New Published Rules - rules.vitejs-loadenv-direct-use

rules/vitejs-loadenv-direct-use.tsx

@@ -0,0 +1,55 @@
+import { defineConfig, loadEnv } from 'vite';  
+
+export default defineConfig(({ mode }) => {
+  // ruleid: vitejs-loadenv-direct-use
+  const env = loadEnv(mode, process.cwd(), '');
+
+  return {
+    define: {
+    "process.env": env
+    }
+  }
+});
+
+// testing variations in quote and variable propagation
+const altConfig = defineConfig(({ mode }) => {
+  // ruleid: vitejs-loadenv-direct-use
+  const env = loadEnv(mode, process.cwd(), "");
+  let xyz = env;
+  var abc = xyz;
+
+  return {
+    define: {
+    'process.env': abc
+    }
+  }
+});
+
+
+const goodConfig = defineConfig(({ mode }) => {
+  // ok: vitejs-loadenv-direct-use
+  const safe = loadEnv(mode, process.cwd(), "APP_");
+
+  return {
+    define: {
+    'process.env': safe
+    }
+  }
+});
+
+/* for taint scenarios, use the vitejs-loadenv-direct-use-tainted.yaml file */
+const taintConfig = defineConfig(({ mode }) => {
+  // const env = loadEnv(mode, process.cwd(), "");
+  const env = {};
+
+  return {
+    define: {
+      // Provide an explicit app-level constant derived from an env var.
+      __APP_ENV__: JSON.stringify(env.APP_ENV),
+    },
+    // Example: use an env var to set the dev server port conditionally.
+    server: {
+      port: env.APP_PORT ? Number(env.APP_PORT) : 5173,
+    },
+  }
+});

rules/vitejs-loadenv-direct-use.yaml

@@ -0,0 +1,35 @@
+rules:
+- id: vitejs-loadenv-direct-use
+  languages:
+  - typescript
+  severity: ERROR
+  message: Directly passing `process.env` to ViteJS via a `loadEnv($...ARGS,$PREFIX)`
+    call is dangerous as the **empty prefix ($PREFIX)** matches all environment variables.
+    This could potentially result in backend environment variables being leaked into
+    frontend JS bundles.
+  patterns:
+  - pattern: loadEnv($...ARGS,$PREFIX)
+  - metavariable-regex:
+      metavariable: $PREFIX
+      regex: '[''"][''"]'
+  fix: loadEnv($...ARGS, "SOME_PREFIX")
+  paths:
+    include:
+    - vite.config.ts
+    - vite.config.js
+  focus-metavariable: $PREFIX
+  metadata:
+    cwe: 'CWE-402: Transmission of Private Resources into a New Sphere (''Resource
+      Leak'')'
+    technology:
+    - javascript
+    references:
+    - https://kawing-ho.github.io/research/posts/footguns-beware/#2-vitejs-processenv-direct-use
+    category: security
+    owasp: A08:2025 Software or Data Integrity Failures
+    confidence: HIGH
+    likelihood: LOW
+    impact: HIGH
+    subcategory:
+    - vuln
+    vulnerability_class: Dangerous Method or Function