@rigour-labs/core 6.2.4 → 6.3.0

package/dist/semantic/learn/types.js

@@ -0,0 +1,55 @@
+/**
+ * Rules learned from a fix: a before/after pair turned into a check.
+ *
+ * A learned rule is data (`.rigour/rules/<id>.json`), reviewed in pull
+ * requests like code. It is kept only when it fires on the code before the
+ * fix, is silent on the fixed code, and fires on few other places in the
+ * repository; the validation that proved this is stored with it.
+ */
+import { z } from 'zod';
+/** How a call is recognised: by its name, the declaration it resolves to, or its exact text. */
+export const CalleeMatcherSchema = z.object({
+    level: z.enum(['name', 'declaration', 'text']),
+    key: z.string().min(1),
+});
+/** Narrows a rule to one function in one file: a regression guard for the fixed code. */
+export const ScopeSchema = z.object({
+    file: z.string().min(1),
+    fn: z.string().min(1),
+});
+export const RequireOptionSchema = z.object({
+    template: z.literal('require-option'),
+    callee: CalleeMatcherSchema,
+    argIndex: z.number().int().min(0),
+    property: z.string().min(1),
+    value: z.string().optional(),
+    scope: ScopeSchema.optional(),
+});
+export const RequireGuardSchema = z.object({
+    template: z.literal('require-guard'),
+    callee: CalleeMatcherSchema,
+    property: z.string().min(1),
+    guard: z.string().min(1),
+    /** Apply only where the call's other arguments mention `guard` (e.g. the body carries it). */
+    appliesWhenArgsMention: z.boolean(),
+    scope: ScopeSchema.optional(),
+});
+export const LearnedPatternSchema = z.discriminatedUnion('template', [RequireOptionSchema, RequireGuardSchema]);
+export const LearnedRuleSchema = z.object({
+    id: z.string().regex(/^[a-z0-9][a-z0-9-]*$/),
+    version: z.literal(1),
+    pattern: LearnedPatternSchema,
+    message: z.string(),
+    severity: z.enum(['low', 'medium', 'high']),
+    source: z.object({
+        commit: z.string().optional(),
+        file: z.string(),
+        function: z.string(),
+    }),
+    validation: z.object({
+        firesBefore: z.number().int(),
+        firesAfter: z.number().int(),
+        maxHits: z.number().int(),
+        repoHits: z.array(z.string()),
+    }),
+});

package/dist/semantic/origins.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Where can an expression's value come from?
+ *
+ * Traces identifiers back through declarations (const/let initializers and
+ * reassignments), destructuring (including an element of `Promise.all([...])`),
+ * conditionals and `??`/`||`, using checker symbols rather than names. The
+ * result is a set of origins: a call, a parameter, an object literal, another
+ * literal, or unknown. Unknown origins are kept so rules can stay silent.
+ */
+import ts from 'typescript';
+import { type FunctionLike } from './ast.js';
+export type Origin = {
+    kind: 'call';
+    node: ts.CallExpression;
+} | {
+    kind: 'param';
+    fn: FunctionLike;
+    index: number;
+    node: ts.ParameterDeclaration;
+} | {
+    kind: 'object';
+    node: ts.ObjectLiteralExpression;
+} | {
+    kind: 'literal';
+    node: ts.Expression;
+} | {
+    kind: 'unknown';
+    node: ts.Node;
+};
+export declare function originsOf(checker: ts.TypeChecker, expr: ts.Expression, depth?: number, seen?: Set<ts.Node>): Origin[];
+/** Elements of `Promise.all([...])` / `Promise.allSettled([...])`, else undefined. */
+export declare function promiseAllItems(expr: ts.Expression): ts.NodeArray<ts.Expression> | undefined;
+export interface PropertyValues {
+    /** Direct values for the property. */
+    values: ts.Expression[];
+    /** Spreads whose object could not be resolved; the property may come from them. */
+    unresolvedSpreads: ts.Expression[];
+    /** Spread expressions that were resolved, in source order. */
+    spreads: ts.Expression[];
+}
+/** Values an object literal gives to `key`, following `...spread` of other object literals. */
+export declare function propertyValues(checker: ts.TypeChecker, obj: ts.ObjectLiteralExpression, key: string, depth?: number): PropertyValues;

package/dist/semantic/origins.js

@@ -0,0 +1,149 @@
+/**
+ * Where can an expression's value come from?
+ *
+ * Traces identifiers back through declarations (const/let initializers and
+ * reassignments), destructuring (including an element of `Promise.all([...])`),
+ * conditionals and `??`/`||`, using checker symbols rather than names. The
+ * result is a set of origins: a call, a parameter, an object literal, another
+ * literal, or unknown. Unknown origins are kept so rules can stay silent.
+ */
+import ts from 'typescript';
+import { enclosingFunction, forEachOwnNode, isFunctionLike, propertyNameText, symbolOf, unwrap } from './ast.js';
+const MAX_DEPTH = 8;
+export function originsOf(checker, expr, depth = 0, seen = new Set()) {
+    const node = unwrap(expr);
+    if (depth > MAX_DEPTH || seen.has(node))
+        return [{ kind: 'unknown', node }];
+    seen.add(node);
+    if (ts.isCallExpression(node))
+        return [{ kind: 'call', node }];
+    if (ts.isObjectLiteralExpression(node))
+        return [{ kind: 'object', node }];
+    if (ts.isConditionalExpression(node)) {
+        return [...originsOf(checker, node.whenTrue, depth + 1, seen), ...originsOf(checker, node.whenFalse, depth + 1, seen)];
+    }
+    if (ts.isBinaryExpression(node) && isFallbackOperator(node.operatorToken.kind)) {
+        return [...originsOf(checker, node.left, depth + 1, seen), ...originsOf(checker, node.right, depth + 1, seen)];
+    }
+    if (isPlainLiteral(node))
+        return [{ kind: 'literal', node }];
+    if (ts.isIdentifier(node))
+        return identifierOrigins(checker, node, depth, seen);
+    return [{ kind: 'unknown', node }];
+}
+function isFallbackOperator(kind) {
+    return kind === ts.SyntaxKind.QuestionQuestionToken || kind === ts.SyntaxKind.BarBarToken;
+}
+function isPlainLiteral(node) {
+    return ts.isStringLiteralLike(node) || ts.isNumericLiteral(node) || ts.isArrayLiteralExpression(node)
+        || node.kind === ts.SyntaxKind.NullKeyword || node.kind === ts.SyntaxKind.TrueKeyword
+        || node.kind === ts.SyntaxKind.FalseKeyword || ts.isTemplateExpression(node)
+        || (ts.isIdentifier(node) && node.text === 'undefined');
+}
+function identifierOrigins(checker, id, depth, seen) {
+    const decl = symbolOf(checker, id)?.valueDeclaration;
+    if (!decl)
+        return [{ kind: 'unknown', node: id }];
+    if (ts.isParameter(decl) && isFunctionLike(decl.parent)) {
+        const param = { kind: 'param', fn: decl.parent, index: decl.parent.parameters.indexOf(decl), node: decl };
+        return decl.initializer ? [param, ...originsOf(checker, decl.initializer, depth + 1, seen)] : [param];
+    }
+    if (ts.isVariableDeclaration(decl)) {
+        const fromInit = decl.initializer ? originsOf(checker, decl.initializer, depth + 1, seen) : [];
+        return [...fromInit, ...reassignmentOrigins(checker, decl, depth, seen)];
+    }
+    if (ts.isBindingElement(decl))
+        return bindingOrigins(checker, decl, depth, seen);
+    return [{ kind: 'unknown', node: decl }];
+}
+/** `let x = a; ... x = b;` inside the same function: both values are origins. */
+function reassignmentOrigins(checker, decl, depth, seen) {
+    const list = decl.parent;
+    if (!ts.isVariableDeclarationList(list) || (list.flags & ts.NodeFlags.Const) || !ts.isIdentifier(decl.name))
+        return [];
+    const target = checker.getSymbolAtLocation(decl.name);
+    const scope = enclosingFunction(decl) ?? decl.getSourceFile();
+    const found = [];
+    forEachOwnNode(scope, (node) => {
+        if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.EqualsToken
+            && ts.isIdentifier(node.left) && checker.getSymbolAtLocation(node.left) === target) {
+            found.push(...originsOf(checker, node.right, depth + 1, seen));
+        }
+    });
+    return found;
+}
+/**
+ * `const [a, b] = await Promise.all([f(), g()])` → b comes from g().
+ * `const { x } = obj` → x comes from obj.x when obj is an object literal.
+ */
+function bindingOrigins(checker, element, depth, seen) {
+    const pattern = element.parent;
+    const holder = pattern.parent;
+    if (!ts.isVariableDeclaration(holder) || !holder.initializer)
+        return [{ kind: 'unknown', node: element }];
+    const init = unwrap(holder.initializer);
+    if (ts.isArrayBindingPattern(pattern)) {
+        const index = pattern.elements.indexOf(element);
+        const items = promiseAllItems(init) ?? (ts.isArrayLiteralExpression(init) ? init.elements : undefined);
+        const item = items?.[index];
+        return item && !ts.isSpreadElement(item) ? originsOf(checker, item, depth + 1, seen) : [{ kind: 'unknown', node: element }];
+    }
+    const key = propertyNameText(element.propertyName) ?? (ts.isIdentifier(element.name) ? element.name.text : undefined);
+    if (!key)
+        return [{ kind: 'unknown', node: element }];
+    const values = [];
+    for (const origin of originsOf(checker, init, depth + 1, seen)) {
+        if (origin.kind !== 'object') {
+            values.push(origin);
+            continue;
+        }
+        for (const value of propertyValues(checker, origin.node, key).values) {
+            values.push(...originsOf(checker, value, depth + 1, seen));
+        }
+    }
+    return values;
+}
+/** Elements of `Promise.all([...])` / `Promise.allSettled([...])`, else undefined. */
+export function promiseAllItems(expr) {
+    const node = unwrap(expr);
+    if (!ts.isCallExpression(node) || !ts.isPropertyAccessExpression(node.expression))
+        return undefined;
+    const target = node.expression;
+    if (!ts.isIdentifier(target.expression) || target.expression.text !== 'Promise')
+        return undefined;
+    if (target.name.text !== 'all' && target.name.text !== 'allSettled')
+        return undefined;
+    const [arg] = node.arguments;
+    return arg && ts.isArrayLiteralExpression(arg) ? arg.elements : undefined;
+}
+/** Values an object literal gives to `key`, following `...spread` of other object literals. */
+export function propertyValues(checker, obj, key, depth = 0) {
+    const result = { values: [], unresolvedSpreads: [], spreads: [] };
+    const matches = (name) => name !== undefined && name.toLowerCase() === key.toLowerCase();
+    for (const prop of obj.properties) {
+        if (ts.isPropertyAssignment(prop) && matches(propertyNameText(prop.name)))
+            result.values.push(prop.initializer);
+        else if (ts.isShorthandPropertyAssignment(prop) && matches(prop.name.text))
+            result.values.push(prop.name);
+        else if (ts.isSpreadAssignment(prop))
+            collectSpread(checker, prop.expression, key, depth, result);
+    }
+    return result;
+}
+function collectSpread(checker, spread, key, depth, into) {
+    into.spreads.push(spread);
+    if (depth > MAX_DEPTH) {
+        into.unresolvedSpreads.push(spread);
+        return;
+    }
+    for (const origin of originsOf(checker, spread)) {
+        if (origin.kind === 'object') {
+            const nested = propertyValues(checker, origin.node, key, depth + 1);
+            into.values.push(...nested.values);
+            into.unresolvedSpreads.push(...nested.unresolvedSpreads);
+        }
+        else if (origin.kind !== 'literal') {
+            into.unresolvedSpreads.push(spread);
+        }
+    }
+}

package/dist/semantic/origins.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/semantic/origins.test.js

@@ -0,0 +1,77 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import ts from 'typescript';
+import { afterEach, describe, expect, it } from 'vitest';
+import { forEachNode, symbolOf } from './ast.js';
+import { originsOf } from './origins.js';
+import { programBatches } from './program.js';
+let dir;
+afterEach(() => { if (dir)
+    fs.rmSync(dir, { recursive: true, force: true }); dir = undefined; });
+/** Program over `files`; returns the checker and a finder for `probe(<expr>)` arguments in main.ts. */
+function setup(files) {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), 'origins-'));
+    for (const [name, body] of Object.entries(files))
+        fs.writeFileSync(path.join(dir, name), body);
+    const [program] = [...programBatches([path.join(dir, 'main.ts')], { strict: true, noEmit: true })];
+    const checker = program.getTypeChecker();
+    const main = program.getSourceFile(path.join(dir, 'main.ts'));
+    const probe = () => {
+        let found;
+        forEachNode(main, (n) => {
+            if (ts.isCallExpression(n) && ts.isIdentifier(n.expression) && n.expression.text === 'probe')
+                found = n.arguments[0];
+        });
+        return found;
+    };
+    const kinds = () => originsOf(checker, probe()).map(o => o.kind === 'call' ? `call:${o.node.expression.getText()}` : o.kind === 'param' ? `param:${o.index}` : o.kind);
+    return { kinds };
+}
+const PRELUDE = 'declare function probe(v: unknown): void;\ndeclare function a(): number;\ndeclare function b(): number;\n';
+describe('originsOf', () => {
+    it('follows const initializers and let reassignments', () => {
+        const { kinds } = setup({ 'main.ts': `${PRELUDE}let x = a();\nif (Math.random()) x = b();\nconst y = x;\nprobe(y);\n` });
+        expect(kinds().sort()).toEqual(['call:a', 'call:b']);
+    });
+    it('maps an element of Promise.all([...]) to the matching call', async () => {
+        const { kinds } = setup({ 'main.ts': `${PRELUDE}async function f() {\n  const [first, second] = await Promise.all([a(), b()]);\n  probe(second);\n  return first;\n}\n` });
+        expect(kinds()).toEqual(['call:b']);
+    });
+    it('reads a destructured property from an object literal', () => {
+        const { kinds } = setup({ 'main.ts': `${PRELUDE}const obj = { left: a(), right: b() };\nconst { right } = obj;\nprobe(right);\n` });
+        expect(kinds()).toEqual(['call:b']);
+    });
+    it('keeps both sides of ?? and of a conditional', () => {
+        const { kinds } = setup({ 'main.ts': `${PRELUDE}const v = Math.random() > 0.5 ? a() : (b() ?? a());\nprobe(v);\n` });
+        expect(kinds().sort()).toEqual(['call:a', 'call:a', 'call:b']);
+    });
+    it('reports a parameter with its index', () => {
+        const { kinds } = setup({ 'main.ts': `${PRELUDE}function f(first: number, second: number) {\n  probe(second);\n  return first;\n}\n` });
+        expect(kinds()).toEqual(['param:1']);
+    });
+    it('follows imports across files to the declaration', () => {
+        const { kinds } = setup({
+            'lib.ts': 'export const shared = Math.max(1, 2);\n',
+            'main.ts': `${PRELUDE}import { shared } from './lib';\nprobe(shared);\n`,
+        });
+        expect(kinds()).toEqual(['call:Math.max']);
+    });
+    it('stays unknown for an import that does not resolve', () => {
+        const { kinds } = setup({ 'main.ts': `${PRELUDE}import { missing } from './nowhere';\nprobe(missing);\n` });
+        expect(kinds()).toEqual(['unknown']);
+    });
+});
+describe('symbolOf', () => {
+    it('resolves the name in a shorthand property to the variable it reads', () => {
+        dir = fs.mkdtempSync(path.join(os.tmpdir(), 'origins-'));
+        fs.writeFileSync(path.join(dir, 'main.ts'), "const headers = { 'x-token': 't' };\nexport const init = { headers };\n");
+        const [program] = [...programBatches([path.join(dir, 'main.ts')], { strict: true, noEmit: true })];
+        const main = program.getSourceFile(path.join(dir, 'main.ts'));
+        let shorthand;
+        forEachNode(main, (n) => { if (ts.isShorthandPropertyAssignment(n))
+            shorthand = n; });
+        const decl = symbolOf(program.getTypeChecker(), shorthand.name)?.valueDeclaration;
+        expect(decl && ts.isVariableDeclaration(decl) && decl.name.getText()).toBe('headers');
+    });
+});

package/dist/semantic/program.d.ts

@@ -0,0 +1,13 @@
+import ts from 'typescript';
+export declare const DEFAULT_BATCH_SIZE = 200;
+export interface ProjectConfig {
+    options: ts.CompilerOptions;
+    /** Every source file the tsconfig includes; empty without a tsconfig. */
+    fileNames: string[];
+}
+export declare function loadProjectConfig(cwd: string): ProjectConfig;
+/**
+ * Programs over `rootFiles` in batches. Each batch reuses the previous
+ * program's unchanged source files, and only one program is alive at a time.
+ */
+export declare function programBatches(rootFiles: string[], options: ts.CompilerOptions, batchSize?: number): Generator<ts.Program>;

package/dist/semantic/program.js

@@ -0,0 +1,62 @@
+/**
+ * TypeScript programs for semantic analysis.
+ *
+ * Compiler options come from the nearest tsconfig through the compiler's own
+ * parser, so `extends` and `paths` behave as they do for tsc. Measured on a
+ * 2,400-file Next.js repo: a program for a few scoped files builds in ~0.5s;
+ * a full scan, in batches and with external packages left unresolved, runs in
+ * ~14s at ~1.3GB RSS (it was ~29s and ~2.8GB with package types loaded).
+ */
+import path from 'path';
+import ts from 'typescript';
+export const DEFAULT_BATCH_SIZE = 200;
+export function loadProjectConfig(cwd) {
+    const configPath = ts.findConfigFile(cwd, ts.sys.fileExists, 'tsconfig.json');
+    const base = { allowJs: true, checkJs: false };
+    if (!configPath || !path.resolve(configPath).startsWith(path.resolve(cwd))) {
+        return { options: analysisOptions(base), fileNames: [] };
+    }
+    const read = ts.readConfigFile(configPath, ts.sys.readFile);
+    if (read.error)
+        return { options: analysisOptions(base), fileNames: [] };
+    const parsed = ts.parseJsonConfigFileContent(read.config, ts.sys, path.dirname(configPath));
+    return { options: analysisOptions({ ...base, ...parsed.options }), fileNames: parsed.fileNames };
+}
+/** Options for analysis only: nothing is emitted and lib files are not checked. */
+function analysisOptions(options) {
+    return { ...options, noEmit: true, skipLibCheck: true, types: [], incremental: false, composite: false };
+}
+/**
+ * A compiler host that resolves project modules but not external packages.
+ * The rules need project functions (relative and `paths` imports) and the
+ * built-in lib globals (`fetch`, `Promise`, `Response`), not the .d.ts graph
+ * behind next, react or a database client. Without this, one batch of a
+ * 2,400-file repo pulls in that whole graph (~2.7GB RSS whatever the batch
+ * size); with it, memory follows the project's own code.
+ */
+function projectOnlyHost(options) {
+    const host = ts.createCompilerHost(options);
+    host.resolveModuleNameLiterals = (literals, containingFile, _redirect, opts) => literals.map(literal => {
+        const resolved = ts.resolveModuleName(literal.text, containingFile, opts, host).resolvedModule;
+        return { resolvedModule: resolved && !resolved.isExternalLibraryImport ? resolved : undefined };
+    });
+    return host;
+}
+/**
+ * Programs over `rootFiles` in batches. Each batch reuses the previous
+ * program's unchanged source files, and only one program is alive at a time.
+ */
+export function* programBatches(rootFiles, options, batchSize = DEFAULT_BATCH_SIZE) {
+    const host = projectOnlyHost(options);
+    let previous;
+    for (let i = 0; i < rootFiles.length; i += batchSize) {
+        const program = ts.createProgram({
+            rootNames: rootFiles.slice(i, i + batchSize),
+            options,
+            host,
+            oldProgram: previous,
+        });
+        previous = program;
+        yield program;
+    }
+}

package/dist/semantic/rules/credential-redirect.d.ts

@@ -0,0 +1,2 @@
+import type { SemanticRule } from '../types.js';
+export declare const credentialRedirect: SemanticRule;

package/dist/semantic/rules/credential-redirect.js

@@ -0,0 +1,209 @@
+/**
+ * credential-redirect: a custom credential header is sent with a fetch that
+ * may follow redirects.
+ *
+ * On a cross-origin redirect fetch drops `Authorization` (WHATWG fetch, as
+ * implemented by undici) but keeps every custom header, so a token sent as
+ * `x-webhook-token` goes to whatever host the target redirects to. The rule
+ * follows the header from the call that sets it, through any wrapper that
+ * forwards its `init` argument, to the fetch call. A fetch whose init sets
+ * `redirect` is treated as handled.
+ */
+import ts from 'typescript';
+import { calledFunction, calleeName, forEachNode, lineOf, locationOf, propertyNameText, relativeFile, snippet, unwrap } from '../ast.js';
+import { originsOf, propertyValues } from '../origins.js';
+const CREDENTIAL_HEADER = /^(?:x-[\w-]*(?:token|secret|key|signature|password|auth[\w-]*)|[\w-]*(?:api[-_]?key|secret|access[-_]?token|private[-_]?token))$/i;
+/** Removed by fetch (or not settable) on a cross-origin redirect. */
+const STRIPPED_ON_REDIRECT = /^(?:authorization|proxy-authorization|cookie)$/i;
+const SECRET_ENV = /SECRET|TOKEN|API_?KEY|PASSWORD|PRIVATE_KEY/i;
+export const credentialRedirect = {
+    id: 'credential-redirect',
+    check(ctx) {
+        const findings = [];
+        forEachNode(ctx.sourceFile, (node) => {
+            if (!ts.isCallExpression(node))
+                return;
+            const finding = isFetchCall(node) ? checkDirect(ctx, node) : checkWrapperCall(ctx, node);
+            if (finding)
+                findings.push(finding);
+        });
+        return findings;
+    },
+};
+function isFetchCall(call) {
+    return calleeName(call) === 'fetch' && call.arguments.length >= 2;
+}
+function checkDirect(ctx, call) {
+    const init = call.arguments[1];
+    if (setsRedirect(ctx.checker, init))
+        return null;
+    const credential = credentialIn(ctx.checker, init);
+    return credential ? finding(ctx, call, credential, call, call.arguments[0]) : null;
+}
+function checkWrapperCall(ctx, call) {
+    const fn = calledFunction(ctx.checker, call);
+    if (!fn)
+        return null;
+    for (const [index, sink] of initParams(ctx.summaries, fn)) {
+        const arg = call.arguments[index];
+        if (!arg || setsRedirect(ctx.checker, arg))
+            continue;
+        const credential = credentialIn(ctx.checker, arg);
+        const url = sink.urlParam === undefined ? undefined : call.arguments[sink.urlParam];
+        if (credential)
+            return finding(ctx, call, credential, sink.fetchCall, url);
+    }
+    return null;
+}
+/** Parameters of `fn` that reach a fetch init with no redirect guard. */
+function initParams(summaries, fn) {
+    return summaries.memo('credential-redirect:init-params', fn, new Map(), () => {
+        const params = new Map();
+        forEachNode(fn, (node) => {
+            if (!ts.isCallExpression(node))
+                return;
+            if (isFetchCall(node)) {
+                const urlParam = directParam(summaries.checker, node.arguments[0], fn);
+                for (const index of paramsFlowingInto(summaries.checker, node.arguments[1], fn))
+                    params.set(index, { fetchCall: node, urlParam });
+                return;
+            }
+            const inner = calledFunction(summaries.checker, node);
+            if (!inner || inner === fn)
+                return;
+            for (const [innerIndex, sink] of initParams(summaries, inner)) {
+                const arg = node.arguments[innerIndex];
+                if (!arg)
+                    continue;
+                const innerUrl = sink.urlParam === undefined ? undefined : node.arguments[sink.urlParam];
+                const urlParam = innerUrl ? directParam(summaries.checker, innerUrl, fn) : undefined;
+                for (const index of paramsFlowingInto(summaries.checker, arg, fn))
+                    params.set(index, { fetchCall: sink.fetchCall, urlParam });
+            }
+        });
+        return params;
+    });
+}
+/** The index of `fn`'s parameter that `expr` is, if it is one. */
+function directParam(checker, expr, fn) {
+    if (!expr)
+        return undefined;
+    const origin = originsOf(checker, expr).find(o => o.kind === 'param' && o.fn === fn);
+    return origin?.kind === 'param' ? origin.index : undefined;
+}
+/** `https://host/...` written as a literal (or a template whose host is literal): a fixed endpoint. */
+function fixedHttpsHost(checker, url) {
+    if (!url)
+        return undefined;
+    const origins = originsOf(checker, url);
+    if (origins.length !== 1 || origins[0].kind !== 'literal')
+        return undefined;
+    const node = origins[0].node;
+    const text = ts.isStringLiteralLike(node) ? node.text : ts.isTemplateExpression(node) ? templatePrefix(checker, node) : '';
+    return text.match(/^https:\/\/([^/${}\s]+)(?:\/|$)/)?.[1];
+}
+/** Literal start of a template, resolving a leading constant: `${BASE_URL}/task` → "https://host/task". */
+function templatePrefix(checker, node) {
+    if (node.head.text || node.templateSpans.length === 0)
+        return node.head.text;
+    const [first] = node.templateSpans;
+    const origins = originsOf(checker, first.expression);
+    const base = origins.length === 1 && origins[0].kind === 'literal' && ts.isStringLiteralLike(origins[0].node) ? origins[0].node.text : '';
+    return base ? base + first.literal.text : '';
+}
+/** Indices of `fn`'s parameters that `expr` passes through (directly or spread) without adding `redirect`. */
+function paramsFlowingInto(checker, expr, fn) {
+    const indices = [];
+    for (const origin of originsOf(checker, expr)) {
+        if (origin.kind === 'param' && origin.fn === fn)
+            indices.push(origin.index);
+        if (origin.kind !== 'object' || propertyValues(checker, origin.node, 'redirect').values.length > 0)
+            continue;
+        for (const spread of propertyValues(checker, origin.node, 'redirect').spreads) {
+            for (const inner of originsOf(checker, spread)) {
+                if (inner.kind === 'param' && inner.fn === fn)
+                    indices.push(inner.index);
+            }
+        }
+    }
+    return indices;
+}
+/** The init (or an object spread into it) sets `redirect` explicitly. */
+function setsRedirect(checker, init) {
+    return originsOf(checker, init).some(origin => origin.kind === 'object' && propertyValues(checker, origin.node, 'redirect').values.length > 0);
+}
+/** First custom credential header in an init's `headers`. */
+function credentialIn(checker, init) {
+    for (const origin of originsOf(checker, init)) {
+        if (origin.kind !== 'object')
+            continue;
+        for (const headers of propertyValues(checker, origin.node, 'headers').values) {
+            const found = credentialHeader(checker, headers);
+            if (found)
+                return found;
+        }
+    }
+    return null;
+}
+function credentialHeader(checker, headers) {
+    for (const origin of originsOf(checker, headersObject(headers))) {
+        if (origin.kind !== 'object')
+            continue;
+        for (const prop of origin.node.properties) {
+            if (!ts.isPropertyAssignment(prop))
+                continue;
+            const header = propertyNameText(prop.name);
+            if (!header || STRIPPED_ON_REDIRECT.test(header))
+                continue;
+            if (CREDENTIAL_HEADER.test(header) || readsSecretEnv(prop.initializer))
+                return { header, node: prop };
+        }
+    }
+    return null;
+}
+/** `new Headers({...})` → the object literal inside. */
+function headersObject(expr) {
+    const node = unwrap(expr);
+    if (ts.isNewExpression(node) && ts.isIdentifier(node.expression) && node.expression.text === 'Headers' && node.arguments?.[0]) {
+        return node.arguments[0];
+    }
+    return node;
+}
+/** `process.env.WEBHOOK_SECRET` (possibly inside a template or `??`). */
+function readsSecretEnv(value) {
+    let found = false;
+    const walk = (node) => {
+        if (found)
+            return;
+        if (ts.isPropertyAccessExpression(node) && ts.isPropertyAccessExpression(node.expression)
+            && node.expression.name.text === 'env' && ts.isIdentifier(node.expression.expression)
+            && node.expression.expression.text === 'process' && SECRET_ENV.test(node.name.text)) {
+            found = true;
+        }
+        else {
+            ts.forEachChild(node, walk);
+        }
+    };
+    walk(value);
+    return found;
+}
+function finding(ctx, call, credential, fetchCall, url) {
+    const fixedHost = fixedHttpsHost(ctx.checker, url);
+    const via = fetchCall === call
+        ? `\`${snippet(call, 50)}\``
+        : `\`${calleeName(call) ?? 'the call'}(...)\`, which forwards it to \`${snippet(fetchCall, 40)}\` (${locationOf(ctx.cwd, fetchCall)})`;
+    return {
+        rule: 'credential-redirect',
+        // A fixed https vendor endpoint only leaks if that vendor redirects across hosts;
+        // a configurable or computed target is the risk this rule exists for.
+        severity: fixedHost ? 'low' : 'high',
+        provenance: 'security',
+        file: relativeFile(ctx.cwd, ctx.sourceFile),
+        line: lineOf(call),
+        message: `The \`${credential.header}\` header is sent through ${via} without \`redirect: "manual"\`. `
+            + `fetch drops Authorization on a cross-origin redirect but keeps custom headers, so this credential goes to any host the target redirects to.`
+            + (fixedHost ? ` The target is the fixed endpoint ${fixedHost}, so this only matters if that host redirects.` : ''),
+        hint: 'Set `redirect: "manual"` (or "error") on the request and treat a 3xx as a failure, or send the credential in the Authorization header.',
+        evidence: [locationOf(ctx.cwd, credential.node), `${locationOf(ctx.cwd, fetchCall)} ${snippet(fetchCall, 50)}`],
+    };
+}

package/dist/semantic/rules/degraded-response-cached.d.ts

@@ -0,0 +1,2 @@
+import type { SemanticRule } from '../types.js';
+export declare const degradedResponseCached: SemanticRule;