{"size": 2216, "ext": "js", "max_stars_repo_path": "rules/detect-object-injection.js", "max_stars_repo_name": "MarkKragerup/eslint-plugin-security", "max_stars_repo_stars_event_min_datetime": null, "max_stars_repo_stars_event_max_datetime": null, "max_issues_repo_path": "rules/detect-object-injection.js", "max_issues_repo_name": "MarkKragerup/eslint-plugin-security", "max_issues_repo_issues_event_min_datetime": null, "max_issues_repo_issues_event_max_datetime": null, "max_forks_repo_path": "rules/detect-object-injection.js", "max_forks_repo_name": "MarkKragerup/eslint-plugin-security", "max_forks_repo_forks_event_min_datetime": null, "max_forks_repo_forks_event_max_datetime": null}
{"max_stars_count": null, "max_issues_count": null, "max_forks_count": null, "avg_line_length": 27.0243902439, "max_line_length": 125, "alphanum_fraction": 0.5207581227}
/**
 * Tries to detect instances of var[var]
 * @author Jon Lamendola
 */

'use strict';

//------------------------------------------------------------------------------
// Rule Definition
//------------------------------------------------------------------------------

const getPath = (value, seen, keys) => {
  let index = seen.indexOf(value);
  const path = [keys[index]];
  for (index--; index >= 0; index--) {
    if (seen[index][path[0]] === value) {
      value = seen[index];
      path.unshift(keys[index]);
    }
  }
  return `~${path.join('.')}`;
};

const getSerialize = (fn, decycle) => {
  const seen = [];
  const keys = [];
  decycle =
    decycle ||
    function (key, value) {
      return `[Circular ${getPath(value, seen, keys)}]`;
    };
  return function (key, value) {
    let ret = value;
    if (typeof value === 'object' && value) {
      if (seen.indexOf(value) !== -1) {
        ret = decycle(key, value);
      } else {
        seen.push(value);
        keys.push(key);
      }
    }
    if (fn) {
      ret = fn(key, ret);
    }
    return ret;
  };
};

const stringify = (obj, fn, spaces, decycle) => {
  return JSON.stringify(obj, getSerialize(fn, decycle), spaces);
};

stringify.getSerialize = getSerialize;
export default {
  meta: {
    type: 'error',
    docs: {
      description: 'Detects "variable[key]" as a left- or right-hand assignment operand.',
      category: 'Possible Security Vulnerability',
      recommended: true,
      url: 'https://github.com/nodesecurity/eslint-plugin-security/blob/main/docs/the-dangers-of-square-bracket-notation.md',
    },
  },
  create: function (context) {
    return {
      MemberExpression: function (node) {
        if (node.computed === true) {
          if (node.property.type === 'Identifier') {
            if (node.parent.type === 'VariableDeclarator') {
              context.report(node, 'Variable Assigned to Object Injection Sink');
            } else if (node.parent.type === 'CallExpression') {
              context.report(node, 'Function Call Object Injection Sink');
            } else {
              context.report(node, 'Generic Object Injection Sink');
            }
          }
        }
      },
    };
  },
};
