* feat(#3415): ship local/no-unbounded-quantifier, burn down ReDoS class Phase 4 of epic #3212 (ADR-3212 §5/§7, the final phase). New rule flags an unbounded */+/{n,} quantifier over a broad character class ([\s\S], dotAll ., or a 1-2-unit negated class like [^\n]/[^)\n] — the exact #2128-fixed shape) applied to a regex whose match target is data-flow-traced to readFileSync content. eslint-rules/lib/readfilesync-trace.cjs extracts the data-flow tracer shared with no-crlf-fragile-split (Phase 2) rather than a second copy — no-crlf-fragile-split refactored onto it with zero behavior change, parity-tested. Real triage, not 798 mechanical edits: the ADR's census (2026-08-08) screened every unbounded quantifier in the tree unscoped. Correctly scoped to readFileSync-derived content (matching Phase 2's own G2/G3 scoping), the rule found 162 real hits across two detection waves — the second wave (93) surfaced only after a genuine off-by-one bug in this rule's own first draft was caught while writing its RuleTester tests and fixed (the bug silently missed every directly-quantified [\s\S]* with no gap before the quantifier — exactly the class this rule exists to catch). 3 hits landed in production src/ (commands.cts, milestone.cts, roadmap.cts) and were each empirically timed against adversarial input (matching #2128's own measured-not-assumed precedent) — all confirmed linear-time/benign, left unbounded with a measured-evidence comment rather than mechanically bounded. The remaining 159 are test-file fixture parsing (test-author-controlled, fixed-size content, not adversarial input) — each suppressed with a specific, non-generic reason. Zero functional behavior changed anywhere in this diff. tests/no-pending-3212-markers.test.cjs locks the epic's own closing invariant (ADR §7: "assert zero pending #3212 markers remain") — ground truth confirmed trivially true today (no phase left any such marker behind), now regression-locked going forward. Design: .gsd/phase/chore-3415-prohibition-with-teeth/40-design.md Test matrix: .gsd/phase/chore-3415-prohibition-with-teeth/50-test-matrix.md Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(#3415): correct rule category mislabel, add CI test-scope entry An orthogonal Standards-axis review found eslint-rules/no-unbounded-quantifier.cjs mistakenly carried meta.docs.category: 'Portability', copied from a sibling rule without realizing what that implied: docs/contributing/cross-platform- portability-rules.md governs an ADR-1703 rule family under a hard "zero escape hatches" contract (tests/portability-rule-disable-ban.test.cjs's PROTECTED_RULES bans eslint-disable for those rules entirely). This rule is not part of that family — it's ADR-3212 (ReDoS/CWE-1333), a different epic — and its eslint-disable-next-line suppressions (159 of them, added earlier this same phase after empirical benign-verification) are an intentional, correct design, not a bypass. Corrected to category: 'Best Practices', matching the actual precedent (no-adhoc-regex-escape.cjs, Phase 1 of the same epic, which is also correctly outside PROTECTED_RULES), and the rule's own docstring now states this explicitly so a future reader doesn't have to re-derive it. Also registers a new scripts/ci-test-scope.cjs bucket so editing this rule or the shared eslint-rules/lib/readfilesync-trace.cjs helper re-runs their own test suites under targeted CI selection — was previously unregistered and invisible to that fast-path (this PR's own gsd-test checkpoint runs the full suite regardless, so this only affects future narrowly-scoped PRs). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(#3415): bound no-unbounded-quantifier's own scanner (CWE-1333, ironic) Security review found the rule meant to catch algorithmic-complexity bugs had one of its own: hasUnboundedBroadQuantifier's negated-class inner scan walked from each `[^` occurrence to the next `]` (or EOF) with no bound, while the outer loop only ever advanced by one character — O(n²) total work on a pattern with many unclosed `[^` runs. Runs unconditionally inside checkPattern on any `new RegExp('literal string')` argument in any linted file, before the (cheap) readFileSync data-flow gate — so a single crafted string literal, no valid regex syntax required, could make `npm run lint` / CI hang. Empirically confirmed both the bug and the fix: pre-fix, n=4000/8000/ 16000/32000 chars took 30.8/115.6/463.8/1874.3ms (~4x work per 2x n, quadratic); extrapolated, the 300000-char repro from the finding would run ~165s. Post-fix (bail the inner scan once units exceeds the rule's own 1-2-unit scope, rather than continuing to hunt for a closing `]`), the same 300000-char input runs in 8.7ms via the real rule module, independently reconfirmed at 18ms via a fresh Linter.verify() call. New regression row in tests/no-unbounded-quantifier.rule.test.cjs asserts the RuleTester run on a 50000-char adversarial pattern completes and returns a defined result — no wall-clock assertion (CLAUDE.md Clock Seams / local/no-elapsed-assertion). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(#3415): triage 3 new sites, re-raise ceiling after upstream batch next merged 12 more PRs during this PR's review. Two consequences: - tests/edit-phase.test.cjs (fix #3262, unrelated) added 3 new content.match(/<tag>([\s\S]*?)<\/tag>/) reads of this repo's own workflow .md content — the same Class A pattern as the ~159 sites already triaged elsewhere in this PR. Suppressed with the same established reason. - lint-allow-test-rule-refs' ratchet ceiling needed re-raising again (301 -> 303) for the same reason as the two prior bumps: organic growth from unrelated, already-reviewed PRs landing concurrently, not a defect in this branch's own diff. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: sim <sim@local> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
173 lines
5.6 KiB
JavaScript
173 lines
5.6 KiB
JavaScript
'use strict';
|
|
|
|
/**
|
|
* readfilesync-trace.cjs
|
|
*
|
|
* Shared data-flow tracing for "is this AST node derived from a readFileSync
|
|
* call" and "is this RegExpLiteral applied to a readFileSync-derived
|
|
* receiver" — extracted from `no-crlf-fragile-split.cjs` (ADR-1703 Phase 4)
|
|
* so `no-unbounded-quantifier.cjs` (ADR-3212 §5/§7, epic #3212 Phase 4,
|
|
* #3415) does not carry a second, divergence-prone copy of the same ~80-line
|
|
* scope walk. Both rules import this module; a parity test
|
|
* (tests/readfilesync-trace-parity.test.cjs) asserts they classify a shared
|
|
* fixture set identically.
|
|
*
|
|
* Byte-identical logic to the pre-extraction copy in `no-crlf-fragile-split.cjs`
|
|
* — this is a pure relocation, not a rewrite (ADR-3212 §6, extend-never-mutate).
|
|
*/
|
|
|
|
/**
|
|
* Returns true if the node is a call to `readFileSync` or `fs.readFileSync`.
|
|
* @param {import('eslint').Rule.Node} node
|
|
* @returns {boolean}
|
|
*/
|
|
function isReadFileSyncCall(node) {
|
|
if (!node || node.type !== 'CallExpression') return false;
|
|
const callee = node.callee;
|
|
if (callee.type === 'Identifier' && callee.name === 'readFileSync') return true;
|
|
if (
|
|
callee.type === 'MemberExpression' &&
|
|
!callee.computed &&
|
|
callee.property.type === 'Identifier' &&
|
|
callee.property.name === 'readFileSync'
|
|
) {
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Given an Identifier node, walk the scope chain to find its binding, then
|
|
* check if the initializer is derived from readFileSync.
|
|
* @param {import('eslint').Rule.Node} identNode
|
|
* @param {import('eslint').SourceCode} sourceCode
|
|
* @returns {boolean}
|
|
*/
|
|
function resolveIdentifierToReadFileSync(identNode, sourceCode) {
|
|
if (typeof sourceCode.getScope !== 'function') return false;
|
|
|
|
let scope;
|
|
try {
|
|
scope = sourceCode.getScope(identNode);
|
|
} catch (_) {
|
|
// If scope resolution fails (e.g. due to unsupported node type or parser
|
|
// version mismatch), conservatively return false (not flagged) — an
|
|
// unresolvable scope produces a false negative rather than a spurious error.
|
|
return false;
|
|
}
|
|
if (!scope) return false;
|
|
|
|
let s = scope;
|
|
while (s) {
|
|
const variable = s.variables.find((v) => v.name === identNode.name);
|
|
if (variable) {
|
|
const defs = variable.defs;
|
|
if (!defs || defs.length === 0) return false;
|
|
const decl = defs[0].node; // VariableDeclarator
|
|
if (!decl || !decl.init) return false;
|
|
return isReadFileSyncDerived(decl.init, sourceCode);
|
|
}
|
|
s = s.upper;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Returns true if `node` is (transitively) derived from a readFileSync call.
|
|
*
|
|
* Handles:
|
|
* - Direct: readFileSync(...) -- the node itself IS the readFileSync call
|
|
* - Chain: readFileSync(...).toString() etc.
|
|
* - Identifier resolved via scope to a variable initialized from readFileSync
|
|
*
|
|
* @param {import('eslint').Rule.Node} node
|
|
* @param {import('eslint').SourceCode} sourceCode
|
|
* @returns {boolean}
|
|
*/
|
|
function isReadFileSyncDerived(node, sourceCode) {
|
|
if (!node) return false;
|
|
|
|
if (isReadFileSyncCall(node)) return true;
|
|
|
|
if (node.type === 'MemberExpression') {
|
|
return isReadFileSyncDerived(node.object, sourceCode);
|
|
}
|
|
|
|
if (node.type === 'CallExpression') {
|
|
if (isReadFileSyncCall(node)) return true;
|
|
if (node.callee.type === 'MemberExpression') {
|
|
return isReadFileSyncDerived(node.callee.object, sourceCode);
|
|
}
|
|
}
|
|
|
|
if (node.type === 'Identifier') {
|
|
return resolveIdentifierToReadFileSync(node, sourceCode);
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Returns true if a pattern-bearing node (RegExpLiteral, or the callee-object
|
|
* position for `/regex/.test(str)`) is used on a readFileSync-derived
|
|
* receiver via .match/.test/.exec/.replace/.replaceAll/.split/.matchAll.
|
|
*
|
|
* Two AST shapes:
|
|
* Shape A: str.match(/regex/) — regex is an ARG to the call.
|
|
* regex.parent = CallExpression (arg), callee.object = str
|
|
* Shape B: /regex/.test(str) — regex is the callee object.
|
|
* regex.parent = MemberExpression (the .test callee)
|
|
* regex.parent.parent = CallExpression, first arg = str
|
|
*
|
|
* @param {import('eslint').Rule.Node} regexNode — the RegExpLiteral (or `new RegExp(...)` CallExpression)
|
|
* @param {import('eslint').SourceCode} sourceCode
|
|
* @returns {boolean}
|
|
*/
|
|
function isPatternUsedOnFileContent(regexNode, sourceCode) {
|
|
const FILE_METHODS = new Set(['match', 'test', 'exec', 'replace', 'replaceAll', 'split', 'matchAll']);
|
|
const parent = regexNode.parent;
|
|
if (!parent) return false;
|
|
|
|
// Shape A: str.match(regex) — regex is an argument; parent is CallExpression
|
|
if (parent.type === 'CallExpression') {
|
|
const callee = parent.callee;
|
|
if (
|
|
callee &&
|
|
callee.type === 'MemberExpression' &&
|
|
!callee.computed &&
|
|
callee.property.type === 'Identifier' &&
|
|
FILE_METHODS.has(callee.property.name)
|
|
) {
|
|
if (parent.arguments.includes(regexNode)) {
|
|
return isReadFileSyncDerived(callee.object, sourceCode);
|
|
}
|
|
}
|
|
return false;
|
|
}
|
|
|
|
// Shape B: /regex/.test(str) — regex is the callee object.
|
|
if (parent.type === 'MemberExpression' && !parent.computed) {
|
|
if (
|
|
parent.object === regexNode &&
|
|
parent.property.type === 'Identifier' &&
|
|
FILE_METHODS.has(parent.property.name)
|
|
) {
|
|
const callExpr = parent.parent;
|
|
if (callExpr && callExpr.type === 'CallExpression' && callExpr.callee === parent) {
|
|
const args = callExpr.arguments;
|
|
if (args && args.length > 0) {
|
|
return isReadFileSyncDerived(args[0], sourceCode);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
module.exports = {
|
|
isReadFileSyncCall,
|
|
isReadFileSyncDerived,
|
|
isPatternUsedOnFileContent,
|
|
};
|