SonarJS Has 269 Rules. It Still Misses 65% of Security Vulnerabilities.

Vulnerable Code Detections (out of 40 patterns):

Interlace:   ████████████████████████████████████████  40/40 (100%)
SonarJS:     ██████████████░░░░░░░░░░░░░░░░░░░░░░░░░░  14/40 (35%)

// Test 1: String concatenation — MISSED by SonarJS ❌ | Interlace ✅
export function vuln_sql_string_concat(userId) {
  const query = "SELECT * FROM users WHERE id = '" + userId + "'";
  return db.query(query);
}
// Interlace: pg/no-sql-injection, secure-coding/database-injection

// Test 2: Template literal — MISSED by SonarJS ❌ | Interlace ✅
export function vuln_sql_template_literal(email) {
  const query = `SELECT * FROM users WHERE email = '${email}'`;
  return db.query(query);
}

// Test 3: Dynamic column name — MISSED by SonarJS ❌ | Interlace ✅
export function vuln_sql_dynamic_column(sortColumn) {
  const query = `SELECT * FROM users ORDER BY ${sortColumn}`;
  return db.query(query);
}

// Test 4: Conditional query building — MISSED by SonarJS ❌ | Interlace ✅
export function vuln_sql_conditional(filters) {
  let query = "SELECT * FROM products WHERE 1=1";
  if (filters.name) {
    query += ` AND name = '${filters.name}'`;
  }
  return db.query(query);
}

// Test 1: exec() with concatenation — SonarJS ✅ sonarjs/os-command | Interlace ✅
export function vuln_cmd_exec_concat(filename) {
  const { exec } = require("child_process");
  exec("ls -la " + filename, callback);
}
// SonarJS: "Make sure that executing this OS command is safe here."

// Test 2: exec() with template literal — SonarJS ✅ sonarjs/os-command | Interlace ✅
export function vuln_cmd_exec_template(filename) {
  const { exec } = require("child_process");
  exec(`convert ${filename} output.png`, callback);
}

// Test 3: execSync() — SonarJS ✅ sonarjs/os-command | Interlace ✅
export function vuln_cmd_execsync(command) {
  const { execSync } = require("child_process");
  return execSync(command).toString();
}

// Test 4: spawn() with shell: true — SonarJS ✅ sonarjs/os-command | Interlace ✅
export function vuln_cmd_spawn_shell(userCommand) {
  const { spawn } = require("child_process");
  return spawn(userCommand, { shell: true });
}

// Test 1: path.join with user input — MISSED by SonarJS ❌ | Interlace ✅
export function vuln_path_join(filename) {
  const filepath = path.join("./uploads", filename);
  return fs.readFileSync(filepath);
}

// Test 2: String concatenation — MISSED by SonarJS ❌ | Interlace ✅
export function vuln_path_concat(userId) {
  return fs.readFileSync("./data/" + userId + "/profile.json");
}

// Test 3: No validation — MISSED by SonarJS ❌ | Interlace ✅
export async function vuln_path_no_validation(userDir) {
  return fs.readdir(`./storage/${userDir}`);
}

// Test 4: URL pathname — MISSED by SonarJS ❌ | Interlace ✅
export function vuln_path_url_pathname(url) {
  const parsedUrl = new URL(url);
  return fs.readFileSync(`./static${parsedUrl.pathname}`);
}

// Test 1: Database password — SonarJS ✅ sonarjs/no-hardcoded-passwords | Interlace ✅
export function vuln_creds_db_password() {
  return new Pool({
    password: "secretPassword123", // ← SonarJS: "Review this potentially hard-coded password."
  });
}

// Test 2: API key — MISSED by SonarJS ❌ | Interlace ✅
export function vuln_creds_api_key() {
  const apiKey = "sk-prod-abc123def456ghi789jkl012mno345pqr678";
  return fetch("https://api.example.com", {
    headers: { Authorization: `Bearer ${apiKey}` },
  });
}

// Test 3: AWS credentials — MISSED by SonarJS ❌ | Interlace ✅
export function vuln_creds_aws() {
  AWS.config.update({
    accessKeyId: "AKIAIOSFODNN7EXAMPLE",
    secretAccessKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
  });
}

// Test 4: JWT secret — SonarJS ✅ sonarjs/hardcoded-secret-signatures | Interlace ✅
export function vuln_creds_jwt_secret(user) {
  return jwt.sign(user, "my-super-secret-jwt-key-12345");
}
// SonarJS: "Revoke and change this password, as it is compromised."

// Test 1: Algorithm "none" — SonarJS ✅ sonarjs/insecure-jwt-token | Interlace ✅
export function vuln_jwt_alg_none(token) {
  return jwt.verify(token, "secret", { algorithms: ["none", "HS256"] });
}
// SonarJS: "Use only strong cipher algorithms when verifying the signature of this JWT."

// Test 2: No algorithm restriction — MISSED by SonarJS ❌ | Interlace ✅
export function vuln_jwt_no_algorithm(token, secret) {
  return jwt.verify(token, secret); // No algorithms specified - accepts any
}
// Interlace: jwt/require-algorithm-restriction

// Test 3: No expiration — MISSED by SonarJS ❌ | Interlace ✅
export function vuln_jwt_no_expiry(user) {
  return jwt.sign(user, process.env.JWT_SECRET); // Token never expires
}
// Interlace: jwt/require-expiration

// Test 1: innerHTML — MISSED by SonarJS ❌ | Interlace ✅
export function vuln_xss_innerhtml(userContent) {
  document.getElementById("output").innerHTML = userContent;
}
// Interlace: browser-security/no-inner-html

// Test 2: document.write — MISSED by SonarJS ❌ | Interlace ✅
export function vuln_xss_document_write(userInput) {
  document.write("<div>" + userInput + "</div>");
}
// Interlace: browser-security/no-document-write

// Test 3: eval() — SonarJS ✅ sonarjs/code-eval | Interlace ✅
export function vuln_xss_eval(userCode) {
  return eval(userCode);
}
// SonarJS: "Make sure that this dynamic injection or execution of code is safe."

// Test 4: new Function() — SonarJS ✅ sonarjs/code-eval | Interlace ✅
export function vuln_xss_new_function(userCode) {
  const fn = new Function(userCode);
  return fn();
}

// Test 1: Bracket notation — MISSED by SonarJS ❌ | Interlace ✅
export function vuln_proto_bracket(obj, key, value) {
  obj[key] = value; // key could be "__proto__"
  return obj;
}

// Test 2: Deep nested manipulation — MISSED by SonarJS ❌ | Interlace ✅
export function vuln_proto_nested(obj, path, value) {
  const keys = path.split(".");
  let current = obj;
  for (let i = 0; i < keys.length - 1; i++) {
    current = current[keys[i]];
  }
  current[keys[keys.length - 1]] = value;
}

// Test 3: Object.assign with parsed JSON — MISSED by SonarJS ❌ | Interlace ✅
export function vuln_proto_assign(userInput) {
  const config = {};
  Object.assign(config, JSON.parse(userInput));
  return config;
}

// Test 1: Math.random() for token — SonarJS ✅ sonarjs/pseudo-random | Interlace ✅
export function vuln_random_token() {
  return Math.random().toString(36).substring(2);
}
// SonarJS: "Make sure that using this pseudorandom number generator is safe here."

// Test 2: Math.random() for session — SonarJS ✅ sonarjs/pseudo-random | Interlace ✅
export function vuln_random_session() {
  return "session_" + Math.floor(Math.random() * 1000000);
}

// Test 1: MD5 hash — SonarJS ✅ sonarjs/hashing | Interlace ✅
export function vuln_crypto_md5(password) {
  return crypto.createHash("md5").update(password).digest("hex");
}
// SonarJS: "Make sure this weak hash algorithm is not used in a sensitive context here."

// Test 2: SHA1 hash — SonarJS ✅ sonarjs/hashing | Interlace ✅
export function vuln_crypto_sha1(sensitiveData) {
  return crypto.createHash("sha1").update(sensitiveData).digest("hex");
}

// Test 3: DES encryption — MISSED by SonarJS ❌ | Interlace ✅
export function vuln_crypto_des(plaintext) {
  const cipher = crypto.createCipher("des", "password");
  return cipher.update(plaintext, "utf8", "hex") + cipher.final("hex");
}
// Interlace: crypto/no-weak-cipher

// Test 1: Direct comparison — MISSED by SonarJS ❌ | Interlace ✅
export function vuln_timing_direct(input, secret) {
  return input === secret;
}
// Interlace: crypto/no-timing-unsafe-compare

// Test 2: Token comparison — MISSED by SonarJS ❌ | Interlace ✅
export function vuln_timing_token(userToken, storedToken) {
  if (userToken === storedToken) {
    return { authenticated: true };
  }
}

// Test 1: MongoDB findOne with user input — MISSED by SonarJS ❌ | Interlace ✅
export async function vuln_nosql_mongo(username) {
  return db.collection("users").findOne({ username });
}
// Interlace: mongodb-security/no-raw-query

// Test 2: $where operator — MISSED by SonarJS ❌ | Interlace ✅
export async function vuln_nosql_where(userInput) {
  return db.collection("users").find({ $where: userInput });
}
// Interlace: mongodb-security/no-where-string

// Test 1: fetch with user URL — MISSED by SonarJS ❌ | Interlace ✅
export async function vuln_ssrf_fetch(userUrl) {
  const response = await fetch(userUrl);
  return response.json();
}
// Interlace: browser-security/no-unvalidated-fetch

// Test 2: axios with user URL — MISSED by SonarJS ❌ | Interlace ✅
export async function vuln_ssrf_axios(endpoint) {
  return axios.get(endpoint);
}

// Test 1: Express redirect — MISSED by SonarJS ❌ | Interlace ✅
export function vuln_redirect(req, res) {
  const returnUrl = req.query.returnTo;
  res.redirect(returnUrl);
}
// Interlace: express-security/no-open-redirect

// Test 1: Evil regex — SonarJS ✅ sonarjs/slow-regex | Interlace ✅
export function vuln_redos_evil(input) {
  const evilRegex = /^(a+)+$/;
  return evilRegex.test(input);
}
// SonarJS: "Make sure the regex used here, which is vulnerable to super-linear runtime
//           due to backtracking, cannot lead to denial of service."

// Test 2: User-controlled regex — MISSED by SonarJS ❌ | Interlace ✅
export function vuln_redos_user(pattern, input) {
  const regex = new RegExp(pattern); // User controls the pattern
  return regex.test(input);
}
// Interlace: secure-coding/detect-non-literal-regexp

// ✅ SAFE: execFile with literal arguments — SonarJS flags ❌
export function safe_cmd_execfile_literal() {
  const { execFile } = require("child_process");
  return execFile("ls", ["-la", "/tmp"]);
}
// SonarJS sonarjs/no-os-command-from-path:
// "Make sure the \"PATH\" variable only contains fixed, unwriteable directories."

// ✅ SAFE: spawn with shell: false — SonarJS flags ❌
export function safe_cmd_spawn_noshell() {
  const { spawn } = require("child_process");
  return spawn("convert", ["input.png", "output.jpg"], { shell: false });
}
// SonarJS sonarjs/no-os-command-from-path (same rule, same false alarm)

// ✅ SAFE: execFile with validated input — SonarJS flags ❌
export function safe_cmd_validated(format) {
  if (!["png", "jpg", "gif"].includes(format)) {
    throw new Error("Invalid format");
  }
  return execFile("convert", ["input.img", `output.${format}`]);
}
// SonarJS sonarjs/no-os-command-from-path (same rule, same false alarm)

// ✅ SAFE: Math.random() for array shuffle — SonarJS flags ❌
export function safe_random_shuffle(array) {
  const shuffled = [...array];
  for (let i = shuffled.length - 1; i > 0; i--) {
    const j = Math.floor(Math.random() * (i + 1));
    [shuffled[i], shuffled[j]] = [shuffled[j], shuffled[i]];
  }
  return shuffled;
}
// SonarJS sonarjs/pseudo-random:
// "Make sure that using this pseudorandom number generator is safe here."

// ✅ SAFE: Simple email regex — SonarJS flags ❌
export function safe_regex_simple(input) {
  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
  return emailRegex.test(input);
}
// SonarJS sonarjs/slow-regex:
// "Make sure the regex used here, which is vulnerable to super-linear runtime
//  due to backtracking, cannot lead to denial of service."

// eslint.config.js — Best of both worlds
import sonarjs from "eslint-plugin-sonarjs";
import secureCoding from "eslint-plugin-secure-coding";
import nodeSecurity from "eslint-plugin-node-security";
import pg from "eslint-plugin-pg";
import jwt from "eslint-plugin-jwt";

export default [
  sonarjs.configs.recommended, // Quality ✅
  secureCoding.configs.recommended, // Security ✅
  nodeSecurity.configs.recommended, // Node.js security ✅
  pg.configs.recommended, // Database security ✅
  jwt.configs.recommended, // Auth security ✅
];

git clone https://github.com/AshDevFr/eslint-benchmark-suite
cd eslint-benchmark-suite
npm install
npm run benchmark:fn-fp