no-unsafe-alloc.js 1.7 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546
  1. // Copyright (c) Microsoft Corporation.
  2. // Licensed under the MIT License.
  3. "use strict";
  4. //------------------------------------------------------------------------------
  5. // Rule Definition
  6. //------------------------------------------------------------------------------
  7. module.exports = {
  8. meta: {
  9. type: "suggestion",
  10. fixable: "code",
  11. schema: [],
  12. docs: {
  13. description: "When calling [`Buffer.allocUnsafe`](https://nodejs.org/api/buffer.html#buffer_static_method_buffer_allocunsafe_size) and [`Buffer.allocUnsafeSlow`](https://nodejs.org/api/buffer.html#buffer_static_method_buffer_allocunsafeslow_size), the allocated memory is not wiped-out and can contain old, potentially sensitive data.",
  14. url: "https://github.com/microsoft/eslint-plugin-sdl/blob/master/docs/rules/no-unsafe-alloc.md"
  15. },
  16. messages: {
  17. default: 'Do not allocate uninitialized buffers in Node.js'
  18. }
  19. },
  20. create: function (context) {
  21. return {
  22. "MemberExpression[object.name='Buffer'][property.name=/allocUnsafe|allocUnsafeSlow/]"(node) {
  23. // Known false positives
  24. if (
  25. node.parent != undefined &&
  26. node.parent.arguments != undefined &&
  27. node.parent.arguments.length != undefined &&
  28. // Buffer.allocUnsafe(0);
  29. node.parent.type === 'CallExpression' &&
  30. node.parent.arguments.length == 1 &&
  31. node.parent.arguments[0] != undefined &&
  32. node.parent.arguments[0].type === 'Literal' &&
  33. node.parent.arguments[0].value == '0'
  34. ) {
  35. return;
  36. }
  37. context.report({
  38. node: node,
  39. messageId: "default"
  40. });
  41. }
  42. };
  43. }
  44. };