@kitajs/ts-html-plugin 4.1.4 → 5.0.0-next.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kitajs/ts-html-plugin",
-  "version": "4.1.4",
+  "version": "5.0.0-next.0",
   "homepage": "https://github.com/kitajs/html/tree/master/packages/ts-html-plugin#readme",
   "bugs": "https://github.com/kitajs/html/issues",
   "repository": {
@@ -16,30 +16,38 @@
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "bin": {
-    "ts-html-plugin": "dist/cli.js",
-    "xss-scan": "dist/cli.js"
+    "ts-html-plugin": "bin/index.js",
+    "xss-scan": "bin/index.js"
   },
+  "files": [
+    "dist",
+    "src",
+    "!dist/*.tsbuildinfo"
+  ],
   "dependencies": {
     "chalk": "^5.6.2",
     "tslib": "^2.8.1",
     "yargs": "^18.0.0"
   },
   "devDependencies": {
-    "@swc-node/register": "^1.11.1",
-    "@swc/helpers": "^0.5.17",
-    "@types/node": "^24.5.0",
-    "@types/yargs": "^17.0.33",
+    "@types/node": "^24.10.13",
+    "@types/yargs": "^17.0.35",
+    "@typescript/native-preview": "^7.0.0-dev.20260122.2",
+    "@vitest/coverage-v8": "^4.0.18",
     "fast-defer": "^1.1.9",
-    "self": "file:"
+    "self-ts-plugin": "link:",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.18",
+    "@kitajs/html": "^5.0.0-next.0"
   },
   "peerDependencies": {
-    "@kitajs/html": "^4.2.10",
-    "typescript": "^5.9.3"
+    "typescript": "^5.9.3",
+    "@kitajs/html": "^5.0.0-next.0"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "dev": "tsc -p tsconfig.build.json --watch",
-    "test": "pnpm build && pnpm install && pnpm test-exec",
-    "test-exec": "node --require @swc-node/register --test test/**/*.test.ts"
+    "build": "tsgo -p tsconfig.build.json",
+    "pretest": "pnpm run build",
+    "test": "vitest --coverage --typecheck --run",
+    "test-types": "tsgo --noEmit"
   }
 }

package/src/cli.ts

@@ -0,0 +1,229 @@
+import chalk from 'chalk';
+import fs from 'node:fs';
+import path from 'node:path';
+import ts from 'typescript';
+import yargs from 'yargs';
+import { hideBin } from 'yargs/helpers';
+import { recursiveDiagnoseJsxElements } from './util';
+
+const { version } = require('../package.json');
+
+const help = `
+
+@kitajs/ts-html-plugin v${version} - A CLI tool & TypeScript LSP for finding XSS vulnerabilities in your TypeScript code.
+
+Usage: xss-scan         [options] <file> <file>...
+       ts-html-plugin   [options] <file> <file>...
+
+Options:
+  --cwd <path>          The current working directory to use (defaults to process.cwd())
+  -p, --project <path>  The path to the tsconfig.json file to use (defaults to 'tsconfig.json')
+  -s, --simplified      Use simplified diagnostics
+  -h, --help            Show this help message
+  --version             Show the version number
+  <file> <file>...      The files to check (defaults to all files in tsconfig.json)
+
+Examples:
+  $ xss-scan
+  $ xss-scan --cwd src
+  $ xss-scan --project tsconfig.build.json
+  $ xss-scan src/index.tsx src/App.tsx
+
+Exit codes:
+  0 - No XSS vulnerabilities were found
+  1 - XSS vulnerabilities were found
+  2 - Only warnings were found
+
+`.trim();
+
+function readCompilerOptions(tsconfigPath: string) {
+  const { config, error } = ts.readConfigFile(tsconfigPath, ts.sys.readFile);
+
+  if (error) {
+    return { errors: [error] };
+  }
+
+  const { options, errors, fileNames } = ts.parseJsonConfigFileContent(
+    config,
+    ts.sys,
+    path.dirname(tsconfigPath),
+    undefined,
+    tsconfigPath
+  );
+
+  if (errors.length) {
+    return { errors };
+  }
+
+  return { options, fileNames, errors: undefined };
+}
+
+function prettyPrintErrorCount(diagnostics: ts.Diagnostic[], root: string) {
+  const files = new Map<string, number>();
+
+  // Counts the amount of errors per file
+  for (const diagnostic of diagnostics) {
+    if (!diagnostic.file) {
+      continue;
+    }
+
+    const file = files.get(diagnostic.file.fileName);
+
+    if (file !== undefined) {
+      files.set(diagnostic.file.fileName, file + 1);
+      continue;
+    }
+
+    files.set(diagnostic.file.fileName, 1);
+  }
+
+  if (files.size > 1) {
+    console.error(
+      chalk.red(`Found a total of ${diagnostics.length} errors in ${files.size} files\n`)
+    );
+  }
+
+  for (const [file, amount] of files.entries()) {
+    console.error(
+      chalk.red(
+        `Found ${amount} error${amount === 1 ? '' : 's'} in ${path.relative(root, file)}`
+      )
+    );
+  }
+}
+
+function fileExists(p: string) {
+  try {
+    fs.statSync(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function main() {
+  const args = await yargs(hideBin(process.argv)).help(false).version(version).argv;
+
+  if (args.help || args.h) {
+    console.log(help);
+    return process.exit(0);
+  }
+
+  // Detects unknown arguments
+  for (const key in args) {
+    if (key === '_' || key === '$0') {
+      continue;
+    }
+
+    switch (key) {
+      case 'cwd':
+      case 'project':
+      case 'p':
+      case 's':
+      case 'simplified':
+        continue;
+      default:
+        console.error(`Unknown argument: ${key}. Run --help for more information.`);
+        return process.exit(1);
+    }
+  }
+
+  const root = args.cwd ? String(args.cwd) : process.cwd();
+
+  const tsconfigPath = String(args.project || args.p || 'tsconfig.json');
+
+  const simplified = !!(args.simplified || args.s);
+
+  const diagnosticFormatter =
+    !process.stdout.isTTY || simplified
+      ? ts.formatDiagnostics
+      : ts.formatDiagnosticsWithColorAndContext;
+
+  if (!fileExists(tsconfigPath)) {
+    console.error((!simplified ? chalk.red : String)(`Could not find ${tsconfigPath}`));
+    return process.exit(1);
+  }
+
+  const tsconfig = readCompilerOptions(tsconfigPath);
+
+  const diagnosticHost: ts.FormatDiagnosticsHost = {
+    getCurrentDirectory: ts.sys.getCurrentDirectory,
+    getCanonicalFileName: (fileName) => fileName,
+    getNewLine: () => ts.sys.newLine
+  };
+
+  if (tsconfig.errors) {
+    console.error(diagnosticFormatter(tsconfig.errors, diagnosticHost));
+    return process.exit(1);
+  }
+
+  let files = tsconfig.fileNames;
+
+  if (args._.length) {
+    // Prefer the files passed as arguments, otherwise use the files in tsconfig.json
+    files = [];
+
+    for (let i = 0; i < args._.length; i++) {
+      const file = String(args._[i]);
+
+      if (!fileExists(file)) {
+        console.error(
+          (!simplified ? chalk.red : String)(`Could not find provided '${file}' file.`)
+        );
+        return process.exit(1);
+      }
+
+      if (!file.match(/(t|j)sx$/)) {
+        console.warn(
+          (!simplified ? chalk.yellow : String)(
+            `Provided '${file}' file is not a TSX/JSX file.`
+          )
+        );
+        continue;
+      }
+
+      files.push(file);
+    }
+  }
+
+  if (!files.length) {
+    console.error((!simplified ? chalk.red : String)('No files were found to check.'));
+    return process.exit(1);
+  }
+
+  const program = ts.createProgram(files, tsconfig.options);
+  const typeChecker = program.getTypeChecker();
+  const sources = program.getSourceFiles();
+
+  const diagnostics: ts.Diagnostic[] = [];
+
+  for (const source of sources) {
+    const filename = source.fileName;
+
+    // Not a tsx file, so don't do anything
+    if (!filename.match(/(t|j)sx$/)) {
+      continue;
+    }
+
+    ts.forEachChild(source, function loopSourceNodes(node) {
+      recursiveDiagnoseJsxElements(ts, node, typeChecker, diagnostics);
+    });
+  }
+
+  if (diagnostics.length) {
+    const hasError = diagnostics.some(
+      (diagnostic) => diagnostic.category === ts.DiagnosticCategory.Error
+    );
+
+    console.error(diagnosticFormatter(diagnostics, diagnosticHost));
+
+    if (!simplified) {
+      prettyPrintErrorCount(diagnostics, root);
+    }
+
+    process.exit(hasError ? 1 : 2);
+  }
+
+  console.log(chalk.green(`No XSS vulnerabilities found in ${files.length} files!`));
+  process.exit(0);
+}

package/src/errors.ts

@@ -0,0 +1,34 @@
+function createError(code: number, message: string) {
+  return {
+    code,
+    message:
+      process.env.INTERNAL_DISABLE_URL_DOCS !== 'true'
+        ? `${message}\nSee https://html.kitajs.org/TS${code}`
+        : message
+  };
+}
+
+// 88600 is the base code for all errors in this plugin.
+// KITA in ASCII
+// 75 * 105 * 116 * 97 = 88609500
+// Simplify to 88600
+
+export const Xss = createError(
+  88601,
+  `Content may introduce an XSS vulnerability and must be marked with the \`safe\` attribute.`
+);
+
+export const DoubleEscape = createError(
+  88602,
+  `The \`safe\` attribute causes this content to be escaped more than once.`
+);
+
+export const ComponentXss = createError(
+  88603,
+  `Content inside a Component must be escaped using escapeHtml().`
+);
+
+export const UnusedSafe = createError(
+  88604,
+  `The \`safe\` attribute is unused in this context.`
+);

package/src/index.ts

@@ -0,0 +1,43 @@
+import type { default as TS, server } from 'typescript/lib/tsserverlibrary';
+import { proxyObject, recursiveDiagnoseJsxElements } from './util';
+
+export = function (modules: { typescript: typeof TS }) {
+  const ts = modules.typescript;
+
+  return {
+    create(info: Pick<server.PluginCreateInfo, 'languageService'>) {
+      const proxy = proxyObject(info.languageService);
+
+      proxy.getSemanticDiagnostics = function clonedSemanticDiagnostics(filename) {
+        const diagnostics = info.languageService.getSemanticDiagnostics(filename);
+
+        // Not a tsx file, so don't do anything
+        if (!filename.endsWith('.tsx') && !filename.endsWith('.jsx')) {
+          return diagnostics;
+        }
+
+        const program = info.languageService.getProgram();
+
+        if (!program) {
+          return diagnostics;
+        }
+
+        const source = program.getSourceFile(filename);
+
+        if (!source) {
+          return diagnostics;
+        }
+
+        const typeChecker = program.getTypeChecker();
+
+        ts.forEachChild(source, function loopSourceNodes(node) {
+          recursiveDiagnoseJsxElements(ts, node, typeChecker, diagnostics);
+        });
+
+        return diagnostics;
+      };
+
+      return proxy;
+    }
+  };
+};