@lipemat/eslint-config 5.0.0-beta.2 → 5.0.0-beta.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lipemat/eslint-config",
-  "version": "5.0.0-beta.2",
+  "version": "5.0.0-beta.3",
   "license": "MIT",
   "description": "Eslint configuration for all @lipemat packages",
   "engines": {

package/plugins/security/rules/dangerously-set-inner-html.js

@@ -52,7 +52,7 @@ const plugin = {
                     node,
                     messageId: 'dangerousInnerHtml',
                     fix: (fixer) => {
-                        return fixer.replaceText(node, `dangerouslySetInnerHTML={{__html: DOMPurify.sanitize(${context.sourceCode.getText(htmlValue)})}}`);
+                        return fixer.replaceText(node, `dangerouslySetInnerHTML={{__html: DOMPurify.sanitize( ${context.sourceCode.getText(htmlValue)} )}}`);
                     },
                 });
             },

package/plugins/security/rules/html-executing-assignment.js

@@ -1,7 +1,8 @@
 import { AST_NODE_TYPES } from '@typescript-eslint/utils';
-import { isSanitized } from '../utils/shared.js';
+import { isDomElementType, isSafeLiteralString, isSanitized } from '../utils/shared.js';
 const UNSAFE_PROPERTIES = [
-    'innerHTML', 'outerHTML',
+    'innerHTML',
+    'outerHTML',
 ];
 function isUnsafeProperty(propertyName) {
     return UNSAFE_PROPERTIES.includes(propertyName);
@@ -26,8 +27,7 @@ const plugin = {
     create(context) {
         return {
             AssignmentExpression(node) {
-                // Handle element.innerHTML = value and element.outerHTML = value
-                if (AST_NODE_TYPES.MemberExpression !== node.left.type || !('name' in node.left.property)) {
+                if (AST_NODE_TYPES.MemberExpression !== node.left.type || AST_NODE_TYPES.Identifier !== node.left.property.type) {
                     return;
                 }
                 const propertyName = node.left.property.name;
@@ -35,7 +35,7 @@ const plugin = {
                     return;
                 }
                 const value = node.right;
-                if (!isSanitized(value)) {
+                if (!isSafeLiteralString(value) && !isSanitized(value) && isDomElementType(node.left.object, context)) {
                     context.report({
                         node,
                         messageId: 'executed',
@@ -47,14 +47,14 @@ const plugin = {
                                 messageId: 'domPurify',
                                 fix: (fixer) => {
                                     const valueText = context.sourceCode.getText(value);
-                                    return fixer.replaceText(value, `DOMPurify.sanitize(${valueText})`);
+                                    return fixer.replaceText(value, `DOMPurify.sanitize( ${valueText} )`);
                                 },
                             },
                             {
                                 messageId: 'sanitize',
                                 fix: (fixer) => {
                                     const valueText = context.sourceCode.getText(value);
-                                    return fixer.replaceText(value, `sanitize(${valueText})`);
+                                    return fixer.replaceText(value, `sanitize( ${valueText} )`);
                                 },
                             },
                         ],

package/plugins/security/rules/html-executing-function.js

@@ -1,5 +1,5 @@
 import { AST_NODE_TYPES } from '@typescript-eslint/utils';
-import { isDomElementType, isSanitized } from '../utils/shared.js';
+import { isDomElementType, isSafeLiteralString, isSanitized } from '../utils/shared.js';
 import { isJQueryCall } from './jquery-executing.js';
 const DOCUMENT_METHODS = [
     'document.write',
@@ -42,19 +42,20 @@ function getDocumentCall(node) {
     }
     return null;
 }
-function getElementMethodCall(node) {
-    // Detect element.method(userInput) calls
-    if (AST_NODE_TYPES.MemberExpression !== node.callee.type || !('name' in node.callee.property)) {
+function getElementMethodCall(node, context) {
+    if (AST_NODE_TYPES.MemberExpression !== node.callee.type || AST_NODE_TYPES.Identifier !== node.callee.property.type) {
         return null;
     }
     const methodName = node.callee.property.name;
+    if (!isDomElementType(node.callee.object, context)) {
+        return null; // We only care about DOM element method calls.
+    }
     if (!isUnsafeMethod(methodName)) {
         return null;
     }
     if (isJQueryCall(node)) {
         return null; // Handled in jquery-executing rule
     }
-    // This is a generic element method call, not jQuery specific
     return methodName;
 }
 const plugin = {
@@ -91,7 +92,7 @@ const plugin = {
                     method = documentMethod;
                 }
                 else {
-                    method = getElementMethodCall(node);
+                    method = getElementMethodCall(node, context);
                     if (null === method) {
                         return;
                     }
@@ -100,7 +101,7 @@ const plugin = {
                 if (isSecondArgMethod(method)) {
                     arg = node.arguments[1];
                 }
-                if (!isSanitized(arg) && !isDomElementType(arg, context)) {
+                if (!isSafeLiteralString(arg) && !isSanitized(arg) && !isDomElementType(arg, context)) {
                     context.report({
                         node,
                         messageId: method,
@@ -109,14 +110,14 @@ const plugin = {
                                 messageId: 'domPurify',
                                 fix: (fixer) => {
                                     const argText = context.sourceCode.getText(arg);
-                                    return fixer.replaceText(arg, `DOMPurify.sanitize(${argText})`);
+                                    return fixer.replaceText(arg, `DOMPurify.sanitize( ${argText} )`);
                                 },
                             },
                             {
                                 messageId: 'sanitize',
                                 fix: (fixer) => {
                                     const argText = context.sourceCode.getText(arg);
-                                    return fixer.replaceText(arg, `sanitize(${argText})`);
+                                    return fixer.replaceText(arg, `sanitize( ${argText} )`);
                                 },
                             },
                         ],

package/plugins/security/rules/html-sinks.js

@@ -1,11 +1,5 @@
 import { AST_NODE_TYPES } from '@typescript-eslint/utils';
-import { isSanitized, isStringLike } from '../utils/shared.js';
-/**
- * Check if a node is a literal string
- */
-function isLiteralString(node) {
-    return AST_NODE_TYPES.Literal === node.type && 'string' === typeof node.value;
-}
+import { isLiteralString, isSanitized, isStringLike } from '../utils/shared.js';
 /**
  * Get the callee name from a call expression
  */
@@ -87,11 +81,11 @@ const plugin = {
                             suggest: [
                                 {
                                     messageId: 'domPurify',
-                                    fix: fixer => fixer.replaceText(firstArg, `DOMPurify.sanitize(${argText})`),
+                                    fix: fixer => fixer.replaceText(firstArg, `DOMPurify.sanitize( ${argText} )`),
                                 },
                                 {
                                     messageId: 'sanitize',
-                                    fix: fixer => fixer.replaceText(firstArg, `sanitize(${argText})`),
+                                    fix: fixer => fixer.replaceText(firstArg, `sanitize( ${argText} )`),
                                 },
                             ],
                         });
@@ -111,11 +105,11 @@ const plugin = {
                             suggest: [
                                 {
                                     messageId: 'domPurify',
-                                    fix: fixer => fixer.replaceText(node.right, `DOMPurify.sanitize(${rightText})`),
+                                    fix: fixer => fixer.replaceText(node.right, `DOMPurify.sanitize( ${rightText} )`),
                                 },
                                 {
                                     messageId: 'sanitize',
-                                    fix: fixer => fixer.replaceText(node.right, `sanitize(${rightText})`),
+                                    fix: fixer => fixer.replaceText(node.right, `sanitize( ${rightText} )`),
                                 },
                             ],
                         });

package/plugins/security/rules/html-string-concat.js

@@ -3,7 +3,12 @@ function isStringConcat(node) {
     // 'foo' + userInput + 'bar' (HTML-like only)
     return AST_NODE_TYPES.BinaryExpression === node.type && '+' === node.operator && hasHtmlLikeStrings(node);
 }
-function hasHtmlLikeStrings(node) {
+/**
+ * Check if an expression contains any HTML-like strings.
+ * - Looks for `<` or `>` characters in string literals and template literals.
+ * - Recursively checks binary expressions with the ` + ` operator.
+ */
+export function hasHtmlLikeStrings(node) {
     if (AST_NODE_TYPES.Literal === node.type && 'string' === typeof node.value) {
         return /[<>]/.test(node.value);
     }

package/plugins/security/rules/jquery-executing.js

@@ -84,14 +84,14 @@ const plugin = {
                                     messageId: 'domPurify',
                                     fix: (fixer) => {
                                         const argText = context.sourceCode.getText(arg);
-                                        return fixer.replaceText(arg, `DOMPurify.sanitize(${argText})`);
+                                        return fixer.replaceText(arg, `DOMPurify.sanitize( ${argText} )`);
                                     },
                                 },
                                 {
                                     messageId: 'sanitize',
                                     fix: (fixer) => {
                                         const argText = context.sourceCode.getText(arg);
-                                        return fixer.replaceText(arg, `sanitize(${argText})`);
+                                        return fixer.replaceText(arg, `sanitize( ${argText} )`);
                                     },
                                 },
                             ],

package/plugins/security/rules/window-escaping.js

@@ -1,5 +1,5 @@
 import { AST_NODE_TYPES } from '@typescript-eslint/utils';
-import { isSanitized } from '../utils/shared.js';
+import { isLiteralString, isSanitized } from '../utils/shared.js';
 // Window and location properties that need special handling
 const LOCATION_PROPS = new Set(['href', 'src', 'action',
     'protocol', 'host', 'hostname', 'pathname', 'search', 'hash', 'username', 'port', 'name', 'status',
@@ -9,37 +9,7 @@ export function isSafeUrlString(value) {
     return !/^\s*(?:javascript|data|vbscript|about|livescript)\s*:/i.test(decodeURIComponent(value.replace(/[\u0000-\u001F\u007F]+/g, '')));
 }
 function isSafeUrlLiteral(node) {
-    if (AST_NODE_TYPES.TemplateElement !== node.type && AST_NODE_TYPES.Literal !== node.type) {
-        return false;
-    }
-    if (typeof node.value !== 'string') {
-        return false;
-    }
-    return isSafeUrlString(node.value);
-}
-function isSafeUrlTemplate(node) {
-    if (AST_NODE_TYPES.TemplateLiteral !== node.type || 0 === node.quasis.length) {
-        return false;
-    }
-    // Basic scheme safety on the first static chunk
-    const firstChunk = node.quasis[0];
-    if (isSafeUrlLiteral(firstChunk)) {
-        return true;
-    }
-    return isUrlEncoded(node);
-}
-function isUrlEncoded(node) {
-    if (AST_NODE_TYPES.TemplateLiteral !== node.type) {
-        return false;
-    }
-    return Array.isArray(node.expressions) && node.expressions.length > 0 && node.expressions.every(isEncoded);
-}
-function isEncoded(node) {
-    if (AST_NODE_TYPES.CallExpression !== node.type) {
-        return false;
-    }
-    return AST_NODE_TYPES.Identifier === node.callee.type &&
-        ('encodeURIComponent' === node.callee.name || 'encodeURI' === node.callee.name);
+    return isLiteralString(node) && isSafeUrlString(node.value);
 }
 function isWindowLocationAssignment(node) {
     // window.location.<prop> = ...
@@ -60,16 +30,16 @@ function isWindowAssignment(node) {
         'window' === node.left.object.name &&
         WINDOW_PROPS.has(node.left.property.name));
 }
-function isWindowOrLocationMemberExpression(memberExpr) {
+function isWindowOrLocation(expression) {
     // Helper to detect a window.* or window.location.*
-    if (AST_NODE_TYPES.MemberExpression !== memberExpr.type) {
+    if (AST_NODE_TYPES.MemberExpression !== expression.type) {
         return false;
     }
-    if (AST_NODE_TYPES.Identifier === memberExpr.object.type && 'window' === memberExpr.object.name) {
+    if (AST_NODE_TYPES.Identifier === expression.object.type && 'window' === expression.object.name) {
         return true;
     }
-    if (AST_NODE_TYPES.MemberExpression === memberExpr.object.type) {
-        const memberObject = memberExpr.object;
+    if (AST_NODE_TYPES.MemberExpression === expression.object.type) {
+        const memberObject = expression.object;
         const isObjectWindow = AST_NODE_TYPES.Identifier === memberObject.object.type && 'window' === memberObject.object.name;
         const isPropertyLocation = AST_NODE_TYPES.Identifier === memberObject.property.type && 'location' === memberObject.property.name;
         return isObjectWindow && isPropertyLocation;
@@ -108,10 +78,7 @@ const plugin = {
                     if (!LOCATION_PROPS.has(propName)) {
                         return;
                     }
-                    if (isSafeUrlLiteral(rhsResolved) || isSafeUrlTemplate(rhsResolved)) {
-                        return;
-                    }
-                    if (isSanitized(rhsResolved)) {
+                    if (isSafeUrlLiteral(rhsResolved) || isSanitized(rhsResolved)) {
                         return;
                     }
                     context.report({
@@ -125,13 +92,13 @@ const plugin = {
                                 messageId: 'sanitize',
                                 fix: (fixer) => {
                                     const argText = context.sourceCode.getText(right);
-                                    return fixer.replaceText(right, `sanitize(${argText})`);
+                                    return fixer.replaceText(right, `sanitize( ${argText} )`);
                                 },
                             }, {
                                 messageId: 'domPurify',
                                 fix: (fixer) => {
                                     const argText = context.sourceCode.getText(right);
-                                    return fixer.replaceText(right, `DOMPurify.sanitize(${argText})`);
+                                    return fixer.replaceText(right, `DOMPurify.sanitize( ${argText} )`);
                                 },
                             },
                         ],
@@ -154,13 +121,13 @@ const plugin = {
                                 messageId: 'sanitize',
                                 fix: (fixer) => {
                                     const argText = context.sourceCode.getText(right);
-                                    return fixer.replaceText(right, `sanitize(${argText})`);
+                                    return fixer.replaceText(right, `sanitize( ${argText} )`);
                                 },
                             }, {
                                 messageId: 'domPurify',
                                 fix: (fixer) => {
                                     const argText = context.sourceCode.getText(right);
-                                    return fixer.replaceText(right, `DOMPurify.sanitize(${argText})`);
+                                    return fixer.replaceText(right, `DOMPurify.sanitize( ${argText} )`);
                                 },
                             },
                         ],
@@ -173,7 +140,7 @@ const plugin = {
                 if (AST_NODE_TYPES.AssignmentExpression === parent.type && parent.left === node) {
                     return;
                 }
-                if (!isWindowOrLocationMemberExpression(node) || !('name' in node.property)) {
+                if (!isWindowOrLocation(node) || !('name' in node.property)) {
                     return;
                 }
                 const propName = node.property.name;

package/plugins/security/utils/shared.js

@@ -1,5 +1,12 @@
 import { AST_NODE_TYPES, ESLintUtils } from '@typescript-eslint/utils';
 import {} from 'typescript';
+/**
+ * Is the node of type string.
+ * - String literals.
+ * - constants of type string.
+ * - template literals.
+ * - intrinsic type string.
+ */
 export function isStringLike(node, context) {
     const type = getType(node, context);
     const literal = type.isStringLiteral();
@@ -9,9 +16,9 @@ export function isStringLike(node, context) {
 /**
  * Get the TypeScript type of node.
  */
-export function getType(arg, context) {
+export function getType(expression, context) {
     const { getTypeAtLocation } = ESLintUtils.getParserServices(context);
-    const type = getTypeAtLocation(arg);
+    const type = getTypeAtLocation(expression);
     return type.getNonNullableType();
 }
 /**
@@ -22,10 +29,13 @@ export function getType(arg, context) {
  *
  * @link https://typescript-eslint.io/developers/custom-rules/#typed-rules
  */
-export function isDomElementType(arg, context) {
-    const element = getType(arg, context);
-    const name = element.getSymbol()?.escapedName ?? '';
+export function isDomElementType(expression, context) {
+    const type = getType(expression, context);
+    const name = type.getSymbol()?.escapedName ?? '';
     // Match any type that ends with "Element", e.g., HTMLElement, HTMLDivElement, Element, etc.
+    if ('Element' === name) {
+        return true;
+    }
     return name.startsWith('HTML') && name.endsWith('Element');
 }
 /**
@@ -45,3 +55,24 @@ export function isSanitized(node) {
     }
     return false;
 }
+/**
+ * Check if a node is a literal string
+ */
+export function isLiteralString(node) {
+    return AST_NODE_TYPES.Literal === node.type && 'string' === typeof node.value;
+}
+/**
+ * Check if a node is a literal string that is safe to use in an HTML context.
+ * - Must be a literal string.
+ * - Must not contain `<script`.
+ * - Must not start with a dangerous protocol (javascript:, data:, vbscript:, about:, livescript:).
+ */
+export function isSafeLiteralString(node) {
+    if (!isLiteralString(node)) {
+        return false;
+    }
+    if (node.value.includes('<script')) {
+        return false;
+    }
+    return !/^\s*(?:javascript|data|vbscript|about|livescript)\s*:/i.test(decodeURIComponent(node.value.replace(/[\u0000-\u001F\u007F]+/g, '')));
+}

package/types/plugins/security/rules/html-string-concat.d.ts

@@ -1,3 +1,9 @@
-import { type TSESLint } from '@typescript-eslint/utils';
+import { type TSESLint, type TSESTree } from '@typescript-eslint/utils';
+/**
+ * Check if an expression contains any HTML-like strings.
+ * - Looks for `<` or `>` characters in string literals and template literals.
+ * - Recursively checks binary expressions with the ` + ` operator.
+ */
+export declare function hasHtmlLikeStrings(node: TSESTree.Expression | TSESTree.PrivateIdentifier): boolean;
 declare const plugin: TSESLint.RuleModule<'htmlStringConcat'>;
 export default plugin;

package/types/plugins/security/utils/shared.d.ts

@@ -1,10 +1,17 @@
 import { type TSESLint, type TSESTree } from '@typescript-eslint/utils';
 import { type Type } from 'typescript';
+/**
+ * Is the node of type string.
+ * - String literals.
+ * - constants of type string.
+ * - template literals.
+ * - intrinsic type string.
+ */
 export declare function isStringLike(node: TSESTree.CallExpressionArgument, context: Readonly<TSESLint.RuleContext<string, readonly []>>): boolean;
 /**
  * Get the TypeScript type of node.
  */
-export declare function getType<Context extends Readonly<TSESLint.RuleContext<string, readonly []>>>(arg: TSESTree.CallExpressionArgument, context: Context): Type;
+export declare function getType<Context extends Readonly<TSESLint.RuleContext<string, readonly []>>>(expression: TSESTree.CallExpressionArgument, context: Context): Type;
 /**
  * Is the type of variable being passed a DOM element?
  *
@@ -13,9 +20,20 @@ export declare function getType<Context extends Readonly<TSESLint.RuleContext<st
  *
  * @link https://typescript-eslint.io/developers/custom-rules/#typed-rules
  */
-export declare function isDomElementType<Context extends Readonly<TSESLint.RuleContext<string, readonly []>>>(arg: TSESTree.CallExpressionArgument, context: Context): boolean;
+export declare function isDomElementType<Context extends Readonly<TSESLint.RuleContext<string, readonly []>>>(expression: TSESTree.CallExpressionArgument, context: Context): boolean;
 /**
  * Check if a node is a call to a known sanitization function.
  * - Currently recognizes `sanitize(...)` and `DOMPurify.sanitize(...)`.
  */
 export declare function isSanitized(node: TSESTree.Property['value'] | TSESTree.CallExpressionArgument): boolean;
+/**
+ * Check if a node is a literal string
+ */
+export declare function isLiteralString(node: TSESTree.Property['value'] | TSESTree.CallExpressionArgument): node is TSESTree.StringLiteral;
+/**
+ * Check if a node is a literal string that is safe to use in an HTML context.
+ * - Must be a literal string.
+ * - Must not contain `<script`.
+ * - Must not start with a dangerous protocol (javascript:, data:, vbscript:, about:, livescript:).
+ */
+export declare function isSafeLiteralString(node: TSESTree.Property['value'] | TSESTree.CallExpressionArgument): boolean;