@flint.fyi/ts 0.14.3 → 0.14.5

package/lib/rules/emptyBlocks.test.js

@@ -0,0 +1,135 @@
+import rule from "./emptyBlocks.js";
+import { ruleTester } from "./ruleTester.js";
+ruleTester.describe(rule, {
+    invalid: [
+        {
+            code: `
+if (condition) {}
+`,
+            snapshot: `
+if (condition) {}
+               ~~
+               Empty block statements should be removed or contain code.
+`,
+        },
+        {
+            code: `
+if (condition) {
+} else {}
+`,
+            snapshot: `
+if (condition) {
+               ~
+               Empty block statements should be removed or contain code.
+} else {}
+~
+       ~~
+       Empty block statements should be removed or contain code.
+`,
+        },
+        {
+            code: `
+while (condition) {}
+`,
+            snapshot: `
+while (condition) {}
+                  ~~
+                  Empty block statements should be removed or contain code.
+`,
+        },
+        {
+            code: `
+for (let i = 0; i < 10; i++) {}
+`,
+            snapshot: `
+for (let i = 0; i < 10; i++) {}
+                             ~~
+                             Empty block statements should be removed or contain code.
+`,
+        },
+        {
+            code: `
+switch (value) {}
+`,
+            snapshot: `
+switch (value) {}
+               ~~
+               Empty block statements should be removed or contain code.
+`,
+        },
+        {
+            code: `
+do {} while (condition);
+`,
+            snapshot: `
+do {} while (condition);
+   ~~
+   Empty block statements should be removed or contain code.
+`,
+        },
+        {
+            code: `
+if (x) {
+    doSomething();
+} else if (y) {}
+`,
+            snapshot: `
+if (x) {
+    doSomething();
+} else if (y) {}
+              ~~
+              Empty block statements should be removed or contain code.
+`,
+        },
+        {
+            code: `
+try {
+    doSomething();
+} finally {}
+`,
+            snapshot: `
+try {
+    doSomething();
+} finally {}
+          ~~
+          Empty block statements should be removed or contain code.
+`,
+        },
+    ],
+    valid: [
+        `if (condition) { doSomething(); }`,
+        `while (condition) { doSomething(); }`,
+        `for (let i = 0; i < 10; i++) { doSomething(); }`,
+        `switch (value) { case 1: break; }`,
+        `do { doSomething(); } while (condition);`,
+        `function test() {}`,
+        `const fn = function() {};`,
+        `const arrow = () => {};`,
+        `class MyClass { method() {} }`,
+        `class MyClass { constructor() {} }`,
+        `class MyClass { get value() {} }`,
+        `class MyClass { set value(v) {} }`,
+        `
+if (condition) {
+    // Intentionally empty
+}
+`,
+        `
+while (condition) {
+    /* Do nothing */
+}
+`,
+        `
+try {
+    doSomething();
+} catch (error) {}
+`,
+        `
+try {
+    doSomething();
+} catch (error) {
+    // Ignore errors
+}
+`,
+    ],
+});

package/lib/rules/forDirections.d.ts

@@ -0,0 +1,6 @@
+declare const _default: import("@flint.fyi/core").Rule<{
+    readonly description: "Reports for loops with counter variables that move in the wrong direction.";
+    readonly id: "forDirections";
+    readonly preset: "stylistic";
+}, import("../nodes.js").TSNodesByName, import("../language.js").TypeScriptServices, "wrongDirection", undefined>;
+export default _default;

package/lib/rules/forDirections.js

@@ -0,0 +1,124 @@
+import * as ts from "typescript";
+import { getTSNodeRange } from "../getTSNodeRange.js";
+import { typescriptLanguage } from "../language.js";
+function getConditionDirection(condition, counterName) {
+    if (!ts.isBinaryExpression(condition)) {
+        return undefined;
+    }
+    const leftName = getCounterName(condition.left);
+    const rightName = getCounterName(condition.right);
+    const isCounterLeft = leftName === counterName;
+    const isCounterRight = rightName === counterName;
+    if (!isCounterLeft && !isCounterRight) {
+        return undefined;
+    }
+    const { operatorToken } = condition;
+    if (isCounterLeft) {
+        if (operatorToken.kind === ts.SyntaxKind.LessThanToken ||
+            operatorToken.kind === ts.SyntaxKind.LessThanEqualsToken) {
+            return 1;
+        }
+        if (operatorToken.kind === ts.SyntaxKind.GreaterThanToken ||
+            operatorToken.kind === ts.SyntaxKind.GreaterThanEqualsToken) {
+            return -1;
+        }
+    }
+    else {
+        if (operatorToken.kind === ts.SyntaxKind.LessThanToken ||
+            operatorToken.kind === ts.SyntaxKind.LessThanEqualsToken) {
+            return -1;
+        }
+        if (operatorToken.kind === ts.SyntaxKind.GreaterThanToken ||
+            operatorToken.kind === ts.SyntaxKind.GreaterThanEqualsToken) {
+            return 1;
+        }
+    }
+    return undefined;
+}
+function getCounterName(node) {
+    return ts.isIdentifier(node) ? node.text : undefined;
+}
+function getUpdateDirection(update) {
+    if (ts.isPostfixUnaryExpression(update) ||
+        ts.isPrefixUnaryExpression(update)) {
+        switch (update.operator) {
+            case ts.SyntaxKind.MinusMinusToken:
+                return -1;
+            case ts.SyntaxKind.PlusPlusToken:
+                return 1;
+            default:
+                return undefined;
+        }
+    }
+    if (ts.isBinaryExpression(update)) {
+        const { operatorToken, right } = update;
+        if (operatorToken.kind === ts.SyntaxKind.PlusEqualsToken ||
+            operatorToken.kind === ts.SyntaxKind.MinusEqualsToken) {
+            if (ts.isNumericLiteral(right)) {
+                const value = Number(right.text);
+                if (operatorToken.kind === ts.SyntaxKind.PlusEqualsToken) {
+                    return value > 0 ? 1 : value < 0 ? -1 : 0;
+                }
+                return value > 0 ? -1 : value < 0 ? 1 : 0;
+            }
+            if (ts.isPrefixUnaryExpression(right) &&
+                right.operator === ts.SyntaxKind.MinusToken &&
+                ts.isNumericLiteral(right.operand)) {
+                const value = Number(right.operand.text);
+                if (operatorToken.kind === ts.SyntaxKind.PlusEqualsToken) {
+                    return value > 0 ? -1 : 1;
+                }
+                return value > 0 ? 1 : -1;
+            }
+        }
+    }
+    return undefined;
+}
+export default typescriptLanguage.createRule({
+    about: {
+        description: "Reports for loops with counter variables that move in the wrong direction.",
+        id: "forDirections",
+        preset: "stylistic",
+    },
+    messages: {
+        wrongDirection: {
+            primary: "The update moves the counter in the wrong direction for this loop condition.",
+            secondary: [
+                "A for loop with a counter that moves in the wrong direction relative to its stop condition will run infinitely or never execute.",
+                "When the counter increases but the condition expects it to decrease (or vice versa), the loop logic is incorrect.",
+            ],
+            suggestions: [
+                "Verify the loop counter update direction matches the condition.",
+            ],
+        },
+    },
+    setup(context) {
+        return {
+            visitors: {
+                ForStatement: (node) => {
+                    if (!node.condition ||
+                        !node.incrementor ||
+                        !node.initializer ||
+                        !ts.isVariableDeclarationList(node.initializer)) {
+                        return;
+                    }
+                    const declaration = node.initializer.declarations.at(0);
+                    if (!declaration || !ts.isIdentifier(declaration.name)) {
+                        return;
+                    }
+                    const updateDirection = getUpdateDirection(node.incrementor);
+                    if (!updateDirection) {
+                        return;
+                    }
+                    const conditionDirection = getConditionDirection(node.condition, declaration.name.text);
+                    if (updateDirection !== conditionDirection) {
+                        context.report({
+                            message: "wrongDirection",
+                            range: getTSNodeRange(node.incrementor, context.sourceFile),
+                        });
+                    }
+                },
+            },
+        };
+    },
+});

package/lib/rules/forDirections.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/rules/forDirections.test.js

@@ -0,0 +1,99 @@
+import rule from "./forDirections.js";
+import { ruleTester } from "./ruleTester.js";
+ruleTester.describe(rule, {
+    invalid: [
+        {
+            code: `
+for (let i = 0; i < 10; i--) {}
+`,
+            snapshot: `
+for (let i = 0; i < 10; i--) {}
+                        ~~~
+                        The update moves the counter in the wrong direction for this loop condition.
+`,
+        },
+        {
+            code: `
+for (let index = 0; index < 10; index--) {}
+`,
+            snapshot: `
+for (let index = 0; index < 10; index--) {}
+                                ~~~~~~~
+                                The update moves the counter in the wrong direction for this loop condition.
+`,
+        },
+        {
+            code: `
+for (let index = 10; index >= 0; index++) {}
+`,
+            snapshot: `
+for (let index = 10; index >= 0; index++) {}
+                                 ~~~~~~~
+                                 The update moves the counter in the wrong direction for this loop condition.
+`,
+        },
+        {
+            code: `
+for (let index = 0; index > 10; index++) {}
+`,
+            snapshot: `
+for (let index = 0; index > 10; index++) {}
+                                ~~~~~~~
+                                The update moves the counter in the wrong direction for this loop condition.
+`,
+        },
+        {
+            code: `
+for (let index = 0; 10 > index; index--) {}
+`,
+            snapshot: `
+for (let index = 0; 10 > index; index--) {}
+                                ~~~~~~~
+                                The update moves the counter in the wrong direction for this loop condition.
+`,
+        },
+        {
+            code: `
+for (let index = 0; index < 10; index -= 1) {}
+`,
+            snapshot: `
+for (let index = 0; index < 10; index -= 1) {}
+                                ~~~~~~~~~~
+                                The update moves the counter in the wrong direction for this loop condition.
+`,
+        },
+        {
+            code: `
+for (let index = 10; index > 0; index += 1) {}
+`,
+            snapshot: `
+for (let index = 10; index > 0; index += 1) {}
+                                ~~~~~~~~~~
+                                The update moves the counter in the wrong direction for this loop condition.
+`,
+        },
+        {
+            code: `
+for (let index = 0; index < 10; index += -1) {}
+`,
+            snapshot: `
+for (let index = 0; index < 10; index += -1) {}
+                                ~~~~~~~~~~~
+                                The update moves the counter in the wrong direction for this loop condition.
+`,
+        },
+    ],
+    valid: [
+        `for (let i = 0; i < 10; i++) { }`,
+        `for (let index = 0; index < 10; index++) { }`,
+        `for (let index = 10; index >= 0; index--) { }`,
+        `for (let index = 0; 10 > index; index++) { }`,
+        `for (let index = 10; 0 < index; index--) { }`,
+        `for (let index = 10; index >= 0; index += step) { }`,
+        `for (let index = 0; index <= 10; index -= 0) { }`,
+        `for (let index = 0; index < 10; index += 1) { }`,
+        `for (let index = 10; index > 0; index -= 1) { }`,
+        `for (let index = 0; index < 10; index += 2) { }`,
+        `for (let index = 10; index > 0; index -= 2) { }`,
+    ],
+});

package/lib/rules/functionNewCalls.d.ts

@@ -0,0 +1,6 @@
+declare const _default: import("@flint.fyi/core").Rule<{
+    readonly description: "Reports using the Function constructor to create functions from strings.";
+    readonly id: "functionNewCalls";
+    readonly preset: "logical";
+}, import("../nodes.js").TSNodesByName, import("../language.js").TypeScriptServices, "noFunctionConstructor", undefined>;
+export default _default;

package/lib/rules/functionNewCalls.js

@@ -0,0 +1,60 @@
+import * as ts from "typescript";
+import { getTSNodeRange } from "../getTSNodeRange.js";
+import { typescriptLanguage } from "../language.js";
+import { isGlobalDeclaration } from "../utils/isGlobalDeclaration.js";
+import { isGlobalDeclarationOfName } from "../utils/isGlobalDeclarationOfName.js";
+export default typescriptLanguage.createRule({
+    about: {
+        description: "Reports using the Function constructor to create functions from strings.",
+        id: "functionNewCalls",
+        preset: "logical",
+    },
+    messages: {
+        noFunctionConstructor: {
+            primary: "Dynamically creating functions with the Function constructor is insecure and slow.",
+            secondary: [
+                "Using the `Function` constructor to create functions from strings is similar to `eval()` and introduces security risks and performance issues.",
+                "Code passed to the Function constructor is executed in the global scope, making it harder to optimize and potentially allowing arbitrary code execution if user input is involved.",
+            ],
+            suggestions: [
+                "Define functions using function declarations (`function name() {}`) or arrow functions (`() => {}`) instead.",
+                "If dynamic code generation is truly necessary, consider safer alternatives like passing functions as parameters or using a more constrained domain-specific approach.",
+            ],
+        },
+    },
+    setup(context) {
+        function checkNode(node) {
+            if (isFunctionConstructor(node)) {
+                context.report({
+                    message: "noFunctionConstructor",
+                    range: getTSNodeRange(node.expression, context.sourceFile),
+                });
+            }
+        }
+        function isFunctionConstructor(node) {
+            if (ts.isIdentifier(node.expression)) {
+                if (isGlobalDeclarationOfName(node.expression, "Function", context.typeChecker)) {
+                    return true;
+                }
+            }
+            else if (ts.isPropertyAccessExpression(node.expression) &&
+                isGlobalDeclaration(node.expression, context.typeChecker)) {
+                const propertyName = node.expression.name.text;
+                if (propertyName !== "Function") {
+                    return false;
+                }
+                const object = node.expression.expression;
+                if (ts.isIdentifier(object)) {
+                    return object.text === "globalThis" || object.text === "window";
+                }
+            }
+            return false;
+        }
+        return {
+            visitors: {
+                CallExpression: checkNode,
+                NewExpression: checkNode,
+            },
+        };
+    },
+});

package/lib/rules/functionNewCalls.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/rules/functionNewCalls.test.js

@@ -0,0 +1,115 @@
+import rule from "./functionNewCalls.js";
+import { ruleTester } from "./ruleTester.js";
+ruleTester.describe(rule, {
+    invalid: [
+        {
+            code: `
+const fn = new Function("a", "b", "return a + b");
+`,
+            snapshot: `
+const fn = new Function("a", "b", "return a + b");
+               ~~~~~~~~
+               Dynamically creating functions with the Function constructor is insecure and slow.
+`,
+        },
+        {
+            code: `
+const fn = Function("a", "return a");
+`,
+            snapshot: `
+const fn = Function("a", "return a");
+           ~~~~~~~~
+           Dynamically creating functions with the Function constructor is insecure and slow.
+`,
+        },
+        {
+            code: `
+const fn = new Function("return 1");
+`,
+            snapshot: `
+const fn = new Function("return 1");
+               ~~~~~~~~
+               Dynamically creating functions with the Function constructor is insecure and slow.
+`,
+        },
+        {
+            code: `
+const fn = Function();
+`,
+            snapshot: `
+const fn = Function();
+           ~~~~~~~~
+           Dynamically creating functions with the Function constructor is insecure and slow.
+`,
+        },
+        {
+            code: `
+const fn = new globalThis.Function("return 1");
+`,
+            snapshot: `
+const fn = new globalThis.Function("return 1");
+               ~~~~~~~~~~~~~~~~~~~
+               Dynamically creating functions with the Function constructor is insecure and slow.
+`,
+        },
+        {
+            code: `
+const fn = globalThis.Function("return 1");
+`,
+            snapshot: `
+const fn = globalThis.Function("return 1");
+           ~~~~~~~~~~~~~~~~~~~
+           Dynamically creating functions with the Function constructor is insecure and slow.
+`,
+        },
+        {
+            code: `
+const fn = new window.Function("return 1");
+`,
+            snapshot: `
+const fn = new window.Function("return 1");
+               ~~~~~~~~~~~~~~~
+               Dynamically creating functions with the Function constructor is insecure and slow.
+`,
+        },
+        {
+            code: `
+const fn = window.Function("return 1");
+`,
+            snapshot: `
+const fn = window.Function("return 1");
+           ~~~~~~~~~~~~~~~
+           Dynamically creating functions with the Function constructor is insecure and slow.
+`,
+        },
+        {
+            code: `
+const result = new Function("a", "b", "return a + b")(1, 2);
+`,
+            snapshot: `
+const result = new Function("a", "b", "return a + b")(1, 2);
+                   ~~~~~~~~
+                   Dynamically creating functions with the Function constructor is insecure and slow.
+`,
+        },
+        {
+            code: `
+const CustomFunction = Function;
+const fn = new CustomFunction();
+`,
+            snapshot: `
+const CustomFunction = Function;
+const fn = new CustomFunction();
+               ~~~~~~~~~~~~~~
+               Dynamically creating functions with the Function constructor is insecure and slow.
+`,
+        },
+    ],
+    valid: [
+        `const fn = function(a, b) { return a + b; };`,
+        `const fn = (a, b) => a + b;`,
+        `function add(a, b) { return a + b; }`,
+        `class MyFunction {}`,
+        `const fn = new MyFunction();`,
+    ],
+});

package/lib/rules/negativeZeroComparisons.js

@@ -1,24 +1,6 @@
 import * as ts from "typescript";
 import { typescriptLanguage } from "../language.js";
-const comparisonOperators = new Set([
-    ts.SyntaxKind.EqualsEqualsEqualsToken,
-    ts.SyntaxKind.EqualsEqualsToken,
-    ts.SyntaxKind.ExclamationEqualsEqualsToken,
-    ts.SyntaxKind.ExclamationEqualsToken,
-    ts.SyntaxKind.GreaterThanEqualsToken,
-    ts.SyntaxKind.GreaterThanToken,
-    ts.SyntaxKind.LessThanEqualsToken,
-    ts.SyntaxKind.LessThanToken,
-]);
-function isEqualityOperator(operator) {
-    return (operator === "===" ||
-        operator === "==" ||
-        operator === "!==" ||
-        operator === "!=");
-}
-function isNegatedEqualityOperator(operator) {
-    return operator === "!==" || operator === "!=";
-}
+import { isComparisonOperator, isEqualityOperator, isNegatedEqualityOperator, } from "./utils/operators.js";
 function isNegativeZero(node) {
     return (ts.isPrefixUnaryExpression(node) &&
         node.operator === ts.SyntaxKind.MinusToken &&
@@ -51,7 +33,7 @@ export default typescriptLanguage.createRule({
         return {
             visitors: {
                 BinaryExpression: (node) => {
-                    if (!comparisonOperators.has(node.operatorToken.kind) ||
+                    if (!isComparisonOperator(node.operatorToken) ||
                         (!isNegativeZero(node.left) && !isNegativeZero(node.right))) {
                         return;
                     }
@@ -66,12 +48,12 @@ export default typescriptLanguage.createRule({
                         },
                         message: "unexpectedNegativeZeroComparison",
                         range,
-                        suggestions: isEqualityOperator(operator)
+                        suggestions: isEqualityOperator(node.operatorToken)
                             ? [
                                 {
                                     id: "useObjectIs",
                                     range,
-                                    text: generateObjectIsText(node, isNegatedEqualityOperator(operator)),
+                                    text: generateObjectIsText(node, isNegatedEqualityOperator(node.operatorToken)),
                                 },
                             ]
                             : undefined,

package/lib/rules/nonOctalDecimalEscapes.d.ts

@@ -0,0 +1,6 @@
+declare const _default: import("@flint.fyi/core").Rule<{
+    readonly description: "Reports non-octal decimal escape sequences (\\8 and \\9) in string literals.";
+    readonly id: "nonOctalDecimalEscapes";
+    readonly preset: "logical";
+}, import("../nodes.js").TSNodesByName, import("../language.js").TypeScriptServices, "unexpectedEscape", undefined>;
+export default _default;

package/lib/rules/nonOctalDecimalEscapes.js

@@ -0,0 +1,57 @@
+import { typescriptLanguage } from "../language.js";
+const nonOctalDecimalEscapePattern = /\\[89]/g;
+export default typescriptLanguage.createRule({
+    about: {
+        description: "Reports non-octal decimal escape sequences (\\8 and \\9) in string literals.",
+        id: "nonOctalDecimalEscapes",
+        preset: "logical",
+    },
+    messages: {
+        unexpectedEscape: {
+            primary: "Non-octal decimal escape sequences (\\8 and \\9) should not be used in string literals.",
+            secondary: [
+                "Non-octal decimal escape sequences \\8 and \\9 are legacy features that are treated as identity escapes (the same as the literal digits).",
+                "They are optional in the ECMAScript specification and not supported in strict mode in all environments.",
+                "Use the literal digits directly instead.",
+            ],
+            suggestions: [
+                "Remove the backslash to use the literal digit.",
+                "If an escape sequence is needed, use a Unicode escape like \\u0038 or \\u0039.",
+            ],
+        },
+    },
+    setup(context) {
+        function checkNode(node) {
+            const text = node.getText(context.sourceFile);
+            const matches = [...text.matchAll(nonOctalDecimalEscapePattern)];
+            for (const match of matches) {
+                // Ignore escapes where the backslash itself is escaped (e.g. "\\\\8" -> literal "\\8").
+                // Count the number of consecutive backslashes immediately before the match.
+                const matchIndex = match.index;
+                let backslashesBefore = 0;
+                for (let i = matchIndex - 1; i >= 0 && text[i] === "\\"; i--) {
+                    backslashesBefore++;
+                }
+                // If there is an odd number of backslashes before this one, the backslash is escaped
+                // and should not be treated as an escape sequence.
+                if (backslashesBefore % 2 === 1) {
+                    continue;
+                }
+                const start = node.getStart(context.sourceFile) + matchIndex;
+                context.report({
+                    message: "unexpectedEscape",
+                    range: {
+                        begin: start,
+                        end: start + match[0].length,
+                    },
+                });
+            }
+        }
+        return {
+            visitors: {
+                NoSubstitutionTemplateLiteral: checkNode,
+                StringLiteral: checkNode,
+            },
+        };
+    },
+});

package/lib/rules/nonOctalDecimalEscapes.test.d.ts

@@ -0,0 +1 @@
+export {};