@noctcore/eslint-plugin-security

Injection / path-traversal precision rules. High-precision syntactic sinks only — precision is the point. Flat-config only, ESLint 9+.

Install

bun add -D @noctcore/eslint-plugin-security   # or npm i -D / pnpm add -D

Use

// eslint.config.js
import security from '@noctcore/eslint-plugin-security';

export default [
  security.configs.recommended,
];

Or wire rules individually — including the opt-in require-path-containment:

import security from '@noctcore/eslint-plugin-security';

export default [
  {
    plugins: { 'noctcore-security': security },
    rules: {
      'noctcore-security/no-shell-interpolation': ['error', { extraCallees: ['sh'] }],
      // High false-positive; enable explicitly (omitted from `recommended`).
      'noctcore-security/require-path-containment': ['warn', { requestObjects: ['req', 'ctx'] }],
    },
  },
];

Rules

| Rule | Description | Recommended | | --- | --- | --- | | no-shell-interpolation | A dynamically-built command string must not flow into a shell runner (exec/execSync, or spawn/execFile with shell: true). | error | | require-path-containment | req.* input passed directly into path.join / path.resolve without a containment guard. | opt-in (off) |