feat(linter): implement noSecrets

crates/biome_diagnostics_categories/src/categories.rs

@@ -129,6 +129,7 @@ define_categories! {
     "lint/nursery/noExportedImports": "https://biomejs.dev/linter/rules/no-exported-imports",
     "lint/nursery/noImportantInKeyframe": "https://biomejs.dev/linter/rules/no-important-in-keyframe",
     "lint/nursery/noInvalidDirectionInLinearGradient": "https://biomejs.dev/linter/rules/no-invalid-direction-in-linear-gradient",
+    "lint/nursery/noInvalidGridAreas": "https://biomejs.dev/linter/rules/use-consistent-grid-areas",
     "lint/nursery/noInvalidPositionAtImportRule": "https://biomejs.dev/linter/rules/no-invalid-position-at-import-rule",
     "lint/nursery/noIrregularWhitespace": "https://biomejs.dev/linter/rules/no-irregular-whitespace",
     "lint/nursery/noLabelWithoutControl": "https://biomejs.dev/linter/rules/no-label-without-control",
@@ -137,6 +138,7 @@ define_categories! {
     "lint/nursery/noReactSpecificProps": "https://biomejs.dev/linter/rules/no-react-specific-props",
     "lint/nursery/noRestrictedImports": "https://biomejs.dev/linter/rules/no-restricted-imports",
     "lint/nursery/noRestrictedTypes": "https://biomejs.dev/linter/rules/no-restricted-types",
+    "lint/nursery/noSecrets": "https://biomejs.dev/linter/rules/no-secrets",
     "lint/nursery/noShorthandPropertyOverrides": "https://biomejs.dev/linter/rules/no-shorthand-property-overrides",
     "lint/nursery/noStaticElementInteractions": "https://biomejs.dev/linter/rules/no-static-element-interactions",
     "lint/nursery/noSubstr": "https://biomejs.dev/linter/rules/no-substr",
@@ -159,7 +161,6 @@ define_categories! {
     "lint/nursery/useBiomeSuppressionComment": "https://biomejs.dev/linter/rules/use-biome-suppression-comment",
     "lint/nursery/useConsistentBuiltinInstantiation": "https://biomejs.dev/linter/rules/use-consistent-new-builtin",
     "lint/nursery/useConsistentCurlyBraces": "https://biomejs.dev/linter/rules/use-consistent-curly-braces",
-    "lint/nursery/noInvalidGridAreas": "https://biomejs.dev/linter/rules/use-consistent-grid-areas",
     "lint/nursery/useConsistentMemberAccessibility": "https://biomejs.dev/linter/rules/use-consistent-member-accessibility",
     "lint/nursery/useDateNow": "https://biomejs.dev/linter/rules/use-date-now",
     "lint/nursery/useDefaultSwitchClause": "https://biomejs.dev/linter/rules/use-default-switch-clause",

crates/biome_js_analyze/src/lint/nursery.rs

@@ -15,6 +15,7 @@ pub mod no_misplaced_assertion;
 pub mod no_react_specific_props;
 pub mod no_restricted_imports;
 pub mod no_restricted_types;
+pub mod no_secrets;
 pub mod no_static_element_interactions;
 pub mod no_substr;
 pub mod no_undeclared_dependencies;
@@ -62,6 +63,7 @@ declare_lint_group! {
             self :: no_react_specific_props :: NoReactSpecificProps ,
             self :: no_restricted_imports :: NoRestrictedImports ,
             self :: no_restricted_types :: NoRestrictedTypes ,
+            self :: no_secrets :: NoSecrets ,
             self :: no_static_element_interactions :: NoStaticElementInteractions ,
             self :: no_substr :: NoSubstr ,
             self :: no_undeclared_dependencies :: NoUndeclaredDependencies ,

crates/biome_js_analyze/src/lint/nursery/no_secrets.rs

@@ -0,0 +1,130 @@
+use biome_analyze::{context::RuleContext, declare_lint_rule, Ast, Rule, RuleDiagnostic, RuleSource, RuleSourceKind};
+use biome_console::markup;
+
+use biome_js_syntax::JsStringLiteralExpression;
+
+use biome_rowan::AstNode;
+use regex::Regex;
+use std::sync::LazyLock;
+
+// List of sensitive patterns
+const SENSITIVE_PATTERNS: &[&str] = &[
+    r"xox[p|b|o|a]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32}",  // Slack Token
+    r"-----BEGIN RSA PRIVATE KEY-----",  // RSA Private Key
+    r"-----BEGIN OPENSSH PRIVATE KEY-----",  // SSH (OPENSSH) Private Key
+    r"-----BEGIN DSA PRIVATE KEY-----",  // SSH (DSA) Private Key
+    r"-----BEGIN EC PRIVATE KEY-----",  // SSH (EC) Private Key
+    r"-----BEGIN PGP PRIVATE KEY BLOCK-----",  // PGP Private Key Block
+    r#"[fF][aA][cC][eE][bB][oO][oO][kK].*['\"][0-9a-f]{32}['\"]"#,  // Facebook OAuth
+    r#"[tT][wW][iI][tT][tT][eE][rR].*['\"][0-9a-zA-Z]{35,44}['\"]"#,  // Twitter OAuth
+    r#"[gG][iI][tT][hH][uU][bB].*['\"][0-9a-zA-Z]{35,40}['\"]"#,  // GitHub
+    r#""client_secret":"[a-zA-Z0-9-_]{24}""#,  // Google OAuth
+    r"AKIA[0-9A-Z]{16}",  // AWS API Key
+    r"[hH][eE][rR][oO][kK][uU].*[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}",  // Heroku API Key
+    r#"[sS][eE][cC][rR][eE][tT].*['\"][0-9a-zA-Z]{32,45}['\"]"#,  // Generic Secret
+    r#"[aA][pP][iI][_]?[kK][eE][yY].*['\"][0-9a-zA-Z]{32,45}['\"]"#,  // Generic API Key
+    r"https://hooks\.slack\.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}",  // Slack Webhook
+    r#""type": "service_account""#,  // Google (GCP) Service-account
+    r"SK[a-z0-9]{32}",  // Twilio API Key
+    r#"[a-zA-Z]{3,10}://[^/\s:@]{3,20}:[^/\s:@]{3,20}@.{1,100}['"\s]"#,  // Password in URL
+];
+
+// TODO: Try to get this to work in JavaScript comments as well
+declare_lint_rule! {
+    /// Disallow usage of sensitive data such as API keys and tokens.
+    ///
+    /// This rule checks for high-entropy strings and matches common patterns
+    /// for secrets, such as AWS keys, Slack tokens, and private keys.
+    ///
+    /// ## Examples
+    ///
+    /// ### Invalid
+    ///
+    /// ```js,expect_diagnostic
+    /// var secret = "AKIA1234567890EXAMPLE";
+    /// ```
+    ///
+    /// ### Valid
+    ///
+    /// ```js
+    /// var nonSecret = "hello world";
+    /// ```
+    pub NoSecrets {
+        version: "next",
+        name: "noSecrets",
+        language: "js",
+        recommended: false,
+        sources: &[RuleSource::Eslint("no-secrets/no-secrets")],
+        source_kind: RuleSourceKind::Inspired,
+    }
+}
+
+impl Rule for NoSecrets {
+    type Query = Ast<JsStringLiteralExpression>;
+    type State = ();
+    type Signals = Option<Self::State>;
+    type Options = ();
+
+    fn run(ctx: &RuleContext<Self>) -> Self::Signals {
+        let node = ctx.query();
+        let Some(token) = node.value_token().ok() else {
+            return None;
+        };
+        let text = token.text();
+
+        for pattern in SENSITIVE_PATTERNS {
+            let re = LazyLock::new(|| Regex::new(pattern).unwrap());
+            if re.is_match(&text) {
+                return Some(());
+            }
+        }
+
+        if is_high_entropy(&text) {
+            return Some(());
+        }
+
+        None
+    }
+
+    fn diagnostic(ctx: &RuleContext<Self>, _state: &Self::State) -> Option<RuleDiagnostic> {
+        let node = ctx.query();
+        Some(
+            RuleDiagnostic::new(
+                rule_category!(),
+                node.range(),
+                markup! { "Potential secret found." }
+            ).note(markup! { "This looks like a sensitive value such as an API key or token." }) // TODO: Give a more detailed response on the *type* of API Key/token (based on the SENSITIVE PATTERNS)
+        )
+    }
+}
+
+fn is_high_entropy(text: &str) -> bool {
+    let entropy = calculate_shannon_entropy(text);
+    entropy > 4.5  // TODO: Make this optional, or controllable
+}
+
+/**
+ * From https://github.com/nickdeis/eslint-plugin-no-secrets/blob/master/utils.js#L93
+ * Calculates Shannon entropy to measure the randomness of data. High entropy values indicate potentially
+ * secret or sensitive information, as such data is typically more random and less predictable than regular text.
+ * Useful for detecting API keys, passwords, and other secrets within code or configuration files.
+ * @param {*} str
+ */
+fn calculate_shannon_entropy(data: &str) -> f64 {
+    let mut freq = [0usize; 256];
+    let mut len = 0usize;
+    for &byte in data.as_bytes() {
+        freq[byte as usize] += 1;
+        len += 1;
+    }
+
+    let mut entropy = 0.0;
+    for count in freq.iter() {
+        if *count > 0 {
+            let p = *count as f64 / len as f64;
+            entropy -= p * p.log2();
+        }
+    }
+
+    entropy
+}

crates/biome_js_analyze/tests/specs/nursery/noSecrets/invalid.js

@@ -0,0 +1,15 @@
+const apiKey = '12345';
+const password = 'mySecretPassword';
+var secret = "AKIA1234567890EXAMPLE"
+const slackToken = "xoxb-123456789012-123456789012-abcdefghijklmnopqrstuvwx";
+const rsaPrivateKey = "-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIBAAKCAQEA1234567890..."
+const facebookToken = "facebook_app_id_12345abcde67890fghij12345";
+const twitterApiKey = "twitter_api_key_1234567890abcdefghijklmnopqrstuvwxyz";
+const githubToken = "github_pat_1234567890abcdefghijklmnopqrstuvwxyz";
+const clientSecret = "abcdefghijklmnopqrstuvwxyz"
+const herokuApiKey = "heroku_api_key_1234abcd-1234-1234-1234-1234abcd5678";
+const genericSecret = "secret_1234567890abcdefghijklmnopqrstuvwxyz";
+const genericApiKey = "api_key_1234567890abcdefghijklmnopqrstuvwxyz";
+const slackKey = "https://hooks.slack.com/services/T12345678/B12345678/abcdefghijklmnopqrstuvwx"
+const twilioApiKey = "SK1234567890abcdefghijklmnopqrstuv";
+const dbUrl = "postgres://user:password123@example.com:5432/dbname";