require-secure-deletion

Quick Summary

Vulnerability and Risk

Vulnerability: Incomplete cleanup occurs when sensitive information is removed from an object or variable but remains in memory or is not properly cleared before being reused or released.

Risk: Attackers with local memory access or via side-channel attacks can potentially recover sensitive data that was not securely "wiped". In JavaScript, the delete operator only removes a property reference, but does not overwrite the actual memory content.

Error Message Format

The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:

🔒 CWE-459 OWASP:M9 | Insecure Deletion detected | MEDIUM [DataCleanup]
   Fix: Review deletion pattern; ensure sensitive data is wiped or overwritten | https://cwe.mitre.org/data/definitions/459.html

Message Components

Rule Details

This rule flags delete on a sensitive, statically known property — password, secret, apiKey, token, privateKey, sessionId, creditCard and friends. delete unbinds a property; it does not scrub the value, and any other reference to it (a spread copy, a log line, an already-serialised response body) keeps the secret alive.

Ordinary property deletion (delete options.cacheable, delete acc[key]) is not reported. Before v4.5.0 this rule fired on every delete expression, which produced 120 findings across a 1,470-file corpus with no security content in any of them — it was a delete detector, not a secret-cleanup detector.

Why This Matters

Configuration

{
  "node-security/require-secure-deletion": [
    "warn",
    { "additionalSensitiveProperties": ["pincode", "recoveryphrase"] }
  ]
}

Examples

❌ Incorrect

// Simply deleting a sensitive property
const user = { username: 'john', password: 'secret_password_123' };
delete user.password; // ❌ Reference removed, but data remains in memory

delete session.refreshToken;   // ❌
delete payload['accessToken']; // ❌ computed access with a literal key
delete user?.privateKey;       // ❌ optional chaining

✅ Correct

// Securely wiping a Buffer containing sensitive data
const sensitiveBuffer = Buffer.from('secret_key');
// ... use buffer ...
sensitiveBuffer.fill(0); // ✅ Clear memory explicitly

// Non-sensitive property deletion is not this rule's business
delete options.cacheable;  // ✅
delete stats.children;     // ✅
delete acc[dynamicKey];    // ✅ property name not statically known

Known False Negatives

The following patterns are not detected due to static analysis limitations:

Values from Variables

Why: Values stored in variables are not traced.

// ❌ NOT DETECTED
const key = 'password';
delete user[key];

Mitigation: Review all dynamic property access involving sensitive objects.

Garbage Collection Reliance

Why: This rule cannot detect if a developer is correctly relying on garbage collection for non-sensitive data.

Mitigation: Differentiate between "cleanup" for memory management and "secure wipe" for security.

References

• CWE-459: Incomplete Cleanup
• OWASP Secure Coding: Data Destruction

⚙️ Options