@microsoft/eslint-plugin-sdl - npm Package Compare versions

Comparing version 0.1.5 to 0.1.6

CODE_OF_CONDUCT.md

@@ -0,0 +0,0 @@ # Microsoft Open Source Code of Conduct

config/angular.js

@@ -0,1 +1,4 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
 /**
@@ -2,0 +5,0 @@ * Shareable config for Angular apps.

config/angularjs.js

@@ -0,1 +1,4 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
 /**
@@ -2,0 +5,0 @@ * Shareable config for AngularJS apps.

config/common.js

@@ -0,1 +1,4 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
 /**
@@ -2,0 +5,0 @@ * Shareable config for common JavaScript apps.

config/electron.js

@@ -0,1 +1,4 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
 /**
@@ -2,0 +5,0 @@ * Shareable config for Electron apps.

config/node.js

@@ -0,1 +1,4 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
 /**
@@ -2,0 +5,0 @@ * Shareable config for Node apps.

config/react.js

@@ -0,1 +1,4 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
 /**
@@ -2,0 +5,0 @@ * Shareable config for React apps.

config/recommended.js

@@ -0,1 +1,4 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
 /**
@@ -2,0 +5,0 @@ * Default SDL recommended config for all applications.

config/required.js

@@ -0,1 +1,4 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
 /**
@@ -2,0 +5,0 @@ * Default SDL required config for all applications.

config/typescript.js

@@ -0,1 +1,4 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
 /**
@@ -8,3 +11,2 @@ * Shareable config for TypeScript applications.
 module.exports = {
-  parser: "@typescript-eslint/parser",
   parserOptions: {
@@ -25,2 +27,3 @@ ecmaVersion: 6,
       ],
+      parser: "@typescript-eslint/parser",
       rules: {
@@ -27,0 +30,0 @@ "@typescript-eslint/no-implied-eval": "error",

docs/rules/no-angular-bypass-sanitizer.md

@@ -0,0 +0,0 @@ # Do not bypass Angular's built-in sanitization (no-angular-bypass-sanitizer)

docs/rules/no-angularjs-bypass-sce.md

@@ -0,0 +0,0 @@ # Do not bypass Strict Contextual Escaping (SCE) in AngularJS (no-angularjs-bypass-sce)

docs/rules/no-angularjs-enable-svg.md

@@ -0,0 +0,0 @@ # Do not enable SVG support in AngularJS (no-angularjs-enable-svg)

docs/rules/no-angularjs-sanitization-whitelist.md

@@ -0,0 +0,0 @@ # Do not bypass Angular's built-in sanitization (no-angularjs-sanitization-whitelist)

docs/rules/no-cookies.md

@@ -0,0 +0,0 @@ # Do not use HTTP cookies in modern applications (no-cookies)

docs/rules/no-document-domain.md

@@ -0,0 +0,0 @@ # Do not write to document.domain property (no-document-domain)

docs/rules/no-document-write.md

@@ -0,0 +0,0 @@ # Do not write to DOM directly using document.write or document.writeln methods (no-document-write)

docs/rules/no-electron-node-integration.md

@@ -0,0 +0,0 @@ # Do not enable Node.js Integration for Remote Content (no-electron-node-integration)

docs/rules/no-html-method.md

@@ -0,0 +0,0 @@ # Do not write to DOM directly using jQuery html() method (no-html-method)

docs/rules/no-inner-html.md

@@ -0,0 +0,0 @@ # Do not write to DOM directly using innerHTML/outerHTML property (no-inner-html)

docs/rules/no-insecure-random.md

@@ -0,0 +0,0 @@ # Do not use insecure random functions

docs/rules/no-insecure-url.md

@@ -19,3 +19,3 @@ # Do not use insecure URLs (no-insecure-url)
 "@microsoft/sdl/no-insecure-url": ["error", {
-            "blacklist": ["^(http|ftp):\\/\\/", "^https:\\/\\/www\\.disallow-example\\.com"],
+            "blocklist": ["^(http|ftp):\\/\\/", "^https:\\/\\/www\\.disallow-example\\.com"],
             "exceptions": ["^http:\\/\\/schemas\\.microsoft\\.com\\/\\/?.*"]
@@ -25,3 +25,3 @@ }]
 
-... overrides the internal blacklist, blocking the following URL patterns... :
+... overrides the internal blocklist, blocking the following URL patterns... :
 - `http://`...
@@ -37,3 +37,3 @@ - `ftp://`...
 
-URLs in neither the blacklist nor the exceptions list, are allowed:
+URLs in neither the blocklist nor the exceptions list, are allowed:
 - `telnet://`...
@@ -40,0 +40,0 @@ - `ws://`...

docs/rules/no-msapp-exec-unsafe.md

 # Do not bypass script injection validation (no-msapp-exec-unsafe)
 
 Calls to `MSApp.execUnsafeLocalFunction()` bypass script injection validation and should be avoided.

docs/rules/no-postmessage-star-origin.md

 # Do not use * as target origin when sending data to other windows (no-postmessage-star-origin)
 
 Always provide specific target origin, not * when sending data to other windows using [`postMessage`](https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage#Security_concerns) to avoid data leakage outside of trust boundary.

docs/rules/no-unsafe-alloc.md

@@ -0,0 +0,0 @@ # Do not allocate uninitialized buffers in Node.js (no-unsafe-alloc)

docs/rules/no-winjs-html-unsafe.md

 # Do not set HTML using unsafe methods from WinJS.Utilities (no-winjs-html-unsafe)
 
 Calls to [`setInnerHTMLUnsafe`](https://docs.microsoft.com/en-us/previous-versions/windows/apps/br211696(v=win.10)), [`setOuterHTMLUnsafe`](https://docs.microsoft.com/en-us/previous-versions/windows/apps/br211698(v=win.10)) or [`insertAdjacentHTMLUnsafe`](https://docs.microsoft.com/en-us/previous-versions/windows/apps/br229832(v=win.10)) methods from [Windows Library for JavaScript](https://docs.microsoft.com/en-us/previous-versions/windows/apps/mt502392(v=win.10)) do not perform input validation and should be avoided. Use alternate methods such as [`setInnerHTML`](https://docs.microsoft.com/en-us/previous-versions/windows/apps/br211697(v=win.10)) instead.

docs/rules/react-iframe-missing-sandbox.md

@@ -0,0 +0,0 @@ # An iframe element is missing a sandbox attribute (react-iframe-missing-sandbox)

lib/ast-utils.js

@@ -0,0 +0,0 @@ // Copyright (c) Microsoft Corporation.

lib/index.js

@@ -0,0 +0,0 @@ // Copyright (c) Microsoft Corporation.

lib/rules/no-angular-bypass-sanitizer.js

@@ -0,0 +0,0 @@ // Copyright (c) Microsoft Corporation.

lib/rules/no-angularjs-bypass-sce.js

@@ -28,4 +28,4 @@ // Copyright (c) Microsoft Corporation.
     },
-    create: function(context) {
-        
+    create: function (context) {
+
         function reportIt(node) {
@@ -47,3 +47,15 @@ context.report({
             "CallExpression[arguments!=''][callee.object.name='$sceDelegate'][callee.property.name='trustAs']": reportIt,
-            "CallExpression[arguments!=''][callee.object.name='$sce'][callee.property.name=/trustAs(Css|Html|Js|ResourceUrl|Url)?/]": reportIt
+            "CallExpression[arguments!=''][callee.object.name='$sce'][callee.property.name=/trustAs(Css|Html|Js|ResourceUrl|Url)?/]"(node) {
+                // Known false positives
+                if (
+                    node.arguments
+                    && node.arguments.length === 1
+                    && node.arguments[0].type === "Literal"
+                    && node.arguments[0].value === ""
+                ) {
+                    return;
+                }
+
+                return reportIt(node);
+            }
         };
@@ -53,2 +65,2 @@ }
 
-// TODO: Review https://docs.angularjs.org/api/ng/provider/$sceDelegateProvider#resourceUrlWhitelist and https://docs.angularjs.org/api/ng/provider/$sceDelegateProvider#resourceUrlBlacklist
+// TODO: Review https://docs.angularjs.org/api/ng/provider/$sceDelegateProvider#resourceUrlWhitelist and https://docs.angularjs.org/api/ng/provider/$sceDelegateProvider#resourceUrlBlacklist

lib/rules/no-angularjs-enable-svg.js

@@ -0,0 +0,0 @@ // Copyright (c) Microsoft Corporation.

lib/rules/no-angularjs-sanitization-whitelist.js

@@ -0,0 +0,0 @@ // Copyright (c) Microsoft Corporation.

lib/rules/no-cookies.js

@@ -0,0 +0,0 @@ // Copyright (c) Microsoft Corporation.

lib/rules/no-document-domain.js

@@ -0,0 +0,0 @@ // Copyright (c) Microsoft Corporation.

lib/rules/no-document-write.js

@@ -0,0 +0,0 @@ // Copyright (c) Microsoft Corporation.

lib/rules/no-electron-node-integration.js

@@ -0,0 +0,0 @@ // Copyright (c) Microsoft Corporation.

lib/rules/no-html-method.js

@@ -35,7 +35,18 @@ // Copyright (c) Microsoft Corporation.
       // - Improve rule with type information from TypeScript parser
-
+      // - Consider ignoring all Literals?
       "CallExpression[arguments.length=1] > MemberExpression.callee[property.name='html']"(node) {
+        // Known false positives
+        if (
+          // element.html("")
+          node.parent.arguments[0].type === "Literal"
+          && (
+            node.parent.arguments[0].value === ""
+            || node.parent.arguments[0].value === null
+          )
+        ) {
+          return;
+        }
         context.report(
         { 
-          node: node,  
+          node: node,
           messageId: "default" 
@@ -42,0 +53,0 @@ });

lib/rules/no-inner-html.js

@@ -0,0 +0,0 @@ // Copyright (c) Microsoft Corporation.

lib/rules/no-insecure-random.js

@@ -70,3 +70,3 @@ // Copyright (c) Microsoft Corporation.
         }else{
-          notFalsePositive = node.object.name === 'Math'
+          notFalsePositive = node.object.name === 'Math';
         }
@@ -73,0 +73,0 @@

lib/rules/no-insecure-url.js

@@ -13,3 +13,3 @@ // Copyright (c) Microsoft Corporation.
 //------------------------------------------------------------------------------
-const DEFAULT_BLACKLIST = [
+const DEFAULT_BLOCKLIST = [
     /^(ftp|http|telnet|ws):\/\//i
@@ -24,3 +24,3 @@ ];
 module.exports = {
-    defaultBlacklist: DEFAULT_BLACKLIST,
+    defaultBlocklist: DEFAULT_BLOCKLIST,
     defaultExceptions: DEFAULT_EXCEPTIONS,
@@ -34,3 +34,3 @@ meta: {
                 properties: {
-                    blacklist: {
+                    blocklist: {
                         type: "array",
@@ -62,3 +62,3 @@ items: {
         const options = context.options[0] || {};
-        const blacklist = (options.blacklist || DEFAULT_BLACKLIST).map((pattern) => { return new RegExp(pattern, "i"); });
+        const blocklist = (options.blocklist || DEFAULT_BLOCKLIST).map((pattern) => { return new RegExp(pattern, "i"); });
         const exceptions = (options.exceptions || DEFAULT_EXCEPTIONS).map((pattern) => { return new RegExp(pattern, "i"); });
@@ -73,3 +73,3 @@
                 if (typeof node.value === "string") {
-                    if (matches(blacklist, node.value) && !matches(exceptions, node.value)) {
+                    if (matches(blocklist, node.value) && !matches(exceptions, node.value)) {
                         context.report({
@@ -87,4 +87,4 @@ node: node,
 
-                    if ((matches(blacklist, rawStringText) && !matches(exceptions, rawStringText)) ||
-                        (matches(blacklist, cookedStringText) && !matches(exceptions, cookedStringText))) {
+                    if ((matches(blocklist, rawStringText) && !matches(exceptions, rawStringText)) ||
+                        (matches(blocklist, cookedStringText) && !matches(exceptions, cookedStringText))) {
                         context.report({
@@ -91,0 +91,0 @@ node: node,

lib/rules/no-msapp-exec-unsafe.js

@@ -0,0 +0,0 @@ // Copyright (c) Microsoft Corporation.

lib/rules/no-postmessage-star-origin.js

@@ -0,0 +0,0 @@ // Copyright (c) Microsoft Corporation.

lib/rules/no-unsafe-alloc.js

@@ -0,0 +0,0 @@ // Copyright (c) Microsoft Corporation.

lib/rules/no-winjs-html-unsafe.js

@@ -0,0 +0,0 @@ // Copyright (c) Microsoft Corporation.

lib/rules/react-iframe-missing-sandbox.js

@@ -0,0 +0,0 @@ // Copyright (c) Microsoft Corporation.

package.json

 {
   "name": "@microsoft/eslint-plugin-sdl",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "ESLint plugin focused on common security issues and misconfigurations discoverable during static testing as part of Microsoft Security Development Lifecycle (SDL)",
@@ -26,3 +26,3 @@ "keywords": [
     "eslint": "^7.1.0",
-    "mocha": "^7.2.0",
+    "mocha": "^8.3.2",
     "typescript": "^3.9.7"
@@ -29,0 +29,0 @@ },

README.md

 # eslint-plugin-sdl
+![Node CI](https://github.com/microsoft/eslint-plugin-sdl/workflows/Node%20CI/badge.svg?branch=main&event=push)
+![E2E integration](https://github.com/microsoft/eslint-plugin-sdl/workflows/E2E%20integration/badge.svg?branch=main&event=push)
 
@@ -3,0 +5,0 @@ [ESLint Plugin](https://eslint.org/docs/developer-guide/working-with-plugins) focused on common security issues and misconfigurations.

SECURITY.md

@@ -0,0 +0,0 @@ <!-- BEGIN MICROSOFT SECURITY.MD V0.0.5 BLOCK -->

No alert changes

Improved metrics

Lines of code

1157

increased by1.22%

Number of lines in readme file

69

increased by2.99%

Worsened metrics

Total package byte prevSize

71400

decreased by-6.47%

Number of package files

50

decreased by-7.41%

No dependency changes