eslint-plugin-security
Advanced tools
eslint-plugin-security is an ESLint plugin that helps identify potential security issues in your JavaScript code. It provides a set of rules that can be used to catch common security vulnerabilities, such as the use of eval(), potential XSS vulnerabilities, and more.
Detecting the use of eval()
This rule detects the use of eval() with an expression, which can lead to code injection vulnerabilities. The code sample shows a scenario where user input is passed to eval(), which is flagged by the rule.
/* eslint security/detect-eval-with-expression: 'error' */
const userInput = '2 + 2';
eval(userInput);Detecting potential XSS vulnerabilities
This rule detects the use of non-literal regular expressions, which can be a source of XSS vulnerabilities. The code sample demonstrates creating a RegExp object with user input, which is flagged by the rule.
/* eslint security/detect-non-literal-regexp: 'error' */
const userInput = '.*';
const regex = new RegExp(userInput);Detecting potential ReDoS vulnerabilities
This rule detects potentially unsafe regular expressions that could lead to Regular Expression Denial of Service (ReDoS) attacks. The code sample shows an unsafe regex pattern that is flagged by the rule.
/* eslint security/detect-unsafe-regex: 'error' */
const unsafeRegex = /(a+)+$/;
unsafeRegex.test('aaaaaaaaaaaaaaaaaaaaaaaaaaaaa');eslint-plugin-no-unsanitized is an ESLint plugin that focuses on preventing the use of unsanitized methods that can lead to XSS vulnerabilities. It is similar to eslint-plugin-security in that it helps identify potential security issues, but it specifically targets unsanitized DOM manipulations.
eslint-plugin-scanjs-rules is an ESLint plugin that provides a set of security rules based on the Mozilla ScanJS project. It is similar to eslint-plugin-security in that it aims to identify security issues in JavaScript code, but it includes a different set of rules inspired by the ScanJS project.
ESLint rules for Node Security
This project will help identify potential security hotspots, but finds a lot of false positives which need triage by a human.
npm install --save-dev eslint-plugin-security or yarn add eslint-plugin-security --dev
Add the following to your .eslintrc file:
"extends": [
"plugin:security/recommended"
]
npm run-script cont-int
npm test
detect-unsafe-regexLocates potentially unsafe regular expressions, which may take a very long time to run, blocking the event loop.
More information: Regular Expression DoS and Node.js
detect-buffer-noassertDetect calls to buffer with noAssert flag set.
From the Node.js API docs: "Setting noAssert to true skips validation of the offset. This allows the offset to be beyond the end of the Buffer."
detect-child-processDetect instances of child_process & non-literal exec()
More information: Avoiding Command Injection in Node.js
detect-disable-mustache-escapeDetects object.escapeMarkup = false, which can be used with some template engines to disable escaping of HTML entities. This can lead to Cross-Site Scripting (XSS) vulnerabilities.
More information: OWASP XSS
detect-eval-with-expressionDetects eval(variable) which can allow an attacker to run arbitrary code inside your process.
More information: What are the security issues with eval in JavaScript?
detect-no-csrf-before-method-overrideDetects Express csrf middleware setup before method-override middleware. This can allow GET requests (which are not checked by csrf) to turn into POST requests later.
More information: Bypass Connect CSRF protection by abusing methodOverride Middleware
detect-non-literal-fs-filenameDetects variable in filename argument of fs calls, which might allow an attacker to access anything on your system.
More information: OWASP Path Traversal
detect-non-literal-regexpDetects RegExp(variable), which might allow an attacker to DOS your server with a long-running regular expression.
More information: Regular Expression DoS and Node.js
detect-non-literal-requireDetects require(variable), which might allow an attacker to load and run arbitrary code, or access arbitrary files on disk.
More information: Where does Node.js and require look for modules?
detect-object-injectionDetects variable[key] as a left- or right-hand assignment operand.
More information: The Dangers of Square Bracket Notation
detect-possible-timing-attacksDetects insecure comparisons (==, !=, !== and ===), which check input sequentially.
More information: A lesson in timing attacks
detect-pseudoRandomBytesDetects if pseudoRandomBytes() is in use, which might not give you the randomness you need and expect.
More information: Randombytes vs pseudorandombytes
detect-new-bufferDetect instances of new Buffer(argument) where argument is any non-literal value.
1.5.0 / 2022-04-14
package-lock.jsonFAQs
Security rules for eslint
We found that eslint-plugin-security demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Node.js will be enforcing stricter semver-major PR policies a month before major releases to enhance stability and ensure reliable release candidates.
Security News
Research
Socket's threat research team has detected five malicious npm packages targeting Roblox developers, deploying malware to steal credentials and personal data.
Security News
vlt introduced its new package manager and a serverless registry this week, innovating in a space where npm has stagnated.