@flint.fyi/ts 0.14.3 → 0.14.4

package/lib/rules/forDirections.test.js

@@ -0,0 +1,99 @@
+import rule from "./forDirections.js";
+import { ruleTester } from "./ruleTester.js";
+ruleTester.describe(rule, {
+    invalid: [
+        {
+            code: `
+for (let i = 0; i < 10; i--) {}
+`,
+            snapshot: `
+for (let i = 0; i < 10; i--) {}
+                        ~~~
+                        The update moves the counter in the wrong direction for this loop condition.
+`,
+        },
+        {
+            code: `
+for (let index = 0; index < 10; index--) {}
+`,
+            snapshot: `
+for (let index = 0; index < 10; index--) {}
+                                ~~~~~~~
+                                The update moves the counter in the wrong direction for this loop condition.
+`,
+        },
+        {
+            code: `
+for (let index = 10; index >= 0; index++) {}
+`,
+            snapshot: `
+for (let index = 10; index >= 0; index++) {}
+                                 ~~~~~~~
+                                 The update moves the counter in the wrong direction for this loop condition.
+`,
+        },
+        {
+            code: `
+for (let index = 0; index > 10; index++) {}
+`,
+            snapshot: `
+for (let index = 0; index > 10; index++) {}
+                                ~~~~~~~
+                                The update moves the counter in the wrong direction for this loop condition.
+`,
+        },
+        {
+            code: `
+for (let index = 0; 10 > index; index--) {}
+`,
+            snapshot: `
+for (let index = 0; 10 > index; index--) {}
+                                ~~~~~~~
+                                The update moves the counter in the wrong direction for this loop condition.
+`,
+        },
+        {
+            code: `
+for (let index = 0; index < 10; index -= 1) {}
+`,
+            snapshot: `
+for (let index = 0; index < 10; index -= 1) {}
+                                ~~~~~~~~~~
+                                The update moves the counter in the wrong direction for this loop condition.
+`,
+        },
+        {
+            code: `
+for (let index = 10; index > 0; index += 1) {}
+`,
+            snapshot: `
+for (let index = 10; index > 0; index += 1) {}
+                                ~~~~~~~~~~
+                                The update moves the counter in the wrong direction for this loop condition.
+`,
+        },
+        {
+            code: `
+for (let index = 0; index < 10; index += -1) {}
+`,
+            snapshot: `
+for (let index = 0; index < 10; index += -1) {}
+                                ~~~~~~~~~~~
+                                The update moves the counter in the wrong direction for this loop condition.
+`,
+        },
+    ],
+    valid: [
+        `for (let i = 0; i < 10; i++) { }`,
+        `for (let index = 0; index < 10; index++) { }`,
+        `for (let index = 10; index >= 0; index--) { }`,
+        `for (let index = 0; 10 > index; index++) { }`,
+        `for (let index = 10; 0 < index; index--) { }`,
+        `for (let index = 10; index >= 0; index += step) { }`,
+        `for (let index = 0; index <= 10; index -= 0) { }`,
+        `for (let index = 0; index < 10; index += 1) { }`,
+        `for (let index = 10; index > 0; index -= 1) { }`,
+        `for (let index = 0; index < 10; index += 2) { }`,
+        `for (let index = 10; index > 0; index -= 2) { }`,
+    ],
+});

package/lib/rules/functionNewCalls.d.ts

@@ -0,0 +1,6 @@
+declare const _default: import("@flint.fyi/core").Rule<{
+    readonly description: "Reports using the Function constructor to create functions from strings.";
+    readonly id: "functionNewCalls";
+    readonly preset: "logical";
+}, import("../nodes.js").TSNodesByName, import("../language.js").TypeScriptServices, "noFunctionConstructor", undefined>;
+export default _default;

package/lib/rules/functionNewCalls.js

@@ -0,0 +1,60 @@
+import * as ts from "typescript";
+import { getTSNodeRange } from "../getTSNodeRange.js";
+import { typescriptLanguage } from "../language.js";
+import { isGlobalDeclaration } from "../utils/isGlobalDeclaration.js";
+import { isGlobalDeclarationOfName } from "../utils/isGlobalDeclarationOfName.js";
+export default typescriptLanguage.createRule({
+    about: {
+        description: "Reports using the Function constructor to create functions from strings.",
+        id: "functionNewCalls",
+        preset: "logical",
+    },
+    messages: {
+        noFunctionConstructor: {
+            primary: "Dynamically creating functions with the Function constructor is insecure and slow.",
+            secondary: [
+                "Using the `Function` constructor to create functions from strings is similar to `eval()` and introduces security risks and performance issues.",
+                "Code passed to the Function constructor is executed in the global scope, making it harder to optimize and potentially allowing arbitrary code execution if user input is involved.",
+            ],
+            suggestions: [
+                "Define functions using function declarations (`function name() {}`) or arrow functions (`() => {}`) instead.",
+                "If dynamic code generation is truly necessary, consider safer alternatives like passing functions as parameters or using a more constrained domain-specific approach.",
+            ],
+        },
+    },
+    setup(context) {
+        function checkNode(node) {
+            if (isFunctionConstructor(node)) {
+                context.report({
+                    message: "noFunctionConstructor",
+                    range: getTSNodeRange(node.expression, context.sourceFile),
+                });
+            }
+        }
+        function isFunctionConstructor(node) {
+            if (ts.isIdentifier(node.expression)) {
+                if (isGlobalDeclarationOfName(node.expression, "Function", context.typeChecker)) {
+                    return true;
+                }
+            }
+            else if (ts.isPropertyAccessExpression(node.expression) &&
+                isGlobalDeclaration(node.expression, context.typeChecker)) {
+                const propertyName = node.expression.name.text;
+                if (propertyName !== "Function") {
+                    return false;
+                }
+                const object = node.expression.expression;
+                if (ts.isIdentifier(object)) {
+                    return object.text === "globalThis" || object.text === "window";
+                }
+            }
+            return false;
+        }
+        return {
+            visitors: {
+                CallExpression: checkNode,
+                NewExpression: checkNode,
+            },
+        };
+    },
+});

package/lib/rules/functionNewCalls.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/rules/functionNewCalls.test.js

@@ -0,0 +1,115 @@
+import rule from "./functionNewCalls.js";
+import { ruleTester } from "./ruleTester.js";
+ruleTester.describe(rule, {
+    invalid: [
+        {
+            code: `
+const fn = new Function("a", "b", "return a + b");
+`,
+            snapshot: `
+const fn = new Function("a", "b", "return a + b");
+               ~~~~~~~~
+               Dynamically creating functions with the Function constructor is insecure and slow.
+`,
+        },
+        {
+            code: `
+const fn = Function("a", "return a");
+`,
+            snapshot: `
+const fn = Function("a", "return a");
+           ~~~~~~~~
+           Dynamically creating functions with the Function constructor is insecure and slow.
+`,
+        },
+        {
+            code: `
+const fn = new Function("return 1");
+`,
+            snapshot: `
+const fn = new Function("return 1");
+               ~~~~~~~~
+               Dynamically creating functions with the Function constructor is insecure and slow.
+`,
+        },
+        {
+            code: `
+const fn = Function();
+`,
+            snapshot: `
+const fn = Function();
+           ~~~~~~~~
+           Dynamically creating functions with the Function constructor is insecure and slow.
+`,
+        },
+        {
+            code: `
+const fn = new globalThis.Function("return 1");
+`,
+            snapshot: `
+const fn = new globalThis.Function("return 1");
+               ~~~~~~~~~~~~~~~~~~~
+               Dynamically creating functions with the Function constructor is insecure and slow.
+`,
+        },
+        {
+            code: `
+const fn = globalThis.Function("return 1");
+`,
+            snapshot: `
+const fn = globalThis.Function("return 1");
+           ~~~~~~~~~~~~~~~~~~~
+           Dynamically creating functions with the Function constructor is insecure and slow.
+`,
+        },
+        {
+            code: `
+const fn = new window.Function("return 1");
+`,
+            snapshot: `
+const fn = new window.Function("return 1");
+               ~~~~~~~~~~~~~~~
+               Dynamically creating functions with the Function constructor is insecure and slow.
+`,
+        },
+        {
+            code: `
+const fn = window.Function("return 1");
+`,
+            snapshot: `
+const fn = window.Function("return 1");
+           ~~~~~~~~~~~~~~~
+           Dynamically creating functions with the Function constructor is insecure and slow.
+`,
+        },
+        {
+            code: `
+const result = new Function("a", "b", "return a + b")(1, 2);
+`,
+            snapshot: `
+const result = new Function("a", "b", "return a + b")(1, 2);
+                   ~~~~~~~~
+                   Dynamically creating functions with the Function constructor is insecure and slow.
+`,
+        },
+        {
+            code: `
+const CustomFunction = Function;
+const fn = new CustomFunction();
+`,
+            snapshot: `
+const CustomFunction = Function;
+const fn = new CustomFunction();
+               ~~~~~~~~~~~~~~
+               Dynamically creating functions with the Function constructor is insecure and slow.
+`,
+        },
+    ],
+    valid: [
+        `const fn = function(a, b) { return a + b; };`,
+        `const fn = (a, b) => a + b;`,
+        `function add(a, b) { return a + b; }`,
+        `class MyFunction {}`,
+        `const fn = new MyFunction();`,
+    ],
+});

package/lib/rules/negativeZeroComparisons.js

@@ -1,24 +1,6 @@
 import * as ts from "typescript";
 import { typescriptLanguage } from "../language.js";
-const comparisonOperators = new Set([
-    ts.SyntaxKind.EqualsEqualsEqualsToken,
-    ts.SyntaxKind.EqualsEqualsToken,
-    ts.SyntaxKind.ExclamationEqualsEqualsToken,
-    ts.SyntaxKind.ExclamationEqualsToken,
-    ts.SyntaxKind.GreaterThanEqualsToken,
-    ts.SyntaxKind.GreaterThanToken,
-    ts.SyntaxKind.LessThanEqualsToken,
-    ts.SyntaxKind.LessThanToken,
-]);
-function isEqualityOperator(operator) {
-    return (operator === "===" ||
-        operator === "==" ||
-        operator === "!==" ||
-        operator === "!=");
-}
-function isNegatedEqualityOperator(operator) {
-    return operator === "!==" || operator === "!=";
-}
+import { isComparisonOperator, isEqualityOperator, isNegatedEqualityOperator, } from "./utils/operators.js";
 function isNegativeZero(node) {
     return (ts.isPrefixUnaryExpression(node) &&
         node.operator === ts.SyntaxKind.MinusToken &&
@@ -51,7 +33,7 @@ export default typescriptLanguage.createRule({
         return {
             visitors: {
                 BinaryExpression: (node) => {
-                    if (!comparisonOperators.has(node.operatorToken.kind) ||
+                    if (!isComparisonOperator(node.operatorToken) ||
                         (!isNegativeZero(node.left) && !isNegativeZero(node.right))) {
                         return;
                     }
@@ -66,12 +48,12 @@ export default typescriptLanguage.createRule({
                         },
                         message: "unexpectedNegativeZeroComparison",
                         range,
-                        suggestions: isEqualityOperator(operator)
+                        suggestions: isEqualityOperator(node.operatorToken)
                             ? [
                                 {
                                     id: "useObjectIs",
                                     range,
-                                    text: generateObjectIsText(node, isNegatedEqualityOperator(operator)),
+                                    text: generateObjectIsText(node, isNegatedEqualityOperator(node.operatorToken)),
                                 },
                             ]
                             : undefined,

package/lib/rules/nonOctalDecimalEscapes.d.ts

@@ -0,0 +1,6 @@
+declare const _default: import("@flint.fyi/core").Rule<{
+    readonly description: "Reports non-octal decimal escape sequences (\\8 and \\9) in string literals.";
+    readonly id: "nonOctalDecimalEscapes";
+    readonly preset: "logical";
+}, import("../nodes.js").TSNodesByName, import("../language.js").TypeScriptServices, "unexpectedEscape", undefined>;
+export default _default;

package/lib/rules/nonOctalDecimalEscapes.js

@@ -0,0 +1,57 @@
+import { typescriptLanguage } from "../language.js";
+const nonOctalDecimalEscapePattern = /\\[89]/g;
+export default typescriptLanguage.createRule({
+    about: {
+        description: "Reports non-octal decimal escape sequences (\\8 and \\9) in string literals.",
+        id: "nonOctalDecimalEscapes",
+        preset: "logical",
+    },
+    messages: {
+        unexpectedEscape: {
+            primary: "Non-octal decimal escape sequences (\\8 and \\9) should not be used in string literals.",
+            secondary: [
+                "Non-octal decimal escape sequences \\8 and \\9 are legacy features that are treated as identity escapes (the same as the literal digits).",
+                "They are optional in the ECMAScript specification and not supported in strict mode in all environments.",
+                "Use the literal digits directly instead.",
+            ],
+            suggestions: [
+                "Remove the backslash to use the literal digit.",
+                "If an escape sequence is needed, use a Unicode escape like \\u0038 or \\u0039.",
+            ],
+        },
+    },
+    setup(context) {
+        function checkNode(node) {
+            const text = node.getText(context.sourceFile);
+            const matches = [...text.matchAll(nonOctalDecimalEscapePattern)];
+            for (const match of matches) {
+                // Ignore escapes where the backslash itself is escaped (e.g. "\\\\8" -> literal "\\8").
+                // Count the number of consecutive backslashes immediately before the match.
+                const matchIndex = match.index;
+                let backslashesBefore = 0;
+                for (let i = matchIndex - 1; i >= 0 && text[i] === "\\"; i--) {
+                    backslashesBefore++;
+                }
+                // If there is an odd number of backslashes before this one, the backslash is escaped
+                // and should not be treated as an escape sequence.
+                if (backslashesBefore % 2 === 1) {
+                    continue;
+                }
+                const start = node.getStart(context.sourceFile) + matchIndex;
+                context.report({
+                    message: "unexpectedEscape",
+                    range: {
+                        begin: start,
+                        end: start + match[0].length,
+                    },
+                });
+            }
+        }
+        return {
+            visitors: {
+                NoSubstitutionTemplateLiteral: checkNode,
+                StringLiteral: checkNode,
+            },
+        };
+    },
+});

package/lib/rules/nonOctalDecimalEscapes.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/rules/nonOctalDecimalEscapes.test.js

@@ -0,0 +1,69 @@
+import rule from "./nonOctalDecimalEscapes.js";
+import { ruleTester } from "./ruleTester.js";
+ruleTester.describe(rule, {
+    invalid: [
+        {
+            code: `
+"\\8"
+`,
+            snapshot: `
+"\\8"
+ ~~
+ Non-octal decimal escape sequences (\\8 and \\9) should not be used in string literals.
+`,
+        },
+        {
+            code: `
+"\\9"
+`,
+            snapshot: `
+"\\9"
+ ~~
+ Non-octal decimal escape sequences (\\8 and \\9) should not be used in string literals.
+`,
+        },
+        {
+            code: `
+"w\\8less"
+`,
+            snapshot: `
+"w\\8less"
+  ~~
+  Non-octal decimal escape sequences (\\8 and \\9) should not be used in string literals.
+`,
+        },
+        {
+            code: `
+"December 1\\9"
+`,
+            snapshot: `
+"December 1\\9"
+           ~~
+           Non-octal decimal escape sequences (\\8 and \\9) should not be used in string literals.
+`,
+        },
+        {
+            code: `
+"Don't use \\8 and \\9 escapes."
+`,
+            snapshot: `
+"Don't use \\8 and \\9 escapes."
+           ~~
+           Non-octal decimal escape sequences (\\8 and \\9) should not be used in string literals.
+                  ~~
+                  Non-octal decimal escape sequences (\\8 and \\9) should not be used in string literals.
+`,
+        },
+        {
+            code: `
+"\\0\\8"
+`,
+            snapshot: `
+"\\0\\8"
+   ~~
+   Non-octal decimal escape sequences (\\8 and \\9) should not be used in string literals.
+`,
+        },
+    ],
+    valid: ['"8"', '"9"', '"w8less"', '"December 19"', '"\\\\8"', '"\\0\\u0038"'],
+});

package/lib/rules/numericLiteralParsing.d.ts

@@ -0,0 +1,6 @@
+declare const _default: import("@flint.fyi/core").Rule<{
+    readonly description: "Reports parseInt calls with binary, hexadecimal, or octal strings that can be replaced with numeric literals.";
+    readonly id: "numericLiteralParsing";
+    readonly preset: "stylistic";
+}, import("../nodes.js").TSNodesByName, import("../language.js").TypeScriptServices, "preferLiteral", undefined>;
+export default _default;

package/lib/rules/numericLiteralParsing.js

@@ -0,0 +1,97 @@
+import * as ts from "typescript";
+import { getTSNodeRange } from "../getTSNodeRange.js";
+import { typescriptLanguage } from "../language.js";
+import { isGlobalDeclaration } from "../utils/isGlobalDeclaration.js";
+function convertToLiteral(value, radix) {
+    const parsed = Number.parseInt(value, radix);
+    if (Number.isNaN(parsed)) {
+        return value;
+    }
+    switch (radix) {
+        case 2:
+            return `0b${parsed.toString(2)}`;
+        case 8:
+            return `0o${parsed.toString(8)}`;
+        case 16:
+            return `0x${parsed.toString(16).toUpperCase()}`;
+        default:
+            return value;
+    }
+}
+function getRadixValue(node) {
+    if (!ts.isNumericLiteral(node)) {
+        return undefined;
+    }
+    const value = Number(node.text);
+    if (![2, 8, 16].includes(value)) {
+        return undefined;
+    }
+    return value;
+}
+// TODO: Use a util like getStaticValue
+function getStringValue(node) {
+    return ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)
+        ? node.text
+        : undefined;
+}
+export default typescriptLanguage.createRule({
+    about: {
+        description: "Reports parseInt calls with binary, hexadecimal, or octal strings that can be replaced with numeric literals.",
+        id: "numericLiteralParsing",
+        preset: "stylistic",
+    },
+    messages: {
+        preferLiteral: {
+            primary: "Use {{ literal }} instead of parseInt with radix {{ radix }}.",
+            secondary: [
+                "Binary, octal, and hexadecimal numeric literals are more readable and direct than using parseInt with a radix.",
+                "Numeric literals are supported natively and don't require function calls.",
+            ],
+            suggestions: ["Replace the parseInt call with the numeric literal."],
+        },
+    },
+    setup(context) {
+        function checkParseIntCall(node) {
+            if (node.arguments.length !== 2) {
+                return;
+            }
+            const stringValue = getStringValue(node.arguments[0]);
+            if (!stringValue) {
+                return;
+            }
+            const radixValue = getRadixValue(node.arguments[1]);
+            if (!radixValue) {
+                return;
+            }
+            context.report({
+                data: {
+                    literal: convertToLiteral(stringValue, radixValue),
+                    radix: String(radixValue),
+                },
+                message: "preferLiteral",
+                range: getTSNodeRange(node, context.sourceFile),
+            });
+        }
+        return {
+            visitors: {
+                CallExpression: (node) => {
+                    if (ts.isIdentifier(node.expression)) {
+                        if (node.expression.text === "parseInt" &&
+                            isGlobalDeclaration(node.expression, context.typeChecker)) {
+                            checkParseIntCall(node);
+                        }
+                    }
+                    else if (ts.isPropertyAccessExpression(node.expression)) {
+                        if (ts.isIdentifier(node.expression.expression) &&
+                            node.expression.expression.text === "Number" &&
+                            ts.isIdentifier(node.expression.name) &&
+                            node.expression.name.text === "parseInt" &&
+                            isGlobalDeclaration(node.expression.expression, context.typeChecker)) {
+                            checkParseIntCall(node);
+                        }
+                    }
+                },
+            },
+        };
+    },
+});

package/lib/rules/numericLiteralParsing.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/rules/numericLiteralParsing.test.js

@@ -0,0 +1,99 @@
+import rule from "./numericLiteralParsing.js";
+import { ruleTester } from "./ruleTester.js";
+ruleTester.describe(rule, {
+    invalid: [
+        {
+            code: `
+const binary = parseInt("111110111", 2);
+`,
+            snapshot: `
+const binary = parseInt("111110111", 2);
+               ~~~~~~~~~~~~~~~~~~~~~~~~
+               Use 0b111110111 instead of parseInt with radix 2.
+`,
+        },
+        {
+            code: `
+const octal = parseInt("767", 8);
+`,
+            snapshot: `
+const octal = parseInt("767", 8);
+              ~~~~~~~~~~~~~~~~~~
+              Use 0o767 instead of parseInt with radix 8.
+`,
+        },
+        {
+            code: `
+const hex = parseInt("1F7", 16);
+`,
+            snapshot: `
+const hex = parseInt("1F7", 16);
+            ~~~~~~~~~~~~~~~~~~~
+            Use 0x1F7 instead of parseInt with radix 16.
+`,
+        },
+        {
+            code: `
+const value = Number.parseInt("111110111", 2);
+`,
+            snapshot: `
+const value = Number.parseInt("111110111", 2);
+              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+              Use 0b111110111 instead of parseInt with radix 2.
+`,
+        },
+        {
+            code: `
+const result = Number.parseInt("767", 8);
+`,
+            snapshot: `
+const result = Number.parseInt("767", 8);
+               ~~~~~~~~~~~~~~~~~~~~~~~~~
+               Use 0o767 instead of parseInt with radix 8.
+`,
+        },
+        {
+            code: `
+const num = Number.parseInt("1F7", 16);
+`,
+            snapshot: `
+const num = Number.parseInt("1F7", 16);
+            ~~~~~~~~~~~~~~~~~~~~~~~~~~
+            Use 0x1F7 instead of parseInt with radix 16.
+`,
+        },
+        {
+            code: `
+const value = parseInt(\`111110111\`, 2);
+`,
+            snapshot: `
+const value = parseInt(\`111110111\`, 2);
+              ~~~~~~~~~~~~~~~~~~~~~~~~
+              Use 0b111110111 instead of parseInt with radix 2.
+`,
+        },
+    ],
+    valid: [
+        `const decimal = parseInt("123");`,
+        `const value = parseInt("123", 10);`,
+        `const ternary = parseInt("102", 3);`,
+        `const binary = 0b111110111;`,
+        `const octal = 0o767;`,
+        `const hex = 0x1F7;`,
+        `const dynamic = parseInt(value, 2);`,
+        `const variable = parseInt("111", radix);`,
+        `const single = parseInt("111");`,
+        `Number.parseInt("123");`,
+        `Number.parseInt("123", 10);`,
+        `
+			function parseInt(...values: unknown[]) {}
+			parseInt("1", 2);
+			export {};
+		`,
+        `
+			const Number = { parseInt(...values: unknown[]) {} };
+			Number.parseInt("1", 2);
+			export {};
+		`,
+    ],
+});

package/lib/rules/selfAssignments.d.ts

@@ -0,0 +1,6 @@
+declare const _default: import("@flint.fyi/core").Rule<{
+    readonly description: "Reports self-assignments which have no effect and are likely errors.";
+    readonly id: "selfAssignments";
+    readonly preset: "logical";
+}, import("../nodes.js").TSNodesByName, import("../language.js").TypeScriptServices, "selfAssignment", undefined>;
+export default _default;