@fabriziosalmi/slopless 1.17.0 → 1.17.2

package/package.json

@@ -1,11 +1,27 @@
 {
   "name": "@fabriziosalmi/slopless",
-  "version": "1.17.0",
+  "version": "1.17.2",
   "description": "",
-  "main": "dist/index.js",
+  "main": "dist/engine/api.js",
+  "types": "dist/engine/api.d.ts",
   "bin": {
     "slopless": "dist/index.js"
   },
+  "exports": {
+    ".": {
+      "types": "./dist/engine/api.d.ts",
+      "default": "./dist/engine/api.js"
+    },
+    "./dist/engine/api": {
+      "types": "./dist/engine/api.d.ts",
+      "default": "./dist/engine/api.js"
+    },
+    "./dist/engine/api.js": {
+      "types": "./dist/engine/api.d.ts",
+      "default": "./dist/engine/api.js"
+    },
+    "./package.json": "./package.json"
+  },
   "files": [
     "dist",
     "rules"
@@ -20,8 +36,9 @@
     "docs:build": "npm run docs:gen && vitepress build docs",
     "docs:preview": "vitepress preview docs",
     "verify:bundle": "node scripts/verify-bundle.js",
+    "verify:rules": "node scripts/check-rule-performance.js",
     "verify:action": "bash scripts/run-action-locally.sh . 'src/**/*.ts'",
-    "release:prep": "npm run docs:gen && npm run build && npm test && npm run verify:bundle",
+    "release:prep": "npm run docs:gen && npm run build && npm test && npm run verify:rules && npm run verify:bundle",
     "version": "node scripts/check-changelog.js && node scripts/sync-versions.js && npm run docs:gen && npm run build && git add dist docs README.md packages/*/package.json"
   },
   "keywords": [

package/rules/VBC-010.yaml

@@ -6,7 +6,11 @@ tags:
   - accessibility
   - html
 match:
-  regex: <div[^>]*\s(onclick|onClick)=(?!\{?\s*\(?\s*(?:e|ev|evt|event|_e)\s*\)?\s*=>\s*\{?\s*(?:e|ev|evt|event|_e)\.(?:stopPropagation|preventDefault)\(\)\s*\}?\s*\})
+  # `[^>]{0,2000}` rather than `[^>]*`: in markup with no closing `>` the
+  # unbounded form scanned to the end of the file from every `<div`, which is
+  # quadratic — 13ms at 15KB, 767ms at 120KB. An opening tag's attribute list is
+  # not 2,000 characters long, and exceeding it costs a missed finding.
+  regex: <div[^>]{0,2000}\s(onclick|onClick)=(?!\{?\s*\(?\s*(?:e|ev|evt|event|_e)\s*\)?\s*=>\s*\{?\s*(?:e|ev|evt|event|_e)\.(?:stopPropagation|preventDefault)\(\)\s*\}?\s*\})
   file_types:
     - html
     - js

package/rules/VBC-017-B.yaml

@@ -8,7 +8,10 @@ tags:
 match:
   # `.only` is the dangerous one: the suite still passes, having run one test.
   # A skipped test is at least visibly skipped.
-  regex: \b(?:describe|it|test|context|suite)\.only\s*\(|^\s*(?:fdescribe|fit)\s*\(
+  # `^[ \t]*`, not `^\s*`: with `m` every line start is a match position and
+  # `\s*` there swallows the newlines after it, which is quadratic on a file of
+  # blank lines. Indentation before `fit(` is horizontal whitespace.
+  regex: \b(?:describe|it|test|context|suite)\.only\s*\(|^[ \t]*(?:fdescribe|fit)\s*\(
   flags: m
   scan: code
   file_types:

package/rules/VBC-035.yaml

@@ -8,8 +8,14 @@ match:
   # "Icon-only" is the whole claim: a button holding an icon *and* a visible
   # label already has an accessible name, and that is how most toolbars are
   # written. The svg has to be the only thing between the tags.
+  #
+  # The `{0,2000}?` bound is what stops the scan. Unbounded, an `<svg>` with no
+  # closing tag sent the search to the end of the file, once per candidate
+  # button: 15 seconds on 32,000 unclosed tags, and quadratic. Bounded, the same
+  # input is 179ms and linear. 2,000 characters is far more than a button icon's
+  # path data, and exceeding it costs a missed finding rather than a wrong one.
   regex: >-
-    <button\b(?![^>]*(?:aria-label|aria-labelledby|title))[^>]*>\s*<svg\b[^>]*(?:/>|>(?:(?!</svg>)[\s\S])*?</svg>)\s*</button>
+    <button\b(?![^>]*(?:aria-label|aria-labelledby|title))[^>]*>\s*<svg\b[^>]*(?:/>|>(?:(?!</svg>)[\s\S]){0,2000}?</svg>)\s*</button>
   multiline: true
   file_types:
     - html

package/rules/VBC-051.yaml

@@ -6,8 +6,13 @@ tags:
   - clean-code
   - style
 match:
+  # The gap between the two spellings is bounded at 400 characters. Unbounded,
+  # `.*?` rescanned the rest of the line from every candidate, which on one long
+  # line is quadratic: 128ms at 30KB, 413ms at 60KB. The CLI skips such files as
+  # generated, but `lintText` does not, so the editor and the MCP server see
+  # them. Two names on the same line are near each other or they are unrelated.
   regex: >-
-    ((?<![.'\"])\b[a-z]+_[a-z]+\b(?!\s*[:?]).*?\b[a-z]+[A-Z][a-z]+\b)|(\b[a-z]+[A-Z][a-z]+\b.*?(?<![.'\"])\b[a-z]+_[a-z]+\b(?!\s*[:?]))
+    ((?<![.'\"])\b[a-z]+_[a-z]+\b(?!\s*[:?]).{0,400}?\b[a-z]+[A-Z][a-z]+\b)|(\b[a-z]+[A-Z][a-z]+\b.{0,400}?(?<![.'\"])\b[a-z]+_[a-z]+\b(?!\s*[:?]))
   file_types:
     - js
     - ts

package/rules/VBC-104.yaml

@@ -5,8 +5,21 @@ category: clean-code
 tags:
   - clean-code
 match:
+  # `^[ \t]*` rather than `^\s*`: with the `m` flag every line start is a match
+  # position, and `\s*` there can swallow the newlines that follow it, so a file
+  # of blank lines gave the engine an ambiguous split at every one of them. That
+  # was quadratic — 28ms at 5,000 blank lines, 44s at 200,000 — and a file of
+  # blank lines is something anyone can put in a pull request. Indentation before
+  # `import` is horizontal whitespace, which is all this ever meant to allow.
+  #
+  # The gap between the two is bounded as well. Unbounded, every `import` with
+  # no `require` after it rescanned to the end of the file, which is quadratic
+  # on a file that is mostly imports: 13ms at 28KB, 848ms at 223KB. Bounded it is
+  # linear, 20ms and 146ms. 4,000 characters is roughly a hundred lines, which is
+  # further apart than the two spellings of a module system usually sit, and
+  # being further apart than that costs a missed warning rather than a wrong one.
   regex: >-
-    ^\s*import\s[\s\S]*?^\s*(?:const|let|var)\s[^\n]*=\s*require\(|^\s*(?:const|let|var)\s[^\n]*=\s*require\([\s\S]*?^\s*import\s
+    ^[ \t]*import\s[\s\S]{0,4000}?^[ \t]*(?:const|let|var)\s[^\n]*=\s*require\(|^[ \t]*(?:const|let|var)\s[^\n]*=\s*require\([\s\S]{0,4000}?^[ \t]*import\s
   flags: m
   multiline: true
   file_types:

package/rules/VBC-901.yaml

@@ -12,8 +12,31 @@ match:
   # Nothing starting with 255 is a host: 240.0.0.0/4 is reserved, so a dotted
   # quad there is a netmask or a broadcast address — `isInNet(host, "172.16.0.0",
   # "255.240.0.0")` names a mask, not a machine.
+  #
+  # The same reasoning covers the IANA special-purpose ranges that are not
+  # globally reachable (#43). They are what SSRF and egress blocklists list, so
+  # reporting them made a project's most defensive file its noisiest:
+  #   0.0.0.0/8        "this network", all of it, not only 0.0.0.0 (RFC 6890)
+  #   192.0.0.0/24     IETF protocol assignments (RFC 6890)
+  #   192.88.99.0/24   deprecated 6to4 relay anycast (RFC 7526)
+  #   100.64.0.0/10    shared address space, carrier-grade NAT (RFC 6598)
+  #   198.18.0.0/15    benchmarking (RFC 2544)
+  # The fire list keeps their neighbours, so the exclusion cannot widen quietly.
+  #
+  # RFC 1918 private ranges are deliberately still reported: 192.168.1.50 in
+  # code is exactly one environment. 169.254.0.0/16 is too, for the opposite
+  # reason from the above: a literal link-local address is almost always the
+  # cloud metadata service being called, not being blocked.
+  #
+  # Well-known public resolvers are not reported, by exact address and never by
+  # subnet: Google, Cloudflare (1.1.1.2 and 1.1.1.3 are its filtered variants),
+  # Quad9, OpenDNS and AdGuard. The message says an address pins code to one
+  # environment, and an anycast resolver reachable from everywhere does not —
+  # it is a documented choice that outlives the project, which is the call
+  # l0-git#29 made too. Decided in #43. The fire list keeps each one's
+  # neighbour, so a typo'd or unknown address beside them is still reported.
   regex: >-
-    \b(?!127\.|0\.0\.0\.0\b|255\.|192\.0\.2\.|198\.51\.100\.|203\.0\.113\.)(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\b
+    \b(?!127\.|0\.|255\.|192\.0\.2\.|198\.51\.100\.|203\.0\.113\.|192\.0\.0\.|192\.88\.99\.|100\.(?:6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\.|198\.1[89]\.|(?:8\.8\.8\.8|8\.8\.4\.4|1\.1\.1\.1|1\.0\.0\.1|1\.1\.1\.2|1\.0\.0\.2|1\.1\.1\.3|1\.0\.0\.3|9\.9\.9\.9|149\.112\.112\.112|9\.9\.9\.10|149\.112\.112\.10|9\.9\.9\.11|149\.112\.112\.11|208\.67\.222\.222|208\.67\.220\.220|208\.67\.222\.220|208\.67\.220\.222|208\.67\.222\.123|208\.67\.220\.123|94\.140\.14\.14|94\.140\.15\.15|94\.140\.14\.15|94\.140\.15\.16|94\.140\.14\.140|94\.140\.14\.141)\b)(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\b
   scan: strings
   file_types:
     - js
@@ -52,7 +75,15 @@ message: >-
 tests:
   fire:
     - const host = '192.168.1.50';
-    - const dns = "8.8.8.8";
+    # Beside a known resolver is not a known resolver.
+    - const dns = "8.8.8.9";
+    - const near = "1.1.1.4";
+    # One step outside each special-purpose range: still a host.
+    - const near = "192.0.1.1";
+    - const relay = "192.88.100.1";
+    - const below = "100.63.255.255";
+    - const above = "100.128.0.1";
+    - const bench = "198.20.0.1";
   quiet:
     - const host = process.env.DB_HOST;
     - const version = '1.2';
@@ -66,3 +97,15 @@ tests:
     # "255.240.0.0")` still reports — on the 172.16.0.0, which is an address.)
     - const netmask = "255.240.0.0";
     - const mask = '255.255.255.0';
+    # IANA special-purpose, not globally reachable (#43).
+    - '"192.0.0.0/24",'
+    - '"192.88.99.0/24",'
+    - const thisNet = "0.1.2.3";
+    - const cgnat = "100.64.0.1";
+    - const cgnatTop = "100.127.255.254";
+    - const benchmark = "198.18.0.1";
+    - const benchmarkTop = "198.19.255.1";
+    # Public anycast resolvers, a choice rather than an environment (#43).
+    - const dns = "8.8.8.8";
+    - const cloudflare = '1.1.1.3';
+    - 'upstream = ["9.9.9.9", "94.140.14.14"]'

package/rules/VBC-920.yaml

@@ -2,11 +2,22 @@ id: VBC-920
 name: relative-link-format
 severity: warning
 category: docs
+# Off unless the config names it (#43). In CommonMark [x](guide.md) and
+# [x](./guide.md) resolve identically, and the message's "tool compatibility"
+# names no tool, so this is a house style rather than a defect. Preferences
+# nobody agreed to ship disabled; a project that wants the style can ask for it.
+opt_in: true
 tags:
   - documentation
   - maintenance
 match:
-  regex: \]\((?![a-z]+:|/|\.)
+  # `#` is excluded along with schemes, absolute paths and ./ ../: an in-page
+  # anchor points at a heading in this document, not at a relative file.
+  regex: \]\((?![a-z]+:|/|\.|#)
+  # Link syntax inside `code` or a fenced block is an example of a link, not a
+  # link, and CommonMark renders neither. The CHANGELOG line that describes how
+  # Jekyll writes links was the one reported (#43).
+  exclude_markdown_code: true
   file_types:
     - md
 message: >-
@@ -15,6 +26,22 @@ message: >-
 tests:
   fire:
     - See [the guide](guide.md).
+    # A real link after the code in the same line is still a real link.
+    - 'Run `make docs`, then read [the guide](guide.md).'
   quiet:
     - See [the guide](./guide.md).
     - See [the site](https://example.com).
+    # In-page anchor.
+    - See [the setup](#setup).
+    # Inside a code span.
+    - 'Inline code: `[CLI](cli-reference.html)` is how Jekyll links.'
+    - 'Double backticks: ``[a](b.md) with a ` inside`` still code.'
+    # Inside a fenced block, both fence characters.
+    - |
+      ```markdown
+      [guide](guide.md)
+      ```
+    - |
+      ~~~
+      [guide](guide.md)
+      ~~~

package/rules/VBC-936.yaml

@@ -6,8 +6,11 @@ tags:
   - docs
   - maintenance
 match:
+  # `^[ \t]*`, not `^\s*`: with `m` every line start is a match position and
+  # `\s*` there swallows the newlines after it, which is quadratic on a file of
+  # blank lines. A blockquote marker is indented by horizontal whitespace.
   regex: >-
-    \[\s*(?:EXPERIMENTAL|ALPHA|UNSTABLE|PREVIEW)\s*\]|(?:⚠️|:warning:)\s*\*{0,2}(?:experimental|alpha|unstable)\b|^\s*>\s*\*{0,2}(?:experimental|unstable)\b
+    \[\s*(?:EXPERIMENTAL|ALPHA|UNSTABLE|PREVIEW)\s*\]|(?:⚠️|:warning:)\s*\*{0,2}(?:experimental|alpha|unstable)\b|^[ \t]*>\s*\*{0,2}(?:experimental|unstable)\b
   flags: im
   file_types:
     - md