release: WRNexusJS 0.2.75

2026-07-21 12:30:46 +05:30
parent 2ca2d02b22
commit 69b6cd431f
100 changed files with 2313 additions and 116 deletions
@@ -0,0 +1,40 @@
+import type { DevToolbarRule } from "./types.ts";
+import { createIssue } from "./helpers.ts";
+
+export const securityRules: DevToolbarRule[] = [
+  {
+    id: "security/page",
+    category: "security",
+    defaultSeverity: "warning",
+    description: "Checks development-visible security mistakes.",
+    run: ({ url, root }) => {
+      const issues = [];
+      for (const [key] of url.searchParams)
+        if (/pass(word)?|token|secret|api[-_]?key/i.test(key))
+          issues.push(
+            createIssue({
+              ruleId: "security/secret-query",
+              category: "security",
+              severity: "error",
+              title: "Potential secret appears in URL",
+              message: `The query parameter “${key}” may contain sensitive information.`,
+              recommendation:
+                "Send secrets in a secure request body or authorization header, not a URL.",
+            }),
+          );
+      for (const form of root.querySelectorAll<HTMLFormElement>('form[action^="http://"]'))
+        issues.push(
+          createIssue({
+            ruleId: "security/insecure-form",
+            category: "security",
+            severity: "error",
+            title: "Form submits over HTTP",
+            message: "Form values may be transmitted without transport encryption.",
+            element: form,
+            recommendation: "Submit to an HTTPS endpoint.",
+          }),
+        );
+      return issues;
+    },
+  },
+];