@flint.fyi/ts 0.15.0 → 0.18.0

package/lib/rules/regexResultArrayGroups.js

@@ -0,0 +1,187 @@
+import { ruleCreator } from "./ruleCreator.js";
+import { skipParentheses } from "./utils/skipParentheses.js";
+import { getRegExpConstruction } from "./utils/getRegExpConstruction.js";
+import { getRegExpLiteralDetails } from "./utils/getRegExpLiteralDetails.js";
+import { getTSNodeRange, typescriptLanguage } from "@flint.fyi/typescript-language";
+import ts from "typescript";
+import { parseRegExpLiteral, visitRegExpAST } from "@eslint-community/regexpp";
+//#region src/rules/regexResultArrayGroups.ts
+function extractCallExpression(expression) {
+	const unwrapped = skipParentheses(expression);
+	if (ts.isCallExpression(unwrapped)) return unwrapped;
+	if (ts.isNonNullExpression(unwrapped) || ts.isAsExpression(unwrapped) || ts.isTypeAssertionExpression(unwrapped)) return extractCallExpression(unwrapped.expression);
+}
+function findAssignmentsToSymbol(symbol, sourceFile, typeChecker) {
+	const assignments = [];
+	function visit(node) {
+		if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.EqualsToken && ts.isIdentifier(node.left)) {
+			if (typeChecker.getSymbolAtLocation(node.left) === symbol) assignments.push(node);
+		}
+		ts.forEachChild(node, visit);
+	}
+	visit(sourceFile);
+	return assignments;
+}
+function getNamedCapturingGroups(pattern, flags) {
+	const groups = [];
+	let ast;
+	try {
+		ast = parseRegExpLiteral(new RegExp(pattern, flags));
+	} catch {
+		return groups;
+	}
+	let index = 0;
+	visitRegExpAST(ast, { onCapturingGroupEnter(node) {
+		index++;
+		if (node.name) groups.push({
+			index,
+			name: node.name
+		});
+	} });
+	return groups;
+}
+function getNamedGroupsFromExpression(node, typeChecker, sourceFile) {
+	const unwrapped = skipParentheses(node);
+	if (ts.isIdentifier(unwrapped)) {
+		const symbol = typeChecker.getSymbolAtLocation(unwrapped);
+		if (symbol) return getRegexInfoFromSymbol(symbol.flags & ts.SymbolFlags.Alias ? typeChecker.getAliasedSymbol(symbol) : symbol, typeChecker, sourceFile);
+	}
+	if (ts.isCallExpression(unwrapped)) {
+		const regexInfo = getRegexFromCall(unwrapped, typeChecker, sourceFile);
+		if (regexInfo) {
+			const namedGroups = getNamedCapturingGroups(regexInfo.pattern, regexInfo.flags);
+			if (namedGroups.length) return namedGroups;
+		}
+	}
+	if (ts.isNonNullExpression(unwrapped) || ts.isAsExpression(unwrapped) || ts.isTypeAssertionExpression(unwrapped)) return getNamedGroupsFromExpression(unwrapped.expression, typeChecker, sourceFile);
+}
+function getRegexFromCall(node, typeChecker, sourceFile) {
+	return getRegexFromExecCall(node, typeChecker, sourceFile) ?? getRegexFromMatchCall(node, typeChecker, sourceFile) ?? getRegexFromMatchAllCall(node, typeChecker, sourceFile);
+}
+function getRegexFromExecCall(node, typeChecker, sourceFile) {
+	if (!ts.isPropertyAccessExpression(node.expression)) return;
+	if (node.expression.name.text !== "exec" || node.arguments.length !== 1) return;
+	const regexObject = node.expression.expression;
+	return getRegexInfoFromExpression(regexObject, typeChecker, sourceFile);
+}
+function getRegexFromMatchAllCall(node, typeChecker, sourceFile) {
+	if (!ts.isPropertyAccessExpression(node.expression)) return;
+	if (node.expression.name.text !== "matchAll" || node.arguments.length !== 1) return;
+	if (!(typeChecker.getTypeAtLocation(node.expression.expression).flags & ts.TypeFlags.StringLike)) return;
+	const regexArg = node.arguments[0];
+	return getRegexInfoFromExpression(regexArg, typeChecker, sourceFile);
+}
+function getRegexFromMatchCall(node, typeChecker, sourceFile) {
+	if (!ts.isPropertyAccessExpression(node.expression) || node.expression.name.text !== "match" || node.arguments.length !== 1) return;
+	if (!(typeChecker.getTypeAtLocation(node.expression.expression).flags & ts.TypeFlags.StringLike)) return;
+	const regexArg = node.arguments[0];
+	const info = getRegexInfoFromExpression(regexArg, typeChecker, sourceFile);
+	if (info?.flags.includes("g")) return;
+	return info;
+}
+function getRegexInfoFromExpression(node, typeChecker, sourceFile) {
+	const unwrapped = skipParentheses(node);
+	if (ts.isRegularExpressionLiteral(unwrapped)) return getRegExpLiteralDetails(unwrapped, { sourceFile });
+	if (ts.isCallExpression(unwrapped) || ts.isNewExpression(unwrapped)) {
+		const construction = getRegExpConstruction(unwrapped, {
+			sourceFile,
+			typeChecker
+		});
+		if (construction) return {
+			flags: construction.flags,
+			pattern: construction.pattern.replace(/\\\\/g, "\\")
+		};
+	}
+	if (ts.isIdentifier(unwrapped)) {
+		const symbol = typeChecker.getSymbolAtLocation(unwrapped);
+		if (symbol) {
+			const declarations = symbol.getDeclarations();
+			if (declarations) {
+				for (const declaration of declarations) if (ts.isVariableDeclaration(declaration) && declaration.initializer) return getRegexInfoFromExpression(declaration.initializer, typeChecker, sourceFile);
+			}
+		}
+	}
+}
+function getRegexInfoFromSymbol(symbol, typeChecker, sourceFile) {
+	const declarations = symbol.getDeclarations();
+	if (declarations) for (const declaration of declarations) {
+		if (ts.isVariableDeclaration(declaration) && declaration.initializer) {
+			const callExpression = extractCallExpression(declaration.initializer);
+			if (callExpression) {
+				const regexInfo = getRegexFromCall(callExpression, typeChecker, sourceFile);
+				if (regexInfo) {
+					const namedGroups = getNamedCapturingGroups(regexInfo.pattern, regexInfo.flags);
+					if (namedGroups.length) return namedGroups;
+				}
+			}
+		}
+		if (ts.isParameter(declaration)) continue;
+	}
+	const assignments = findAssignmentsToSymbol(symbol, sourceFile, typeChecker);
+	for (const assignment of assignments) {
+		const callExpression = extractCallExpression(assignment.right);
+		if (callExpression) {
+			const regexInfo = getRegexFromCall(callExpression, typeChecker, sourceFile);
+			if (regexInfo) {
+				const namedGroups = getNamedCapturingGroups(regexInfo.pattern, regexInfo.flags);
+				if (namedGroups.length) return namedGroups;
+			}
+		}
+	}
+}
+function isAnyType(type) {
+	return (type.flags & ts.TypeFlags.Any) !== 0;
+}
+function isRegExpExecArrayOrRegExpMatchArray(type, typeChecker) {
+	const symbol = type.getSymbol();
+	if (symbol) {
+		const name = symbol.getName();
+		if (name === "RegExpExecArray" || name === "RegExpMatchArray") return true;
+	}
+	if (type.isUnionOrIntersection()) return type.types.every((constituent) => isRegExpExecArrayOrRegExpMatchArray(constituent, typeChecker) || (constituent.flags & ts.TypeFlags.Null) !== 0 || (constituent.flags & ts.TypeFlags.Undefined) !== 0);
+	return false;
+}
+var regexResultArrayGroups_default = ruleCreator.createRule(typescriptLanguage, {
+	about: {
+		description: "Reports indexed access on regex result arrays when named capturing groups should be used.",
+		id: "regexResultArrayGroups",
+		presets: ["stylisticStrict"]
+	},
+	messages: { preferGroups: {
+		primary: "Use `.groups.{{ name }}` instead of numeric index for the named capturing group '{{ name }}'.",
+		secondary: ["When a regex has named capturing groups, accessing them by name is more readable and maintainable.", "Numeric indices are fragile and can break if the regex pattern is modified."],
+		suggestions: ["Replace the indexed access with `.groups.{{ name }}`.", "Use the named capturing group syntax for better code clarity."]
+	} },
+	setup(context) {
+		return { visitors: { ElementAccessExpression: (node, { sourceFile, typeChecker }) => {
+			const argument = skipParentheses(node.argumentExpression);
+			if (!ts.isNumericLiteral(argument)) return;
+			const index = Number(argument.text);
+			if (index <= 0 || !Number.isInteger(index)) return;
+			const object = skipParentheses(node.expression);
+			const objectType = typeChecker.getTypeAtLocation(object);
+			if (isAnyType(objectType)) return;
+			if (!isRegExpExecArrayOrRegExpMatchArray(objectType, typeChecker)) return;
+			const namedGroups = getNamedGroupsFromExpression(object, typeChecker, sourceFile);
+			if (!namedGroups) return;
+			const namedGroup = namedGroups.find((group) => group.index === index);
+			if (!namedGroup) return;
+			context.report({
+				data: { name: namedGroup.name },
+				fix: {
+					range: getTSNodeRange(node, sourceFile),
+					text: `${object.getText(sourceFile)}${node.questionDotToken ? "?" : ""}.groups.${namedGroup.name}`
+				},
+				message: "preferGroups",
+				range: {
+					begin: node.argumentExpression.getStart(sourceFile),
+					end: node.getEnd()
+				}
+			});
+		} } };
+	}
+});
+//#endregion
+export { regexResultArrayGroups_default as default };
+
+//# sourceMappingURL=regexResultArrayGroups.js.map

package/lib/rules/regexSetOperationOptimizations.d.ts

@@ -0,0 +1,10 @@
+declare const _default: import("@flint.fyi/core").Rule<{
+    readonly description: "Reports set operations in regular expressions that can be simplified.";
+    readonly id: "regexSetOperationOptimizations";
+    readonly presets: ["logical", "logicalStrict"];
+} & {
+    presets?: ("javascript" | "logical" | "logicalStrict" | "stylistic" | "stylisticStrict")[];
+    url: string;
+}, object, object, "toIntersection" | "toNegationOfConjunction" | "toNegationOfDisjunction" | "toSubtraction", import("@flint.fyi/core").AnyOptionalSchema>;
+export default _default;
+//# sourceMappingURL=regexSetOperationOptimizations.d.ts.map

package/lib/rules/regexSetOperationOptimizations.js

@@ -0,0 +1,177 @@
+import { ruleCreator } from "./ruleCreator.js";
+import { getRegExpLiteralDetails } from "./utils/getRegExpLiteralDetails.js";
+import { getTSNodeRange, typescriptLanguage } from "@flint.fyi/typescript-language";
+import { RegExpParser, visitRegExpAST } from "@eslint-community/regexpp";
+import { toUnicodeSet } from "regexp-ast-analysis";
+//#region src/rules/regexSetOperationOptimizations.ts
+function collectIntersectionOperands(expression) {
+	const operands = [];
+	let operand = expression;
+	while (operand.type === "ClassIntersection") {
+		operands.push(operand.right);
+		operand = operand.left;
+	}
+	return [operand, ...operands.toReversed()];
+}
+function getParsedElement(pattern, unicodeSets) {
+	try {
+		const ast = new RegExpParser().parsePattern(pattern, void 0, void 0, {
+			unicode: false,
+			unicodeSets
+		});
+		if (ast.alternatives.length !== 1) return;
+		const alt = ast.alternatives[0];
+		if (alt.elements.length !== 1) return;
+		const element = alt.elements[0];
+		if (element.type === "Assertion" || element.type === "Quantifier" || element.type === "CapturingGroup" || element.type === "Group" || element.type === "Backreference") return;
+		return element;
+	} catch {
+		return;
+	}
+}
+function getRawTextToNot(negatedNode) {
+	if (negatedNode.type === "CharacterClass" || negatedNode.type === "ExpressionCharacterClass") return `${negatedNode.raw[0]}${negatedNode.raw.slice(2)}`;
+	const escapeChar = negatedNode.raw[1]?.toLowerCase();
+	if (!escapeChar) return negatedNode.raw;
+	return `${negatedNode.raw[0]}${escapeChar}${negatedNode.raw.slice(2)}`;
+}
+function hasNegate(node) {
+	return node.type === "CharacterClass" || node.type === "ExpressionCharacterClass" || node.type === "CharacterSet" && (node.kind !== "property" || !node.strings);
+}
+function isFixedPatternEquivalent(targetNode, fixedText, unicodeSets) {
+	const flags = {
+		unicode: false,
+		unicodeSets
+	};
+	const originalUs = toUnicodeSet(targetNode, flags);
+	const convertedElement = getParsedElement(fixedText, unicodeSets);
+	if (!convertedElement) return false;
+	const convertedUs = toUnicodeSet(convertedElement, flags);
+	return originalUs.equals(convertedUs);
+}
+function isNegated(node) {
+	return hasNegate(node) && node.negate;
+}
+var regexSetOperationOptimizations_default = ruleCreator.createRule(typescriptLanguage, {
+	about: {
+		description: "Reports set operations in regular expressions that can be simplified.",
+		id: "regexSetOperationOptimizations",
+		presets: ["logical", "logicalStrict"]
+	},
+	messages: {
+		toIntersection: {
+			primary: "This subtraction can be simplified to an intersection.",
+			secondary: ["Subtracting a negated set is equivalent to intersecting with the positive set.", "This simplification allows for a more clear and readable regular expression."],
+			suggestions: ["Convert the subtraction to an intersection."]
+		},
+		toNegationOfConjunction: {
+			primary: "This character class can be simplified to a negated conjunction.",
+			secondary: ["A union of negated sets is equivalent to the negation of their intersection.", "This simplification allows for a more clear and readable regular expression."],
+			suggestions: ["Convert to a negated conjunction."]
+		},
+		toNegationOfDisjunction: {
+			primary: "This {{ target }} can be simplified to a negated disjunction.",
+			secondary: ["An intersection of negated sets is equivalent to the negation of their union.", "This simplification allows for a more clear and readable regular expression."],
+			suggestions: ["Convert to a negated disjunction."]
+		},
+		toSubtraction: {
+			primary: "This intersection can be simplified to a subtraction.",
+			secondary: ["Intersecting with a negated set is equivalent to subtracting the positive set.", "This simplification allows for a more clear and readable regular expression."],
+			suggestions: ["Convert the intersection to a subtraction."]
+		}
+	},
+	setup(context) {
+		return { visitors: { RegularExpressionLiteral: (node, { sourceFile }) => {
+			const details = getRegExpLiteralDetails(node, { sourceFile });
+			if (!details.flags.includes("v")) return;
+			let regexpAst;
+			try {
+				regexpAst = new RegExpParser().parsePattern(details.pattern, void 0, void 0, {
+					unicode: false,
+					unicodeSets: true
+				});
+			} catch {
+				return;
+			}
+			const nodeRange = getTSNodeRange(node, sourceFile);
+			function reportWithFix(targetNode, messageId, fixedText, data) {
+				if (!details.pattern) return false;
+				if (!isFixedPatternEquivalent(targetNode, fixedText, true)) return false;
+				const newPattern = details.pattern.slice(0, targetNode.start) + fixedText + details.pattern.slice(targetNode.end);
+				context.report({
+					data,
+					fix: {
+						range: nodeRange,
+						text: `/${newPattern}/${details.flags}`
+					},
+					message: messageId,
+					range: nodeRange
+				});
+				return true;
+			}
+			function toNegationOfDisjunction(classNode) {
+				if (classNode.expression.type !== "ClassIntersection") return false;
+				const operands = collectIntersectionOperands(classNode.expression);
+				const negatedOperands = [];
+				const others = [];
+				for (const operand of operands) if (isNegated(operand)) negatedOperands.push(operand);
+				else others.push(operand);
+				if (negatedOperands.length < 2) return false;
+				const fixedOperands = negatedOperands.map((negatedOperand) => getRawTextToNot(negatedOperand)).join("");
+				if (negatedOperands.length === operands.length) return reportWithFix(classNode, "toNegationOfDisjunction", `[${classNode.negate ? "" : "^"}${fixedOperands}]`, { target: "character class" });
+				const operandTextList = [`[^${fixedOperands}]`, ...others.map((operand) => operand.raw)];
+				return reportWithFix(classNode, "toNegationOfDisjunction", `[${classNode.negate ? "^" : ""}${operandTextList.join("&&")}]`, { target: "expression" });
+			}
+			function toNegationOfConjunction(ccNode) {
+				if (ccNode.elements.length <= 1) return false;
+				const elements = ccNode.elements;
+				const negatedElements = elements.filter(isNegated);
+				if (negatedElements.length !== elements.length) return false;
+				const fixedElements = negatedElements.map((negatedElement) => getRawTextToNot(negatedElement));
+				return reportWithFix(ccNode, "toNegationOfConjunction", `[${ccNode.negate ? "" : "^"}${fixedElements.join("&&")}]`);
+			}
+			function toSubtraction(classNode) {
+				const expression = classNode.expression;
+				if (expression.type !== "ClassIntersection") return false;
+				const operands = collectIntersectionOperands(expression);
+				const negatedOperand = operands.find(isNegated);
+				if (!negatedOperand) return false;
+				const others = operands.filter((operand) => operand !== negatedOperand);
+				let fixedLeftText = others.map((operand) => operand.raw).join("&&");
+				if (others.length >= 2) fixedLeftText = `[${fixedLeftText}]`;
+				const fixedRightText = getRawTextToNot(negatedOperand);
+				return reportWithFix(classNode, "toSubtraction", `[${classNode.negate ? "^" : ""}${fixedLeftText}--${fixedRightText}]`);
+			}
+			function toIntersection(expression, expressionRight, eccNode) {
+				if (expression.type !== "ClassSubtraction") return false;
+				const { left, right } = expression;
+				if (!isNegated(right)) return false;
+				let fixedText = `${left.type === "ClassSubtraction" ? `[${left.raw}]` : left.raw}&&${getRawTextToNot(right)}`;
+				if (expressionRight) fixedText = `[${fixedText}]`;
+				const targetRaw = eccNode.raw;
+				return reportWithFix(eccNode, "toIntersection", targetRaw.slice(0, expression.start - eccNode.start) + fixedText + targetRaw.slice(expression.end - eccNode.start));
+			}
+			function verifyExpressions(eccNode) {
+				let operand = eccNode.expression;
+				let right = null;
+				while (operand.type === "ClassIntersection" || operand.type === "ClassSubtraction") {
+					toIntersection(operand, right, eccNode);
+					right = operand.right;
+					operand = operand.left;
+				}
+			}
+			visitRegExpAST(regexpAst, {
+				onCharacterClassEnter(ccNode) {
+					toNegationOfConjunction(ccNode);
+				},
+				onExpressionCharacterClassEnter(eccNode) {
+					if (!toNegationOfDisjunction(eccNode) && !toSubtraction(eccNode)) verifyExpressions(eccNode);
+				}
+			});
+		} } };
+	}
+});
+//#endregion
+export { regexSetOperationOptimizations_default as default };
+
+//# sourceMappingURL=regexSetOperationOptimizations.js.map

package/lib/rules/regexStandaloneBackslashes.d.ts

@@ -0,0 +1,10 @@
+declare const _default: import("@flint.fyi/core").Rule<{
+    readonly description: "Reports standalone backslashes in regex patterns that look like incomplete escape sequences.";
+    readonly id: "regexStandaloneBackslashes";
+    readonly presets: ["logical", "logicalStrict"];
+} & {
+    presets?: ("javascript" | "logical" | "logicalStrict" | "stylistic" | "stylisticStrict")[];
+    url: string;
+}, object, object, "standaloneBackslash", import("@flint.fyi/core").AnyOptionalSchema>;
+export default _default;
+//# sourceMappingURL=regexStandaloneBackslashes.d.ts.map

package/lib/rules/regexStandaloneBackslashes.js

@@ -0,0 +1,59 @@
+import { ruleCreator } from "./ruleCreator.js";
+import { parseRegexpAst } from "./utils/parseRegexpAst.js";
+import { getRegExpConstruction } from "./utils/getRegExpConstruction.js";
+import { getRegExpLiteralDetails } from "./utils/getRegExpLiteralDetails.js";
+import { typescriptLanguage } from "@flint.fyi/typescript-language";
+import { visitRegExpAST } from "@eslint-community/regexpp";
+//#region src/rules/regexStandaloneBackslashes.ts
+const codepointBackslash = 92;
+var regexStandaloneBackslashes_default = ruleCreator.createRule(typescriptLanguage, {
+	about: {
+		description: "Reports standalone backslashes in regex patterns that look like incomplete escape sequences.",
+		id: "regexStandaloneBackslashes",
+		presets: ["logical", "logicalStrict"]
+	},
+	messages: { standaloneBackslash: {
+		primary: "This standalone backslash (`\\`) looks like an incomplete escape sequence.",
+		secondary: ["This backslash is interpreted as a literal `\\` character because the following character doesn't form a valid escape sequence.", "This commonly happens with incomplete control escapes like `\\c` or `\\c1`."],
+		suggestions: ["Use a valid escape sequence or escape the backslash with `\\\\`."]
+	} },
+	setup(context) {
+		function findStandaloneBackslashes(pattern, flags) {
+			const results = [];
+			const regexpAst = parseRegexpAst(pattern, flags);
+			if (!regexpAst) return results;
+			visitRegExpAST(regexpAst, { onCharacterEnter(charNode) {
+				if (charNode.value === codepointBackslash && charNode.raw === "\\") results.push(charNode);
+			} });
+			return results;
+		}
+		function checkPattern(pattern, patternStart, flags) {
+			const backslashes = findStandaloneBackslashes(pattern, flags);
+			for (const backslash of backslashes) context.report({
+				message: "standaloneBackslash",
+				range: {
+					begin: patternStart + backslash.start,
+					end: patternStart + backslash.end
+				}
+			});
+		}
+		function checkRegexLiteral(node, services) {
+			const details = getRegExpLiteralDetails(node, services);
+			checkPattern(details.pattern, details.start, details.flags);
+		}
+		function checkRegExpConstructor(node, services) {
+			const construction = getRegExpConstruction(node, services);
+			if (!construction) return;
+			checkPattern(construction.pattern.replace(/\\\\/g, "\\"), construction.start + 1, construction.flags);
+		}
+		return { visitors: {
+			CallExpression: checkRegExpConstructor,
+			NewExpression: checkRegExpConstructor,
+			RegularExpressionLiteral: checkRegexLiteral
+		} };
+	}
+});
+//#endregion
+export { regexStandaloneBackslashes_default as default };
+
+//# sourceMappingURL=regexStandaloneBackslashes.js.map

package/lib/rules/regexStarQuantifiers.d.ts

@@ -0,0 +1,10 @@
+declare const _default: import("@flint.fyi/core").Rule<{
+    readonly description: "Reports quantifiers `{0,}` in regular expressions that should use `*` instead.";
+    readonly id: "regexStarQuantifiers";
+    readonly presets: ["stylisticStrict"];
+} & {
+    presets?: ("javascript" | "logical" | "logicalStrict" | "stylistic" | "stylisticStrict")[];
+    url: string;
+}, object, object, "preferStar", import("@flint.fyi/core").AnyOptionalSchema>;
+export default _default;
+//# sourceMappingURL=regexStarQuantifiers.d.ts.map

package/lib/rules/regexStarQuantifiers.js

@@ -0,0 +1,68 @@
+import { ruleCreator } from "./ruleCreator.js";
+import { parseRegexpAst } from "./utils/parseRegexpAst.js";
+import { getRegExpConstruction } from "./utils/getRegExpConstruction.js";
+import { getRegExpLiteralDetails } from "./utils/getRegExpLiteralDetails.js";
+import { typescriptLanguage } from "@flint.fyi/typescript-language";
+import { visitRegExpAST } from "@eslint-community/regexpp";
+//#region src/rules/regexStarQuantifiers.ts
+function getQuantifierOffsets(quantifier) {
+	return [quantifier.element.end - quantifier.start, quantifier.greedy ? quantifier.end - quantifier.start : quantifier.end - quantifier.start - 1];
+}
+var regexStarQuantifiers_default = ruleCreator.createRule(typescriptLanguage, {
+	about: {
+		description: "Reports quantifiers `{0,}` in regular expressions that should use `*` instead.",
+		id: "regexStarQuantifiers",
+		presets: ["stylisticStrict"]
+	},
+	messages: { preferStar: {
+		primary: "Prefer the more succinct '*' quantifier instead of '{{ quantifier }}'.",
+		secondary: ["The `*` quantifier is a more concise way to express matching zero or more of the preceding element."],
+		suggestions: ["Replace '{{ quantifier }}' with '*'."]
+	} },
+	setup(context) {
+		function checkPattern(pattern, patternStart, flags, isStringPattern) {
+			const regexpAst = parseRegexpAst(pattern, flags);
+			if (!regexpAst) return;
+			visitRegExpAST(regexpAst, { onQuantifierEnter(quantifier) {
+				if (quantifier.min !== 0 || quantifier.max !== Infinity) return;
+				const [startOffset, endOffset] = getQuantifierOffsets(quantifier);
+				const quantifierText = quantifier.raw.slice(startOffset, endOffset);
+				if (quantifierText === "*") return;
+				const replacement = quantifier.greedy ? "*" : "*?";
+				context.report({
+					data: { quantifier: quantifierText },
+					fix: {
+						range: {
+							begin: patternStart + quantifier.start + startOffset,
+							end: patternStart + quantifier.start + (isStringPattern ? endOffset : quantifier.raw.length)
+						},
+						text: replacement
+					},
+					message: "preferStar",
+					range: {
+						begin: patternStart + quantifier.start + startOffset,
+						end: patternStart + quantifier.start + endOffset
+					}
+				});
+			} });
+		}
+		function checkRegexLiteral(node, services) {
+			const details = getRegExpLiteralDetails(node, services);
+			checkPattern(details.pattern, details.start, details.flags, false);
+		}
+		function checkRegExpConstructor(node, services) {
+			const construction = getRegExpConstruction(node, services);
+			if (!construction) return;
+			checkPattern(construction.raw, construction.start + 1, construction.flags, true);
+		}
+		return { visitors: {
+			CallExpression: checkRegExpConstructor,
+			NewExpression: checkRegExpConstructor,
+			RegularExpressionLiteral: checkRegexLiteral
+		} };
+	}
+});
+//#endregion
+export { regexStarQuantifiers_default as default };
+
+//# sourceMappingURL=regexStarQuantifiers.js.map

package/lib/rules/regexSuperLinearBacktracking.d.ts

@@ -0,0 +1,10 @@
+declare const _default: import("@flint.fyi/core").Rule<{
+    readonly description: "Reports regular expressions with exponential or polynomial backtracking.";
+    readonly id: "regexSuperLinearBacktracking";
+    readonly presets: ["logical", "logicalStrict"];
+} & {
+    presets?: ("javascript" | "logical" | "logicalStrict" | "stylistic" | "stylisticStrict")[];
+    url: string;
+}, object, object, "self" | "trade", import("@flint.fyi/core").AnyOptionalSchema>;
+export default _default;
+//# sourceMappingURL=regexSuperLinearBacktracking.d.ts.map

package/lib/rules/regexSuperLinearBacktracking.js

@@ -0,0 +1,98 @@
+import { ruleCreator } from "./ruleCreator.js";
+import { getRegExpConstruction } from "./utils/getRegExpConstruction.js";
+import { getRegExpLiteralDetails } from "./utils/getRegExpLiteralDetails.js";
+import { parseRegexpAstFull } from "./utils/parseRegexpAstFull.js";
+import { typescriptLanguage } from "@flint.fyi/typescript-language";
+import { analyse } from "scslre";
+//#region src/rules/regexSuperLinearBacktracking.ts
+function mentionQuantifier(quantifier) {
+	return `'${quantifier.raw}'`;
+}
+var regexSuperLinearBacktracking_default = ruleCreator.createRule(typescriptLanguage, {
+	about: {
+		description: "Reports regular expressions with exponential or polynomial backtracking.",
+		id: "regexSuperLinearBacktracking",
+		presets: ["logical", "logicalStrict"]
+	},
+	messages: {
+		self: {
+			primary: "Quantifier {{ quant }} can reach itself via {{ parentQuant }}, causing {{ complexity }} backtracking.",
+			secondary: ["This pattern can be exploited to cause denial of service (ReDoS) attacks.", "Using any string accepted by {{ attack }}, the regex can be forced to backtrack excessively."],
+			suggestions: ["Make the inner quantifier possessive or use atomic groups.", "Rewrite the pattern to remove the self-referential quantifier."]
+		},
+		trade: {
+			primary: "Quantifiers {{ startQuant }} and {{ endQuant }} can exchange characters, causing {{ complexity }} backtracking.",
+			secondary: ["This pattern can be exploited to cause denial of service (ReDoS) attacks.", "Using any string accepted by {{ attack }}, the regex can be forced to backtrack excessively."],
+			suggestions: ["Make one of the quantifiers possessive or use atomic groups.", "Rewrite the pattern to remove the ambiguity between quantifiers."]
+		}
+	},
+	setup(context) {
+		function analyseAndReport(parsed, patternStart, flags) {
+			let result;
+			try {
+				result = analyse(parsed, { reportTypes: { Move: false } });
+			} catch {
+				return;
+			}
+			for (const report of result.reports) {
+				const complexity = report.exponential ? "exponential" : "polynomial";
+				const attack = `/${report.character.literal.source}+/${flags.includes("i") ? "i" : ""}`;
+				if (report.type === "Self") {
+					const quantStart = patternStart + report.quant.start;
+					const quantEnd = patternStart + report.quant.end;
+					context.report({
+						data: {
+							attack,
+							complexity,
+							parentQuant: mentionQuantifier(report.parentQuant),
+							quant: mentionQuantifier(report.quant)
+						},
+						message: "self",
+						range: {
+							begin: quantStart,
+							end: quantEnd
+						}
+					});
+				} else if (report.type === "Trade") {
+					const startQuantStart = patternStart + report.startQuant.start;
+					const endQuantEnd = patternStart + report.endQuant.end;
+					context.report({
+						data: {
+							attack,
+							complexity,
+							endQuant: mentionQuantifier(report.endQuant),
+							startQuant: mentionQuantifier(report.startQuant)
+						},
+						message: "trade",
+						range: {
+							begin: startQuantStart,
+							end: endQuantEnd
+						}
+					});
+				}
+			}
+		}
+		function checkRegexLiteral(node, services) {
+			const details = getRegExpLiteralDetails(node, services);
+			const parsed = parseRegexpAstFull(details.pattern, details.flags);
+			if (!parsed) return;
+			analyseAndReport(parsed, details.start, details.flags);
+		}
+		function checkRegExpConstructor(node, services) {
+			const construction = getRegExpConstruction(node, services);
+			if (!construction) return;
+			const parsed = parseRegexpAstFull(construction.pattern, construction.flags);
+			if (!parsed) return;
+			analyseAndReport(parsed, construction.start + 1, construction.flags);
+		}
+		return { visitors: {
+			CallExpression: checkRegExpConstructor,
+			NewExpression: checkRegExpConstructor,
+			RegularExpressionLiteral: checkRegexLiteral
+		} };
+	}
+});
+//#endregion
+export { regexSuperLinearBacktracking_default as default };
+
+//# sourceMappingURL=regexSuperLinearBacktracking.js.map

package/lib/rules/regexSuperLinearMoves.d.ts

@@ -0,0 +1,10 @@
+declare const _default: import("@flint.fyi/core").Rule<{
+    readonly description: "Reports quantifiers that can cause quadratic regex matching time.";
+    readonly id: "regexSuperLinearMoves";
+    readonly presets: ["logical"];
+} & {
+    presets?: ("javascript" | "logical" | "logicalStrict" | "stylistic" | "stylisticStrict")[];
+    url: string;
+}, object, object, "superLinear", import("@flint.fyi/core").AnyOptionalSchema>;
+export default _default;
+//# sourceMappingURL=regexSuperLinearMoves.d.ts.map