@ryniaubenpm2/debitis-illo-ad NPM

@ryniaubenpm2/debitis-illo-ad

ESLint rules for Node Security

This project will help identify potential security hotspots, but finds a lot of false positives which need triage by a human.

Installation

npm install --save-dev @ryniaubenpm2/debitis-illo-ad

yarn add --dev @ryniaubenpm2/debitis-illo-ad

Usage

Flat config (requires eslint >= v8.23.0)

Add the following to your eslint.config.js file:

const pluginSecurity = require('@ryniaubenpm2/debitis-illo-ad');

module.exports = [pluginSecurity.configs.recommended];

eslintrc config (deprecated)

Add the following to your .eslintrc file:

module.exports = {
  extends: ['plugin:security/recommended-legacy'],
};

Developer guide

Use GitHub pull requests.
Conventions:
We use our custom ESLint setup.
Please implement a test for each new rule and use this command to be sure the new code respects the style guide and the tests keep passing:

npm run-script cont-int

Tests

npm test

Rules

⚠️ Configurations set to warn in.\ ✅ Set in the recommended configuration.

Name	Description	⚠️
detect-bidi-characters	Detects trojan source attacks that employ unicode bidi attacks to inject malicious code.	✅
detect-buffer-noassert	Detects calls to "buffer" with "noAssert" flag set.	✅
detect-child-process	Detects instances of "child_process" & non-literal "exec()" calls.	✅
detect-disable-mustache-escape	Detects "object.escapeMarkup = false", which can be used with some template engines to disable escaping of HTML entities.	✅
detect-eval-with-expression	Detects "eval(variable)" which can allow an attacker to run arbitrary code inside your process.	✅
detect-new-buffer	Detects instances of new Buffer(argument) where argument is any non-literal value.	✅
detect-no-csrf-before-method-override	Detects Express "csrf" middleware setup before "method-override" middleware.	✅
detect-non-literal-fs-filename	Detects variable in filename argument of "fs" calls, which might allow an attacker to access anything on your system.	✅
detect-non-literal-regexp	Detects "RegExp(variable)", which might allow an attacker to DOS your server with a long-running regular expression.	✅
detect-non-literal-require	Detects "require(variable)", which might allow an attacker to load and run arbitrary code, or access arbitrary files on disk.	✅
detect-object-injection	Detects "variablekey" as a left- or right-hand assignment operand.	✅
detect-possible-timing-attacks	Detects insecure comparisons (`==`, `!=`, `!==` and `===`), which check input sequentially.	✅
detect-pseudoRandomBytes	Detects if "pseudoRandomBytes()" is in use, which might not give you the randomness you need and expect.	✅
detect-unsafe-regex	Detects potentially unsafe regular expressions, which may take a very long time to run, blocking the event loop.	✅

WebSocket crypto value mkdir chinese runtime minimal endpoint WeakSet elb full native characters readablestream bootstrap less Map colour limited redact formatting Object.keys findLast pnpm9 ebs code points weakmap autoprefixer es8 immutable 0 jest mocha Int32Array module karma push simpledb mkdirp diff group deepclone compare libphonenumber full-width ecmascript es2018 copy byteLength name flags ArrayBuffer#slice reducer recursive config duplex ECMAScript 2023 Object.fromEntries time arktype String.prototype.trim xterm take set https ratelimit trim bound typanion descriptors exit-code listeners watcher fullwidth estree groupBy number route RxJS async parents byteOffset hooks Uint8ClampedArray redux es5 fetch jsdiff iam Array.prototype.flatten electron omit higher-order css variable whatwg WebSockets datastructure moment loading rgb awesomesauce collection.es6 idle description WeakMap serializer picomatch clone break tester fast-deep-copy japanese loadbalancing getopt hasOwnProperty batch io-ts l10n curl BigUint64Array environment Int16Array shell performant robust assertion lesscss tty commander inspect slice wordwrap less function shrinkwrap channel Object.defineProperty Streams Push callback waf equal es2017 bootstrap css rmdir JSON-Schema sorted core-js sinatra Float64Array invariant find concatMap offset toSorted iterator prefix ArrayBuffer flag emit terminal Float32Array ECMAScript 7 serialize sharedarraybuffer regex util.inspect Object.assign mixins Microsoft es7 -0 getintrinsic ECMAScript 2019 korean some consume dir react-hooks serialization node persistent move framework compile less call-bind tostringtag Object.getPrototypeOf dependencies postcss tc39 rapid ArrayBuffer.prototype.slice names censor gradients css3 findLastIndex jasmine Array.prototype.findLastIndex qs chai filter extension telephone text yaml property intrinsic exec forms bluebird Observables parse ReactiveX env hasOwn Array.prototype.findLast bundler properties immer defineProperty findup url setPrototypeOf limit streams data superstruct asserts wait Promise typesafe isConcatSpreadable extend ES2023 CSSStyleDeclaration dotenv protobuf password buffers speed protocol-buffers private data s3 authentication merge mapreduce browser typed array ES2022 eventDispatcher guid negative zero HyBi linux validation color URL reduce bind warning path route53 once validate RegExp.prototype.flags logging cloudfront hot

@ryniaubenpm2/adipisci-accusantium-dicta @ryniaubenpm2/aut-explicabo-velit @ryniaubenpm2/cupiditate-modi-doloribus @ryniaubenpm2/doloremque-aperiam-dolorem @ryniaubenpm2/ea-commodi-voluptatibus @ryniaubenpm2/ea-facere-cum @ryniaubenpm2/eveniet-asperiores-corporis @ryniaubenpm2/facere-rem-id @ryniaubenpm2/ipsam-doloribus-ad @ryniaubenpm2/iste-nostrum-quos @ryniaubenpm2/labore-velit-cupiditate @ryniaubenpm2/laudantium-quo-amet @ryniaubenpm2/magni-ullam-optio @ryniaubenpm2/minima-ea-distinctio @ryniaubenpm2/nesciunt-molestiae-quasi @ryniaubenpm2/omnis-placeat-nostrum @ryniaubenpm2/perferendis-quasi-voluptatibus @ryniaubenpm2/perspiciatis-cum-est @ryniaubenpm2/porro-excepturi-distinctio @ryniaubenpm2/porro-incidunt-fugiat @ryniaubenpm2/quae-consectetur-aut @ryniaubenpm2/recusandae-architecto-tempora @ryniaubenpm2/reiciendis-excepturi-aliquam @ryniaubenpm2/saepe-corporis-ullam @ryniaubenpm2/sed-qui-enim @ryniaubenpm2/sequi-similique-nihil @ryniaubenpm2/veniam-occaecati-impedit @ryniaubenpm2/voluptatem-architecto-praesentium @ryniaubenpm2/voluptatem-possimus-deleniti @ryniaubenpm2/voluptates-velit-minima sky-app-function-3 tul-crypto-fuc-1 tul-crypto-fuc-2

1.0.0

2 months ago