eslint-plugin-vercel-ai-security 1.3.9 → 1.4.0

package/CHANGELOG.md

@@ -1,3 +1,63 @@
+## 1.4.0
+
+### Minor Changes
+
+- [#299](https://github.com/ofri-peretz/eslint/pull/299) [`608defb`](https://github.com/ofri-peretz/eslint/commit/608defbbce6818e2ad4f51d7425e044c4ca04e3e) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Detect the AI SDK v7 `instructions` option, not just the deprecated `system`.
+
+  AI SDK v7 renamed the system-prompt option to `instructions` and marks `system` as
+  `@deprecated Use 'instructions' instead` in its own type definitions. Four rules matched
+  the property name `system` literally, so on any code written against current AI SDK docs
+  they reported nothing at all:
+
+  - `no-dynamic-system-prompt`
+  - `require-validated-prompt` (its `unsafeSystemPrompt` branch)
+  - `require-rag-content-validation`
+  - `no-sensitive-in-prompt`
+
+  All four now accept either spelling via a shared `SYSTEM_PROMPT_PROPS` set, so `system`
+  keeps working for pre-v7 code and `instructions` is covered going forward.
+
+  The same pass closed a second silent miss in those rules: a quoted key
+  (`{ "instructions": … }`) parses to a string `Literal`, not an `Identifier`, and
+  three of the four rules read only `Identifier` keys — so putting quotes round the
+  key was enough to stop them firing. Key extraction now goes through a shared
+  `getStaticPropName` helper. Three fixtures that recorded this as expected
+  behaviour (one labelled "documented FN: only Identifier keys are matched") moved
+  from `valid` to `invalid`, since a rule that stops firing on formatting is a miss,
+  not a design decision. Computed keys (`{ [k]: … }`) still return `null` — there
+  the name genuinely isn't statically known.
+
+  This was found the hard way. Scanning the `nuxt-ui-templates/chat` template, a system
+  prompt interpolating the signed-in user's name straight into `instructions:` went
+  unreported — the finding was spotted by reading the file, not by the linter that exists to
+  catch it. Each of the four rules now carries a regression test that fails if the
+  `instructions` spelling is dropped again, and one of them uses the exact template-literal
+  shape from that file.
+
+### Patch Changes
+
+- Updated dependencies [[`09d2951`](https://github.com/ofri-peretz/eslint/commit/09d2951b3ac74efc9ba49b64e9089d66800b16cc)]:
+  - @interlace/eslint-devkit@1.4.4
+
+## 1.3.10
+
+### Patch Changes
+
+- [#294](https://github.com/ofri-peretz/eslint/pull/294) [`659f6dc`](https://github.com/ofri-peretz/eslint/commit/659f6dc0181b03b675f72b5949fcf123dd066358) Thanks [@ofri-peretz](https://github.com/ofri-peretz)! - Rewrite `description` and `keywords` on every published package for npm search discovery. npm ranks on name, description, and keywords, and the registry only picks up these fields at publish — so this is metadata-only and takes effect for each package on its next release.
+
+  **Descriptions now lead with the search phrase.** Every one starts `ESLint plugin for <the thing you'd search>` instead of a brand-first or category-first framing, and names the concrete vulnerabilities the plugin actually detects. Three were corrected while doing so:
+
+  - `eslint-plugin-import-next` claimed "100x faster no-cycle detection". No 100x measurement exists: `CLAIMS.md` records **3.1x end-to-end** (8x in pure rule execution) on a 5,483-file React codebase, and the highest number in any benchmark result is 54.9x on the synthetic corpus. The description now states the real-codebase figure.
+  - `eslint-plugin-secure-coding` claimed SQL injection, XSS and CSRF coverage — none of which are its rules. It now names what it does detect: LDAP, XPath, XXE, GraphQL and template injection, unsafe deserialization, ReDoS, missing authentication, and PII in logs.
+  - `eslint-plugin-secure-coding` ("89 rules") and `eslint-plugin-react-a11y` ("37 rules") hard-coded rule counts that had drifted from reality. Counts are generated into `interlace-numbers.json`; hand-typed copies are removed rather than corrected.
+
+  **Keywords now match the vocabulary of the plugins that rank.** `eslint-plugin-security`, `eslint-plugin-jsx-a11y`, `eslint-plugin-n` and `eslint-plugin-import` all carry the `eslint` / `eslintplugin` / `eslint-plugin` trio — six of our packages were missing `eslintplugin`, and every one now carries all three plus `static-analysis`, `linting` and `code-quality`. Security plugins add `sast`, `appsec` and `vulnerability`; `node-security` and `secure-coding` also carry `nodesecurity`, the exact keyword `eslint-plugin-security` ranks on. Each plugin gained the CWE identifiers and attack names for what it detects (`cwe-78` command injection, `cwe-22` path traversal, `cwe-89` SQL injection, `cwe-79` XSS, `cwe-347` JWT algorithm confusion, `cwe-352` CSRF, `cwe-943` NoSQL injection), and `node-security` gained the crypto vocabulary it had been missing entirely despite absorbing the crypto rule set (`crypto`, `cryptography`, `weak-hash`, `md5`, `sha1`, `timing-attack`).
+
+  No rule behavior, exports, or configuration changes.
+
+- Updated dependencies [[`e1cdf83`](https://github.com/ofri-peretz/eslint/commit/e1cdf83e3db761907f0ab06f7fc6c1f1da7513a5), [`659f6dc`](https://github.com/ofri-peretz/eslint/commit/659f6dc0181b03b675f72b5949fcf123dd066358)]:
+  - @interlace/eslint-devkit@1.4.3
+
 ## 1.3.9
 
 ### Patch Changes

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "eslint-plugin-vercel-ai-security",
-  "version": "1.3.9",
-  "description": "Security-focused ESLint plugin for Vercel AI SDK. SDK-aware rules for generateText, streamText, tools, and streaming patterns with full type knowledge.",
+  "version": "1.4.0",
+  "description": "ESLint plugin for Vercel AI SDK security — detects prompt injection, system-prompt leaks, hardcoded API keys, and unvalidated model output in generateText and streamText.",
   "type": "commonjs",
   "main": "./src/index.js",
   "types": "./src/index.d.ts",
@@ -43,27 +43,35 @@
   ],
   "keywords": [
     "eslint",
-    "eslint-plugin",
     "eslintplugin",
-    "interlace-security",
+    "eslint-plugin",
+    "static-analysis",
+    "linting",
+    "code-quality",
     "security",
+    "sast",
+    "appsec",
+    "vulnerability",
+    "owasp",
+    "cwe",
+    "interlace-security",
     "vercel",
     "vercel-ai",
+    "vercel-ai-sdk",
     "ai-sdk",
-    "generateText",
-    "streamText",
+    "ai-security",
     "llm",
+    "llm-security",
+    "generative-ai",
     "prompt-injection",
-    "owasp",
     "owasp-llm-top-10",
-    "cwe",
-    "vulnerability",
+    "rag",
+    "tool-calling",
+    "generateText",
+    "streamText",
     "llm-optimized",
     "ai-assistant",
-    "typescript",
-    "linting",
-    "code-quality",
-    "static-analysis"
+    "typescript"
   ],
   "engines": {
     "node": ">=18.0.0"
@@ -78,7 +86,7 @@
   },
   "dependencies": {
     "tslib": "^2.3.0",
-    "@interlace/eslint-devkit": "^1.4.2"
+    "@interlace/eslint-devkit": "^1.4.4"
   },
   "devDependencies": {
     "@ai-sdk/openai": "^4.0.16",

package/src/index.js

@@ -152,7 +152,7 @@ exports.rules = {
 exports.plugin = {
     meta: {
         name: 'eslint-plugin-vercel-ai-security',
-        version: '1.3.9',
+        version: '1.4.0',
     },
     rules: exports.rules,
 };

package/src/rules/no-dynamic-system-prompt/index.js

@@ -12,6 +12,7 @@ exports.noDynamicSystemPrompt = void 0;
  * @see OWASP ASI01: Agent Confusion
  */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const prompt_props_1 = require("../../utils/prompt-props");
 exports.noDynamicSystemPrompt = (0, eslint_devkit_1.createRule)({
     name: 'no-dynamic-system-prompt',
     meta: {
@@ -96,12 +97,12 @@ exports.noDynamicSystemPrompt = (0, eslint_devkit_1.createRule)({
                 const optionsArg = node.arguments[0];
                 if (!optionsArg || optionsArg.type !== 'ObjectExpression')
                     return;
-                // Find system property
+                // Find the system-prompt property (`instructions` in AI SDK v7+, `system` before it)
                 for (const prop of optionsArg.properties) {
-                    if (prop.type !== 'Property')
+                    if (prop.type !== eslint_devkit_1.AST_NODE_TYPES.Property)
                         continue;
-                    const keyName = prop.key.type === 'Identifier' ? prop.key.name : null;
-                    if (keyName !== 'system')
+                    const keyName = (0, prompt_props_1.getStaticPropName)(prop.key);
+                    if (!(0, prompt_props_1.isSystemPromptProp)(keyName))
                         continue;
                     // Check if system prompt is dynamic
                     if (isDynamicContent(prop.value)) {

package/src/rules/no-sensitive-in-prompt/index.js

@@ -12,6 +12,7 @@ exports.noSensitiveInPrompt = void 0;
  * @see OWASP LLM02: Sensitive Information Disclosure
  */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const prompt_props_1 = require("../../utils/prompt-props");
 exports.noSensitiveInPrompt = (0, eslint_devkit_1.createRule)({
     name: 'no-sensitive-in-prompt',
     meta: {
@@ -117,12 +118,12 @@ exports.noSensitiveInPrompt = (0, eslint_devkit_1.createRule)({
                 const optionsArg = node.arguments[0];
                 if (!optionsArg || optionsArg.type !== 'ObjectExpression')
                     return;
-                // Check prompt, system, and messages properties
-                const propsToCheck = new Set(['prompt', 'system', 'messages']);
+                // Check prompt, the system-prompt props, and messages
+                const propsToCheck = new Set(['prompt', 'messages', ...prompt_props_1.SYSTEM_PROMPT_PROPS]);
                 for (const prop of optionsArg.properties) {
-                    if (prop.type !== 'Property')
+                    if (prop.type !== eslint_devkit_1.AST_NODE_TYPES.Property)
                         continue;
-                    const keyName = prop.key.type === 'Identifier' ? prop.key.name : null;
+                    const keyName = (0, prompt_props_1.getStaticPropName)(prop.key);
                     if (!keyName || !propsToCheck.has(keyName))
                         continue;
                     const sensitiveVar = findSensitiveData(prop.value);

package/src/rules/require-rag-content-validation/index.js

@@ -12,6 +12,7 @@ exports.requireRagContentValidation = void 0;
  * @see OWASP ASI07: Poisoned RAG Pipeline
  */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const prompt_props_1 = require("../../utils/prompt-props");
 exports.requireRagContentValidation = (0, eslint_devkit_1.createRule)({
     name: 'require-rag-content-validation',
     meta: {
@@ -157,10 +158,10 @@ exports.requireRagContentValidation = (0, eslint_devkit_1.createRule)({
                     return;
                 // Check prompt property
                 for (const prop of optionsArg.properties) {
-                    if (prop.type !== 'Property')
+                    if (prop.type !== eslint_devkit_1.AST_NODE_TYPES.Property)
                         continue;
-                    const keyName = prop.key.type === 'Identifier' ? prop.key.name : null;
-                    if (keyName !== 'prompt' && keyName !== 'system')
+                    const keyName = (0, prompt_props_1.getStaticPropName)(prop.key);
+                    if (keyName !== 'prompt' && !(0, prompt_props_1.isSystemPromptProp)(keyName))
                         continue;
                     const ragSource = containsRagContent(prop.value);
                     if (ragSource) {

package/src/rules/require-validated-prompt/index.js

@@ -13,6 +13,7 @@ exports.requireValidatedPrompt = void 0;
  * @see https://owasp.org/www-project-top-10-for-large-language-model-applications/
  */
 const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const prompt_props_1 = require("../../utils/prompt-props");
 exports.requireValidatedPrompt = (0, eslint_devkit_1.createRule)({
     name: 'require-validated-prompt',
     meta: {
@@ -192,13 +193,9 @@ exports.requireValidatedPrompt = (0, eslint_devkit_1.createRule)({
             }
             // Check for unsafe prompt property
             for (const prop of optionsArg.properties) {
-                if (prop.type !== 'Property')
+                if (prop.type !== eslint_devkit_1.AST_NODE_TYPES.Property)
                     continue;
-                const keyName = prop.key.type === 'Identifier'
-                    ? prop.key.name
-                    : prop.key.type === 'Literal'
-                        ? String(prop.key.value)
-                        : null;
+                const keyName = (0, prompt_props_1.getStaticPropName)(prop.key);
                 if (keyName === 'prompt') {
                     const result = hasUnsafeUserInput(prop.value);
                     if (result.unsafe) {
@@ -212,7 +209,7 @@ exports.requireValidatedPrompt = (0, eslint_devkit_1.createRule)({
                         });
                     }
                 }
-                if (keyName === 'system') {
+                if ((0, prompt_props_1.isSystemPromptProp)(keyName)) {
                     const result = hasUnsafeUserInput(prop.value);
                     if (result.unsafe) {
                         context.report({

package/src/utils/prompt-props.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+import { type TSESTree } from '@interlace/eslint-devkit';
+/**
+ * Property names the AI SDK accepts for the system prompt.
+ *
+ * As of AI SDK v7 the canonical name is `instructions`; `system` still works but
+ * is marked `@deprecated Use 'instructions' instead` in the SDK's own types. Both
+ * must be checked — code written against current docs uses `instructions`, and
+ * code predating v7 uses `system`.
+ */
+export declare const SYSTEM_PROMPT_PROPS: ReadonlySet<string>;
+/** True when `name` is a property the AI SDK treats as the system prompt. */
+export declare function isSystemPromptProp(name: string | null): boolean;
+/**
+ * Static name of an object property key, or `null` when it isn't statically known.
+ *
+ * `{ instructions: x }` and `{ 'instructions': x }` are the same property, but the
+ * first parses to an `Identifier` key and the second to a string `Literal`. Reading
+ * only `Identifier` silently skips the quoted form, so a rule stops firing on code
+ * that is semantically identical. Computed keys (`{ [k]: x }`) stay `null` — the
+ * name genuinely isn't known statically.
+ */
+export declare function getStaticPropName(key: TSESTree.Node): string | null;

package/src/utils/prompt-props.js

@@ -0,0 +1,40 @@
+"use strict";
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SYSTEM_PROMPT_PROPS = void 0;
+exports.isSystemPromptProp = isSystemPromptProp;
+exports.getStaticPropName = getStaticPropName;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+/**
+ * Property names the AI SDK accepts for the system prompt.
+ *
+ * As of AI SDK v7 the canonical name is `instructions`; `system` still works but
+ * is marked `@deprecated Use 'instructions' instead` in the SDK's own types. Both
+ * must be checked — code written against current docs uses `instructions`, and
+ * code predating v7 uses `system`.
+ */
+exports.SYSTEM_PROMPT_PROPS = new Set(['instructions', 'system']);
+/** True when `name` is a property the AI SDK treats as the system prompt. */
+function isSystemPromptProp(name) {
+    return name !== null && exports.SYSTEM_PROMPT_PROPS.has(name);
+}
+/**
+ * Static name of an object property key, or `null` when it isn't statically known.
+ *
+ * `{ instructions: x }` and `{ 'instructions': x }` are the same property, but the
+ * first parses to an `Identifier` key and the second to a string `Literal`. Reading
+ * only `Identifier` silently skips the quoted form, so a rule stops firing on code
+ * that is semantically identical. Computed keys (`{ [k]: x }`) stay `null` — the
+ * name genuinely isn't known statically.
+ */
+function getStaticPropName(key) {
+    if (key.type === eslint_devkit_1.AST_NODE_TYPES.Identifier)
+        return key.name;
+    if (key.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof key.value === 'string')
+        return key.value;
+    return null;
+}