[feat] added metadata for the each rule (#17)

Author: webschik

README.md

@@ -80,7 +80,7 @@ Examples: [test/rules/tsr-disable-mustache-escape/default/test.ts.lint](test/rul
 
 #### `tsr-detect-eval-with-expression`
 
-Detects `eval(variable)` which can allow an attacker to run arbitary code inside your process.
+Detects `eval(variable)` which can allow an attacker to run arbitrary code inside your process.
 
 More information: http://security.stackexchange.com/questions/94017/what-are-the-security-issues-with-eval-in-javascript
 

src/rules/tsrDetectBufferNoassertRule.ts

@@ -36,6 +36,19 @@ const writeMethods: string[] = [
 ];
 
 export class Rule extends Lint.Rules.AbstractRule {
+    static metadata: Lint.IRuleMetadata = {
+        ruleName: 'tsr-detect-buffer-noassert',
+        description: 'Warns when Buffer with noAssert flag is used',
+        descriptionDetails: Lint.Utils.dedent`Any usage of Buffer
+            with noAssert flag will trigger a warning.
+            See https://github.com/webschik/tslint-config-security#tsr-detect-buffer-noassert`,
+        optionsDescription: '',
+        options: null,
+        type: 'functionality',
+        requiresTypeInfo: false,
+        typescriptOnly: false
+    };
+
     apply(sourceFile: ts.SourceFile): Lint.RuleFailure[] {
         return this.applyWithFunction(sourceFile, walk);
     }

src/rules/tsrDetectChildProcessRule.ts

@@ -3,6 +3,19 @@ import * as ts from 'typescript';
 import {stringLiteralKinds} from '../node-kind';
 
 export class Rule extends Lint.Rules.AbstractRule {
+    static metadata: Lint.IRuleMetadata = {
+        ruleName: 'tsr-detect-child-process',
+        description: 'Warns when child_process.exec() with non-literal first argument is used',
+        descriptionDetails: Lint.Utils.dedent`Any usage of child_process.exec()
+            with non-literal first argument will trigger a warning.
+            See https://github.com/webschik/tslint-config-security#tsr-detect-child-process`,
+        optionsDescription: '',
+        options: null,
+        type: 'functionality',
+        requiresTypeInfo: false,
+        typescriptOnly: false
+    };
+
     apply(sourceFile: ts.SourceFile): Lint.RuleFailure[] {
         return this.applyWithFunction(sourceFile, walk);
     }

src/rules/tsrDetectEvalWithExpressionRule.ts

@@ -4,6 +4,19 @@ import {stringLiteralKinds} from '../node-kind';
 import syntaxKindToName from '../syntax-kind-to-name';
 
 export class Rule extends Lint.Rules.AbstractRule {
+    static metadata: Lint.IRuleMetadata = {
+        ruleName: 'tsr-detect-eval-with-expression',
+        description: 'Warns when eval() with non-literal argument is used',
+        descriptionDetails: Lint.Utils.dedent`Any usage of eval()
+            with non-literal argument will trigger a warning.
+            See https://github.com/webschik/tslint-config-security#tsr-detect-eval-with-expression`,
+        optionsDescription: '',
+        options: null,
+        type: 'functionality',
+        requiresTypeInfo: false,
+        typescriptOnly: false
+    };
+
     apply(sourceFile: ts.SourceFile): Lint.RuleFailure[] {
         return this.applyWithFunction(sourceFile, walk);
     }

src/rules/tsrDetectHtmlInjectionRule.ts

@@ -3,6 +3,19 @@ import * as ts from 'typescript';
 import {stringLiteralKinds} from '../node-kind';
 
 export class Rule extends Lint.Rules.AbstractRule {
+    static metadata: Lint.IRuleMetadata = {
+        ruleName: 'tsr-detect-html-injection',
+        description: 'Warns when possible HTML injection is found',
+        descriptionDetails: Lint.Utils.dedent`Any usage of unsafe DOM APIs as Element.innerHTML or document.write()
+            will trigger a warning.
+            See https://github.com/webschik/tslint-config-security#tsr-detect-html-injection`,
+        optionsDescription: '',
+        options: null,
+        type: 'functionality',
+        requiresTypeInfo: false,
+        typescriptOnly: false
+    };
+
     apply(sourceFile: ts.SourceFile): Lint.RuleFailure[] {
         return this.applyWithFunction(sourceFile, walk);
     }

src/rules/tsrDetectNoCsrfBeforeMethodOverrideRule.ts

@@ -2,6 +2,19 @@ import * as Lint from 'tslint';
 import * as ts from 'typescript';
 
 export class Rule extends Lint.Rules.AbstractRule {
+    static metadata: Lint.IRuleMetadata = {
+        ruleName: 'tsr-detect-no-csrf-before-method-override',
+        description: 'Warns when csrf middleware for Express.js is setup before method-override middleware',
+        descriptionDetails: Lint.Utils.dedent`Any usage of express.csrf() middleware before
+            express.methodOverride() will trigger a warning.
+            See https://github.com/webschik/tslint-config-security#tsr-detect-no-csrf-before-method-override`,
+        optionsDescription: '',
+        options: null,
+        type: 'functionality',
+        requiresTypeInfo: false,
+        typescriptOnly: false
+    };
+
     apply(sourceFile: ts.SourceFile): Lint.RuleFailure[] {
         return this.applyWithFunction(sourceFile, walk);
     }

src/rules/tsrDetectNonLiteralBufferRule.ts

@@ -3,6 +3,19 @@ import * as ts from 'typescript';
 import {stringLiteralKinds} from '../node-kind';
 
 export class Rule extends Lint.Rules.AbstractRule {
+    static metadata: Lint.IRuleMetadata = {
+        ruleName: 'tsr-detect-non-literal-buffer',
+        description: 'Warns when Buffer constructor with non-literal argument is used',
+        descriptionDetails: Lint.Utils.dedent`Any usage of new Buffer()
+            with non-literal argument will trigger a warning.
+            See https://github.com/webschik/tslint-config-security#tsr-detect-non-literal-buffer`,
+        optionsDescription: '',
+        options: null,
+        type: 'functionality',
+        requiresTypeInfo: false,
+        typescriptOnly: false
+    };
+
     apply(sourceFile: ts.SourceFile): Lint.RuleFailure[] {
         return this.applyWithFunction(sourceFile, walk);
     }

src/rules/tsrDetectNonLiteralFsFilenameRule.ts

@@ -4,6 +4,19 @@ import fsModuleMethodsArgumentsInfo from '../fs-module-methods-arguments-info';
 import {stringLiteralKinds} from '../node-kind';
 
 export class Rule extends Lint.Rules.AbstractRule {
+    static metadata: Lint.IRuleMetadata = {
+        ruleName: 'tsr-detect-non-literal-fs-filename',
+        description: 'Warns when methods of Node.js FileSystem API are used with non-literal argument as a filename',
+        descriptionDetails: Lint.Utils.dedent`Any usage of Node.js FileSystem methods
+            with non-literal argument as a filename will trigger a warning.
+            See https://github.com/webschik/tslint-config-security#tsr-detect-non-literal-fs-filename`,
+        optionsDescription: '',
+        options: null,
+        type: 'functionality',
+        requiresTypeInfo: false,
+        typescriptOnly: false
+    };
+
     apply(sourceFile: ts.SourceFile): Lint.RuleFailure[] {
         return this.applyWithFunction(sourceFile, walk);
     }

src/rules/tsrDetectNonLiteralRegexpRule.ts

@@ -3,6 +3,19 @@ import * as ts from 'typescript';
 import {stringLiteralKinds} from '../node-kind';
 
 export class Rule extends Lint.Rules.AbstractRule {
+    static metadata: Lint.IRuleMetadata = {
+        ruleName: 'tsr-detect-non-literal-regexp',
+        description: 'Warns when RegExp constructor with non-literal argument is used',
+        descriptionDetails: Lint.Utils.dedent`Any usage of new RegExp()
+            with non-literal argument will trigger a warning.
+            See https://github.com/webschik/tslint-config-security#tsr-detect-non-literal-regexp`,
+        optionsDescription: '',
+        options: null,
+        type: 'functionality',
+        requiresTypeInfo: false,
+        typescriptOnly: false
+    };
+
     apply(sourceFile: ts.SourceFile): Lint.RuleFailure[] {
         return this.applyWithFunction(sourceFile, walk);
     }

src/rules/tsrDetectNonLiteralRequireRule.ts

@@ -3,6 +3,19 @@ import * as ts from 'typescript';
 import {stringLiteralKinds} from '../node-kind';
 
 export class Rule extends Lint.Rules.AbstractRule {
+    static metadata: Lint.IRuleMetadata = {
+        ruleName: 'tsr-detect-non-literal-require',
+        description: 'Warns when require() function is used with non-literal argument',
+        descriptionDetails: Lint.Utils.dedent`Any usage of require()
+            with non-literal argument will trigger a warning.
+            See https://github.com/webschik/tslint-config-security#tsr-detect-non-literal-require`,
+        optionsDescription: '',
+        options: null,
+        type: 'functionality',
+        requiresTypeInfo: false,
+        typescriptOnly: false
+    };
+
     apply(sourceFile: ts.SourceFile): Lint.RuleFailure[] {
         return this.applyWithFunction(sourceFile, walk);
     }