eslint-plugin-securelint

An ESLint plugin that detects security vulnerabilities in your JavaScript/TypeScript code. Get inline warnings and errors directly in your editor.

Installation

npm install eslint-plugin-securelint --save-dev

Usage

Add the plugin and enable rules in your ESLint configuration:

// eslint.config.js
import securelint from "eslint-plugin-securelint";

export default [
  {
    plugins: { securelint },
    rules: {
      "securelint/no-sql-injection": "warn",
      "securelint/no-eval": "error",
      "securelint/no-hardcoded-secrets": "warn",
      "securelint/no-xss": "error",
      "securelint/no-path-traversal": "warn",
      "securelint/no-command-injection": "error",
    },
  },
];

Rules

| Rule | Description | |------|-------------| | no-sql-injection | Detects string concatenation/interpolation in SQL query functions | | no-eval | Flags eval(), new Function(), and setTimeout/setInterval with strings | | no-hardcoded-secrets | Catches hardcoded API keys, passwords, and known token patterns (AWS, GitHub, Slack, etc.) | | no-xss | Detects unsafe innerHTML, outerHTML, document.write(), and dangerouslySetInnerHTML | | no-path-traversal | Flags dynamic values in filesystem operations (fs.readFile, fs.writeFile, etc.) | | no-command-injection | Detects dynamic strings passed to exec()/execSync() shell commands |

Examples

no-sql-injection

// Bad
db.query("SELECT * FROM users WHERE id = " + userId);
db.query(`DELETE FROM users WHERE id = ${userId}`);

// Good
db.query("SELECT * FROM users WHERE id = ?", [userId]);

no-eval

// Bad
eval(userInput);
new Function("return " + code);
setTimeout("alert(1)", 1000);

// Good
setTimeout(() => alert(1), 1000);

no-hardcoded-secrets

// Bad
const apiKey = "sk-1234567890abcdef1234567890abcdef";
const password = "supersecretpassword123";

// Good
const apiKey = process.env.API_KEY;

no-xss

// Bad
element.innerHTML = userInput;
document.write(htmlContent);

// Good
element.textContent = userInput;

no-command-injection

// Bad
exec(`rm -rf ${userInput}`);

// Good
execFile("rm", ["-rf", sanitizedPath]);

License

MIT