eslint/rules/security
Security: Injection (XSS, SQL, commands), weak cryptography, secrets, insecure protocols and the sanitizer. Rules of ESLint, typescript-eslint and SonarJS (the Sonar way profile of SonarQube) on this subject, every rule listed; the TypeScript rules apply to TypeScript files only.
57 rules, 46 on. Source: lint/eslint/rules/security.mjs.
| Rule | Setting | Files | What it checks | Why |
|---|---|---|---|---|
no-restricted-properties | warn, [{"property":"bypassSecurityTrustHtml","message":"Bypassi… | JS + TS | Disallow certain properties on certain objects | Custom: a sanitizer bypass is a security review, not a shortcut. Warn: a reviewed bypass (trusted, constant markup) may be justified with an eslint-disable comment. |
no-eval | error | JS + TS | Disallow the use of eval() | — |
no-implied-eval | error | JS + TS | Disallow the use of eval()-like methods | Replaced by the TS version. |
no-new-func | error | JS + TS | Disallow new operators with the Function object | — |
no-script-url | error | JS + TS | Disallow javascript: URLs | — |
sonarjs/code-eval | off | JS + TS | Dynamic code execution should not use user-controlled data | Off: duplicate of no-eval, no-new-func and no-implied-eval. |
sonarjs/confidential-information-logging | off | JS + TS | Confidential information should not be logged | Off: not in the Sonar way profile of SonarQube. |
sonarjs/content-length | error | JS + TS | HTTP request content length should be limited | — |
sonarjs/content-security-policy | error | JS + TS | Content security policy fetch directives should not be disabled | — |
sonarjs/cookie-no-httponly | error | JS + TS | Cookies should have the "HttpOnly" flag | — |
sonarjs/cors | error | JS + TS | Cross-Origin Resource Sharing (CORS) policy should be restricted to trusted origins | — |
sonarjs/csrf | error | JS + TS | CSRF protections should not be disabled | — |
sonarjs/disabled-auto-escaping | error | JS + TS | Auto-escaping in HTML template engines should not be disabled | — |
sonarjs/disabled-resource-integrity | error | JS + TS | Remote artifacts should not be used without integrity checks | — |
sonarjs/dompurify-unsafe-config | error | JS + TS | DOMPurify configuration should not be bypassable | — |
sonarjs/encryption-secure-mode | error | JS + TS | Encryption algorithms should be used with secure mode and padding scheme | — |
sonarjs/file-permissions | error | JS + TS | File permissions should not be set to world-accessible values | — |
sonarjs/file-uploads | error | JS + TS | File uploads should be restricted | — |
sonarjs/frame-ancestors | off | JS + TS | Content Security Policy frame-ancestors directive should not be disabled | Off: not in the Sonar way profile of SonarQube. |
sonarjs/hardcoded-secret-signatures | error | JS + TS | Credentials should not be hard-coded | — |
sonarjs/hashing | error | JS + TS | Weak hashing algorithms should not be used | — |
sonarjs/hidden-files | off | JS + TS | Hidden files should not be served statically | Off: not in the Sonar way profile of SonarQube. |
sonarjs/insecure-cookie | error | JS + TS | Cookies should have the "secure" flag | — |
sonarjs/insecure-jwt-token | error | JS + TS | JWT should be signed and verified with strong cipher algorithms | — |
sonarjs/link-with-target-blank | error | JS + TS | Opened windows should not have access to the originating page | — |
sonarjs/no-angular-bypass-sanitization | error | JS + TS | Angular built-in sanitization should not be disabled | — |
sonarjs/no-clear-text-protocols | warn | JS + TS | Clear-text protocols should not be used | Warn: a SonarQube security hotspot: to review, a local URL may be fine. |
sonarjs/no-hardcoded-ip | warn | JS + TS | IP addresses should not be hardcoded | Warn: a SonarQube security hotspot: to review, a documented example may be fine. |
sonarjs/no-hardcoded-passwords | error | JS + TS | Credentials should not be hard-coded | — |
sonarjs/no-hardcoded-secrets | error | JS + TS | Secrets should not be hard-coded | — |
sonarjs/no-intrusive-permissions | off | JS + TS | Sensitive permissions should not be requested unnecessarily | Off: not in the Sonar way profile of SonarQube. |
sonarjs/no-ip-forward | off | JS + TS | Client IP address should not be forwarded to proxies | Off: not in the Sonar way profile of SonarQube. |
sonarjs/no-mime-sniff | error | JS + TS | Browsers should not be allowed to perform MIME type sniffing | — |
sonarjs/no-mixed-content | off | JS + TS | Content Security Policy should block mixed-content | Off: not in the Sonar way profile of SonarQube. |
sonarjs/no-os-command-from-path | error | JS + TS | OS commands should not rely on PATH resolution | — |
sonarjs/no-referrer-policy | error | JS + TS | HTTP Referrer-Policy should not be set to an unsafe value | — |
sonarjs/no-session-cookies-on-static-assets | error | JS + TS | Static Assets should not serve session cookies | — |
sonarjs/no-unsafe-unzip | off | JS + TS | Expanding archive files should not be done without controlling resource consumption | Off: not in the Sonar way profile of SonarQube. |
sonarjs/no-weak-cipher | error | JS + TS | Cipher algorithms should be robust | — |
sonarjs/no-weak-keys | error | JS + TS | Cryptographic keys should be robust | — |
sonarjs/os-command | off | JS + TS | OS commands should not be executed using a shell interpreter | Off: not in the Sonar way profile of SonarQube. |
sonarjs/post-message | error | JS + TS | Origins should be verified during cross-origin communications | — |
sonarjs/production-debug | error | JS + TS | Debugging features should not be enabled in production | — |
sonarjs/pseudo-random | warn | JS + TS | Pseudorandom number generators (PRNGs) should not be used in security contexts | Warn: a SonarQube security hotspot: to review, Math.random is fine outside security. |
sonarjs/publicly-writable-directories | error | JS + TS | Temporary files should not be created in publicly writable directories | — |
sonarjs/session-regeneration | error | JS + TS | A new session should be created during user authentication | — |
sonarjs/slow-regex | error | JS + TS | Regular expressions should not cause catastrophic backtracking | — |
sonarjs/sql-queries | error | JS + TS | SQL queries should not be dynamically formatted | — |
sonarjs/strict-transport-security | error | JS + TS | HTTP Strict-Transport-Security policy should not be disabled | — |
sonarjs/unverified-certificate | error | JS + TS | Server certificates should be verified during SSL/TLS connections | — |
sonarjs/unverified-hostname | error | JS + TS | Server hostnames should be verified during SSL/TLS connections | — |
sonarjs/weak-ssl | error | JS + TS | Weak SSL/TLS protocols should not be used | — |
sonarjs/web-sql-database | off | JS + TS | Web SQL databases should not be used | Off: not in the Sonar way profile of SonarQube. |
sonarjs/x-powered-by | error | JS + TS | Web application technologies should not disclose version information | — |
sonarjs/xml-parser-xxe | error | JS + TS | XML parsers should not be vulnerable to XXE attacks | — |
no-implied-eval | off | TS | Disallow the use of eval()-like methods | Replaced by the TS version. |
@typescript-eslint/no-implied-eval | error | TS | Disallow the use of eval()-like functions | — |