Security News
GitHub Removes Malicious Pull Requests Targeting Open Source Repositories
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
eslint-plugin-security
Advanced tools
eslint-plugin-security is an ESLint plugin that helps identify potential security issues in your JavaScript code. It provides a set of rules that can be used to catch common security vulnerabilities, such as the use of eval(), potential XSS vulnerabilities, and more.
Detecting the use of eval()
This rule detects the use of eval() with an expression, which can lead to code injection vulnerabilities. The code sample shows a scenario where user input is passed to eval(), which is flagged by the rule.
/* eslint security/detect-eval-with-expression: 'error' */
const userInput = '2 + 2';
eval(userInput);
Detecting potential XSS vulnerabilities
This rule detects the use of non-literal regular expressions, which can be a source of XSS vulnerabilities. The code sample demonstrates creating a RegExp object with user input, which is flagged by the rule.
/* eslint security/detect-non-literal-regexp: 'error' */
const userInput = '.*';
const regex = new RegExp(userInput);
Detecting potential ReDoS vulnerabilities
This rule detects potentially unsafe regular expressions that could lead to Regular Expression Denial of Service (ReDoS) attacks. The code sample shows an unsafe regex pattern that is flagged by the rule.
/* eslint security/detect-unsafe-regex: 'error' */
const unsafeRegex = /(a+)+$/;
unsafeRegex.test('aaaaaaaaaaaaaaaaaaaaaaaaaaaaa');
eslint-plugin-no-unsanitized is an ESLint plugin that focuses on preventing the use of unsanitized methods that can lead to XSS vulnerabilities. It is similar to eslint-plugin-security in that it helps identify potential security issues, but it specifically targets unsanitized DOM manipulations.
eslint-plugin-scanjs-rules is an ESLint plugin that provides a set of security rules based on the Mozilla ScanJS project. It is similar to eslint-plugin-security in that it aims to identify security issues in JavaScript code, but it includes a different set of rules inspired by the ScanJS project.
ESLint rules for Node Security
Probably not something you want to just toss and leave in a project. It will help identify potential security hotspots, but finds a lot of false positives that needs triaged by a human.
npm install --save-dev eslint-plugin-security
Add the following to your .eslintrc
file:
"plugins": [
"security"
]
detect-unsafe-regex
- Locates potentially unsafe regular expressionsdetect-buffer-noassert
- Detects calls to buffer with noassert flag setdetect-child-process
- Detects instances of child_process & non-literal cp.exec()detect-disable-mustache-escape
-detect-eval-with-expression
- Detects eval(var)detect-no-csrf-before-method-override
- Detects Express.csrf before method-overridedetect-non-literal-fs-filename
- Detects var in filename argument of fs callsdetect-non-literal-regexp
- Detects RegExp(var)detect-non-literal-require
- Detects require(var)detect-object-injection
- Detects var[var]detect-possible-timing-attacks
- Detects insecure comparisons (== != !== ===)detect-pseudoRandomBytes
- Detects if pseudoRandomBytes() is in use1.0.0 / 2015-11-15
FAQs
Security rules for eslint
The npm package eslint-plugin-security receives a total of 0 weekly downloads. As such, eslint-plugin-security popularity was classified as not popular.
We found that eslint-plugin-security demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
Security News
RubyGems.org has added a new "maintainer" role that allows for publishing new versions of gems. This new permission type is aimed at improving security for gem owners and the service overall.
Security News
Node.js will be enforcing stricter semver-major PR policies a month before major releases to enhance stability and ensure reliable release candidates.