eslint-plugin-sonarjs 1.0.4 → 2.0.0

package/lib/helpers/aws/cdk.js

@@ -0,0 +1,293 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeFQN = exports.getLiteralValue = exports.AwsCdkCheckArguments = exports.AwsCdkTemplate = void 0;
+const module_1 = require("../module");
+const ast_1 = require("../ast");
+const AWS_OPTIONS_ARGUMENT_POSITION = 2;
+/**
+ * A rule template for AWS CDK resources
+ *
+ * @param mapOrFactory callbacks to invoke when a new expression or a call expression matches a fully qualified name
+ * @param meta the rule metadata
+ * @returns the instantiated rule module
+ */
+function AwsCdkTemplate(mapOrFactory, meta = {}) {
+    return {
+        meta,
+        create(ctx) {
+            const consumers = typeof mapOrFactory === 'function' ? mapOrFactory(ctx) : mapOrFactory;
+            return {
+                'NewExpression, CallExpression'(node) {
+                    if (node.arguments.some(arg => arg.type === 'SpreadElement')) {
+                        return;
+                    }
+                    for (const fqn in consumers) {
+                        const normalizedExpectedFQN = normalizeFQN(fqn);
+                        const callback = consumers[fqn];
+                        if (typeof callback === 'object' || node.type === 'CallExpression') {
+                            executeIfMatching(node, normalizedExpectedFQN, callback);
+                            continue;
+                        }
+                        const normalizedActualFQN = normalizeFQN((0, module_1.getFullyQualifiedName)(ctx, node.callee));
+                        if (normalizedActualFQN === normalizedExpectedFQN) {
+                            callback(node, ctx);
+                        }
+                    }
+                },
+            };
+            function executeIfMatching(node, expected, callback) {
+                if (typeof callback === 'function') {
+                    return;
+                }
+                const fqn = normalizeFQN((0, module_1.getFullyQualifiedName)(ctx, node.callee));
+                if (node.type === 'NewExpression' && fqn === expected) {
+                    callback.newExpression?.(node, ctx);
+                }
+                else if (isMethodCall(callback, fqn, expected)) {
+                    callback.callExpression(node, ctx, fqn);
+                }
+            }
+            function isMethodCall(callback, fqn, expected) {
+                if (callback.functionName) {
+                    return fqn === `${expected}.${callback.functionName}`;
+                }
+                else if (callback.methods && fqn?.startsWith(expected)) {
+                    const methodNames = fqn.substring(expected.length).split('.');
+                    const methods = callback.methods;
+                    return methodNames.every(name => name === '' || methods.includes(name));
+                }
+                else {
+                    return fqn === expected;
+                }
+            }
+        },
+    };
+}
+exports.AwsCdkTemplate = AwsCdkTemplate;
+/**
+ * Get the messageId at the given position from an array. If a string is used
+ * instead of an array, return it
+ * @param messageId Array of messageIds or single string if only one messageId is used
+ * @param pos
+ */
+function getMessageAtPos(messageId, pos = 0) {
+    if (typeof messageId === 'string') {
+        return messageId;
+    }
+    return messageId[pos];
+}
+/**
+ * Function to analyse arguments in a function and check for correct values. It will report if the
+ * conditions are not met unless `silent = true`, in which case it will return boolean `true`
+ * indicating conditions are not met.
+ *
+ * @param messageId Array of messageIds or single string if only one messageId is used. When an array is passed,
+ *                  first messageId is used for omitted values and second for invalid values.
+ * @param needsProps whether default (undefined) values are allowed or if it must be set
+ * @param propertyName property name to search in the object (Array of strings for nested props)
+ * @param values allowed or disallowed values
+ * @param silent whether the function must report or just return conflicting Node when conditions are not met
+ * @param position position of the argument to be analysed (3rd argument by default)
+ */
+function AwsCdkCheckArguments(messageId, needsProps, propertyName, values, silent = false, position = AWS_OPTIONS_ARGUMENT_POSITION) {
+    return (expr, ctx) => {
+        const argument = expr.arguments[position];
+        // Argument not found or undefined
+        if (!argument || (0, ast_1.isUndefined)(argument)) {
+            if (needsProps) {
+                if (silent) {
+                    return expr.callee;
+                }
+                ctx.report({ messageId: getMessageAtPos(messageId, 0), node: expr.callee });
+            }
+            return;
+        }
+        const properties = traverseProperties({ node: argument, nodeToReport: argument }, typeof propertyName === 'string' ? [propertyName] : propertyName, ctx, getMessageAtPos(messageId, 0), needsProps, silent);
+        if (!Array.isArray(properties)) {
+            return properties;
+        }
+        if (!properties?.length) {
+            return;
+        }
+        for (const property of properties) {
+            const propertyValue = (0, ast_1.getUniqueWriteUsageOrNode)(ctx, property.node.value, true);
+            if ((0, ast_1.isUnresolved)(propertyValue, ctx)) {
+                continue;
+            }
+            /* Property is undefined or an empty array, which is the undefined equivalent
+               for properties with an array-form where we expect multiple nested values */
+            if ((0, ast_1.isUndefined)(propertyValue) ||
+                (propertyValue.type === 'ArrayExpression' && !propertyValue.elements.length)) {
+                if (needsProps) {
+                    if (silent) {
+                        return getNodeToReport(property);
+                    }
+                    ctx.report({ messageId: getMessageAtPos(messageId, 0), node: getNodeToReport(property) });
+                }
+                continue;
+            }
+            // Value is expected to be a primitive (string, number)
+            if (values?.primitives && disallowedValue(ctx, propertyValue, values.primitives)) {
+                if (silent) {
+                    return getNodeToReport(property);
+                }
+                ctx.report({ messageId: getMessageAtPos(messageId, 1), node: getNodeToReport(property) });
+            }
+            // Value is expected to be an Identifier following a specific FQN
+            if (values?.fqns && disallowedFQNs(ctx, propertyValue, values.fqns)) {
+                if (silent) {
+                    return getNodeToReport(property);
+                }
+                ctx.report({ messageId: getMessageAtPos(messageId, 1), node: getNodeToReport(property) });
+            }
+            // The value needs to be validated with a customized function
+            if (values?.customChecker && values.customChecker(ctx, propertyValue)) {
+                if (silent) {
+                    return getNodeToReport(property);
+                }
+                ctx.report({ messageId: getMessageAtPos(messageId, 1), node: getNodeToReport(property) });
+            }
+        }
+    };
+}
+exports.AwsCdkCheckArguments = AwsCdkCheckArguments;
+function getNodeToReport(property) {
+    if (property.nodeToReport.type === 'Property') {
+        return property.nodeToReport.value;
+    }
+    return property.nodeToReport;
+}
+/**
+ * Given an object expression, check for [nested] attributes. If at some level an
+ * array is found, the search for next level properties will be performed on each element
+ * of the array.
+ *
+ * @returns an array of Nodes which have the given property path.
+ *
+ * @param node node to look for the next property.
+ * @param propertyPath pending property paths to traverse
+ * @param ctx rule context
+ * @param messageId messageId to report when path cannot be met and silent = `false`
+ * @param needsProp whether missing (undefined) values are allowed or if it must be set
+ * @param silent whether the function must report or just return conflicting Node when conditions are not met
+ */
+function traverseProperties(node, propertyPath, ctx, messageId, needsProp, silent) {
+    const [propertyName, ...nextElements] = propertyPath;
+    const properties = [];
+    const children = [];
+    if ((0, ast_1.isUnresolved)(node.node, ctx)) {
+        return [];
+    }
+    const objExpr = (0, ast_1.getValueOfExpression)(ctx, node.node, 'ObjectExpression', true);
+    if (objExpr === undefined) {
+        const arrayExpr = (0, ast_1.getValueOfExpression)(ctx, node.node, 'ArrayExpression', true);
+        if (arrayExpr === undefined || !arrayExpr.elements.length) {
+            if (needsProp) {
+                if (silent) {
+                    return node.nodeToReport;
+                }
+                ctx.report({ messageId, node: node.nodeToReport });
+            }
+            return [];
+        }
+        for (const element of arrayExpr.elements) {
+            const elemObjExpr = (0, ast_1.getValueOfExpression)(ctx, element, 'ObjectExpression', true);
+            if (elemObjExpr && element) {
+                children.push({ node: elemObjExpr, nodeToReport: element });
+            }
+        }
+    }
+    else {
+        children.push({ node: objExpr, nodeToReport: node.nodeToReport });
+    }
+    for (const child of children) {
+        const property = (0, ast_1.getProperty)(child.node, propertyName, ctx);
+        if (property === undefined) {
+            continue;
+        }
+        if (!property) {
+            if (needsProp) {
+                if (silent) {
+                    return node.nodeToReport;
+                }
+                ctx.report({ messageId, node: node.nodeToReport });
+            }
+            continue;
+        }
+        if (nextElements.length) {
+            if (child.node === child.nodeToReport &&
+                child.node.properties.includes(property)) {
+                child.nodeToReport = property.value;
+            }
+            child.node = property.value;
+            const nextElementChildren = traverseProperties(child, nextElements, ctx, messageId, needsProp, silent);
+            if (!Array.isArray(nextElementChildren)) {
+                return nextElementChildren;
+            }
+            properties.push(...nextElementChildren);
+        }
+        else {
+            if (child.node === child.nodeToReport &&
+                child.node.properties.includes(property)) {
+                child.nodeToReport = property;
+            }
+            child.node = property;
+            properties.push(child);
+        }
+    }
+    return properties;
+}
+function disallowedValue(ctx, node, values) {
+    const literal = getLiteralValue(ctx, node);
+    if (literal) {
+        if (values.valid?.length) {
+            const found = values.valid.some(value => {
+                if (values.case_insensitive && typeof literal.value === 'string') {
+                    return value.toLowerCase() === literal.value.toLowerCase();
+                }
+                return value === literal.value;
+            });
+            if (!found) {
+                return true;
+            }
+        }
+        if (values.invalid?.length) {
+            const found = values.invalid.some(value => {
+                if (values.case_insensitive && typeof literal.value === 'string') {
+                    return value.toLowerCase() === literal.value.toLowerCase();
+                }
+                return value === literal.value;
+            });
+            if (found) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+function getLiteralValue(ctx, node) {
+    if ((0, ast_1.isLiteral)(node)) {
+        return node;
+    }
+    else if ((0, ast_1.isIdentifier)(node)) {
+        const usage = (0, ast_1.getUniqueWriteUsage)(ctx, node.name, node);
+        if (usage) {
+            return getLiteralValue(ctx, usage);
+        }
+    }
+    return undefined;
+}
+exports.getLiteralValue = getLiteralValue;
+function disallowedFQNs(ctx, node, values) {
+    const normalizedFQN = normalizeFQN((0, module_1.getFullyQualifiedName)(ctx, node));
+    if (values.valid?.length &&
+        (!normalizedFQN || !values.valid.map(normalizeFQN).includes(normalizedFQN))) {
+        return true;
+    }
+    return normalizedFQN && values.invalid?.map(normalizeFQN).includes(normalizedFQN);
+}
+function normalizeFQN(fqn) {
+    return fqn?.replace(/-/g, '_');
+}
+exports.normalizeFQN = normalizeFQN;
+//# sourceMappingURL=cdk.js.map

package/lib/helpers/aws/cdk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cdk.js","sourceRoot":"","sources":["../../../helpers/aws/cdk.ts"],"names":[],"mappings":";;;AAqBA,sCAAkD;AAClD,gCASgB;AAEhB,MAAM,6BAA6B,GAAG,CAAC,CAAC;AA8BxC;;;;;;GAMG;AACH,SAAgB,cAAc,CAC5B,YAAgF,EAChF,OAA0B,EAAE;IAE5B,OAAO;QACL,IAAI;QACJ,MAAM,CAAC,GAAqB;YAC1B,MAAM,SAAS,GAAG,OAAO,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YACxF,OAAO;gBACL,+BAA+B,CAAC,IAAgB;oBAC9C,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,eAAe,CAAC,EAAE,CAAC;wBAC7D,OAAO;oBACT,CAAC;oBACD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;wBAC5B,MAAM,qBAAqB,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;wBAChD,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;wBAChC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;4BACnE,iBAAiB,CAAC,IAAI,EAAE,qBAAsB,EAAE,QAAQ,CAAC,CAAC;4BAC1D,SAAS;wBACX,CAAC;wBACD,MAAM,mBAAmB,GAAG,YAAY,CAAC,IAAA,8BAAqB,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;wBAClF,IAAI,mBAAmB,KAAK,qBAAqB,EAAE,CAAC;4BAClD,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;wBACtB,CAAC;oBACH,CAAC;gBACH,CAAC;aACF,CAAC;YAEF,SAAS,iBAAiB,CAAC,IAAgB,EAAE,QAAgB,EAAE,QAAwB;gBACrF,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;oBACnC,OAAO;gBACT,CAAC;gBAED,MAAM,GAAG,GAAG,YAAY,CAAC,IAAA,8BAAqB,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBAClE,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;oBACtD,QAAQ,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACtC,CAAC;qBAAM,IAAI,YAAY,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;oBACjD,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC;YAED,SAAS,YAAY,CAAC,QAAwB,EAAE,GAAuB,EAAE,QAAgB;gBACvF,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;oBAC1B,OAAO,GAAG,KAAK,GAAG,QAAQ,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;gBACxD,CAAC;qBAAM,IAAI,QAAQ,CAAC,OAAO,IAAI,GAAG,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACzD,MAAM,WAAW,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;oBACjC,OAAO,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC1E,CAAC;qBAAM,CAAC;oBACN,OAAO,GAAG,KAAK,QAAQ,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAtDD,wCAsDC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,SAA4B,EAAE,GAAG,GAAG,CAAC;IAC5D,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,oBAAoB,CAClC,SAA4B,EAC5B,UAAmB,EACnB,YAA+B,EAC/B,MAAqB,EACrB,MAAM,GAAG,KAAK,EACd,QAAQ,GAAG,6BAA6B;IAExC,OAAO,CAAC,IAA0B,EAAE,GAAqB,EAA2B,EAAE;QACpF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAE1C,kCAAkC;QAClC,IAAI,CAAC,QAAQ,IAAI,IAAA,iBAAW,EAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,IAAI,CAAC,MAAM,CAAC;gBACrB,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,kBAAkB,CACnC,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,EAC1C,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,EAChE,GAAG,EACH,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC,EAC7B,UAAU,EACV,MAAM,CACP,CAAC;QAEF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,MAAM,aAAa,GAAG,IAAA,+BAAyB,EAC7C,GAAG,EACF,QAAQ,CAAC,IAAwB,CAAC,KAAK,EACxC,IAAI,CACL,CAAC;YAEF,IAAI,IAAA,kBAAY,EAAC,aAAa,EAAE,GAAG,CAAC,EAAE,CAAC;gBACrC,SAAS;YACX,CAAC;YAED;0FAC8E;YAC9E,IACE,IAAA,iBAAW,EAAC,aAAa,CAAC;gBAC1B,CAAC,aAAa,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC5E,CAAC;gBACD,IAAI,UAAU,EAAE,CAAC;oBACf,IAAI,MAAM,EAAE,CAAC;wBACX,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;oBACnC,CAAC;oBACD,GAAG,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC5F,CAAC;gBACD,SAAS;YACX,CAAC;YAED,uDAAuD;YACvD,IAAI,MAAM,EAAE,UAAU,IAAI,eAAe,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjF,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;gBACnC,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC5F,CAAC;YACD,iEAAiE;YACjE,IAAI,MAAM,EAAE,IAAI,IAAI,cAAc,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpE,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;gBACnC,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC5F,CAAC;YACD,6DAA6D;YAC7D,IAAI,MAAM,EAAE,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC;gBACtE,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;gBACnC,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAxFD,oDAwFC;AAED,SAAS,eAAe,CAAC,QAAuB;IAC9C,IAAI,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9C,OAAO,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC;IACrC,CAAC;IACD,OAAO,QAAQ,CAAC,YAAY,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;GAaG;AAEH,SAAS,kBAAkB,CACzB,IAAmB,EACnB,YAAsB,EACtB,GAAqB,EACrB,SAAiB,EACjB,SAAkB,EAClB,MAAe;IAEf,MAAM,CAAC,YAAY,EAAE,GAAG,YAAY,CAAC,GAAG,YAAY,CAAC;IACrD,MAAM,UAAU,GAAoB,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,IAAI,IAAA,kBAAY,EAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,IAAA,0BAAoB,EAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;IAE/E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,IAAA,0BAAoB,EAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;QAEhF,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC1D,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,IAAI,CAAC,YAAY,CAAC;gBAC3B,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;YACrD,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACzC,MAAM,WAAW,GAAG,IAAA,0BAAoB,EAAC,GAAG,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;YACjF,IAAI,WAAW,IAAI,OAAO,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAA,iBAAW,EAAC,KAAK,CAAC,IAA+B,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;QACvF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,SAAS;QACX,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,IAAI,CAAC,YAAY,CAAC;gBAC3B,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;YACrD,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;YACxB,IACE,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,YAAY;gBAChC,KAAK,CAAC,IAAgC,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACrE,CAAC;gBACD,KAAK,CAAC,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC;YACtC,CAAC;YACD,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC;YAC5B,MAAM,mBAAmB,GAAG,kBAAkB,CAC5C,KAAK,EACL,YAAY,EACZ,GAAG,EACH,SAAS,EACT,SAAS,EACT,MAAM,CACP,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACxC,OAAO,mBAAmB,CAAC;YAC7B,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,IACE,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,YAAY;gBAChC,KAAK,CAAC,IAAgC,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACrE,CAAC;gBACD,KAAK,CAAC,YAAY,GAAG,QAAQ,CAAC;YAChC,CAAC;YACD,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC;YACtB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,eAAe,CAAC,GAAqB,EAAE,IAAiB,EAAE,MAAc;IAC/E,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;gBACtC,IAAI,MAAM,CAAC,gBAAgB,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACjE,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC7D,CAAC;gBACD,OAAO,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC;YACjC,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;gBACxC,IAAI,MAAM,CAAC,gBAAgB,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACjE,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC7D,CAAC;gBACD,OAAO,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC;YACjC,CAAC,CAAC,CAAC;YACH,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,eAAe,CAC7B,GAAqB,EACrB,IAAiB;IAEjB,IAAI,IAAA,eAAS,EAAC,IAAI,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;SAAM,IAAI,IAAA,kBAAY,EAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAA,yBAAmB,EAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAbD,0CAaC;AAED,SAAS,cAAc,CAAC,GAAqB,EAAE,IAAiB,EAAE,MAAc;IAC9E,MAAM,aAAa,GAAG,YAAY,CAAC,IAAA,8BAAqB,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAErE,IACE,MAAM,CAAC,KAAK,EAAE,MAAM;QACpB,CAAC,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,EAC3E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,aAAa,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;AACpF,CAAC;AAED,SAAgB,YAAY,CAAC,GAAmB;IAC9C,OAAO,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACjC,CAAC;AAFD,oCAEC"}

package/lib/helpers/aws/iam.d.ts

@@ -0,0 +1,31 @@
+import { Node } from 'estree';
+import { Rule } from 'eslint';
+import { Result } from '../result';
+import { StringLiteral } from '../ast';
+export interface PolicyCheckerOptions {
+    effect: {
+        property: string;
+        type: 'FullyQualifiedName' | 'string';
+        allowValue: string;
+    };
+    actions: {
+        property: string;
+        anyValues?: string[];
+    };
+    resources: {
+        property: string;
+    };
+    conditions: {
+        property: string;
+    };
+    principals: {
+        property: string;
+        type: 'FullyQualifiedName' | 'json';
+        anyValues?: string[];
+    };
+}
+type StatementChecker = (expr: Node, ctx: Rule.RuleContext, options: PolicyCheckerOptions) => void;
+export declare function AwsIamPolicyTemplate(statementChecker: StatementChecker, meta: Rule.RuleMetaData): Rule.RuleModule;
+export declare function getSensitiveEffect(properties: Result, ctx: Rule.RuleContext, options: PolicyCheckerOptions): Result;
+export declare function isAnyLiteral(literal: StringLiteral): boolean;
+export {};

package/lib/helpers/aws/iam.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAnyLiteral = exports.getSensitiveEffect = exports.AwsIamPolicyTemplate = void 0;
+const cdk_1 = require("./cdk");
+const result_1 = require("../result");
+const ast_1 = require("../ast");
+const module_1 = require("../module");
+const PROPERTIES_POSITION = 0;
+const POLICY_DOCUMENT_STATEMENT_PROPERTY = 'Statement';
+const ARN_PRINCIPAL = 'aws_cdk_lib.aws_iam.ArnPrincipal';
+const STAR_PRINCIPAL = 'aws_cdk_lib.aws_iam.StarPrincipal';
+const ANY_PRINCIPAL = 'aws_cdk_lib.aws_iam.AnyPrincipal';
+const ANY_LITERAL = '*';
+const PROPERTIES_OPTIONS = {
+    effect: {
+        property: 'effect',
+        type: 'FullyQualifiedName',
+        allowValue: 'aws_cdk_lib.aws_iam.Effect.ALLOW',
+    },
+    actions: {
+        property: 'actions',
+    },
+    resources: {
+        property: 'resources',
+    },
+    conditions: {
+        property: 'conditions',
+    },
+    principals: {
+        property: 'principals',
+        type: 'FullyQualifiedName',
+        anyValues: [STAR_PRINCIPAL, ANY_PRINCIPAL, ARN_PRINCIPAL],
+    },
+};
+const JSON_OPTIONS = {
+    effect: {
+        property: 'Effect',
+        type: 'string',
+        allowValue: 'Allow',
+    },
+    actions: {
+        property: 'Action',
+    },
+    resources: {
+        property: 'Resource',
+    },
+    conditions: {
+        property: 'Condition',
+    },
+    principals: {
+        property: 'Principal',
+        type: 'json',
+    },
+};
+function AwsIamPolicyTemplate(statementChecker, meta) {
+    return (0, cdk_1.AwsCdkTemplate)({
+        'aws-cdk-lib.aws-iam.PolicyStatement': {
+            newExpression: policyStatementChecker(statementChecker, PROPERTIES_OPTIONS),
+            functionName: 'fromJson',
+            callExpression: policyStatementChecker(statementChecker, JSON_OPTIONS),
+        },
+        'aws-cdk-lib.aws-iam.PolicyDocument': {
+            functionName: 'fromJson',
+            callExpression: policyDocumentChecker(statementChecker, JSON_OPTIONS),
+        },
+    }, meta);
+}
+exports.AwsIamPolicyTemplate = AwsIamPolicyTemplate;
+function getSensitiveEffect(properties, ctx, options) {
+    const effect = properties.getProperty(options.effect.property);
+    return effect.filter(node => {
+        if (options.effect.type === 'FullyQualifiedName') {
+            const fullyQualifiedName = (0, cdk_1.normalizeFQN)((0, module_1.getFullyQualifiedName)(ctx, node));
+            return fullyQualifiedName === options.effect.allowValue;
+        }
+        else {
+            return (0, ast_1.isStringLiteral)(node) && node.value === options.effect.allowValue;
+        }
+    });
+}
+exports.getSensitiveEffect = getSensitiveEffect;
+function isAnyLiteral(literal) {
+    return literal.value === ANY_LITERAL;
+}
+exports.isAnyLiteral = isAnyLiteral;
+function policyDocumentChecker(statementChecker, options) {
+    return (expr, ctx) => {
+        const call = (0, result_1.getResultOfExpression)(ctx, expr);
+        const properties = call.getArgument(PROPERTIES_POSITION);
+        const statements = properties.getProperty(POLICY_DOCUMENT_STATEMENT_PROPERTY);
+        if (statements.isFound) {
+            for (const node of (0, ast_1.flattenArgs)(ctx, [statements.node])) {
+                statementChecker(node, ctx, options);
+            }
+        }
+    };
+}
+function policyStatementChecker(statementChecker, options) {
+    return (expr, ctx) => {
+        const call = (0, result_1.getResultOfExpression)(ctx, expr);
+        const properties = call.getArgument(PROPERTIES_POSITION);
+        if (properties.isFound) {
+            statementChecker(properties.node, ctx, options);
+        }
+    };
+}
+//# sourceMappingURL=iam.js.map

package/lib/helpers/aws/iam.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam.js","sourceRoot":"","sources":["../../../helpers/aws/iam.ts"],"names":[],"mappings":";;;AAqBA,+BAAqD;AACrD,sCAA0D;AAC1D,gCAAqE;AACrE,sCAAkD;AA2BlD,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B,MAAM,kCAAkC,GAAG,WAAW,CAAC;AAEvD,MAAM,aAAa,GAAG,kCAAkC,CAAC;AACzD,MAAM,cAAc,GAAG,mCAAmC,CAAC;AAC3D,MAAM,aAAa,GAAG,kCAAkC,CAAC;AAEzD,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB,MAAM,kBAAkB,GAAyB;IAC/C,MAAM,EAAE;QACN,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,oBAAoB;QAC1B,UAAU,EAAE,kCAAkC;KAC/C;IACD,OAAO,EAAE;QACP,QAAQ,EAAE,SAAS;KACpB;IACD,SAAS,EAAE;QACT,QAAQ,EAAE,WAAW;KACtB;IACD,UAAU,EAAE;QACV,QAAQ,EAAE,YAAY;KACvB;IACD,UAAU,EAAE;QACV,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,oBAAoB;QAC1B,SAAS,EAAE,CAAC,cAAc,EAAE,aAAa,EAAE,aAAa,CAAC;KAC1D;CACF,CAAC;AAEF,MAAM,YAAY,GAAyB;IACzC,MAAM,EAAE;QACN,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,OAAO;KACpB;IACD,OAAO,EAAE;QACP,QAAQ,EAAE,QAAQ;KACnB;IACD,SAAS,EAAE;QACT,QAAQ,EAAE,UAAU;KACrB;IACD,UAAU,EAAE;QACV,QAAQ,EAAE,WAAW;KACtB;IACD,UAAU,EAAE;QACV,QAAQ,EAAE,WAAW;QACrB,IAAI,EAAE,MAAM;KACb;CACF,CAAC;AAEF,SAAgB,oBAAoB,CAAC,gBAAkC,EAAE,IAAuB;IAC9F,OAAO,IAAA,oBAAc,EACnB;QACE,qCAAqC,EAAE;YACrC,aAAa,EAAE,sBAAsB,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;YAC3E,YAAY,EAAE,UAAU;YACxB,cAAc,EAAE,sBAAsB,CAAC,gBAAgB,EAAE,YAAY,CAAC;SACvE;QACD,oCAAoC,EAAE;YACpC,YAAY,EAAE,UAAU;YACxB,cAAc,EAAE,qBAAqB,CAAC,gBAAgB,EAAE,YAAY,CAAC;SACtE;KACF,EACD,IAAI,CACL,CAAC;AACJ,CAAC;AAfD,oDAeC;AAED,SAAgB,kBAAkB,CAChC,UAAkB,EAClB,GAAqB,EACrB,OAA6B;IAE7B,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QAC1B,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACjD,MAAM,kBAAkB,GAAG,IAAA,kBAAY,EAAC,IAAA,8BAAqB,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YAC1E,OAAO,kBAAkB,KAAK,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,OAAO,IAAA,qBAAe,EAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAdD,gDAcC;AAED,SAAgB,YAAY,CAAC,OAAsB;IACjD,OAAO,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC;AACvC,CAAC;AAFD,oCAEC;AAED,SAAS,qBAAqB,CAAC,gBAAkC,EAAE,OAA6B;IAC9F,OAAO,CAAC,IAAoB,EAAE,GAAqB,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,IAAA,8BAAqB,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,UAAU,CAAC,WAAW,CAAC,kCAAkC,CAAC,CAAC;QAE9E,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,KAAK,MAAM,IAAI,IAAI,IAAA,iBAAW,EAAC,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACvD,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,gBAAkC,EAAE,OAA6B;IAC/F,OAAO,CAAC,IAAoC,EAAE,GAAqB,EAAE,EAAE;QACrE,MAAM,IAAI,GAAG,IAAA,8BAAqB,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;QAEzD,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/lib/helpers/aws/index.d.ts

@@ -0,0 +1,3 @@
+export * from './cdk';
+export * from './iam';
+export * from './s3';

package/lib/helpers/aws/index.js

@@ -0,0 +1,39 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/*
+ * SonarQube JavaScript Plugin
+ * Copyright (C) 2011-2024 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+__exportStar(require("./cdk"), exports);
+__exportStar(require("./iam"), exports);
+__exportStar(require("./s3"), exports);
+//# sourceMappingURL=index.js.map

package/lib/helpers/aws/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../helpers/aws/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,wCAAsB;AACtB,wCAAsB;AACtB,uCAAqB"}

package/lib/helpers/aws/s3.d.ts

@@ -0,0 +1,51 @@
+import { Rule } from 'eslint';
+import * as estree from 'estree';
+import { IssueLocation } from '..';
+/**
+ * A rule template for AWS S3 Buckets
+ *
+ * The rule template allows to detect sensitive configuration passed on
+ * the invocation of S3 Bucket's constructor from AWS CDK:
+ *
+ * ```new s3.Bucket(...)```
+ *
+ * @param callback the callback invoked on visiting S3 Bucket's instantiation
+ * @param meta the instantiated rule metadata
+ * @returns the instantiated rule definition
+ */
+export declare function S3BucketTemplate(callback: (bucketConstructor: estree.NewExpression, context: Rule.RuleContext) => void, meta?: Rule.RuleMetaData): Rule.RuleModule;
+/**
+ * Detects S3 Bucket's constructor invocation from 'aws-cdk-lib/aws-s3':
+ *
+ * const s3 = require('aws-cdk-lib/aws-s3');
+ * new s3.Bucket();
+ */
+export declare function isS3BucketConstructor(context: Rule.RuleContext, node: estree.NewExpression): boolean;
+/**
+ * Detects S3 BucketDeployment's constructor invocation from 'aws-cdk-lib/aws-s3-deployment':
+ *
+ * const s3 = require('aws-cdk-lib/aws-s3-deployment');
+ * new s3.BucketDeployment();
+ */
+export declare function isS3BucketDeploymentConstructor(context: Rule.RuleContext, node: estree.NewExpression): boolean;
+/**
+ * Extracts a property from the configuration argument of S3 Bucket's constructor
+ *
+ * ```
+ * new s3.Bucket(_, _, { // config
+ *  key1: value1,
+ *  ...
+ *  keyN: valueN
+ * });
+ * ```
+ *
+ * @param context the rule context
+ * @param bucket the invocation of S3 Bucket's constructor
+ * @param key the key of the property to extract
+ * @returns the extracted property
+ */
+export declare function getBucketProperty(context: Rule.RuleContext, bucket: estree.NewExpression, key: string): estree.Property | null | undefined;
+/**
+ * Finds the propagated setting of a sensitive property
+ */
+export declare function findPropagatedSetting(sensitiveProperty: estree.Property, propagatedValue: estree.Node): IssueLocation | undefined;

package/lib/helpers/aws/s3.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findPropagatedSetting = exports.getBucketProperty = exports.isS3BucketDeploymentConstructor = exports.isS3BucketConstructor = exports.S3BucketTemplate = void 0;
+const __1 = require("..");
+const cdk_1 = require("./cdk");
+/**
+ * A rule template for AWS S3 Buckets
+ *
+ * The rule template allows to detect sensitive configuration passed on
+ * the invocation of S3 Bucket's constructor from AWS CDK:
+ *
+ * ```new s3.Bucket(...)```
+ *
+ * @param callback the callback invoked on visiting S3 Bucket's instantiation
+ * @param meta the instantiated rule metadata
+ * @returns the instantiated rule definition
+ */
+function S3BucketTemplate(callback, meta = {}) {
+    return {
+        meta,
+        create(context) {
+            return {
+                NewExpression: (node) => {
+                    if (isS3BucketConstructor(context, node)) {
+                        callback(node, context);
+                    }
+                },
+            };
+        },
+    };
+}
+exports.S3BucketTemplate = S3BucketTemplate;
+/**
+ * Detects S3 Bucket's constructor invocation from 'aws-cdk-lib/aws-s3':
+ *
+ * const s3 = require('aws-cdk-lib/aws-s3');
+ * new s3.Bucket();
+ */
+function isS3BucketConstructor(context, node) {
+    return (0, cdk_1.normalizeFQN)((0, __1.getFullyQualifiedName)(context, node)) === 'aws_cdk_lib.aws_s3.Bucket';
+}
+exports.isS3BucketConstructor = isS3BucketConstructor;
+/**
+ * Detects S3 BucketDeployment's constructor invocation from 'aws-cdk-lib/aws-s3-deployment':
+ *
+ * const s3 = require('aws-cdk-lib/aws-s3-deployment');
+ * new s3.BucketDeployment();
+ */
+function isS3BucketDeploymentConstructor(context, node) {
+    return ((0, cdk_1.normalizeFQN)((0, __1.getFullyQualifiedName)(context, node)) ===
+        'aws_cdk_lib.aws_s3_deployment.BucketDeployment');
+}
+exports.isS3BucketDeploymentConstructor = isS3BucketDeploymentConstructor;
+/**
+ * Extracts a property from the configuration argument of S3 Bucket's constructor
+ *
+ * ```
+ * new s3.Bucket(_, _, { // config
+ *  key1: value1,
+ *  ...
+ *  keyN: valueN
+ * });
+ * ```
+ *
+ * @param context the rule context
+ * @param bucket the invocation of S3 Bucket's constructor
+ * @param key the key of the property to extract
+ * @returns the extracted property
+ */
+function getBucketProperty(context, bucket, key) {
+    const args = bucket.arguments;
+    const optionsArg = args[2];
+    const options = (0, __1.getValueOfExpression)(context, optionsArg, 'ObjectExpression');
+    if (options == null) {
+        return null;
+    }
+    return options.properties.find(property => (0, __1.isProperty)(property) && (0, __1.isIdentifier)(property.key, key));
+}
+exports.getBucketProperty = getBucketProperty;
+/**
+ * Finds the propagated setting of a sensitive property
+ */
+function findPropagatedSetting(sensitiveProperty, propagatedValue) {
+    const isPropagatedProperty = sensitiveProperty.value !== propagatedValue;
+    if (isPropagatedProperty) {
+        return (0, __1.toSecondaryLocation)((0, __1.getNodeParent)(propagatedValue), 'Propagated setting.');
+    }
+    return undefined;
+}
+exports.findPropagatedSetting = findPropagatedSetting;
+//# sourceMappingURL=s3.js.map

package/lib/helpers/aws/s3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3.js","sourceRoot":"","sources":["../../../helpers/aws/s3.ts"],"names":[],"mappings":";;;AAqBA,0BAQY;AACZ,+BAAqC;AAErC;;;;;;;;;;;GAWG;AACH,SAAgB,gBAAgB,CAC9B,QAAsF,EACtF,OAA0B,EAAE;IAE5B,OAAO;QACL,IAAI;QACJ,MAAM,CAAC,OAAyB;YAC9B,OAAO;gBACL,aAAa,EAAE,CAAC,IAA0B,EAAE,EAAE;oBAC5C,IAAI,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;wBACzC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;oBAC1B,CAAC;gBACH,CAAC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAhBD,4CAgBC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CAAC,OAAyB,EAAE,IAA0B;IACzF,OAAO,IAAA,kBAAY,EAAC,IAAA,yBAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,2BAA2B,CAAC;AAC5F,CAAC;AAFD,sDAEC;AAED;;;;;GAKG;AACH,SAAgB,+BAA+B,CAC7C,OAAyB,EACzB,IAA0B;IAE1B,OAAO,CACL,IAAA,kBAAY,EAAC,IAAA,yBAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClD,gDAAgD,CACjD,CAAC;AACJ,CAAC;AARD,0EAQC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,iBAAiB,CAC/B,OAAyB,EACzB,MAA4B,EAC5B,GAAW;IAEX,MAAM,IAAI,GAAG,MAAM,CAAC,SAAgC,CAAC;IAErD,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAA,wBAAoB,EAAC,OAAO,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC;IAC9E,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,OAAO,CAAC,UAAU,CAAC,IAAI,CAC5B,QAAQ,CAAC,EAAE,CAAC,IAAA,cAAU,EAAC,QAAQ,CAAC,IAAI,IAAA,gBAAY,EAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CACrC,CAAC;AACnC,CAAC;AAhBD,8CAgBC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CACnC,iBAAkC,EAClC,eAA4B;IAE5B,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,KAAK,KAAK,eAAe,CAAC;IACzE,IAAI,oBAAoB,EAAE,CAAC;QACzB,OAAO,IAAA,uBAAmB,EAAC,IAAA,iBAAa,EAAC,eAAe,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AATD,sDASC"}

package/lib/helpers/chai.d.ts

@@ -0,0 +1,6 @@
+import { Rule } from 'eslint';
+import * as estree from 'estree';
+export declare namespace Chai {
+    function isImported(context: Rule.RuleContext): boolean;
+    function isAssertion(context: Rule.RuleContext, node: estree.Node): boolean;
+}