vibe/eslint.config.js at develop · kexi/vibe · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
import eslint from "@eslint/js";
import tseslint from "typescript-eslint";
import eslintConfigPrettier from "eslint-config-prettier";
import eslintPluginSecurity from "eslint-plugin-security";

/** @type {import('eslint').ESLint.Plugin} */
const vibeSecurityPlugin = {
  meta: { name: "vibe-security" },
  rules: {
    "no-unescaped-cd-output": {
      meta: {
        type: "problem",
        docs: {
          description: "Require escapeShellPath() in cd shell output to prevent injection",
        },
        messages: {
          unescaped:
            "Unescaped path in cd output. Use escapeShellPath() to prevent shell injection.",
        },
        schema: [],
      },
      create(context) {
        return {
          CallExpression(node) {
            // Match console.log(...)
            const isConsoleLog =
              node.callee.type === "MemberExpression" &&
              node.callee.object.type === "Identifier" &&
              node.callee.object.name === "console" &&
              node.callee.property.type === "Identifier" &&
              node.callee.property.name === "log";
            if (!isConsoleLog) return;

            const arg = node.arguments[0];
            const isTemplateLiteral = arg && arg.type === "TemplateLiteral";
            if (!isTemplateLiteral) return;

            // Check if template starts with "cd '"
            const firstQuasi = arg.quasis[0];
            const startsWith_cd = firstQuasi.value.raw.startsWith("cd '");
            if (!startsWith_cd) return;

            // Each expression in the template must be escapeShellPath(...)
            for (const expr of arg.expressions) {
              const isEscaped =
                expr.type === "CallExpression" &&
                expr.callee.type === "Identifier" &&
                expr.callee.name === "escapeShellPath";
              if (!isEscaped) {
                context.report({ node: expr, messageId: "unescaped" });
              }
            }
          },
        };
      },
    },
  },
};

export default tseslint.config(
  eslint.configs.recommended,
  ...tseslint.configs.recommended,
  eslintPluginSecurity.configs.recommended,
  eslintConfigPrettier,
  {
    ignores: [
      "**/node_modules/**",
      "**/dist/**",
      "packages/core/src/version.ts",
      "packages/docs/**",
      "packages/video/**",
      "packages/npm/**",
      "packages/native/**",
      "packages/e2e/**",
    ],
  },
  {
    plugins: {
      "vibe-security": vibeSecurityPlugin,
    },
    rules: {
      "@typescript-eslint/no-unused-vars": [
        "error",
        { argsIgnorePattern: "^_", varsIgnorePattern: "^_" },
      ],
      "@typescript-eslint/no-explicit-any": "warn",
      "no-eval": "error",
      "no-new-func": "error",
      "no-restricted-imports": [
        "error",
        {
          paths: [
            {
              name: "child_process",
              message: "Use the runtime abstraction layer instead.",
            },
            {
              name: "node:child_process",
              message: "Use the runtime abstraction layer instead.",
            },
          ],
        },
      ],
      "no-restricted-syntax": [
        "error",
        {
          selector: "CallExpression[callee.name='execSync']",
          message: "Use spawn() with array arguments instead.",
        },
        {
          selector: "CallExpression[callee.property.name='execSync']",
          message: "Use spawn() with array arguments instead.",
        },
        {
          selector: "Property[key.name='shell'][value.value=true]",
          message: "shell: true enables shell injection.",
        },
      ],
      "security/detect-eval-with-expression": "error",
      "security/detect-child-process": "off",
      "security/detect-non-literal-fs-filename": "off",
      "security/detect-non-literal-regexp": "warn",
      "security/detect-unsafe-regex": "error",
      "security/detect-buffer-noassert": "error",
      "security/detect-object-injection": "off",
      "security/detect-possible-timing-attacks": "warn",
      "vibe-security/no-unescaped-cd-output": "error",
    },
  },
  {
    files: ["packages/core/src/runtime/node/process.ts", "scripts/**/*.ts"],
    rules: {
      "no-restricted-imports": "off",
      "no-restricted-syntax": "off",
    },
  },
  {
    files: ["**/*.test.ts", "**/*.spec.ts"],
    rules: {
      "no-restricted-imports": "off",
      "no-restricted-syntax": "off",
    },
  },
);