Security News
tea.xyz Spam Plagues npm and RubyGems Package Registries
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
@rushstack/eslint-plugin-security
Advanced tools
Readme
This plugin implements a collection of security rules for ESLint.
Our ambition is to eventually provide a comprehensive set of recommended security rules for:
If you would like to request or contribute a new security rule, you are encouraged to create a GitHub issue in the Rush Stack monorepo where this project is developed. Thanks!
@rushstack/security/no-unsafe-regexp
Require regular expressions to be constructed from string constants rather than dynamically building strings at runtime.
Regular expressions should be constructed from string constants. Dynamically building strings at runtime may introduce security vulnerabilities, performance concerns, and bugs involving incorrect escaping of special characters.
The following patterns are considered problems when @rushstack/security/no-unsafe-regexp
is enabled:
function parseRestResponse(request: ICatalogRequest,
items: ICatalogItem[]): ICatalogItem[] {
// Security vulnerability: A malicious user could invoke the REST service using a
// "searchPattern" with a complex RegExp that causes a denial of service.
const regexp: RegExp = new RegExp(request.searchPattern);
return items.filter(item => regexp.test(item.title));
}
function hasExtension(filePath: string, extension: string): boolean {
// Escaping mistake: If the "extension" string contains a special character such as ".",
// it will be interpreted as a regular expression operator. Correctly escaping an arbitrary
// string is a nontrivial problem due to RegExp implementation differences, as well as contextual
// issues (since which characters are special changes inside RegExp nesting constructs).
// In most cases, this problem is better solved without regular expressions.
const regexp: RegExp = new RegExp(`\.${extension}$`);
return regexp.test(filePath);
}
The following patterns are NOT considered problems:
function isInteger(s: string): boolean {
return /[0-9]+/.test(s);
}
function isInteger(s: string): boolean {
return new RegExp('[0-9]+').test(s);
}
@rushstack/eslint-plugin-security
is part of the Rush Stack family of projects.
FAQs
An ESLint plugin providing rules that identify common security vulnerabilities for browser applications, Node.js tools, and Node.js services
The npm package @rushstack/eslint-plugin-security receives a total of 56,635 weekly downloads. As such, @rushstack/eslint-plugin-security popularity was classified as popular.
We found that @rushstack/eslint-plugin-security demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
Security News
As cyber threats become more autonomous, AI-powered defenses are crucial for businesses to stay ahead of attackers who can exploit software vulnerabilities at scale.
Security News
UnitedHealth Group disclosed that the ransomware attack on Change Healthcare compromised protected health information for millions in the U.S., with estimated costs to the company expected to reach $1 billion.