Rule S4507: debug features activated in production (deprecate S1442 and S1525)

eslint-bridge/src/rules/main.ts

@@ -98,6 +98,7 @@ import { rule as preferDefaultLast } from './prefer-default-last';
 import { rule as preferPromiseShorthand } from './prefer-promise-shorthand';
 import { rule as preferTypeGuard } from './prefer-type-guard';
 import { rule as processArgv } from './process-argv';
+import { rule as productionDebug } from './production-debug';
 import { rule as pseudoRandom } from './pseudo-random';
 import { rule as regularExpr } from './regular-expr';
 import { rule as shorthandPropertyGrouping } from './shorthand-property-grouping';
@@ -198,6 +199,7 @@ ruleModules['prefer-default-last'] = preferDefaultLast;
 ruleModules['prefer-promise-shorthand'] = preferPromiseShorthand;
 ruleModules['prefer-type-guard'] = preferTypeGuard;
 ruleModules['process-argv'] = processArgv;
+ruleModules['production-debug'] = productionDebug;
 ruleModules['pseudo-random'] = pseudoRandom;
 ruleModules['regular-expr'] = regularExpr;
 ruleModules['shorthand-property-grouping'] = shorthandPropertyGrouping;

eslint-bridge/src/rules/production-debug.ts

@@ -0,0 +1,111 @@
+/*
+ * SonarQube JavaScript Plugin
+ * Copyright (C) 2011-2020 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+// https://jira.sonarsource.com/browse/RSPEC-4507
+
+import { Rule } from 'eslint';
+import * as estree from 'estree';
+import {
+  getModuleNameOfIdentifier,
+  getUniqueWriteUsage,
+  getVariableFromName,
+  isIdentifier,
+} from './utils';
+
+const ERRORHANDLER_MODULE = 'errorhandler';
+const message =
+  'Make sure this debug feature is deactivated before delivering the code in production.';
+
+export const rule: Rule.RuleModule = {
+  create(context: Rule.RuleContext) {
+    return {
+      DebuggerStatement(node: estree.Node) {
+        context.report({
+          node,
+          message,
+        });
+      },
+      CallExpression(node: estree.Node) {
+        const callExpression = node as estree.CallExpression;
+
+        // alert(...)
+        checkOpenDialogFunction(context, callExpression);
+
+        // app.use(...)
+        checkErrorHandlerMiddleware(context, callExpression);
+      },
+    };
+  },
+};
+
+function checkOpenDialogFunction(context: Rule.RuleContext, callExpression: estree.CallExpression) {
+  const { callee } = callExpression;
+  if (callee.type === 'Identifier') {
+    const { name } = callee;
+
+    if (name === 'alert' || name === 'prompt' || name === 'confirm') {
+      const variable = getVariableFromName(context, name);
+      if (variable) {
+        // we don't report on custom function
+        return;
+      }
+      context.report({
+        node: callExpression,
+        message,
+      });
+    }
+  }
+}
+
+function checkErrorHandlerMiddleware(
+  context: Rule.RuleContext,
+  callExpression: estree.CallExpression,
+) {
+  const { callee, arguments: args } = callExpression;
+  if (
+    callee.type === 'MemberExpression' &&
+    isIdentifier(callee.property, 'use') &&
+    args.length > 0 &&
+    !isInsideConditional(context)
+  ) {
+    let middleware: estree.Node | undefined = args[0];
+    if (middleware.type === 'Identifier') {
+      middleware = getUniqueWriteUsage(context, middleware.name);
+    }
+
+    if (
+      middleware &&
+      middleware.type === 'CallExpression' &&
+      middleware.callee.type === 'Identifier'
+    ) {
+      const module = getModuleNameOfIdentifier(middleware.callee, context);
+      if (module?.value === ERRORHANDLER_MODULE) {
+        context.report({
+          node: callExpression,
+          message,
+        });
+      }
+    }
+  }
+}
+
+function isInsideConditional(context: Rule.RuleContext) {
+  const ancestors = context.getAncestors();
+  return ancestors.some(ancestor => ancestor.type === 'IfStatement');
+}

eslint-bridge/tests/rules/production-debug.test.ts

@@ -0,0 +1,124 @@
+/*
+ * SonarQube JavaScript Plugin
+ * Copyright (C) 2011-2020 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+import { RuleTester } from 'eslint';
+import { rule } from 'rules/production-debug';
+
+const ruleTester = new RuleTester({ parserOptions: { ecmaVersion: 2018, sourceType: 'module' } });
+
+const message =
+  'Make sure this debug feature is deactivated before delivering the code in production.';
+
+ruleTester.run(
+  'Delivering code in production with debug features activated is security-sensitive',
+  rule,
+  {
+    valid: [
+      {
+        code: `
+      Debug.write("hello, world");
+
+      // we report only on trivial (and mostly used) usages without object access
+      this.alert("here!");
+      window.alert("here!");
+
+      // custom is ok
+      function alert() {}
+      alert("here!");
+
+      import { confirm } from './confirm';
+      confirm("Are you sure?");
+      `,
+      },
+    ],
+    invalid: [
+      {
+        code: `debugger;`,
+        errors: [
+          {
+            message,
+            line: 1,
+            endLine: 1,
+            column: 1,
+            endColumn: 10,
+          },
+        ],
+      },
+      {
+        code: `
+      alert("here!");
+      confirm("Are you sure?");
+      prompt("What's your name?", "John Doe");
+      `,
+        errors: [
+          {
+            message,
+            line: 2,
+          },
+          {
+            message,
+            line: 3,
+          },
+          {
+            message,
+            line: 4,
+          },
+        ],
+      },
+      {
+        code: `
+        const errorhandler = require('errorhandler');
+        if (process.env.NODE_ENV === 'development') {
+          app1.use(errorhandler()); // Compliant
+        }
+        app2.use(errorhandler()); // Noncompliant  
+        `,
+        errors: [
+          {
+            message,
+            line: 6,
+            column: 9,
+            endColumn: 33,
+          },
+        ],
+      },
+      {
+        code: `
+        import * as errorhandler from 'errorhandler';
+        const handler = errorhandler();
+        app1.use(handler); // Noncompliant  
+        if (process.env.NODE_ENV === 'development') {
+          app2.use(handler); // Compliant
+        } else {
+          app3.use(handler); // Compliant
+        }
+        app4.use();
+        `,
+        errors: [
+          {
+            message,
+            line: 4,
+            column: 9,
+            endColumn: 26,
+          },
+        ],
+      },
+    ],
+  },
+);

its/ruling/src/test/expected/js/javascript-test-sources/javascript-S4507.json

@@ -0,0 +1,5 @@
+{
+'javascript-test-sources:src/ecmascript6/sonar-web/src/main/js/components/issue/issue-view.js':[
+133,
+],
+}

its/ruling/src/test/expected/js/jshint/javascript-S4507.json

@@ -0,0 +1,12 @@
+{
+'jshint:tests/unit/fixtures/gh247.js':[
+9,
+10,
+11,
+17,
+22,
+34,
+35,
+36,
+],
+}

its/ruling/src/test/expected/js/p5.js/javascript-S4507.json

@@ -0,0 +1,13 @@
+{
+'p5.js:lib/addons/p5.sound.js':[
+10042,
+10176,
+10193,
+],
+'p5.js:src/io/files.js':[
+1838,
+],
+'p5.js:test/manual-test-examples/dom/audioelt_onended/sketch.js':[
+8,
+],
+}

its/ruling/src/test/expected/js/prototype/javascript-S4507.json

@@ -0,0 +1,5 @@
+{
+'prototype:test/unit/tests/element_mixins.test.js':[
+27,
+],
+}

its/ruling/src/test/expected/ts/TypeScript/typescript-S4507.json

@@ -0,0 +1,5 @@
+{
+'TypeScript:src/compiler/core.ts':[
+2254,
+],
+}

its/ruling/src/test/expected/ts/console/typescript-S4507.json

@@ -0,0 +1,12 @@
+{
+'console:src/main.tsx':[
+55,
+],
+'console:src/views/Integrations/AlgoliaPopup/AlgoliaIndexPopup/AlgoliaIndexPopup.tsx':[
+143,
+148,
+],
+'console:src/views/account/ResetPasswordView/ResetPasswordView.tsx':[
+45,
+],
+}

javascript-checks/src/main/java/org/sonar/javascript/checks/CheckList.java

@@ -238,6 +238,7 @@ public static List<Class> getAllChecks() {
       PrimitiveWrappersCheck.class,
       ProcessArgvCheck.class,
       PreferDefaultLastCheck.class,
+      ProductionDebugCheck.class,
       PseudoRandomCheck.class,
       ReassignedParameterCheck.class,
       RedeclaredSymbolCheck.class,

javascript-checks/src/main/java/org/sonar/javascript/checks/ProductionDebugCheck.java

@@ -0,0 +1,36 @@
+/*
+ * SonarQube JavaScript Plugin
+ * Copyright (C) 2011-2020 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+package org.sonar.javascript.checks;
+
+import org.sonar.check.Rule;
+import org.sonar.javascript.checks.annotations.JavaScriptRule;
+import org.sonar.javascript.checks.annotations.TypeScriptRule;
+
+@JavaScriptRule
+@TypeScriptRule
+@Rule(key = "S4507")
+public class ProductionDebugCheck extends EslintBasedCheck {
+
+  @Override
+  public String eslintKey() {
+    return "production-debug";
+  }
+}
+

javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1442.html

@@ -12,4 +12,5 @@ <h2>See</h2>
   </li>
   <li> <a href="http://cwe.mitre.org/data/definitions/489.html">MITRE, CWE-489</a> - Leftover Debug Code </li>
 </ul>
-
+<h2>Deprecated</h2>
+<p>This rule is deprecated; use {rule:javascript:S4507} instead.</p>

javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1442.json

@@ -1,7 +1,7 @@
 {
   "title": "\"alert(...)\" should not be used",
   "type": "VULNERABILITY",
-  "status": "ready",
+  "status": "deprecated",
   "remediation": {
     "func": "Constant\/Issue",
     "constantCost": "10min"

javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1525.html

@@ -23,4 +23,5 @@ <h2>See</h2>
   </li>
   <li> <a href="http://cwe.mitre.org/data/definitions/489.html">MITRE, CWE-489</a> - Leftover Debug Code </li>
 </ul>
-
+<h2>Deprecated</h2>
+<p>This rule is deprecated; use {rule:javascript:S4507} instead.</p>

javascript-checks/src/main/resources/org/sonar/l10n/javascript/rules/javascript/S1525.json

@@ -1,7 +1,7 @@
 {
   "title": "Debugger statements should not be used",
   "type": "VULNERABILITY",
-  "status": "ready",
+  "status": "deprecated",
   "remediation": {
     "func": "Constant\/Issue",
     "constantCost": "5min"