golem15/msd-core
4
0
Fork 0
Code Issues 1 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

chore(#3212): bounded quantifiers over document content — prohibition with teeth — Phase 4 (#3441)

Browse Source 
* feat(#3415): ship local/no-unbounded-quantifier, burn down ReDoS class

Phase 4 of epic #3212 (ADR-3212 §5/§7, the final phase). New rule flags
an unbounded */+/{n,} quantifier over a broad character class
([\s\S], dotAll ., or a 1-2-unit negated class like [^\n]/[^)\n] — the
exact #2128-fixed shape) applied to a regex whose match target is
data-flow-traced to readFileSync content.

eslint-rules/lib/readfilesync-trace.cjs extracts the data-flow tracer
shared with no-crlf-fragile-split (Phase 2) rather than a second copy
— no-crlf-fragile-split refactored onto it with zero behavior change,
parity-tested.

Real triage, not 798 mechanical edits: the ADR's census (2026-08-08)
screened every unbounded quantifier in the tree unscoped. Correctly
scoped to readFileSync-derived content (matching Phase 2's own G2/G3
scoping), the rule found 162 real hits across two detection waves — the
second wave (93) surfaced only after a genuine off-by-one bug in this
rule's own first draft was caught while writing its RuleTester tests
and fixed (the bug silently missed every directly-quantified [\s\S]*
with no gap before the quantifier — exactly the class this rule exists
to catch). 3 hits landed in production src/ (commands.cts, milestone.cts,
roadmap.cts) and were each empirically timed against adversarial input
(matching #2128's own measured-not-assumed precedent) — all confirmed
linear-time/benign, left unbounded with a measured-evidence comment
rather than mechanically bounded. The remaining 159 are test-file
fixture parsing (test-author-controlled, fixed-size content, not
adversarial input) — each suppressed with a specific, non-generic
reason. Zero functional behavior changed anywhere in this diff.

tests/no-pending-3212-markers.test.cjs locks the epic's own closing
invariant (ADR §7: "assert zero pending #3212 markers remain") — ground
truth confirmed trivially true today (no phase left any such marker
behind), now regression-locked going forward.

Design: .gsd/phase/chore-3415-prohibition-with-teeth/40-design.md
Test matrix: .gsd/phase/chore-3415-prohibition-with-teeth/50-test-matrix.md

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(#3415): correct rule category mislabel, add CI test-scope entry

An orthogonal Standards-axis review found eslint-rules/no-unbounded-quantifier.cjs
mistakenly carried meta.docs.category: 'Portability', copied from a sibling
rule without realizing what that implied: docs/contributing/cross-platform-
portability-rules.md governs an ADR-1703 rule family under a hard "zero
escape hatches" contract (tests/portability-rule-disable-ban.test.cjs's
PROTECTED_RULES bans eslint-disable for those rules entirely). This rule is
not part of that family — it's ADR-3212 (ReDoS/CWE-1333), a different epic —
and its eslint-disable-next-line suppressions (159 of them, added earlier
this same phase after empirical benign-verification) are an intentional,
correct design, not a bypass. Corrected to category: 'Best Practices',
matching the actual precedent (no-adhoc-regex-escape.cjs, Phase 1 of the
same epic, which is also correctly outside PROTECTED_RULES), and the rule's
own docstring now states this explicitly so a future reader doesn't have to
re-derive it.

Also registers a new scripts/ci-test-scope.cjs bucket so editing this rule
or the shared eslint-rules/lib/readfilesync-trace.cjs helper re-runs their
own test suites under targeted CI selection — was previously unregistered
and invisible to that fast-path (this PR's own gsd-test checkpoint runs the
full suite regardless, so this only affects future narrowly-scoped PRs).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(#3415): bound no-unbounded-quantifier's own scanner (CWE-1333, ironic)

Security review found the rule meant to catch algorithmic-complexity bugs
had one of its own: hasUnboundedBroadQuantifier's negated-class inner
scan walked from each `[^` occurrence to the next `]` (or EOF) with no
bound, while the outer loop only ever advanced by one character — O(n²)
total work on a pattern with many unclosed `[^` runs. Runs unconditionally
inside checkPattern on any `new RegExp('literal string')` argument in any
linted file, before the (cheap) readFileSync data-flow gate — so a single
crafted string literal, no valid regex syntax required, could make
`npm run lint` / CI hang.

Empirically confirmed both the bug and the fix: pre-fix, n=4000/8000/
16000/32000 chars took 30.8/115.6/463.8/1874.3ms (~4x work per 2x n,
quadratic); extrapolated, the 300000-char repro from the finding would
run ~165s. Post-fix (bail the inner scan once units exceeds the rule's
own 1-2-unit scope, rather than continuing to hunt for a closing `]`),
the same 300000-char input runs in 8.7ms via the real rule module,
independently reconfirmed at 18ms via a fresh Linter.verify() call.

New regression row in tests/no-unbounded-quantifier.rule.test.cjs
asserts the RuleTester run on a 50000-char adversarial pattern
completes and returns a defined result — no wall-clock assertion
(CLAUDE.md Clock Seams / local/no-elapsed-assertion).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(#3415): triage 3 new sites, re-raise ceiling after upstream batch

next merged 12 more PRs during this PR's review. Two consequences:

- tests/edit-phase.test.cjs (fix #3262, unrelated) added 3 new
  content.match(/<tag>([\s\S]*?)<\/tag>/) reads of this repo's own
  workflow .md content — the same Class A pattern as the ~159 sites
  already triaged elsewhere in this PR. Suppressed with the same
  established reason.
- lint-allow-test-rule-refs' ratchet ceiling needed re-raising again
  (301 -> 303) for the same reason as the two prior bumps: organic
  growth from unrelated, already-reviewed PRs landing concurrently,
  not a defect in this branch's own diff.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Co-authored-by: sim <sim@local>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Tom Boucher
2026-08-14 10:02:28 -04:00
committed by GitHub
parent 9dd240f634
commit 69e7afd0c7
86 changed files with 987 additions and 141 deletions
Download Patch File Download Diff File Expand all files Collapse all files

172
eslint-rules/lib/readfilesync-trace.cjs Normal file
View File

@@ -0,0 +1,172 @@
'use strict';
/**
* readfilesync-trace.cjs
*
* Shared data-flow tracing for "is this AST node derived from a readFileSync
* call" and "is this RegExpLiteral applied to a readFileSync-derived
* receiver" — extracted from `no-crlf-fragile-split.cjs` (ADR-1703 Phase 4)
* so `no-unbounded-quantifier.cjs` (ADR-3212 §5/§7, epic #3212 Phase 4,
* #3415) does not carry a second, divergence-prone copy of the same ~80-line
* scope walk. Both rules import this module; a parity test
* (tests/readfilesync-trace-parity.test.cjs) asserts they classify a shared
* fixture set identically.
*
* Byte-identical logic to the pre-extraction copy in `no-crlf-fragile-split.cjs`
* — this is a pure relocation, not a rewrite (ADR-3212 §6, extend-never-mutate).
*/
/**
* Returns true if the node is a call to `readFileSync` or `fs.readFileSync`.
* @param {import('eslint').Rule.Node} node
* @returns {boolean}
*/
function isReadFileSyncCall(node) {
if (!node || node.type !== 'CallExpression') return false;
const callee = node.callee;
if (callee.type === 'Identifier' && callee.name === 'readFileSync') return true;
if (
callee.type === 'MemberExpression' &&
!callee.computed &&
callee.property.type === 'Identifier' &&
callee.property.name === 'readFileSync'
) {
return true;
}
return false;
}
/**
* Given an Identifier node, walk the scope chain to find its binding, then
* check if the initializer is derived from readFileSync.
* @param {import('eslint').Rule.Node} identNode
* @param {import('eslint').SourceCode} sourceCode
* @returns {boolean}
*/
function resolveIdentifierToReadFileSync(identNode, sourceCode) {
if (typeof sourceCode.getScope !== 'function') return false;
let scope;
try {
scope = sourceCode.getScope(identNode);
} catch (_) {
// If scope resolution fails (e.g. due to unsupported node type or parser
// version mismatch), conservatively return false (not flagged) — an
// unresolvable scope produces a false negative rather than a spurious error.
return false;
}
if (!scope) return false;
let s = scope;
while (s) {
const variable = s.variables.find((v) => v.name === identNode.name);
if (variable) {
const defs = variable.defs;
if (!defs || defs.length === 0) return false;
const decl = defs[0].node; // VariableDeclarator
if (!decl || !decl.init) return false;
return isReadFileSyncDerived(decl.init, sourceCode);
}
s = s.upper;
}
return false;
}
/**
* Returns true if `node` is (transitively) derived from a readFileSync call.
*
* Handles:
* - Direct: readFileSync(...) -- the node itself IS the readFileSync call
* - Chain: readFileSync(...).toString() etc.
* - Identifier resolved via scope to a variable initialized from readFileSync
*
* @param {import('eslint').Rule.Node} node
* @param {import('eslint').SourceCode} sourceCode
* @returns {boolean}
*/
function isReadFileSyncDerived(node, sourceCode) {
if (!node) return false;
if (isReadFileSyncCall(node)) return true;
if (node.type === 'MemberExpression') {
return isReadFileSyncDerived(node.object, sourceCode);
}
if (node.type === 'CallExpression') {
if (isReadFileSyncCall(node)) return true;
if (node.callee.type === 'MemberExpression') {
return isReadFileSyncDerived(node.callee.object, sourceCode);
}
}
if (node.type === 'Identifier') {
return resolveIdentifierToReadFileSync(node, sourceCode);
}
return false;
}
/**
* Returns true if a pattern-bearing node (RegExpLiteral, or the callee-object
* position for `/regex/.test(str)`) is used on a readFileSync-derived
* receiver via .match/.test/.exec/.replace/.replaceAll/.split/.matchAll.
*
* Two AST shapes:
* Shape A: str.match(/regex/) — regex is an ARG to the call.
* regex.parent = CallExpression (arg), callee.object = str
* Shape B: /regex/.test(str) — regex is the callee object.
* regex.parent = MemberExpression (the .test callee)
* regex.parent.parent = CallExpression, first arg = str
*
* @param {import('eslint').Rule.Node} regexNode — the RegExpLiteral (or `new RegExp(...)` CallExpression)
* @param {import('eslint').SourceCode} sourceCode
* @returns {boolean}
*/
function isPatternUsedOnFileContent(regexNode, sourceCode) {
const FILE_METHODS = new Set(['match', 'test', 'exec', 'replace', 'replaceAll', 'split', 'matchAll']);
const parent = regexNode.parent;
if (!parent) return false;
// Shape A: str.match(regex) — regex is an argument; parent is CallExpression
if (parent.type === 'CallExpression') {
const callee = parent.callee;
if (
callee &&
callee.type === 'MemberExpression' &&
!callee.computed &&
callee.property.type === 'Identifier' &&
FILE_METHODS.has(callee.property.name)
) {
if (parent.arguments.includes(regexNode)) {
return isReadFileSyncDerived(callee.object, sourceCode);
}
}
return false;
}
// Shape B: /regex/.test(str) — regex is the callee object.
if (parent.type === 'MemberExpression' && !parent.computed) {
if (
parent.object === regexNode &&
parent.property.type === 'Identifier' &&
FILE_METHODS.has(parent.property.name)
) {
const callExpr = parent.parent;
if (callExpr && callExpr.type === 'CallExpression' && callExpr.callee === parent) {
const args = callExpr.arguments;
if (args && args.length > 0) {
return isReadFileSyncDerived(args[0], sourceCode);
}
}
}
}
return false;
}
module.exports = {
isReadFileSyncCall,
isReadFileSyncDerived,
isPatternUsedOnFileContent,
};

143
eslint-rules/no-crlf-fragile-split.cjs
View File

@@ -39,6 +39,7 @@
*/
const { isWindowsExcludedNode } = require('./lib/platform-guard.cjs');
const { isReadFileSyncDerived, isPatternUsedOnFileContent } = require('./lib/readfilesync-trace.cjs');
/** @type {import('eslint').Rule.RuleModule} */
const rule = {
@@ -79,103 +80,6 @@ const rule = {
return null;
}
/**
* Returns true if the node is a call to `readFileSync` or `fs.readFileSync`.
* @param {import('eslint').Rule.Node} node
* @returns {boolean}
*/
function isReadFileSyncCall(node) {
if (!node || node.type !== 'CallExpression') return false;
const callee = node.callee;
// readFileSync(...)
if (callee.type === 'Identifier' && callee.name === 'readFileSync') return true;
// fs.readFileSync(...)
if (
callee.type === 'MemberExpression' &&
!callee.computed &&
callee.property.type === 'Identifier' &&
callee.property.name === 'readFileSync'
) {
return true;
}
return false;
}
/**
* Returns true if `node` is (transitively) derived from a readFileSync call.
*
* Handles:
* - Direct: readFileSync(...) -- the node itself IS the readFileSync call
* - Chain: readFileSync(...).toString() etc.
* - Identifier resolved via scope to a variable initialized from readFileSync
*
* @param {import('eslint').Rule.Node} node
* @returns {boolean}
*/
function isReadFileSyncDerived(node) {
if (!node) return false;
// Direct readFileSync call
if (isReadFileSyncCall(node)) return true;
// MemberExpression: x.something — check the object
if (node.type === 'MemberExpression') {
return isReadFileSyncDerived(node.object);
}
// CallExpression: x.something() — check object of the callee
if (node.type === 'CallExpression') {
if (isReadFileSyncCall(node)) return true;
if (node.callee.type === 'MemberExpression') {
return isReadFileSyncDerived(node.callee.object);
}
}
// Identifier: resolve to its variable initializer via scope
if (node.type === 'Identifier') {
return resolveIdentifierToReadFileSync(node);
}
return false;
}
/**
* Given an Identifier node, walk the scope chain to find its binding,
* then check if the initializer is derived from readFileSync.
* @param {import('eslint').Rule.Node} identNode
* @returns {boolean}
*/
function resolveIdentifierToReadFileSync(identNode) {
if (typeof sourceCode.getScope !== 'function') return false;
let scope;
try {
scope = sourceCode.getScope(identNode);
} catch (_) {
// If scope resolution fails (e.g. due to unsupported node type or
// parser version mismatch), conservatively return false (not flagged).
// This is an intentional boundary: an unresolvable scope produces a
// false negative rather than a spurious error.
return false;
}
if (!scope) return false;
let s = scope;
while (s) {
const variable = s.variables.find(v => v.name === identNode.name);
if (variable) {
const defs = variable.defs;
if (!defs || defs.length === 0) return false;
const decl = defs[0].node; // VariableDeclarator
if (!decl || !decl.init) return false;
// Check the init is readFileSync-derived
return isReadFileSyncDerived(decl.init);
}
s = s.upper;
}
return false;
}
/**
* Returns true if a RegExpLiteral has at least one FRAGILE bare \n — a \n
* that is not adequately protected against CRLF.
@@ -283,48 +187,7 @@ const rule = {
* @returns {boolean}
*/
function isRegexUsedOnFileContent(regexNode) {
const FILE_METHODS = new Set(['match', 'test', 'exec', 'replace', 'replaceAll', 'split', 'matchAll']);
const parent = regexNode.parent;
if (!parent) return false;
// Shape A: str.match(regex) — regex is an argument; parent is CallExpression
if (parent.type === 'CallExpression') {
const callee = parent.callee;
if (
callee &&
callee.type === 'MemberExpression' &&
!callee.computed &&
callee.property.type === 'Identifier' &&
FILE_METHODS.has(callee.property.name)
) {
// regex must actually be one of the arguments (not the callee)
if (parent.arguments.includes(regexNode)) {
return isReadFileSyncDerived(callee.object);
}
}
return false;
}
// Shape B: /regex/.test(str) — regex is the callee object.
// In this case, regexNode.parent is the MemberExpression (/regex/.test)
if (parent.type === 'MemberExpression' && !parent.computed) {
if (
parent.object === regexNode &&
parent.property.type === 'Identifier' &&
FILE_METHODS.has(parent.property.name)
) {
// parent.parent should be the CallExpression
const callExpr = parent.parent;
if (callExpr && callExpr.type === 'CallExpression' && callExpr.callee === parent) {
const args = callExpr.arguments;
if (args && args.length > 0) {
return isReadFileSyncDerived(args[0]);
}
}
}
}
return false;
return isPatternUsedOnFileContent(regexNode, sourceCode);
}
/**
@@ -372,7 +235,7 @@ const rule = {
const argVal = stringValue(args[0]);
if (argVal === '\n') {
// Is the receiver derived from readFileSync?
if (isReadFileSyncDerived(callee.object)) {
if (isReadFileSyncDerived(callee.object, sourceCode)) {
g1Violations.push(node);
}
}

153
eslint-rules/no-unbounded-quantifier.cjs Normal file
View File

@@ -0,0 +1,153 @@
'use strict';
/**
* no-unbounded-quantifier
*
* Flags a lazy any-scan or an unbounded quantifier over a broad character
* class in a regex applied to caller-supplied document content — the ReDoS/
* catastrophic-backtracking shape #2128 fixed (eight commits total; CodeQL
* has flagged the class, #663). ADR-3212 §5/§7 (epic #3212 Phase 4, #3415).
*
* This rule is NOT part of the ADR-1703 portability-rule family (see
* `docs/contributing/cross-platform-portability-rules.md`) and is not listed
* in `tests/portability-rule-disable-ban.test.cjs`'s `PROTECTED_RULES` — its
* `eslint-disable-next-line` suppressions, added after empirical
* benign-verification of a specific site, are an intentional and permitted
* part of this rule's design, unlike the ADR-1703 rules' zero-escape-hatch ban.
*
* ## What this enforces
*
* A RegExpLiteral (or `new RegExp('literal string')`, no interpolation —
* interpolated-value construction is `no-adhoc-regex-escape`'s territory)
* whose pattern contains an UNBOUNDED quantifier (`*`, `+`, `*?`, `+?`, or an
* open-ended `{n,}`) applied to:
* - `[\s\S]` / `[\S\s]` (the standard any-char-including-newline idiom)
* - `.` when the pattern carries the `s` (dotAll) flag
* - a broad negated class `[^...]` whose excluded set is short (1-2 units,
* an escape sequence counting as one unit) — e.g. `[^)]`, `[^\n]`,
* `[^)\n]` — matches nearly the same "everything" shape as `[\s\S]`,
* and is the exact shape #2128 fixed (`[^)\n]*` → `[^)\n]{0,200}`)
*
* AND whose match target is data-flow-traced to a `readFileSync` result
* (direct, chained, or via a same-scope variable binding — see
* `lib/readfilesync-trace.cjs`, shared with `no-crlf-fragile-split`).
*
* A quantifier that already carries an explicit closed bound (`{0,200}`,
* `{1,50}`) is NOT flagged — that is the #2128 fix shape this rule exists to
* make the default.
*
* ## Known boundaries
*
* Scoped to file/document content by data-flow, identically to
* `no-crlf-fragile-split`'s G2/G3 — a regex over a short in-memory constant,
* a flag string, or a non-readFileSync-derived value is out of scope by
* design (ADR-3212 §5: "most [of the census] are benign"). A regex stored far
* from its use, or content obtained via a non-readFileSync read (fs.readFile
* callback, streams), may not be caught.
*
* DEFECT category: CWE-1333 (Inefficient Regular Expression Complexity).
*/
const { isPatternUsedOnFileContent } = require('./lib/readfilesync-trace.cjs');
/**
* Walks a regex pattern SOURCE STRING (not the compiled RegExp) looking for
* an unbounded quantifier applied to a broad-match atom. Returns true on the
* first fragile occurrence found.
*
* A "broad-match atom" immediately preceding the quantifier is one of:
* - the literal 6-char sequence `[\s\S]` or `[\S\s]`
* - `.` (only counted as broad when `hasDotAll` is true)
* - a character class `[^X]` where X (with escapes counted as one unit) is
* 1-2 units long
*
* An "unbounded quantifier" is `*`, `+`, `*?`, `+?`, or `{n,}` (no upper
* bound). `{n,m}` (closed) is never flagged.
*
* @param {string} pattern
* @param {boolean} hasDotAll
* @returns {boolean}
*/
function hasUnboundedBroadQuantifier(pattern, hasDotAll) {
let i = 0;
const len = pattern.length;
while (i < len) {
let atomEnd = -1;
if (pattern.startsWith('[\\s\\S]', i) || pattern.startsWith('[\\S\\s]', i)) {
atomEnd = i + 6;
} else if (hasDotAll && pattern[i] === '.') {
atomEnd = i + 1;
} else if (pattern[i] === '[' && pattern[i + 1] === '^') {
let j = i + 2;
let units = 0;
let closed = false;
while (j < len) {
if (pattern[j] === ']') { closed = true; break; }
if (units > 2) break;
if (pattern[j] === '\\' && j + 1 < len) { j += 2; units++; continue; }
j++; units++;
}
if (closed && units >= 1 && units <= 2) {
atomEnd = j + 1;
}
}
if (atomEnd !== -1) {
const quant = pattern.slice(atomEnd, atomEnd + 8);
if (/^(\*\??|\+\??)/.test(quant)) return true;
const openEnded = quant.match(/^\{(\d+),\}/);
if (openEnded) return true;
}
i++;
}
return false;
}
/** @type {import('eslint').Rule.RuleModule} */
const rule = {
meta: {
type: 'problem',
docs: {
description:
'Disallow an unbounded quantifier over a broad character class in a regex applied to file content (ReDoS risk, CWE-1333)',
category: 'Best Practices',
},
schema: [],
messages: {
unboundedQuantifier:
'Unbounded quantifier over a broad character class ([\\s\\S]/./[^X]) applied to ' +
'readFileSync content is a catastrophic-backtracking risk (CWE-1333, #2128 class). ' +
'Bound it explicitly (e.g. {0,200}) or replace with a scanner from src/token-scanner.cts.',
},
},
create(context) {
const sourceCode = context.sourceCode ?? context.getSourceCode();
function checkPattern(node, pattern, flags) {
if (!hasUnboundedBroadQuantifier(pattern, flags.includes('s'))) return;
if (!isPatternUsedOnFileContent(node, sourceCode)) return;
context.report({ node, messageId: 'unboundedQuantifier' });
}
return {
Literal(node) {
if (!node.regex) return;
checkPattern(node, node.regex.pattern, node.regex.flags || '');
},
NewExpression(node) {
if (node.callee.type !== 'Identifier' || node.callee.name !== 'RegExp') return;
const [patternArg, flagsArg] = node.arguments;
if (!patternArg || patternArg.type !== 'Literal' || typeof patternArg.value !== 'string') return;
const flags = flagsArg && flagsArg.type === 'Literal' && typeof flagsArg.value === 'string' ? flagsArg.value : '';
checkPattern(node, patternArg.value, flags);
},
};
},
};
module.exports = rule;