ESLint plugin containing Node.js security rules
This plugin will help to identify potential threats and prevent attacks.
npm install --save-dev eslint-plugin-security-node
Add the following configuration to your .eslintrc
file:
"plugins": [
"security-node"
],
"extends": [
"plugin:security-node/recommended"
]
- Use GitHub pull requests
- Check the .eslintrc file to see the ESLint setup
Type the following to test all the rules:
$ npm test
Type the following to test a particular rule:
$ ./node_modules/.bin/mocha tests/lib/rules/rule_name
For details check the documentation file non-literal-reg-expr
For details check the documentation file detect-absence-of-name-option-in-exrpress-session
For details check the documentation file detect-buffer-unsafe-allocation
For details check the documentation file detect-child-process
For details check the documentation file detect-crlf
For more information check the documentation file detect-dangerous-redirects
For more information check the documentation file detect-eval-with-expr
For more information check the documentation file detect-html-injection
For more information check the documentation file detect-insecure-randomness
For more information check the documentation file detect-non-literal-require-calls
For more information check the documentation file detect-nosql-injection
For more information check the documentation file detect-option-multiplestatements-in-mysql
For more information check the documentation file detect-option-rejectunauthorized-in-nodejs-httpsrequest
For more information check the documentation file detect-option-unsafe-in-serialize-javascript-npm-package
For more information check the documentation file detect-possible-timing-attacks
For more information check the documentation file detect-runinthiscontext-method-in-nodes-vm.
For more information check the documentation file detect-security-missconfiguration-cookie
For more information check the documentation file detect-sql-injection
For more information check the documentation file disable-ssl-across-node-server