Add security lint and rule security tests

- Enable eslint-plugin-security for .markdownlint-rules (eval, non-literal require/fs/regexp, etc.).
- Add test/markdownlint-rules/security.test.js for defensive regex config parsing and ReDoS awareness.
- Document security tests and security lint in CONTRIBUTING and README.

Author: cypher0n3

CONTRIBUTING.md

@@ -54,6 +54,15 @@ These targets mirror the GitHub Actions workflows. Run them locally before pushi
   make test-rules
   ```
 
+#### Rule Security Tests
+
+- **Security tests** (`test/markdownlint-rules/security.test.js`): assert that invalid or malformed regex in rule config does not throw (defensive parsing).
+  A skipped test documents ReDoS risk when rules use user-controlled regex; enable it after adding mitigation (e.g. safe-regex or timeout).
+- **Security lint**: `eslint-plugin-security` is enabled for `.markdownlint-rules` (via `make lint-js`) and forbids `eval`, `new Function`, `child_process`, non-literal `require`/`fs`/`Buffer`, and similar.
+
+These execute as part of `make test-rules` and `make lint-js` respectively.
+`make ci` includes these in all the checks it executes.
+
 ### Python Unit Tests (`make test-python`)
 
 - Unit tests for `test-scripts/` in `test-scripts/test_*.py` (unittest).

Makefile

@@ -27,7 +27,7 @@ lint-readmes:
 #       When adding or modifying JS linting, update both this Makefile and
 #       the workflow file to ensure local 'make lint-js' matches CI behavior.
 #       Requires: Node.js and npm; run 'npm install' (or npm ci) once for node_modules.
-#       Lints .markdownlint-rules/*.js with ESLint (recommended + complexity/max-lines).
+#       Lints .markdownlint-rules/*.js with ESLint (recommended + complexity/max-lines + eslint-plugin-security).
 # Usage: make lint-js [PATHS="path1,path2"]
 #        - PATHS: Comma-separated list of files/directories (default: .markdownlint-rules)
 lint-js:

README.md

@@ -36,9 +36,9 @@ Lint and docs-as-code tooling: custom [markdownlint](https://github.com/DavidAns
       Do not register as a rule in markdownlint.
     - Use when: copying the rule files; required by several of the rules above.
 
-- **JS linting** for the rule code: ESLint (recommended + complexity/max-lines), aligned with the GitHub Actions workflow.
+- **JS linting** for the rule code: ESLint (recommended + complexity/max-lines + eslint-plugin-security), aligned with the GitHub Actions workflow.
 - **Markdownlint fixture tests**: [md_test_files/](md_test_files/README.md) includes positive/negative fixtures with explicit expected errors, verified by `test-scripts/verify_markdownlint_fixtures.py`.
-- **Rule unit tests**: Node `node:test` unit tests for each custom rule in `test/markdownlint-rules/`; run with `make test-rules` or `npm run test:rules`.
+- **Rule unit tests**: Node `node:test` unit tests for each custom rule in `test/markdownlint-rules/` (including security tests for defensive regex handling and ReDoS awareness); run with `make test-rules` or `npm run test:rules`.
 - **Python unit tests**: `unittest` tests for [test-scripts/](test-scripts/README.md) in `test-scripts/test_*.py`; run with `make test-python`.
 - **Python linting** for repo tooling scripts: `make lint-python` (flake8, pylint, xenon/radon, vulture, bandit).
 

eslint.config.cjs

@@ -3,12 +3,13 @@
 const js = require("@eslint/js");
 const globals = require("globals");
 const { defineConfig } = require("eslint/config");
+const eslintPluginSecurity = require("eslint-plugin-security");
 
 module.exports = defineConfig([
   {
     name: "docs-as-code-tools/markdownlint-rules",
     files: [".markdownlint-rules/**/*.js"],
-    plugins: { js },
+    plugins: { js, security: eslintPluginSecurity },
     extends: ["js/recommended"],
     languageOptions: {
       ecmaVersion: 2022,
@@ -20,6 +21,20 @@ module.exports = defineConfig([
       complexity: ["warn", { max: 10 }],
       "max-depth": ["warn", 4],
       "max-params": ["warn", 4],
+      "security/detect-eval-with-expression": "warn",
+      "security/detect-non-literal-require": "warn",
+      "security/detect-child-process": "warn",
+      "security/detect-non-literal-fs-filename": "warn",
+      "security/detect-new-buffer": "warn",
+      "security/detect-buffer-noassert": "warn",
+      "security/detect-disable-mustache-escape": "warn",
+      "security/detect-no-csrf-before-method-override": "warn",
+      "security/detect-possible-timing-attacks": "warn",
+      "security/detect-pseudoRandomBytes": "warn",
+      "security/detect-bidi-characters": "warn",
+      "security/detect-non-literal-regexp": "warn",
+      "security/detect-object-injection": "off",
+      "security/detect-unsafe-regex": "off",
     },
   },
 ]);

package-lock.json

@@ -8,6 +8,7 @@
   "devDependencies": {
     "@eslint/js": "^9.0.0",
     "eslint": "^9.15.0",
+    "eslint-plugin-security": "^3.0.1",
     "globals": "^15.0.0",
     "markdownlint-cli2": "^0.14.0"
   }

package.json

@@ -0,0 +1,46 @@
+"use strict";
+
+/**
+ * Security-focused tests for .markdownlint-rules:
+ * - Invalid or malicious regex in config does not throw (safeRegExp / defensive parsing).
+ * - Rules complete within a timeout when given ReDoS-prone patterns and long input
+ *   (ensures we don't hang on malicious or accidental catastrophic backtracking).
+ */
+
+const { describe, it } = require("node:test");
+const assert = require("node:assert");
+const ruleAnchors = require("../../.markdownlint-rules/allow-custom-anchors.js");
+const { runRule } = require("./run-rule.js");
+
+describe("security", () => {
+  describe("allow-custom-anchors: invalid regex in config", () => {
+    it("does not throw when allowedIdPatterns contains invalid regex", () => {
+      const lines = ["<a id=\"x\"></a>"];
+      assert.doesNotThrow(() => {
+        runRule(ruleAnchors, lines, { allowedIdPatterns: ["["] });
+      });
+    });
+
+    it("does not throw when placement has invalid headingMatch regex", () => {
+      const lines = ["<a id=\"ok\"></a>"];
+      const config = {
+        allowedIdPatterns: [
+          { pattern: "^ok$", placement: { headingMatch: "(" } },
+        ],
+      };
+      assert.doesNotThrow(() => {
+        runRule(ruleAnchors, lines, config);
+      });
+    });
+  });
+
+  describe("allow-custom-anchors: ReDoS awareness", () => {
+    it("ReDoS: user-controlled regex can cause catastrophic backtracking (mitigation TBD)", { skip: "Current implementation is susceptible; enable when safe-regex or timeout is added." }, () => {
+      const longId = "a".repeat(35) + "X";
+      const lines = [`<a id="${longId}"></a>`];
+      const config = { allowedIdPatterns: ["(a+)+$"] };
+      const errors = runRule(ruleAnchors, lines, config);
+      assert.ok(Array.isArray(errors));
+    });
+  });
+});