ESLint rules for Node Security
This project will help identify potential security hotspots, but finds a lot of false positives which need triage by a human.
npm install --save-dev eslint-plugin-security
Add the following to your .eslintrc file:
"plugins": [
"security"
],
"extends": [
"plugin:security/recommended"
]- Use GitHub pull requests.
- Conventions:
- We use our custom ESLint setup.
- Please implement a test for each new rule and use this command to be sure the new code respects the style guide and the tests keep passing:
npm run-script cont-intnpm testLocates potentially unsafe regular expressions, which may take a very long time to run, blocking the event loop.
More information: Regular Expression DoS and Node.js
Detects calls to buffer with noAssert flag set
From the Node.js API docs: "Setting noAssert to true skips validation of the offset. This allows the offset to be beyond the end of the Buffer."
Detects instances of child_process & non-literal exec()
More information: Avoiding Command Injection in Node.js
Detects object.escapeMarkup = false, which can be used with some template engines to disable escaping of HTML entities. This can lead to Cross-Site Scripting (XSS) vulnerabilities.
More information: https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
Detects eval(variable) which can allow an attacker to run arbitary code inside your process.
More information: http://security.stackexchange.com/questions/94017/what-are-the-security-issues-with-eval-in-javascript
Detects Express csrf middleware setup before method-override middleware. This can allow GET requests (which are not checked by csrf) to turn into POST requests later.
More information: Bypass Connect CSRF protection by abusing methodOverride Middleware
Detects variable in filename argument of fs calls, which might allow an attacker to access anything on your system.
More information: https://www.owasp.org/index.php/Path_Traversal
Detects RegExp(variable), which might allow an attacker to DOS your server with a long-running regular expression.
More information: Regular Expression DoS and Node.js
Detects require(variable), which might allow an attacker to load and run arbitrary code, or access arbitrary files on disk.
More information: http://www.bennadel.com/blog/2169-where-does-node-js-and-require-look-for-modules.htm
Detects variable[key] as a left- or right-hand assignment operand.
More information: The Dangers of Square Bracket Notation
Detects insecure comparisons (==, !=, !== and ===), which check input sequentially.
More information: https://snyk.io/blog/node-js-timing-attack-ccc-ctf/
Detects if pseudoRandomBytes() is in use, which might not give you the randomness you need and expect.
More information: http://stackoverflow.com/questions/18130254/randombytes-vs-pseudorandombytes