oxlint-plugin-security-rules

An oxlint plugin that ports security rules from eslint-plugin-security.

Installation

npm install --save-dev oxlint-plugin-security-rules

Usage

Add to your .oxlintrc.json:

{
  "jsPlugins": [
    { "name": "security", "specifier": "oxlint-plugin-security-rules" }
  ],
  "rules": {
    "security/detect-eval-with-expression": "error",
    "security/detect-non-literal-require": "warn",
    "security/detect-non-literal-fs-filename": "warn",
    "security/detect-unsafe-regex": "error",
    "security/detect-child-process": "warn",
    "security/detect-new-buffer": "warn",
    "security/detect-buffer-noassert": "warn",
    "security/detect-non-literal-regexp": "warn",
    "security/detect-bidi-characters": "error",
    "security/detect-disable-mustache-escape": "warn",
    "security/detect-no-csrf-before-method-override": "warn",
    "security/detect-pseudoRandomBytes": "warn"
  }
}

Rules

| Rule | Description | |---|---| | detect-bidi-characters | Detects trojan source attacks using unicode bidirectional characters | | detect-buffer-noassert | Flags buffer.readXXX() calls with the noAssert flag | | detect-child-process | Flags child_process method calls with non-literal arguments | | detect-disable-mustache-escape | Flags obj.escapeMarkup = false | | detect-eval-with-expression | Flags eval() with non-literal argument | | detect-new-buffer | Flags new Buffer() with non-literal argument | | detect-no-csrf-before-method-override | Flags methodOverride() registered before csrf() in Express. Note: flags methodOverride() in any file where csrf() has not been registered before it | | detect-non-literal-fs-filename | Flags fs method calls with variable path arguments | | detect-non-literal-regexp | Flags new RegExp() with non-literal argument | | detect-non-literal-require | Flags require() with non-literal argument | | detect-pseudoRandomBytes | Flags use of .pseudoRandomBytes | | detect-unsafe-regex | Flags regex patterns that may cause catastrophic backtracking |

License

MIT