@codelaw/rules-security-js · codelaw-rules-security-js

codelaw's JavaScript (Node, the browser, Express) security rules: 66 of them, each mapped to a CWE and an OWASP Top 10:2025 category, each with a fix class and examples in all four languages. One of codelaw's first-party rule packs (SR-RULE-PACKS). The same files ship on npm as @codelaw/rules-security-js and on PyPI as codelaw-rules-security-js: a Python repository with JavaScript in it gets them too.

# codelaw.toml
extends = ["codelaw:js/recommended", "codelaw:sec-js/recommended"]
preview = true   # every rule is `preview` until a corpus run promotes it

codelaw init does not add it: a security pack is chosen, not detected. The rules run on JS, JSX, TS and TSX files; the TypeScript-only rules (Angular, NestJS, Prisma, typed casts) are in security-ts, which extends this pack.

Presets

recommended holds the 55 high-confidence rules, at error; strict adds the 11 heuristic ones, at warn, so a team can start without noise. 17 rules offer a mechanical fix (auto 0, suggest 17); the other 49 are manual, and each names the safe API in its How to fix steps, which the codelaw-fix skill walks through.

Rules

Every rule carries security: { cwe, owasp, severity } (SR-RULE-FORMAT decision 2a), so

• its finding names the CWE (sec-js/<rule> (CWE-79) …);
• codelaw rules --tag cwe:79 and --tag owasp:A05 find it, and codelaw rules --security-coverage puts it in the OWASP Top 10:2025 matrix;
• SARIF carries its security and external/cwe/cwe-<n> tags and a security-severity that GitHub code scanning ranks by (SR-CLI-MCP decision 4).

Injection and code execution

Cross-site scripting and the browser

Access, requests and the server

Cryptography, secrets and models

How the rules know a value comes from a request

Several rules ask whether a sink's argument comes from a request (sec-js/no-path-traversal, no-ssrf, no-open-redirect, no-ssti, no-header-injection, no-log-injection, no-format-string, no-unvalidated-dynamic-method, no-prototype-pollution, no-llm-output-to-sink, no-prompt-injection). They use the from_source: predicate (SR-RULE-FORMAT decision 3a). It holds when the argument is a listed request source (or a method called on one), is built from one by concatenation, interpolation or ?:, or is a local name bound to one in the same function, one or more assignments or destructurings away. The sources are in this pack's data/sources/:

from_source: is not taint analysis. It never follows a call (a value passed through any function, a sanitizer or not, stops being a source), a return value, a parameter, a closure's outer variable or another file. A rule page that uses it says so. Rules that need to see more than one argument position (path.join(a, b)) look for a request path in the whole call instead. Every other rule fires on a dangerous sink with a value that is not a literal, or on a setting that is unsafe in itself.

What the rules are not

• Not a scanner for the whole program. They read one file at a time and one function at a time; a value that crosses a function boundary is not seen.
• Not a proof of safety. A clean run means no known-bad shape was found, not that the code is safe. strict rules are heuristics and warn.
• Not for generated code or tests without care. Turn rules off for a folder with an [[overrides]] entry in codelaw.toml; sec-js/no-hardcoded-secret and sec-js/no-insecure-random fire in test helpers too.
• Deviations from the first catalogue (W-54). sec-js/no-cleartext-http is manual: an edit primitive cannot rewrite the text inside a URL. sec-js/no-bidi-characters is suggest, not auto: only a comment is removed whole, and a string or regular expression with a hidden character is left for you. sec-js/no-prototype-pollution does not flag a literal .__proto__ write, only a request value used as a key or merged; sec-js/no-javascript-url reads the address by its text (location.hash, document.referrer, …), not through a local name.

Not ported, and why

eslint-plugin-security (Apache-2.0) is the source of the rules whose ported_from: names it; this table covers each of its rules. Bandit (Apache-2.0) and Ruff's S rules (MIT) are named in ported_from: the same way.

Read for ideas only, never copied (L2): CodeQL's JavaScript queries (MIT), the OWASP cheat sheets, and — under licences that forbid copying — eslint-plugin-no-unsanitized (MPL-2.0), njsscan (LGPL-3.0) and Semgrep's rules (the Semgrep Rules License).