@mslmio/eslint-config 2.3.0 → 2.4.0

package/README.md

@@ -26,7 +26,7 @@ UI half behind `/ui` means the root entry resolves neither `@shadcn/lint` nor
 
 | Preset | For | Adds |
 |---|---|---|
-| `house` | anything TS/JS | `no-property-shorthand`, `curly: all`, `us-spelling`, `no-express-json-spaces` |
+| `house` | anything TS/JS | `no-property-shorthand`, `curly: all`, `us-spelling`, `no-express-json-spaces`, `no-invisible-characters` |
 | `lib` | a published library | house + `no-lib-process-env`, `no-module-scope-init` |
 | `ui` | anything rendering Tailwind | house + `require-leading-with-text-size`, `prefer-copy-icon`, `prefer-table-facets` |
 | `uiLib` | a published UI library | `lib` + `ui` |
@@ -44,6 +44,7 @@ UI half behind `/ui` means the root entry resolves neither `@shadcn/lint` nor
 | `us-spelling` | US spelling in prose and identifiers |
 | `require-leading-with-text-size` | An arbitrary Tailwind text size must state its own line height |
 | `prefer-table-facets` | A `kind: "select"` filter lists the values its rows hold (facets), never a literal `options` list |
+| `no-invisible-characters` | No bidi control character anywhere, strings and comments included (Trojan Source), and no zero-width space, joiner or direction mark outside text: write one as an escape |
 
 `us-spelling` skips regex literals — a pattern matching scraped text has to accept both
 spellings — and takes `allow` for proper names that keep their own:

package/index.js

@@ -45,6 +45,7 @@ export const house = [
             "mslmio/us-spelling": "error",
             "mslmio/no-express-json-spaces": "error",
             "mslmio/no-upward-import": "error",
+            "mslmio/no-invisible-characters": "error",
         },
     },
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mslmio/eslint-config",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "description": "Shareable ESLint flat config and house rules: US spelling, library hygiene, workspace layering, and Tailwind/React conventions.",
   "keywords": [
     "eslint",

package/plugin.js

@@ -7,9 +7,10 @@ import requireLeadingWithTextSize from "./rules/require-leading-with-text-size.j
 import noPropertyShorthand from "./rules/no-property-shorthand.js";
 import noUpwardImport from "./rules/no-upward-import.js";
 import preferTableFacets from "./rules/prefer-table-facets.js";
+import noInvisibleCharacters from "./rules/no-invisible-characters.js";
 
 export default {
-    meta: { name: "@mslmio/eslint-plugin", version: "2.3.0" },
+    meta: { name: "@mslmio/eslint-plugin", version: "2.4.0" },
     rules: {
         "no-lib-process-env": noLibProcessEnv,
         "no-module-scope-init": noModuleScopeInit,
@@ -20,5 +21,6 @@ export default {
         "no-property-shorthand": noPropertyShorthand,
         "no-upward-import": noUpwardImport,
         "prefer-table-facets": preferTableFacets,
+        "no-invisible-characters": noInvisibleCharacters,
     },
 };

package/rules/no-invisible-characters.js

@@ -0,0 +1,95 @@
+// Characters that print as nothing, so source reads differently from how it runs.
+//
+// The explicit bidi controls reorder what a reader sees (Trojan Source, CVE-2021-42574),
+// inside a string or a comment as much as in code, so they are refused everywhere; so is a
+// U+FEFF past the start of a file. The zero-width space, joiners and marks are text: a joiner
+// sits in a Persian word or an emoji sequence, a mark in Arabic. In code they are the same
+// name spelled two ways, so only there are they refused.
+const ANYWHERE = new Map([
+    [0x202a, "LEFT-TO-RIGHT EMBEDDING"],
+    [0x202b, "RIGHT-TO-LEFT EMBEDDING"],
+    [0x202c, "POP DIRECTIONAL FORMATTING"],
+    [0x202d, "LEFT-TO-RIGHT OVERRIDE"],
+    [0x202e, "RIGHT-TO-LEFT OVERRIDE"],
+    [0x2066, "LEFT-TO-RIGHT ISOLATE"],
+    [0x2067, "RIGHT-TO-LEFT ISOLATE"],
+    [0x2068, "FIRST STRONG ISOLATE"],
+    [0x2069, "POP DIRECTIONAL ISOLATE"],
+    [0xfeff, "ZERO WIDTH NO-BREAK SPACE"],
+]);
+
+const IN_CODE = new Map([
+    [0x200b, "ZERO WIDTH SPACE"],
+    [0x200c, "ZERO WIDTH NON-JOINER"],
+    [0x200d, "ZERO WIDTH JOINER"],
+    [0x200e, "LEFT-TO-RIGHT MARK"],
+    [0x200f, "RIGHT-TO-LEFT MARK"],
+]);
+
+const PATTERN = /[\u{200B}-\u{200F}\u{202A}-\u{202E}\u{2066}-\u{2069}\u{FEFF}]/gu;
+
+// What a reader takes as text rather than code: where a joiner or a mark belongs.
+const TEXT_TOKENS = new Set(["String", "Template", "RegularExpression", "JSXText"]);
+
+export default {
+    meta: {
+        type: "problem",
+        docs: {
+            description: "No invisible bidi or zero-width characters, which make source read differently from how it runs",
+        },
+        schema: [
+            {
+                type: "object",
+                properties: { docsUrl: { type: "string" } },
+                additionalProperties: false,
+            },
+        ],
+        messages: {
+            invisible:
+                "{{codePoint}} ({{name}}) prints as nothing, so this line reads differently from how it " +
+                "runs. Write it as an escape in a string, or remove it.{{docs}}",
+        },
+    },
+    create(context) {
+        const docs = docsSuffix(context);
+        const sourceCode = context.sourceCode ?? context.getSourceCode();
+        return {
+            Program() {
+                let text = null;
+                for (const m of sourceCode.text.matchAll(PATTERN)) {
+                    const codePoint = m[0].codePointAt(0);
+                    let name = ANYWHERE.get(codePoint);
+                    if (name === undefined) {
+                        text ??= textRanges(sourceCode);
+                        if (text.some(([start, end]) => m.index >= start && m.index < end)) {
+                            continue;
+                        }
+                        name = IN_CODE.get(codePoint);
+                    }
+                    context.report({
+                        loc: {
+                            start: sourceCode.getLocFromIndex(m.index),
+                            end: sourceCode.getLocFromIndex(m.index + m[0].length),
+                        },
+                        messageId: "invisible",
+                        data: {
+                            codePoint: `U+${codePoint.toString(16).toUpperCase().padStart(4, "0")}`,
+                            name: name,
+                            docs: docs,
+                        },
+                    });
+                }
+            },
+        };
+    },
+};
+
+function textRanges(sourceCode) {
+    const tokens = (sourceCode.ast.tokens ?? []).filter((t) => TEXT_TOKENS.has(t.type));
+    return [...tokens, ...sourceCode.getAllComments()].map((t) => t.range);
+}
+
+function docsSuffix(context) {
+    const url = context.options[0]?.docsUrl;
+    return url ? ` See ${url}.` : "";
+}