eslint-plugin-vercel-ai-security 1.3.10 → 1.4.0

package/CHANGELOG.md

@@ -1,3 +1,44 @@
+## 1.4.0
+
+### Minor Changes
+
+- [#299](https://github.com/ofri-peretz/eslint/pull/299) [`608defb`](https://github.com/ofri-peretz/eslint/commit/608defbbce6818e2ad4f51d7425e044c4ca04e3e) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Detect the AI SDK v7 `instructions` option, not just the deprecated `system`.
+
+  AI SDK v7 renamed the system-prompt option to `instructions` and marks `system` as
+  `@deprecated Use 'instructions' instead` in its own type definitions. Four rules matched
+  the property name `system` literally, so on any code written against current AI SDK docs
+  they reported nothing at all:
+
+  - `no-dynamic-system-prompt`
+  - `require-validated-prompt` (its `unsafeSystemPrompt` branch)
+  - `require-rag-content-validation`
+  - `no-sensitive-in-prompt`
+
+  All four now accept either spelling via a shared `SYSTEM_PROMPT_PROPS` set, so `system`
+  keeps working for pre-v7 code and `instructions` is covered going forward.
+
+  The same pass closed a second silent miss in those rules: a quoted key
+  (`{ "instructions": … }`) parses to a string `Literal`, not an `Identifier`, and
+  three of the four rules read only `Identifier` keys — so putting quotes round the
+  key was enough to stop them firing. Key extraction now goes through a shared
+  `getStaticPropName` helper. Three fixtures that recorded this as expected
+  behaviour (one labelled "documented FN: only Identifier keys are matched") moved
+  from `valid` to `invalid`, since a rule that stops firing on formatting is a miss,
+  not a design decision. Computed keys (`{ [k]: … }`) still return `null` — there
+  the name genuinely isn't statically known.
+
+  This was found the hard way. Scanning the `nuxt-ui-templates/chat` template, a system
+  prompt interpolating the signed-in user's name straight into `instructions:` went
+  unreported — the finding was spotted by reading the file, not by the linter that exists to
+  catch it. Each of the four rules now carries a regression test that fails if the
+  `instructions` spelling is dropped again, and one of them uses the exact template-literal
+  shape from that file.
+
+### Patch Changes
+
+- Updated dependencies [[`09d2951`](https://github.com/ofri-peretz/eslint/commit/09d2951b3ac74efc9ba49b64e9089d66800b16cc)]:
+  - @interlace/eslint-devkit@1.4.4
+
 ## 1.3.10
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-vercel-ai-security",
-  "version": "1.3.10",
+  "version": "1.4.0",
   "description": "ESLint plugin for Vercel AI SDK security — detects prompt injection, system-prompt leaks, hardcoded API keys, and unvalidated model output in generateText and streamText.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -86,7 +86,7 @@
   },
   "dependencies": {
     "tslib": "^2.3.0",
-    "@interlace/eslint-devkit": "^1.4.3"
+    "@interlace/eslint-devkit": "^1.4.4"
   },
   "devDependencies": {
     "@ai-sdk/openai": "^4.0.16",

package/src/index.js

@@ -152,7 +152,7 @@ exports.rules = {
 exports.plugin = {
     meta: {
         name: 'eslint-plugin-vercel-ai-security',
-        version: '1.3.10',
+        version: '1.4.0',
     },
     rules: exports.rules,
 };

package/src/rules/no-dynamic-system-prompt/index.js

@@ -12,6 +12,7 @@ exports.noDynamicSystemPrompt = void 0;
  * @see OWASP ASI01: Agent Confusion
  */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const prompt_props_1 = require("../../utils/prompt-props");
 exports.noDynamicSystemPrompt = (0, eslint_devkit_1.createRule)({
     name: 'no-dynamic-system-prompt',
     meta: {
@@ -96,12 +97,12 @@ exports.noDynamicSystemPrompt = (0, eslint_devkit_1.createRule)({
                 const optionsArg = node.arguments[0];
                 if (!optionsArg || optionsArg.type !== 'ObjectExpression')
                     return;
-                // Find system property
+                // Find the system-prompt property (`instructions` in AI SDK v7+, `system` before it)
                 for (const prop of optionsArg.properties) {
-                    if (prop.type !== 'Property')
+                    if (prop.type !== eslint_devkit_1.AST_NODE_TYPES.Property)
                         continue;
-                    const keyName = prop.key.type === 'Identifier' ? prop.key.name : null;
-                    if (keyName !== 'system')
+                    const keyName = (0, prompt_props_1.getStaticPropName)(prop.key);
+                    if (!(0, prompt_props_1.isSystemPromptProp)(keyName))
                         continue;
                     // Check if system prompt is dynamic
                     if (isDynamicContent(prop.value)) {

package/src/rules/no-sensitive-in-prompt/index.js

@@ -12,6 +12,7 @@ exports.noSensitiveInPrompt = void 0;
  * @see OWASP LLM02: Sensitive Information Disclosure
  */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const prompt_props_1 = require("../../utils/prompt-props");
 exports.noSensitiveInPrompt = (0, eslint_devkit_1.createRule)({
     name: 'no-sensitive-in-prompt',
     meta: {
@@ -117,12 +118,12 @@ exports.noSensitiveInPrompt = (0, eslint_devkit_1.createRule)({
                 const optionsArg = node.arguments[0];
                 if (!optionsArg || optionsArg.type !== 'ObjectExpression')
                     return;
-                // Check prompt, system, and messages properties
-                const propsToCheck = new Set(['prompt', 'system', 'messages']);
+                // Check prompt, the system-prompt props, and messages
+                const propsToCheck = new Set(['prompt', 'messages', ...prompt_props_1.SYSTEM_PROMPT_PROPS]);
                 for (const prop of optionsArg.properties) {
-                    if (prop.type !== 'Property')
+                    if (prop.type !== eslint_devkit_1.AST_NODE_TYPES.Property)
                         continue;
-                    const keyName = prop.key.type === 'Identifier' ? prop.key.name : null;
+                    const keyName = (0, prompt_props_1.getStaticPropName)(prop.key);
                     if (!keyName || !propsToCheck.has(keyName))
                         continue;
                     const sensitiveVar = findSensitiveData(prop.value);

package/src/rules/require-rag-content-validation/index.js

@@ -12,6 +12,7 @@ exports.requireRagContentValidation = void 0;
  * @see OWASP ASI07: Poisoned RAG Pipeline
  */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const prompt_props_1 = require("../../utils/prompt-props");
 exports.requireRagContentValidation = (0, eslint_devkit_1.createRule)({
     name: 'require-rag-content-validation',
     meta: {
@@ -157,10 +158,10 @@ exports.requireRagContentValidation = (0, eslint_devkit_1.createRule)({
                     return;
                 // Check prompt property
                 for (const prop of optionsArg.properties) {
-                    if (prop.type !== 'Property')
+                    if (prop.type !== eslint_devkit_1.AST_NODE_TYPES.Property)
                         continue;
-                    const keyName = prop.key.type === 'Identifier' ? prop.key.name : null;
-                    if (keyName !== 'prompt' && keyName !== 'system')
+                    const keyName = (0, prompt_props_1.getStaticPropName)(prop.key);
+                    if (keyName !== 'prompt' && !(0, prompt_props_1.isSystemPromptProp)(keyName))
                         continue;
                     const ragSource = containsRagContent(prop.value);
                     if (ragSource) {

package/src/rules/require-validated-prompt/index.js

@@ -13,6 +13,7 @@ exports.requireValidatedPrompt = void 0;
  * @see https://owasp.org/www-project-top-10-for-large-language-model-applications/
  */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const prompt_props_1 = require("../../utils/prompt-props");
 exports.requireValidatedPrompt = (0, eslint_devkit_1.createRule)({
     name: 'require-validated-prompt',
     meta: {
@@ -192,13 +193,9 @@ exports.requireValidatedPrompt = (0, eslint_devkit_1.createRule)({
             }
             // Check for unsafe prompt property
             for (const prop of optionsArg.properties) {
-                if (prop.type !== 'Property')
+                if (prop.type !== eslint_devkit_1.AST_NODE_TYPES.Property)
                     continue;
-                const keyName = prop.key.type === 'Identifier'
-                    ? prop.key.name
-                    : prop.key.type === 'Literal'
-                        ? String(prop.key.value)
-                        : null;
+                const keyName = (0, prompt_props_1.getStaticPropName)(prop.key);
                 if (keyName === 'prompt') {
                     const result = hasUnsafeUserInput(prop.value);
                     if (result.unsafe) {
@@ -212,7 +209,7 @@ exports.requireValidatedPrompt = (0, eslint_devkit_1.createRule)({
                         });
                     }
                 }
-                if (keyName === 'system') {
+                if ((0, prompt_props_1.isSystemPromptProp)(keyName)) {
                     const result = hasUnsafeUserInput(prop.value);
                     if (result.unsafe) {
                         context.report({

package/src/utils/prompt-props.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+import { type TSESTree } from '@interlace/eslint-devkit';
+/**
+ * Property names the AI SDK accepts for the system prompt.
+ *
+ * As of AI SDK v7 the canonical name is `instructions`; `system` still works but
+ * is marked `@deprecated Use 'instructions' instead` in the SDK's own types. Both
+ * must be checked — code written against current docs uses `instructions`, and
+ * code predating v7 uses `system`.
+ */
+export declare const SYSTEM_PROMPT_PROPS: ReadonlySet<string>;
+/** True when `name` is a property the AI SDK treats as the system prompt. */
+export declare function isSystemPromptProp(name: string | null): boolean;
+/**
+ * Static name of an object property key, or `null` when it isn't statically known.
+ *
+ * `{ instructions: x }` and `{ 'instructions': x }` are the same property, but the
+ * first parses to an `Identifier` key and the second to a string `Literal`. Reading
+ * only `Identifier` silently skips the quoted form, so a rule stops firing on code
+ * that is semantically identical. Computed keys (`{ [k]: x }`) stay `null` — the
+ * name genuinely isn't known statically.
+ */
+export declare function getStaticPropName(key: TSESTree.Node): string | null;

package/src/utils/prompt-props.js

@@ -0,0 +1,40 @@
+"use strict";
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SYSTEM_PROMPT_PROPS = void 0;
+exports.isSystemPromptProp = isSystemPromptProp;
+exports.getStaticPropName = getStaticPropName;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+/**
+ * Property names the AI SDK accepts for the system prompt.
+ *
+ * As of AI SDK v7 the canonical name is `instructions`; `system` still works but
+ * is marked `@deprecated Use 'instructions' instead` in the SDK's own types. Both
+ * must be checked — code written against current docs uses `instructions`, and
+ * code predating v7 uses `system`.
+ */
+exports.SYSTEM_PROMPT_PROPS = new Set(['instructions', 'system']);
+/** True when `name` is a property the AI SDK treats as the system prompt. */
+function isSystemPromptProp(name) {
+    return name !== null && exports.SYSTEM_PROMPT_PROPS.has(name);
+}
+/**
+ * Static name of an object property key, or `null` when it isn't statically known.
+ *
+ * `{ instructions: x }` and `{ 'instructions': x }` are the same property, but the
+ * first parses to an `Identifier` key and the second to a string `Literal`. Reading
+ * only `Identifier` silently skips the quoted form, so a rule stops firing on code
+ * that is semantically identical. Computed keys (`{ [k]: x }`) stay `null` — the
+ * name genuinely isn't known statically.
+ */
+function getStaticPropName(key) {
+    if (key.type === eslint_devkit_1.AST_NODE_TYPES.Identifier)
+        return key.name;
+    if (key.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof key.value === 'string')
+        return key.value;
+    return null;
+}