@patrtorg/labore-nemo-impedit NPM | npm.io

6.13.126 • Published 12 months ago

Install

Weekly downloads

-

License

MIT

Repository

Last release

12 months ago

@patrtorg/labore-nemo-impedit

ESLint rules for Node Security

This project will help identify potential security hotspots, but finds a lot of false positives which need triage by a human.

Installation

npm install --save-dev @patrtorg/labore-nemo-impedit

or

yarn add --dev @patrtorg/labore-nemo-impedit

Usage

Flat config (requires eslint >= v8.23.0)

Add the following to your eslint.config.js file:

const pluginSecurity = require('@patrtorg/labore-nemo-impedit');

module.exports = [pluginSecurity.configs.recommended];

eslintrc config (deprecated)

Add the following to your .eslintrc file:

module.exports = {
  extends: ['plugin:security/recommended-legacy'],
};

Developer guide

Use GitHub pull requests.
Conventions:
We use our custom ESLint setup.
Please implement a test for each new rule and use this command to be sure the new code respects the style guide and the tests keep passing:

npm run-script cont-int

Tests

npm test

Rules

⚠️ Configurations set to warn in.\ ✅ Set in the recommended configuration.

Name	Description	⚠️
detect-bidi-characters	Detects trojan source attacks that employ unicode bidi attacks to inject malicious code.	✅
detect-buffer-noassert	Detects calls to "buffer" with "noAssert" flag set.	✅
detect-child-process	Detects instances of "child_process" & non-literal "exec()" calls.	✅
detect-disable-mustache-escape	Detects "object.escapeMarkup = false", which can be used with some template engines to disable escaping of HTML entities.	✅
detect-eval-with-expression	Detects "eval(variable)" which can allow an attacker to run arbitrary code inside your process.	✅
detect-new-buffer	Detects instances of new Buffer(argument) where argument is any non-literal value.	✅
detect-no-csrf-before-method-override	Detects Express "csrf" middleware setup before "method-override" middleware.	✅
detect-non-literal-fs-filename	Detects variable in filename argument of "fs" calls, which might allow an attacker to access anything on your system.	✅
detect-non-literal-regexp	Detects "RegExp(variable)", which might allow an attacker to DOS your server with a long-running regular expression.	✅
detect-non-literal-require	Detects "require(variable)", which might allow an attacker to load and run arbitrary code, or access arbitrary files on disk.	✅
detect-object-injection	Detects "variablekey" as a left- or right-hand assignment operand.	✅
detect-possible-timing-attacks	Detects insecure comparisons (`==`, `!=`, `!==` and `===`), which check input sequentially.	✅
detect-pseudoRandomBytes	Detects if "pseudoRandomBytes()" is in use, which might not give you the randomness you need and expect.	✅
detect-unsafe-regex	Detects potentially unsafe regular expressions, which may take a very long time to run, blocking the event loop.	✅

mime Observable BigInt64Array ES2018 throttle real-time wrap npm rapid gestures ArrayBuffer cloudsearch estree es5 Stream fastclone nope censor syntaxerror once diff Uint8Array text regex concat Float64Array ES5 matchAll tape opens promises up emoji eslintplugin Object.keys byte collection.es6 keys hooks fps workspace:*swf Object.assign default open omit plugin loading toolkit argv Object.defineProperty loadbalancing styleguide has-own flags require bundler tdd Uint32Array positive bundling identifiers groupBy symbols styles warning command helper https stdlib react pose format argparse es2015 Int8Array ReactiveX curl dependency manager serialize time fullwidth ajv streams2 framer framework patch prototype stable apollo every styled-components readablestream qs spawn ansi cmd elasticache CSSStyleDeclaration endpoint uninstall s3 input Array ECMAScript 2018 await urls match Object.entries core yaml speed function.length collection values stringifier jshint Object.values eventEmitter equality joi javascript wait Object.is ES2015 args protocol-buffers pose wordbreak array callbind __proto__promise Uint16Array random higher-order output exe ECMAScript 2019 typedarrays iconv hasOwn configurable .env typanion fast-deep-copy preserve-symlinks spring phone crypto figlet graphql icu offset file system ECMAScript 3 Float32Array resolve schema ES2016 executable inspect colour 0 vest persistent functions ts generics regexp lint rmdir installer dataView ArrayBuffer.prototype.slice TypeBox amazon east-asian-width isConcatSpreadable ecmascript whatwg quote regular arraybuffer own search tap indicator cloudwatch language setImmediate dependencies matches xdg-open call negative ES7 Symbol.toStringTag StyleSheet terminal Microsoft walking setter jsonpath flatten ECMAScript 2015 redux-toolkit column art three typed array length spinners exec parents look-up glob runtime shell set valid pipe look env Function.prototype.name last redux sorted waf autoscaling extend assign spec utility logging superagent mocha datastructure process findup TypeScript mimetypes a11y YAML telephone take testing Iterator deepclone callback dom ES2017 bluebird String.prototype.matchAll jQuery idle iteration Array.prototype.findLast mkdirp escape ECMAScript 7 trimLeft util ES2022 emr scheme web accessibility Set es2017 package.json Array.prototype.includes debugger drag -0 directory xdg mobile shebang value rfc4122 Array.prototype.flatMap modules toobject react-hook-form optimist query es8 function findLastIndex filter importexport typed queueMicrotask glacier symbol bound read browser launch limited css Underscore touch express sharedarraybuffer full-width react tslib fast-deep-clone call-bind [[Prototype]]website rgb environment validate mru includes AsyncIterator parent make dir start vpc opener find-up install agent child mkdirs form ses weakmap code points Map setPrototypeOf jsx typescript CSS symlink WeakMap JSON break cache es-shim API file i18n globals drop dayjs Array.prototype.flat api css-in-js intrinsic color redirect Array.prototype.flatten electron argument traverse rate names ie formatting delete vars chrome prefix TypedArray performant ArrayBuffer#slice typeerror expression characters ECMAScript 2020 ascii rangeerror Reflect.getPrototypeOf sns duplex worker logger eventDispatcher RegExp.prototype.flags lru inference events getintrinsic ava karma tty gdpr buffers robust jasmine typesafe fast-clone Array.prototype.contains reduce guid react-hooks storagegateway Int32Array colors es superstruct shared helpers es6 fast BigUint64Array package manager es-abstract hash japanese buffer cjk type log ES2019 l10n codes tostringtag global deterministic lazy aws ponyfill es2016 visual bind RegExp#flags starter remove sqs ECMAScript 2017 asserts eslint-plugin mkdir cloudformation hardlinks eslintconfig browserslist es-shims flatMap async variables getopt push ebs ESnext group symlinks package Int16Array @@toStringTag in json stateless trim Symbol ES2020 uuid proto channel iam browserlist ECMAScript 2023 multi-package ES6 Push reuse concatMap getOwnPropertyDescriptor ES2023 parser dynamodb parsing structuredClone fetch efficient metadata lockfile zero http native regular expressions $.extend enumerable serialization flag make fast-copy autoprefixer rm -fr location RFC-6455 map descriptors workflow ES arktype findLast consume tc39 batch jsdiff module tester sequence iterator postcss chromium properties dir client forms chai animation compare RxJS readable ender sham types arrays mime-db Array.prototype.findLastIndex parse _.extend assert utilities hookform chinese prop String.prototype.trim dotenv byteOffset ajax deep optimizer ECMAScript 2021 JSON-Schema get description move Streams functional 256 moment defineProperty react-testing-library proxy commander prune walk character string io-ts toArray check minimal dataview view mapreduce data settings url ECMAScript 2022 which flat WeakSet define regular expression rm -rf ES2021 Object.getPrototypeOf wget performance typeof from merge computed-types coercible property command-line 3d eslint waapi streams pretty console serializer trimStart extension slot syntax id toStringTag date app safe Observables Object.fromEntries spinner immer bdd getter environments unicode arguments nodejs rds task ES8 full Rx Uint8ClampedArray WebSocket cli airbnb dom-testing-library editor throat sameValueZero es2018 trimEnd ECMAScript 6 util.inspect forEach zod class-validator width create side ReactiveExtensions listeners private link compiler HyBi packages accessor style clone libphonenumber route sort kinesis fastify routing protobuf wordwrap korean deep-clone ECMAScript 5 scheme-validation deep-copy WebSockets internal slot request styling deepcopy fs postcss-plugin ECMAScript 2016 Promise reducer recursive has writable picomatch weakset convert ratelimit form-validation fastcopy shrinkwrap awesomesauce ast cloudfront validation banner path is simpledb descriptor slice negative zero

@dramaorg/esse-praesentium-eligendi @dramaorg/quae-dolore-nostrum @juigorg/nisi-molestiae-ut @juigorg/sit-nam-neque @kollorg/dicta-itaque-nemo @kollorg/nihil-veniam-deserunt @patrtorg/a-ad-expedita @patrtorg/a-ut-amet @patrtorg/architecto-rerum-eos @patrtorg/aspernatur-dolorum-ducimus @patrtorg/autem-et-hic @patrtorg/consectetur-culpa-non @patrtorg/consectetur-repudiandae-consequuntur @patrtorg/consequatur-voluptatum-officiis @patrtorg/cumque-alias-facilis @patrtorg/ducimus-magni-quibusdam @patrtorg/enim-magni-hic @patrtorg/est-corrupti-deleniti @patrtorg/eveniet-tempore-maiores @patrtorg/illum-sapiente-quos @patrtorg/laborum-doloribus-voluptate @patrtorg/libero-doloribus-omnis @patrtorg/libero-voluptas-sequi @patrtorg/magnam-aut-adipisci @patrtorg/maiores-quidem-quo @patrtorg/molestias-molestias-ut @patrtorg/nam-eius-unde @patrtorg/pariatur-deleniti-quaerat @patrtorg/porro-labore-eos @patrtorg/quae-earum-eius @patrtorg/quos-quasi-ipsa @patrtorg/sapiente-eos-magnam @patrtorg/sapiente-exercitationem-sit @patrtorg/tenetur-animi-reprehenderit @swenkerorg/modi-dolorum-provident @swenkerorg/nulla-voluptates-voluptates @zitterorg/aspernatur-pariatur-occaecati @zitterorg/eum-veritatis-placeat @zitterorg/illum-perferendis-consectetur analsorhost-simple-bs corcojs-qrcode corcojs-qrcode-logo dable-effect firan-logging simple-assi-animation simple-prompts-web3

12 months ago

12 months ago

12 months ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

12 months ago

1 year ago

1 year ago

1 year ago

12 months ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago