@jameswyse/oxc-config 0.2.0 → 0.4.0

package/dist/rules/no-disabled-tls-verification.js

@@ -0,0 +1,42 @@
+import { defineRule } from "@oxlint/plugins";
+import { isGlobal, staticPropertyName, unwrapExpression } from "../shared/index.js";
+function isFalse(node) {
+    const value = unwrapExpression(node);
+    return value.type === "Literal" && value.value === false;
+}
+function isDisabledFlag(node) {
+    const value = unwrapExpression(node);
+    return (value.type === "Literal" && (value.value === "0" || value.value === 0)) || isFalse(value);
+}
+export const noDisabledTlsVerification = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "Disallow turning off TLS certificate verification." },
+        schema: [],
+        messages: {
+            disabled: "This turns off TLS certificate verification, so any server can impersonate the real one. Trust the right certificate authority instead, such as with the `ca` option or `NODE_EXTRA_CA_CERTS`.",
+        },
+    },
+    create(context) {
+        const sourceCode = context.sourceCode;
+        return {
+            Property(node) {
+                if (staticPropertyName(node) === "rejectUnauthorized" && isFalse(node.value)) {
+                    context.report({ node, messageId: "disabled" });
+                }
+            },
+            AssignmentExpression(node) {
+                const target = unwrapExpression(node.left);
+                const environment = target.type === "MemberExpression" ? unwrapExpression(target.object) : null;
+                if (target.type === "MemberExpression" &&
+                    staticPropertyName(target) === "NODE_TLS_REJECT_UNAUTHORIZED" &&
+                    environment?.type === "MemberExpression" &&
+                    staticPropertyName(environment) === "env" &&
+                    isGlobal(sourceCode, unwrapExpression(environment.object), "process") &&
+                    isDisabledFlag(node.right)) {
+                    context.report({ node, messageId: "disabled" });
+                }
+            },
+        };
+    },
+});

package/dist/rules/no-env-access.js

@@ -1,10 +1,34 @@
 import { defineRule } from "@oxlint/plugins";
-import { isGlobal, propertyName } from "../shared/index.js";
+import { importedBinding, isGlobalValue, isNodeGlobalValue, moduleExportName, staticPropertyName, staticString, unwrapExpression, } from "../shared/index.js";
+const processModules = new Set(["node:process", "process"]);
+const environmentExports = new Set(["env", "default"]);
 function isImportMeta(node) {
-    return (node?.type === "MetaProperty" && node.meta.name === "import" && node.property.name === "meta");
+    const value = unwrapExpression(node);
+    return (value.type === "MetaProperty" && value.meta.name === "import" && value.property.name === "meta");
+}
+function isProcessModule(sourceCode, node) {
+    const binding = importedBinding(sourceCode, node);
+    return (binding !== null &&
+        processModules.has(binding.source) &&
+        (binding.name === "*" || binding.name === "default"));
 }
 function isEnvironmentSource(sourceCode, node) {
-    return isGlobal(sourceCode, node, "process") || isImportMeta(node);
+    if (!node) {
+        return false;
+    }
+    return (isNodeGlobalValue(sourceCode, node, "process") ||
+        isImportMeta(node) ||
+        isProcessModule(sourceCode, node));
+}
+function isReflectGet(sourceCode, node) {
+    const callee = unwrapExpression(node.callee);
+    const [target, key] = node.arguments;
+    return (callee.type === "MemberExpression" &&
+        staticPropertyName(callee) === "get" &&
+        isGlobalValue(sourceCode, callee.object, "Reflect") &&
+        target?.type !== "SpreadElement" &&
+        isEnvironmentSource(sourceCode, target) &&
+        staticString(key) === "env");
 }
 export const noEnvAccess = defineRule({
     meta: {
@@ -19,14 +43,47 @@ export const noEnvAccess = defineRule({
         const sourceCode = context.sourceCode;
         return {
             MemberExpression(node) {
-                if (propertyName(node) === "env" && isEnvironmentSource(sourceCode, node.object)) {
+                if (staticPropertyName(node) === "env" && isEnvironmentSource(sourceCode, node.object)) {
                     context.report({ node, messageId: "env" });
                 }
             },
             VariableDeclarator(node) {
                 if (node.id.type === "ObjectPattern" &&
                     isEnvironmentSource(sourceCode, node.init) &&
-                    node.id.properties.some((property) => property.type === "Property" && propertyName(property) === "env")) {
+                    node.id.properties.some((property) => property.type === "Property" && staticPropertyName(property) === "env")) {
+                    context.report({ node, messageId: "env" });
+                }
+            },
+            CallExpression(node) {
+                if (isReflectGet(sourceCode, node)) {
+                    context.report({ node, messageId: "env" });
+                }
+            },
+            ImportDeclaration(node) {
+                if (!processModules.has(node.source.value) || node.importKind === "type") {
+                    return;
+                }
+                for (const specifier of node.specifiers) {
+                    if (specifier.type === "ImportSpecifier" &&
+                        specifier.importKind !== "type" &&
+                        moduleExportName(specifier.imported) === "env") {
+                        context.report({ node: specifier, messageId: "env" });
+                    }
+                }
+            },
+            ExportNamedDeclaration(node) {
+                if (!node.source || !processModules.has(node.source.value) || node.exportKind === "type") {
+                    return;
+                }
+                for (const specifier of node.specifiers) {
+                    if (specifier.exportKind !== "type" &&
+                        environmentExports.has(moduleExportName(specifier.local))) {
+                        context.report({ node: specifier, messageId: "env" });
+                    }
+                }
+            },
+            ExportAllDeclaration(node) {
+                if (processModules.has(node.source.value) && node.exportKind !== "type") {
                     context.report({ node, messageId: "env" });
                 }
             },

package/dist/rules/no-fixed-test-delay.js

@@ -1,6 +1,21 @@
 import { defineRule } from "@oxlint/plugins";
-import { variableFor, isGlobal, propertyName, isPlaywright, apiReference, testContext, } from "../shared/index.js";
-function numericLiteral(node) {
+import { variableFor, isGlobal, propertyName, isPlaywright, apiReference, isEffectModule, testContext, } from "../shared/index.js";
+function constantValue(sourceCode, node) {
+    if (node?.type !== "Identifier") {
+        return node;
+    }
+    const [definition, ...others] = variableFor(sourceCode, node)?.defs ?? [];
+    const declarator = definition?.node;
+    return others.length === 0 &&
+        definition?.type === "Variable" &&
+        definition.parent?.type === "VariableDeclaration" &&
+        definition.parent.kind === "const" &&
+        declarator?.type === "VariableDeclarator"
+        ? declarator.init
+        : node;
+}
+function numericLiteral(sourceCode, argument) {
+    const node = constantValue(sourceCode, argument);
     return ((node?.type === "Literal" && typeof node.value === "number") ||
         (node?.type === "UnaryExpression" &&
             ["+", "-"].includes(node.operator) &&
@@ -64,7 +79,7 @@ function timerPromise(sourceCode, node) {
     const timer = singleExpression(executor.body);
     if (timer?.type !== "CallExpression" ||
         !globalTimer(sourceCode, timer.callee) ||
-        !numericLiteral(timer.arguments[1])) {
+        !numericLiteral(sourceCode, timer.arguments[1])) {
         return false;
     }
     return resolvesWithoutValue(sourceCode, timer.arguments[0], resolve);
@@ -86,6 +101,26 @@ function playwrightPage(sourceCode, node, enclosing) {
             variableFor(sourceCode, binding) === variableFor(sourceCode, node));
     });
 }
+function isFixedDuration(sourceCode, argument) {
+    const node = constantValue(sourceCode, argument);
+    if (node?.type === "Literal") {
+        return typeof node.value === "string" || typeof node.value === "number";
+    }
+    const owner = node?.type === "CallExpression" && node.callee.type === "MemberExpression"
+        ? node.callee.object
+        : null;
+    return (node?.type === "CallExpression" &&
+        owner !== null &&
+        isEffectModule(sourceCode, owner, "Duration") &&
+        node.arguments.length > 0 &&
+        node.arguments.every((item) => numericLiteral(sourceCode, item)));
+}
+function isEffectSleep(sourceCode, node) {
+    return (node.callee.type === "MemberExpression" &&
+        propertyName(node.callee) === "sleep" &&
+        isEffectModule(sourceCode, node.callee.object, "Effect") &&
+        isFixedDuration(sourceCode, node.arguments[0]));
+}
 export const noFixedTestDelay = defineRule({
     meta: {
         type: "problem",
@@ -99,6 +134,12 @@ export const noFixedTestDelay = defineRule({
         const sourceCode = context.sourceCode;
         return {
             CallExpression(node) {
+                if (node.parent.type === "YieldExpression" &&
+                    node.parent.delegate &&
+                    isEffectSleep(sourceCode, node) &&
+                    testContext(sourceCode, node)) {
+                    context.report({ node, messageId: "delay" });
+                }
                 if (node.parent.type !== "AwaitExpression") {
                     return;
                 }
@@ -109,10 +150,10 @@ export const noFixedTestDelay = defineRule({
                 const api = apiReference(sourceCode, node.callee);
                 const importedTimer = api?.name === "setTimeout" &&
                     ["node:timers/promises", "timers/promises"].includes(api.module) &&
-                    numericLiteral(node.arguments[0]);
+                    numericLiteral(sourceCode, node.arguments[0]);
                 const browserTimer = node.callee.type === "MemberExpression" &&
                     propertyName(node.callee) === "waitForTimeout" &&
-                    numericLiteral(node.arguments[0]) &&
+                    numericLiteral(sourceCode, node.arguments[0]) &&
                     playwrightPage(sourceCode, node.callee.object, enclosing);
                 if (importedTimer || browserTimer) {
                     context.report({ node, messageId: "delay" });

package/dist/rules/no-generic-object-guard.d.ts

@@ -0,0 +1 @@
+export declare const noGenericObjectGuard: import("@oxlint/plugins").Rule;

package/dist/rules/no-generic-object-guard.js

@@ -0,0 +1,279 @@
+import { defineRule } from "@oxlint/plugins";
+import { isGlobal, propertyName, unwrapExpression } from "../shared/index.js";
+function unwrap(node) {
+    const value = unwrapExpression(node);
+    return value.type === "ChainExpression" ? unwrap(value.expression) : value;
+}
+function combined(checks) {
+    if (checks.includes(null)) {
+        return null;
+    }
+    if (checks.includes("object")) {
+        return "object";
+    }
+    return checks.includes("function") ? "function" : "supporting";
+}
+function isSubject(node, subject) {
+    const value = unwrap(node);
+    return value.type === "Identifier" && value.name === subject;
+}
+function isLiteral(node, value) {
+    const literal = unwrap(node);
+    return literal.type === "Literal" && literal.value === value;
+}
+function isUndefined(node) {
+    const value = unwrap(node);
+    return value.type === "Identifier" && value.name === "undefined";
+}
+function comparedPair(node, subject, matches) {
+    return ((isSubject(node.left, subject) && matches(node.right)) ||
+        (isSubject(node.right, subject) && matches(node.left)));
+}
+function isTypeofSubject(node, subject) {
+    const value = unwrap(node);
+    return value.type === "UnaryExpression" && value.operator === "typeof"
+        ? isSubject(value.argument, subject)
+        : false;
+}
+function typeofCheck(node, subject) {
+    const [typeofSide, literal] = isTypeofSubject(node.left, subject)
+        ? [node.left, node.right]
+        : [node.right, node.left];
+    if (!isTypeofSubject(typeofSide, subject) || !["===", "=="].includes(node.operator)) {
+        return null;
+    }
+    if (isLiteral(literal, "object")) {
+        return "object";
+    }
+    return isLiteral(literal, "function") ? "function" : null;
+}
+function isArrayCheck(sourceCode, node, subject) {
+    const call = unwrap(node);
+    return (call.type === "CallExpression" &&
+        call.callee.type === "MemberExpression" &&
+        propertyName(call.callee) === "isArray" &&
+        isGlobal(sourceCode, call.callee.object, "Array") &&
+        call.arguments.length === 1 &&
+        call.arguments[0] !== undefined &&
+        isSubject(call.arguments[0], subject));
+}
+function isPrototypeRead(sourceCode, node, subject) {
+    const call = unwrap(node);
+    return (call.type === "CallExpression" &&
+        call.callee.type === "MemberExpression" &&
+        propertyName(call.callee) === "getPrototypeOf" &&
+        isGlobal(sourceCode, call.callee.object, "Object") &&
+        call.arguments[0] !== undefined &&
+        isSubject(call.arguments[0], subject));
+}
+function isObjectPrototype(sourceCode, node) {
+    const value = unwrap(node);
+    return (value.type === "MemberExpression" &&
+        propertyName(value) === "prototype" &&
+        isGlobal(sourceCode, value.object, "Object"));
+}
+function isObjectTag(sourceCode, node, subject) {
+    const call = unwrap(node);
+    const tag = call.type === "CallExpression" && call.callee.type === "MemberExpression"
+        ? call.callee.object
+        : null;
+    return (call.type === "CallExpression" &&
+        call.callee.type === "MemberExpression" &&
+        propertyName(call.callee) === "call" &&
+        call.arguments[0] !== undefined &&
+        isSubject(call.arguments[0], subject) &&
+        tag?.type === "MemberExpression" &&
+        propertyName(tag) === "toString" &&
+        isObjectPrototype(sourceCode, tag.object));
+}
+function provesObject(sourceCode, value, expected, subject) {
+    return ((isPrototypeRead(sourceCode, value, subject) &&
+        (isLiteral(expected, null) || isObjectPrototype(sourceCode, expected))) ||
+        (isObjectTag(sourceCode, value, subject) && isLiteral(expected, "[object Object]")));
+}
+function equalityCheck(sourceCode, comparison, subject) {
+    const typeofResult = typeofCheck(comparison, subject);
+    if (typeofResult !== null) {
+        return typeofResult;
+    }
+    if (provesObject(sourceCode, comparison.left, comparison.right, subject) ||
+        provesObject(sourceCode, comparison.right, comparison.left, subject)) {
+        return "object";
+    }
+    return null;
+}
+function objectCheck(sourceCode, node, subject) {
+    const value = unwrap(node);
+    if (value.type === "LogicalExpression" && value.operator !== "??") {
+        return combined([
+            objectCheck(sourceCode, value.left, subject),
+            objectCheck(sourceCode, value.right, subject),
+        ]);
+    }
+    if (value.type === "UnaryExpression" && value.operator === "!") {
+        const argument = unwrap(value.argument);
+        if (isArrayCheck(sourceCode, argument, subject)) {
+            return "supporting";
+        }
+        return argument.type === "UnaryExpression" && argument.operator === "!"
+            ? objectCheck(sourceCode, argument.argument, subject)
+            : null;
+    }
+    if (isSubject(value, subject)) {
+        return "supporting";
+    }
+    if (value.type === "CallExpression" && isGlobal(sourceCode, value.callee, "Boolean")) {
+        const [argument] = value.arguments;
+        return argument !== undefined && isSubject(argument, subject) ? "supporting" : null;
+    }
+    if (value.type !== "BinaryExpression") {
+        return null;
+    }
+    if (value.operator === "instanceof") {
+        return isSubject(value.left, subject) && isGlobal(sourceCode, value.right, "Object")
+            ? "object"
+            : null;
+    }
+    if (["!==", "!="].includes(value.operator)) {
+        return comparedPair(value, subject, (other) => isLiteral(other, null) || isUndefined(other))
+            ? "supporting"
+            : null;
+    }
+    return ["===", "=="].includes(value.operator) ? equalityCheck(sourceCode, value, subject) : null;
+}
+function rejection(sourceCode, node, subject) {
+    const value = unwrap(node);
+    if (value.type === "LogicalExpression" && value.operator !== "??") {
+        return combined([
+            rejection(sourceCode, value.left, subject),
+            rejection(sourceCode, value.right, subject),
+        ]);
+    }
+    if (value.type === "UnaryExpression" && value.operator === "!") {
+        return objectCheck(sourceCode, value.argument, subject);
+    }
+    if (isArrayCheck(sourceCode, value, subject)) {
+        return "supporting";
+    }
+    if (value.type !== "BinaryExpression") {
+        return null;
+    }
+    if (["===", "=="].includes(value.operator)) {
+        return comparedPair(value, subject, (other) => isLiteral(other, null) || isUndefined(other))
+            ? "supporting"
+            : null;
+    }
+    return ["!==", "!="].includes(value.operator)
+        ? equalityCheck(sourceCode, { left: value.left, operator: "===", right: value.right }, subject)
+        : null;
+}
+function isNamedHelper(fn) {
+    const holder = fn.parent;
+    return (fn.type === "FunctionDeclaration" ||
+        (holder.type === "VariableDeclarator" && holder.init === fn) ||
+        (holder.type === "Property" && holder.value === fn) ||
+        (holder.type === "PropertyDefinition" && holder.value === fn) ||
+        holder.type === "MethodDefinition");
+}
+const openTypes = new Set(["TSUnknownKeyword", "TSAnyKeyword"]);
+const weakClaims = new Set(["TSObjectKeyword", "TSUnknownKeyword", "TSAnyKeyword"]);
+function isWeakClaim(claim) {
+    if (weakClaims.has(claim.type) ||
+        (claim.type === "TSTypeLiteral" && claim.members.length === 0)) {
+        return true;
+    }
+    const [argument] = claim.type === "TSTypeReference" ? (claim.typeArguments?.params ?? []) : [];
+    return (claim.type === "TSTypeReference" &&
+        claim.typeName.type === "Identifier" &&
+        claim.typeName.name === "NonNullable" &&
+        argument !== undefined &&
+        isWeakClaim(argument));
+}
+function unprovenClaim(sourceCode, fn, parameter) {
+    const predicate = fn.returnType?.typeAnnotation;
+    const parameterType = parameter.typeAnnotation?.typeAnnotation;
+    if (predicate?.type !== "TSTypePredicate" ||
+        predicate.parameterName.type !== "Identifier" ||
+        predicate.parameterName.name !== parameter.name ||
+        predicate.typeAnnotation === null ||
+        parameterType === undefined ||
+        !openTypes.has(parameterType.type)) {
+        return null;
+    }
+    const claim = predicate.typeAnnotation.typeAnnotation;
+    return isWeakClaim(claim) ? null : sourceCode.getText(claim);
+}
+function returnedCheck(sourceCode, node, subject) {
+    return isLiteral(node, true) ? "supporting" : objectCheck(sourceCode, node, subject);
+}
+function rejectedCheck(sourceCode, statement, subject) {
+    if (statement.type !== "IfStatement" || statement.alternate !== null) {
+        return null;
+    }
+    const consequent = statement.consequent;
+    const exit = consequent.type === "BlockStatement" && consequent.body.length === 1
+        ? consequent.body[0]
+        : consequent;
+    return exit?.type === "ReturnStatement" &&
+        exit.argument !== null &&
+        isLiteral(exit.argument, false)
+        ? rejection(sourceCode, statement.test, subject)
+        : null;
+}
+function guardProof(sourceCode, fn, subject) {
+    if (fn.body === null) {
+        return null;
+    }
+    if (fn.body.type !== "BlockStatement") {
+        return returnedCheck(sourceCode, fn.body, subject);
+    }
+    const statements = fn.body.body;
+    const last = statements.at(-1);
+    if (last?.type !== "ReturnStatement" || last.argument === null) {
+        return null;
+    }
+    return combined([
+        ...statements.slice(0, -1).map((statement) => rejectedCheck(sourceCode, statement, subject)),
+        returnedCheck(sourceCode, last.argument, subject),
+    ]);
+}
+export const noGenericObjectGuard = defineRule({
+    meta: {
+        type: "suggestion",
+        docs: {
+            description: "Disallow guards such as isRecord that only prove a value is a non-null object, and guards that claim a type they never check.",
+        },
+        schema: [],
+        messages: {
+            unproven: "This guard claims `{{subject}}` is `{{claim}}` but only checks that it exists. Check the fields the type promises, or parse the value with a schema.",
+            guard: "This guard only proves `{{subject}}` is an object, which says nothing about its fields. Parse the value with a schema where it enters, or narrow inline where only its object-ness matters.",
+        },
+    },
+    create(context) {
+        const sourceCode = context.sourceCode;
+        function check(fn) {
+            const [parameter, ...rest] = fn.params;
+            if (parameter?.type !== "Identifier" || rest.length > 0) {
+                return;
+            }
+            const proof = guardProof(sourceCode, fn, parameter.name);
+            if (proof === "object" && isNamedHelper(fn)) {
+                context.report({ node: fn, messageId: "guard", data: { subject: parameter.name } });
+                return;
+            }
+            const claim = unprovenClaim(sourceCode, fn, parameter);
+            if (claim !== null && proof === "supporting") {
+                context.report({
+                    node: fn,
+                    messageId: "unproven",
+                    data: { subject: parameter.name, claim },
+                });
+            }
+        }
+        return {
+            ArrowFunctionExpression: check,
+            FunctionDeclaration: check,
+            FunctionExpression: check,
+        };
+    },
+});

package/dist/rules/no-get-password-form.d.ts

@@ -0,0 +1 @@
+export declare const noGetPasswordForm: import("@oxlint/plugins").Rule;

package/dist/rules/no-get-password-form.js

@@ -0,0 +1,113 @@
+import { defineRule } from "@oxlint/plugins";
+const secretAutocomplete = new Set(["current-password", "new-password", "one-time-code"]);
+function isOmitted(item) {
+    const value = item.value?.type === "JSXExpressionContainer" ? item.value.expression : null;
+    return ((value?.type === "Identifier" && value.name === "undefined") ||
+        (value?.type === "Literal" && value.value === null));
+}
+function attribute(element, name) {
+    return element.attributes.find((item) => item.type === "JSXAttribute" &&
+        item.name.type === "JSXIdentifier" &&
+        item.name.name === name &&
+        !isOmitted(item));
+}
+function stringValue(item) {
+    const value = item?.value?.type === "JSXExpressionContainer" ? item.value.expression : item?.value;
+    if (value?.type === "TemplateLiteral" && value.expressions.length === 0) {
+        return value.quasis[0]?.value.cooked ?? null;
+    }
+    return value?.type === "Literal" && typeof value.value === "string" ? value.value : null;
+}
+function literalValue(item) {
+    return stringValue(item)?.toLowerCase() ?? null;
+}
+function isElement(element, name) {
+    return element.name.type === "JSXIdentifier" && element.name.name === name;
+}
+function isSecretInput(element) {
+    return (isElement(element, "input") &&
+        (literalValue(attribute(element, "type")) === "password" ||
+            (literalValue(attribute(element, "autoComplete")) ?? "")
+                .split(/\s+/u)
+                .some((token) => secretAutocomplete.has(token))));
+}
+function isGetMethod(item) {
+    const method = literalValue(item);
+    return method !== null && method !== "post" && method !== "dialog";
+}
+function submitsByGet(element) {
+    const action = attribute(element, "action");
+    const method = attribute(element, "method");
+    return (!element.attributes.some((item) => item.type === "JSXSpreadAttribute") &&
+        (action === undefined || literalValue(action) !== null) &&
+        (method === undefined || isGetMethod(method)));
+}
+function submitsByGetOverride(element) {
+    const type = literalValue(attribute(element, "type"));
+    const method = attribute(element, "formMethod");
+    const submits = isElement(element, "button")
+        ? type !== "button" && type !== "reset"
+        : isElement(element, "input") && (type === "submit" || type === "image");
+    return submits && method !== undefined && isGetMethod(method);
+}
+function owningForms(control, forms) {
+    const target = attribute(control, "form");
+    if (target !== undefined) {
+        const id = stringValue(target);
+        return id === null || id === ""
+            ? []
+            : forms.filter((form) => stringValue(attribute(form.openingElement, "id")) === id);
+    }
+    for (let ancestor = control.parent.parent; ancestor !== null; ancestor = ancestor.parent) {
+        if (ancestor.type === "JSXElement" && isElement(ancestor.openingElement, "form")) {
+            return [ancestor];
+        }
+    }
+    return [];
+}
+export const noGetPasswordForm = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "Require forms with password fields to submit by POST." },
+        schema: [],
+        messages: {
+            get: 'This form has a password field but submits by GET, so a submission before JavaScript loads puts the password in the URL. Add `method="post"` or pass a function `action`.',
+            override: 'This button submits a form with a password field by GET, so a submission before JavaScript loads puts the password in the URL. Remove `formMethod` or set it to "post".',
+        },
+    },
+    create(context) {
+        const forms = [];
+        const controls = [];
+        return {
+            JSXElement(node) {
+                if (isElement(node.openingElement, "form")) {
+                    forms.push(node);
+                }
+            },
+            JSXOpeningElement(node) {
+                if (isElement(node, "input") || isElement(node, "button")) {
+                    controls.push(node);
+                }
+            },
+            "Program:exit"() {
+                const owned = new Map();
+                for (const control of controls) {
+                    for (const form of owningForms(control, forms)) {
+                        owned.set(form, [...(owned.get(form) ?? []), control]);
+                    }
+                }
+                for (const [form, items] of owned) {
+                    if (!items.some(isSecretInput)) {
+                        continue;
+                    }
+                    if (submitsByGet(form.openingElement)) {
+                        context.report({ node: form.openingElement, messageId: "get" });
+                    }
+                    for (const submitter of items.filter(submitsByGetOverride)) {
+                        context.report({ node: submitter, messageId: "override" });
+                    }
+                }
+            },
+        };
+    },
+});

package/dist/rules/no-hardcoded-credential.d.ts

@@ -0,0 +1 @@
+export declare const noHardcodedCredential: import("@oxlint/plugins").Rule;

package/dist/rules/no-hardcoded-credential.js

@@ -0,0 +1,45 @@
+import { defineRule } from "@oxlint/plugins";
+const credentials = [
+    [
+        "private key",
+        /-----BEGIN (?:RSA |EC |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY-----[\s\S]*?(?:-----END|$)/gu,
+    ],
+    ["AWS access key", /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/gu],
+    ["GitHub token", /\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{60,})\b/gu],
+    ["Stripe live key", /\b(?:sk|rk)_live_[0-9A-Za-z]{20,}\b/gu],
+    ["Slack token", /\bxox[abposr]-[0-9A-Za-z-]{10,}\b/gu],
+    ["Google API key", /\bAIza[0-9A-Za-z_-]{35}\b/gu],
+    ["Anthropic or OpenAI key", /\bsk-(?:ant-[a-z0-9]+-|proj-)[A-Za-z0-9_-]{32,}/gu],
+];
+const placeholder = /example|fake|dummy|placeholder|redacted|x{6,}|abcdefgh|12345678/iu;
+function credentialIn(text) {
+    return (credentials.find(([, pattern]) => [...text.matchAll(pattern)].some((match) => !placeholder.test(match[0])))?.[0] ?? null);
+}
+export const noHardcodedCredential = defineRule({
+    meta: {
+        type: "problem",
+        docs: { description: "Disallow credentials written into source code." },
+        schema: [],
+        messages: {
+            credential: "This looks like a real {{kind}}. Revoke it, then load the credential from the environment or a secret store.",
+        },
+    },
+    create(context) {
+        function check(node, text) {
+            const kind = credentialIn(text);
+            if (kind !== null) {
+                context.report({ node, messageId: "credential", data: { kind } });
+            }
+        }
+        return {
+            Literal(node) {
+                if (typeof node.value === "string") {
+                    check(node, node.value);
+                }
+            },
+            TemplateElement(node) {
+                check(node, node.value.raw);
+            },
+        };
+    },
+});

package/dist/rules/no-import-time-effects.d.ts

@@ -0,0 +1 @@
+export declare const noImportTimeEffects: import("@oxlint/plugins").Rule;