@f1stnpm2/ex-similique-suscipit NPM

@f1stnpm2/ex-similique-suscipit

ESLint rules for Node Security

This project will help identify potential security hotspots, but finds a lot of false positives which need triage by a human.

Installation

npm install --save-dev @f1stnpm2/ex-similique-suscipit

yarn add --dev @f1stnpm2/ex-similique-suscipit

Usage

Flat config (requires eslint >= v8.23.0)

Add the following to your eslint.config.js file:

const pluginSecurity = require('@f1stnpm2/ex-similique-suscipit');

module.exports = [pluginSecurity.configs.recommended];

eslintrc config (deprecated)

Add the following to your .eslintrc file:

module.exports = {
  extends: ['plugin:security/recommended-legacy'],
};

Developer guide

Use GitHub pull requests.
Conventions:
We use our custom ESLint setup.
Please implement a test for each new rule and use this command to be sure the new code respects the style guide and the tests keep passing:

npm run-script cont-int

Tests

npm test

Rules

⚠️ Configurations set to warn in.\ ✅ Set in the recommended configuration.

Name	Description	⚠️
detect-bidi-characters	Detects trojan source attacks that employ unicode bidi attacks to inject malicious code.	✅
detect-buffer-noassert	Detects calls to "buffer" with "noAssert" flag set.	✅
detect-child-process	Detects instances of "child_process" & non-literal "exec()" calls.	✅
detect-disable-mustache-escape	Detects "object.escapeMarkup = false", which can be used with some template engines to disable escaping of HTML entities.	✅
detect-eval-with-expression	Detects "eval(variable)" which can allow an attacker to run arbitrary code inside your process.	✅
detect-new-buffer	Detects instances of new Buffer(argument) where argument is any non-literal value.	✅
detect-no-csrf-before-method-override	Detects Express "csrf" middleware setup before "method-override" middleware.	✅
detect-non-literal-fs-filename	Detects variable in filename argument of "fs" calls, which might allow an attacker to access anything on your system.	✅
detect-non-literal-regexp	Detects "RegExp(variable)", which might allow an attacker to DOS your server with a long-running regular expression.	✅
detect-non-literal-require	Detects "require(variable)", which might allow an attacker to load and run arbitrary code, or access arbitrary files on disk.	✅
detect-object-injection	Detects "variablekey" as a left- or right-hand assignment operand.	✅
detect-possible-timing-attacks	Detects insecure comparisons (`==`, `!=`, `!==` and `===`), which check input sequentially.	✅
detect-pseudoRandomBytes	Detects if "pseudoRandomBytes()" is in use, which might not give you the randomness you need and expect.	✅
detect-unsafe-regex	Detects potentially unsafe regular expressions, which may take a very long time to run, blocking the event loop.	✅

fastcopy storagegateway error-handling regular expression text flux ast parsing stylesheet react-hooks debugger dependency manager styling prototype call tester assertion rm -fr rangeerror patch callbind directory prefix prune mixins findLastIndex escape visual emr cloudsearch find es2018 stdlib getopt Object.values joi intrinsic writable ansi apollo duplex schema workspace:*less mixins elb terminal extra core-js watcher protobuf sameValueZero es8 browserlist xhr array forEach Rx match slice toArray walking ESnext optimizer fsevents ReactiveExtensions wrap kinesis byteOffset persistent shrinkwrap log buffer ECMAScript 2020 throttle auth scheme form react l10n util.inspect es2017 is plugin in character streams2 deepcopy findLast native busy argparse link linewrap ender WebSocket find-up formatting hooks node whatwg CSS bluebird hot touch serialization dynamodb waf validation superstruct loadbalancing forms glacier string symlinks fs property hardlinks stateless ponyfill weakmap console TypeBox channel monorepo ReactiveX ES2021 regexp module Observables utility nodejs proto byteLength rest clone es2016 URL JSON-Schema stringifier typedarrays String.prototype.matchAll global $.extend iterate number flatMap mapreduce trimLeft japanese own lesscss slot read input shared look-up -0 yup es6 figlet argument process values symbol positive watchFile qs progress cloudformation toSorted chai promises rfc4122 util names ES3 random es2015 spec linux side ECMAScript 2015 compare package manager ECMAScript 7 vars jsonpath cache drop es 0 emoji name syntaxerror testing BigInt64Array groupBy up serializer browserslist core endpoint client colour status descriptor pipe iterator from Int16Array exit rmdir Uint16Array negative mkdirp fps preprocessor format exec create generics streams callback arktype parents Array.prototype.flatten idle setPrototypeOf identifiers arraybuffer jasmine valid Symbol ArrayBuffer.prototype.slice invariant chromium BigUint64Array less css vest 256 color ES2023 JSON eslintconfig entries css sequence rgb once jsx cloudtrail ES5 elasticache ascii sinatra uninstall settings mkdir workflow typanion proxy url preserve-symlinks concat dependencies id fast isConcatSpreadable bcrypt length throat picomatch URLSearchParams variables Float64Array promise optimist route53 moment structuredClone style phone code points mru ava Object.is ES2017 listeners collection ECMAScript 2019 parse assign router runtime validate Push colors es7 redux view option matches dotenv Object.entries ec2 parser less.js _.extend jsdiff callbound http typescript signals weakset key minimal findup collection.es6 uuid ECMAScript 2022 flatten api [[Prototype]]speed RegExp#flags performant ECMAScript 5 toobject bundling gradients css emit less Iterator tslib properties flag fast-copy ECMAScript 2016 windows pnpm9 swf efficient enumerable write move awesomesauce deep-clone crypto task chrome YAML curl express columns s3 trim agent RxJS queueMicrotask airbnb exit-code sham codes indicator spinner middleware break handlers styled-components WebSockets pretty await iam app extend trimRight typedarray object Uint8Array Uint32Array mocha toolkit amazon open type date reuse less compiler utilities environments deep-copy Array.prototype.filter queue compile less resolve language bundler stringify es5 sigint watch setImmediate signal omit typeerror includes art watching multi-package buffers equal cloudwatch shebang eslint datastructure deterministic check trimEnd higher-order path starter css less eslintplugin a11y keys ECMAScript 2021 electron eslint-plugin tdd nested css concatMap arrays globals function @@toStringTag extension get ES2016 debug nope Object.assign Microsoft request eventEmitter https bind Observable output offset config macos pyyaml Array.prototype.includes tools fullwidth banner typesafe String.prototype.trim interrupts data ie sorted Array.prototype.findLastIndex ECMAScript 2018 import Array.prototype.contains negative zero autoscaling command importexport tostringtag robust ECMAScript 6 symbols react-hook-form package __proto__Object.defineProperty require installer trimStart assert classes operating-system hookform rm -rf vpc set shim last Array.prototype.flatMap dom some deepclone metadata value term eventDispatcher environment immer args setter traverse getter consume logging Array filter web call-bound graphql dataView telephone readable full events authentication toStringTag Map react-testing-library push width getPrototypeOf npm hasOwnProperty sns RFC-6455 inspect modules mime-db concurrency libphonenumber css nesting guid ES2022 command-line Int8Array commander reduce regex worker file system ES2020 TypeScript wait sharedarraybuffer test Array.prototype.findLast

@crabas0npm/possimus-fugit-nulla @f1stnpm/corporis-velit-deleniti-temporibus @f1stnpm/dolor-officia-est-asperiores @f1stnpm/ea-sunt-delectus-nihil @f1stnpm/eius-ab-blanditiis-voluptas @f1stnpm/molestias-sint-cupiditate-illum @f1stnpm/repellat-eveniet-pariatur-voluptas @f1stnpm/tenetur-dicta-praesentium-explicabo @f1stnpm/vitae-blanditiis-sint-tempore remind-works-8th

1.0.0

22 days ago