lwc-linter
Version:
A comprehensive CLI tool for linting Lightning Web Components v8.0.0+ with modern LWC patterns, decorators, lifecycle hooks, and Salesforce platform integration
248 lines • 11.9 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
exports.loadSecurityRules = loadSecurityRules;
function loadSecurityRules() {
return [
{
name: 'no-innerhtml',
description: 'Prevent use of innerHTML to avoid XSS vulnerabilities',
category: 'security',
severity: 'error',
fixable: false,
check: (content, filePath, config) => {
const issues = [];
if (!filePath.endsWith('.js'))
return issues;
const lines = content.split('\n');
lines.forEach((line, index) => {
if (line.includes('innerHTML') && !line.trim().startsWith('//')) {
if (config.security?.allowInnerHTML) {
issues.push({
rule: 'no-innerhtml',
message: 'innerHTML usage detected. Ensure content is properly sanitized to prevent XSS',
severity: 'warn',
line: index + 1,
fixable: false,
category: 'security'
});
}
else {
issues.push({
rule: 'no-innerhtml',
message: 'Avoid innerHTML. Use textContent or Lightning Web Components data binding instead',
severity: 'error',
line: index + 1,
fixable: false,
category: 'security'
});
}
}
// Also check for outerHTML
if (line.includes('outerHTML') && !line.trim().startsWith('//')) {
issues.push({
rule: 'no-innerhtml',
message: 'Avoid outerHTML. Use Lightning Web Components templates instead',
severity: 'error',
line: index + 1,
fixable: false,
category: 'security'
});
}
});
return issues;
}
},
{
name: 'input-validation',
description: 'Ensure proper input validation and sanitization',
category: 'security',
severity: 'warn',
fixable: false,
check: (content, filePath, config) => {
const issues = [];
if (!filePath.endsWith('.js'))
return issues;
const lines = content.split('\n');
lines.forEach((line, index) => {
// Check for user input without validation
if ((line.includes('.value') || line.includes('event.target')) &&
!content.includes('validate') &&
!content.includes('sanitize')) {
issues.push({
rule: 'input-validation',
message: 'User input should be validated and sanitized before use',
severity: 'warn',
line: index + 1,
fixable: false,
category: 'security'
});
}
// Check for direct database queries (if any ORM patterns)
if (line.includes('SELECT') || line.includes('INSERT') || line.includes('UPDATE')) {
issues.push({
rule: 'input-validation',
message: 'Avoid direct SQL queries. Use parameterized queries or ORM methods',
severity: 'error',
line: index + 1,
fixable: false,
category: 'security'
});
}
});
return issues;
}
},
{
name: 'xss-prevention',
description: 'Prevent Cross-Site Scripting (XSS) vulnerabilities',
category: 'security',
severity: 'error',
fixable: false,
check: (content, filePath, config) => {
const issues = [];
const lines = content.split('\n');
lines.forEach((line, index) => {
// Check for script injection patterns in HTML
if (filePath.endsWith('.html')) {
if (line.includes('<script') && !line.includes('lwc:')) {
issues.push({
rule: 'xss-prevention',
message: 'Avoid inline scripts. Use Lightning Web Components JavaScript files instead',
severity: 'error',
line: index + 1,
fixable: false,
category: 'security'
});
}
// Check for javascript: URLs
if (line.includes('javascript:')) {
issues.push({
rule: 'xss-prevention',
message: 'Avoid javascript: URLs as they can lead to XSS vulnerabilities',
severity: 'error',
line: index + 1,
fixable: false,
category: 'security'
});
}
}
// Check for eval usage in JavaScript
if (filePath.endsWith('.js') && line.includes('eval(') && !line.trim().startsWith('//')) {
issues.push({
rule: 'xss-prevention',
message: 'eval() is dangerous and can lead to code injection. Avoid its use',
severity: 'error',
line: index + 1,
fixable: false,
category: 'security'
});
}
});
return issues;
}
},
{
name: 'no-eval',
description: 'Prohibit the use of eval() and similar functions',
category: 'security',
severity: 'error',
fixable: false,
check: (content, filePath, config) => {
const issues = [];
if (!filePath.endsWith('.js'))
return issues;
const lines = content.split('\n');
const dangerousFunctions = ['eval', 'Function', 'setTimeout', 'setInterval'];
lines.forEach((line, index) => {
dangerousFunctions.forEach(func => {
// Check for eval-like functions with string arguments
if (line.includes(`${func}(`) &&
(line.includes('"') || line.includes("'")) &&
!line.trim().startsWith('//')) {
if (func === 'setTimeout' || func === 'setInterval') {
// Simple string check for string arguments
if (line.includes(`${func}("`) || line.includes(`${func}('`)) {
issues.push({
rule: 'no-eval',
message: `Avoid using ${func} with string arguments. Use function references instead`,
severity: 'warn',
line: index + 1,
fixable: false,
category: 'security'
});
}
}
else {
issues.push({
rule: 'no-eval',
message: `Avoid ${func}() as it can execute arbitrary code and poses security risks`,
severity: 'error',
line: index + 1,
fixable: false,
category: 'security'
});
}
}
});
});
return issues;
}
},
{
name: 'secure-communication',
description: 'Ensure secure communication practices',
category: 'security',
severity: 'warn',
fixable: false,
check: (content, filePath, config) => {
const issues = [];
if (!filePath.endsWith('.js'))
return issues;
const lines = content.split('\n');
lines.forEach((line, index) => {
// Check for HTTP URLs in production code
if (line.includes('http://') && !line.includes('localhost')) {
issues.push({
rule: 'secure-communication',
message: 'Use HTTPS instead of HTTP for secure communication',
severity: 'warn',
line: index + 1,
fixable: false,
category: 'security'
});
}
// Check for hardcoded credentials - simple string matching
if (!line.trim().startsWith('//')) {
if ((line.includes('password=') || line.includes('password:')) ||
(line.includes('apikey=') || line.includes('apiKey=') || line.includes('api_key=')) ||
(line.includes('secret=') || line.includes('secret:')) ||
(line.includes('token=') || line.includes('token:'))) {
issues.push({
rule: 'secure-communication',
message: 'Avoid hardcoding credentials. Use environment variables or secure storage',
severity: 'error',
line: index + 1,
fixable: false,
category: 'security'
});
}
}
// Check for localStorage usage with sensitive data
if (line.includes('localStorage') &&
(line.includes('password') || line.includes('token') || line.includes('key'))) {
issues.push({
rule: 'secure-communication',
message: 'Avoid storing sensitive data in localStorage. Consider secure alternatives',
severity: 'warn',
line: index + 1,
fixable: false,
category: 'security'
});
}
});
return issues;
}
}
];
}
//# sourceMappingURL=security.js.map