solium-plugin-security
Version:
Official Solium Plugin for Security-related lint rules
109 lines (87 loc) • 10.5 kB
Markdown
# The official Security Plugin for Solium
[](https://travis-ci.org/duaraghav8/solium-plugin-security)
This Plugin provides security-focused lint rules for [Solium](https://github.com/duaraghav8/Solium).
The rules have been taken from Consensys' [Recommended Smart Contract Practices](https://consensys.github.io/smart-contract-best-practices/recommendations/) and Solium's [Rule Wishlist](https://github.com/duaraghav8/Solium/issues/44).
## Installation
**NOTE: If you're using Solium `v1.0.1` or above, this plugin comes pre-installed as a local dependency and you can skip this section.**
`npm install -g solium-plugin-security`
## Usage
**NOTE: If you've installed Solium `v1.0.1` or above and created `soliumrc.json` using `solium --init`, you can skip this step since solium automatically applies the security plugin for you.**
Add `security` to your `soliumrc.json`'s `plugins` array. Your configuration file should look like:
```json
{
"extends": "solium:all",
"plugins": ["security"],
"rules": {
...
}
}
```
## List of rules
Below are the rules supplied by this plugin and the information on passing options to them and their auto-fixing capabilities.
Some of them aren't always desirable and are therefore disabled by default (marked below as `OFF`). You should explicitly enable them in your `.soliumrc.json`.
| Name | Description | Options | Defaults | Fixes |
|--------------------------------------|--------------------------------------------------------------------------------------------------|-----------------------------------|--------------------------------------|-------|
| no-throw | Discourage use of 'throw' statement for error flagging | | | YES |
| no-tx-origin | Discourage use of 'tx.origin' global variable | | | |
| enforce-explicit-visibility | Encourage user to explicitly specify visibility of function | | | YES |
| no-block-members | Discourage use of members 'blockhash' & 'timestamp' (and alias 'now') of 'block' global variable | List of members to warn against | ["blockhash", "timestamp"] | |
| no-call-value | Discourage use of .call.value()() | | | |
| no-assign-params | Disallow assigning to function parameters | | | |
| no-fixed | Disallow fixed point types | | | |
| no-inline-assembly | Discourage use of inline assembly | | | |
| no-low-level-calls | Discourage the use of low-level functions - call(), callcode() & delegatecall() | List of functions to warn against | ["call", "callcode", "delegatecall"] | |
| no-modify-for-iter-var | Discourage user to modify a for loop iteration counting variable in the loop body | | | |
| no-send | Discourage the use of unsafe method 'send' | | | |
| no-sha3 | Encourage use of 'keccak256()' over 'sha3()' function | | | YES |
| no-unreachable-code | Disallow unreachable code | | | |
| `OFF` else-after-elseif | Encourage user to use else statement after else-if statement | | | |
| `OFF` enforce-loop-bounds | Encourage use of loops with fixed bounds | | | |
| `OFF` enforce-placeholder-last | Enforce that the function placeholder is the last statement in the modifier | | | |
| `OFF` return-at-end | Discourage use of early returns in functions | | | |
| `OFF` one-break-per-loop | Discourage use of multiple breaks in while/for/do loops | | | |
| `OFF` max-statements-in-func | Enforce upper limit on number of statements inside a function | Maximum number of statements | 25 | |
| `OFF` no-abstract-func | Discourage use of abstract functions | | | |
| `OFF` no-bit-operations | Disallow bitwise operations | | | |
| `OFF` no-continue | Discourage use of 'continue' statement | | | |
| `OFF` no-inheritance | Discourage use of inheritance | Disallow interface inheritance | { "no-interface": false } | |
| `OFF` no-multiple-inheritance | Discourage use of multiple inheritance | Disallow interface inheritance | { "no-interface": false } | |
| `OFF` no-named-params | Disallow named function parameters | | | |
| `OFF` no-named-returns | Discourage use of named returns in functions | | | |
| `OFF` 256-bit-ints-only | Disallow non-256 bit integers | | | |
| `OFF` no-suicide-or-selfdestruct | Disallow suicide and selfdestruct | | | |
| `OFF` no-var | Disallow type deduction via `var` | | | |
| `OFF` no-user-defined-modifiers | Disallow user-defined modifiers | | | |
| `OFF` no-void-returns | Discourage use of void returns in functions prototypes | | | |
| `OFF` no-func-overriding | Discourage function overriding | | | |
An example `soliumrc.json` configuring and applying this plugin is:
```json
{
"plugins": ["security"],
"rules": {
"some-other-solium-rule": 1,
"security/no-low-level-calls": ["error", ["call", "delegatecall"]],
"security/no-block-members": [1, ["timestamp"]],
"security/no-throw": "off"
}
}
```
This tells solium to apply the 3 `security/` rules with special configuration provided and apply the remaining rules of the plugin with their default configurations. If you want to disable a plugin rule, you have to explicitly disable it inside `rules`.
Lint normally using `solium -d contracts/` or `solium -d contracts/ --fix` to apply fixes as well.
## Developer Setup
- `git clone <URL-of-this-repo>`
- `cd solium-plugin-security`
- `npm install --dev`
- `npm link`
- `npm link solium-plugin-security`
- `npm test`
If you'd also like to use your develop build of this plugin with dev build of Solium, go to Solium's directory and run `npm link solium-plugin-security`. This will let Solium access your modified plugin instead of its pre-installed security module.
Access Solium's [Developer Docs](http://solium.readthedocs.io/en/latest/developer-guide.html)
## Roadmap
- [ ] Add automated tests
- [ ] Refine rule `enforce-explicit-visibility`
- [ ] Add more security rules
### Security rules to be implemented
- [ ] `no-multiple-send-calls`
- [ ] `check-send-result`
**[Access the complete Solium documentation](http://solium.readthedocs.io/en/latest/index.html)**