@lipemat/eslint-config 4.0.5 → 5.0.0-beta.3

package/types/plugins/security/rules/html-executing-function.d.ts

@@ -0,0 +1,6 @@
+import { type TSESLint } from '@typescript-eslint/utils';
+type HtmlExecutingFunctions = 'document.write' | 'document.writeln';
+type UnsafeCalls = 'after' | 'append' | 'before' | 'insertAdjacentHTML' | 'prepend' | 'replaceWith' | 'setAttribute';
+type Messages = HtmlExecutingFunctions | UnsafeCalls | 'sanitize' | 'domPurify';
+declare const plugin: TSESLint.RuleModule<Messages>;
+export default plugin;

package/types/plugins/security/rules/html-sinks.d.ts

@@ -0,0 +1,4 @@
+import { type TSESLint } from '@typescript-eslint/utils';
+type Messages = 'setTimeoutString' | 'setIntervalString' | 'windowOpenUnsanitized' | 'cssTextUnsanitized' | 'sanitize' | 'domPurify';
+declare const plugin: TSESLint.RuleModule<Messages>;
+export default plugin;

package/types/plugins/security/rules/html-string-concat.d.ts

@@ -0,0 +1,9 @@
+import { type TSESLint, type TSESTree } from '@typescript-eslint/utils';
+/**
+ * Check if an expression contains any HTML-like strings.
+ * - Looks for `<` or `>` characters in string literals and template literals.
+ * - Recursively checks binary expressions with the ` + ` operator.
+ */
+export declare function hasHtmlLikeStrings(node: TSESTree.Expression | TSESTree.PrivateIdentifier): boolean;
+declare const plugin: TSESLint.RuleModule<'htmlStringConcat'>;
+export default plugin;

package/types/plugins/security/rules/jquery-executing.d.ts

@@ -0,0 +1,17 @@
+import { type TSESLint, type TSESTree } from '@typescript-eslint/utils';
+type UnsafeCalls = 'after' | 'append' | 'appendTo' | 'before' | 'html' | 'insertAfter' | 'insertBefore' | 'prepend' | 'prependTo' | 'replaceAll' | 'replaceWith';
+type Messages = 'needsEscaping' | 'sanitize' | 'domPurify';
+type Context = TSESLint.RuleContext<Messages, []>;
+/**
+ * Is the type of variable being passed a jQuery element?
+ *
+ * - jQuery elements are of type `JQuery`.
+ * - jQuery elements do not require sanitization.
+ *
+ * @link https://typescript-eslint.io/developers/custom-rules/#typed-rules
+ */
+export declare function isJQueryElementType(arg: TSESTree.CallExpressionArgument, context: Context): boolean;
+export declare function isJQueryCall(node: TSESTree.CallExpression): boolean;
+export declare function getJQueryCall(node: TSESTree.CallExpression): UnsafeCalls | null;
+declare const plugin: TSESLint.RuleModule<Messages>;
+export default plugin;

package/types/plugins/security/rules/vulnerable-tag-stripping.d.ts

@@ -0,0 +1,4 @@
+import { type TSESLint } from '@typescript-eslint/utils';
+type Messages = 'vulnerableTagStripping' | 'useTextOnly';
+declare const plugin: TSESLint.RuleModule<Messages>;
+export default plugin;

package/types/plugins/security/rules/window-escaping.d.ts

@@ -0,0 +1,5 @@
+import { type TSESLint } from '@typescript-eslint/utils';
+type Messages = 'unsafeWindow' | 'unsafeRead' | 'unsafeWindowLocation' | 'domPurify' | 'sanitize';
+export declare function isSafeUrlString(value: string): boolean;
+declare const plugin: TSESLint.RuleModule<Messages>;
+export default plugin;

package/types/plugins/security/utils/shared.d.ts

@@ -0,0 +1,39 @@
+import { type TSESLint, type TSESTree } from '@typescript-eslint/utils';
+import { type Type } from 'typescript';
+/**
+ * Is the node of type string.
+ * - String literals.
+ * - constants of type string.
+ * - template literals.
+ * - intrinsic type string.
+ */
+export declare function isStringLike(node: TSESTree.CallExpressionArgument, context: Readonly<TSESLint.RuleContext<string, readonly []>>): boolean;
+/**
+ * Get the TypeScript type of node.
+ */
+export declare function getType<Context extends Readonly<TSESLint.RuleContext<string, readonly []>>>(expression: TSESTree.CallExpressionArgument, context: Context): Type;
+/**
+ * Is the type of variable being passed a DOM element?
+ *
+ * - DOM elements are of the type `HTML{*}Element`.
+ * - DOM elements do not require sanitization.
+ *
+ * @link https://typescript-eslint.io/developers/custom-rules/#typed-rules
+ */
+export declare function isDomElementType<Context extends Readonly<TSESLint.RuleContext<string, readonly []>>>(expression: TSESTree.CallExpressionArgument, context: Context): boolean;
+/**
+ * Check if a node is a call to a known sanitization function.
+ * - Currently recognizes `sanitize(...)` and `DOMPurify.sanitize(...)`.
+ */
+export declare function isSanitized(node: TSESTree.Property['value'] | TSESTree.CallExpressionArgument): boolean;
+/**
+ * Check if a node is a literal string
+ */
+export declare function isLiteralString(node: TSESTree.Property['value'] | TSESTree.CallExpressionArgument): node is TSESTree.StringLiteral;
+/**
+ * Check if a node is a literal string that is safe to use in an HTML context.
+ * - Must be a literal string.
+ * - Must not contain `<script`.
+ * - Must not start with a dangerous protocol (javascript:, data:, vbscript:, about:, livescript:).
+ */
+export declare function isSafeLiteralString(node: TSESTree.Property['value'] | TSESTree.CallExpressionArgument): boolean;