import type { ValidationRule, ValidationContext } from '../interfaces'; import { ValidationSeverity } from '../interfaces'; /** * Configuration options for NoComputedDestructuringRule */ export interface NoComputedDestructuringOptions { /** * Custom error message */ message?: string; } /** * NoComputedDestructuringRule - Blocks computed property names in destructuring patterns * * **Security Rationale:** * Computed property names in destructuring can bypass static analysis by constructing * dangerous property names at runtime through string concatenation or other expressions. * * **Attack Vector Blocked:** * ```javascript * // Attacker constructs 'constructor' at runtime to bypass static analysis * const {['const'+'ructor']:Func} = callTool; * const evil = Func('return process')(); // Sandbox escape! * * // Or using variables * const prop = 'constructor'; * const {[prop]:Func} = someFunction; * ``` * * **Why This Is Dangerous:** * 1. Static analysis cannot determine the property name at compile time * 2. Attackers can split dangerous identifiers like 'constructor', 'prototype', '__proto__' * 3. This allows extraction of Function constructor from any function object * 4. Function constructor enables arbitrary code execution: `new Function('return process')()` * * **Valid Alternatives:** * ```javascript * // Use static property names instead * const { name, value } = obj; * const { data: result } = await callTool('getData', {}); * ``` * * @example * ```typescript * const rule = new NoComputedDestructuringRule(); * validator.addRule(rule); * ``` */ export declare class NoComputedDestructuringRule implements ValidationRule { readonly name = "no-computed-destructuring"; readonly description = "Blocks computed property names in destructuring patterns to prevent runtime property name attacks"; readonly defaultSeverity = ValidationSeverity.ERROR; readonly enabledByDefault = true; private readonly customMessage?; constructor(options?: NoComputedDestructuringOptions); validate(context: ValidationContext): void; /** * Generate a human-readable description of the computed key */ private describeKey; }