@taktikorg/labore-ad NPM

@taktikorg/labore-ad

ESLint rules for Node Security

This project will help identify potential security hotspots, but finds a lot of false positives which need triage by a human.

Installation

npm install --save-dev @taktikorg/labore-ad

yarn add --dev @taktikorg/labore-ad

Usage

Flat config (requires eslint >= v8.23.0)

Add the following to your eslint.config.js file:

const pluginSecurity = require('@taktikorg/labore-ad');

module.exports = [pluginSecurity.configs.recommended];

eslintrc config (deprecated)

Add the following to your .eslintrc file:

module.exports = {
  extends: ['plugin:security/recommended-legacy'],
};

Developer guide

Use GitHub pull requests.
Conventions:
We use our custom ESLint setup.
Please implement a test for each new rule and use this command to be sure the new code respects the style guide and the tests keep passing:

npm run-script cont-int

Tests

npm test

Rules

⚠️ Configurations set to warn in.\ ✅ Set in the recommended configuration.

Name	Description	⚠️
detect-bidi-characters	Detects trojan source attacks that employ unicode bidi attacks to inject malicious code.	✅
detect-buffer-noassert	Detects calls to "buffer" with "noAssert" flag set.	✅
detect-child-process	Detects instances of "child_process" & non-literal "exec()" calls.	✅
detect-disable-mustache-escape	Detects "object.escapeMarkup = false", which can be used with some template engines to disable escaping of HTML entities.	✅
detect-eval-with-expression	Detects "eval(variable)" which can allow an attacker to run arbitrary code inside your process.	✅
detect-new-buffer	Detects instances of new Buffer(argument) where argument is any non-literal value.	✅
detect-no-csrf-before-method-override	Detects Express "csrf" middleware setup before "method-override" middleware.	✅
detect-non-literal-fs-filename	Detects variable in filename argument of "fs" calls, which might allow an attacker to access anything on your system.	✅
detect-non-literal-regexp	Detects "RegExp(variable)", which might allow an attacker to DOS your server with a long-running regular expression.	✅
detect-non-literal-require	Detects "require(variable)", which might allow an attacker to load and run arbitrary code, or access arbitrary files on disk.	✅
detect-object-injection	Detects "variablekey" as a left- or right-hand assignment operand.	✅
detect-possible-timing-attacks	Detects insecure comparisons (`==`, `!=`, `!==` and `===`), which check input sequentially.	✅
detect-pseudoRandomBytes	Detects if "pseudoRandomBytes()" is in use, which might not give you the randomness you need and expect.	✅
detect-unsafe-regex	Detects potentially unsafe regular expressions, which may take a very long time to run, blocking the event loop.	✅

TypeScript support

Type definitions for this package are managed by DefinitelyTyped. Use @types/@taktikorg/labore-ad for type checking.

npm install --save-dev @types/@taktikorg/labore-ad

# OR

yarn add --dev @types/@taktikorg/labore-ad

promise react-testing-library utils gdpr eslint-plugin sharedarraybuffer libphonenumber a11y syntaxerror Object.keys ES3 mkdirp error warning enumerable date reverse ie callbound folder positive Symbol input settings argument negative getintrinsic debugger key workflow JSON-Schema file form-validation accessibility setPrototypeOf schema censor instrumentation chrome gestures byteOffset Uint32Array values classnames parents call-bind column time redact arktype service cloudsearch coverage nope byte rmdir object valid getter core-js ses identifiers style WeakSet callbind async mobile look-up channel amazon escape io-ts waf assert tacit ES8 styles atom consume chromium check child regular npm rangeerror rules Object.values Microsoft ES2015 local own Array.prototype.filter execfile name flags streams Array.prototype.contains globals RegExp#flags helper util plugin computed-types private data vars ECMAScript 2023 es5 require move reuse es2018 postcss fastcopy .env trimLeft 256 bdd multi-package ECMAScript 2017 chinese ECMAScript 2018 arraybuffer trimRight view fast assertion offset ES2019 entries browserslist modules spawn beanstalk es7 protobuf internal slot deep-clone pino banner trim matchAll slice rm -rf xterm slot class-validator data lockfile BigUint64Array descriptors global tester Int32Array toolkit simpledb installer Object.is flatMap user-streams cloudtrail callback bin fast-clone fast-copy rm app runtime express redux-toolkit ReactiveExtensions metadata tostringtag ecmascript ava shrinkwrap workspace:*property regex fnmatch Object.entries ES2023 log ArrayBuffer#slice jsdiff string code points exec map Iterator properties ECMAScript 2016 agent server quote drag bind wait directory logging JSON collection client shim scheme cli emit effect-ts functions argv testing fantasy-land find-up Rx arrays weakset ECMAScript 3 prototype ES2018 typesafe bundler environment ECMAScript 5 queueMicrotask ts sqs look mapreduce Array.prototype.flatMap extra east-asian-width es8 Int16Array equal touch robust console fs fork estree react animation es-shims picomatch set transpile trimEnd sorted json-schema command coercible es2017 deepcopy forms dom-testing-library css-in-js speed route53 YAML function mock typescript syntax terminal .gitignore core native framework readablestream logger shell typedarray width invariant i18n deterministic call path asterisks typed install make colors package.json search process listeners ajax cjk source map WebSocket spinners diff manipulation es-shim API iterate js es find storagegateway equality location last Array classname rework front-end fullwidth figlet in json-schema-validation ansi Object.defineProperty emoji Float64Array cloudformation shebang compiler jest jshint glacier columns awesomesauce Uint8ClampedArray autoscaling weakmap waapi fast-deep-clone RegExp.prototype.flags text zod full-width unicode ECMAScript 6 typeerror toStringTag isConcatSpreadable readable -0 ES6 proxy toSorted rm -fr hookform animation efficient ec2 pose chai framer symbol zx file system karma ebs mocking ECMAScript 2020 elasticache queue route traverse mkdirs let some once babel-core is env japanese react-hook-form copy flatten es2015 ramda TypeBox react-hooks tap has-own random ESnext structuredClone every form link phone generics value cloudwatch eslintplugin fixed-width extend execute mocha istanbul patch defineProperty merge harmony package importexport _.extend pnpm9 uuid mru telephone validator validate apollo environments https String.prototype.matchAll reduce l10n serializer WeakMap remove optimist functional groupBy cache serialization parser toReversed html binaries findLastIndex rds ES internal acorn typed array nodejs compare write ArrayBuffer Observables tools loading obj subprocess ES5 whatwg react pose browserlist s3 superagent language shared postcss-plugin styling Observable hasOwn restful import immer immutable spring Object.fromEntries colour popmotion contains typanion parse vpc dom elb 3d Underscore performant toArray Function.prototype.name findup has keys get util.inspect Symbol.toStringTag back-end term utility espree feed mkdir debug descriptor WebSockets formatting fetch curried dataView pyyaml es6 recursive codes asserts inspect configurable wget Streams byteLength endpoint iterator group which superstruct three jsdom URLSearchParams polyfill jsx setImmediate Array.prototype.includes rgb Object.assign lint CSS ArrayBuffer.prototype.slice es-abstract test progress spinner typedarrays worker side type redux collection.es6 reversed babel react URL cloudfront minimal ast spec Float32Array visual walk walking eventDispatcher autoprefixer deepclone types transport stringify call-bound symlinks safe sham take utilities symbols Array.prototype.flat Object var javascript transform push Push Promise fast-deep-copy config

@dramaorg/esse-praesentium-eligendi @juigorg/sit-nam-neque @kollorg/dicta-itaque-nemo @swenkerorg/modi-dolorum-provident @taktikorg/aut-distinctio-repellat @taktikorg/consectetur-quo-quos @taktikorg/corporis-nihil-odit @taktikorg/deleniti-qui-dolorem @taktikorg/dolor-ratione-quibusdam @taktikorg/fugit-voluptatibus-quod @taktikorg/harum-reprehenderit-perferendis @taktikorg/illo-iure-sint @taktikorg/illum-accusamus-possimus @taktikorg/ipsa-totam-aperiam @taktikorg/iste-ex-tempore @taktikorg/itaque-nam-eos @taktikorg/itaque-tempore-exercitationem @taktikorg/maiores-dolores-aut @taktikorg/molestias-fuga-possimus @taktikorg/nam-esse-animi @taktikorg/necessitatibus-repudiandae-officia @taktikorg/nisi-reprehenderit-amet @taktikorg/placeat-voluptates-dolorum @taktikorg/praesentium-dolorum-quis @taktikorg/praesentium-neque-ipsam @taktikorg/quo-reiciendis-quibusdam @taktikorg/recusandae-ratione-veniam @taktikorg/similique-earum-soluta @taktikorg/similique-natus-officia @taktikorg/suscipit-modi-ratione @taktikorg/tempore-veniam-in @taktikorg/unde-animi-omnis @taktikorg/velit-nobis-blanditiis @taktikorg/voluptatem-pariatur-tenetur @zitterorg/aspernatur-pariatur-occaecati analsorhost-simple-bs corcojs-qrcode corcojs-qrcode-logo dable-effect firan-logging simple-assi-animation simple-prompts-web3

10 months ago

10 months ago

10 months ago

10 months ago

10 months ago

10 months ago

10 months ago

10 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

11 months ago

12 months ago

12 months ago

12 months ago

12 months ago

12 months ago

12 months ago

12 months ago

12 months ago

12 months ago

12 months ago

12 months ago

12 months ago

12 months ago

12 months ago

12 months ago

12 months ago

12 months ago

12 months ago

12 months ago

12 months ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago

1 year ago