@sarj/eslint-plugin 15.26.1 → 15.26.2

package/dist/index.cjs

@@ -4149,12 +4149,12 @@ function createSqlListener(handler) {
 
 // src/rules/no-dynamic-sql.ts
 var NO_DYNAMIC_SQL_DOCUMENTATION = {
-  summary: "Disallow runtime values embedded inside quoted SQL values passed to statement-execution methods.",
-  rationale: "Embedding runtime values in SQL bypasses driver parameterization and can introduce injection defects or unstable query plans.",
-  remediation: "Use SQL placeholders and pass runtime values through the driver's binding API.",
+  summary: "Disallow runtime values and fragments interpolated into SQL passed to statement-execution methods.",
+  rationale: "Embedding runtime values or fragments in SQL bypasses driver parameterization or an explicit allowlist and can introduce injection defects or unstable query plans.",
+  remediation: "Bind data values through SQL placeholders. Select non-bindable identifiers or clauses from fixed, reviewed fragments instead of interpolating runtime text.",
   category: "security",
   limitations: [
-    "Only single-quoted SQL values are inspected. Double-quoted identifiers, comments, dollar strings, and unquoted fragments are excluded; this is not a general SQL injection detector.",
+    "Template and concatenation fragments are inspected at recognized execution calls. Double-quoted identifiers, comments, and dollar strings are excluded; this is not a general SQL injection detector.",
     "Literal fragments, legacy uppercase fragment names, and parameterizing tagged templates are exempt; uppercase spelling does not prove a value is static.",
     "The bounded lexer recognizes doubled quotes, comments, and PostgreSQL dollar strings; dialect-specific escape modes and SQL generated through other APIs require separate security review."
   ],
@@ -4176,6 +4176,26 @@ var NO_DYNAMIC_SQL_DOCUMENTATION = {
       focusPath: "src/users.ts",
       expectedCount: 1,
       public: true
+    },
+    {
+      id: "bound-unquoted-value",
+      scenarioId: "unquoted",
+      title: "An unquoted runtime value is bound separately",
+      outcome: "no-match",
+      files: [{ path: "src/users.ts", source: "db.prepare('select id from users where id = ?').bind(userId);" }],
+      focusPath: "src/users.ts",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "unquoted-runtime-fragment",
+      scenarioId: "unquoted",
+      title: "A runtime fragment is interpolated into SQL",
+      outcome: "match",
+      files: [{ path: "src/users.ts", source: "db.prepare(`select id from users where id = ${userId}`);" }],
+      focusPath: "src/users.ts",
+      expectedCount: 1,
+      public: true
     }
   ]
 };
@@ -4198,14 +4218,21 @@ function isStaticFragment(expression) {
 }
 function runtimeInterpolations(template) {
   const parts = template.quasis.map((quasi) => quasi.value.cooked ?? quasi.value.raw);
-  const ranges = sqlSingleQuotedRanges(parts.join(RUNTIME_MARKER));
+  const statement = parts.join(RUNTIME_MARKER);
+  const ranges = sqlSingleQuotedRanges(statement);
+  const visible = stripSqlNoise(statement);
   let offset = 0;
-  return template.expressions.filter(
+  return template.expressions.flatMap(
     (expression, index) => {
       offset += parts[index]?.length ?? 0;
       const inValue = ranges.some(([start, end]) => start < offset && offset < end);
+      const unquoted = visible.slice(offset, offset + RUNTIME_MARKER.length) === RUNTIME_MARKER;
       offset += RUNTIME_MARKER.length;
-      return inValue && !isStaticFragment(expression) && endsWithSqlQuote(parts[index] ?? "") && startsWithSqlQuote(parts[index + 1] ?? "");
+      if (isStaticFragment(expression)) return [];
+      if (inValue && endsWithSqlQuote(parts[index] ?? "") && startsWithSqlQuote(parts[index + 1] ?? "")) {
+        return [{ expression, messageId: "dynamicSql" }];
+      }
+      return unquoted ? [{ expression, messageId: "dynamicFragment" }] : [];
     }
   );
 }
@@ -4236,16 +4263,21 @@ function runtimeConcatOperands(node) {
     return [];
   }
   const parts = operands.map((operand) => staticLiteralText(operand) ?? RUNTIME_MARKER);
-  const ranges = sqlSingleQuotedRanges(parts.join(""));
+  const statement = parts.join("");
+  const ranges = sqlSingleQuotedRanges(statement);
+  const visible = stripSqlNoise(statement);
   let offset = 0;
-  return operands.filter((operand, index) => {
+  return operands.flatMap((operand, index) => {
     const inValue = ranges.some(([start, end]) => start < offset && offset < end);
+    const unquoted = visible.slice(offset, offset + RUNTIME_MARKER.length) === RUNTIME_MARKER;
     offset += parts[index]?.length ?? 0;
-    if (!inValue) return false;
-    if (isStaticFragment(operand)) return false;
+    if (isStaticFragment(operand)) return [];
     const before = operands[index - 1];
     const after = operands[index + 1];
-    return before !== void 0 && after !== void 0 && endsWithSqlQuote(staticLiteralText(before) ?? "") && startsWithSqlQuote(staticLiteralText(after) ?? "");
+    if (inValue && before !== void 0 && after !== void 0 && endsWithSqlQuote(staticLiteralText(before) ?? "") && startsWithSqlQuote(staticLiteralText(after) ?? "")) {
+      return [{ expression: operand, messageId: "dynamicSql" }];
+    }
+    return unquoted ? [{ expression: operand, messageId: "dynamicFragment" }] : [];
   });
 }
 function concatOperands(node) {
@@ -4301,7 +4333,8 @@ var no_dynamic_sql_default = createRule({
       }
     ],
     messages: {
-      dynamicSql: "Runtime value embedded inside a quoted SQL value passed to `{{method}}()`. Replace the quoted interpolation with a placeholder and bind the value separately."
+      dynamicSql: "Runtime value embedded inside a quoted SQL value passed to `{{method}}()`. Replace the quoted interpolation with a placeholder and bind the value separately.",
+      dynamicFragment: "Runtime fragment interpolated into SQL passed to `{{method}}()`. Bind data values; select non-bindable SQL fragments from fixed, reviewed alternatives."
     }
   },
   defaultOptions: [{}],
@@ -4320,8 +4353,8 @@ var no_dynamic_sql_default = createRule({
         const offenders = statement.type === import_utils27.AST_NODE_TYPES.TemplateLiteral ? runtimeInterpolations(statement) : runtimeConcatOperands(statement);
         for (const offender of offenders) {
           context.report({
-            node: offender,
-            messageId: "dynamicSql",
+            node: offender.expression,
+            messageId: offender.messageId,
             data: { method }
           });
         }
@@ -23252,7 +23285,7 @@ var RULES = {
 };
 var meta = {
   name: "@sarj/eslint-plugin",
-  version: "15.26.1"
+  version: "15.26.2"
 };
 var APPLICATION_ONLY_RULES = [];
 var LIBRARY_IMPORT_POLICY = ["error", {

package/dist/index.d.cts

@@ -175,11 +175,6 @@ interface RuleOptions$1 {
     readonly max?: number;
 }
 
-/**
- * @fileoverview no-dynamic-sql — bind runtime values separately from SQL string literals.
- *
- * Examples: https://github.com/sarj-ai/code-standards/blob/main/packages/typescript/tests/rules/no-dynamic-sql.test.ts
- */
 interface RuleOptions {
     readonly methods?: readonly string[];
 }
@@ -247,7 +242,7 @@ declare const RULES: {
     readonly "no-cors-wildcard-with-credentials": DocumentedRule<readonly [], "corsWildcardWithCredentials">;
     readonly "no-duplicate-lifecycle-refresh-listeners": DocumentedRule<readonly [], "duplicateLifecycleRefresh">;
     readonly "no-dangerously-allow-svg": DocumentedRule<readonly [], "noDangerouslyAllowSvg">;
-    readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql">;
+    readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql" | "dynamicFragment">;
     readonly "no-enum": DocumentedRule<readonly [{
         ignoreFiles?: readonly string[];
     }?], "noEnum">;
@@ -1001,7 +996,7 @@ type FlatPreset = {
 declare const PLUGIN: {
     readonly meta: {
         readonly name: "@sarj/eslint-plugin";
-        readonly version: "15.26.1";
+        readonly version: "15.26.2";
     };
     readonly rules: {
         readonly "no-conditional-empty-object-spread": DocumentedRule<[], "avoid">;
@@ -1037,7 +1032,7 @@ declare const PLUGIN: {
         readonly "no-cors-wildcard-with-credentials": DocumentedRule<readonly [], "corsWildcardWithCredentials">;
         readonly "no-duplicate-lifecycle-refresh-listeners": DocumentedRule<readonly [], "duplicateLifecycleRefresh">;
         readonly "no-dangerously-allow-svg": DocumentedRule<readonly [], "noDangerouslyAllowSvg">;
-        readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql">;
+        readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql" | "dynamicFragment">;
         readonly "no-enum": DocumentedRule<readonly [{
             ignoreFiles?: readonly string[];
         }?], "noEnum">;

package/dist/index.d.ts

@@ -175,11 +175,6 @@ interface RuleOptions$1 {
     readonly max?: number;
 }
 
-/**
- * @fileoverview no-dynamic-sql — bind runtime values separately from SQL string literals.
- *
- * Examples: https://github.com/sarj-ai/code-standards/blob/main/packages/typescript/tests/rules/no-dynamic-sql.test.ts
- */
 interface RuleOptions {
     readonly methods?: readonly string[];
 }
@@ -247,7 +242,7 @@ declare const RULES: {
     readonly "no-cors-wildcard-with-credentials": DocumentedRule<readonly [], "corsWildcardWithCredentials">;
     readonly "no-duplicate-lifecycle-refresh-listeners": DocumentedRule<readonly [], "duplicateLifecycleRefresh">;
     readonly "no-dangerously-allow-svg": DocumentedRule<readonly [], "noDangerouslyAllowSvg">;
-    readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql">;
+    readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql" | "dynamicFragment">;
     readonly "no-enum": DocumentedRule<readonly [{
         ignoreFiles?: readonly string[];
     }?], "noEnum">;
@@ -1001,7 +996,7 @@ type FlatPreset = {
 declare const PLUGIN: {
     readonly meta: {
         readonly name: "@sarj/eslint-plugin";
-        readonly version: "15.26.1";
+        readonly version: "15.26.2";
     };
     readonly rules: {
         readonly "no-conditional-empty-object-spread": DocumentedRule<[], "avoid">;
@@ -1037,7 +1032,7 @@ declare const PLUGIN: {
         readonly "no-cors-wildcard-with-credentials": DocumentedRule<readonly [], "corsWildcardWithCredentials">;
         readonly "no-duplicate-lifecycle-refresh-listeners": DocumentedRule<readonly [], "duplicateLifecycleRefresh">;
         readonly "no-dangerously-allow-svg": DocumentedRule<readonly [], "noDangerouslyAllowSvg">;
-        readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql">;
+        readonly "no-dynamic-sql": DocumentedRule<readonly [RuleOptions?], "dynamicSql" | "dynamicFragment">;
         readonly "no-enum": DocumentedRule<readonly [{
             ignoreFiles?: readonly string[];
         }?], "noEnum">;

package/dist/index.js

@@ -4113,12 +4113,12 @@ function createSqlListener(handler) {
 
 // src/rules/no-dynamic-sql.ts
 var NO_DYNAMIC_SQL_DOCUMENTATION = {
-  summary: "Disallow runtime values embedded inside quoted SQL values passed to statement-execution methods.",
-  rationale: "Embedding runtime values in SQL bypasses driver parameterization and can introduce injection defects or unstable query plans.",
-  remediation: "Use SQL placeholders and pass runtime values through the driver's binding API.",
+  summary: "Disallow runtime values and fragments interpolated into SQL passed to statement-execution methods.",
+  rationale: "Embedding runtime values or fragments in SQL bypasses driver parameterization or an explicit allowlist and can introduce injection defects or unstable query plans.",
+  remediation: "Bind data values through SQL placeholders. Select non-bindable identifiers or clauses from fixed, reviewed fragments instead of interpolating runtime text.",
   category: "security",
   limitations: [
-    "Only single-quoted SQL values are inspected. Double-quoted identifiers, comments, dollar strings, and unquoted fragments are excluded; this is not a general SQL injection detector.",
+    "Template and concatenation fragments are inspected at recognized execution calls. Double-quoted identifiers, comments, and dollar strings are excluded; this is not a general SQL injection detector.",
     "Literal fragments, legacy uppercase fragment names, and parameterizing tagged templates are exempt; uppercase spelling does not prove a value is static.",
     "The bounded lexer recognizes doubled quotes, comments, and PostgreSQL dollar strings; dialect-specific escape modes and SQL generated through other APIs require separate security review."
   ],
@@ -4140,6 +4140,26 @@ var NO_DYNAMIC_SQL_DOCUMENTATION = {
       focusPath: "src/users.ts",
       expectedCount: 1,
       public: true
+    },
+    {
+      id: "bound-unquoted-value",
+      scenarioId: "unquoted",
+      title: "An unquoted runtime value is bound separately",
+      outcome: "no-match",
+      files: [{ path: "src/users.ts", source: "db.prepare('select id from users where id = ?').bind(userId);" }],
+      focusPath: "src/users.ts",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "unquoted-runtime-fragment",
+      scenarioId: "unquoted",
+      title: "A runtime fragment is interpolated into SQL",
+      outcome: "match",
+      files: [{ path: "src/users.ts", source: "db.prepare(`select id from users where id = ${userId}`);" }],
+      focusPath: "src/users.ts",
+      expectedCount: 1,
+      public: true
     }
   ]
 };
@@ -4162,14 +4182,21 @@ function isStaticFragment(expression) {
 }
 function runtimeInterpolations(template) {
   const parts = template.quasis.map((quasi) => quasi.value.cooked ?? quasi.value.raw);
-  const ranges = sqlSingleQuotedRanges(parts.join(RUNTIME_MARKER));
+  const statement = parts.join(RUNTIME_MARKER);
+  const ranges = sqlSingleQuotedRanges(statement);
+  const visible = stripSqlNoise(statement);
   let offset = 0;
-  return template.expressions.filter(
+  return template.expressions.flatMap(
     (expression, index) => {
       offset += parts[index]?.length ?? 0;
       const inValue = ranges.some(([start, end]) => start < offset && offset < end);
+      const unquoted = visible.slice(offset, offset + RUNTIME_MARKER.length) === RUNTIME_MARKER;
       offset += RUNTIME_MARKER.length;
-      return inValue && !isStaticFragment(expression) && endsWithSqlQuote(parts[index] ?? "") && startsWithSqlQuote(parts[index + 1] ?? "");
+      if (isStaticFragment(expression)) return [];
+      if (inValue && endsWithSqlQuote(parts[index] ?? "") && startsWithSqlQuote(parts[index + 1] ?? "")) {
+        return [{ expression, messageId: "dynamicSql" }];
+      }
+      return unquoted ? [{ expression, messageId: "dynamicFragment" }] : [];
     }
   );
 }
@@ -4200,16 +4227,21 @@ function runtimeConcatOperands(node) {
     return [];
   }
   const parts = operands.map((operand) => staticLiteralText(operand) ?? RUNTIME_MARKER);
-  const ranges = sqlSingleQuotedRanges(parts.join(""));
+  const statement = parts.join("");
+  const ranges = sqlSingleQuotedRanges(statement);
+  const visible = stripSqlNoise(statement);
   let offset = 0;
-  return operands.filter((operand, index) => {
+  return operands.flatMap((operand, index) => {
     const inValue = ranges.some(([start, end]) => start < offset && offset < end);
+    const unquoted = visible.slice(offset, offset + RUNTIME_MARKER.length) === RUNTIME_MARKER;
     offset += parts[index]?.length ?? 0;
-    if (!inValue) return false;
-    if (isStaticFragment(operand)) return false;
+    if (isStaticFragment(operand)) return [];
     const before = operands[index - 1];
     const after = operands[index + 1];
-    return before !== void 0 && after !== void 0 && endsWithSqlQuote(staticLiteralText(before) ?? "") && startsWithSqlQuote(staticLiteralText(after) ?? "");
+    if (inValue && before !== void 0 && after !== void 0 && endsWithSqlQuote(staticLiteralText(before) ?? "") && startsWithSqlQuote(staticLiteralText(after) ?? "")) {
+      return [{ expression: operand, messageId: "dynamicSql" }];
+    }
+    return unquoted ? [{ expression: operand, messageId: "dynamicFragment" }] : [];
   });
 }
 function concatOperands(node) {
@@ -4265,7 +4297,8 @@ var no_dynamic_sql_default = createRule({
       }
     ],
     messages: {
-      dynamicSql: "Runtime value embedded inside a quoted SQL value passed to `{{method}}()`. Replace the quoted interpolation with a placeholder and bind the value separately."
+      dynamicSql: "Runtime value embedded inside a quoted SQL value passed to `{{method}}()`. Replace the quoted interpolation with a placeholder and bind the value separately.",
+      dynamicFragment: "Runtime fragment interpolated into SQL passed to `{{method}}()`. Bind data values; select non-bindable SQL fragments from fixed, reviewed alternatives."
     }
   },
   defaultOptions: [{}],
@@ -4284,8 +4317,8 @@ var no_dynamic_sql_default = createRule({
         const offenders = statement.type === AST_NODE_TYPES25.TemplateLiteral ? runtimeInterpolations(statement) : runtimeConcatOperands(statement);
         for (const offender of offenders) {
           context.report({
-            node: offender,
-            messageId: "dynamicSql",
+            node: offender.expression,
+            messageId: offender.messageId,
             data: { method }
           });
         }
@@ -23273,7 +23306,7 @@ var RULES = {
 };
 var meta = {
   name: "@sarj/eslint-plugin",
-  version: "15.26.1"
+  version: "15.26.2"
 };
 var APPLICATION_ONLY_RULES = [];
 var LIBRARY_IMPORT_POLICY = ["error", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sarj/eslint-plugin",
-  "version": "15.26.1",
+  "version": "15.26.2",
   "packageManager": "npm@12.0.2",
   "description": "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   "type": "module",