SecurityAuthorization

security/no-user-controlled-authorization

Do not grant access or assign authority from client-controlled roles, permissions, scopes, ownership, tenant, or admin claims without trusted validation.

access-controluntrusted-inputroles

01 Examples

TypeScript

if (req.body.role === "admin") deleteUser(req.params.id);

Finding

Disallow authorization based on attacker-controlled claims.

02 Enable it

Setup

Install the package, register its plugin factory, then enable the rule.

Install the package

pnpm add -D @scruple/security

Register the plugin

In scruple.config.ts, register the factory under the security namespace used by the rule ID.

import { security } from "@scruple/security";

plugins: {
  "security": security(),
},

Enable the rule

"security/no-user-controlled-authorization": "warn"

Package: @scruple/security
Default threshold: 0.9
Minimum confidence: 0.75