eslint-plugin-vercel-ai-security 1.4.1 → 1.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-vercel-ai-security",
-  "version": "1.4.1",
+  "version": "1.4.2",
   "description": "ESLint plugin for Vercel AI SDK security — detects prompt injection, system-prompt leaks, hardcoded API keys, and unvalidated model output in generateText and streamText.",
   "type": "commonjs",
   "main": "./src/index.js",

package/src/index.js

@@ -82,7 +82,7 @@ exports.rules = {
 exports.plugin = {
     meta: {
         name: 'eslint-plugin-vercel-ai-security',
-        version: '1.4.1',
+        version: '1.4.2',
     },
     rules: exports.rules,
 };

package/src/rules/no-dynamic-system-prompt/index.js

@@ -80,7 +80,7 @@ exports.noDynamicSystemPrompt = (0, eslint_devkit_1.createRule)({
                 for (const prop of optionsArg.properties) {
                     if (prop.type !== eslint_devkit_1.AST_NODE_TYPES.Property)
                         continue;
-                    const keyName = (0, prompt_props_1.getStaticPropName)(prop.key);
+                    const keyName = (0, prompt_props_1.getStaticPropName)(prop);
                     if (!(0, prompt_props_1.isSystemPromptProp)(keyName))
                         continue;
                     if (isDynamicContent(prop.value)) {

package/src/rules/no-sensitive-in-prompt/index.js

@@ -103,7 +103,7 @@ exports.noSensitiveInPrompt = (0, eslint_devkit_1.createRule)({
                 for (const prop of optionsArg.properties) {
                     if (prop.type !== eslint_devkit_1.AST_NODE_TYPES.Property)
                         continue;
-                    const keyName = (0, prompt_props_1.getStaticPropName)(prop.key);
+                    const keyName = (0, prompt_props_1.getStaticPropName)(prop);
                     if (!keyName || !propsToCheck.has(keyName))
                         continue;
                     const sensitiveVar = findSensitiveData(prop.value);

package/src/rules/require-rag-content-validation/index.js

@@ -132,7 +132,7 @@ exports.requireRagContentValidation = (0, eslint_devkit_1.createRule)({
                 for (const prop of optionsArg.properties) {
                     if (prop.type !== eslint_devkit_1.AST_NODE_TYPES.Property)
                         continue;
-                    const keyName = (0, prompt_props_1.getStaticPropName)(prop.key);
+                    const keyName = (0, prompt_props_1.getStaticPropName)(prop);
                     if (keyName !== 'prompt' && !(0, prompt_props_1.isSystemPromptProp)(keyName))
                         continue;
                     const ragSource = containsRagContent(prop.value);

package/src/rules/require-validated-prompt/index.js

@@ -162,7 +162,7 @@ exports.requireValidatedPrompt = (0, eslint_devkit_1.createRule)({
             for (const prop of optionsArg.properties) {
                 if (prop.type !== eslint_devkit_1.AST_NODE_TYPES.Property)
                     continue;
-                const keyName = (0, prompt_props_1.getStaticPropName)(prop.key);
+                const keyName = (0, prompt_props_1.getStaticPropName)(prop);
                 if (keyName === 'prompt') {
                     const result = hasUnsafeUserInput(prop.value);
                     if (result.unsafe) {

package/src/utils/prompt-props.js

@@ -8,10 +8,13 @@ exports.SYSTEM_PROMPT_PROPS = new Set(['instructions', 'system']);
 function isSystemPromptProp(name) {
     return name !== null && exports.SYSTEM_PROMPT_PROPS.has(name);
 }
-function getStaticPropName(key) {
-    if (key.type === eslint_devkit_1.AST_NODE_TYPES.Identifier)
-        return key.name;
-    if (key.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof key.value === 'string')
-        return key.value;
+function getStaticPropName(prop) {
+    if (prop.computed)
+        return null;
+    if (prop.key.type === eslint_devkit_1.AST_NODE_TYPES.Identifier)
+        return prop.key.name;
+    if (prop.key.type === eslint_devkit_1.AST_NODE_TYPES.Literal && typeof prop.key.value === 'string') {
+        return prop.key.value;
+    }
     return null;
 }