百科.dev
全部条目在线工具AI 编程趋势榜开源项目技术资讯提交条目
登录
< 返回工具列表
E

eslint-plugin-security

> 编程语言
开源

Node 安全性的 ESLint 规则

2.4K stars0 点赞2 次浏览
访问官网GitHub

工具介绍

Node 安全性的 ESLint 规则

eslint-plugin-security

ESLint rules for Node Security

This project will help identify potential security hotspots, but finds a lot of false positives which need triage by a human.

Installation

bash
npm install --save-dev eslint-plugin-security

or

bash
yarn add --dev eslint-plugin-security

Usage

Flat config (requires eslint >= v8.23.0)

Add the following to your eslint.config.js file:

javascript
const pluginSecurity = require('eslint-plugin-security');

module.exports = [pluginSecurity.configs.recommended];

eslintrc config (deprecated)

Add the following to your .eslintrc file:

javascript
module.exports = {
  extends: ['plugin:security/recommended-legacy'],
};

Developer guide

  • Use GitHub pull requests.
  • Conventions:
  • We use our custom ESLint setup.
  • Please implement a test for each new rule and use this command to be sure the new code respects the style guide and the tests keep passing:
bash
npm run-script cont-int

Tests

bash
npm test

Rules

⚠️ Configurations set to warn in.
✅ Set in the recommended configuration.

Name Description ⚠️
detect-bidi-characters Detects trojan source attacks that employ unicode bidi attacks to inject malicious code. ✅
detect-buffer-noassert Detects calls to "buffer" with "noAssert" flag set. ✅
detect-child-process Detects instances of "child_process" & non-literal "exec()" calls. ✅
detect-disable-mustache-escape Detects "object.escapeMarkup = false", which can be used with some template engines to disable escaping of HTML entities. ✅
detect-eval-with-expression Detects "eval(variable)" which can allow an attacker to run arbitrary code inside your process. ✅
detect-invisible-characters Detects invisible characters that have no visible glyph and can be used to hide malicious code. ✅
detect-new-buffer Detects instances of new Buffer(argument) where argument is any non-literal value. ✅
detect-no-csrf-before-method-override Detects Express "csrf" middleware setup before "method-override" middleware. ✅
detect-non-literal-fs-filename Detects variable in filename argument of "fs" calls, which might allow an attacker to access anything on your system. ✅
detect-non-literal-regexp Detects "RegExp(variable)", which might allow an attacker to DOS your server with a long-running regular expression. ✅
detect-non-literal-require Detects "require(variable)", which might allow an attacker to load and run arbitrary code, or access arbitrary files on disk. ✅
detect-object-injection Detects "variable[key]" as a left- or right-hand assignment operand. ✅
detect-possible-timing-attacks Detects insecure comparisons (==, !=, !== and ===), which check input sequentially. ✅
detect-pseudoRandomBytes Detects if "pseudoRandomBytes()" is in use, which might not give you the randomness you need and expect. ✅
detect-unsafe-regex Detects potentially unsafe regular expressions, which may take a very long time to run, blocking the event loop. ✅

TypeScript support

Type definitions for this package are managed by DefinitelyTyped. Use @types/eslint-plugin-security for type checking.

bash
npm install --save-dev @types/eslint-plugin-security

# OR

yarn add --dev @types/eslint-plugin-security

Issues· 0 开放

查看全部 Issues在 GitHub 打开

暂无开放 Issues，或尚未同步最近议题。

> 标签

JavaScripteslinteslint-plugin

暂无评论，来聊聊你的看法吧

> 工具信息

发布日期2026年8月1日
最后更新2026年9月17日
分类编程语言
定价开源

> 相关工具

T
TypeScript
JavaScript 的超集，为前端与全栈提供静态类型
P
Python
通用编程语言，广泛用于 Web、数据与 AI
G
Go
Google 推出的简洁高效系统语言