@fjall/eslint-plugin 29.0.0 → 30.0.0

package/README.md

@@ -28,4 +28,7 @@ export default [
 ```
 
 Every rule lives in its own file (`<rule-name>.js`); `index.js` is the barrel
-exposing them all under the `rules` map.
+exposing them all under the `rules` map. AST helpers that more than two rules
+would otherwise re-derive (the scope-chain variable lookup, the TS type-wrapper
+unwrap) live in `astHelpers.js` and are imported, never copied — a rule still
+carrying a private copy migrates to the shared helper as it is next touched.

package/astHelpers.js

@@ -0,0 +1,40 @@
+/**
+ * @fileoverview AST helpers shared across the plugin's rules.
+ *
+ * Rules stay one-per-file (`<rule-name>.js`); the helpers every flow-tracking
+ * rule otherwise re-derives — the scope-chain variable lookup and the
+ * type-wrapper unwrap — live here so one copy's membership cannot silently
+ * drift from another's. A sibling still carrying a private copy migrates to
+ * these as it is next touched.
+ */
+
+/** Type-level wrappers with no runtime value of their own; `expression` is the value. */
+export const TS_WRAPPER_TYPES = new Set([
+  "TSAsExpression",
+  "TSNonNullExpression",
+  "TSSatisfiesExpression",
+  "TSTypeAssertion"
+]);
+
+/**
+ * The expression as written, minus type-level wrappers and the optional-chain
+ * envelope (`a?.b` parses as ChainExpression → MemberExpression).
+ */
+export function unwrapExpression(node) {
+  while (
+    node &&
+    (node.type === "ChainExpression" || TS_WRAPPER_TYPES.has(node.type))
+  ) {
+    node = node.expression;
+  }
+  return node;
+}
+
+/** The variable `name` resolves to from `scope` outward, or null when unbound. */
+export function findVariableInScopeChain(scope, name) {
+  for (let current = scope; current; current = current.upper) {
+    const variable = current.set.get(name);
+    if (variable) return variable;
+  }
+  return null;
+}

package/index.js

@@ -26,6 +26,7 @@ import requireAbortPrecheckInSdkLoop from "./require-abort-precheck-in-sdk-loop.
 import requireAbortCompositionOnSdkSend from "./require-abort-composition-on-sdk-send.js";
 import noClassicConnectedAccountAssume from "./no-classic-connected-account-assume.js";
 import noRawDbTransaction from "./no-raw-db-transaction.js";
+import noRawRequestUrlInRedirect from "./no-raw-request-url-in-redirect.js";
 import noRawExitCode from "./no-raw-exit-code.js";
 import noReplacementStringExpansion from "./no-replacement-string-expansion.js";
 import noSilentResultDiscard from "./no-silent-result-discard.js";
@@ -66,6 +67,7 @@ export default {
     "require-abort-composition-on-sdk-send": requireAbortCompositionOnSdkSend,
     "no-classic-connected-account-assume": noClassicConnectedAccountAssume,
     "no-raw-db-transaction": noRawDbTransaction,
+    "no-raw-request-url-in-redirect": noRawRequestUrlInRedirect,
     "no-raw-exit-code": noRawExitCode,
     "no-replacement-string-expansion": noReplacementStringExpansion,
     "no-silent-result-discard": noSilentResultDiscard,

package/no-raw-request-url-in-redirect.js

@@ -0,0 +1,854 @@
+/**
+ * @fileoverview A redirect Location must not echo the request's own URL raw.
+ *
+ * React Router serves a client-side navigation as a single-fetch data request
+ * — `/{path}.data?_routes=…` (`/_.data` at the root) — and hands middleware
+ * and loaders that request UNMODIFIED: only route matching sees the normalised
+ * path (`getNormalizedPath` in react-router/lib/server-runtime/urls.ts, not
+ * exported). A redirect whose Location is built from `request.url` therefore
+ * lands a live tab on `/acme/overview.data?_routes=…` — the client follows the
+ * Location it copies out of the data response verbatim. The first, document
+ * navigation works; every in-app navigation after it breaks.
+ *
+ * Flagged — an ECHO of the request's own URL reaching a redirect sink:
+ *   - `request.url` itself (binding names `request` / `req`, any
+ *     `<expr>.request.url`, or `url` destructured from the request), except
+ *     as an argument of `new URL(…)` / `URL.parse(…)`, where the URL object
+ *     is tracked instead
+ *   - the URL object built from it — `new URL(request.url)` /
+ *     `URL.parse(request.url)` inline, a binding initialised or assigned from
+ *     it, an alias of that binding, or a destructure (`const { pathname,
+ *     search } = new URL(request.url)`) — read as `.pathname` / `.search` /
+ *     `.href` / `.toString()` / `.toJSON()` / `String(url)` / `${url}` /
+ *     `url + ""` / `url.searchParams.toString()` / `${url.searchParams}`, or
+ *     passed whole to `Response.redirect(url)` (the one sink that accepts the
+ *     object)
+ *   - a URL resolved AGAINST the request with a static relative reference —
+ *     `new URL("?page=2", request.url)`, `new URL("", request.url)`,
+ *     `new URL("#top", request.url)` — which keeps the `.data` path
+ *   - a `URLSearchParams` built from one of those
+ *     (`new URLSearchParams(url.search)`), coerced the same ways
+ *   …flowing directly, through a same-function binding, destructure or
+ *   assignment (`=`, `+=`, `||=`, `??=`, `&&=`), through string transforms
+ *   (`.replace`, `.slice`, `.split(…)[i]`, `.match(…)?.[i]`, `.join`, …),
+ *   template literals, `+` concatenation, `??` / `||` / ternary branches, a
+ *   second `new URL(echo, base)`, and the transparent wrappers `String` /
+ *   `encodeURIComponent` / `encodeURI` / `decodeURIComponent` / `decodeURI`,
+ *   into:
+ *     - the first argument of `redirect(…)` / `redirectDocument(…)` (by name,
+ *       or under any alias imported from react-router) and of `replace(…)`
+ *       (only under an import binding from react-router — the bare name
+ *       collides with string helpers)
+ *     - the first argument of `Response.redirect(…)`
+ *     - a `Location` header value (any case): a property of the `headers`
+ *       object literal, of a `new Headers(…)` argument, or of a literal bound
+ *       to a `*headers` name; a `["Location", …]` tuple in such an array; or
+ *       `headers.set("Location", …)` / `.append(…)` on a receiver named
+ *       `*headers` or bound to `new Headers(…)`
+ *
+ * NOT flagged — VALUE reads, structural checks, and the caller's own path:
+ *   - `url.searchParams.get(…)` / `.has(…)` / `.getAll(…)` (a value, not the
+ *     URL), and `url.searchParams` handed to a helper
+ *   - `url.pathname.startsWith(…)` / `.includes(…)` / `=== …` (boolean; the
+ *     Location comes from elsewhere)
+ *   - `new URL("/path", request.url)` / `new URL("https://…", request.url)` —
+ *     a static path- or scheme-absolute reference takes only the origin from
+ *     the base — and `new URL(dynamic, request.url)`, where the reference is
+ *     the caller's and must be path-absolute (cf. `safeRedirectSuffix`)
+ *   - `requestPath(request)` destructures (the cure)
+ *   - `url.origin` / `.host` / `.protocol` (no path or query in them)
+ *   - a `location` key on a non-header object (a log payload, a Prisma
+ *     `data`), or `.set("location", …)` on a non-header receiver (a Map)
+ *
+ * Known limitations:
+ *   - Interprocedural flow: the rule is AST-local within a function scope,
+ *     like `mask-error-message-at-boundary`. An echo returned from a helper
+ *     and redirected by its caller, or passed through a user-defined helper
+ *     (`redirect(normalise(url.pathname))`), is not connected. Manual
+ *     discipline applies there: the only sanctioned normaliser is
+ *     `requestPath(request)` at `webapp/app/.server/utils/http/requestPath.ts`,
+ *     which takes the request, not its URL.
+ *   - Flow-insensitive within the scope: every read of a binding the echo is
+ *     assigned to counts, whatever the statement order.
+ *   - A binding chain deeper than MAX_TRACE_DEPTH hops is abandoned, not
+ *     walked — never seen in real code; it keeps the lint run alive.
+ *
+ * Escape hatch:
+ *   `// eslint-disable-next-line fjall/no-raw-request-url-in-redirect -- <why>`
+ * above the ECHO line (the report anchors on the leaf, not the sink) for a
+ * proven document-only path. Expect zero uses.
+ *
+ * Why this rule exists: webapp-standards.md § "Redirect Locations echoed from
+ * `request.url` must normalise the single-fetch URL" landed on 2026-09-02 and
+ * recurred in new code ~90 minutes later (the legacy `/assets` 301 built its
+ * Location from a destructured `search`), with a pre-existing sibling one file
+ * over (the pre-split table shim composing `url.pathname.replace(…)` and
+ * `url.search`). Both were fixed in webapp `45beb2b3`; documented-not-
+ * mechanised rules recur, and this shape is lintable.
+ */
+
+import {
+  TS_WRAPPER_TYPES,
+  findVariableInScopeChain,
+  unwrapExpression
+} from "./astHelpers.js";
+
+const REQUEST_BINDING_NAMES = new Set(["request", "req"]);
+const URL_ECHO_PROPERTIES = new Set(["pathname", "search", "href"]);
+const URL_SERIALISERS = new Set(["toString", "toJSON"]);
+// A method on the flowing string whose RESULT carries none of it — the walk
+// ends. `match` is absent on purpose: a capture is a substring of the echo.
+const TERMINATOR_METHODS = new Set([
+  "includes",
+  "startsWith",
+  "endsWith",
+  "test",
+  "indexOf",
+  "lastIndexOf",
+  "localeCompare",
+  "search",
+  "some",
+  "every",
+  "has"
+]);
+const TRANSPARENT_CALLEES = new Set([
+  "String",
+  "encodeURIComponent",
+  "encodeURI",
+  "decodeURIComponent",
+  "decodeURI"
+]);
+const REACT_ROUTER_REDIRECTORS = new Set([
+  "redirect",
+  "redirectDocument",
+  "replace"
+]);
+// Matched by bare name whatever the import; `replace` needs the import binding.
+const NAME_MATCHED_REDIRECTORS = ["redirect", "redirectDocument"];
+const FLOW_ASSIGNMENT_OPERATORS = new Set(["=", "+=", "||=", "??=", "&&="]);
+const HEADER_WRITE_METHODS = new Set(["set", "append"]);
+const LOCATION_HEADER_RE = /^location$/i;
+const HEADERS_NAME_RE = /headers$/i;
+// A static reference that takes only the origin from its base.
+const ABSOLUTE_REFERENCE_RE = /^(?:\/|[a-z][a-z0-9+.-]*:)/i;
+const MAX_TRACE_DEPTH = 200;
+
+/** @type {import('eslint').Rule.RuleModule} */
+const noRawRequestUrlInRedirect = {
+  meta: {
+    type: "problem",
+    docs: {
+      description:
+        "A redirect Location must derive an echoed path from requestPath(request), never from request.url / new URL(request.url) — a single-fetch data request would be echoed back as /{path}.data?_routes=…"
+    },
+    messages: {
+      rawRequestUrl:
+        '`{{leaf}}` echoes the request\'s own URL into `{{sink}}`. A client-side navigation arrives as `/{path}.data?_routes=…` and the client follows the Location verbatim, so the tab lands on the data URL. Derive the echoed path from `requestPath(request)` (`~/.server/utils/http/requestPath`) instead; value reads (`url.searchParams.get(…)`) are fine. See webapp-standards.md § "Redirect Locations echoed from `request.url` must normalise the single-fetch URL".'
+    },
+    schema: []
+  },
+
+  create(context) {
+    const sourceCode = context.sourceCode;
+    const redirectorNames = new Set(NAME_MATCHED_REDIRECTORS);
+
+    function report(leafNode, leafLabel, sinkLabel) {
+      context.report({
+        node: leafNode,
+        messageId: "rawRequestUrl",
+        data: { leaf: leafLabel, sink: sinkLabel }
+      });
+    }
+
+    function check(leafNode, leafLabel) {
+      const sink = findSink(leafNode, new Set(), 0);
+      if (sink !== null) report(leafNode, leafLabel, sink);
+    }
+
+    // ── Binding resolution ────────────────────────────────────────────
+
+    function findVariable(identifier) {
+      return findVariableInScopeChain(
+        sourceCode.getScope(identifier),
+        identifier.name
+      );
+    }
+
+    /**
+     * Every `{ id, init }` that gives the binding a value: its declarator
+     * (when initialised) and each plain `=` assignment to it.
+     */
+    function initialisersOf(identifier, visited) {
+      const variable = findVariable(identifier);
+      if (!variable || visited.has(variable)) return [];
+      visited.add(variable);
+      const entries = [];
+      for (const def of variable.defs) {
+        if (
+          def.type === "Variable" &&
+          def.node.type === "VariableDeclarator" &&
+          def.node.init !== null
+        ) {
+          entries.push({ id: def.node.id, init: def.node.init });
+        }
+      }
+      for (const ref of variable.references) {
+        const parent = ref.identifier.parent;
+        if (
+          ref.isWrite() &&
+          parent &&
+          parent.type === "AssignmentExpression" &&
+          parent.left === ref.identifier &&
+          parent.operator === "="
+        ) {
+          entries.push({ id: ref.identifier, init: parent.right });
+        }
+      }
+      return entries;
+    }
+
+    /** `request` / `req` / `<expr>.request` — the request object itself. */
+    function isRequestBinding(node) {
+      node = unwrapExpression(node);
+      if (!node) return false;
+      if (node.type === "Identifier")
+        return REQUEST_BINDING_NAMES.has(node.name);
+      return (
+        node.type === "MemberExpression" &&
+        !node.computed &&
+        node.property.type === "Identifier" &&
+        REQUEST_BINDING_NAMES.has(node.property.name)
+      );
+    }
+
+    /** `request.url` / `req.url` / `<expr>.request.url` (chains unwrapped). */
+    function isRequestUrlMember(node) {
+      node = unwrapExpression(node);
+      return (
+        node.type === "MemberExpression" &&
+        !node.computed &&
+        node.property.type === "Identifier" &&
+        node.property.name === "url" &&
+        isRequestBinding(node.object)
+      );
+    }
+
+    /**
+     * `request.url` directly, a binding initialised or assigned from it, or
+     * `url` destructured from the request.
+     */
+    function isRequestUrlValue(node, visited) {
+      node = unwrapExpression(node);
+      if (!node) return false;
+      if (isRequestUrlMember(node)) return true;
+      if (node.type !== "Identifier") return false;
+      return initialisersOf(node, visited).some((entry) => {
+        if (entry.id.type === "Identifier") {
+          return isRequestUrlValue(entry.init, visited);
+        }
+        return (
+          entry.id.type === "ObjectPattern" &&
+          isRequestBinding(entry.init) &&
+          patternPropertyKey(entry.id, node.name) === "url"
+        );
+      });
+    }
+
+    /** `new URL(…)` or `URL.parse(…)` — a URL object under construction. */
+    function isUrlConstruction(node) {
+      node = unwrapExpression(node);
+      if (!node) return false;
+      if (node.type === "NewExpression") {
+        return calleeIdentifierName(node.callee) === "URL";
+      }
+      return (
+        node.type === "CallExpression" && urlStaticMethod(node) === "parse"
+      );
+    }
+
+    /**
+     * "url" when the construction parses the request's URL, or resolves a
+     * static RELATIVE reference against it (the `.data` path survives). A
+     * static absolute reference takes only the origin; a dynamic one is the
+     * caller's.
+     */
+    function urlConstructionKind(node, visited) {
+      const first = node.arguments[0];
+      const base = node.arguments[1];
+      if (first === undefined) return null;
+      if (isRequestUrlValue(first, visited)) return "url";
+      return base !== undefined &&
+        isRequestUrlValue(base, visited) &&
+        isStaticRelativeReference(first)
+        ? "url"
+        : null;
+    }
+
+    /**
+     * "url"    — a URL object built from the request's own URL
+     * "params" — a URLSearchParams carrying that URL's query
+     * null     — anything else (a fixed URL, a value read, unknown)
+     */
+    function resolveUrlKind(node, visited, depth) {
+      if (!node || depth > MAX_TRACE_DEPTH) return null;
+      node = unwrapExpression(node);
+      if (isUrlConstruction(node)) return urlConstructionKind(node, visited);
+      if (node.type === "NewExpression") {
+        const first = node.arguments[0];
+        if (
+          calleeIdentifierName(node.callee) === "URLSearchParams" &&
+          node.arguments.length === 1
+        ) {
+          if (resolveUrlKind(first, visited, depth + 1) === "params") {
+            return "params";
+          }
+          const member = unwrapExpression(first);
+          if (
+            member.type === "MemberExpression" &&
+            !member.computed &&
+            member.property.type === "Identifier" &&
+            (member.property.name === "search" ||
+              member.property.name === "searchParams") &&
+            resolveUrlKind(member.object, visited, depth + 1) === "url"
+          ) {
+            return "params";
+          }
+        }
+        return null;
+      }
+      if (
+        node.type === "MemberExpression" &&
+        !node.computed &&
+        node.property.type === "Identifier" &&
+        node.property.name === "searchParams"
+      ) {
+        return resolveUrlKind(node.object, visited, depth + 1) === "url"
+          ? "params"
+          : null;
+      }
+      if (node.type !== "Identifier") return null;
+      for (const entry of initialisersOf(node, visited)) {
+        if (entry.id.type === "Identifier") {
+          const kind = resolveUrlKind(entry.init, visited, depth + 1);
+          if (kind !== null) return kind;
+          continue;
+        }
+        if (
+          entry.id.type === "ObjectPattern" &&
+          resolveUrlKind(entry.init, visited, depth + 1) === "url" &&
+          patternPropertyKey(entry.id, node.name) === "searchParams"
+        ) {
+          return "params";
+        }
+      }
+      return null;
+    }
+
+    // ── Flow: leaf → sink ─────────────────────────────────────────────
+
+    /**
+     * Walks up from an echo leaf. Returns a sink label when the string
+     * reaches a redirect / Location sink in the same function scope, or null
+     * when it terminates first (boolean check, comparison, unknown helper,
+     * statement boundary).
+     */
+    function findSink(start, visited, depth) {
+      if (depth > MAX_TRACE_DEPTH) return null;
+      let previous = start;
+      let current = start.parent;
+      while (current) {
+        switch (current.type) {
+          case "TemplateLiteral":
+          case "ChainExpression":
+          case "AwaitExpression":
+          case "SpreadElement":
+          case "LogicalExpression":
+            break;
+          case "ArrayExpression":
+            if (isLocationTuple(current, previous)) {
+              return isHeadersLiteral(current) ? "Location header" : null;
+            }
+            break;
+          case "BinaryExpression":
+            if (current.operator !== "+") return null;
+            break;
+          case "ConditionalExpression":
+            if (current.test === previous) return null;
+            break;
+          case "SequenceExpression":
+            if (
+              current.expressions[current.expressions.length - 1] !== previous
+            ) {
+              return null;
+            }
+            break;
+          case "MemberExpression": {
+            if (current.object !== previous) return null;
+            if (current.computed) break;
+            if (current.property.type !== "Identifier") return null;
+            const call = current.parent;
+            if (
+              call &&
+              call.type === "CallExpression" &&
+              call.callee === current
+            ) {
+              if (TERMINATOR_METHODS.has(current.property.name)) return null;
+              previous = call;
+              current = call.parent;
+              continue;
+            }
+            // A URL laundered through `new URL(echo, base)` read back out.
+            if (URL_ECHO_PROPERTIES.has(current.property.name)) break;
+            return null;
+          }
+          case "CallExpression": {
+            if (current.callee === previous) return null;
+            const sink = classifySinkCall(current, previous);
+            if (sink !== null) return sink;
+            if (isTransparentCall(current)) break;
+            return null;
+          }
+          case "NewExpression": {
+            const ctor = calleeIdentifierName(current.callee);
+            if (
+              (ctor !== "URLSearchParams" && ctor !== "URL") ||
+              current.arguments[0] !== previous
+            ) {
+              return null;
+            }
+            // A construction the leaf visitors already track (its own reads
+            // are the leaves) ends this walk; an untracked one — a URL
+            // laundered from echo fragments — carries the echo onward.
+            if (resolveUrlKind(current, new Set(), depth) !== null) return null;
+            break;
+          }
+          case "Property": {
+            if (current.value !== previous) return null;
+            return propertyKeyMatches(current, LOCATION_HEADER_RE) &&
+              isHeadersLiteral(current.parent)
+              ? "Location header"
+              : null;
+          }
+          case "VariableDeclarator": {
+            if (current.init !== previous) return null;
+            return tracePattern(current.id, visited, depth);
+          }
+          case "AssignmentExpression": {
+            if (
+              current.right !== previous ||
+              !FLOW_ASSIGNMENT_OPERATORS.has(current.operator) ||
+              current.left.type !== "Identifier"
+            ) {
+              return null;
+            }
+            return traceBinding(current.left, visited, depth);
+          }
+          default:
+            if (TS_WRAPPER_TYPES.has(current.type)) break;
+            return null;
+        }
+        previous = current;
+        current = current.parent;
+      }
+      return null;
+    }
+
+    function tracePattern(pattern, visited, depth) {
+      const identifiers = [];
+      collectPatternIdentifiers(pattern, identifiers);
+      for (const identifier of identifiers) {
+        const sink = traceBinding(identifier, visited, depth);
+        if (sink !== null) return sink;
+      }
+      return null;
+    }
+
+    function traceBinding(identifier, visited, depth) {
+      const variable = findVariable(identifier);
+      if (!variable || visited.has(variable)) return null;
+      visited.add(variable);
+      for (const ref of variable.references) {
+        if (!ref.isRead() || ref.identifier === identifier) continue;
+        const sink = findSink(ref.identifier, visited, depth + 1);
+        if (sink !== null) return sink;
+      }
+      return null;
+    }
+
+    function classifySinkCall(call, argument) {
+      const callee = unwrapExpression(call.callee);
+      if (callee.type === "Identifier") {
+        return redirectorNames.has(callee.name) &&
+          call.arguments[0] === argument
+          ? `${callee.name}(…)`
+          : null;
+      }
+      if (
+        callee.type !== "MemberExpression" ||
+        callee.computed ||
+        callee.property.type !== "Identifier"
+      ) {
+        return null;
+      }
+      const method = callee.property.name;
+      if (
+        method === "redirect" &&
+        callee.object.type === "Identifier" &&
+        callee.object.name === "Response"
+      ) {
+        return call.arguments[0] === argument ? "Response.redirect(…)" : null;
+      }
+      if (
+        HEADER_WRITE_METHODS.has(method) &&
+        call.arguments[1] === argument &&
+        isStringLiteralMatching(call.arguments[0], LOCATION_HEADER_RE) &&
+        isHeadersReceiver(callee.object)
+      ) {
+        return `${method}("Location", …)`;
+      }
+      return null;
+    }
+
+    function isTransparentCall(call) {
+      const name = calleeIdentifierName(call.callee);
+      return name !== null && TRANSPARENT_CALLEES.has(name);
+    }
+
+    /**
+     * The object or array literal is a headers value: the `headers` property,
+     * a `new Headers(…)` argument, bound to a `*headers` name, or nested in
+     * such an array.
+     */
+    function isHeadersLiteral(literal) {
+      let child = literal;
+      let parent = literal.parent;
+      while (parent && TS_WRAPPER_TYPES.has(parent.type)) {
+        child = parent;
+        parent = parent.parent;
+      }
+      if (!parent) return false;
+      switch (parent.type) {
+        case "Property":
+          return (
+            parent.value === child && propertyKeyName(parent.key) === "headers"
+          );
+        case "NewExpression":
+          return (
+            calleeIdentifierName(parent.callee) === "Headers" &&
+            parent.arguments[0] === child
+          );
+        case "VariableDeclarator":
+          return (
+            parent.init === child &&
+            parent.id.type === "Identifier" &&
+            HEADERS_NAME_RE.test(parent.id.name)
+          );
+        case "AssignmentExpression":
+          return parent.right === child && isHeadersReceiver(parent.left);
+        case "ArrayExpression":
+          return isHeadersLiteral(parent);
+        default:
+          return false;
+      }
+    }
+
+    /** `headers`, `response.headers`, `new Headers()` or a binding to one. */
+    function isHeadersReceiver(node, visited = new Set()) {
+      node = unwrapExpression(node);
+      if (!node) return false;
+      if (node.type === "NewExpression") {
+        return calleeIdentifierName(node.callee) === "Headers";
+      }
+      if (node.type === "MemberExpression") {
+        return (
+          !node.computed &&
+          node.property.type === "Identifier" &&
+          HEADERS_NAME_RE.test(node.property.name)
+        );
+      }
+      if (node.type !== "Identifier") return false;
+      if (HEADERS_NAME_RE.test(node.name)) return true;
+      return initialisersOf(node, visited).some(
+        (entry) =>
+          entry.id.type === "Identifier" &&
+          isHeadersReceiver(entry.init, visited)
+      );
+    }
+
+    // ── Leaves ────────────────────────────────────────────────────────
+
+    /** `${x}` / `x + ""` / `"" + x` — the URL object coerced to a string. */
+    function isStringCoercionContext(node) {
+      const parent = node.parent;
+      if (!parent) return false;
+      if (parent.type === "TemplateLiteral") return true;
+      return parent.type === "BinaryExpression" && parent.operator === "+";
+    }
+
+    function objectLabel(object) {
+      object = unwrapExpression(object);
+      if (object.type === "Identifier") return object.name;
+      if (isUrlConstruction(object)) return constructionLabel(object);
+      if (
+        object.type === "MemberExpression" &&
+        !object.computed &&
+        object.property.type === "Identifier"
+      ) {
+        return `${objectLabel(object.object)}.${object.property.name}`;
+      }
+      return "url";
+    }
+
+    function constructionLabel(node) {
+      const callee = node.type === "NewExpression" ? "new URL" : "URL.parse";
+      const viaBase =
+        node.arguments[1] !== undefined &&
+        !isRequestUrlValue(node.arguments[0], new Set());
+      return viaBase ? `${callee}(…, request.url)` : `${callee}(request.url)`;
+    }
+
+    /** A bare URL / URLSearchParams object (a binding or an inline construction). */
+    function urlObjectKind(node) {
+      const inner = unwrapExpression(node);
+      if (inner.type !== "Identifier" && !isUrlConstruction(inner)) return null;
+      return resolveUrlKind(inner, new Set(), 0);
+    }
+
+    return {
+      ImportDeclaration(node) {
+        if (node.source.value !== "react-router") return;
+        for (const specifier of node.specifiers) {
+          if (
+            specifier.type === "ImportSpecifier" &&
+            specifier.imported.type === "Identifier" &&
+            REACT_ROUTER_REDIRECTORS.has(specifier.imported.name)
+          ) {
+            redirectorNames.add(specifier.local.name);
+          }
+        }
+      },
+
+      MemberExpression(node) {
+        if (isRequestUrlMember(node)) {
+          check(node, "request.url");
+          return;
+        }
+        if (node.computed || node.property.type !== "Identifier") return;
+        const property = node.property.name;
+
+        if (URL_ECHO_PROPERTIES.has(property)) {
+          if (resolveUrlKind(node.object, new Set(), 0) === "url") {
+            check(node, `${objectLabel(node.object)}.${property}`);
+          }
+          return;
+        }
+
+        if (URL_SERIALISERS.has(property)) {
+          const call = node.parent;
+          if (
+            call &&
+            call.type === "CallExpression" &&
+            call.callee === node &&
+            call.arguments.length === 0 &&
+            resolveUrlKind(node.object, new Set(), 0) !== null
+          ) {
+            check(call, `${objectLabel(node.object)}.${property}()`);
+          }
+          return;
+        }
+
+        if (
+          property === "searchParams" &&
+          isStringCoercionContext(node) &&
+          resolveUrlKind(node.object, new Set(), 0) === "url"
+        ) {
+          check(node, `${objectLabel(node.object)}.searchParams`);
+        }
+      },
+
+      CallExpression(node) {
+        // `String(url)` / `String(url.searchParams)`
+        if (
+          calleeIdentifierName(node.callee) === "String" &&
+          node.arguments.length === 1 &&
+          resolveUrlKind(node.arguments[0], new Set(), 0) !== null
+        ) {
+          check(node, `String(${objectLabel(node.arguments[0])})`);
+          return;
+        }
+        // The object itself handed to a sink: `Response.redirect(url)`.
+        for (const argument of node.arguments.slice(0, 2)) {
+          const sink = classifySinkCall(node, argument);
+          if (sink === null || urlObjectKind(argument) === null) continue;
+          const inner = unwrapExpression(argument);
+          report(inner, objectLabel(inner), sink);
+        }
+      },
+
+      TemplateLiteral(node) {
+        for (const expression of node.expressions) {
+          if (urlObjectKind(expression) === null) continue;
+          const inner = unwrapExpression(expression);
+          check(inner, `\${${objectLabel(inner)}}`);
+        }
+      },
+
+      BinaryExpression(node) {
+        if (node.operator !== "+") return;
+        for (const side of [node.left, node.right]) {
+          if (urlObjectKind(side) === null) continue;
+          const inner = unwrapExpression(side);
+          check(inner, `${objectLabel(inner)} + ""`);
+        }
+      },
+
+      VariableDeclarator(node) {
+        if (node.id.type !== "ObjectPattern" || node.init === null) return;
+        // `const { url } = request` — the request's URL bound to a local name.
+        if (isRequestBinding(node.init)) {
+          const property = patternProperty(node.id, "url");
+          if (property === null) return;
+          const sink = tracePattern(property.value, new Set(), 0);
+          if (sink !== null) report(property, "{ url } of request", sink);
+          return;
+        }
+        // `const { pathname, search } = new URL(request.url)` — each
+        // destructured echo property is a leaf bound to a local name.
+        if (resolveUrlKind(node.init, new Set(), 0) !== "url") return;
+        for (const property of node.id.properties) {
+          if (property.type !== "Property") continue;
+          const key = propertyKeyName(property.key);
+          if (key === null || !URL_ECHO_PROPERTIES.has(key)) continue;
+          const sink = tracePattern(property.value, new Set(), 0);
+          if (sink !== null) {
+            report(property, `{ ${key} } of new URL(request.url)`, sink);
+          }
+        }
+      }
+    };
+  }
+};
+
+function calleeIdentifierName(callee) {
+  callee = unwrapExpression(callee);
+  return callee && callee.type === "Identifier" ? callee.name : null;
+}
+
+/** The method name of a `URL.<method>(…)` call, or null. */
+function urlStaticMethod(call) {
+  const callee = unwrapExpression(call.callee);
+  return callee &&
+    callee.type === "MemberExpression" &&
+    !callee.computed &&
+    callee.object.type === "Identifier" &&
+    callee.object.name === "URL" &&
+    callee.property.type === "Identifier"
+    ? callee.property.name
+    : null;
+}
+
+/**
+ * A string literal (or expressionless template) that is a relative reference
+ * — no leading `/`, no scheme. A dynamic value is not static and returns
+ * false: the caller owns it.
+ */
+function isStaticRelativeReference(node) {
+  node = unwrapExpression(node);
+  let text = null;
+  if (node.type === "Literal" && typeof node.value === "string") {
+    text = node.value;
+  } else if (node.type === "TemplateLiteral") {
+    const head = node.quasis[0].value.cooked ?? "";
+    if (head === "" && node.expressions.length > 0) return false;
+    text = head;
+  }
+  return text !== null && !ABSOLUTE_REFERENCE_RE.test(text);
+}
+
+function isLocationTuple(array, valueNode) {
+  return (
+    array.elements.length === 2 &&
+    array.elements[1] === valueNode &&
+    isStringLiteralMatching(array.elements[0], LOCATION_HEADER_RE)
+  );
+}
+
+function propertyKeyName(key) {
+  if (key.type === "Identifier") return key.name;
+  if (key.type === "Literal" && typeof key.value === "string") {
+    return key.value;
+  }
+  return null;
+}
+
+function propertyKeyMatches(property, pattern) {
+  if (property.computed && property.key.type !== "Literal") return false;
+  const name = propertyKeyName(property.key);
+  return name !== null && pattern.test(name);
+}
+
+/** The pattern's property whose (possibly renamed) value binds `localName`. */
+function patternPropertyKey(pattern, localName) {
+  const property = pattern.properties.find(
+    (p) =>
+      p.type === "Property" &&
+      p.value.type === "Identifier" &&
+      p.value.name === localName
+  );
+  return property ? propertyKeyName(property.key) : null;
+}
+
+/** The pattern's property destructuring `key`, or null. */
+function patternProperty(pattern, key) {
+  return (
+    pattern.properties.find(
+      (p) => p.type === "Property" && propertyKeyName(p.key) === key
+    ) ?? null
+  );
+}
+
+function isStringLiteralMatching(node, pattern) {
+  if (!node) return false;
+  node = unwrapExpression(node);
+  if (node.type === "Literal" && typeof node.value === "string") {
+    return pattern.test(node.value);
+  }
+  return (
+    node.type === "TemplateLiteral" &&
+    node.expressions.length === 0 &&
+    node.quasis.length === 1 &&
+    pattern.test(node.quasis[0].value.cooked ?? "")
+  );
+}
+
+function collectPatternIdentifiers(pattern, out) {
+  if (!pattern) return;
+  switch (pattern.type) {
+    case "Identifier":
+      out.push(pattern);
+      return;
+    case "ObjectPattern":
+      for (const property of pattern.properties) {
+        collectPatternIdentifiers(
+          property.type === "Property" ? property.value : property.argument,
+          out
+        );
+      }
+      return;
+    case "ArrayPattern":
+      for (const element of pattern.elements) {
+        collectPatternIdentifiers(element, out);
+      }
+      return;
+    case "AssignmentPattern":
+      collectPatternIdentifiers(pattern.left, out);
+      return;
+    case "RestElement":
+      collectPatternIdentifiers(pattern.argument, out);
+      return;
+    default:
+      return;
+  }
+}
+
+export default noRawRequestUrlInRedirect;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/eslint-plugin",
-  "version": "29.0.0",
+  "version": "30.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",