eslint-plugin-security
ESLint rules for Node Security
This project will help identify potential security hotspots, but finds a lot of false positives which need triage by a human.
Installation
npm install --save-dev eslint-plugin-security
or yarn add eslint-plugin-security --dev
Usage
Add the following to your .eslintrc
file:
"extends": [
"plugin:security/recommended"
]
Developer guide
- Use GitHub pull requests.
- Conventions:
- We use our custom ESLint setup.
- Please implement a test for each new rule and use this command to be sure the new code respects the style guide and the tests keep passing:
npm run-script cont-int
Tests
npm test
Rules
detect-unsafe-regex
Locates potentially unsafe regular expressions, which may take a very long time to run, blocking the event loop.
More information: Regular Expression DoS and Node.js
detect-buffer-noassert
Detect calls to buffer
with noAssert
flag set.
From the Node.js API docs: "Setting noAssert
to true skips validation of the offset
. This allows the offset
to be beyond the end of the Buffer
."
detect-child-process
Detect instances of child_process
& non-literal exec()
More information: Avoiding Command Injection in Node.js
detect-disable-mustache-escape
Detects object.escapeMarkup = false
, which can be used with some template engines to disable escaping of HTML entities. This can lead to Cross-Site Scripting (XSS) vulnerabilities.
More information: OWASP XSS
detect-eval-with-expression
Detects eval(variable)
which can allow an attacker to run arbitrary code inside your process.
More information: What are the security issues with eval in JavaScript?
detect-no-csrf-before-method-override
Detects Express csrf
middleware setup before method-override
middleware. This can allow GET
requests (which are not checked by csrf
) to turn into POST
requests later.
More information: Bypass Connect CSRF protection by abusing methodOverride Middleware
detect-non-literal-fs-filename
Detects variable in filename argument of fs
calls, which might allow an attacker to access anything on your system.
More information: OWASP Path Traversal
detect-non-literal-regexp
Detects RegExp(variable)
, which might allow an attacker to DOS your server with a long-running regular expression.
More information: Regular Expression DoS and Node.js
detect-non-literal-require
Detects require(variable)
, which might allow an attacker to load and run arbitrary code, or access arbitrary files on disk.
More information: Where does Node.js and require look for modules?
detect-object-injection
Detects variable[key]
as a left- or right-hand assignment operand.
More information: The Dangers of Square Bracket Notation
detect-possible-timing-attacks
Detects insecure comparisons (==
, !=
, !==
and ===
), which check input sequentially.
More information: A lesson in timing attacks
detect-pseudoRandomBytes
Detects if pseudoRandomBytes()
is in use, which might not give you the randomness you need and expect.
More information: Randombytes vs pseudorandombytes
detect-new-buffer
Detect instances of new Buffer(argument) where argument is any non-literal value.