eslint-plugin-sonarjs 4.0.1 → 4.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/cjs/S100/rule.js +7 -5
- package/cjs/S101/rule.js +2 -2
- package/cjs/S104/rule.js +2 -2
- package/cjs/S105/rule.js +2 -2
- package/cjs/S1066/rule.js +5 -4
- package/cjs/S1067/rule.js +8 -6
- package/cjs/S1110/rule.js +7 -5
- package/cjs/S1119/rule.js +2 -2
- package/cjs/S1121/rule.js +4 -3
- package/cjs/S1125/rule.js +9 -8
- package/cjs/S1126/rule.js +2 -2
- package/cjs/S1128/rule.js +8 -5
- package/cjs/S1134/rule.js +2 -2
- package/cjs/S1135/rule.js +2 -2
- package/cjs/S1154/rule.js +6 -4
- package/cjs/S117/rule.js +6 -5
- package/cjs/S1172/rule.js +2 -2
- package/cjs/S1192/rule.js +5 -4
- package/cjs/S1219/rule.js +4 -3
- package/cjs/S1226/rule.js +6 -4
- package/cjs/S124/rule.js +2 -2
- package/cjs/S125/rule.js +9 -7
- package/cjs/S126/rule.js +2 -2
- package/cjs/S1264/rule.js +2 -2
- package/cjs/S128/rule.js +4 -3
- package/cjs/S1291/rule.js +2 -2
- package/cjs/S1301/rule.js +2 -2
- package/cjs/S1313/rule.js +2 -2
- package/cjs/S134/rule.js +7 -5
- package/cjs/S135/rule.js +5 -4
- package/cjs/S138/rule.js +9 -6
- package/cjs/S1439/rule.js +2 -2
- package/cjs/S1444/rule.js +2 -2
- package/cjs/S1451/rule.js +2 -2
- package/cjs/S1472/rule.js +2 -2
- package/cjs/S1479/rule.js +2 -2
- package/cjs/S1481/rule.js +2 -2
- package/cjs/S1488/rule.js +11 -7
- package/cjs/S1515/rule.js +10 -8
- package/cjs/S1523/rule.js +5 -5
- package/cjs/S1526/rule.js +5 -4
- package/cjs/S1527/rule.js +2 -2
- package/cjs/S1528/rule.js +2 -2
- package/cjs/S1529/rule.js +4 -3
- package/cjs/S1530/rule.js +5 -3
- package/cjs/S1533/rule.js +2 -2
- package/cjs/S1535/rule.js +2 -2
- package/cjs/S1541/rule.js +10 -7
- package/cjs/S1607/rule.js +22 -20
- package/cjs/S1764/rule.js +10 -7
- package/cjs/S1821/rule.js +2 -2
- package/cjs/S1848/rule.js +10 -7
- package/cjs/S1854/rule.js +18 -14
- package/cjs/S1862/rule.js +10 -8
- package/cjs/S1871/rule.js +21 -16
- package/cjs/S1874/rule.js +4 -3
- package/cjs/S1940/rule.js +2 -2
- package/cjs/S1994/rule.js +10 -7
- package/cjs/S2004/rule.js +9 -7
- package/cjs/S2068/rule.js +75 -12
- package/cjs/S2077/rule.js +10 -6
- package/cjs/S2092/rule.js +2 -2
- package/cjs/S2123/rule.js +2 -2
- package/cjs/S2137/rule.js +2 -2
- package/cjs/S2138/rule.js +4 -3
- package/cjs/S2187/rule.js +2 -2
- package/cjs/S2201/rule.js +8 -5
- package/cjs/S2208/rule.js +2 -2
- package/cjs/S2234/rule.js +15 -11
- package/cjs/S2245/rule.js +4 -3
- package/cjs/S2251/rule.js +5 -4
- package/cjs/S2255/rule.js +6 -5
- package/cjs/S2259/rule.js +14 -9
- package/cjs/S2301/rule.js +14 -9
- package/cjs/S2310/rule.js +14 -11
- package/cjs/S2392/rule.js +7 -5
- package/cjs/S2424/rule.js +2 -2
- package/cjs/S2428/rule.js +8 -6
- package/cjs/S2486/rule.js +4 -3
- package/cjs/S2589/rule.js +12 -10
- package/cjs/S2598/rule.js +17 -14
- package/cjs/S2612/generated-meta.js +1 -1
- package/cjs/S2612/rule.js +8 -6
- package/cjs/S2639/rule.js +2 -2
- package/cjs/S2681/rule.js +2 -2
- package/cjs/S2692/rule.js +6 -4
- package/cjs/S2699/rule.js +40 -31
- package/cjs/S2703/rule.js +2 -2
- package/cjs/S2737/rule.js +6 -4
- package/cjs/S2755/rule.js +9 -6
- package/cjs/S2757/rule.js +2 -2
- package/cjs/S2817/rule.js +10 -7
- package/cjs/S2819/rule.js +16 -12
- package/cjs/S2870/rule.js +8 -5
- package/cjs/S2871/rule.js +12 -9
- package/cjs/S2970/rule.js +9 -8
- package/cjs/S2990/rule.js +2 -2
- package/cjs/S2999/rule.js +10 -7
- package/cjs/S3001/rule.js +2 -2
- package/cjs/S3003/rule.js +10 -7
- package/cjs/S3317/rule.js +4 -3
- package/cjs/S3330/rule.js +2 -2
- package/cjs/S3358/rule.js +2 -2
- package/cjs/S3402/rule.js +14 -10
- package/cjs/S3403/rule.js +10 -7
- package/cjs/S3415/rule.js +16 -13
- package/cjs/S3499/rule.js +5 -4
- package/cjs/S3500/rule.js +5 -4
- package/cjs/S3513/rule.js +5 -4
- package/cjs/S3514/rule.js +10 -7
- package/cjs/S3516/rule.js +10 -7
- package/cjs/S3524/rule.js +2 -2
- package/cjs/S3525/rule.js +6 -4
- package/cjs/S3531/rule.js +5 -3
- package/cjs/S3533/rule.js +8 -7
- package/cjs/S3579/rule.js +6 -4
- package/cjs/S3616/rule.js +6 -4
- package/cjs/S3626/rule.js +4 -3
- package/cjs/S3686/rule.js +7 -5
- package/cjs/S3699/rule.js +4 -3
- package/cjs/S3735/rule.js +8 -5
- package/cjs/S3757/rule.js +8 -6
- package/cjs/S3758/rule.js +9 -7
- package/cjs/S3760/rule.js +24 -21
- package/cjs/S3776/rule.js +26 -22
- package/cjs/S3782/rule.js +6 -4
- package/cjs/S3785/rule.js +9 -6
- package/cjs/S3796/rule.js +12 -8
- package/cjs/S3798/rule.js +4 -3
- package/cjs/S3800/rule.js +16 -11
- package/cjs/S3801/rule.js +15 -11
- package/cjs/S3827/rule.js +9 -6
- package/cjs/S3923/rule.js +9 -6
- package/cjs/S3972/rule.js +5 -4
- package/cjs/S3973/rule.js +7 -5
- package/cjs/S3981/rule.js +4 -3
- package/cjs/S3984/rule.js +4 -3
- package/cjs/S4030/rule.js +10 -7
- package/cjs/S4036/rule.js +7 -5
- package/cjs/S4043/rule.js +12 -8
- package/cjs/S4139/rule.js +7 -5
- package/cjs/S4143/rule.js +12 -9
- package/cjs/S4144/rule.js +12 -9
- package/cjs/S4158/rule.js +11 -8
- package/cjs/S4165/rule.js +14 -12
- package/cjs/S4322/rule.js +8 -5
- package/cjs/S4323/rule.js +4 -3
- package/cjs/S4324/rule.js +7 -5
- package/cjs/S4328/rule.js +2 -2
- package/cjs/S4335/rule.js +6 -4
- package/cjs/S4423/rule.js +4 -3
- package/cjs/S4423/rule.lib.js +8 -7
- package/cjs/S4426/rule.js +11 -10
- package/cjs/S4502/rule.js +16 -13
- package/cjs/S4507/rule.js +8 -6
- package/cjs/S4524/rule.js +2 -2
- package/cjs/S4619/rule.js +6 -4
- package/cjs/S4621/rule.js +5 -4
- package/cjs/S4622/rule.js +5 -3
- package/cjs/S4623/rule.js +8 -5
- package/cjs/S4624/rule.js +6 -4
- package/cjs/S4634/rule.js +4 -3
- package/cjs/S4721/rule.js +7 -5
- package/cjs/S4782/rule.js +7 -5
- package/cjs/S4784/rule.js +5 -4
- package/cjs/S4787/rule.js +9 -7
- package/cjs/S4790/rule.js +7 -5
- package/cjs/S4798/rule.js +2 -2
- package/cjs/S4817/rule.js +10 -8
- package/cjs/S4818/rule.js +4 -3
- package/cjs/S4822/rule.js +13 -9
- package/cjs/S4823/rule.js +4 -3
- package/cjs/S4829/rule.js +4 -3
- package/cjs/S4830/rule.js +11 -8
- package/cjs/S5042/rule.js +9 -7
- package/cjs/S5122/rule.js +40 -36
- package/cjs/S5148/rule.js +9 -8
- package/cjs/S5247/rule.js +22 -18
- package/cjs/S5256/rule.js +5 -4
- package/cjs/S5257/rule.js +4 -3
- package/cjs/S5260/rule.js +4 -3
- package/cjs/S5264/rule.js +4 -3
- package/cjs/S5332/rule.js +4 -3
- package/cjs/S5332/rule.lib.js +19 -17
- package/cjs/S5443/rule.js +2 -2
- package/cjs/S5527/rule.js +18 -14
- package/cjs/S5542/rule.js +6 -4
- package/cjs/S5547/rule.js +6 -4
- package/cjs/S5604/rule.js +15 -14
- package/cjs/S5659/rule.js +15 -12
- package/cjs/S5689/rule.js +11 -8
- package/cjs/S5691/rule.js +7 -5
- package/cjs/S5693/rule.js +14 -12
- package/cjs/S5725/rule.js +9 -6
- package/cjs/S5728/rule.js +7 -4
- package/cjs/S5730/rule.js +9 -6
- package/cjs/S5732/rule.js +8 -5
- package/cjs/S5734/rule.js +7 -4
- package/cjs/S5736/rule.js +8 -5
- package/cjs/S5739/rule.js +11 -8
- package/cjs/S5742/rule.js +7 -4
- package/cjs/S5743/rule.js +8 -6
- package/cjs/S5757/rule.js +13 -10
- package/cjs/S5759/rule.js +10 -7
- package/cjs/S5842/rule.js +2 -2
- package/cjs/S5843/rule.js +22 -19
- package/cjs/S5850/rule.js +4 -3
- package/cjs/S5852/rule.js +2 -2
- package/cjs/S5856/rule.js +10 -7
- package/cjs/S5860/rule.js +30 -26
- package/cjs/S5863/rule.js +15 -11
- package/cjs/S5867/rule.js +8 -7
- package/cjs/S5868/rule.js +7 -5
- package/cjs/S5869/rule.js +6 -5
- package/cjs/S5876/rule.js +12 -8
- package/cjs/S5958/rule.js +12 -9
- package/cjs/S5973/rule.js +10 -7
- package/cjs/S6019/rule.js +4 -3
- package/cjs/S6035/rule.js +2 -2
- package/cjs/S6079/rule.js +9 -6
- package/cjs/S6080/rule.js +13 -10
- package/cjs/S6092/rule.js +9 -7
- package/cjs/S6245/rule.js +14 -9
- package/cjs/S6249/rule.js +7 -5
- package/cjs/S6252/rule.js +12 -8
- package/cjs/S6265/rule.js +27 -20
- package/cjs/S6268/rule.js +5 -4
- package/cjs/S6270/rule.js +12 -9
- package/cjs/S6275/rule.js +2 -2
- package/cjs/S6281/rule.js +22 -17
- package/cjs/S6299/rule.js +2 -2
- package/cjs/S6302/rule.js +6 -5
- package/cjs/S6303/rule.js +12 -10
- package/cjs/S6304/rule.js +6 -5
- package/cjs/S6308/rule.js +7 -5
- package/cjs/S6317/rule.js +5 -4
- package/cjs/S6319/rule.js +2 -2
- package/cjs/S6321/rule.js +25 -23
- package/cjs/S6323/rule.js +4 -3
- package/cjs/S6324/rule.js +2 -2
- package/cjs/S6326/rule.js +2 -2
- package/cjs/S6327/rule.js +2 -2
- package/cjs/S6328/rule.js +4 -3
- package/cjs/S6329/rule.js +7 -5
- package/cjs/S6330/rule.js +2 -2
- package/cjs/S6332/rule.js +2 -2
- package/cjs/S6333/rule.js +8 -6
- package/cjs/S6351/rule.js +22 -19
- package/cjs/S6353/rule.js +2 -2
- package/cjs/S6397/rule.js +2 -2
- package/cjs/S6418/rule.js +9 -24
- package/cjs/S6426/rule.js +5 -4
- package/cjs/S6437/rule.js +10 -7
- package/cjs/S6439/rule.js +9 -7
- package/cjs/S6442/rule.js +11 -8
- package/cjs/S6443/rule.js +9 -7
- package/cjs/S6486/rule.js +5 -4
- package/cjs/S6564/rule.js +4 -3
- package/cjs/S6594/rule.js +12 -8
- package/cjs/S6627/rule.js +6 -4
- package/cjs/S6759/rule.js +10 -6
- package/cjs/S6958/rule.js +2 -2
- package/cjs/S6959/rule.js +9 -6
- package/cjs/S7059/rule.js +8 -5
- package/cjs/S7639/rule.js +5 -4
- package/cjs/S7790/rule.js +7 -5
- package/cjs/S8441/rule.js +13 -9
- package/cjs/S881/rule.js +2 -2
- package/cjs/S888/rule.js +4 -3
- package/cjs/S930/rule.js +14 -12
- package/cjs/helpers/ast.js +11 -8
- package/cjs/helpers/aws/s3.js +9 -6
- package/cjs/helpers/chai.js +41 -43
- package/cjs/helpers/cookie-flag-check.js +19 -17
- package/cjs/helpers/{decorators/index.js → entropy.js} +16 -17
- package/cjs/helpers/express.js +127 -128
- package/cjs/helpers/mocha.js +50 -54
- package/cjs/helpers/regex/ast.js +7 -6
- package/cjs/helpers/regex/extract.js +11 -11
- package/cjs/helpers/regex/group.js +2 -2
- package/cjs/helpers/regex/location.js +2 -2
- package/cjs/helpers/regex/range.js +5 -4
- package/cjs/helpers/regex/rule-template.js +4 -3
- package/cjs/helpers/sinon.js +33 -36
- package/cjs/helpers/supertest.js +34 -37
- package/cjs/helpers/vitest.js +29 -32
- package/docs/file-permissions.md +1 -1
- package/package.json +39 -1
- package/types/helpers/ancestor.d.ts +1 -1
- package/types/helpers/aws/s3.d.ts +1 -1
- package/types/helpers/chai.d.ts +3 -5
- package/types/helpers/entropy.d.ts +1 -0
- package/types/helpers/express.d.ts +38 -43
- package/types/helpers/mocha.d.ts +19 -21
- package/types/helpers/regex/ast.d.ts +1 -1
- package/types/helpers/regex/rule-template.d.ts +1 -1
- package/types/helpers/sinon.d.ts +3 -5
- package/types/helpers/supertest.d.ts +3 -5
- package/types/helpers/type.d.ts +1 -1
- package/types/helpers/vitest.d.ts +3 -5
- package/cjs/helpers/aws/index.js +0 -35
- package/cjs/helpers/decorators/interceptor.js +0 -88
- package/cjs/helpers/index.js +0 -60
- package/cjs/helpers/recognizers/index.js +0 -37
- package/cjs/helpers/rule-detect-react.js +0 -29
- package/cjs/helpers/validate-version.js +0 -94
- package/types/helpers/aws/index.d.ts +0 -3
- package/types/helpers/decorators/index.d.ts +0 -2
- package/types/helpers/decorators/interceptor.d.ts +0 -16
- package/types/helpers/index.d.ts +0 -28
- package/types/helpers/recognizers/index.d.ts +0 -2
- package/types/helpers/rule-detect-react.d.ts +0 -2
- package/types/helpers/validate-version.d.ts +0 -13
package/cjs/S5693/rule.js
CHANGED
|
@@ -53,7 +53,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
53
53
|
exports.rule = void 0;
|
|
54
54
|
const rule_js_1 = require("../S2598/rule.js");
|
|
55
55
|
const bytes_1 = require("bytes");
|
|
56
|
-
const
|
|
56
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
57
|
+
const module_js_1 = require("../helpers/module.js");
|
|
58
|
+
const ast_js_1 = require("../helpers/ast.js");
|
|
57
59
|
const meta = __importStar(require("./generated-meta.js"));
|
|
58
60
|
const FORMIDABLE_MODULE = 'formidable';
|
|
59
61
|
const MAX_FILE_SIZE = 'maxFileSize';
|
|
@@ -72,7 +74,7 @@ const messages = {
|
|
|
72
74
|
safeLimit: 'Make sure the content length limit is safe here.',
|
|
73
75
|
};
|
|
74
76
|
exports.rule = {
|
|
75
|
-
meta: (0,
|
|
77
|
+
meta: (0, generate_meta_js_1.generateMeta)(meta, { messages }),
|
|
76
78
|
create(context) {
|
|
77
79
|
return {
|
|
78
80
|
NewExpression(node) {
|
|
@@ -107,7 +109,7 @@ function checkCallExpression(context, callExpression) {
|
|
|
107
109
|
else {
|
|
108
110
|
return;
|
|
109
111
|
}
|
|
110
|
-
const fqn = (0,
|
|
112
|
+
const fqn = (0, module_js_1.getFullyQualifiedName)(context, identifierFromModule);
|
|
111
113
|
if (!fqn) {
|
|
112
114
|
return;
|
|
113
115
|
}
|
|
@@ -125,7 +127,7 @@ function checkCallExpression(context, callExpression) {
|
|
|
125
127
|
function checkFormidable(context, callExpression) {
|
|
126
128
|
if (callExpression.arguments.length === 0) {
|
|
127
129
|
// options will be set later through member assignment
|
|
128
|
-
const formVariable = (0,
|
|
130
|
+
const formVariable = (0, ast_js_1.getLhsVariable)(context, callExpression);
|
|
129
131
|
if (formVariable) {
|
|
130
132
|
formidableObjects.set(formVariable, {
|
|
131
133
|
maxFileSize: FORMIDABLE_DEFAULT_SIZE,
|
|
@@ -134,9 +136,9 @@ function checkFormidable(context, callExpression) {
|
|
|
134
136
|
}
|
|
135
137
|
return;
|
|
136
138
|
}
|
|
137
|
-
const options = (0,
|
|
139
|
+
const options = (0, ast_js_1.getValueOfExpression)(context, callExpression.arguments[0], 'ObjectExpression');
|
|
138
140
|
if (options) {
|
|
139
|
-
const property = (0,
|
|
141
|
+
const property = (0, ast_js_1.getProperty)(options, MAX_FILE_SIZE, context);
|
|
140
142
|
checkSize(context, callExpression, property, FORMIDABLE_DEFAULT_SIZE);
|
|
141
143
|
}
|
|
142
144
|
}
|
|
@@ -148,13 +150,13 @@ function checkMulter(context, callExpression) {
|
|
|
148
150
|
report(context, callExpression.callee);
|
|
149
151
|
return;
|
|
150
152
|
}
|
|
151
|
-
const multerOptions = (0,
|
|
153
|
+
const multerOptions = (0, ast_js_1.getValueOfExpression)(context, callExpression.arguments[0], 'ObjectExpression');
|
|
152
154
|
if (!multerOptions) {
|
|
153
155
|
return;
|
|
154
156
|
}
|
|
155
|
-
const limitsPropertyValue = (0,
|
|
157
|
+
const limitsPropertyValue = (0, ast_js_1.getProperty)(multerOptions, LIMITS_OPTION, context)?.value;
|
|
156
158
|
if (limitsPropertyValue?.type === 'ObjectExpression') {
|
|
157
|
-
const fileSizeProperty = (0,
|
|
159
|
+
const fileSizeProperty = (0, ast_js_1.getProperty)(limitsPropertyValue, FILE_SIZE_OPTION, context);
|
|
158
160
|
checkSize(context, callExpression, fileSizeProperty);
|
|
159
161
|
}
|
|
160
162
|
if (!limitsPropertyValue) {
|
|
@@ -166,11 +168,11 @@ function checkBodyParser(context, callExpression) {
|
|
|
166
168
|
checkSize(context, callExpression, undefined, BODY_PARSER_DEFAULT_SIZE, true);
|
|
167
169
|
return;
|
|
168
170
|
}
|
|
169
|
-
const options = (0,
|
|
171
|
+
const options = (0, ast_js_1.getValueOfExpression)(context, callExpression.arguments[0], 'ObjectExpression');
|
|
170
172
|
if (!options) {
|
|
171
173
|
return;
|
|
172
174
|
}
|
|
173
|
-
const limitsProperty = (0,
|
|
175
|
+
const limitsProperty = (0, ast_js_1.getProperty)(options, LIMITS_OPTION, context);
|
|
174
176
|
checkSize(context, callExpression, limitsProperty, BODY_PARSER_DEFAULT_SIZE, true);
|
|
175
177
|
}
|
|
176
178
|
function checkSize(context, callExpr, property, defaultLimit, useStandardSizeLimit = false) {
|
|
@@ -203,7 +205,7 @@ function visitAssignment(context, assignment) {
|
|
|
203
205
|
}
|
|
204
206
|
}
|
|
205
207
|
function getSizeValue(context, node) {
|
|
206
|
-
const literal = (0,
|
|
208
|
+
const literal = (0, ast_js_1.getValueOfExpression)(context, node, 'Literal');
|
|
207
209
|
if (literal) {
|
|
208
210
|
if (typeof literal.value === 'number') {
|
|
209
211
|
return literal.value;
|
package/cjs/S5725/rule.js
CHANGED
|
@@ -51,17 +51,20 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
51
51
|
})();
|
|
52
52
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
53
53
|
exports.rule = void 0;
|
|
54
|
-
const
|
|
54
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
55
|
+
const type_js_1 = require("../helpers/type.js");
|
|
56
|
+
const ast_js_1 = require("../helpers/ast.js");
|
|
57
|
+
const parser_services_js_1 = require("../helpers/parser-services.js");
|
|
55
58
|
const meta = __importStar(require("./generated-meta.js"));
|
|
56
59
|
exports.rule = {
|
|
57
|
-
meta: (0,
|
|
60
|
+
meta: (0, generate_meta_js_1.generateMeta)(meta, {
|
|
58
61
|
messages: {
|
|
59
62
|
safeResource: 'Make sure not using resource integrity feature is safe here.',
|
|
60
63
|
},
|
|
61
64
|
}),
|
|
62
65
|
create(context) {
|
|
63
66
|
const services = context.sourceCode.parserServices;
|
|
64
|
-
if (!(0,
|
|
67
|
+
if (!(0, parser_services_js_1.isRequiredParserServices)(services)) {
|
|
65
68
|
return {};
|
|
66
69
|
}
|
|
67
70
|
return {
|
|
@@ -76,9 +79,9 @@ exports.rule = {
|
|
|
76
79
|
if (callee.type !== 'MemberExpression') {
|
|
77
80
|
return;
|
|
78
81
|
}
|
|
79
|
-
const typeName = (0,
|
|
80
|
-
if (!(0,
|
|
81
|
-
!(0,
|
|
82
|
+
const typeName = (0, type_js_1.getTypeAsString)(left, services);
|
|
83
|
+
if (!(0, ast_js_1.isIdentifier)(callee.object, 'document') ||
|
|
84
|
+
!(0, ast_js_1.isIdentifier)(callee.property, 'createElement') ||
|
|
82
85
|
typeName !== 'HTMLScriptElement') {
|
|
83
86
|
return;
|
|
84
87
|
}
|
package/cjs/S5728/rule.js
CHANGED
|
@@ -51,11 +51,14 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
51
51
|
})();
|
|
52
52
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
53
53
|
exports.rule = void 0;
|
|
54
|
-
const
|
|
54
|
+
const express_js_1 = require("../helpers/express.js");
|
|
55
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
56
|
+
const module_js_1 = require("../helpers/module.js");
|
|
57
|
+
const ast_js_1 = require("../helpers/ast.js");
|
|
55
58
|
const meta = __importStar(require("./generated-meta.js"));
|
|
56
59
|
const HELMET = 'helmet';
|
|
57
60
|
const CONTENT_SECURITY_POLICY = 'contentSecurityPolicy';
|
|
58
|
-
exports.rule =
|
|
61
|
+
exports.rule = (0, express_js_1.SensitiveMiddlewarePropertyRule)(findFalseContentSecurityPolicyPropertyFromHelmet, `Make sure not enabling content security policy fetch directives is safe here.`, (0, generate_meta_js_1.generateMeta)(meta));
|
|
59
62
|
/**
|
|
60
63
|
* Looks for property `contentSecurityPolicy: false` in node looking
|
|
61
64
|
* somewhat similar to `helmet(<options>?)`, and returns it.
|
|
@@ -63,10 +66,10 @@ exports.rule = index_js_1.Express.SensitiveMiddlewarePropertyRule(findFalseConte
|
|
|
63
66
|
function findFalseContentSecurityPolicyPropertyFromHelmet(context, node) {
|
|
64
67
|
let sensitive;
|
|
65
68
|
const { callee, arguments: args } = node;
|
|
66
|
-
if ((0,
|
|
69
|
+
if ((0, module_js_1.getFullyQualifiedName)(context, callee) === HELMET &&
|
|
67
70
|
args.length === 1 &&
|
|
68
71
|
args[0].type === 'ObjectExpression') {
|
|
69
|
-
sensitive = (0,
|
|
72
|
+
sensitive = (0, ast_js_1.getPropertyWithValue)(context, args[0], CONTENT_SECURITY_POLICY, false);
|
|
70
73
|
}
|
|
71
74
|
return sensitive ? [sensitive] : [];
|
|
72
75
|
}
|
package/cjs/S5730/rule.js
CHANGED
|
@@ -51,7 +51,10 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
51
51
|
})();
|
|
52
52
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
53
53
|
exports.rule = void 0;
|
|
54
|
-
const
|
|
54
|
+
const express_js_1 = require("../helpers/express.js");
|
|
55
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
56
|
+
const module_js_1 = require("../helpers/module.js");
|
|
57
|
+
const ast_js_1 = require("../helpers/ast.js");
|
|
55
58
|
const meta = __importStar(require("./generated-meta.js"));
|
|
56
59
|
const HELMET = 'helmet';
|
|
57
60
|
const HELMET_CSP = 'helmet-csp';
|
|
@@ -59,13 +62,13 @@ const DIRECTIVES = 'directives';
|
|
|
59
62
|
const CONTENT_SECURITY_POLICY = 'contentSecurityPolicy';
|
|
60
63
|
const BLOCK_ALL_MIXED_CONTENT_CAMEL = 'blockAllMixedContent';
|
|
61
64
|
const BLOCK_ALL_MIXED_CONTENT_HYPHEN = 'block-all-mixed-content';
|
|
62
|
-
exports.rule =
|
|
65
|
+
exports.rule = (0, express_js_1.SensitiveMiddlewarePropertyRule)(findDirectivesWithMissingMixedContentPropertyFromHelmet, `Make sure allowing mixed-content is safe here.`, (0, generate_meta_js_1.generateMeta)(meta));
|
|
63
66
|
function findDirectivesWithMissingMixedContentPropertyFromHelmet(context, node) {
|
|
64
67
|
let sensitive;
|
|
65
68
|
const { arguments: args } = node;
|
|
66
69
|
if (args.length === 1) {
|
|
67
70
|
const [options] = args;
|
|
68
|
-
const maybeDirectives = (0,
|
|
71
|
+
const maybeDirectives = (0, ast_js_1.getProperty)(options, DIRECTIVES, context);
|
|
69
72
|
if (maybeDirectives &&
|
|
70
73
|
isMissingMixedContentProperty(maybeDirectives, context) &&
|
|
71
74
|
isValidHelmetModuleCall(context, node)) {
|
|
@@ -75,10 +78,10 @@ function findDirectivesWithMissingMixedContentPropertyFromHelmet(context, node)
|
|
|
75
78
|
return sensitive ? [sensitive] : [];
|
|
76
79
|
}
|
|
77
80
|
function isValidHelmetModuleCall(context, callExpr) {
|
|
78
|
-
const fqn = (0,
|
|
81
|
+
const fqn = (0, module_js_1.getFullyQualifiedName)(context, callExpr);
|
|
79
82
|
return fqn === `${HELMET}.${CONTENT_SECURITY_POLICY}` || fqn === HELMET_CSP;
|
|
80
83
|
}
|
|
81
84
|
function isMissingMixedContentProperty(directives, context) {
|
|
82
|
-
return !(Boolean((0,
|
|
83
|
-
Boolean((0,
|
|
85
|
+
return !(Boolean((0, ast_js_1.getProperty)(directives.value, BLOCK_ALL_MIXED_CONTENT_CAMEL, context)) ||
|
|
86
|
+
Boolean((0, ast_js_1.getProperty)(directives.value, BLOCK_ALL_MIXED_CONTENT_HYPHEN, context)));
|
|
84
87
|
}
|
package/cjs/S5732/rule.js
CHANGED
|
@@ -51,7 +51,10 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
51
51
|
})();
|
|
52
52
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
53
53
|
exports.rule = void 0;
|
|
54
|
-
const
|
|
54
|
+
const express_js_1 = require("../helpers/express.js");
|
|
55
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
56
|
+
const module_js_1 = require("../helpers/module.js");
|
|
57
|
+
const ast_js_1 = require("../helpers/ast.js");
|
|
55
58
|
const meta = __importStar(require("./generated-meta.js"));
|
|
56
59
|
const HELMET = 'helmet';
|
|
57
60
|
const HELMET_CSP = 'helmet-csp';
|
|
@@ -60,12 +63,12 @@ const NONE = "'none'";
|
|
|
60
63
|
const CONTENT_SECURITY_POLICY = 'contentSecurityPolicy';
|
|
61
64
|
const FRAME_ANCESTORS_CAMEL = 'frameAncestors';
|
|
62
65
|
const FRAME_ANCESTORS_HYPHEN = 'frame-ancestors';
|
|
63
|
-
exports.rule =
|
|
66
|
+
exports.rule = (0, express_js_1.SensitiveMiddlewarePropertyRule)(findDirectivesWithSensitiveFrameAncestorsPropertyFromHelmet, `Make sure disabling content security policy frame-ancestors directive is safe here.`, (0, generate_meta_js_1.generateMeta)(meta));
|
|
64
67
|
function findDirectivesWithSensitiveFrameAncestorsPropertyFromHelmet(context, node) {
|
|
65
68
|
const { arguments: args } = node;
|
|
66
69
|
if (isValidHelmetModuleCall(context, node) && args.length === 1) {
|
|
67
70
|
const [options] = args;
|
|
68
|
-
const maybeDirectives = (0,
|
|
71
|
+
const maybeDirectives = (0, ast_js_1.getProperty)(options, DIRECTIVES, context);
|
|
69
72
|
if (maybeDirectives) {
|
|
70
73
|
const maybeFrameAncestors = getFrameAncestorsProperty(maybeDirectives, context);
|
|
71
74
|
if (!maybeFrameAncestors) {
|
|
@@ -80,7 +83,7 @@ function findDirectivesWithSensitiveFrameAncestorsPropertyFromHelmet(context, no
|
|
|
80
83
|
}
|
|
81
84
|
function isValidHelmetModuleCall(context, callExpr) {
|
|
82
85
|
/* csp(options) or helmet.contentSecurityPolicy(options) */
|
|
83
|
-
const fqn = (0,
|
|
86
|
+
const fqn = (0, module_js_1.getFullyQualifiedName)(context, callExpr);
|
|
84
87
|
return fqn === HELMET_CSP || fqn === `${HELMET}.${CONTENT_SECURITY_POLICY}`;
|
|
85
88
|
}
|
|
86
89
|
function isSetNoneFrameAncestorsProperty(frameAncestors) {
|
|
@@ -91,7 +94,7 @@ function isSetNoneFrameAncestorsProperty(frameAncestors) {
|
|
|
91
94
|
function getFrameAncestorsProperty(directives, context) {
|
|
92
95
|
const propertyKeys = [FRAME_ANCESTORS_CAMEL, FRAME_ANCESTORS_HYPHEN];
|
|
93
96
|
for (const propertyKey of propertyKeys) {
|
|
94
|
-
const maybeProperty = (0,
|
|
97
|
+
const maybeProperty = (0, ast_js_1.getProperty)(directives.value, propertyKey, context);
|
|
95
98
|
if (maybeProperty) {
|
|
96
99
|
return maybeProperty;
|
|
97
100
|
}
|
package/cjs/S5734/rule.js
CHANGED
|
@@ -51,11 +51,14 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
51
51
|
})();
|
|
52
52
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
53
53
|
exports.rule = void 0;
|
|
54
|
-
const
|
|
54
|
+
const express_js_1 = require("../helpers/express.js");
|
|
55
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
56
|
+
const module_js_1 = require("../helpers/module.js");
|
|
57
|
+
const ast_js_1 = require("../helpers/ast.js");
|
|
55
58
|
const meta = __importStar(require("./generated-meta.js"));
|
|
56
59
|
const HELMET = 'helmet';
|
|
57
60
|
const NO_SNIFF = 'noSniff';
|
|
58
|
-
exports.rule =
|
|
61
|
+
exports.rule = (0, express_js_1.SensitiveMiddlewarePropertyRule)(findFalseNoSniffPropertyFromHelmet, `Make sure allowing browsers to sniff MIME types is safe here.`, (0, generate_meta_js_1.generateMeta)(meta));
|
|
59
62
|
/**
|
|
60
63
|
* Looks for property `noSniff: false` in node looking
|
|
61
64
|
* somewhat similar to `helmet(<options>?)`, and returns it.
|
|
@@ -63,10 +66,10 @@ exports.rule = index_js_1.Express.SensitiveMiddlewarePropertyRule(findFalseNoSni
|
|
|
63
66
|
function findFalseNoSniffPropertyFromHelmet(context, node) {
|
|
64
67
|
let sensitive;
|
|
65
68
|
const { callee, arguments: args } = node;
|
|
66
|
-
if ((0,
|
|
69
|
+
if ((0, module_js_1.getFullyQualifiedName)(context, callee) === HELMET &&
|
|
67
70
|
args.length === 1 &&
|
|
68
71
|
args[0].type === 'ObjectExpression') {
|
|
69
|
-
sensitive = (0,
|
|
72
|
+
sensitive = (0, ast_js_1.getPropertyWithValue)(context, args[0], NO_SNIFF, false);
|
|
70
73
|
}
|
|
71
74
|
return sensitive ? [sensitive] : [];
|
|
72
75
|
}
|
package/cjs/S5736/rule.js
CHANGED
|
@@ -51,25 +51,28 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
51
51
|
})();
|
|
52
52
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
53
53
|
exports.rule = void 0;
|
|
54
|
-
const
|
|
54
|
+
const express_js_1 = require("../helpers/express.js");
|
|
55
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
56
|
+
const module_js_1 = require("../helpers/module.js");
|
|
57
|
+
const ast_js_1 = require("../helpers/ast.js");
|
|
55
58
|
const meta = __importStar(require("./generated-meta.js"));
|
|
56
59
|
const HELMET = 'helmet';
|
|
57
60
|
const POLICY = 'policy';
|
|
58
61
|
const REFERRER_POLICY = 'referrerPolicy';
|
|
59
62
|
const UNSAFE_REFERRER_POLICY_VALUES = new Set(['', 'unsafe-url', 'no-referrer-when-downgrade']);
|
|
60
|
-
exports.rule =
|
|
63
|
+
exports.rule = (0, express_js_1.SensitiveMiddlewarePropertyRule)(findNoReferrerPolicyPropertyFromHelmet, `Make sure disabling strict HTTP no-referrer policy is safe here.`, (0, generate_meta_js_1.generateMeta)(meta));
|
|
61
64
|
function findNoReferrerPolicyPropertyFromHelmet(context, node) {
|
|
62
65
|
let sensitive;
|
|
63
66
|
const { callee, arguments: args } = node;
|
|
64
67
|
if (args.length === 1) {
|
|
65
68
|
const [options] = args;
|
|
66
69
|
/* helmet({ referrerPolicy: false }) or helmet.referrerPolicy({ policy: <unsafe_value> }) */
|
|
67
|
-
const fqn = (0,
|
|
70
|
+
const fqn = (0, module_js_1.getFullyQualifiedName)(context, callee);
|
|
68
71
|
if (fqn === HELMET && options.type === 'ObjectExpression') {
|
|
69
|
-
sensitive = (0,
|
|
72
|
+
sensitive = (0, ast_js_1.getPropertyWithValue)(context, options, REFERRER_POLICY, false);
|
|
70
73
|
}
|
|
71
74
|
else if (fqn === `${HELMET}.${REFERRER_POLICY}`) {
|
|
72
|
-
const maybePolicy = (0,
|
|
75
|
+
const maybePolicy = (0, ast_js_1.getProperty)(options, POLICY, context);
|
|
73
76
|
if (maybePolicy && !isSafePolicy(maybePolicy)) {
|
|
74
77
|
sensitive = maybePolicy;
|
|
75
78
|
}
|
package/cjs/S5739/rule.js
CHANGED
|
@@ -51,14 +51,17 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
51
51
|
})();
|
|
52
52
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
53
53
|
exports.rule = void 0;
|
|
54
|
-
const
|
|
54
|
+
const express_js_1 = require("../helpers/express.js");
|
|
55
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
56
|
+
const module_js_1 = require("../helpers/module.js");
|
|
57
|
+
const ast_js_1 = require("../helpers/ast.js");
|
|
55
58
|
const meta = __importStar(require("./generated-meta.js"));
|
|
56
59
|
const HSTS = 'hsts';
|
|
57
60
|
const HELMET = 'helmet';
|
|
58
61
|
const MAX_AGE = 'maxAge';
|
|
59
62
|
const INCLUDE_SUB_DOMAINS = 'includeSubDomains';
|
|
60
63
|
const RECOMMENDED_MAX_AGE = 15552000;
|
|
61
|
-
exports.rule =
|
|
64
|
+
exports.rule = (0, express_js_1.SensitiveMiddlewarePropertyRule)(findSensitiveTransportSecurityPolicyProperty, `Disabling Strict-Transport-Security policy is security-sensitive.`, (0, generate_meta_js_1.generateMeta)(meta));
|
|
62
65
|
function findSensitiveTransportSecurityPolicyProperty(context, node) {
|
|
63
66
|
const sensitiveFinders = [findSensitiveHsts, findSensitiveMaxAge, findSensitiveIncludeSubDomains];
|
|
64
67
|
const sensitives = [];
|
|
@@ -75,16 +78,16 @@ function findSensitiveTransportSecurityPolicyProperty(context, node) {
|
|
|
75
78
|
return sensitives;
|
|
76
79
|
}
|
|
77
80
|
function findSensitiveHsts(context, middleware, options) {
|
|
78
|
-
if ((0,
|
|
79
|
-
return (0,
|
|
81
|
+
if ((0, module_js_1.getFullyQualifiedName)(context, middleware) === HELMET) {
|
|
82
|
+
return (0, ast_js_1.getPropertyWithValue)(context, options, HSTS, false);
|
|
80
83
|
}
|
|
81
84
|
return undefined;
|
|
82
85
|
}
|
|
83
86
|
function findSensitiveMaxAge(context, middleware, options) {
|
|
84
87
|
if (isHstsMiddlewareNode(context, middleware)) {
|
|
85
|
-
const maybeMaxAgeProperty = (0,
|
|
88
|
+
const maybeMaxAgeProperty = (0, ast_js_1.getProperty)(options, MAX_AGE, context);
|
|
86
89
|
if (maybeMaxAgeProperty) {
|
|
87
|
-
const maybeMaxAgeValue = (0,
|
|
90
|
+
const maybeMaxAgeValue = (0, ast_js_1.getValueOfExpression)(context, maybeMaxAgeProperty.value, 'Literal');
|
|
88
91
|
if (typeof maybeMaxAgeValue?.value === 'number' &&
|
|
89
92
|
maybeMaxAgeValue.value < RECOMMENDED_MAX_AGE) {
|
|
90
93
|
return maybeMaxAgeProperty;
|
|
@@ -95,11 +98,11 @@ function findSensitiveMaxAge(context, middleware, options) {
|
|
|
95
98
|
}
|
|
96
99
|
function findSensitiveIncludeSubDomains(context, middleware, options) {
|
|
97
100
|
if (isHstsMiddlewareNode(context, middleware)) {
|
|
98
|
-
return (0,
|
|
101
|
+
return (0, ast_js_1.getPropertyWithValue)(context, options, INCLUDE_SUB_DOMAINS, false);
|
|
99
102
|
}
|
|
100
103
|
return undefined;
|
|
101
104
|
}
|
|
102
105
|
function isHstsMiddlewareNode(context, node) {
|
|
103
|
-
const fqn = (0,
|
|
106
|
+
const fqn = (0, module_js_1.getFullyQualifiedName)(context, node);
|
|
104
107
|
return fqn === `${HELMET}.${HSTS}` || fqn === HSTS;
|
|
105
108
|
}
|
package/cjs/S5742/rule.js
CHANGED
|
@@ -51,11 +51,14 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
51
51
|
})();
|
|
52
52
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
53
53
|
exports.rule = void 0;
|
|
54
|
-
const
|
|
54
|
+
const express_js_1 = require("../helpers/express.js");
|
|
55
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
56
|
+
const module_js_1 = require("../helpers/module.js");
|
|
57
|
+
const ast_js_1 = require("../helpers/ast.js");
|
|
55
58
|
const meta = __importStar(require("./generated-meta.js"));
|
|
56
59
|
const HELMET = 'helmet';
|
|
57
60
|
const EXPECT_CERTIFICATE_TRANSPARENCY = 'expectCt';
|
|
58
|
-
exports.rule =
|
|
61
|
+
exports.rule = (0, express_js_1.SensitiveMiddlewarePropertyRule)(findFalseCertificateTransparencyPropertyFromHelmet, `Make sure disabling Certificate Transparency monitoring is safe here.`, (0, generate_meta_js_1.generateMeta)(meta));
|
|
59
62
|
/**
|
|
60
63
|
* Looks for property `expectCt: false` in node looking
|
|
61
64
|
* somewhat similar to `helmet(<options>?)`, and returns it.
|
|
@@ -63,10 +66,10 @@ exports.rule = index_js_1.Express.SensitiveMiddlewarePropertyRule(findFalseCerti
|
|
|
63
66
|
function findFalseCertificateTransparencyPropertyFromHelmet(context, node) {
|
|
64
67
|
let sensitive;
|
|
65
68
|
const { callee, arguments: args } = node;
|
|
66
|
-
if ((0,
|
|
69
|
+
if ((0, module_js_1.getFullyQualifiedName)(context, callee) === HELMET &&
|
|
67
70
|
args.length === 1 &&
|
|
68
71
|
args[0].type === 'ObjectExpression') {
|
|
69
|
-
sensitive = (0,
|
|
72
|
+
sensitive = (0, ast_js_1.getPropertyWithValue)(context, args[0], EXPECT_CERTIFICATE_TRANSPARENCY, false);
|
|
70
73
|
}
|
|
71
74
|
return sensitive ? [sensitive] : [];
|
|
72
75
|
}
|
package/cjs/S5743/rule.js
CHANGED
|
@@ -51,24 +51,26 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
51
51
|
})();
|
|
52
52
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
53
53
|
exports.rule = void 0;
|
|
54
|
-
const
|
|
54
|
+
const ast_js_1 = require("../helpers/ast.js");
|
|
55
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
56
|
+
const module_js_1 = require("../helpers/module.js");
|
|
55
57
|
const meta = __importStar(require("./generated-meta.js"));
|
|
56
58
|
const MESSAGE = 'Make sure allowing browsers to perform DNS prefetching is safe here.';
|
|
57
59
|
exports.rule = {
|
|
58
|
-
meta: (0,
|
|
60
|
+
meta: (0, generate_meta_js_1.generateMeta)(meta),
|
|
59
61
|
create(context) {
|
|
60
62
|
return {
|
|
61
63
|
CallExpression: (node) => {
|
|
62
64
|
const callExpression = node;
|
|
63
|
-
const fqn = (0,
|
|
65
|
+
const fqn = (0, module_js_1.getFullyQualifiedName)(context, callExpression);
|
|
64
66
|
if (fqn === 'helmet.dnsPrefetchControl') {
|
|
65
|
-
(0,
|
|
67
|
+
(0, ast_js_1.checkSensitiveCall)(context, callExpression, 0, 'allow', true, MESSAGE);
|
|
66
68
|
}
|
|
67
69
|
if (fqn === 'helmet') {
|
|
68
|
-
(0,
|
|
70
|
+
(0, ast_js_1.checkSensitiveCall)(context, callExpression, 0, 'dnsPrefetchControl', false, MESSAGE);
|
|
69
71
|
}
|
|
70
72
|
if (fqn === 'dns-prefetch-control') {
|
|
71
|
-
(0,
|
|
73
|
+
(0, ast_js_1.checkSensitiveCall)(context, callExpression, 0, 'allow', true, MESSAGE);
|
|
72
74
|
}
|
|
73
75
|
},
|
|
74
76
|
};
|
package/cjs/S5757/rule.js
CHANGED
|
@@ -51,40 +51,43 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
51
51
|
})();
|
|
52
52
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
53
53
|
exports.rule = void 0;
|
|
54
|
-
const
|
|
54
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
55
|
+
const module_js_1 = require("../helpers/module.js");
|
|
56
|
+
const ast_js_1 = require("../helpers/ast.js");
|
|
57
|
+
const location_js_1 = require("../helpers/location.js");
|
|
55
58
|
const meta = __importStar(require("./generated-meta.js"));
|
|
56
59
|
const MESSAGE = 'Make sure confidential information is not logged here.';
|
|
57
60
|
exports.rule = {
|
|
58
|
-
meta: (0,
|
|
61
|
+
meta: (0, generate_meta_js_1.generateMeta)(meta),
|
|
59
62
|
create(context) {
|
|
60
63
|
return {
|
|
61
64
|
NewExpression: (node) => {
|
|
62
65
|
const newExpression = node;
|
|
63
66
|
const { callee } = newExpression;
|
|
64
|
-
if ((0,
|
|
67
|
+
if ((0, module_js_1.getFullyQualifiedName)(context, callee) !== 'signale.Signale') {
|
|
65
68
|
return;
|
|
66
69
|
}
|
|
67
70
|
if (newExpression.arguments.length === 0) {
|
|
68
|
-
(0,
|
|
71
|
+
(0, location_js_1.report)(context, { node: callee, message: MESSAGE });
|
|
69
72
|
return;
|
|
70
73
|
}
|
|
71
|
-
const firstArgument = (0,
|
|
74
|
+
const firstArgument = (0, ast_js_1.getValueOfExpression)(context, newExpression.arguments[0], 'ObjectExpression');
|
|
72
75
|
if (!firstArgument) {
|
|
73
76
|
// Argument exists but its value is unknown
|
|
74
77
|
return;
|
|
75
78
|
}
|
|
76
|
-
const secrets = (0,
|
|
79
|
+
const secrets = (0, ast_js_1.getProperty)(firstArgument, 'secrets', context);
|
|
77
80
|
if (secrets?.value.type === 'ArrayExpression' && secrets.value.elements.length === 0) {
|
|
78
|
-
(0,
|
|
81
|
+
(0, location_js_1.report)(context, {
|
|
79
82
|
node: callee,
|
|
80
83
|
message: MESSAGE,
|
|
81
|
-
}, [(0,
|
|
84
|
+
}, [(0, location_js_1.toSecondaryLocation)(secrets)]);
|
|
82
85
|
}
|
|
83
86
|
else if (!secrets) {
|
|
84
|
-
(0,
|
|
87
|
+
(0, location_js_1.report)(context, {
|
|
85
88
|
node: callee,
|
|
86
89
|
message: MESSAGE,
|
|
87
|
-
}, [(0,
|
|
90
|
+
}, [(0, location_js_1.toSecondaryLocation)(firstArgument)]);
|
|
88
91
|
}
|
|
89
92
|
},
|
|
90
93
|
};
|
package/cjs/S5759/rule.js
CHANGED
|
@@ -51,26 +51,29 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
51
51
|
})();
|
|
52
52
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
53
53
|
exports.rule = void 0;
|
|
54
|
-
const
|
|
54
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
55
|
+
const module_js_1 = require("../helpers/module.js");
|
|
56
|
+
const ast_js_1 = require("../helpers/ast.js");
|
|
57
|
+
const location_js_1 = require("../helpers/location.js");
|
|
55
58
|
const meta = __importStar(require("./generated-meta.js"));
|
|
56
59
|
exports.rule = {
|
|
57
|
-
meta: (0,
|
|
60
|
+
meta: (0, generate_meta_js_1.generateMeta)(meta),
|
|
58
61
|
create(context) {
|
|
59
62
|
return {
|
|
60
63
|
CallExpression(node) {
|
|
61
64
|
const call = node;
|
|
62
65
|
const { callee, arguments: args } = call;
|
|
63
66
|
if (isSensitiveFQN(context, call) && args.length > 0) {
|
|
64
|
-
const xfwdProp = (0,
|
|
67
|
+
const xfwdProp = (0, ast_js_1.getProperty)(args[0], 'xfwd', context);
|
|
65
68
|
if (!xfwdProp) {
|
|
66
69
|
return;
|
|
67
70
|
}
|
|
68
|
-
const xfwdValue = (0,
|
|
71
|
+
const xfwdValue = (0, ast_js_1.getValueOfExpression)(context, xfwdProp.value, 'Literal');
|
|
69
72
|
if (xfwdValue?.value === true) {
|
|
70
|
-
(0,
|
|
73
|
+
(0, location_js_1.report)(context, {
|
|
71
74
|
node: callee,
|
|
72
75
|
message: 'Make sure forwarding client IP address is safe here.',
|
|
73
|
-
}, [(0,
|
|
76
|
+
}, [(0, location_js_1.toSecondaryLocation)(xfwdProp)]);
|
|
74
77
|
}
|
|
75
78
|
}
|
|
76
79
|
},
|
|
@@ -78,7 +81,7 @@ exports.rule = {
|
|
|
78
81
|
},
|
|
79
82
|
};
|
|
80
83
|
function isSensitiveFQN(context, call) {
|
|
81
|
-
const fqn = (0,
|
|
84
|
+
const fqn = (0, module_js_1.getFullyQualifiedName)(context, call);
|
|
82
85
|
return (fqn &&
|
|
83
86
|
['http-proxy.createProxyServer', 'http-proxy-middleware.createProxyMiddleware'].includes(fqn));
|
|
84
87
|
}
|
package/cjs/S5842/rule.js
CHANGED
|
@@ -51,7 +51,7 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
51
51
|
})();
|
|
52
52
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
53
53
|
exports.rule = void 0;
|
|
54
|
-
const
|
|
54
|
+
const generate_meta_js_1 = require("../helpers/generate-meta.js");
|
|
55
55
|
const meta = __importStar(require("./generated-meta.js"));
|
|
56
56
|
const rule_template_js_1 = require("../helpers/regex/rule-template.js");
|
|
57
57
|
exports.rule = (0, rule_template_js_1.createRegExpRule)(context => {
|
|
@@ -67,7 +67,7 @@ exports.rule = (0, rule_template_js_1.createRegExpRule)(context => {
|
|
|
67
67
|
}
|
|
68
68
|
},
|
|
69
69
|
};
|
|
70
|
-
}, (0,
|
|
70
|
+
}, (0, generate_meta_js_1.generateMeta)(meta));
|
|
71
71
|
function matchEmptyString(node) {
|
|
72
72
|
switch (node.type) {
|
|
73
73
|
case 'Alternative':
|