Skip to content

Commit fa1c94f

Browse files
lolgablolgab
committed
Add ESLint meta object with description and category
1 parent edd1ae2 commit fa1c94f

13 files changed

+334
-246
lines changed

Diff for: ‎rules/detect-buffer-noassert.js

+56-50
Original file line numberDiff line numberDiff line change
@@ -7,63 +7,69 @@
77
// Rule Definition
88
//------------------------------------------------------------------------------
99

10-
var names = [];
11-
12-
module.exports = function(context) {
10+
module.exports = {
11+
meta: {
12+
docs: {
13+
description: "detect buffer read / write calls that use noAssert set to true",
14+
category: "Security"
15+
}
16+
},
17+
function(context) {
1318

14-
"use strict";
19+
"use strict";
1520

16-
var read = [
17-
"readUInt8",
18-
"readUInt16LE",
19-
"readUInt16BE",
20-
"readUInt32LE",
21-
"readUInt32BE",
22-
"readInt8",
23-
"readInt16LE",
24-
"readInt16BE",
25-
"readInt32LE",
26-
"readInt32BE",
27-
"readFloatLE",
28-
"readFloatBE",
29-
"readDoubleL",
30-
"readDoubleBE"
31-
];
21+
var read = [
22+
"readUInt8",
23+
"readUInt16LE",
24+
"readUInt16BE",
25+
"readUInt32LE",
26+
"readUInt32BE",
27+
"readInt8",
28+
"readInt16LE",
29+
"readInt16BE",
30+
"readInt32LE",
31+
"readInt32BE",
32+
"readFloatLE",
33+
"readFloatBE",
34+
"readDoubleL",
35+
"readDoubleBE"
36+
];
3237

33-
var write = [
34-
"writeUInt8",
35-
"writeUInt16LE",
36-
"writeUInt16BE",
37-
"writeUInt32LE",
38-
"writeUInt32BE",
39-
"writeInt8",
40-
"writeInt16LE",
41-
"writeInt16BE",
42-
"writeInt32LE",
43-
"writeInt32BE",
44-
"writeFloatLE",
45-
"writeFloatBE",
46-
"writeDoubleLE",
47-
"writeDoubleBE"
48-
];
38+
var write = [
39+
"writeUInt8",
40+
"writeUInt16LE",
41+
"writeUInt16BE",
42+
"writeUInt32LE",
43+
"writeUInt32BE",
44+
"writeInt8",
45+
"writeInt16LE",
46+
"writeInt16BE",
47+
"writeInt32LE",
48+
"writeInt32BE",
49+
"writeFloatLE",
50+
"writeFloatBE",
51+
"writeDoubleLE",
52+
"writeDoubleBE"
53+
];
4954

50-
return {
51-
"MemberExpression": function (node) {
52-
var index;
53-
if (read.indexOf(node.property.name) !== -1) {
54-
index = 1;
55-
} else if (write.indexOf(node.property.name) !== -1) {
56-
index = 2;
57-
}
55+
return {
56+
"MemberExpression": function (node) {
57+
var index;
58+
if (read.indexOf(node.property.name) !== -1) {
59+
index = 1;
60+
} else if (write.indexOf(node.property.name) !== -1) {
61+
index = 2;
62+
}
5863

59-
if (index && node.parent && node.parent.arguments && node.parent.arguments[index] && node.parent.arguments[index].value) {
60-
var token = context.getTokens(node)[0];
61-
return context.report(node, 'Found Buffer.' + node.property.name + ' with noAssert flag set true');
62-
64+
if (index && node.parent && node.parent.arguments && node.parent.arguments[index] && node.parent.arguments[index].value) {
65+
var token = context.getTokens(node)[0];
66+
return context.report(node, 'Found Buffer.' + node.property.name + ' with noAssert flag set true');
67+
68+
}
6369
}
64-
}
6570

66-
};
71+
};
6772

73+
}
6874
};
6975

Diff for: ‎rules/detect-child-process.js

+29-24
Original file line numberDiff line numberDiff line change
@@ -9,34 +9,39 @@
99

1010
var names = [];
1111

12-
module.exports = function(context) {
12+
module.exports = {
13+
meta: {
14+
docs: {
15+
description: "detect instances of child_process",
16+
category: "Security"
17+
}
18+
},
19+
function(context) {
1320

14-
"use strict";
21+
"use strict";
1522

16-
return {
17-
"CallExpression": function (node) {
18-
var token = context.getTokens(node)[0];
19-
if (node.callee.name === 'require') {
20-
var args = node.arguments[0];
21-
if (args && args.type === 'Literal' && args.value === 'child_process') {
22-
if (node.parent.type === 'VariableDeclarator') {
23-
names.push(node.parent.id.name);
24-
} else if (node.parent.type === 'AssignmentExpression' && node.parent.operator === '=') {
25-
names.push(node.parent.left.name);
23+
return {
24+
"CallExpression": function (node) {
25+
var token = context.getTokens(node)[0];
26+
if (node.callee.name === 'require') {
27+
var args = node.arguments[0];
28+
if (args && args.type === 'Literal' && args.value === 'child_process') {
29+
if (node.parent.type === 'VariableDeclarator') {
30+
names.push(node.parent.id.name);
31+
} else if (node.parent.type === 'AssignmentExpression' && node.parent.operator === '=') {
32+
names.push(node.parent.left.name);
33+
}
34+
return context.report(node, 'Found require("child_process")');
2635
}
27-
return context.report(node, 'Found require("child_process")');
2836
}
29-
}
30-
},
31-
"MemberExpression": function (node) {
32-
var token = context.getTokens(node)[0];
33-
if (node.property.name === 'exec' && names.indexOf(node.object.name) > -1) {
34-
if (node.parent && node.parent.arguments && node.parent.arguments[0].type !== 'Literal') {
35-
return context.report(node, 'Found child_process.exec() with non Literal first argument');
37+
},
38+
"MemberExpression": function (node) {
39+
if (node.property.name === 'exec' && names.indexOf(node.object.name) > -1) {
40+
if (node.parent && node.parent.arguments && node.parent.arguments[0].type !== 'Literal') {
41+
return context.report(node, 'Found child_process.exec() with non Literal first argument');
42+
}
3643
}
3744
}
38-
}
39-
40-
};
41-
45+
};
46+
}
4247
};

Diff for: ‎rules/detect-disable-mustache-escape.js

+19-12
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,25 @@
1-
module.exports = function(context) {
1+
module.exports = {
2+
meta: {
3+
docs: {
4+
description: "detect object.escapeMarkup = false",
5+
category: "Security"
6+
}
7+
},
8+
function(context) {
29

3-
"use strict";
4-
return {
5-
"AssignmentExpression": function(node) {
6-
if (node.operator === '=') {
7-
if (node.left.property) {
8-
if (node.left.property.name == 'escapeMarkup') {
9-
if (node.right.value == false) {
10-
context.report(node, 'Markup escaping disabled.')
10+
"use strict";
11+
return {
12+
"AssignmentExpression": function(node) {
13+
if (node.operator === '=') {
14+
if (node.left.property) {
15+
if (node.left.property.name == 'escapeMarkup') {
16+
if (node.right.value == false) {
17+
context.report(node, 'Markup escaping disabled.')
18+
}
1119
}
1220
}
1321
}
1422
}
15-
}
23+
};
1624
}
17-
18-
}
25+
};

Diff for: ‎rules/detect-eval-with-expression.js

+15-7
Original file line numberDiff line numberDiff line change
@@ -7,15 +7,23 @@
77
// Rule Definition
88
//------------------------------------------------------------------------------
99

10-
module.exports = function(context) {
10+
module.exports = {
11+
meta: {
12+
docs: {
13+
description: "identify eval with expression",
14+
category: "Security"
15+
}
16+
},
17+
function(context) {
1118

1219
"use strict";
1320

14-
return {
15-
"CallExpression": function(node) {
16-
if (node.callee.name === "eval" && node.arguments[0].type !== 'Literal') {
17-
context.report(node, "eval with argument of type " + node.arguments[0].type);
21+
return {
22+
"CallExpression": function(node) {
23+
if (node.callee.name === "eval" && node.arguments[0].type !== 'Literal') {
24+
context.report(node, "eval with argument of type " + node.arguments[0].type);
25+
}
1826
}
19-
}
20-
};
27+
};
28+
}
2129
};

Diff for: ‎rules/detect-new-buffer.js

+26-17
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,28 @@
1-
module.exports = function (context) {
2-
// Detects instances of new Buffer(argument)
3-
// where argument is any non literal value.
4-
return {
5-
"NewExpression": function (node) {
6-
if (node.callee.name === 'Buffer' &&
7-
node.arguments[0] &&
8-
node.arguments[0].type != 'Literal') {
9-
10-
return context.report(node, "Found new Buffer");
11-
}
12-
1+
/**
2+
* Detects instances of new Buffer(argument) where argument is any non literal value
3+
*
4+
*/
135

6+
//------------------------------------------------------------------------------
7+
// Rule Definition
8+
//------------------------------------------------------------------------------
149

15-
}
16-
};
17-
18-
}
19-
10+
module.exports = {
11+
meta: {
12+
docs: {
13+
description: "detect instances of new Buffer(argument) where argument is any non literal value",
14+
category: "Security"
15+
}
16+
},
17+
function (context) {
18+
return {
19+
"NewExpression": function (node) {
20+
if (node.callee.name === 'Buffer' &&
21+
node.arguments[0] &&
22+
node.arguments[0].type != 'Literal') {
23+
return context.report(node, "Found new Buffer");
24+
}
25+
}
26+
};
27+
}
28+
};

Diff for: ‎rules/detect-no-csrf-before-method-override.js

+32-24
Original file line numberDiff line numberDiff line change
@@ -8,32 +8,40 @@
88
//------------------------------------------------------------------------------
99

1010

11-
module.exports = function(context) {
12-
13-
"use strict";
14-
var csrf = false;
15-
16-
return {
17-
"CallExpression": function(node) {
18-
var token = context.getTokens(node)[0],
19-
nodeType = token.type,
20-
nodeValue = token.value;
21-
22-
if (nodeValue === "express") {
23-
if (!node.callee || !node.callee.property) {
24-
return;
25-
}
26-
27-
if (node.callee.property.name === "methodOverride" && csrf) {
28-
context.report(node, "express.csrf() middleware found before express.methodOverride()");
29-
}
30-
if (node.callee.property.name === "csrf") {
31-
// Keep track of found CSRF
32-
csrf = true;
11+
module.exports = {
12+
meta: {
13+
docs: {
14+
description: "Check and see if CSRF middleware is before methodOverride.",
15+
category: "Security"
16+
}
17+
},
18+
function(context) {
19+
20+
"use strict";
21+
var csrf = false;
22+
23+
return {
24+
"CallExpression": function(node) {
25+
var token = context.getTokens(node)[0],
26+
nodeType = token.type,
27+
nodeValue = token.value;
28+
29+
if (nodeValue === "express") {
30+
if (!node.callee || !node.callee.property) {
31+
return;
32+
}
33+
34+
if (node.callee.property.name === "methodOverride" && csrf) {
35+
context.report(node, "express.csrf() middleware found before express.methodOverride()");
36+
}
37+
if (node.callee.property.name === "csrf") {
38+
// Keep track of found CSRF
39+
csrf = true;
40+
}
3341
}
3442
}
35-
}
36-
};
43+
};
3744

45+
}
3846
};
3947

0 commit comments

Comments
 (0)