@jameswyse/oxc-config 0.1.0 → 0.3.0

package/dist/rules/no-derived-test-expectation.js

@@ -0,0 +1,136 @@
+import { dirname, join } from "node:path";
+import { defineRule } from "@oxlint/plugins";
+import { apiReference, childNodes, projectPath, propertyName, variableFor, } from "../shared/index.js";
+const comparisonMatchers = new Set([
+    "toBe",
+    "toEqual",
+    "toStrictEqual",
+    "toMatchObject",
+    "toContain",
+    "toContainEqual",
+    "toMatch",
+    "toHaveProperty",
+    "toBeCloseTo",
+]);
+const testSupport = /(?:^|[/.])(?:tests?|__tests__|e2e|testing|fixtures?|mocks?|fakes?|stubs?|builders?|factories|support|helpers?)(?:[/.]|$)/u;
+const projectSpecifier = /^(?:\.{1,2}\/|@\/|~\/|#)/u;
+function isProductionImport(sourceCode, directory, callee) {
+    const definition = variableFor(sourceCode, callee)?.defs[0];
+    const declaration = definition?.parent;
+    if (definition?.type !== "ImportBinding" || declaration?.type !== "ImportDeclaration") {
+        return false;
+    }
+    const source = declaration.source.value;
+    const path = source.startsWith(".") ? join(directory, source) : source;
+    return projectSpecifier.test(source) && !testSupport.test(path.replaceAll("\\", "/"));
+}
+function calledName(sourceCode, directory, callee) {
+    if (callee.type === "Identifier") {
+        return isProductionImport(sourceCode, directory, callee) ? callee.name : null;
+    }
+    const name = callee.type === "MemberExpression" ? propertyName(callee) : null;
+    const namespace = callee.type === "MemberExpression" ? callee.object : null;
+    return namespace?.type === "Identifier" &&
+        name !== null &&
+        variableFor(sourceCode, namespace)?.defs[0]?.node.type === "ImportNamespaceSpecifier" &&
+        isProductionImport(sourceCode, directory, namespace)
+        ? `${namespace.name}.${name}`
+        : null;
+}
+function constantValue(sourceCode, node) {
+    const variable = node.type === "Identifier" ? variableFor(sourceCode, node) : null;
+    const definition = variable?.defs[0];
+    return variable !== null &&
+        definition?.type === "Variable" &&
+        definition.parent?.type === "VariableDeclaration" &&
+        definition.parent.kind === "const" &&
+        definition.node.type === "VariableDeclarator" &&
+        definition.node.id.type === "Identifier" &&
+        definition.node.init !== null
+        ? { variable, value: definition.node.init }
+        : null;
+}
+function isExpectedArgument(node) {
+    const call = node.parent;
+    return (call?.type === "CallExpression" &&
+        call.arguments.some((argument) => argument === node) &&
+        call.callee.type === "MemberExpression" &&
+        comparisonMatchers.has(propertyName(call.callee) ?? ""));
+}
+function subjectRoots(sourceCode, argument) {
+    const constant = constantValue(sourceCode, argument);
+    return constant === null ? [argument] : [argument, constant.value];
+}
+function expectedRoot(sourceCode, argument) {
+    const constant = constantValue(sourceCode, argument);
+    return constant !== null &&
+        constant.variable.references.every((reference) => !reference.isRead() || isExpectedArgument(reference.identifier))
+        ? constant.value
+        : argument;
+}
+function productionCalls(sourceCode, directory, root) {
+    const names = [];
+    const pending = [root];
+    for (let node = pending.pop(); node !== undefined; node = pending.pop()) {
+        const name = node.type === "CallExpression" ? calledName(sourceCode, directory, node.callee) : null;
+        if (name !== null) {
+            names.push(name);
+        }
+        if (node.type !== "ArrowFunctionExpression" && node.type !== "FunctionExpression") {
+            pending.push(...childNodes(node, sourceCode.visitorKeys));
+        }
+    }
+    return names;
+}
+function positiveExpectation(sourceCode, node) {
+    let current = node;
+    while (current.type === "MemberExpression") {
+        if (propertyName(current) === "not") {
+            return null;
+        }
+        current = current.object;
+    }
+    return current.type === "CallExpression" &&
+        apiReference(sourceCode, current.callee)?.name === "expect"
+        ? current
+        : null;
+}
+export const noDerivedTestExpectation = defineRule({
+    meta: {
+        type: "suggestion",
+        docs: {
+            description: "Disallow expected values computed by the production code under test.",
+        },
+        schema: [],
+        messages: {
+            derived: "The expected value calls `{{name}}` from production code, so a bug in it changes both sides and the assertion still passes. Write the expected value out, or derive it independently.",
+        },
+    },
+    create(context) {
+        const sourceCode = context.sourceCode;
+        const directory = dirname(projectPath(context.cwd, context.filename));
+        return {
+            CallExpression(node) {
+                const matcher = node.callee.type === "MemberExpression" ? propertyName(node.callee) : null;
+                const expectation = node.callee.type === "MemberExpression" &&
+                    matcher !== null &&
+                    comparisonMatchers.has(matcher)
+                    ? positiveExpectation(sourceCode, node.callee.object)
+                    : null;
+                if (expectation === null) {
+                    return;
+                }
+                const subjectCalls = new Set(expectation.arguments
+                    .flatMap((argument) => subjectRoots(sourceCode, argument))
+                    .flatMap((root) => productionCalls(sourceCode, directory, root)));
+                for (const argument of node.arguments) {
+                    const name = productionCalls(sourceCode, directory, expectedRoot(sourceCode, argument)).find((call) => !subjectCalls.has(call));
+                    if (name !== undefined) {
+                        context.report({ node: argument, messageId: "derived", data: { name } });
+                        return;
+                    }
+                }
+            },
+        };
+    },
+});

package/dist/rules/no-disabled-tls-verification.d.ts

@@ -0,0 +1 @@
+export declare const noDisabledTlsVerification: import("@oxlint/plugins").Rule;

package/dist/rules/no-disabled-tls-verification.js

@@ -0,0 +1,42 @@
+import { defineRule } from "@oxlint/plugins";
+import { isGlobal, staticPropertyName, unwrapExpression } from "../shared/index.js";
+function isFalse(node) {
+    const value = unwrapExpression(node);
+    return value.type === "Literal" && value.value === false;
+}
+function isDisabledFlag(node) {
+    const value = unwrapExpression(node);
+    return (value.type === "Literal" && (value.value === "0" || value.value === 0)) || isFalse(value);
+}
+export const noDisabledTlsVerification = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "Disallow turning off TLS certificate verification." },
+        schema: [],
+        messages: {
+            disabled: "This turns off TLS certificate verification, so any server can impersonate the real one. Trust the right certificate authority instead, such as with the `ca` option or `NODE_EXTRA_CA_CERTS`.",
+        },
+    },
+    create(context) {
+        const sourceCode = context.sourceCode;
+        return {
+            Property(node) {
+                if (staticPropertyName(node) === "rejectUnauthorized" && isFalse(node.value)) {
+                    context.report({ node, messageId: "disabled" });
+                }
+            },
+            AssignmentExpression(node) {
+                const target = unwrapExpression(node.left);
+                const environment = target.type === "MemberExpression" ? unwrapExpression(target.object) : null;
+                if (target.type === "MemberExpression" &&
+                    staticPropertyName(target) === "NODE_TLS_REJECT_UNAUTHORIZED" &&
+                    environment?.type === "MemberExpression" &&
+                    staticPropertyName(environment) === "env" &&
+                    isGlobal(sourceCode, unwrapExpression(environment.object), "process") &&
+                    isDisabledFlag(node.right)) {
+                    context.report({ node, messageId: "disabled" });
+                }
+            },
+        };
+    },
+});

package/dist/rules/no-fixed-test-delay.js

@@ -1,6 +1,21 @@
 import { defineRule } from "@oxlint/plugins";
-import { variableFor, isGlobal, propertyName, isPlaywright, apiReference, testContext, } from "../shared/index.js";
-function numericLiteral(node) {
+import { variableFor, isGlobal, propertyName, isPlaywright, apiReference, isEffectModule, testContext, } from "../shared/index.js";
+function constantValue(sourceCode, node) {
+    if (node?.type !== "Identifier") {
+        return node;
+    }
+    const [definition, ...others] = variableFor(sourceCode, node)?.defs ?? [];
+    const declarator = definition?.node;
+    return others.length === 0 &&
+        definition?.type === "Variable" &&
+        definition.parent?.type === "VariableDeclaration" &&
+        definition.parent.kind === "const" &&
+        declarator?.type === "VariableDeclarator"
+        ? declarator.init
+        : node;
+}
+function numericLiteral(sourceCode, argument) {
+    const node = constantValue(sourceCode, argument);
     return ((node?.type === "Literal" && typeof node.value === "number") ||
         (node?.type === "UnaryExpression" &&
             ["+", "-"].includes(node.operator) &&
@@ -64,7 +79,7 @@ function timerPromise(sourceCode, node) {
     const timer = singleExpression(executor.body);
     if (timer?.type !== "CallExpression" ||
         !globalTimer(sourceCode, timer.callee) ||
-        !numericLiteral(timer.arguments[1])) {
+        !numericLiteral(sourceCode, timer.arguments[1])) {
         return false;
     }
     return resolvesWithoutValue(sourceCode, timer.arguments[0], resolve);
@@ -86,6 +101,26 @@ function playwrightPage(sourceCode, node, enclosing) {
             variableFor(sourceCode, binding) === variableFor(sourceCode, node));
     });
 }
+function isFixedDuration(sourceCode, argument) {
+    const node = constantValue(sourceCode, argument);
+    if (node?.type === "Literal") {
+        return typeof node.value === "string" || typeof node.value === "number";
+    }
+    const owner = node?.type === "CallExpression" && node.callee.type === "MemberExpression"
+        ? node.callee.object
+        : null;
+    return (node?.type === "CallExpression" &&
+        owner !== null &&
+        isEffectModule(sourceCode, owner, "Duration") &&
+        node.arguments.length > 0 &&
+        node.arguments.every((item) => numericLiteral(sourceCode, item)));
+}
+function isEffectSleep(sourceCode, node) {
+    return (node.callee.type === "MemberExpression" &&
+        propertyName(node.callee) === "sleep" &&
+        isEffectModule(sourceCode, node.callee.object, "Effect") &&
+        isFixedDuration(sourceCode, node.arguments[0]));
+}
 export const noFixedTestDelay = defineRule({
     meta: {
         type: "problem",
@@ -99,6 +134,12 @@ export const noFixedTestDelay = defineRule({
         const sourceCode = context.sourceCode;
         return {
             CallExpression(node) {
+                if (node.parent.type === "YieldExpression" &&
+                    node.parent.delegate &&
+                    isEffectSleep(sourceCode, node) &&
+                    testContext(sourceCode, node)) {
+                    context.report({ node, messageId: "delay" });
+                }
                 if (node.parent.type !== "AwaitExpression") {
                     return;
                 }
@@ -109,10 +150,10 @@ export const noFixedTestDelay = defineRule({
                 const api = apiReference(sourceCode, node.callee);
                 const importedTimer = api?.name === "setTimeout" &&
                     ["node:timers/promises", "timers/promises"].includes(api.module) &&
-                    numericLiteral(node.arguments[0]);
+                    numericLiteral(sourceCode, node.arguments[0]);
                 const browserTimer = node.callee.type === "MemberExpression" &&
                     propertyName(node.callee) === "waitForTimeout" &&
-                    numericLiteral(node.arguments[0]) &&
+                    numericLiteral(sourceCode, node.arguments[0]) &&
                     playwrightPage(sourceCode, node.callee.object, enclosing);
                 if (importedTimer || browserTimer) {
                     context.report({ node, messageId: "delay" });

package/dist/rules/no-generic-object-guard.d.ts

@@ -0,0 +1 @@
+export declare const noGenericObjectGuard: import("@oxlint/plugins").Rule;

package/dist/rules/no-generic-object-guard.js

@@ -0,0 +1,279 @@
+import { defineRule } from "@oxlint/plugins";
+import { isGlobal, propertyName, unwrapExpression } from "../shared/index.js";
+function unwrap(node) {
+    const value = unwrapExpression(node);
+    return value.type === "ChainExpression" ? unwrap(value.expression) : value;
+}
+function combined(checks) {
+    if (checks.includes(null)) {
+        return null;
+    }
+    if (checks.includes("object")) {
+        return "object";
+    }
+    return checks.includes("function") ? "function" : "supporting";
+}
+function isSubject(node, subject) {
+    const value = unwrap(node);
+    return value.type === "Identifier" && value.name === subject;
+}
+function isLiteral(node, value) {
+    const literal = unwrap(node);
+    return literal.type === "Literal" && literal.value === value;
+}
+function isUndefined(node) {
+    const value = unwrap(node);
+    return value.type === "Identifier" && value.name === "undefined";
+}
+function comparedPair(node, subject, matches) {
+    return ((isSubject(node.left, subject) && matches(node.right)) ||
+        (isSubject(node.right, subject) && matches(node.left)));
+}
+function isTypeofSubject(node, subject) {
+    const value = unwrap(node);
+    return value.type === "UnaryExpression" && value.operator === "typeof"
+        ? isSubject(value.argument, subject)
+        : false;
+}
+function typeofCheck(node, subject) {
+    const [typeofSide, literal] = isTypeofSubject(node.left, subject)
+        ? [node.left, node.right]
+        : [node.right, node.left];
+    if (!isTypeofSubject(typeofSide, subject) || !["===", "=="].includes(node.operator)) {
+        return null;
+    }
+    if (isLiteral(literal, "object")) {
+        return "object";
+    }
+    return isLiteral(literal, "function") ? "function" : null;
+}
+function isArrayCheck(sourceCode, node, subject) {
+    const call = unwrap(node);
+    return (call.type === "CallExpression" &&
+        call.callee.type === "MemberExpression" &&
+        propertyName(call.callee) === "isArray" &&
+        isGlobal(sourceCode, call.callee.object, "Array") &&
+        call.arguments.length === 1 &&
+        call.arguments[0] !== undefined &&
+        isSubject(call.arguments[0], subject));
+}
+function isPrototypeRead(sourceCode, node, subject) {
+    const call = unwrap(node);
+    return (call.type === "CallExpression" &&
+        call.callee.type === "MemberExpression" &&
+        propertyName(call.callee) === "getPrototypeOf" &&
+        isGlobal(sourceCode, call.callee.object, "Object") &&
+        call.arguments[0] !== undefined &&
+        isSubject(call.arguments[0], subject));
+}
+function isObjectPrototype(sourceCode, node) {
+    const value = unwrap(node);
+    return (value.type === "MemberExpression" &&
+        propertyName(value) === "prototype" &&
+        isGlobal(sourceCode, value.object, "Object"));
+}
+function isObjectTag(sourceCode, node, subject) {
+    const call = unwrap(node);
+    const tag = call.type === "CallExpression" && call.callee.type === "MemberExpression"
+        ? call.callee.object
+        : null;
+    return (call.type === "CallExpression" &&
+        call.callee.type === "MemberExpression" &&
+        propertyName(call.callee) === "call" &&
+        call.arguments[0] !== undefined &&
+        isSubject(call.arguments[0], subject) &&
+        tag?.type === "MemberExpression" &&
+        propertyName(tag) === "toString" &&
+        isObjectPrototype(sourceCode, tag.object));
+}
+function provesObject(sourceCode, value, expected, subject) {
+    return ((isPrototypeRead(sourceCode, value, subject) &&
+        (isLiteral(expected, null) || isObjectPrototype(sourceCode, expected))) ||
+        (isObjectTag(sourceCode, value, subject) && isLiteral(expected, "[object Object]")));
+}
+function equalityCheck(sourceCode, comparison, subject) {
+    const typeofResult = typeofCheck(comparison, subject);
+    if (typeofResult !== null) {
+        return typeofResult;
+    }
+    if (provesObject(sourceCode, comparison.left, comparison.right, subject) ||
+        provesObject(sourceCode, comparison.right, comparison.left, subject)) {
+        return "object";
+    }
+    return null;
+}
+function objectCheck(sourceCode, node, subject) {
+    const value = unwrap(node);
+    if (value.type === "LogicalExpression" && value.operator !== "??") {
+        return combined([
+            objectCheck(sourceCode, value.left, subject),
+            objectCheck(sourceCode, value.right, subject),
+        ]);
+    }
+    if (value.type === "UnaryExpression" && value.operator === "!") {
+        const argument = unwrap(value.argument);
+        if (isArrayCheck(sourceCode, argument, subject)) {
+            return "supporting";
+        }
+        return argument.type === "UnaryExpression" && argument.operator === "!"
+            ? objectCheck(sourceCode, argument.argument, subject)
+            : null;
+    }
+    if (isSubject(value, subject)) {
+        return "supporting";
+    }
+    if (value.type === "CallExpression" && isGlobal(sourceCode, value.callee, "Boolean")) {
+        const [argument] = value.arguments;
+        return argument !== undefined && isSubject(argument, subject) ? "supporting" : null;
+    }
+    if (value.type !== "BinaryExpression") {
+        return null;
+    }
+    if (value.operator === "instanceof") {
+        return isSubject(value.left, subject) && isGlobal(sourceCode, value.right, "Object")
+            ? "object"
+            : null;
+    }
+    if (["!==", "!="].includes(value.operator)) {
+        return comparedPair(value, subject, (other) => isLiteral(other, null) || isUndefined(other))
+            ? "supporting"
+            : null;
+    }
+    return ["===", "=="].includes(value.operator) ? equalityCheck(sourceCode, value, subject) : null;
+}
+function rejection(sourceCode, node, subject) {
+    const value = unwrap(node);
+    if (value.type === "LogicalExpression" && value.operator !== "??") {
+        return combined([
+            rejection(sourceCode, value.left, subject),
+            rejection(sourceCode, value.right, subject),
+        ]);
+    }
+    if (value.type === "UnaryExpression" && value.operator === "!") {
+        return objectCheck(sourceCode, value.argument, subject);
+    }
+    if (isArrayCheck(sourceCode, value, subject)) {
+        return "supporting";
+    }
+    if (value.type !== "BinaryExpression") {
+        return null;
+    }
+    if (["===", "=="].includes(value.operator)) {
+        return comparedPair(value, subject, (other) => isLiteral(other, null) || isUndefined(other))
+            ? "supporting"
+            : null;
+    }
+    return ["!==", "!="].includes(value.operator)
+        ? equalityCheck(sourceCode, { left: value.left, operator: "===", right: value.right }, subject)
+        : null;
+}
+function isNamedHelper(fn) {
+    const holder = fn.parent;
+    return (fn.type === "FunctionDeclaration" ||
+        (holder.type === "VariableDeclarator" && holder.init === fn) ||
+        (holder.type === "Property" && holder.value === fn) ||
+        (holder.type === "PropertyDefinition" && holder.value === fn) ||
+        holder.type === "MethodDefinition");
+}
+const openTypes = new Set(["TSUnknownKeyword", "TSAnyKeyword"]);
+const weakClaims = new Set(["TSObjectKeyword", "TSUnknownKeyword", "TSAnyKeyword"]);
+function isWeakClaim(claim) {
+    if (weakClaims.has(claim.type) ||
+        (claim.type === "TSTypeLiteral" && claim.members.length === 0)) {
+        return true;
+    }
+    const [argument] = claim.type === "TSTypeReference" ? (claim.typeArguments?.params ?? []) : [];
+    return (claim.type === "TSTypeReference" &&
+        claim.typeName.type === "Identifier" &&
+        claim.typeName.name === "NonNullable" &&
+        argument !== undefined &&
+        isWeakClaim(argument));
+}
+function unprovenClaim(sourceCode, fn, parameter) {
+    const predicate = fn.returnType?.typeAnnotation;
+    const parameterType = parameter.typeAnnotation?.typeAnnotation;
+    if (predicate?.type !== "TSTypePredicate" ||
+        predicate.parameterName.type !== "Identifier" ||
+        predicate.parameterName.name !== parameter.name ||
+        predicate.typeAnnotation === null ||
+        parameterType === undefined ||
+        !openTypes.has(parameterType.type)) {
+        return null;
+    }
+    const claim = predicate.typeAnnotation.typeAnnotation;
+    return isWeakClaim(claim) ? null : sourceCode.getText(claim);
+}
+function returnedCheck(sourceCode, node, subject) {
+    return isLiteral(node, true) ? "supporting" : objectCheck(sourceCode, node, subject);
+}
+function rejectedCheck(sourceCode, statement, subject) {
+    if (statement.type !== "IfStatement" || statement.alternate !== null) {
+        return null;
+    }
+    const consequent = statement.consequent;
+    const exit = consequent.type === "BlockStatement" && consequent.body.length === 1
+        ? consequent.body[0]
+        : consequent;
+    return exit?.type === "ReturnStatement" &&
+        exit.argument !== null &&
+        isLiteral(exit.argument, false)
+        ? rejection(sourceCode, statement.test, subject)
+        : null;
+}
+function guardProof(sourceCode, fn, subject) {
+    if (fn.body === null) {
+        return null;
+    }
+    if (fn.body.type !== "BlockStatement") {
+        return returnedCheck(sourceCode, fn.body, subject);
+    }
+    const statements = fn.body.body;
+    const last = statements.at(-1);
+    if (last?.type !== "ReturnStatement" || last.argument === null) {
+        return null;
+    }
+    return combined([
+        ...statements.slice(0, -1).map((statement) => rejectedCheck(sourceCode, statement, subject)),
+        returnedCheck(sourceCode, last.argument, subject),
+    ]);
+}
+export const noGenericObjectGuard = defineRule({
+    meta: {
+        type: "suggestion",
+        docs: {
+            description: "Disallow guards such as isRecord that only prove a value is a non-null object, and guards that claim a type they never check.",
+        },
+        schema: [],
+        messages: {
+            unproven: "This guard claims `{{subject}}` is `{{claim}}` but only checks that it exists. Check the fields the type promises, or parse the value with a schema.",
+            guard: "This guard only proves `{{subject}}` is an object, which says nothing about its fields. Parse the value with a schema where it enters, or narrow inline where only its object-ness matters.",
+        },
+    },
+    create(context) {
+        const sourceCode = context.sourceCode;
+        function check(fn) {
+            const [parameter, ...rest] = fn.params;
+            if (parameter?.type !== "Identifier" || rest.length > 0) {
+                return;
+            }
+            const proof = guardProof(sourceCode, fn, parameter.name);
+            if (proof === "object" && isNamedHelper(fn)) {
+                context.report({ node: fn, messageId: "guard", data: { subject: parameter.name } });
+                return;
+            }
+            const claim = unprovenClaim(sourceCode, fn, parameter);
+            if (claim !== null && proof === "supporting") {
+                context.report({
+                    node: fn,
+                    messageId: "unproven",
+                    data: { subject: parameter.name, claim },
+                });
+            }
+        }
+        return {
+            ArrowFunctionExpression: check,
+            FunctionDeclaration: check,
+            FunctionExpression: check,
+        };
+    },
+});

package/dist/rules/no-get-password-form.d.ts

@@ -0,0 +1 @@
+export declare const noGetPasswordForm: import("@oxlint/plugins").Rule;

package/dist/rules/no-get-password-form.js

@@ -0,0 +1,113 @@
+import { defineRule } from "@oxlint/plugins";
+const secretAutocomplete = new Set(["current-password", "new-password", "one-time-code"]);
+function isOmitted(item) {
+    const value = item.value?.type === "JSXExpressionContainer" ? item.value.expression : null;
+    return ((value?.type === "Identifier" && value.name === "undefined") ||
+        (value?.type === "Literal" && value.value === null));
+}
+function attribute(element, name) {
+    return element.attributes.find((item) => item.type === "JSXAttribute" &&
+        item.name.type === "JSXIdentifier" &&
+        item.name.name === name &&
+        !isOmitted(item));
+}
+function stringValue(item) {
+    const value = item?.value?.type === "JSXExpressionContainer" ? item.value.expression : item?.value;
+    if (value?.type === "TemplateLiteral" && value.expressions.length === 0) {
+        return value.quasis[0]?.value.cooked ?? null;
+    }
+    return value?.type === "Literal" && typeof value.value === "string" ? value.value : null;
+}
+function literalValue(item) {
+    return stringValue(item)?.toLowerCase() ?? null;
+}
+function isElement(element, name) {
+    return element.name.type === "JSXIdentifier" && element.name.name === name;
+}
+function isSecretInput(element) {
+    return (isElement(element, "input") &&
+        (literalValue(attribute(element, "type")) === "password" ||
+            (literalValue(attribute(element, "autoComplete")) ?? "")
+                .split(/\s+/u)
+                .some((token) => secretAutocomplete.has(token))));
+}
+function isGetMethod(item) {
+    const method = literalValue(item);
+    return method !== null && method !== "post" && method !== "dialog";
+}
+function submitsByGet(element) {
+    const action = attribute(element, "action");
+    const method = attribute(element, "method");
+    return (!element.attributes.some((item) => item.type === "JSXSpreadAttribute") &&
+        (action === undefined || literalValue(action) !== null) &&
+        (method === undefined || isGetMethod(method)));
+}
+function submitsByGetOverride(element) {
+    const type = literalValue(attribute(element, "type"));
+    const method = attribute(element, "formMethod");
+    const submits = isElement(element, "button")
+        ? type !== "button" && type !== "reset"
+        : isElement(element, "input") && (type === "submit" || type === "image");
+    return submits && method !== undefined && isGetMethod(method);
+}
+function owningForms(control, forms) {
+    const target = attribute(control, "form");
+    if (target !== undefined) {
+        const id = stringValue(target);
+        return id === null || id === ""
+            ? []
+            : forms.filter((form) => stringValue(attribute(form.openingElement, "id")) === id);
+    }
+    for (let ancestor = control.parent.parent; ancestor !== null; ancestor = ancestor.parent) {
+        if (ancestor.type === "JSXElement" && isElement(ancestor.openingElement, "form")) {
+            return [ancestor];
+        }
+    }
+    return [];
+}
+export const noGetPasswordForm = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "Require forms with password fields to submit by POST." },
+        schema: [],
+        messages: {
+            get: 'This form has a password field but submits by GET, so a submission before JavaScript loads puts the password in the URL. Add `method="post"` or pass a function `action`.',
+            override: 'This button submits a form with a password field by GET, so a submission before JavaScript loads puts the password in the URL. Remove `formMethod` or set it to "post".',
+        },
+    },
+    create(context) {
+        const forms = [];
+        const controls = [];
+        return {
+            JSXElement(node) {
+                if (isElement(node.openingElement, "form")) {
+                    forms.push(node);
+                }
+            },
+            JSXOpeningElement(node) {
+                if (isElement(node, "input") || isElement(node, "button")) {
+                    controls.push(node);
+                }
+            },
+            "Program:exit"() {
+                const owned = new Map();
+                for (const control of controls) {
+                    for (const form of owningForms(control, forms)) {
+                        owned.set(form, [...(owned.get(form) ?? []), control]);
+                    }
+                }
+                for (const [form, items] of owned) {
+                    if (!items.some(isSecretInput)) {
+                        continue;
+                    }
+                    if (submitsByGet(form.openingElement)) {
+                        context.report({ node: form.openingElement, messageId: "get" });
+                    }
+                    for (const submitter of items.filter(submitsByGetOverride)) {
+                        context.report({ node: submitter, messageId: "override" });
+                    }
+                }
+            },
+        };
+    },
+});

package/dist/rules/no-hardcoded-credential.d.ts

@@ -0,0 +1 @@
+export declare const noHardcodedCredential: import("@oxlint/plugins").Rule;