Wondering what’s next for npm?Check out our public roadmap! »

    @rushstack/eslint-plugin-security
    TypeScript icon, indicating that this package has built-in type declarations

    0.1.4 • Public • Published

    @rushstack/eslint-plugin-security

    This plugin implements a collection of security rules for ESLint.

    Our ambition is to eventually provide a comprehensive set of recommended security rules for:

    • web browser applications
    • Node.js tools
    • Node.js services

    If you would like to request or contribute a new security rule, you are encouraged to create a GitHub issue in the Rush Stack monorepo where this project is developed. Thanks!

    @rushstack/security/no-unsafe-regexp

    Require regular expressions to be constructed from string constants rather than dynamically building strings at runtime.

    Rule Details

    Regular expressions should be constructed from string constants. Dynamically building strings at runtime may introduce security vulnerabilities, performance concerns, and bugs involving incorrect escaping of special characters.

    Examples

    The following patterns are considered problems when @rushstack/security/no-unsafe-regexp is enabled:

    function parseRestResponse(request: ICatalogRequest,
      items: ICatalogItem[]): ICatalogItem[] {
    
      // Security vulnerability: A malicious user could invoke the REST service using a
      // "searchPattern" with a complex RegExp that causes a denial of service.
      const regexp: RegExp = new RegExp(request.searchPattern);
      return items.filter(item => regexp.test(item.title));
    }
    function hasExtension(filePath: string, extension: string): boolean {
      // Escaping mistake: If the "extension" string contains a special character such as ".",
      // it will be interpreted as a regular expression operator. Correctly escaping an arbitrary
      // string is a nontrivial problem due to RegExp implementation differences, as well as contextual
      // issues (since which characters are special changes inside RegExp nesting constructs).
      // In most cases, this problem is better solved without regular expressions.
      const regexp: RegExp = new RegExp(`\.${extension}$`);
      return regexp.test(filePath);
    }

    The following patterns are NOT considered problems:

    function isInteger(s: string): boolean {
      return /[0-9]+/.test(s);
    }
    function isInteger(s: string): boolean {
      return new RegExp('[0-9]+').test(s);
    }

    Links

    @rushstack/eslint-plugin-security is part of the Rush Stack family of projects.

    Install

    npm i @rushstack/eslint-plugin-security

    DownloadsWeekly Downloads

    7,114

    Version

    0.1.4

    License

    MIT

    Unpacked Size

    18.6 kB

    Total Files

    16

    Homepage

    rushstack.io

    Last publish

    Collaborators

    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar
    • avatar