rules-typescript

Direct HTML injection detected. Verify the value is sanitized — never pass user-supplied data to innerHTML or dangerouslySetInnerHTML.

Type suppression is banned. Fix the underlying type error instead of suppressing it with @ts-ignore or @ts-nocheck.

Do not type catch variables as 'any'. Use 'unknown' and narrow the type: if (err instanceof Error) { ... }

JSON.parse throws on invalid input. Wrap in try/catch when parsing untrusted data (request bodies, env vars, file contents) or validate with a schema library (zod, valibot) after parsing.

Do not use 'any'. Define a concrete type, interface, or generic. 'any' defeats TypeScript's type system entirely.

axios 1.14.1 and 0.30.4 are malicious supply-chain releases published 2026-03-31 via a compromised maintainer account (Snyk/Microsoft advisory). Both versions install a cross-platform Remote Access Trojan. Upgrade to axios >=1.8.4, re-run 'npm ci', and rotate any credentials that may have been exposed in affected environments.

Bun.file() or Bun.write() called with a request-derived path enables path traversal (CWE-22 / OWASP A01:2021). An attacker can supply '../../../etc/passwd' or an absolute path outside the intended root. Resolve the final path with path.resolve(), then assert it starts with the expected base directory before opening or writing any file.

Bun.$`...` (Bun shell tagged template) with an interpolated expression passes user-controlled text through a POSIX shell, enabling command injection (CWE-78). An attacker can terminate the intended command and append arbitrary ones via ; or $(...). Use Bun.spawn(['cmd', arg]) with a validated argv array, or escape with Bun.$.escape(value) before interpolation. Never interpolate req.* or external data directly into Bun.$.

Bun.spawn() called with a template-literal array element containing an interpolated expression. Even without shell:true, interpolating untrusted data into an argv slot allows argument injection — an attacker can inject flags (e.g. '--exec', '--upload-pack') that change the command's behaviour (CWE-88). Build argv from validated, allowlisted values; never interpolate user input into a spawn array.

db.exec() called with a concatenated string enables SQL injection (CWE-89). Unlike db.query()/db.prepare(), exec() runs the full SQL string verbatim — there is no placeholder binding path. Build DDL/schema strings from a fixed constant, never by concatenating user-controlled values. For data writes, use db.prepare() with ? placeholders.

child_process.exec/execSync invokes a shell — string concatenation or template interpolation opens command injection. Use execFile/spawn with an argv array and { shell: false } (the default).

console.log() in source code detected. Use a structured logger instead so output can be controlled in production.

Logging a secret-named variable (token/secret/password/apiKey/privateKey) via console.log leaks credentials into stdout, log files, and any downstream log aggregator (CWE-312 / CWE-532). Replace with a structured logger that redacts sensitive fields, or use a masked preview: maskToken(value) (trims to first 8 chars + '...'). Never log raw secrets — even in debug paths that ship to production.

Deep relative import (3+ levels) detected. Consider using path aliases (e.g., @/src/...) configured in tsconfig.json for cleaner imports.

Dynamic require() or import() with request-controlled input enables module injection (CWE-706). An attacker can load arbitrary Node built-ins or local files, bypassing access controls. Use a static allowlist of module names: const ALLOWED = { csv: () => import('./csv') }; never pass user input directly to require/import.

Empty catch block silently swallows errors. At minimum, log the error or rethrow it.

eval() and new Function() are banned. They enable code injection attacks and defeat static analysis.

res.redirect() or res.location() with user-controlled input enables open redirect (CVE-2024-29041). Attackers can bypass allow lists using malformed URLs. Validate the URL with 'new URL()' and check the origin against a whitelist of permitted hosts.

Passing an 'as any' cast to a bun:ffi length/byteLength argument bypasses TypeScript's numeric-type check. A wrong value can cause the native library to read or write beyond the allocated buffer, resulting in memory corruption (CWE-843 type confusion, CWE-119 buffer overflow). Use a concrete number expression — never cast to any at a memory-size boundary.

Passing an 'as any' value to bun:ffi ptr() suppresses TypeScript's check that the argument is a TypedArray (Uint8Array/Int32Array/etc.). A wrong type causes a silent dangling-pointer read or write, leading to memory corruption or a segfault in the Zig/C native library. Declare the buffer with the concrete TypedArray type and pass it directly: const buf = new Uint8Array(size); ptr(buf).

MD5 and SHA1 are cryptographically broken. Use SHA-256 or better (e.g., SHA-3).

Disabling TLS certificate verification defeats HTTPS. Never set rejectUnauthorized: false or NODE_TLS_REJECT_UNAUTHORIZED=0 in production code — configure a trust store instead.

Accepting the JWT 'none' algorithm lets any attacker forge tokens by stripping the signature (CVE-2015-9235 class; still reappears in wrappers). Pin algorithms to a concrete list like ['RS256'] or ['HS256'] when calling jsonwebtoken.verify / jose.jwtVerify.

The Buffer() constructor is deprecated since Node 10 and can disclose uninitialized memory or trigger DoS when called with a number. Use Buffer.alloc(n) for zero-filled buffers, Buffer.from(data) for copies, and Buffer.allocUnsafe(n) only when you immediately overwrite.

The Node vm module does not provide a security sandbox — vm.runInNewContext can escape via Object.constructor. Use a real isolate (isolated-vm, worker_threads with MessageChannel, or a subprocess) to run untrusted code.

Non-null assertion (!) detected. Handle the null/undefined case explicitly rather than asserting it away — crashes at runtime if the value is actually null.

Joining request-supplied values into file paths enables path traversal (OWASP A01:2021). An attacker can supply '../../../etc/passwd' to escape the intended root. Always resolve the final path and assert it starts with the expected base directory before opening any file.

Mutating Object.prototype or assigning to __proto__ enables prototype pollution, a common gadget for RCE in Node.js. Use Object.create(null) for dictionaries and never merge untrusted input with a recursive assign.

sourceMap: true exposes your TypeScript source code via .map files served alongside production bundles. Source maps allowed the Claude Code source code leak (March 31, 2026) — private TypeScript was fully reconstructable by anyone inspecting network traffic. Set sourceMap: false or omit the field entirely. For local debugging only, restrict source maps to dev-only tsconfig overrides never deployed to production.

spawn/spawnSync/Bun.spawn called with { shell: true } invokes a POSIX shell to execute the command string — any interpolated or user-supplied argument becomes a shell-injection vector (CWE-78). Remove shell:true and pass an explicit argv array: Bun.spawn(['git', '--version']) never involves a shell by default. If you need a pipeline, build the argv manually or use Bun.$ with escaped values.

Do not use template literals in SQL queries. Use parameterized statements with ? placeholders to prevent SQL injection.

SQL query built with string concatenation enables SQL injection (CWE-89 / OWASP A03:2021). An attacker who controls any concatenated value can exfiltrate or corrupt the database. Use parameterized placeholders: db.query('SELECT * FROM rules WHERE id = ?').get(id) — bun:sqlite passes bound values as separate arguments, never inside the SQL string.

Prefer 'const' or 'let' over 'var'. Block-scoped declarations prevent hoisting bugs and clarify intent.

Wildcard imports ('import * as X') import the entire module and prevent tree-shaking. Use named imports instead.

Consider 'const' if this variable is never reassigned. Immutable bindings make code easier to reason about.

Comparing secrets with === leaks timing information (byte-by-byte early exit). Use crypto.timingSafeEqual() for tokens, HMACs, signatures, and API keys.

lodash _.merge() and _.defaultsDeep() are vulnerable to prototype pollution when passed untrusted input containing a '__proto__' key (CVE-2019-10744, CVE-2020-8203). Upgrade to lodash >=4.17.21 and sanitize untrusted objects before merging — prefer structuredClone() or Object.assign({}) with validated, allowlisted keys.

Math.random() is cryptographically insecure. If this is for security tokens, passwords, or IDs, use crypto.getRandomValues() or crypto.randomBytes().

multer() called with no size limits. This risks memory exhaustion and DoS attacks (CVE-2025-47935, CVE-2025-47944). Upgrade to multer 2.0.0+ and always configure limits: multer({ limits: { fileSize: 5*1024*1024, files: 10 } })

window.postMessage(..., '*') broadcasts the payload to any cross-origin listener, leaking tokens, user data, or auth state. Pass the concrete target origin (e.g., 'https://app.example.com') and verify event.origin on the receiver.

Nested quantifiers (e.g. (.*)+ or (a+)*) can cause catastrophic backtracking (ReDoS) on adversarial input. Refactor to a linear pattern, add a length cap, or use a linear-time engine (re2).

Passing request-derived URLs directly to fetch() or axios enables SSRF (OWASP A10:2021). Attackers can reach internal services or cloud metadata endpoints (e.g. 169.254.169.254). Validate the URL against a strict allowlist of permitted hosts before making any outbound request.