/** * Copyright (c) 2025 Ofri Peretz * Licensed under the MIT License. Use of this source code is governed by the * MIT license that can be found in the LICENSE file. */ /** * ESLint Rule: no-timing-unsafe-compare * Detects === comparison of secrets, suggest crypto.timingSafeEqual() * CWE-208: Observable Timing Discrepancy * * @see https://cwe.mitre.org/data/definitions/208.html */ import type { TSESLint } from '@interlace/eslint-devkit'; type MessageIds = 'timingUnsafeCompare' | 'useTimingSafeEqual'; export interface Options { /** Variable name patterns that indicate secrets. Default: ['token', 'secret', 'key', 'password', 'hash', 'signature', 'mac', 'hmac', 'digest', 'apiKey', 'api_key'] */ secretPatterns?: string[]; } type RuleOptions = [Options?]; export declare const noTimingUnsafeCompare: TSESLint.RuleModule & { name: string; }; export type { Options as NoTimingUnsafeCompareOptions };