Rule S4507: Delivering code in production with debug features activated is security-sensitive (deprecates S1442 and S1525)

[eric-therond-sonarsource]

New rule to implement RSPEC-4507
Since it's implemented, rules S1442 (#1078) and S1525 (#1418) should be deprecated (#1182)

Code examples:
https://github.com/SonarSource/security-expected-issues/tree/master/javascript/rules/hotspots/RSPEC-4507

We should report on usages of errorhandler middleware in production environment.

const errorhandler = require('errorhandler');
if (process.env.NODE_ENV === 'development') {
  // only use in development
  app.use(errorhandler()); // Compliant
}
app2.use(errorhandler()); // Noncompliant  

Simple way to do it is to raise when errorhandler is used outside of any if statement.
A more sophisticated logic could be in addition to check that condition expression involves process.env.NODE_ENV.

[agigleux]

This rule should also raise an issue when sequelize is configured to log (which is the default):

var sequelize = new Sequelize(config.database, config.username, config.password, { host: config.host, dialect: config.dialect });

In this configuration sequelize is logging, so sharing debugging information.
It's safer to turn that feature off for prod.

logging: false