rules-javascript

String interpolation/concatenation in exec() creates a command injection vulnerability. Use execFile() with an arguments array, or spawn() with shell: false.

console.log() in source code — use a structured logging library (pino, winston) that can be controlled in production.

CORS wildcard origin combined with credentials: true is rejected by browsers and indicates a broken auth model. Reflect a validated allowlisted origin instead.

dangerouslySetInnerHTML bypasses React's XSS protection. Render as text, or sanitize with DOMPurify.sanitize() before injecting HTML.

Empty catch blocks silently swallow errors, hiding bugs in production. Log the error or re-throw it: catch (err) { console.error(err); throw err; }

eval() executes arbitrary strings as code — a critical injection vector. Refactor to use a JSON.parse(), a lookup table, or a proper parser.

Hardcoded credential detected. Store secrets in environment variables and access via process.env.SECRET_NAME — never embed them in source code.

innerHTML and document.write() with unsanitized input enable XSS attacks. Use textContent for plain text, or sanitize with DOMPurify before setting innerHTML.

JWT 'none' algorithm lets attackers forge unsigned tokens (classic jsonwebtoken bypass). Use RS256/ES256/HS256 and pass { algorithms: ['RS256'] } to verify().

Loose equality (==, !=) performs type coercion with surprising results (e.g., '' == 0). Use strict equality (===, !==) instead.

Math.random() is not cryptographically secure. Use crypto.randomBytes() or crypto.getRandomValues() for security-sensitive random values like tokens, keys, and passwords.

new Function() constructs and executes arbitrary code at runtime — equivalent to eval(). Use a safer dispatch pattern instead.

Setting or trusting the 'x-middleware-subrequest' header enables the Next.js middleware auth bypass (CVE-2025-29927). Upgrade Next.js to 15.2.3/14.2.25 and never forward this header from clients.

vm2 is deprecated and has unpatched sandbox-escape CVEs (CVE-2023-37466, 2023-37903); node:vm is explicitly not a security sandbox. Use isolated-vm or a separate process/container for untrusted code.

File system operations with user-controlled paths enable path traversal attacks (e.g., ../../etc/passwd). Sanitize paths with path.resolve() and validate they stay within the intended directory.

polyfill.io was compromised in June 2024 and served malware to 100k+ sites (Sansec/Cloudflare advisory). Remove the script or switch to cdnjs.cloudflare.com/polyfill or self-host.

postMessage with targetOrigin '*' leaks data to any origin and enables cross-origin attacks. Pass the explicit target origin string.

__proto__ mutation enables prototype pollution attacks that can compromise all objects in the runtime. Use Object.create(null) for safe dictionaries or validate keys before assignment.

require() with user-supplied input enables path traversal and arbitrary module loading. Validate and whitelist module names before dynamic require.

Passing a string to setTimeout()/setInterval() invokes eval() internally — the string is parsed and executed as code. Pass a function reference instead: setTimeout(() => doThing(), delay).

Template literals or string concatenation in SQL queries allow SQL injection. Use parameterized queries: db.query('SELECT * FROM t WHERE id = ?', [id])

Disabling TLS certificate verification allows trivial MITM attacks. Trust the system CA store, or load the internal CA via tls.createSecureContext({ ca }) instead of disabling verification.

var has function scope and hoisting behavior that causes subtle bugs. Use const for values that don't change, or let for values that do.