@eslint-sh/eslint-plugin 0.5.0 → 0.7.0

package/dist/rules/no-eval.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Message ids this rule reports with: `noEval` for any `eval`, and
+ * `dynamicSource` for a `source` / `.` whose path word is not static.
+ *
+ * @internal
+ */
+export type NoEvalMessageId = 'noEval' | 'dynamicSource';
+/**
+ * The `sh/no-eval` rule module.
+ *
+ * @internal
+ */
+export declare const noEval: import("./define-shell-rule.js").ShellRule<[], NoEvalMessageId>;

package/dist/rules/no-eval.js

@@ -0,0 +1,89 @@
+/**
+ * `sh/no-eval`: reports shell code whose text is only assembled at run time,
+ * and therefore cannot be reviewed before it runs.
+ *
+ * Two constructs break eslint-sh's review contract this way:
+ *
+ * - **`eval`**, in any form. The arguments `eval` runs are re-parsed as shell
+ *   code when the line executes, so the code a reviewer reads is not the code
+ *   that runs. Even `eval "literal"` is reported: the literal is still a second
+ *   layer of shell parsing that tooling (this linter included) never sees as
+ *   commands. `eval` is recognized as the *effective* command, after following
+ *   transparent wrappers (`command eval …`, `builtin eval …`, `exec eval …`)
+ *   through `ShellSourceCode.resolveInvokedCommand`.
+ * - **`source` / `.` of a non-static path.** Loading a file whose path is only
+ *   known at run time (`source "$DIR/lib.sh"`, `. $(pick)`) runs code the
+ *   reviewer cannot locate. Like `eval`, it is recognized as the effective
+ *   command, so `command source "$p"` and `builtin . "$p"` report too; the
+ *   path is the word after the effective command in the call's arguments. A path word is static exactly when
+ *   `ShellSourceCode.resolveWordText` resolves it; this rule never decides
+ *   static-ness itself.
+ *
+ * Out of scope, by design: a command word that is itself dynamic
+ * (`$cmd args`) and embedded command strings (`bash -c "$x"`) belong to
+ * `no-dynamic-invocation`. The rule has no options and offers no fix or
+ * suggestion, because no mechanical rewrite of `eval` preserves behavior.
+ */
+import { DEFAULT_TRANSPARENT_WRAPPERS } from 'sh-ast/analyze';
+import { createRule } from './create-rule.js';
+import { BUILTIN_WRAPPER } from './transparent-wrappers.js';
+/** The registry name of this rule (`sh/no-eval` in a user's config). */
+const RULE_NAME = 'no-eval';
+/**
+ * The wrappers followed to find the command an invocation actually runs:
+ * `sh-ast/analyze`'s defaults (`command`, `exec`, `env`, `sudo`, …) plus
+ * Bash's `builtin`, so `builtin eval …` is recognized as `eval`.
+ */
+const TRANSPARENT_WRAPPERS = [
+    ...DEFAULT_TRANSPARENT_WRAPPERS,
+    BUILTIN_WRAPPER,
+];
+/** The command names that load and run another file in the current shell. */
+const SOURCE_COMMANDS = new Set(['source', '.']);
+/**
+ * The `sh/no-eval` rule module.
+ *
+ * @internal
+ */
+export const noEval = createRule({
+    name: RULE_NAME,
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow `eval`, and `source` or `.` of a path that is not a static literal',
+        },
+        schema: [],
+        messages: {
+            noEval: '`eval` runs text as shell code at run time, so the code it executes cannot be statically reviewed. Write the commands directly instead.',
+            dynamicSource: '`{{command}}` loads a path that is not a static literal, so the code it runs cannot be statically reviewed. Use a literal path instead.',
+        },
+    },
+    create(context) {
+        const { sourceCode } = context;
+        return {
+            CallExpr(node) {
+                const invoked = sourceCode.resolveInvokedCommand(node, {
+                    transparentWrappers: TRANSPARENT_WRAPPERS,
+                });
+                if (!invoked?.effective.static) {
+                    return;
+                }
+                const command = invoked.effective.text;
+                if (command === 'eval') {
+                    context.report({ node, messageId: 'noEval' });
+                    return;
+                }
+                if (!SOURCE_COMMANDS.has(command)) {
+                    return;
+                }
+                // The path is the word right after the effective command, wherever the
+                // wrapper chain placed that command in the call's arguments.
+                const effectiveIndex = invoked.chainIndices.at(-1);
+                const path = effectiveIndex === undefined ? undefined : node.args[effectiveIndex + 1];
+                if (path !== undefined && sourceCode.resolveWordText(path) === null) {
+                    context.report({ node: path, messageId: 'dynamicSource', data: { command } });
+                }
+            },
+        };
+    },
+});

package/dist/rules/no-masked-exit-status.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The rule's single options object.
+ *
+ * @internal
+ */
+export interface NoMaskedExitStatusOptions {
+    /** Report only where `errexit` is known to be on. Defaults to `false`. */
+    readonly onlyWithErrexit?: boolean;
+    /**
+     * With `onlyWithErrexit`, count options on the shebang line (`#!/bin/bash -e`)
+     * as enabled, as `require-strict-mode`'s option of the same name does.
+     * Defaults to `false`.
+     */
+    readonly allowShebangOnly?: boolean;
+    /** The declaration builtins to check. Defaults to all five. */
+    readonly builtins?: readonly string[];
+}
+/** Message ids this rule reports with. @internal */
+export type NoMaskedExitStatusMessageId = 'maskedExitStatus' | 'declareThenAssign' | 'assignThenExport' | 'assignThenReadonly';
+/** Built-in rule `sh/no-masked-exit-status`. @internal */
+export declare const noMaskedExitStatus: import("./define-shell-rule.js").ShellRule<[NoMaskedExitStatusOptions], NoMaskedExitStatusMessageId>;