eslint-plugin-sonarjs 4.0.0 → 4.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +269 -268
- package/cjs/S100/rule.js +7 -5
- package/cjs/S101/rule.js +2 -2
- package/cjs/S104/rule.js +2 -2
- package/cjs/S105/rule.js +2 -2
- package/cjs/S1066/rule.js +5 -4
- package/cjs/S1067/rule.js +8 -6
- package/cjs/S1110/rule.js +7 -5
- package/cjs/S1119/rule.js +85 -7
- package/cjs/S1121/rule.js +4 -3
- package/cjs/S1125/rule.js +9 -8
- package/cjs/S1126/rule.js +2 -2
- package/cjs/S1128/rule.js +8 -5
- package/cjs/S1134/rule.js +2 -2
- package/cjs/S1135/rule.js +2 -2
- package/cjs/S1154/rule.js +6 -4
- package/cjs/S117/rule.js +6 -5
- package/cjs/S1172/rule.js +2 -2
- package/cjs/S1192/rule.js +5 -4
- package/cjs/S1219/rule.js +4 -3
- package/cjs/S1226/rule.js +6 -4
- package/cjs/S124/rule.js +2 -2
- package/cjs/S125/rule.js +9 -7
- package/cjs/S126/rule.js +2 -2
- package/cjs/S1264/rule.js +2 -2
- package/cjs/S128/rule.js +4 -3
- package/cjs/S1291/rule.js +2 -2
- package/cjs/S1301/rule.js +2 -2
- package/cjs/S1313/rule.js +2 -2
- package/cjs/S134/rule.js +7 -5
- package/cjs/S135/rule.js +5 -4
- package/cjs/S138/rule.js +9 -6
- package/cjs/S1439/rule.js +2 -2
- package/cjs/S1444/rule.js +2 -2
- package/cjs/S1451/rule.js +2 -2
- package/cjs/S1472/rule.js +2 -2
- package/cjs/S1479/rule.js +2 -2
- package/cjs/S1481/rule.js +2 -2
- package/cjs/S1488/generated-meta.js +1 -1
- package/cjs/S1488/rule.js +11 -7
- package/cjs/S1515/rule.js +10 -8
- package/cjs/{helpers/aws/index.js → S1523/generated-meta.js} +34 -18
- package/cjs/S1523/index.js +21 -0
- package/cjs/S1523/meta.js +21 -0
- package/cjs/S1523/rule.js +143 -0
- package/cjs/S1526/rule.js +5 -4
- package/cjs/S1527/rule.js +2 -2
- package/cjs/S1528/rule.js +2 -2
- package/cjs/S1529/generated-meta.js +1 -1
- package/cjs/S1529/rule.js +4 -3
- package/cjs/S1530/rule.js +5 -3
- package/cjs/S1533/rule.js +2 -2
- package/cjs/S1535/rule.js +2 -2
- package/cjs/S1541/rule.js +10 -7
- package/cjs/S1607/rule.js +22 -20
- package/cjs/S1764/rule.js +10 -7
- package/cjs/S1821/rule.js +2 -2
- package/cjs/S1848/rule.js +10 -7
- package/cjs/S1854/rule.js +18 -14
- package/cjs/S1862/rule.js +10 -8
- package/cjs/S1871/rule.js +21 -16
- package/cjs/S1874/rule.js +4 -3
- package/cjs/S1940/rule.js +2 -2
- package/cjs/S1994/rule.js +10 -7
- package/cjs/S2004/rule.js +9 -7
- package/cjs/S2068/rule.js +75 -12
- package/cjs/S2077/generated-meta.js +1 -1
- package/cjs/S2077/rule.js +10 -6
- package/cjs/S2092/rule.js +2 -2
- package/cjs/S2123/rule.js +2 -2
- package/cjs/S2137/rule.js +2 -2
- package/cjs/S2138/rule.js +4 -3
- package/cjs/S2187/rule.js +2 -2
- package/cjs/S2201/rule.js +47 -5
- package/cjs/S2208/rule.js +2 -2
- package/cjs/S2234/rule.js +58 -11
- package/cjs/S2245/rule.js +4 -3
- package/cjs/S2251/rule.js +5 -4
- package/cjs/S2255/rule.js +6 -5
- package/cjs/S2259/rule.js +14 -9
- package/cjs/S2301/rule.js +14 -9
- package/cjs/S2310/rule.js +80 -9
- package/cjs/S2392/rule.js +7 -5
- package/cjs/S2424/rule.js +2 -2
- package/cjs/S2428/rule.js +8 -6
- package/cjs/S2486/rule.js +4 -3
- package/cjs/S2589/rule.js +12 -10
- package/cjs/S2598/rule.js +17 -14
- package/cjs/S2612/generated-meta.js +1 -1
- package/cjs/S2612/rule.js +8 -6
- package/cjs/S2639/rule.js +2 -2
- package/cjs/S2681/rule.js +2 -2
- package/cjs/S2692/rule.js +6 -4
- package/cjs/S2699/generated-meta.js +1 -1
- package/cjs/S2699/rule.js +40 -31
- package/cjs/S2703/rule.js +2 -2
- package/cjs/S2737/rule.js +6 -4
- package/cjs/S2755/rule.js +9 -6
- package/cjs/S2757/rule.js +2 -2
- package/cjs/S2817/rule.js +10 -7
- package/cjs/S2819/rule.js +16 -12
- package/cjs/S2870/rule.js +8 -5
- package/cjs/S2871/rule.js +12 -9
- package/cjs/S2970/rule.js +9 -8
- package/cjs/S2990/rule.js +2 -2
- package/cjs/S2999/rule.js +10 -7
- package/cjs/S3001/rule.js +2 -2
- package/cjs/S3003/rule.js +10 -7
- package/cjs/S3317/rule.js +4 -3
- package/cjs/S3330/rule.js +2 -2
- package/cjs/S3358/rule.js +2 -2
- package/cjs/S3402/rule.js +14 -10
- package/cjs/S3403/rule.js +10 -7
- package/cjs/S3415/rule.js +16 -13
- package/cjs/S3499/rule.js +5 -4
- package/cjs/S3500/rule.js +5 -4
- package/cjs/S3513/rule.js +5 -4
- package/cjs/S3514/rule.js +10 -7
- package/cjs/S3516/rule.js +10 -7
- package/cjs/S3524/rule.js +2 -2
- package/cjs/S3525/rule.js +6 -4
- package/cjs/S3531/rule.js +5 -3
- package/cjs/S3533/rule.js +8 -7
- package/cjs/S3579/rule.js +6 -4
- package/cjs/S3616/rule.js +6 -4
- package/cjs/S3626/rule.js +4 -3
- package/cjs/S3686/rule.js +7 -5
- package/cjs/S3699/rule.js +4 -3
- package/cjs/S3735/rule.js +8 -5
- package/cjs/S3757/rule.js +8 -6
- package/cjs/S3758/rule.js +9 -7
- package/cjs/S3760/rule.js +24 -21
- package/cjs/S3776/rule.js +26 -22
- package/cjs/S3782/rule.js +6 -4
- package/cjs/S3785/rule.js +9 -6
- package/cjs/S3796/rule.js +12 -8
- package/cjs/S3798/rule.js +4 -3
- package/cjs/S3800/rule.js +22 -11
- package/cjs/S3801/generated-meta.js +1 -1
- package/cjs/S3801/rule.js +15 -11
- package/cjs/S3827/rule.js +9 -6
- package/cjs/S3923/rule.js +9 -6
- package/cjs/S3972/rule.js +5 -4
- package/cjs/S3973/rule.js +7 -5
- package/cjs/S3981/rule.js +4 -3
- package/cjs/S3984/rule.js +4 -3
- package/cjs/S4030/rule.js +10 -7
- package/cjs/S4036/rule.js +7 -5
- package/cjs/S4043/rule.js +12 -8
- package/cjs/S4139/rule.js +7 -5
- package/cjs/S4143/rule.js +12 -9
- package/cjs/S4144/rule.js +12 -9
- package/cjs/S4158/rule.js +11 -8
- package/cjs/S4165/rule.js +14 -12
- package/cjs/S4322/rule.js +8 -5
- package/cjs/S4323/rule.js +4 -3
- package/cjs/S4324/rule.js +7 -5
- package/cjs/S4328/rule.js +2 -2
- package/cjs/S4335/rule.js +6 -4
- package/cjs/S4423/rule.js +4 -3
- package/cjs/S4423/rule.lib.js +8 -7
- package/cjs/S4426/rule.js +11 -10
- package/cjs/S4502/rule.js +16 -13
- package/cjs/S4507/rule.js +8 -6
- package/cjs/S4524/rule.js +2 -2
- package/cjs/S4619/rule.js +6 -4
- package/cjs/S4621/rule.js +5 -4
- package/cjs/S4622/rule.js +5 -3
- package/cjs/S4623/rule.js +8 -5
- package/cjs/S4624/rule.js +6 -4
- package/cjs/S4634/rule.js +4 -3
- package/cjs/S4721/rule.js +7 -5
- package/cjs/S4782/rule.js +7 -5
- package/cjs/S4784/rule.js +5 -4
- package/cjs/S4787/rule.js +9 -7
- package/cjs/S4790/rule.js +7 -5
- package/cjs/S4798/rule.js +2 -2
- package/cjs/S4817/rule.js +10 -8
- package/cjs/S4818/rule.js +4 -3
- package/cjs/S4822/rule.js +13 -9
- package/cjs/S4823/rule.js +4 -3
- package/cjs/S4829/rule.js +4 -3
- package/cjs/S4830/rule.js +11 -8
- package/cjs/S5042/rule.js +9 -7
- package/cjs/S5122/rule.js +40 -36
- package/cjs/S5148/rule.js +9 -8
- package/cjs/S5247/rule.js +22 -18
- package/cjs/S5256/rule.js +5 -4
- package/cjs/S5257/rule.js +4 -3
- package/cjs/S5260/rule.js +4 -3
- package/cjs/S5264/rule.js +4 -3
- package/cjs/S5332/rule.js +4 -3
- package/cjs/S5332/rule.lib.js +19 -17
- package/cjs/S5443/rule.js +2 -2
- package/cjs/S5527/rule.js +18 -14
- package/cjs/S5542/rule.js +6 -4
- package/cjs/S5547/rule.js +6 -4
- package/cjs/S5604/rule.js +15 -14
- package/cjs/S5659/rule.js +15 -12
- package/cjs/S5689/rule.js +11 -8
- package/cjs/S5691/rule.js +7 -5
- package/cjs/S5693/rule.js +14 -12
- package/cjs/S5725/rule.js +9 -6
- package/cjs/S5728/rule.js +7 -4
- package/cjs/S5730/rule.js +9 -6
- package/cjs/S5732/rule.js +8 -5
- package/cjs/S5734/rule.js +7 -4
- package/cjs/S5736/rule.js +8 -5
- package/cjs/S5739/rule.js +11 -8
- package/cjs/S5742/rule.js +7 -4
- package/cjs/S5743/rule.js +8 -6
- package/cjs/S5757/rule.js +13 -10
- package/cjs/S5759/rule.js +10 -7
- package/cjs/S5842/rule.js +2 -2
- package/cjs/S5843/rule.js +22 -19
- package/cjs/S5850/rule.js +4 -3
- package/cjs/S5852/rule.js +2 -2
- package/cjs/S5856/rule.js +10 -7
- package/cjs/S5860/rule.js +30 -26
- package/cjs/S5863/rule.js +15 -11
- package/cjs/S5867/rule.js +8 -7
- package/cjs/S5868/rule.js +7 -5
- package/cjs/S5869/rule.js +6 -5
- package/cjs/S5876/rule.js +12 -8
- package/cjs/S5958/rule.js +12 -9
- package/cjs/S5973/rule.js +10 -7
- package/cjs/S6019/rule.js +4 -3
- package/cjs/S6035/rule.js +2 -2
- package/cjs/S6079/rule.js +9 -6
- package/cjs/S6080/rule.js +13 -10
- package/cjs/S6092/rule.js +9 -7
- package/cjs/S6245/rule.js +14 -9
- package/cjs/S6249/rule.js +7 -5
- package/cjs/S6252/rule.js +12 -8
- package/cjs/S6265/rule.js +27 -20
- package/cjs/S6268/rule.js +5 -4
- package/cjs/S6270/rule.js +12 -9
- package/cjs/S6275/rule.js +2 -2
- package/cjs/S6281/rule.js +22 -17
- package/cjs/S6299/rule.js +2 -2
- package/cjs/S6302/rule.js +6 -5
- package/cjs/S6303/rule.js +12 -10
- package/cjs/S6304/rule.js +6 -5
- package/cjs/S6308/rule.js +7 -5
- package/cjs/S6317/rule.js +5 -4
- package/cjs/S6319/rule.js +2 -2
- package/cjs/S6321/rule.js +25 -23
- package/cjs/S6323/rule.js +4 -3
- package/cjs/S6324/rule.js +2 -2
- package/cjs/S6326/rule.js +2 -2
- package/cjs/S6327/rule.js +2 -2
- package/cjs/S6328/rule.js +4 -3
- package/cjs/S6329/rule.js +7 -5
- package/cjs/S6330/rule.js +2 -2
- package/cjs/S6332/rule.js +2 -2
- package/cjs/S6333/rule.js +8 -6
- package/cjs/S6351/rule.js +22 -19
- package/cjs/S6353/rule.js +2 -2
- package/cjs/S6397/rule.js +2 -2
- package/cjs/S6418/config.js +1 -1
- package/cjs/S6418/rule.js +9 -24
- package/cjs/S6426/rule.js +5 -4
- package/cjs/S6437/rule.js +10 -7
- package/cjs/S6439/rule.js +9 -7
- package/cjs/S6442/rule.js +11 -8
- package/cjs/S6443/rule.js +9 -7
- package/cjs/S6486/rule.js +5 -4
- package/cjs/S6564/rule.js +4 -3
- package/cjs/S6594/rule.js +12 -8
- package/cjs/S6627/rule.js +6 -4
- package/cjs/S6759/rule.js +10 -6
- package/cjs/S6958/rule.js +2 -2
- package/cjs/S6959/rule.js +9 -6
- package/cjs/S7059/generated-meta.js +1 -1
- package/cjs/S7059/rule.js +8 -5
- package/cjs/S7639/generated-meta.js +1 -1
- package/cjs/S7639/rule.js +5 -4
- package/cjs/S7790/generated-meta.js +1 -1
- package/cjs/S7790/rule.js +7 -5
- package/cjs/S8441/generated-meta.js +1 -1
- package/cjs/S8441/rule.js +13 -9
- package/cjs/S881/rule.js +2 -2
- package/cjs/S888/rule.js +4 -3
- package/cjs/S930/rule.js +14 -12
- package/cjs/helpers/ast.js +11 -8
- package/cjs/helpers/aws/s3.js +9 -6
- package/cjs/helpers/chai.js +41 -43
- package/cjs/helpers/configs.js +92 -0
- package/cjs/helpers/cookie-flag-check.js +19 -17
- package/cjs/helpers/{decorators/index.js → entropy.js} +16 -17
- package/cjs/helpers/express.js +127 -128
- package/cjs/helpers/find-up/all-in-parent-dirs.js +0 -16
- package/cjs/helpers/mocha.js +50 -54
- package/cjs/helpers/regex/ast.js +7 -6
- package/cjs/helpers/regex/extract.js +11 -11
- package/cjs/helpers/regex/group.js +2 -2
- package/cjs/helpers/regex/location.js +2 -2
- package/cjs/helpers/regex/range.js +5 -4
- package/cjs/helpers/regex/rule-template.js +4 -3
- package/cjs/helpers/sinon.js +33 -36
- package/cjs/helpers/supertest.js +34 -37
- package/cjs/helpers/vitest.js +29 -32
- package/cjs/plugin-rules.js +452 -450
- package/docs/assertions-in-tests.md +2 -0
- package/docs/bitwise-operators.md +2 -0
- package/docs/code-eval.md +7 -0
- package/docs/file-permissions.md +1 -1
- package/docs/no-async-constructor.md +2 -0
- package/docs/no-inconsistent-returns.md +2 -0
- package/docs/prefer-immediate-return.md +2 -0
- package/docs/sql-queries.md +2 -0
- package/package.json +39 -1
- package/types/S1067/rule.d.ts +1 -1
- package/types/S1110/rule.d.ts +1 -1
- package/types/S1128/rule.d.ts +1 -1
- package/types/S1172/rule.d.ts +1 -1
- package/types/S1226/rule.d.ts +1 -1
- package/types/S134/rule.d.ts +1 -1
- package/types/S1472/rule.d.ts +1 -1
- package/types/S1481/rule.d.ts +1 -1
- package/types/S1488/generated-meta.d.ts +1 -1
- package/types/S1515/rule.d.ts +1 -1
- package/types/S1523/generated-meta.d.ts +17 -0
- package/types/S1523/index.d.ts +1 -0
- package/types/S1523/meta.d.ts +2 -0
- package/types/S1523/rule.d.ts +2 -0
- package/types/S1527/rule.d.ts +1 -1
- package/types/S1529/generated-meta.d.ts +1 -1
- package/types/S1541/rule.d.ts +1 -1
- package/types/S1862/rule.d.ts +1 -1
- package/types/S2077/generated-meta.d.ts +1 -1
- package/types/S2123/rule.d.ts +1 -1
- package/types/S2259/rule.d.ts +1 -1
- package/types/S2428/rule.d.ts +1 -1
- package/types/S2589/rule.d.ts +1 -1
- package/types/S2598/rule.d.ts +1 -1
- package/types/S2699/generated-meta.d.ts +1 -1
- package/types/S2699/rule.d.ts +1 -1
- package/types/S2737/rule.d.ts +1 -1
- package/types/S2757/rule.d.ts +1 -1
- package/types/S2819/rule.d.ts +1 -1
- package/types/S3001/rule.d.ts +1 -1
- package/types/S3317/rule.d.ts +1 -1
- package/types/S3500/rule.d.ts +1 -1
- package/types/S3513/rule.d.ts +1 -1
- package/types/S3686/rule.d.ts +1 -1
- package/types/S3801/generated-meta.d.ts +1 -1
- package/types/S3972/rule.d.ts +1 -1
- package/types/S3973/rule.d.ts +1 -1
- package/types/S4030/rule.d.ts +1 -1
- package/types/S4143/rule.d.ts +1 -1
- package/types/S4158/rule.d.ts +1 -1
- package/types/S4621/rule.d.ts +1 -1
- package/types/S4782/rule.d.ts +1 -1
- package/types/S5693/rule.d.ts +1 -1
- package/types/S5725/rule.d.ts +1 -1
- package/types/S5860/rule.d.ts +1 -1
- package/types/S5868/rule.d.ts +1 -1
- package/types/S5869/rule.d.ts +1 -1
- package/types/S6079/rule.d.ts +1 -1
- package/types/S6326/rule.d.ts +1 -1
- package/types/S6351/rule.d.ts +1 -1
- package/types/S6418/config.d.ts +1 -1
- package/types/S6443/rule.d.ts +1 -1
- package/types/S7059/generated-meta.d.ts +1 -1
- package/types/S7639/generated-meta.d.ts +1 -1
- package/types/S7790/generated-meta.d.ts +1 -1
- package/types/S8441/generated-meta.d.ts +1 -1
- package/types/S930/rule.d.ts +1 -1
- package/types/helpers/ancestor.d.ts +3 -3
- package/types/helpers/ast.d.ts +1 -1
- package/types/helpers/aws/iam.d.ts +2 -2
- package/types/helpers/aws/s3.d.ts +1 -1
- package/types/helpers/chai.d.ts +3 -5
- package/types/helpers/configs.d.ts +39 -1
- package/types/helpers/entropy.d.ts +1 -0
- package/types/helpers/equivalence.d.ts +1 -1
- package/types/helpers/express.d.ts +38 -43
- package/types/helpers/find-up/all-in-parent-dirs.d.ts +1 -1
- package/types/helpers/find-up/closest.d.ts +1 -1
- package/types/helpers/find-up/find-minimatch.d.ts +1 -1
- package/types/helpers/generate-meta.d.ts +1 -1
- package/types/helpers/mocha.d.ts +19 -21
- package/types/helpers/module.d.ts +1 -1
- package/types/helpers/package-jsons/all-in-parent-dirs.d.ts +1 -1
- package/types/helpers/package-jsons/dependencies.d.ts +1 -1
- package/types/helpers/recognizers/CodeRecognizer.d.ts +1 -1
- package/types/helpers/recognizers/JavaScriptFootPrint.d.ts +2 -2
- package/types/helpers/recognizers/LanguageFootprint.d.ts +1 -1
- package/types/helpers/regex/alternation.d.ts +1 -1
- package/types/helpers/regex/ast.d.ts +1 -1
- package/types/helpers/regex/location.d.ts +2 -2
- package/types/helpers/regex/range.d.ts +2 -2
- package/types/helpers/regex/rule-template.d.ts +1 -1
- package/types/helpers/result.d.ts +1 -1
- package/types/helpers/sinon.d.ts +4 -6
- package/types/helpers/sonar-runtime.d.ts +1 -1
- package/types/helpers/supertest.d.ts +4 -6
- package/types/helpers/type.d.ts +1 -1
- package/types/helpers/vitest.d.ts +4 -6
- package/types/plugin-rules.d.ts +1 -0
- package/cjs/helpers/decorators/interceptor.js +0 -88
- package/cjs/helpers/index.js +0 -60
- package/cjs/helpers/recognizers/index.js +0 -37
- package/cjs/helpers/rule-detect-react.js +0 -29
- package/cjs/helpers/validate-version.js +0 -94
- package/types/helpers/aws/index.d.ts +0 -3
- package/types/helpers/decorators/index.d.ts +0 -2
- package/types/helpers/decorators/interceptor.d.ts +0 -16
- package/types/helpers/index.d.ts +0 -28
- package/types/helpers/recognizers/index.d.ts +0 -2
- package/types/helpers/rule-detect-react.d.ts +0 -2
- package/types/helpers/validate-version.d.ts +0 -13
package/cjs/S5527/rule.js
CHANGED
|
@@ -51,10 +51,14 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
51
51
|
})();
|
|
52
52
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
53
53
|
exports.rule = void 0;
|
|
54
|
-
const
|
|
54
|
+
const location_js_1 = require("../helpers/location.js");
|
|
55
|
+
const ancestor_js_1 = require("../helpers/ancestor.js");
|
|
56
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
57
|
+
const module_js_1 = require("../helpers/module.js");
|
|
58
|
+
const ast_js_1 = require("../helpers/ast.js");
|
|
55
59
|
const meta = __importStar(require("./generated-meta.js"));
|
|
56
60
|
exports.rule = {
|
|
57
|
-
meta: (0,
|
|
61
|
+
meta: (0, generate_meta_js_1.generateMeta)(meta),
|
|
58
62
|
create(context) {
|
|
59
63
|
const MESSAGE = 'Enable server hostname verification on this SSL/TLS connection.';
|
|
60
64
|
const SECONDARY_MESSAGE = 'Set "rejectUnauthorized" to "true".';
|
|
@@ -65,26 +69,26 @@ exports.rule = {
|
|
|
65
69
|
const sensitiveArgument = callExpression.arguments[sensitiveArgumentIndex];
|
|
66
70
|
const secondaryLocations = [];
|
|
67
71
|
let shouldReport = false;
|
|
68
|
-
const argumentValue = (0,
|
|
72
|
+
const argumentValue = (0, ast_js_1.getValueOfExpression)(context, sensitiveArgument, 'ObjectExpression');
|
|
69
73
|
if (!argumentValue) {
|
|
70
74
|
return;
|
|
71
75
|
}
|
|
72
76
|
if (sensitiveArgument !== argumentValue) {
|
|
73
|
-
secondaryLocations.push((0,
|
|
77
|
+
secondaryLocations.push((0, location_js_1.toSecondaryLocation)(argumentValue));
|
|
74
78
|
}
|
|
75
|
-
const unsafeRejectUnauthorizedConfiguration = (0,
|
|
79
|
+
const unsafeRejectUnauthorizedConfiguration = (0, ast_js_1.getPropertyWithValue)(context, argumentValue, 'rejectUnauthorized', false);
|
|
76
80
|
if (unsafeRejectUnauthorizedConfiguration) {
|
|
77
|
-
secondaryLocations.push((0,
|
|
81
|
+
secondaryLocations.push((0, location_js_1.toSecondaryLocation)(unsafeRejectUnauthorizedConfiguration, SECONDARY_MESSAGE));
|
|
78
82
|
shouldReport = true;
|
|
79
83
|
}
|
|
80
|
-
const checkServerIdentityProperty = (0,
|
|
84
|
+
const checkServerIdentityProperty = (0, ast_js_1.getProperty)(argumentValue, 'checkServerIdentity', context);
|
|
81
85
|
if (checkServerIdentityProperty &&
|
|
82
86
|
shouldReportOnCheckServerIdentityCallBack(checkServerIdentityProperty)) {
|
|
83
|
-
secondaryLocations.push((0,
|
|
87
|
+
secondaryLocations.push((0, location_js_1.toSecondaryLocation)(checkServerIdentityProperty));
|
|
84
88
|
shouldReport = true;
|
|
85
89
|
}
|
|
86
90
|
if (shouldReport) {
|
|
87
|
-
(0,
|
|
91
|
+
(0, location_js_1.report)(context, {
|
|
88
92
|
node: callExpression.callee,
|
|
89
93
|
message: MESSAGE,
|
|
90
94
|
}, secondaryLocations);
|
|
@@ -92,12 +96,12 @@ exports.rule = {
|
|
|
92
96
|
}
|
|
93
97
|
function shouldReportOnCheckServerIdentityCallBack(checkServerIdentityProperty) {
|
|
94
98
|
let baseFunction;
|
|
95
|
-
baseFunction = (0,
|
|
96
|
-
baseFunction ??= (0,
|
|
99
|
+
baseFunction = (0, ast_js_1.getValueOfExpression)(context, checkServerIdentityProperty.value, 'FunctionExpression');
|
|
100
|
+
baseFunction ??= (0, ast_js_1.getValueOfExpression)(context, checkServerIdentityProperty.value, 'ArrowFunctionExpression');
|
|
97
101
|
if (baseFunction?.body.type === 'BlockStatement') {
|
|
98
102
|
const returnStatements = ReturnStatementsVisitor.getReturnStatements(baseFunction.body, context);
|
|
99
103
|
if (returnStatements.every(r => {
|
|
100
|
-
return (!r.argument || (0,
|
|
104
|
+
return (!r.argument || (0, ast_js_1.getValueOfExpression)(context, r.argument, 'Literal')?.value === true);
|
|
101
105
|
})) {
|
|
102
106
|
return true;
|
|
103
107
|
}
|
|
@@ -107,7 +111,7 @@ exports.rule = {
|
|
|
107
111
|
return {
|
|
108
112
|
CallExpression: (node) => {
|
|
109
113
|
const callExpression = node;
|
|
110
|
-
const fqn = (0,
|
|
114
|
+
const fqn = (0, module_js_1.getFullyQualifiedName)(context, callExpression);
|
|
111
115
|
if (fqn === 'https.request') {
|
|
112
116
|
checkSensitiveArgument(callExpression, 0);
|
|
113
117
|
}
|
|
@@ -141,7 +145,7 @@ class ReturnStatementsVisitor {
|
|
|
141
145
|
case 'ArrowFunctionExpression':
|
|
142
146
|
return;
|
|
143
147
|
}
|
|
144
|
-
for (const childNode of (0,
|
|
148
|
+
for (const childNode of (0, ancestor_js_1.childrenOf)(node, context.sourceCode.visitorKeys)) {
|
|
145
149
|
visitNode(childNode);
|
|
146
150
|
}
|
|
147
151
|
};
|
package/cjs/S5542/rule.js
CHANGED
|
@@ -51,7 +51,9 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
51
51
|
})();
|
|
52
52
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
53
53
|
exports.rule = void 0;
|
|
54
|
-
const
|
|
54
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
55
|
+
const module_js_1 = require("../helpers/module.js");
|
|
56
|
+
const ast_js_1 = require("../helpers/ast.js");
|
|
55
57
|
const meta = __importStar(require("./generated-meta.js"));
|
|
56
58
|
const aliases = [
|
|
57
59
|
'AES128',
|
|
@@ -75,7 +77,7 @@ const aliases = [
|
|
|
75
77
|
'SEED',
|
|
76
78
|
];
|
|
77
79
|
exports.rule = {
|
|
78
|
-
meta: (0,
|
|
80
|
+
meta: (0, generate_meta_js_1.generateMeta)(meta, {
|
|
79
81
|
messages: {
|
|
80
82
|
useSecureMode: 'Use a secure mode and padding scheme.',
|
|
81
83
|
},
|
|
@@ -88,11 +90,11 @@ exports.rule = {
|
|
|
88
90
|
return {
|
|
89
91
|
CallExpression: (node) => {
|
|
90
92
|
const callExpression = node;
|
|
91
|
-
if ((0,
|
|
93
|
+
if ((0, module_js_1.getFullyQualifiedName)(context, callExpression) !== 'crypto.createCipheriv') {
|
|
92
94
|
return;
|
|
93
95
|
}
|
|
94
96
|
const sensitiveArgument = callExpression.arguments[0];
|
|
95
|
-
const sensitiveArgumentValue = (0,
|
|
97
|
+
const sensitiveArgumentValue = (0, ast_js_1.getValueOfExpression)(context, sensitiveArgument, 'Literal');
|
|
96
98
|
if (!sensitiveArgumentValue) {
|
|
97
99
|
return;
|
|
98
100
|
}
|
package/cjs/S5547/rule.js
CHANGED
|
@@ -51,11 +51,13 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
51
51
|
})();
|
|
52
52
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
53
53
|
exports.rule = void 0;
|
|
54
|
-
const
|
|
54
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
55
|
+
const module_js_1 = require("../helpers/module.js");
|
|
56
|
+
const ast_js_1 = require("../helpers/ast.js");
|
|
55
57
|
const meta = __importStar(require("./generated-meta.js"));
|
|
56
58
|
const WEAK_CIPHERS = ['bf', 'blowfish', 'des', 'rc2', 'rc4'];
|
|
57
59
|
exports.rule = {
|
|
58
|
-
meta: (0,
|
|
60
|
+
meta: (0, generate_meta_js_1.generateMeta)(meta, {
|
|
59
61
|
messages: {
|
|
60
62
|
strongerCipher: 'Use a strong cipher algorithm.',
|
|
61
63
|
},
|
|
@@ -64,8 +66,8 @@ exports.rule = {
|
|
|
64
66
|
return {
|
|
65
67
|
CallExpression(node) {
|
|
66
68
|
const callExpression = node;
|
|
67
|
-
if ((0,
|
|
68
|
-
const algorithm = (0,
|
|
69
|
+
if ((0, module_js_1.getFullyQualifiedName)(context, callExpression) === 'crypto.createCipheriv') {
|
|
70
|
+
const algorithm = (0, ast_js_1.getValueOfExpression)(context, callExpression.arguments[0], 'Literal');
|
|
69
71
|
const algorithmValue = algorithm?.value?.toString().toLowerCase();
|
|
70
72
|
if (algorithm &&
|
|
71
73
|
algorithmValue &&
|
package/cjs/S5604/rule.js
CHANGED
|
@@ -51,7 +51,8 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
51
51
|
})();
|
|
52
52
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
53
53
|
exports.rule = void 0;
|
|
54
|
-
const
|
|
54
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
55
|
+
const ast_js_1 = require("../helpers/ast.js");
|
|
55
56
|
const meta = __importStar(require("./generated-meta.js"));
|
|
56
57
|
const GEOLOCATION = 'geolocation';
|
|
57
58
|
const CAMERA = 'camera';
|
|
@@ -70,7 +71,7 @@ const messages = {
|
|
|
70
71
|
checkPermission: 'Make sure the use of the {{feature}} is necessary.',
|
|
71
72
|
};
|
|
72
73
|
exports.rule = {
|
|
73
|
-
meta: (0,
|
|
74
|
+
meta: (0, generate_meta_js_1.generateMeta)(meta, { messages }),
|
|
74
75
|
create(context) {
|
|
75
76
|
const permissions = context.options[0]?.permissions ?? DEFAULT_PERMISSIONS;
|
|
76
77
|
return {
|
|
@@ -95,12 +96,12 @@ exports.rule = {
|
|
|
95
96
|
}
|
|
96
97
|
if (isNavigatorMemberExpression(callee, 'mediaDevices', 'getUserMedia') &&
|
|
97
98
|
call.arguments.length > 0) {
|
|
98
|
-
const firstArg = (0,
|
|
99
|
+
const firstArg = (0, ast_js_1.getValueOfExpression)(context, call.arguments[0], 'ObjectExpression');
|
|
99
100
|
checkForCameraAndMicrophonePermissions(context, permissions, callee, firstArg);
|
|
100
101
|
return;
|
|
101
102
|
}
|
|
102
103
|
if (permissions.includes(NOTIFICATIONS) &&
|
|
103
|
-
(0,
|
|
104
|
+
(0, ast_js_1.isMemberExpression)(callee, 'Notification', 'requestPermission')) {
|
|
104
105
|
context.report({
|
|
105
106
|
messageId: 'checkPermission',
|
|
106
107
|
data: {
|
|
@@ -111,7 +112,7 @@ exports.rule = {
|
|
|
111
112
|
return;
|
|
112
113
|
}
|
|
113
114
|
if (permissions.includes(PERSISTENT_STORAGE) &&
|
|
114
|
-
(0,
|
|
115
|
+
(0, ast_js_1.isMemberExpression)(callee.object, 'navigator', 'storage')) {
|
|
115
116
|
context.report({
|
|
116
117
|
messageId: 'checkPermission',
|
|
117
118
|
data: {
|
|
@@ -123,7 +124,7 @@ exports.rule = {
|
|
|
123
124
|
},
|
|
124
125
|
NewExpression(node) {
|
|
125
126
|
const { callee } = node;
|
|
126
|
-
if (permissions.includes(NOTIFICATIONS) && (0,
|
|
127
|
+
if (permissions.includes(NOTIFICATIONS) && (0, ast_js_1.isIdentifier)(callee, 'Notification')) {
|
|
127
128
|
context.report({
|
|
128
129
|
messageId: 'checkPermission',
|
|
129
130
|
data: {
|
|
@@ -149,10 +150,10 @@ function checkForCameraAndMicrophonePermissions(context, permissions, callee, fi
|
|
|
149
150
|
for (const prop of firstArg.properties) {
|
|
150
151
|
if (prop.type === 'Property') {
|
|
151
152
|
const { value, key } = prop;
|
|
152
|
-
if ((0,
|
|
153
|
+
if ((0, ast_js_1.isIdentifier)(key, 'audio') && shouldCheckAudio && isOtherThanFalse(context, value)) {
|
|
153
154
|
perms.push('microphone');
|
|
154
155
|
}
|
|
155
|
-
else if ((0,
|
|
156
|
+
else if ((0, ast_js_1.isIdentifier)(key, 'video') &&
|
|
156
157
|
shouldCheckVideo &&
|
|
157
158
|
isOtherThanFalse(context, value)) {
|
|
158
159
|
perms.push(CAMERA);
|
|
@@ -170,14 +171,14 @@ function checkForCameraAndMicrophonePermissions(context, permissions, callee, fi
|
|
|
170
171
|
}
|
|
171
172
|
}
|
|
172
173
|
function isOtherThanFalse(context, value) {
|
|
173
|
-
const exprValue = (0,
|
|
174
|
+
const exprValue = (0, ast_js_1.getValueOfExpression)(context, value, 'Literal');
|
|
174
175
|
if (exprValue?.value === false) {
|
|
175
176
|
return false;
|
|
176
177
|
}
|
|
177
178
|
return true;
|
|
178
179
|
}
|
|
179
180
|
function checkPermissions(context, call, permissions) {
|
|
180
|
-
const firstArg = (0,
|
|
181
|
+
const firstArg = (0, ast_js_1.getValueOfExpression)(context, call.arguments[0], 'ObjectExpression');
|
|
181
182
|
if (firstArg?.type === 'ObjectExpression') {
|
|
182
183
|
const nameProp = firstArg.properties.find(prop => hasNamePropertyWithPermission(prop, context, permissions));
|
|
183
184
|
if (nameProp) {
|
|
@@ -193,12 +194,12 @@ function checkPermissions(context, call, permissions) {
|
|
|
193
194
|
}
|
|
194
195
|
}
|
|
195
196
|
function isNavigatorMemberExpression({ object, property }, firstProperty, ...secondProperty) {
|
|
196
|
-
return ((0,
|
|
197
|
-
(0,
|
|
197
|
+
return ((0, ast_js_1.isMemberExpression)(object, 'navigator', firstProperty) &&
|
|
198
|
+
(0, ast_js_1.isIdentifier)(property, ...secondProperty));
|
|
198
199
|
}
|
|
199
200
|
function hasNamePropertyWithPermission(prop, context, permissions) {
|
|
200
|
-
if (prop.type === 'Property' && (0,
|
|
201
|
-
const value = (0,
|
|
201
|
+
if (prop.type === 'Property' && (0, ast_js_1.isIdentifier)(prop.key, 'name')) {
|
|
202
|
+
const value = (0, ast_js_1.getValueOfExpression)(context, prop.value, 'Literal');
|
|
202
203
|
return (value &&
|
|
203
204
|
typeof value.value === 'string' &&
|
|
204
205
|
supportedPermissions.has(value.value) &&
|
package/cjs/S5659/rule.js
CHANGED
|
@@ -51,18 +51,21 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
51
51
|
})();
|
|
52
52
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
53
53
|
exports.rule = void 0;
|
|
54
|
-
const
|
|
54
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
55
|
+
const module_js_1 = require("../helpers/module.js");
|
|
56
|
+
const ast_js_1 = require("../helpers/ast.js");
|
|
57
|
+
const location_js_1 = require("../helpers/location.js");
|
|
55
58
|
const meta = __importStar(require("./generated-meta.js"));
|
|
56
59
|
exports.rule = {
|
|
57
|
-
meta: (0,
|
|
60
|
+
meta: (0, generate_meta_js_1.generateMeta)(meta),
|
|
58
61
|
create(context) {
|
|
59
62
|
const SIGN_MESSAGE = 'Use only strong cipher algorithms when signing this JWT.';
|
|
60
63
|
const VERIFY_MESSAGE = 'Use only strong cipher algorithms when verifying the signature of this JWT.';
|
|
61
64
|
const SECONDARY_MESSAGE = `The "algorithms" option should be defined and should not contain 'none'.`;
|
|
62
65
|
function checkCallToSign(callExpression, thirdArgumentValue, secondaryLocations) {
|
|
63
|
-
const unsafeAlgorithmProperty = (0,
|
|
66
|
+
const unsafeAlgorithmProperty = (0, ast_js_1.getPropertyWithValue)(context, thirdArgumentValue, 'algorithm', 'none');
|
|
64
67
|
if (unsafeAlgorithmProperty) {
|
|
65
|
-
const unsafeAlgorithmValue = (0,
|
|
68
|
+
const unsafeAlgorithmValue = (0, ast_js_1.getValueOfExpression)(context, unsafeAlgorithmProperty.value, 'Literal');
|
|
66
69
|
if (unsafeAlgorithmValue && unsafeAlgorithmValue !== unsafeAlgorithmProperty.value) {
|
|
67
70
|
secondaryLocations.push(unsafeAlgorithmValue);
|
|
68
71
|
}
|
|
@@ -70,19 +73,19 @@ exports.rule = {
|
|
|
70
73
|
}
|
|
71
74
|
}
|
|
72
75
|
function checkCallToVerify(callExpression, publicKey, thirdArgumentValue, secondaryLocations) {
|
|
73
|
-
const algorithmsProperty = (0,
|
|
76
|
+
const algorithmsProperty = (0, ast_js_1.getProperty)(thirdArgumentValue, 'algorithms', context);
|
|
74
77
|
if (!algorithmsProperty) {
|
|
75
|
-
if ((0,
|
|
78
|
+
if ((0, ast_js_1.isNullLiteral)(publicKey)) {
|
|
76
79
|
raiseIssueOn(callExpression.callee, VERIFY_MESSAGE, secondaryLocations);
|
|
77
80
|
}
|
|
78
81
|
return;
|
|
79
82
|
}
|
|
80
|
-
const algorithmsValue = (0,
|
|
83
|
+
const algorithmsValue = (0, ast_js_1.getValueOfExpression)(context, algorithmsProperty.value, 'ArrayExpression');
|
|
81
84
|
if (!algorithmsValue) {
|
|
82
85
|
return;
|
|
83
86
|
}
|
|
84
87
|
const algorithmsContainNone = algorithmsValue.elements.some(e => {
|
|
85
|
-
const value = (0,
|
|
88
|
+
const value = (0, ast_js_1.getValueOfExpression)(context, e, 'Literal');
|
|
86
89
|
return value?.value === 'none';
|
|
87
90
|
});
|
|
88
91
|
if (algorithmsContainNone) {
|
|
@@ -93,15 +96,15 @@ exports.rule = {
|
|
|
93
96
|
}
|
|
94
97
|
}
|
|
95
98
|
function raiseIssueOn(node, message, secondaryLocations) {
|
|
96
|
-
(0,
|
|
99
|
+
(0, location_js_1.report)(context, {
|
|
97
100
|
node,
|
|
98
101
|
message,
|
|
99
|
-
}, secondaryLocations.map(node => (0,
|
|
102
|
+
}, secondaryLocations.map(node => (0, location_js_1.toSecondaryLocation)(node, SECONDARY_MESSAGE)));
|
|
100
103
|
}
|
|
101
104
|
return {
|
|
102
105
|
CallExpression: (node) => {
|
|
103
106
|
const callExpression = node;
|
|
104
|
-
const fqn = (0,
|
|
107
|
+
const fqn = (0, module_js_1.getFullyQualifiedName)(context, callExpression);
|
|
105
108
|
const isCallToSign = fqn === 'jsonwebtoken.sign';
|
|
106
109
|
const isCallToVerify = fqn === 'jsonwebtoken.verify';
|
|
107
110
|
if (!isCallToSign && !isCallToVerify) {
|
|
@@ -112,7 +115,7 @@ exports.rule = {
|
|
|
112
115
|
return;
|
|
113
116
|
}
|
|
114
117
|
const thirdArgument = callExpression.arguments[2];
|
|
115
|
-
const thirdArgumentValue = (0,
|
|
118
|
+
const thirdArgumentValue = (0, ast_js_1.getValueOfExpression)(context, thirdArgument, 'ObjectExpression');
|
|
116
119
|
if (!thirdArgumentValue) {
|
|
117
120
|
return;
|
|
118
121
|
}
|
package/cjs/S5689/rule.js
CHANGED
|
@@ -51,7 +51,10 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
51
51
|
})();
|
|
52
52
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
53
53
|
exports.rule = void 0;
|
|
54
|
-
const
|
|
54
|
+
const express_js_1 = require("../helpers/express.js");
|
|
55
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
56
|
+
const module_js_1 = require("../helpers/module.js");
|
|
57
|
+
const ast_js_1 = require("../helpers/ast.js");
|
|
55
58
|
const meta = __importStar(require("./generated-meta.js"));
|
|
56
59
|
const HELMET = 'helmet';
|
|
57
60
|
const HIDE_POWERED_BY = 'hide-powered-by';
|
|
@@ -60,7 +63,7 @@ const PROTECTING_MIDDLEWARES = [HELMET, HIDE_POWERED_BY];
|
|
|
60
63
|
/** Expected number of arguments in `app.set`. */
|
|
61
64
|
const APP_SET_NUM_ARGS = 2;
|
|
62
65
|
exports.rule = {
|
|
63
|
-
meta: (0,
|
|
66
|
+
meta: (0, generate_meta_js_1.generateMeta)(meta, {
|
|
64
67
|
messages: {
|
|
65
68
|
headerSet: 'Make sure disclosing the fingerprinting of this web technology is safe here.',
|
|
66
69
|
headerDefault: 'This framework implicitly discloses version information by default. Make sure it is safe here.',
|
|
@@ -80,7 +83,7 @@ exports.rule = {
|
|
|
80
83
|
if (!isSafe && appInstantiation) {
|
|
81
84
|
const callExpr = node;
|
|
82
85
|
isSafe =
|
|
83
|
-
|
|
86
|
+
(0, express_js_1.isUsingMiddleware)(context, callExpr, appInstantiation, isProtecting(context)) ||
|
|
84
87
|
isDisabledXPoweredBy(callExpr, appInstantiation) ||
|
|
85
88
|
isSetFalseXPoweredBy(callExpr, appInstantiation) ||
|
|
86
89
|
isAppEscaping(callExpr, appInstantiation);
|
|
@@ -90,7 +93,7 @@ exports.rule = {
|
|
|
90
93
|
VariableDeclarator: (node) => {
|
|
91
94
|
if (!isSafe && !appInstantiation) {
|
|
92
95
|
const varDecl = node;
|
|
93
|
-
const app =
|
|
96
|
+
const app = (0, express_js_1.attemptFindAppInstantiation)(varDecl, context);
|
|
94
97
|
if (app) {
|
|
95
98
|
appInstantiation = app;
|
|
96
99
|
}
|
|
@@ -122,16 +125,16 @@ exports.rule = {
|
|
|
122
125
|
*/
|
|
123
126
|
function isHidePoweredByFromHelmet(context, n) {
|
|
124
127
|
if (n.type === 'CallExpression') {
|
|
125
|
-
return (0,
|
|
128
|
+
return (0, module_js_1.getFullyQualifiedName)(context, n) === `${HELMET}.hidePoweredBy`;
|
|
126
129
|
}
|
|
127
130
|
return false;
|
|
128
131
|
}
|
|
129
132
|
function isProtecting(context) {
|
|
130
|
-
return (n) =>
|
|
133
|
+
return (n) => (0, express_js_1.isMiddlewareInstance)(context, PROTECTING_MIDDLEWARES, n) ||
|
|
131
134
|
isHidePoweredByFromHelmet(context, n);
|
|
132
135
|
}
|
|
133
136
|
function isDisabledXPoweredBy(callExpression, app) {
|
|
134
|
-
if ((0,
|
|
137
|
+
if ((0, ast_js_1.isMethodInvocation)(callExpression, app.name, 'disable', 1)) {
|
|
135
138
|
const arg0 = callExpression.arguments[0];
|
|
136
139
|
return arg0.type === 'Literal' && String(arg0.value).toLowerCase() === HEADER_X_POWERED_BY;
|
|
137
140
|
}
|
|
@@ -144,7 +147,7 @@ function isSetTrueXPoweredBy(callExpression, app) {
|
|
|
144
147
|
return getSetTrueXPoweredByValue(callExpression, app) === true;
|
|
145
148
|
}
|
|
146
149
|
function getSetTrueXPoweredByValue(callExpression, app) {
|
|
147
|
-
if ((0,
|
|
150
|
+
if ((0, ast_js_1.isMethodInvocation)(callExpression, app.name, 'set', APP_SET_NUM_ARGS)) {
|
|
148
151
|
const [headerName, onOff] = callExpression.arguments;
|
|
149
152
|
if (headerName.type === 'Literal' &&
|
|
150
153
|
String(headerName.value).toLowerCase() === HEADER_X_POWERED_BY &&
|
package/cjs/S5691/rule.js
CHANGED
|
@@ -51,11 +51,13 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
51
51
|
})();
|
|
52
52
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
53
53
|
exports.rule = void 0;
|
|
54
|
-
const
|
|
54
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
55
|
+
const module_js_1 = require("../helpers/module.js");
|
|
56
|
+
const ast_js_1 = require("../helpers/ast.js");
|
|
55
57
|
const meta = __importStar(require("./generated-meta.js"));
|
|
56
58
|
const SERVE_STATIC = 'serve-static';
|
|
57
59
|
exports.rule = {
|
|
58
|
-
meta: (0,
|
|
60
|
+
meta: (0, generate_meta_js_1.generateMeta)(meta, {
|
|
59
61
|
messages: {
|
|
60
62
|
safeHiddenFile: 'Make sure serving hidden files is safe here.',
|
|
61
63
|
},
|
|
@@ -65,12 +67,12 @@ exports.rule = {
|
|
|
65
67
|
CallExpression(node) {
|
|
66
68
|
// serveStatic(...)
|
|
67
69
|
const { callee, arguments: args } = node;
|
|
68
|
-
if ((0,
|
|
70
|
+
if ((0, module_js_1.getFullyQualifiedName)(context, callee) === SERVE_STATIC && args.length > 1) {
|
|
69
71
|
let options = args[1];
|
|
70
72
|
if (options.type === 'Identifier') {
|
|
71
|
-
options = (0,
|
|
73
|
+
options = (0, ast_js_1.getUniqueWriteUsage)(context, options.name, node);
|
|
72
74
|
}
|
|
73
|
-
const dotfilesProperty = (0,
|
|
75
|
+
const dotfilesProperty = (0, ast_js_1.getProperty)(options, 'dotfiles', context);
|
|
74
76
|
if (dotfilesProperty?.value.type === 'Literal' &&
|
|
75
77
|
dotfilesProperty.value.value === 'allow') {
|
|
76
78
|
context.report({ node: dotfilesProperty, messageId: 'safeHiddenFile' });
|
package/cjs/S5693/rule.js
CHANGED
|
@@ -53,7 +53,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
53
53
|
exports.rule = void 0;
|
|
54
54
|
const rule_js_1 = require("../S2598/rule.js");
|
|
55
55
|
const bytes_1 = require("bytes");
|
|
56
|
-
const
|
|
56
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
57
|
+
const module_js_1 = require("../helpers/module.js");
|
|
58
|
+
const ast_js_1 = require("../helpers/ast.js");
|
|
57
59
|
const meta = __importStar(require("./generated-meta.js"));
|
|
58
60
|
const FORMIDABLE_MODULE = 'formidable';
|
|
59
61
|
const MAX_FILE_SIZE = 'maxFileSize';
|
|
@@ -72,7 +74,7 @@ const messages = {
|
|
|
72
74
|
safeLimit: 'Make sure the content length limit is safe here.',
|
|
73
75
|
};
|
|
74
76
|
exports.rule = {
|
|
75
|
-
meta: (0,
|
|
77
|
+
meta: (0, generate_meta_js_1.generateMeta)(meta, { messages }),
|
|
76
78
|
create(context) {
|
|
77
79
|
return {
|
|
78
80
|
NewExpression(node) {
|
|
@@ -107,7 +109,7 @@ function checkCallExpression(context, callExpression) {
|
|
|
107
109
|
else {
|
|
108
110
|
return;
|
|
109
111
|
}
|
|
110
|
-
const fqn = (0,
|
|
112
|
+
const fqn = (0, module_js_1.getFullyQualifiedName)(context, identifierFromModule);
|
|
111
113
|
if (!fqn) {
|
|
112
114
|
return;
|
|
113
115
|
}
|
|
@@ -125,7 +127,7 @@ function checkCallExpression(context, callExpression) {
|
|
|
125
127
|
function checkFormidable(context, callExpression) {
|
|
126
128
|
if (callExpression.arguments.length === 0) {
|
|
127
129
|
// options will be set later through member assignment
|
|
128
|
-
const formVariable = (0,
|
|
130
|
+
const formVariable = (0, ast_js_1.getLhsVariable)(context, callExpression);
|
|
129
131
|
if (formVariable) {
|
|
130
132
|
formidableObjects.set(formVariable, {
|
|
131
133
|
maxFileSize: FORMIDABLE_DEFAULT_SIZE,
|
|
@@ -134,9 +136,9 @@ function checkFormidable(context, callExpression) {
|
|
|
134
136
|
}
|
|
135
137
|
return;
|
|
136
138
|
}
|
|
137
|
-
const options = (0,
|
|
139
|
+
const options = (0, ast_js_1.getValueOfExpression)(context, callExpression.arguments[0], 'ObjectExpression');
|
|
138
140
|
if (options) {
|
|
139
|
-
const property = (0,
|
|
141
|
+
const property = (0, ast_js_1.getProperty)(options, MAX_FILE_SIZE, context);
|
|
140
142
|
checkSize(context, callExpression, property, FORMIDABLE_DEFAULT_SIZE);
|
|
141
143
|
}
|
|
142
144
|
}
|
|
@@ -148,13 +150,13 @@ function checkMulter(context, callExpression) {
|
|
|
148
150
|
report(context, callExpression.callee);
|
|
149
151
|
return;
|
|
150
152
|
}
|
|
151
|
-
const multerOptions = (0,
|
|
153
|
+
const multerOptions = (0, ast_js_1.getValueOfExpression)(context, callExpression.arguments[0], 'ObjectExpression');
|
|
152
154
|
if (!multerOptions) {
|
|
153
155
|
return;
|
|
154
156
|
}
|
|
155
|
-
const limitsPropertyValue = (0,
|
|
157
|
+
const limitsPropertyValue = (0, ast_js_1.getProperty)(multerOptions, LIMITS_OPTION, context)?.value;
|
|
156
158
|
if (limitsPropertyValue?.type === 'ObjectExpression') {
|
|
157
|
-
const fileSizeProperty = (0,
|
|
159
|
+
const fileSizeProperty = (0, ast_js_1.getProperty)(limitsPropertyValue, FILE_SIZE_OPTION, context);
|
|
158
160
|
checkSize(context, callExpression, fileSizeProperty);
|
|
159
161
|
}
|
|
160
162
|
if (!limitsPropertyValue) {
|
|
@@ -166,11 +168,11 @@ function checkBodyParser(context, callExpression) {
|
|
|
166
168
|
checkSize(context, callExpression, undefined, BODY_PARSER_DEFAULT_SIZE, true);
|
|
167
169
|
return;
|
|
168
170
|
}
|
|
169
|
-
const options = (0,
|
|
171
|
+
const options = (0, ast_js_1.getValueOfExpression)(context, callExpression.arguments[0], 'ObjectExpression');
|
|
170
172
|
if (!options) {
|
|
171
173
|
return;
|
|
172
174
|
}
|
|
173
|
-
const limitsProperty = (0,
|
|
175
|
+
const limitsProperty = (0, ast_js_1.getProperty)(options, LIMITS_OPTION, context);
|
|
174
176
|
checkSize(context, callExpression, limitsProperty, BODY_PARSER_DEFAULT_SIZE, true);
|
|
175
177
|
}
|
|
176
178
|
function checkSize(context, callExpr, property, defaultLimit, useStandardSizeLimit = false) {
|
|
@@ -203,7 +205,7 @@ function visitAssignment(context, assignment) {
|
|
|
203
205
|
}
|
|
204
206
|
}
|
|
205
207
|
function getSizeValue(context, node) {
|
|
206
|
-
const literal = (0,
|
|
208
|
+
const literal = (0, ast_js_1.getValueOfExpression)(context, node, 'Literal');
|
|
207
209
|
if (literal) {
|
|
208
210
|
if (typeof literal.value === 'number') {
|
|
209
211
|
return literal.value;
|
package/cjs/S5725/rule.js
CHANGED
|
@@ -51,17 +51,20 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
51
51
|
})();
|
|
52
52
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
53
53
|
exports.rule = void 0;
|
|
54
|
-
const
|
|
54
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
55
|
+
const type_js_1 = require("../helpers/type.js");
|
|
56
|
+
const ast_js_1 = require("../helpers/ast.js");
|
|
57
|
+
const parser_services_js_1 = require("../helpers/parser-services.js");
|
|
55
58
|
const meta = __importStar(require("./generated-meta.js"));
|
|
56
59
|
exports.rule = {
|
|
57
|
-
meta: (0,
|
|
60
|
+
meta: (0, generate_meta_js_1.generateMeta)(meta, {
|
|
58
61
|
messages: {
|
|
59
62
|
safeResource: 'Make sure not using resource integrity feature is safe here.',
|
|
60
63
|
},
|
|
61
64
|
}),
|
|
62
65
|
create(context) {
|
|
63
66
|
const services = context.sourceCode.parserServices;
|
|
64
|
-
if (!(0,
|
|
67
|
+
if (!(0, parser_services_js_1.isRequiredParserServices)(services)) {
|
|
65
68
|
return {};
|
|
66
69
|
}
|
|
67
70
|
return {
|
|
@@ -76,9 +79,9 @@ exports.rule = {
|
|
|
76
79
|
if (callee.type !== 'MemberExpression') {
|
|
77
80
|
return;
|
|
78
81
|
}
|
|
79
|
-
const typeName = (0,
|
|
80
|
-
if (!(0,
|
|
81
|
-
!(0,
|
|
82
|
+
const typeName = (0, type_js_1.getTypeAsString)(left, services);
|
|
83
|
+
if (!(0, ast_js_1.isIdentifier)(callee.object, 'document') ||
|
|
84
|
+
!(0, ast_js_1.isIdentifier)(callee.property, 'createElement') ||
|
|
82
85
|
typeName !== 'HTMLScriptElement') {
|
|
83
86
|
return;
|
|
84
87
|
}
|
package/cjs/S5728/rule.js
CHANGED
|
@@ -51,11 +51,14 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
51
51
|
})();
|
|
52
52
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
53
53
|
exports.rule = void 0;
|
|
54
|
-
const
|
|
54
|
+
const express_js_1 = require("../helpers/express.js");
|
|
55
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
56
|
+
const module_js_1 = require("../helpers/module.js");
|
|
57
|
+
const ast_js_1 = require("../helpers/ast.js");
|
|
55
58
|
const meta = __importStar(require("./generated-meta.js"));
|
|
56
59
|
const HELMET = 'helmet';
|
|
57
60
|
const CONTENT_SECURITY_POLICY = 'contentSecurityPolicy';
|
|
58
|
-
exports.rule =
|
|
61
|
+
exports.rule = (0, express_js_1.SensitiveMiddlewarePropertyRule)(findFalseContentSecurityPolicyPropertyFromHelmet, `Make sure not enabling content security policy fetch directives is safe here.`, (0, generate_meta_js_1.generateMeta)(meta));
|
|
59
62
|
/**
|
|
60
63
|
* Looks for property `contentSecurityPolicy: false` in node looking
|
|
61
64
|
* somewhat similar to `helmet(<options>?)`, and returns it.
|
|
@@ -63,10 +66,10 @@ exports.rule = index_js_1.Express.SensitiveMiddlewarePropertyRule(findFalseConte
|
|
|
63
66
|
function findFalseContentSecurityPolicyPropertyFromHelmet(context, node) {
|
|
64
67
|
let sensitive;
|
|
65
68
|
const { callee, arguments: args } = node;
|
|
66
|
-
if ((0,
|
|
69
|
+
if ((0, module_js_1.getFullyQualifiedName)(context, callee) === HELMET &&
|
|
67
70
|
args.length === 1 &&
|
|
68
71
|
args[0].type === 'ObjectExpression') {
|
|
69
|
-
sensitive = (0,
|
|
72
|
+
sensitive = (0, ast_js_1.getPropertyWithValue)(context, args[0], CONTENT_SECURITY_POLICY, false);
|
|
70
73
|
}
|
|
71
74
|
return sensitive ? [sensitive] : [];
|
|
72
75
|
}
|
package/cjs/S5730/rule.js
CHANGED
|
@@ -51,7 +51,10 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
51
51
|
})();
|
|
52
52
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
53
53
|
exports.rule = void 0;
|
|
54
|
-
const
|
|
54
|
+
const express_js_1 = require("../helpers/express.js");
|
|
55
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
56
|
+
const module_js_1 = require("../helpers/module.js");
|
|
57
|
+
const ast_js_1 = require("../helpers/ast.js");
|
|
55
58
|
const meta = __importStar(require("./generated-meta.js"));
|
|
56
59
|
const HELMET = 'helmet';
|
|
57
60
|
const HELMET_CSP = 'helmet-csp';
|
|
@@ -59,13 +62,13 @@ const DIRECTIVES = 'directives';
|
|
|
59
62
|
const CONTENT_SECURITY_POLICY = 'contentSecurityPolicy';
|
|
60
63
|
const BLOCK_ALL_MIXED_CONTENT_CAMEL = 'blockAllMixedContent';
|
|
61
64
|
const BLOCK_ALL_MIXED_CONTENT_HYPHEN = 'block-all-mixed-content';
|
|
62
|
-
exports.rule =
|
|
65
|
+
exports.rule = (0, express_js_1.SensitiveMiddlewarePropertyRule)(findDirectivesWithMissingMixedContentPropertyFromHelmet, `Make sure allowing mixed-content is safe here.`, (0, generate_meta_js_1.generateMeta)(meta));
|
|
63
66
|
function findDirectivesWithMissingMixedContentPropertyFromHelmet(context, node) {
|
|
64
67
|
let sensitive;
|
|
65
68
|
const { arguments: args } = node;
|
|
66
69
|
if (args.length === 1) {
|
|
67
70
|
const [options] = args;
|
|
68
|
-
const maybeDirectives = (0,
|
|
71
|
+
const maybeDirectives = (0, ast_js_1.getProperty)(options, DIRECTIVES, context);
|
|
69
72
|
if (maybeDirectives &&
|
|
70
73
|
isMissingMixedContentProperty(maybeDirectives, context) &&
|
|
71
74
|
isValidHelmetModuleCall(context, node)) {
|
|
@@ -75,10 +78,10 @@ function findDirectivesWithMissingMixedContentPropertyFromHelmet(context, node)
|
|
|
75
78
|
return sensitive ? [sensitive] : [];
|
|
76
79
|
}
|
|
77
80
|
function isValidHelmetModuleCall(context, callExpr) {
|
|
78
|
-
const fqn = (0,
|
|
81
|
+
const fqn = (0, module_js_1.getFullyQualifiedName)(context, callExpr);
|
|
79
82
|
return fqn === `${HELMET}.${CONTENT_SECURITY_POLICY}` || fqn === HELMET_CSP;
|
|
80
83
|
}
|
|
81
84
|
function isMissingMixedContentProperty(directives, context) {
|
|
82
|
-
return !(Boolean((0,
|
|
83
|
-
Boolean((0,
|
|
85
|
+
return !(Boolean((0, ast_js_1.getProperty)(directives.value, BLOCK_ALL_MIXED_CONTENT_CAMEL, context)) ||
|
|
86
|
+
Boolean((0, ast_js_1.getProperty)(directives.value, BLOCK_ALL_MIXED_CONTENT_HYPHEN, context)));
|
|
84
87
|
}
|