# oxlint-plugin-security-rules

An [oxlint](https://oxc.rs/docs/guide/usage/linter) plugin that ports security rules from [eslint-plugin-security](https://github.com/eslint-community/eslint-plugin-security).

## Installation

```sh
npm install --save-dev oxlint-plugin-security-rules
```

## Usage

Add to your `.oxlintrc.json`:

```json
{
  "jsPlugins": [
    { "name": "security", "specifier": "oxlint-plugin-security-rules" }
  ],
  "rules": {
    "security/detect-eval-with-expression": "error",
    "security/detect-non-literal-require": "warn",
    "security/detect-non-literal-fs-filename": "warn",
    "security/detect-unsafe-regex": "error",
    "security/detect-child-process": "warn",
    "security/detect-new-buffer": "warn",
    "security/detect-buffer-noassert": "warn",
    "security/detect-non-literal-regexp": "warn",
    "security/detect-bidi-characters": "error",
    "security/detect-disable-mustache-escape": "warn",
    "security/detect-no-csrf-before-method-override": "warn",
    "security/detect-pseudoRandomBytes": "warn"
  }
}
```

## Rules

| Rule | Description |
|---|---|
| `detect-bidi-characters` | Detects trojan source attacks using unicode bidirectional characters |
| `detect-buffer-noassert` | Flags `buffer.readXXX()` calls with the `noAssert` flag |
| `detect-child-process` | Flags `child_process` method calls with non-literal arguments |
| `detect-disable-mustache-escape` | Flags `obj.escapeMarkup = false` |
| `detect-eval-with-expression` | Flags `eval()` with non-literal argument |
| `detect-new-buffer` | Flags `new Buffer()` with non-literal argument |
| `detect-no-csrf-before-method-override` | Flags `methodOverride()` registered before `csrf()` in Express. Note: flags `methodOverride()` in any file where `csrf()` has not been registered before it |
| `detect-non-literal-fs-filename` | Flags `fs` method calls with variable path arguments |
| `detect-non-literal-regexp` | Flags `new RegExp()` with non-literal argument |
| `detect-non-literal-require` | Flags `require()` with non-literal argument |
| `detect-pseudoRandomBytes` | Flags use of `.pseudoRandomBytes` |
| `detect-unsafe-regex` | Flags regex patterns that may cause catastrophic backtracking |

## License

MIT