rules-bun

'bun patch' modifies a dependency directly in node_modules. Patches are fragile — they are silently lost on the next 'bun install' unless committed with 'bun patch --commit'.

Publishing to npm via bun is permanent (except within 72 hours). Verify the version, build output, and included files before publishing.

bunx without a pinned version always fetches the latest release. A compromised package version could execute malicious code in your project during the run.

Command injection risk: Bun.spawn() is used with 'shell: true' or 'sh -c'. This makes it highly vulnerable to command injection if user-controlled input is part of the command string. Always pass commands and arguments as an array to the 'cmd' property and avoid 'shell: true' to ensure arguments are properly escaped.

RISK: Disabling TLS certificate validation (rejectUnauthorized: false) exposes fetch/HTTPS traffic to man-in-the-middle attacks. FIX: Remove the option; if a self-signed cert is required, add its CA via the 'ca' option instead.

Style Guide Violation: Usage of 'var' keyword detected. Modern JavaScript and Google's JavaScript Style Guide recommend using 'const' or 'let' for variable declarations to improve scope management, prevent common hoisting-related bugs, and enhance code readability. Please refactor to use 'const' or 'let'.

Insecure dynamic code execution: Usage of 'eval()' or 'new Function()' is detected. These functions are dangerous when used with untrusted input as they can execute arbitrary code, leading to severe security vulnerabilities like RCE. Refactor to avoid dynamic code execution from external sources.

RISK: Math.random() is not cryptographically secure — the sequence is predictable, so generated tokens/secrets/salts can be guessed. FIX: Use crypto.randomUUID(), crypto.randomBytes(n), or crypto.getRandomValues().

Deprecated Buffer constructor: 'new Buffer()' is deprecated in Node.js and should be avoided in Bun for compatibility and security reasons (e.g., uninitialized memory in older Node.js versions). Use 'Buffer.from()', 'Buffer.alloc()', or 'Buffer.allocUnsafe()' for explicit and safer memory allocation.

RISK: Entries in trustedDependencies re-enable arbitrary postinstall script execution that Bun disables by default, widening the supply-chain attack surface. FIX: Remove entries you do not need; for each remaining one, audit its install scripts and pin an exact version.

RISK: Bun.password bcrypt cost < 12 is below the 2024 OWASP password-storage recommendation and bcrypt silently truncates inputs > 72 bytes. FIX: Raise cost to 12+ or switch to the default argon2id algorithm.

Potential path traversal vulnerability: Bun.write() path argument uses string concatenation. This is risky if user input is involved. Always use 'path.join()' or 'path.resolve()' with a base directory for safe path construction to prevent directory traversal attacks.

RISK: Bun.serve defaults maxRequestBodySize to 128 MB, letting a single request exhaust memory (DoS). FIX: Set an explicit maxRequestBodySize appropriate to the endpoint (e.g. 1_000_000 for JSON APIs).

RISK: Bun.$.raw() bypasses the tagged-template auto-escaping, re-introducing shell injection when any untrusted value reaches it. FIX: Remove .raw() and interpolate values directly with Bun.$`cmd ${value}` so Bun escapes them.

RISK: Bun.sql.unsafe() / postgres.unsafe() executes a raw SQL string with no parameterization, enabling SQL injection (see CVE-2024-52531 class). FIX: Use the tagged template sql`SELECT ... WHERE id=${id}` so values are bound as parameters.

RISK: bun:sqlite db.query/run/exec/prepare with a template literal does NOT parameterize ${...} — the value is concatenated into SQL and is injectable. FIX: Use placeholders — db.query('SELECT ... WHERE id=?').all(id) or named params {$id: id}.

RISK: SubtleCrypto.importKey with extractable: true lets the key material be exported from the runtime, defeating the point of using WebCrypto. FIX: Pass extractable: false unless you genuinely need exportKey later.

Synchronous file read detected: Using '.textSync()' or '.arrayBufferSync()' can block the event loop, leading to performance issues and potential Denial-of-Service (DoS) if reading large or untrusted files. Prefer asynchronous methods like '.text()' or '.arrayBuffer()' with 'await' for non-blocking I/O.

RISK: MD5 and SHA-1 are cryptographically broken (collision attacks) and must not be used for signatures, integrity, or identifiers of security value. FIX: Use 'sha256' or 'sha512' via Bun.CryptoHasher or node:crypto.createHash.

RISK: Bun.serve WebSocket upgrade() without an Origin check is vulnerable to Cross-Site WebSocket Hijacking — a malicious page can open an authenticated socket to your server. FIX: Validate req.headers.get('origin') against an allowlist before calling server.upgrade(req).