@jameswyse/oxc-config 0.1.0

package/dist/rules/electron-no-raw-ipc-renderer-exposure.js

@@ -0,0 +1,127 @@
+import { defineRule } from "@oxlint/plugins";
+import { childNodes, propertyName, variableFor } from "../shared/index.js";
+const exposedArgument = new Map([
+    ["exposeInMainWorld", 1],
+    ["exposeInIsolatedWorld", 2],
+]);
+const listenerMethods = new Set([
+    "on",
+    "once",
+    "addListener",
+    "prependListener",
+    "prependOnceListener",
+]);
+function electronName(sourceCode, node) {
+    if (node.type === "MemberExpression") {
+        return propertyName(node);
+    }
+    if (node.type !== "Identifier") {
+        return null;
+    }
+    const definition = variableFor(sourceCode, node)?.defs[0];
+    if (definition?.type === "ImportBinding" && definition.node.type === "ImportSpecifier") {
+        const { imported } = definition.node;
+        return imported.type === "Literal" ? imported.value : imported.name;
+    }
+    return node.name;
+}
+function isPropertyPosition(node) {
+    const parent = node.parent;
+    return ((parent?.type === "MemberExpression" && parent.property === node && !parent.computed) ||
+        (parent?.type === "Property" && parent.key === node && parent.value !== node));
+}
+function isWithin(node, root) {
+    for (let current = node; current; current = current.parent) {
+        if (current === root) {
+            return true;
+        }
+    }
+    return false;
+}
+function isParameterOf(sourceCode, node, root) {
+    return (node?.type === "Identifier" &&
+        Boolean(variableFor(sourceCode, node)?.defs.some((definition) => definition.type === "Parameter" && isWithin(definition.node, root))));
+}
+function resolveConstant(sourceCode, node) {
+    if (node.type !== "Identifier") {
+        return node;
+    }
+    const definitions = variableFor(sourceCode, node)?.defs ?? [];
+    const definition = definitions.length === 1 ? definitions[0] : null;
+    return definition?.type === "Variable" &&
+        definition.parent?.type === "VariableDeclaration" &&
+        definition.parent.kind === "const" &&
+        definition.node.type === "VariableDeclarator" &&
+        definition.node.id.type === "Identifier" &&
+        definition.node.init
+        ? definition.node.init
+        : node;
+}
+function walk(node, visitorKeys, visit) {
+    visit(node);
+    for (const child of childNodes(node, visitorKeys)) {
+        walk(child, visitorKeys, visit);
+    }
+}
+export const electronNoRawIpcRendererExposure = defineRule({
+    meta: {
+        type: "problem",
+        docs: {
+            description: "Disallow exposing ipcRenderer, its methods or arbitrary channels through contextBridge.",
+        },
+        schema: [],
+        messages: {
+            exposed: "Expose narrow functions that call fixed IPC channels, never ipcRenderer or its methods.",
+            channel: "Use a fixed IPC channel. Forwarding a renderer-supplied channel lets the renderer reach every IPC handler.",
+            listener: "Wrap the renderer callback and pass it only the payload. Passing it to ipcRenderer.{{method}} hands the renderer the IPC event and its sender.",
+        },
+    },
+    create(context) {
+        const sourceCode = context.sourceCode;
+        function isIpcRenderer(node) {
+            return ((node.type === "Identifier" || node.type === "MemberExpression") &&
+                !isPropertyPosition(node) &&
+                electronName(sourceCode, node) === "ipcRenderer");
+        }
+        function checkCall(call, method, root) {
+            const [channel, listener] = call.arguments;
+            if (channel?.type === "SpreadElement" || isParameterOf(sourceCode, channel, root)) {
+                context.report({ node: channel, messageId: "channel" });
+            }
+            if (listenerMethods.has(method) && isParameterOf(sourceCode, listener, root)) {
+                context.report({ node: listener, messageId: "listener", data: { method } });
+            }
+        }
+        function check(node, root) {
+            if (!isIpcRenderer(node)) {
+                return;
+            }
+            const member = node.parent;
+            const method = member?.type === "MemberExpression" && member.object === node ? propertyName(member) : null;
+            const call = member?.parent;
+            if (method && call?.type === "CallExpression" && call.callee === member) {
+                checkCall(call, method, root);
+                return;
+            }
+            context.report({ node, messageId: "exposed" });
+        }
+        return {
+            CallExpression(node) {
+                const callee = node.callee;
+                if (callee.type !== "MemberExpression") {
+                    return;
+                }
+                const name = propertyName(callee);
+                const index = name === null ? undefined : exposedArgument.get(name);
+                if (index === undefined || electronName(sourceCode, callee.object) !== "contextBridge") {
+                    return;
+                }
+                const exposed = node.arguments[index];
+                if (exposed) {
+                    const root = resolveConstant(sourceCode, exposed);
+                    walk(root, sourceCode.visitorKeys, (child) => check(child, root));
+                }
+            },
+        };
+    },
+});

package/dist/rules/electron-no-remote-module.d.ts

@@ -0,0 +1 @@
+export declare const electronNoRemoteModule: import("@oxlint/plugins").Rule;

package/dist/rules/electron-no-remote-module.js

@@ -0,0 +1,112 @@
+import { defineRule } from "@oxlint/plugins";
+import { isGlobal, propertyName, variableFor } from "../shared/index.js";
+function moduleName(node) {
+    return node?.type === "Literal" && typeof node.value === "string" ? node.value : null;
+}
+function isRemotePackage(name) {
+    return name === "@electron/remote" || (name?.startsWith("@electron/remote/") ?? false);
+}
+function isElectron(name) {
+    return name === "electron" || (name?.startsWith("electron/") ?? false);
+}
+function requiredModule(sourceCode, node) {
+    return node?.type === "CallExpression" && isGlobal(sourceCode, node.callee, "require")
+        ? moduleName(node.arguments[0])
+        : null;
+}
+function isElectronModule(sourceCode, node) {
+    if (isElectron(requiredModule(sourceCode, node))) {
+        return true;
+    }
+    if (node?.type !== "Identifier") {
+        return false;
+    }
+    const [definition, ...otherDefinitions] = variableFor(sourceCode, node)?.defs ?? [];
+    if (definition === undefined || otherDefinitions.length > 0) {
+        return false;
+    }
+    const { node: definitionNode, parent } = definition;
+    if (definition.type === "ImportBinding") {
+        return (definitionNode.type !== "ImportSpecifier" &&
+            parent?.type === "ImportDeclaration" &&
+            isElectron(parent.source.value));
+    }
+    return (definition.type === "Variable" &&
+        parent?.type === "VariableDeclaration" &&
+        parent.kind === "const" &&
+        definitionNode.type === "VariableDeclarator" &&
+        definitionNode.id.type === "Identifier" &&
+        isElectron(requiredModule(sourceCode, definitionNode.init)));
+}
+function specifierName(node) {
+    return node.type === "Identifier" ? node.name : node.value;
+}
+export const electronNoRemoteModule = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "Disallow Electron's remote module and @electron/remote." },
+        schema: [],
+        messages: {
+            remote: "Do not use Electron remote APIs. Expose a narrow, validated IPC operation instead.",
+        },
+    },
+    create(context) {
+        const sourceCode = context.sourceCode;
+        function checkSource(node, source) {
+            if (isRemotePackage(moduleName(source))) {
+                context.report({ node, messageId: "remote" });
+                return true;
+            }
+            return false;
+        }
+        return {
+            ImportDeclaration(node) {
+                if (checkSource(node, node.source) || !isElectron(node.source.value)) {
+                    return;
+                }
+                for (const specifier of node.specifiers) {
+                    if (specifier.type === "ImportSpecifier" &&
+                        specifierName(specifier.imported) === "remote") {
+                        context.report({ node: specifier, messageId: "remote" });
+                    }
+                }
+            },
+            ExportNamedDeclaration(node) {
+                if (checkSource(node, node.source) || !isElectron(moduleName(node.source))) {
+                    return;
+                }
+                for (const specifier of node.specifiers) {
+                    if (specifierName(specifier.local) === "remote") {
+                        context.report({ node: specifier, messageId: "remote" });
+                    }
+                }
+            },
+            ExportAllDeclaration(node) {
+                checkSource(node, node.source);
+            },
+            ImportExpression(node) {
+                checkSource(node, node.source);
+            },
+            CallExpression(node) {
+                if (isGlobal(sourceCode, node.callee, "require")) {
+                    checkSource(node, node.arguments[0]);
+                }
+            },
+            MemberExpression(node) {
+                if (propertyName(node) === "remote" && isElectronModule(sourceCode, node.object)) {
+                    context.report({ node, messageId: "remote" });
+                }
+            },
+            VariableDeclarator(node) {
+                if (node.id.type !== "ObjectPattern" || !isElectronModule(sourceCode, node.init)) {
+                    return;
+                }
+                for (const property of node.id.properties) {
+                    if (property.type === "Property" && propertyName(property) === "remote") {
+                        context.report({ node: property, messageId: "remote" });
+                    }
+                }
+            },
+        };
+    },
+});

package/dist/rules/electron-secure-web-preferences.d.ts

@@ -0,0 +1 @@
+export declare const electronSecureWebPreferences: import("@oxlint/plugins").Rule;

package/dist/rules/electron-secure-web-preferences.js

@@ -0,0 +1,108 @@
+import { defineRule } from "@oxlint/plugins";
+import { variableFor } from "../shared/index.js";
+const hardenedPreferences = [
+    ["contextIsolation", true],
+    ["sandbox", true],
+    ["nodeIntegration", false],
+];
+const dangerousPreferences = [
+    ["allowRunningInsecureContent", false],
+    ["enableBlinkFeatures", ""],
+    ["enableRemoteModule", false],
+    ["experimentalFeatures", false],
+    ["nodeIntegrationInSubFrames", false],
+    ["nodeIntegrationInWorker", false],
+    ["webSecurity", true],
+    ["webviewTag", false],
+];
+function unwrap(node) {
+    if (node?.type === "TSAsExpression" ||
+        node?.type === "TSSatisfiesExpression" ||
+        node?.type === "TSNonNullExpression" ||
+        node?.type === "TSTypeAssertion") {
+        return unwrap(node.expression);
+    }
+    return node;
+}
+function keyName(property) {
+    if (!property.computed && property.key.type === "Identifier") {
+        return property.key.name;
+    }
+    return property.key.type === "Literal" ? String(property.key.value) : null;
+}
+function setting(object, name) {
+    let property = null;
+    let known = true;
+    for (const candidate of object.properties) {
+        const key = candidate.type === "Property" ? keyName(candidate) : null;
+        if (candidate.type === "Property" && key === name) {
+            property = candidate;
+            known = true;
+        }
+        else if (key === null) {
+            known = false;
+        }
+    }
+    return { property, known };
+}
+function hasValue(property, expected) {
+    const value = unwrap(property?.value);
+    return value?.type === "Literal" && value.value === expected;
+}
+function objectFor(sourceCode, node) {
+    const value = unwrap(node);
+    if (value?.type === "ObjectExpression") {
+        return value;
+    }
+    if (value?.type !== "Identifier") {
+        return null;
+    }
+    const definitions = variableFor(sourceCode, value)?.defs ?? [];
+    const definition = definitions.length === 1 ? definitions[0] : null;
+    return definition?.type === "Variable" &&
+        definition.parent?.type === "VariableDeclaration" &&
+        definition.parent.kind === "const" &&
+        definition.node.type === "VariableDeclarator" &&
+        definition.node.id.type === "Identifier"
+        ? objectFor(sourceCode, definition.node.init)
+        : null;
+}
+export const electronSecureWebPreferences = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "Require hardened Electron webPreferences." },
+        schema: [],
+        messages: {
+            insecure: "Set webPreferences contextIsolation: true, sandbox: true and nodeIntegration: false explicitly, with nothing spread after them.",
+            dangerous: 'Do not enable the dangerous Electron webPreference "{{name}}".',
+        },
+    },
+    create(context) {
+        const sourceCode = context.sourceCode;
+        return {
+            ObjectExpression(node) {
+                const { property } = setting(node, "webPreferences");
+                if (!property) {
+                    return;
+                }
+                const webPreferences = objectFor(sourceCode, property.value);
+                if (!webPreferences) {
+                    return;
+                }
+                const hardened = hardenedPreferences.every(([name, expected]) => {
+                    const preference = setting(webPreferences, name);
+                    return preference.known && hasValue(preference.property, expected);
+                });
+                if (!hardened) {
+                    context.report({ node: property.value, messageId: "insecure" });
+                }
+                for (const [name, safe] of dangerousPreferences) {
+                    const preference = setting(webPreferences, name).property;
+                    if (preference && !hasValue(preference, safe)) {
+                        context.report({ node: preference, messageId: "dangerous", data: { name } });
+                    }
+                }
+            },
+        };
+    },
+});

package/dist/rules/explicit-api-states.d.ts

@@ -0,0 +1 @@
+export declare const explicitApiStates: import("@oxlint/plugins").Rule;

package/dist/rules/explicit-api-states.js

@@ -0,0 +1,143 @@
+import { defineRule } from "@oxlint/plugins";
+import { propertyName } from "../shared/index.js";
+const absentTypes = new Set(["TSUndefinedKeyword", "TSNullKeyword"]);
+function isBooleanType(type) {
+    if (type?.type === "TSBooleanKeyword") {
+        return true;
+    }
+    if (type?.type !== "TSUnionType") {
+        return false;
+    }
+    const present = type.types.filter((member) => !absentTypes.has(member.type));
+    return present.length === 1 && isBooleanType(present[0]);
+}
+function booleanParameter(parameter) {
+    const target = parameter.type === "TSParameterProperty" ? parameter.parameter : parameter;
+    if (target.type === "Identifier") {
+        return isBooleanType(target.typeAnnotation?.typeAnnotation) ? target : null;
+    }
+    if (target.type !== "AssignmentPattern" || target.left.type !== "Identifier") {
+        return null;
+    }
+    const annotation = target.left.typeAnnotation?.typeAnnotation;
+    const isBoolean = annotation
+        ? isBooleanType(annotation)
+        : target.right.type === "Literal" && typeof target.right.value === "boolean";
+    return isBoolean ? target.left : null;
+}
+function isSetter(name, fn, parameter) {
+    return (/^(?:set|update)\p{Lu}/u.test(name.slice(name.lastIndexOf(".") + 1)) &&
+        fn.params.at(-1) === parameter);
+}
+function functionValue(node) {
+    return node?.type === "ArrowFunctionExpression" || node?.type === "FunctionExpression"
+        ? node
+        : null;
+}
+function isPublicMember(member) {
+    return (!member.computed &&
+        member.key.type !== "PrivateIdentifier" &&
+        member.accessibility !== "private" &&
+        member.accessibility !== "protected");
+}
+function classMembers(declaration) {
+    const name = declaration.id?.name ?? "default";
+    return declaration.body.body.flatMap((member) => {
+        if ((member.type !== "MethodDefinition" && member.type !== "PropertyDefinition") ||
+            !isPublicMember(member)) {
+            return [];
+        }
+        if (member.type === "MethodDefinition" && member.kind !== "set" && member.kind !== "get") {
+            return [{ name: `${name}.${propertyName(member)}`, fn: member.value }];
+        }
+        const value = member.type === "PropertyDefinition" ? functionValue(member.value) : null;
+        return value ? [{ name: `${name}.${propertyName(member)}`, fn: value }] : [];
+    });
+}
+function exportedFunctions(declaration) {
+    if (!declaration) {
+        return [];
+    }
+    if (declaration.type === "FunctionDeclaration" ||
+        declaration.type === "FunctionExpression" ||
+        declaration.type === "ArrowFunctionExpression") {
+        return [{ name: declaration.id?.name ?? "default", fn: declaration }];
+    }
+    if (declaration.type === "ClassDeclaration" || declaration.type === "ClassExpression") {
+        return classMembers(declaration);
+    }
+    if (declaration.type === "VariableDeclaration") {
+        return declaration.declarations.flatMap((declarator) => {
+            const fn = functionValue(declarator.init);
+            return fn && declarator.id.type === "Identifier" ? [{ name: declarator.id.name, fn }] : [];
+        });
+    }
+    return [];
+}
+export const explicitApiStates = defineRule({
+    meta: {
+        type: "suggestion",
+        docs: {
+            description: "Avoid boolean control parameters on exported functions and public methods.",
+        },
+        schema: [],
+        messages: {
+            boolean: "Parameter '{{parameter}}' makes `{{name}}` switch on a positional boolean. Take named options or split it into explicit variants.",
+        },
+    },
+    create(context) {
+        function check({ name, fn }) {
+            if (!fn.body) {
+                return;
+            }
+            for (const parameter of fn.params) {
+                const identifier = booleanParameter(parameter);
+                if (identifier && !isSetter(name, fn, parameter)) {
+                    context.report({
+                        node: identifier,
+                        messageId: "boolean",
+                        data: { parameter: identifier.name, name },
+                    });
+                }
+            }
+        }
+        return {
+            Program(program) {
+                const exportedNames = new Set();
+                for (const statement of program.body) {
+                    if (statement.type === "ExportNamedDeclaration" && !statement.source) {
+                        if (statement.exportKind === "type") {
+                            continue;
+                        }
+                        for (const entry of exportedFunctions(statement.declaration)) {
+                            check(entry);
+                        }
+                        for (const specifier of statement.specifiers) {
+                            if (specifier.exportKind !== "type" && specifier.local.type === "Identifier") {
+                                exportedNames.add(specifier.local.name);
+                            }
+                        }
+                    }
+                    if (statement.type === "ExportDefaultDeclaration") {
+                        if (statement.declaration.type === "Identifier") {
+                            exportedNames.add(statement.declaration.name);
+                        }
+                        else {
+                            for (const entry of exportedFunctions(statement.declaration)) {
+                                check(entry);
+                            }
+                        }
+                    }
+                }
+                for (const statement of program.body) {
+                    const owner = statement.type === "ClassDeclaration" ? statement.id?.name : undefined;
+                    for (const entry of exportedFunctions(statement)) {
+                        if (exportedNames.has(owner ?? entry.name)) {
+                            check(entry);
+                        }
+                    }
+                }
+            },
+        };
+    },
+});

package/dist/rules/import-boundaries.d.ts

@@ -0,0 +1 @@
+export declare const importBoundaries: import("@oxlint/plugins").Rule;

package/dist/rules/import-boundaries.js

@@ -0,0 +1,99 @@
+import { dirname, resolve as resolvePath } from "node:path";
+import { defineRule } from "@oxlint/plugins";
+import { projectPath, matchesAny } from "../shared/index.js";
+function isStringList(value) {
+    return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function parseBoundary(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new TypeError("Each import boundary must be an object.");
+    }
+    const { files, ignore = [], deny, message } = value;
+    if (!isStringList(files) ||
+        !isStringList(ignore) ||
+        !isStringList(deny) ||
+        typeof message !== "string") {
+        throw new TypeError("Each import boundary needs files, deny and message settings.");
+    }
+    return { files, ignore, deny, message };
+}
+function parseBoundaries(options) {
+    const [option] = options;
+    if (typeof option !== "object" ||
+        option === null ||
+        Array.isArray(option) ||
+        !Array.isArray(option.boundaries)) {
+        throw new TypeError("Configure import boundaries with a boundaries array.");
+    }
+    return option.boundaries.map(parseBoundary);
+}
+export const importBoundaries = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "Keep modules from importing across configured boundaries." },
+        schema: [
+            {
+                type: "object",
+                properties: {
+                    boundaries: {
+                        type: "array",
+                        items: {
+                            type: "object",
+                            properties: {
+                                files: { type: "array", items: { type: "string" } },
+                                ignore: { type: "array", items: { type: "string" } },
+                                deny: { type: "array", items: { type: "string" } },
+                                message: { type: "string" },
+                            },
+                            required: ["files", "deny", "message"],
+                            additionalProperties: false,
+                        },
+                    },
+                },
+                required: ["boundaries"],
+                additionalProperties: false,
+            },
+        ],
+        messages: { boundary: "Do not import '{{specifier}}' here. {{message}}" },
+    },
+    create(context) {
+        const file = projectPath(context.cwd, context.filename);
+        const active = parseBoundaries(context.options).filter((boundary) => matchesAny(file, boundary.files) && !matchesAny(file, boundary.ignore));
+        if (active.length === 0) {
+            return {};
+        }
+        function check(source, typeOnly) {
+            if (typeOnly || source?.type !== "Literal" || typeof source.value !== "string") {
+                return;
+            }
+            const specifier = source.value;
+            const target = specifier.startsWith(".")
+                ? projectPath(context.cwd, resolvePath(dirname(context.filename), specifier))
+                : specifier;
+            const boundary = active.find(({ deny }) => matchesAny(target, deny));
+            if (boundary) {
+                context.report({
+                    node: source,
+                    messageId: "boundary",
+                    data: { specifier, message: boundary.message },
+                });
+            }
+        }
+        return {
+            ImportDeclaration(node) {
+                check(node.source, node.importKind === "type" ||
+                    (node.specifiers.length > 0 &&
+                        node.specifiers.every((specifier) => specifier.type === "ImportSpecifier" && specifier.importKind === "type")));
+            },
+            ExportNamedDeclaration(node) {
+                check(node.source, node.exportKind === "type");
+            },
+            ExportAllDeclaration(node) {
+                check(node.source, node.exportKind === "type");
+            },
+            ImportExpression(node) {
+                check(node.source, false);
+            },
+        };
+    },
+});

package/dist/rules/no-ambient-clock.d.ts

@@ -0,0 +1 @@
+export declare const noAmbientClock: import("@oxlint/plugins").Rule;

package/dist/rules/no-ambient-clock.js

@@ -0,0 +1,35 @@
+import { defineRule } from "@oxlint/plugins";
+import { propertyName, isGlobalValue, isInjectionSeam } from "../shared/index.js";
+export const noAmbientClock = defineRule({
+    meta: {
+        type: "suggestion",
+        docs: { description: "Read the current date and time only in a clock owner." },
+        schema: [],
+        messages: {
+            clock: "Accept the current time from the caller or an injected clock. If this module owns the clock, add it to the `clock` owners.",
+        },
+    },
+    create(context) {
+        const sourceCode = context.sourceCode;
+        function check(node, date) {
+            if (isGlobalValue(sourceCode, date, "Date") && !isInjectionSeam(node)) {
+                context.report({ node, messageId: "clock" });
+            }
+        }
+        return {
+            MemberExpression(node) {
+                if (propertyName(node) === "now") {
+                    check(node, node.object);
+                }
+            },
+            NewExpression(node) {
+                if (node.arguments.length === 0) {
+                    check(node, node.callee);
+                }
+            },
+            CallExpression(node) {
+                check(node, node.callee);
+            },
+        };
+    },
+});

package/dist/rules/no-ambient-random.d.ts

@@ -0,0 +1 @@
+export declare const noAmbientRandom: import("@oxlint/plugins").Rule;