@rushstack/eslint-plugin-security

This plugin implements a collection of security rules for ESLint.

Our ambition is to eventually provide a comprehensive set of recommended security rules for:

web browser applications
Node.js tools
Node.js services

If you would like to request or contribute a new security rule, you are encouraged to create a GitHub issue in the Rush Stack monorepo where this project is developed. Thanks!

`@rushstack/security/no-unsafe-regexp`

Require regular expressions to be constructed from string constants rather than dynamically building strings at runtime.

Rule Details

Regular expressions should be constructed from string constants. Dynamically building strings at runtime may introduce security vulnerabilities, performance concerns, and bugs involving incorrect escaping of special characters.

Examples

The following patterns are considered problems when @rushstack/security/no-unsafe-regexp is enabled:

function parseRestResponse(request: ICatalogRequest,
  items: ICatalogItem[]): ICatalogItem[] {

  // Security vulnerability: A malicious user could invoke the REST service using a
  // "searchPattern" with a complex RegExp that causes a denial of service.
  const regexp: RegExp = new RegExp(request.searchPattern);
  return items.filter(item => regexp.test(item.title));
}

function hasExtension(filePath: string, extension: string): boolean {
  // Escaping mistake: If the "extension" string contains a special character such as ".",
  // it will be interpreted as a regular expression operator. Correctly escaping an arbitrary
  // string is a nontrivial problem due to RegExp implementation differences, as well as contextual
  // issues (since which characters are special changes inside RegExp nesting constructs).
  // In most cases, this problem is better solved without regular expressions.
  const regexp: RegExp = new RegExp(`\.${extension}$`);
  return regexp.test(filePath);
}

The following patterns are NOT considered problems:

function isInteger(s: string): boolean {
  return /[0-9]+/.test(s);
}

function isInteger(s: string): boolean {
  return new RegExp('[0-9]+').test(s);
}

Links

CHANGELOG.md - Find out what's new in the latest version

@rushstack/eslint-plugin-security is part of the Rush Stack family of projects.