Skip to content

Commit 1258118

Browse files
nzakasnzakas
committed
chore: Upgrade ESLint and fix lint errors
1 parent 2a3797f commit 1258118

15 files changed

+1257
-1759
lines changed

‎package-lock.json

+922-1,451
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json

+2-1
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
"changelog": "changelog eslint-plugin-security all > CHANGELOG.md",
88
"test": "npx mocha test/**/*",
99
"lint": "npx eslint .",
10+
"lint:fix": "npx eslint --fix .",
1011
"cont-int": "npm test && npm run-script lint"
1112
},
1213
"repository": {
@@ -29,7 +30,7 @@
2930
},
3031
"devDependencies": {
3132
"changelog": "1.3.0",
32-
"eslint": "^2.10.1",
33+
"eslint": "^8.11.0",
3334
"eslint-config-nodesecurity": "^1.3.1",
3435
"mocha": "^9.2.2"
3536
}

‎rules/detect-buffer-noassert.js

+51-51
Original file line numberDiff line numberDiff line change
@@ -1,69 +1,69 @@
11
/**
22
* Tries to detect buffer read / write calls that use noAssert set to true
3-
* @author Adam Baldwin
3+
* @author Adam Baldwin
44
*/
55

6+
'use strict';
7+
68
//------------------------------------------------------------------------------
79
// Rule Definition
810
//------------------------------------------------------------------------------
911

10-
var names = [];
12+
const names = [];
1113

1214
module.exports = function(context) {
1315

14-
"use strict";
16+
const read = [
17+
'readUInt8',
18+
'readUInt16LE',
19+
'readUInt16BE',
20+
'readUInt32LE',
21+
'readUInt32BE',
22+
'readInt8',
23+
'readInt16LE',
24+
'readInt16BE',
25+
'readInt32LE',
26+
'readInt32BE',
27+
'readFloatLE',
28+
'readFloatBE',
29+
'readDoubleL',
30+
'readDoubleBE'
31+
];
1532

16-
var read = [
17-
"readUInt8",
18-
"readUInt16LE",
19-
"readUInt16BE",
20-
"readUInt32LE",
21-
"readUInt32BE",
22-
"readInt8",
23-
"readInt16LE",
24-
"readInt16BE",
25-
"readInt32LE",
26-
"readInt32BE",
27-
"readFloatLE",
28-
"readFloatBE",
29-
"readDoubleL",
30-
"readDoubleBE"
31-
];
33+
const write = [
34+
'writeUInt8',
35+
'writeUInt16LE',
36+
'writeUInt16BE',
37+
'writeUInt32LE',
38+
'writeUInt32BE',
39+
'writeInt8',
40+
'writeInt16LE',
41+
'writeInt16BE',
42+
'writeInt32LE',
43+
'writeInt32BE',
44+
'writeFloatLE',
45+
'writeFloatBE',
46+
'writeDoubleLE',
47+
'writeDoubleBE'
48+
];
3249

33-
var write = [
34-
"writeUInt8",
35-
"writeUInt16LE",
36-
"writeUInt16BE",
37-
"writeUInt32LE",
38-
"writeUInt32BE",
39-
"writeInt8",
40-
"writeInt16LE",
41-
"writeInt16BE",
42-
"writeInt32LE",
43-
"writeInt32BE",
44-
"writeFloatLE",
45-
"writeFloatBE",
46-
"writeDoubleLE",
47-
"writeDoubleBE"
48-
];
50+
return {
51+
'MemberExpression': function (node) {
52+
let index;
53+
if (read.indexOf(node.property.name) !== -1) {
54+
index = 1;
55+
}
56+
else if (write.indexOf(node.property.name) !== -1) {
57+
index = 2;
58+
}
4959

50-
return {
51-
"MemberExpression": function (node) {
52-
var index;
53-
if (read.indexOf(node.property.name) !== -1) {
54-
index = 1;
55-
} else if (write.indexOf(node.property.name) !== -1) {
56-
index = 2;
57-
}
60+
if (index && node.parent && node.parent.arguments && node.parent.arguments[index] && node.parent.arguments[index].value) {
61+
const token = context.getTokens(node)[0];
62+
return context.report(node, `Found Buffer.${ node.property.name } with noAssert flag set true`);
5863

59-
if (index && node.parent && node.parent.arguments && node.parent.arguments[index] && node.parent.arguments[index].value) {
60-
var token = context.getTokens(node)[0];
61-
return context.report(node, 'Found Buffer.' + node.property.name + ' with noAssert flag set true');
62-
63-
}
64-
}
64+
}
65+
}
6566

66-
};
67+
};
6768

6869
};
69-

‎rules/detect-child-process.js

+27-26
Original file line numberDiff line numberDiff line change
@@ -3,40 +3,41 @@
33
* @author Adam Baldwin
44
*/
55

6+
'use strict';
7+
68
//------------------------------------------------------------------------------
79
// Rule Definition
810
//------------------------------------------------------------------------------
911

10-
var names = [];
12+
const names = [];
1113

1214
module.exports = function(context) {
1315

14-
"use strict";
15-
16-
return {
17-
"CallExpression": function (node) {
18-
var token = context.getTokens(node)[0];
19-
if (node.callee.name === 'require') {
20-
var args = node.arguments[0];
21-
if (args && args.type === 'Literal' && args.value === 'child_process') {
22-
if (node.parent.type === 'VariableDeclarator') {
23-
names.push(node.parent.id.name);
24-
} else if (node.parent.type === 'AssignmentExpression' && node.parent.operator === '=') {
25-
names.push(node.parent.left.name);
26-
}
27-
return context.report(node, 'Found require("child_process")');
28-
}
29-
}
30-
},
31-
"MemberExpression": function (node) {
32-
var token = context.getTokens(node)[0];
33-
if (node.property.name === 'exec' && names.indexOf(node.object.name) > -1) {
34-
if (node.parent && node.parent.arguments && node.parent.arguments[0].type !== 'Literal') {
35-
return context.report(node, 'Found child_process.exec() with non Literal first argument');
36-
}
37-
}
16+
return {
17+
'CallExpression': function (node) {
18+
const token = context.getTokens(node)[0];
19+
if (node.callee.name === 'require') {
20+
const args = node.arguments[0];
21+
if (args && args.type === 'Literal' && args.value === 'child_process') {
22+
if (node.parent.type === 'VariableDeclarator') {
23+
names.push(node.parent.id.name);
24+
}
25+
else if (node.parent.type === 'AssignmentExpression' && node.parent.operator === '=') {
26+
names.push(node.parent.left.name);
27+
}
28+
return context.report(node, 'Found require("child_process")');
29+
}
30+
}
31+
},
32+
'MemberExpression': function (node) {
33+
const token = context.getTokens(node)[0];
34+
if (node.property.name === 'exec' && names.indexOf(node.object.name) > -1) {
35+
if (node.parent && node.parent.arguments && node.parent.arguments[0].type !== 'Literal') {
36+
return context.report(node, 'Found child_process.exec() with non Literal first argument');
3837
}
38+
}
39+
}
3940

40-
};
41+
};
4142

4243
};

‎rules/detect-disable-mustache-escape.js

+14-12
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,20 @@
1+
2+
'use strict';
3+
14
module.exports = function(context) {
25

3-
"use strict";
4-
return {
5-
"AssignmentExpression": function(node) {
6-
if (node.operator === '=') {
7-
if (node.left.property) {
8-
if (node.left.property.name == 'escapeMarkup') {
9-
if (node.right.value == false) {
10-
context.report(node, 'Markup escaping disabled.')
11-
}
12-
}
13-
}
6+
return {
7+
'AssignmentExpression': function(node) {
8+
if (node.operator === '=') {
9+
if (node.left.property) {
10+
if (node.left.property.name === 'escapeMarkup') {
11+
if (node.right.value === false) {
12+
context.report(node, 'Markup escaping disabled.');
1413
}
14+
}
1515
}
16+
}
1617
}
18+
};
1719

18-
}
20+
};

‎rules/detect-eval-with-expression.js

+9-9
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,19 @@
33
* @author Adam Baldwin
44
*/
55

6+
'use strict';
7+
68
//------------------------------------------------------------------------------
79
// Rule Definition
810
//------------------------------------------------------------------------------
911

1012
module.exports = function(context) {
1113

12-
"use strict";
13-
14-
return {
15-
"CallExpression": function(node) {
16-
if (node.callee.name === "eval" && node.arguments[0].type !== 'Literal') {
17-
context.report(node, "eval with argument of type " + node.arguments[0].type);
18-
}
19-
}
20-
};
14+
return {
15+
'CallExpression': function(node) {
16+
if (node.callee.name === 'eval' && node.arguments[0].type !== 'Literal') {
17+
context.report(node, `eval with argument of type ${ node.arguments[0].type}`);
18+
}
19+
}
20+
};
2121
};

‎rules/detect-new-buffer.js

+14-12
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,21 @@
1+
'use strict';
2+
3+
14
module.exports = function (context) {
2-
// Detects instances of new Buffer(argument)
3-
// where argument is any non literal value.
4-
return {
5-
"NewExpression": function (node) {
6-
if (node.callee.name === 'Buffer' &&
5+
// Detects instances of new Buffer(argument)
6+
// where argument is any non literal value.
7+
return {
8+
'NewExpression': function (node) {
9+
if (node.callee.name === 'Buffer' &&
710
node.arguments[0] &&
8-
node.arguments[0].type != 'Literal') {
9-
10-
return context.report(node, "Found new Buffer");
11-
}
11+
node.arguments[0].type !== 'Literal') {
1212

13+
return context.report(node, 'Found new Buffer');
14+
}
1315

1416

15-
}
16-
};
1717

18-
}
18+
}
19+
};
1920

21+
};

‎rules/detect-no-csrf-before-method-override.js

+24-24
Original file line numberDiff line numberDiff line change
@@ -3,37 +3,37 @@
33
* @author Adam Baldwin
44
*/
55

6+
'use strict';
7+
68
//------------------------------------------------------------------------------
79
// Rule Definition
810
//------------------------------------------------------------------------------
911

1012

1113
module.exports = function(context) {
1214

13-
"use strict";
14-
var csrf = false;
15-
16-
return {
17-
"CallExpression": function(node) {
18-
var token = context.getTokens(node)[0],
19-
nodeType = token.type,
20-
nodeValue = token.value;
21-
22-
if (nodeValue === "express") {
23-
if (!node.callee || !node.callee.property) {
24-
return;
25-
}
26-
27-
if (node.callee.property.name === "methodOverride" && csrf) {
28-
context.report(node, "express.csrf() middleware found before express.methodOverride()");
29-
}
30-
if (node.callee.property.name === "csrf") {
31-
// Keep track of found CSRF
32-
csrf = true;
33-
}
34-
}
15+
let csrf = false;
16+
17+
return {
18+
'CallExpression': function(node) {
19+
const token = context.getTokens(node)[0];
20+
const nodeType = token.type;
21+
const nodeValue = token.value;
22+
23+
if (nodeValue === 'express') {
24+
if (!node.callee || !node.callee.property) {
25+
return;
3526
}
36-
};
3727

38-
};
28+
if (node.callee.property.name === 'methodOverride' && csrf) {
29+
context.report(node, 'express.csrf() middleware found before express.methodOverride()');
30+
}
31+
if (node.callee.property.name === 'csrf') {
32+
// Keep track of found CSRF
33+
csrf = true;
34+
}
35+
}
36+
}
37+
};
3938

39+
};

0 commit comments

Comments
 (0)