@eslint/json 0.8.0 → 0.9.0

package/README.md

@@ -30,9 +30,9 @@ deno add @eslint/json
 
 This package exports these languages:
 
--   `"json/json"` is for regular JSON files
--   `"json/jsonc"` is for JSON files that support comments ([JSONC](https://github.com/microsoft/node-jsonc-parser)) such as those used for Visual Studio Code configuration files
--   `"json/json5"` is for [JSON5](https://json5.org) files
+- `"json/json"` is for regular JSON files
+- `"json/jsonc"` is for JSON files that support comments ([JSONC](https://github.com/microsoft/node-jsonc-parser)) such as those used for Visual Studio Code configuration files
+- `"json/json5"` is for [JSON5](https://json5.org) files
 
 Depending on which types of JSON files you'd like to lint, you can set up your `eslint.config.js` file to include just the files you'd like. Here's an example that lints JSON, JSONC, and JSON5 files:
 
@@ -152,10 +152,16 @@ export default [
 
 ## Rules
 
--   `no-duplicate-keys` - warns when there are two keys in an object with the same text.
--   `no-empty-keys` - warns when there is a key in an object that is an empty string or contains only whitespace (note: `package-lock.json` uses empty keys intentionally)
--   `no-unsafe-values` - warns on values that are unsafe for interchange, such as numbers outside safe range or lone surrogates.
--   `no-unnormalized-keys` - warns on keys containing [unnormalized characters](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/normalize#description). You can optionally specify the normalization form via `{ form: "form_name" }`, where `form_name` can be any of `"NFC"`, `"NFD"`, `"NFKC"`, or `"NFKD"`.
+- `no-duplicate-keys` - warns when there are two keys in an object with the same text.
+- `no-empty-keys` - warns when there is a key in an object that is an empty string or contains only whitespace (note: `package-lock.json` uses empty keys intentionally)
+- `no-unsafe-values` - warns on values that are unsafe for interchange, such
+  as strings with unmatched
+  [surrogates](https://en.wikipedia.org/wiki/UTF-16), numbers that evaluate to
+  Infinity, numbers that evaluate to zero unintentionally, numbers that look
+  like integers but are too large, and
+  [subnormal numbers](https://en.wikipedia.org/wiki/Subnormal_number).
+- `no-unnormalized-keys` - warns on keys containing [unnormalized characters](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/normalize#description). You can optionally specify the normalization form via `{ form: "form_name" }`, where `form_name` can be any of `"NFC"`, `"NFD"`, `"NFKC"`, or `"NFKD"`.
+- `top-level-interop` - warns when the top-level item in the document is neither an array nor an object. This can be enabled to ensure maximal interoperability with the oldest JSON parsers.
 
 ## Configuration Comments
 
@@ -222,8 +228,8 @@ export default [
 
 This plugin implements JSON parsing for ESLint using the language plugins API, which is the official way of supporting non-JavaScript languages in ESLint. This differs from the other plugins:
 
--   `eslint-plugin-json` uses a processor to parse the JSON, meaning it doesn't create an AST and you can't write custom rules for it.
--   `eslint-plugin-jsonc` uses a parser that still goes through the JavaScript linting functionality and requires several rules to disallow valid JavaScript syntax that is invalid in JSON.
+- `eslint-plugin-json` uses a processor to parse the JSON, meaning it doesn't create an AST and you can't write custom rules for it.
+- `eslint-plugin-jsonc` uses a parser that still goes through the JavaScript linting functionality and requires several rules to disallow valid JavaScript syntax that is invalid in JSON.
 
 As such, this plugin is more robust and faster than the others. You can write your own custom rules when using the languages in this plugin, too.
 
@@ -251,7 +257,7 @@ to get your logo on our READMEs and [website](https://eslint.org/sponsors).
 <p><a href="https://automattic.com"><img src="https://images.opencollective.com/automattic/d0ef3e1/logo.png" alt="Automattic" height="128"></a> <a href="https://www.airbnb.com/"><img src="https://images.opencollective.com/airbnb/d327d66/logo.png" alt="Airbnb" height="128"></a></p><h3>Gold Sponsors</h3>
 <p><a href="https://trunk.io/"><img src="https://images.opencollective.com/trunkio/fb92d60/avatar.png" alt="trunk.io" height="96"></a></p><h3>Silver Sponsors</h3>
 <p><a href="https://www.serptriumph.com/"><img src="https://images.opencollective.com/serp-triumph5/fea3074/logo.png" alt="SERP Triumph" height="64"></a> <a href="https://www.jetbrains.com/"><img src="https://images.opencollective.com/jetbrains/fe76f99/logo.png" alt="JetBrains" height="64"></a> <a href="https://liftoff.io/"><img src="https://images.opencollective.com/liftoff/5c4fa84/logo.png" alt="Liftoff" height="64"></a> <a href="https://americanexpress.io"><img src="https://avatars.githubusercontent.com/u/3853301?v=4" alt="American Express" height="64"></a> <a href="https://www.workleap.com"><img src="https://avatars.githubusercontent.com/u/53535748?u=d1e55d7661d724bf2281c1bfd33cb8f99fe2465f&v=4" alt="Workleap" height="64"></a></p><h3>Bronze Sponsors</h3>
-<p><a href="https://cybozu.co.jp/"><img src="https://images.opencollective.com/cybozu/933e46d/logo.png" alt="Cybozu" height="32"></a> <a href="https://syntax.fm"><img src="https://github.com/syntaxfm.png" alt="Syntax" height="32"></a> <a href="https://www.wordhint.net/"><img src="https://images.opencollective.com/wordhint/be86813/avatar.png" alt="WordHint" height="32"></a> <a href="https://www.crosswordsolver.org/anagram-solver/"><img src="https://images.opencollective.com/anagram-solver/2666271/logo.png" alt="Anagram Solver" height="32"></a> <a href="https://icons8.com/"><img src="https://images.opencollective.com/icons8/7fa1641/logo.png" alt="Icons8" height="32"></a> <a href="https://discord.com"><img src="https://images.opencollective.com/discordapp/f9645d9/logo.png" alt="Discord" height="32"></a> <a href="https://www.gitbook.com"><img src="https://avatars.githubusercontent.com/u/7111340?v=4" alt="GitBook" height="32"></a> <a href="https://nx.dev"><img src="https://avatars.githubusercontent.com/u/23692104?v=4" alt="Nx" height="32"></a> <a href="https://herocoders.com"><img src="https://avatars.githubusercontent.com/u/37549774?v=4" alt="HeroCoders" height="32"></a></p>
+<p><a href="https://cybozu.co.jp/"><img src="https://images.opencollective.com/cybozu/933e46d/logo.png" alt="Cybozu" height="32"></a> <a href="https://syntax.fm"><img src="https://github.com/syntaxfm.png" alt="Syntax" height="32"></a> <a href="https://www.wordhint.net/"><img src="https://images.opencollective.com/wordhint/be86813/avatar.png" alt="WordHint" height="32"></a> <a href="https://www.crosswordsolver.org/anagram-solver/"><img src="https://images.opencollective.com/anagram-solver/2666271/logo.png" alt="Anagram Solver" height="32"></a> <a href="https://icons8.com/"><img src="https://images.opencollective.com/icons8/7fa1641/logo.png" alt="Icons8" height="32"></a> <a href="https://discord.com"><img src="https://images.opencollective.com/discordapp/f9645d9/logo.png" alt="Discord" height="32"></a> <a href="https://www.gitbook.com"><img src="https://avatars.githubusercontent.com/u/7111340?v=4" alt="GitBook" height="32"></a> <a href="https://nx.dev"><img src="https://avatars.githubusercontent.com/u/23692104?v=4" alt="Nx" height="32"></a> <a href="https://opensource.mercedes-benz.com/"><img src="https://avatars.githubusercontent.com/u/34240465?v=4" alt="Mercedes-Benz Group" height="32"></a> <a href="https://herocoders.com"><img src="https://avatars.githubusercontent.com/u/37549774?v=4" alt="HeroCoders" height="32"></a></p>
 <h3>Technology Sponsors</h3>
 Technology sponsors allow us to use their products and services for free as part of a contribution to the open source ecosystem and our work.
 <p><a href="https://netlify.com"><img src="https://raw.githubusercontent.com/eslint/eslint.org/main/src/assets/images/techsponsors/netlify-icon.svg" alt="Netlify" height="32"></a> <a href="https://algolia.com"><img src="https://raw.githubusercontent.com/eslint/eslint.org/main/src/assets/images/techsponsors/algolia-icon.svg" alt="Algolia" height="32"></a> <a href="https://1password.com"><img src="https://raw.githubusercontent.com/eslint/eslint.org/main/src/assets/images/techsponsors/1password-icon.svg" alt="1Password" height="32"></a></p>

package/dist/cjs/index.cjs

@@ -543,6 +543,12 @@ var noEmptyKeys = {
  * @author Bradley Meck Farias
  */
 
+// RFC 8259's `number` production, as a regex.  Capture the integer part
+// and the fractional part.
+const NUMBER =
+	/^-?(?<int>0|([1-9][0-9]*))(?:\.(?<frac>[0-9]+))?(?:[eE][+-]?[0-9]+)?$/u;
+const NON_ZERO = /[1-9]/u;
+
 var noUnsafeValues = {
 	meta: {
 		type: /** @type {const} */ ("problem"),
@@ -552,7 +558,12 @@ var noUnsafeValues = {
 		},
 
 		messages: {
-			unsafeNumber: "Number outside safe range found.",
+			unsafeNumber: "The number '{{ value }}' will evaluate to Infinity.",
+			unsafeInteger:
+				"The integer '{{ value }}' is outside the safe integer range.",
+			unsafeZero: "The number '{{ value }}' will evaluate to zero.",
+			subnormal:
+				"Unexpected subnormal number '{{ value }}' found, which may cause interoperability issues.",
 			loneSurrogate: "Lone surrogate '{{ surrogate }}' found.",
 		},
 	},
@@ -560,11 +571,64 @@ var noUnsafeValues = {
 	create(context) {
 		return {
 			Number(node) {
+				const value = context.sourceCode.getText(node);
+
 				if (Number.isFinite(node.value) !== true) {
 					context.report({
 						loc: node.loc,
 						messageId: "unsafeNumber",
+						data: { value },
 					});
+				} else {
+					// Also matches -0, intentionally
+					if (node.value === 0) {
+						// If the value has been rounded down to 0, but there was some
+						// fraction or non-zero part before the e-, this is a very small
+						// number that doesn't fit inside an f64.
+						const match = value.match(NUMBER);
+						// assert(match, "If the regex is right, match is always truthy")
+
+						// If any part of the number other than the exponent has a
+						// non-zero digit in it, this number was not intended to be
+						// evaluated down to a zero.
+						if (
+							NON_ZERO.test(match.groups.int) ||
+							NON_ZERO.test(match.groups.frac)
+						) {
+							context.report({
+								loc: node.loc,
+								messageId: "unsafeZero",
+								data: { value },
+							});
+						}
+					} else if (!/[.e]/iu.test(value)) {
+						// Intended to be an integer
+						if (
+							node.value > Number.MAX_SAFE_INTEGER ||
+							node.value < Number.MIN_SAFE_INTEGER
+						) {
+							context.report({
+								loc: node.loc,
+								messageId: "unsafeInteger",
+								data: { value },
+							});
+						}
+					} else {
+						// Floating point.  Check for subnormal.
+						const buffer = new ArrayBuffer(8);
+						const view = new DataView(buffer);
+						view.setFloat64(0, node.value, false);
+						const asBigInt = view.getBigUint64(0, false);
+						// Subnormals have an 11-bit exponent of 0 and a non-zero mantissa.
+						if ((asBigInt & 0x7ff0000000000000n) === 0n) {
+							context.report({
+								loc: node.loc,
+								messageId: "subnormal",
+								// Value included so that it's seen in scientific notation
+								data: node,
+							});
+						}
+					}
 				}
 			},
 			String(node) {
@@ -654,6 +718,42 @@ var noUnnormalizedKeys = {
 	},
 };
 
+/**
+ * @fileoverview Rule to ensure top-level items are either an array or ojbect.
+ * @author Joe Hildebrand
+ */
+
+var topLevelInterop = {
+	meta: {
+		type: /** @type {const} */ ("problem"),
+
+		docs: {
+			description:
+				"Require the JSON top-level value to be an array or object",
+		},
+
+		messages: {
+			topLevel:
+				"Top level item should be array or object, got '{{type}}'.",
+		},
+	},
+
+	create(context) {
+		return {
+			Document(node) {
+				const { type } = node.body;
+				if (type !== "Object" && type !== "Array") {
+					context.report({
+						loc: node.loc,
+						messageId: "topLevel",
+						data: { type },
+					});
+				}
+			},
+		};
+	},
+};
+
 /**
  * @fileoverview JSON plugin.
  * @author Nicholas C. Zakas
@@ -667,7 +767,7 @@ var noUnnormalizedKeys = {
 const plugin = {
 	meta: {
 		name: "@eslint/json",
-		version: "0.8.0", // x-release-please-version
+		version: "0.9.0", // x-release-please-version
 	},
 	languages: {
 		json: new JSONLanguage({ mode: "json" }),
@@ -679,6 +779,7 @@ const plugin = {
 		"no-empty-keys": noEmptyKeys,
 		"no-unsafe-values": noUnsafeValues,
 		"no-unnormalized-keys": noUnnormalizedKeys,
+		"top-level-interop": topLevelInterop,
 	},
 	configs: {
 		recommended: {

package/dist/cjs/index.d.cts

@@ -210,6 +210,9 @@ declare namespace plugin {
                 };
                 messages: {
                     unsafeNumber: string;
+                    unsafeInteger: string;
+                    unsafeZero: string;
+                    subnormal: string;
                     loneSurrogate: string;
                 };
             };
@@ -241,6 +244,20 @@ declare namespace plugin {
                 Member(node: any): void;
             };
         };
+        "top-level-interop": {
+            meta: {
+                type: "problem";
+                docs: {
+                    description: string;
+                };
+                messages: {
+                    topLevel: string;
+                };
+            };
+            create(context: any): {
+                Document(node: any): void;
+            };
+        };
     };
     namespace configs {
         namespace recommended {

package/dist/esm/index.d.ts

@@ -210,6 +210,9 @@ declare namespace plugin {
                 };
                 messages: {
                     unsafeNumber: string;
+                    unsafeInteger: string;
+                    unsafeZero: string;
+                    subnormal: string;
                     loneSurrogate: string;
                 };
             };
@@ -241,6 +244,20 @@ declare namespace plugin {
                 Member(node: any): void;
             };
         };
+        "top-level-interop": {
+            meta: {
+                type: "problem";
+                docs: {
+                    description: string;
+                };
+                messages: {
+                    topLevel: string;
+                };
+            };
+            create(context: any): {
+                Document(node: any): void;
+            };
+        };
     };
     namespace configs {
         namespace recommended {

package/dist/esm/index.js

@@ -540,6 +540,12 @@ var noEmptyKeys = {
  * @author Bradley Meck Farias
  */
 
+// RFC 8259's `number` production, as a regex.  Capture the integer part
+// and the fractional part.
+const NUMBER =
+	/^-?(?<int>0|([1-9][0-9]*))(?:\.(?<frac>[0-9]+))?(?:[eE][+-]?[0-9]+)?$/u;
+const NON_ZERO = /[1-9]/u;
+
 var noUnsafeValues = {
 	meta: {
 		type: /** @type {const} */ ("problem"),
@@ -549,7 +555,12 @@ var noUnsafeValues = {
 		},
 
 		messages: {
-			unsafeNumber: "Number outside safe range found.",
+			unsafeNumber: "The number '{{ value }}' will evaluate to Infinity.",
+			unsafeInteger:
+				"The integer '{{ value }}' is outside the safe integer range.",
+			unsafeZero: "The number '{{ value }}' will evaluate to zero.",
+			subnormal:
+				"Unexpected subnormal number '{{ value }}' found, which may cause interoperability issues.",
 			loneSurrogate: "Lone surrogate '{{ surrogate }}' found.",
 		},
 	},
@@ -557,11 +568,64 @@ var noUnsafeValues = {
 	create(context) {
 		return {
 			Number(node) {
+				const value = context.sourceCode.getText(node);
+
 				if (Number.isFinite(node.value) !== true) {
 					context.report({
 						loc: node.loc,
 						messageId: "unsafeNumber",
+						data: { value },
 					});
+				} else {
+					// Also matches -0, intentionally
+					if (node.value === 0) {
+						// If the value has been rounded down to 0, but there was some
+						// fraction or non-zero part before the e-, this is a very small
+						// number that doesn't fit inside an f64.
+						const match = value.match(NUMBER);
+						// assert(match, "If the regex is right, match is always truthy")
+
+						// If any part of the number other than the exponent has a
+						// non-zero digit in it, this number was not intended to be
+						// evaluated down to a zero.
+						if (
+							NON_ZERO.test(match.groups.int) ||
+							NON_ZERO.test(match.groups.frac)
+						) {
+							context.report({
+								loc: node.loc,
+								messageId: "unsafeZero",
+								data: { value },
+							});
+						}
+					} else if (!/[.e]/iu.test(value)) {
+						// Intended to be an integer
+						if (
+							node.value > Number.MAX_SAFE_INTEGER ||
+							node.value < Number.MIN_SAFE_INTEGER
+						) {
+							context.report({
+								loc: node.loc,
+								messageId: "unsafeInteger",
+								data: { value },
+							});
+						}
+					} else {
+						// Floating point.  Check for subnormal.
+						const buffer = new ArrayBuffer(8);
+						const view = new DataView(buffer);
+						view.setFloat64(0, node.value, false);
+						const asBigInt = view.getBigUint64(0, false);
+						// Subnormals have an 11-bit exponent of 0 and a non-zero mantissa.
+						if ((asBigInt & 0x7ff0000000000000n) === 0n) {
+							context.report({
+								loc: node.loc,
+								messageId: "subnormal",
+								// Value included so that it's seen in scientific notation
+								data: node,
+							});
+						}
+					}
 				}
 			},
 			String(node) {
@@ -651,6 +715,42 @@ var noUnnormalizedKeys = {
 	},
 };
 
+/**
+ * @fileoverview Rule to ensure top-level items are either an array or ojbect.
+ * @author Joe Hildebrand
+ */
+
+var topLevelInterop = {
+	meta: {
+		type: /** @type {const} */ ("problem"),
+
+		docs: {
+			description:
+				"Require the JSON top-level value to be an array or object",
+		},
+
+		messages: {
+			topLevel:
+				"Top level item should be array or object, got '{{type}}'.",
+		},
+	},
+
+	create(context) {
+		return {
+			Document(node) {
+				const { type } = node.body;
+				if (type !== "Object" && type !== "Array") {
+					context.report({
+						loc: node.loc,
+						messageId: "topLevel",
+						data: { type },
+					});
+				}
+			},
+		};
+	},
+};
+
 /**
  * @fileoverview JSON plugin.
  * @author Nicholas C. Zakas
@@ -664,7 +764,7 @@ var noUnnormalizedKeys = {
 const plugin = {
 	meta: {
 		name: "@eslint/json",
-		version: "0.8.0", // x-release-please-version
+		version: "0.9.0", // x-release-please-version
 	},
 	languages: {
 		json: new JSONLanguage({ mode: "json" }),
@@ -676,6 +776,7 @@ const plugin = {
 		"no-empty-keys": noEmptyKeys,
 		"no-unsafe-values": noUnsafeValues,
 		"no-unnormalized-keys": noUnnormalizedKeys,
+		"top-level-interop": topLevelInterop,
 	},
 	configs: {
 		recommended: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eslint/json",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "JSON linting plugin for ESLint",
   "author": "Nicholas C. Zakas",
   "type": "module",
@@ -64,7 +64,7 @@
   "license": "Apache-2.0",
   "dependencies": {
     "@eslint/plugin-kit": "^0.2.3",
-    "@humanwhocodes/momoa": "^3.3.3"
+    "@humanwhocodes/momoa": "^3.3.4"
   },
   "devDependencies": {
     "@eslint/core": "^0.6.0",
@@ -77,7 +77,7 @@
     "got": "^14.4.2",
     "lint-staged": "^15.2.7",
     "mocha": "^10.4.0",
-    "prettier": "^3.3.2",
+    "prettier": "^3.4.1",
     "rollup": "^4.16.2",
     "rollup-plugin-copy": "^3.5.0",
     "typescript": "^5.4.5",