@sarj/eslint-plugin 15.26.7 → 15.26.8

package/dist/index.cjs

@@ -9486,7 +9486,7 @@ var NO_SECRET_IN_LOG_DOCUMENTATION = {
   rationale: "Logs are widely retained and distributed, so credentials and raw bodies can become durable data leaks.",
   remediation: "Omit the value, log allowlisted non-sensitive context, or use an approved redactor; truncation alone is not a safety guarantee.",
   category: "security",
-  limitations: ["Detection uses configurable logger names and statically recognizable secret names, raw-body names, and redaction markers. Name-based exemptions are policy heuristics, not proof that a value is safely redacted."],
+  limitations: ["Detection uses configurable logger names and statically recognizable secret names, raw-body names, and redaction markers. Literal containers and template/string concatenation expressions are inspected; unknown spreads, computed properties, aliases, and opaque calls are not followed. Name-based exemptions are policy heuristics, not proof that a value is safely redacted."],
   examples: [
     { id: "redacted-secret", title: "Log non-sensitive context instead of the secret", outcome: "no-match", files: [{ path: "src/auth.ts", source: "logger.info('auth', { requestId });" }], focusPath: "src/auth.ts", expectedCount: 0, public: true },
     { id: "logged-secret", title: "Do not send a secret to logs", outcome: "match", files: [{ path: "src/auth.ts", source: "logger.error('auth failed', { token });" }], focusPath: "src/auth.ts", expectedCount: 1, public: true }
@@ -9537,13 +9537,25 @@ var LOG_INNOCUOUS_WORDS = /* @__PURE__ */ new Set([
   "len",
   "length"
 ]);
-var REDACTION_RE = /prefix|suffix|redact|mask|hash|hint|_len|length/i;
-var WHOLE_TOKEN_REDACTION_MARKERS = /* @__PURE__ */ new Set(["tag"]);
+var SECRET_REDACTION_TOKENS = /* @__PURE__ */ new Set([
+  "prefix",
+  "suffix",
+  "redact",
+  "redacted",
+  "mask",
+  "masked",
+  "hash",
+  "hashed",
+  "hint",
+  "len",
+  "length",
+  "tag"
+]);
 function isSecretKeyword(name) {
   return !hasRedactionMarker(name) && isSecretName(name, LOG_INNOCUOUS_WORDS);
 }
 function hasRedactionMarker(name) {
-  return REDACTION_RE.test(name) || tokenize(name).some((tok) => WHOLE_TOKEN_REDACTION_MARKERS.has(tok));
+  return tokenize(name).some((token) => SECRET_REDACTION_TOKENS.has(token));
 }
 function valueName(node) {
   if (node.type === "Identifier") return node.name;
@@ -9563,8 +9575,27 @@ var RAW_BLOB_WORDS = /* @__PURE__ */ new Set([
   "params"
 ]);
 var RAW_BLOB_IDENTIFIERS = /* @__PURE__ */ new Set(["formdata"]);
-var BLOB_REDACTION_RE = /redact|sanit|scrub|mask|truncat|anonym|filtered|preview|summar/i;
-var BLOB_REDACTION_TOKENS = /* @__PURE__ */ new Set([
+var BLOB_TRANSFORM_TOKENS = /* @__PURE__ */ new Set([
+  "redact",
+  "redacted",
+  "sanitize",
+  "sanitized",
+  "scrub",
+  "scrubbed",
+  "mask",
+  "masked",
+  "truncate",
+  "truncated",
+  "anonymize",
+  "anonymized",
+  "filter",
+  "filtered",
+  "preview",
+  "summarize",
+  "summarized",
+  "summary"
+]);
+var BLOB_SAFE_TOKENS = /* @__PURE__ */ new Set([
   "safe",
   "clean",
   "shape",
@@ -9586,11 +9617,8 @@ function rawBlobValueName(value) {
   return null;
 }
 function isRawBlobName(name) {
-  if (REDACTION_RE.test(name) || BLOB_REDACTION_RE.test(name)) {
-    return false;
-  }
   const tokens = tokenize(name);
-  if (tokens.some((tok) => BLOB_REDACTION_TOKENS.has(tok))) {
+  if (tokens.some((tok) => SECRET_REDACTION_TOKENS.has(tok) || BLOB_TRANSFORM_TOKENS.has(tok) || BLOB_SAFE_TOKENS.has(tok))) {
     return false;
   }
   const first = leadingWord(name);
@@ -9660,12 +9688,62 @@ var no_secret_in_log_default = createRule({
     }
     function reportRawBlob(node, value) {
       if (!blobArmApplies) {
-        return;
+        return false;
       }
       const name = rawBlobValueName(value);
       if (name !== null) {
         context.report({ node, messageId: "noRawBodyInLog", data: { name } });
+        return true;
       }
+      return false;
+    }
+    function literalProperties(value) {
+      const effective = /* @__PURE__ */ new Map();
+      for (const entry of value.properties) {
+        if (entry.type === "SpreadElement") {
+          if (entry.argument.type !== "ObjectExpression") {
+            effective.clear();
+            continue;
+          }
+          for (const property of literalProperties(entry.argument)) {
+            const key2 = propertyKeyName2(property);
+            if (key2 !== null) effective.set(key2, property);
+          }
+          continue;
+        }
+        const key = propertyKeyName2(entry);
+        if (key === null) {
+          effective.clear();
+          continue;
+        }
+        effective.set(key, entry);
+      }
+      return [...effective.values()];
+    }
+    function inspectLoggedValue(value) {
+      if (value.type === "ObjectExpression") {
+        for (const property of literalProperties(value)) {
+          if (reportSecretProperty(property) || reportRawBlob(property, property.value)) continue;
+          inspectLoggedValue(property.value);
+        }
+        return;
+      }
+      if (value.type === "ArrayExpression") {
+        for (const element of value.elements) {
+          if (element !== null && element.type !== "SpreadElement") inspectLoggedValue(element);
+        }
+        return;
+      }
+      if (value.type === "TemplateLiteral") {
+        for (const expression of value.expressions) inspectLoggedValue(expression);
+        return;
+      }
+      if (value.type === "BinaryExpression" && value.operator === "+") {
+        inspectLoggedValue(value.left);
+        inspectLoggedValue(value.right);
+        return;
+      }
+      if (!reportSecretArgument(value)) reportRawBlob(value, value);
     }
     return {
       CallExpression(node) {
@@ -9673,20 +9751,7 @@ var no_secret_in_log_default = createRule({
           return;
         }
         for (const arg of node.arguments) {
-          if (arg.type === "ObjectExpression") {
-            for (const prop of arg.properties) {
-              if (prop.type !== "Property") {
-                continue;
-              }
-              if (!reportSecretProperty(prop)) {
-                reportRawBlob(prop, prop.value);
-              }
-            }
-            continue;
-          }
-          if (!reportSecretArgument(arg)) {
-            reportRawBlob(arg, arg);
-          }
+          if (arg.type !== "SpreadElement") inspectLoggedValue(arg);
         }
       }
     };
@@ -23162,7 +23227,7 @@ var RULES = {
 };
 var meta = {
   name: "@sarj/eslint-plugin",
-  version: "15.26.7"
+  version: "15.26.8"
 };
 var APPLICATION_ONLY_RULES = [];
 var LIBRARY_IMPORT_POLICY = ["error", {

package/dist/index.d.cts

@@ -996,7 +996,7 @@ type FlatPreset = {
 declare const PLUGIN: {
     readonly meta: {
         readonly name: "@sarj/eslint-plugin";
-        readonly version: "15.26.7";
+        readonly version: "15.26.8";
     };
     readonly rules: {
         readonly "no-conditional-empty-object-spread": DocumentedRule<[], "avoid">;

package/dist/index.d.ts

@@ -996,7 +996,7 @@ type FlatPreset = {
 declare const PLUGIN: {
     readonly meta: {
         readonly name: "@sarj/eslint-plugin";
-        readonly version: "15.26.7";
+        readonly version: "15.26.8";
     };
     readonly rules: {
         readonly "no-conditional-empty-object-spread": DocumentedRule<[], "avoid">;

package/dist/index.js

@@ -9468,7 +9468,7 @@ var NO_SECRET_IN_LOG_DOCUMENTATION = {
   rationale: "Logs are widely retained and distributed, so credentials and raw bodies can become durable data leaks.",
   remediation: "Omit the value, log allowlisted non-sensitive context, or use an approved redactor; truncation alone is not a safety guarantee.",
   category: "security",
-  limitations: ["Detection uses configurable logger names and statically recognizable secret names, raw-body names, and redaction markers. Name-based exemptions are policy heuristics, not proof that a value is safely redacted."],
+  limitations: ["Detection uses configurable logger names and statically recognizable secret names, raw-body names, and redaction markers. Literal containers and template/string concatenation expressions are inspected; unknown spreads, computed properties, aliases, and opaque calls are not followed. Name-based exemptions are policy heuristics, not proof that a value is safely redacted."],
   examples: [
     { id: "redacted-secret", title: "Log non-sensitive context instead of the secret", outcome: "no-match", files: [{ path: "src/auth.ts", source: "logger.info('auth', { requestId });" }], focusPath: "src/auth.ts", expectedCount: 0, public: true },
     { id: "logged-secret", title: "Do not send a secret to logs", outcome: "match", files: [{ path: "src/auth.ts", source: "logger.error('auth failed', { token });" }], focusPath: "src/auth.ts", expectedCount: 1, public: true }
@@ -9519,13 +9519,25 @@ var LOG_INNOCUOUS_WORDS = /* @__PURE__ */ new Set([
   "len",
   "length"
 ]);
-var REDACTION_RE = /prefix|suffix|redact|mask|hash|hint|_len|length/i;
-var WHOLE_TOKEN_REDACTION_MARKERS = /* @__PURE__ */ new Set(["tag"]);
+var SECRET_REDACTION_TOKENS = /* @__PURE__ */ new Set([
+  "prefix",
+  "suffix",
+  "redact",
+  "redacted",
+  "mask",
+  "masked",
+  "hash",
+  "hashed",
+  "hint",
+  "len",
+  "length",
+  "tag"
+]);
 function isSecretKeyword(name) {
   return !hasRedactionMarker(name) && isSecretName(name, LOG_INNOCUOUS_WORDS);
 }
 function hasRedactionMarker(name) {
-  return REDACTION_RE.test(name) || tokenize(name).some((tok) => WHOLE_TOKEN_REDACTION_MARKERS.has(tok));
+  return tokenize(name).some((token) => SECRET_REDACTION_TOKENS.has(token));
 }
 function valueName(node) {
   if (node.type === "Identifier") return node.name;
@@ -9545,8 +9557,27 @@ var RAW_BLOB_WORDS = /* @__PURE__ */ new Set([
   "params"
 ]);
 var RAW_BLOB_IDENTIFIERS = /* @__PURE__ */ new Set(["formdata"]);
-var BLOB_REDACTION_RE = /redact|sanit|scrub|mask|truncat|anonym|filtered|preview|summar/i;
-var BLOB_REDACTION_TOKENS = /* @__PURE__ */ new Set([
+var BLOB_TRANSFORM_TOKENS = /* @__PURE__ */ new Set([
+  "redact",
+  "redacted",
+  "sanitize",
+  "sanitized",
+  "scrub",
+  "scrubbed",
+  "mask",
+  "masked",
+  "truncate",
+  "truncated",
+  "anonymize",
+  "anonymized",
+  "filter",
+  "filtered",
+  "preview",
+  "summarize",
+  "summarized",
+  "summary"
+]);
+var BLOB_SAFE_TOKENS = /* @__PURE__ */ new Set([
   "safe",
   "clean",
   "shape",
@@ -9568,11 +9599,8 @@ function rawBlobValueName(value) {
   return null;
 }
 function isRawBlobName(name) {
-  if (REDACTION_RE.test(name) || BLOB_REDACTION_RE.test(name)) {
-    return false;
-  }
   const tokens = tokenize(name);
-  if (tokens.some((tok) => BLOB_REDACTION_TOKENS.has(tok))) {
+  if (tokens.some((tok) => SECRET_REDACTION_TOKENS.has(tok) || BLOB_TRANSFORM_TOKENS.has(tok) || BLOB_SAFE_TOKENS.has(tok))) {
     return false;
   }
   const first = leadingWord(name);
@@ -9642,12 +9670,62 @@ var no_secret_in_log_default = createRule({
     }
     function reportRawBlob(node, value) {
       if (!blobArmApplies) {
-        return;
+        return false;
       }
       const name = rawBlobValueName(value);
       if (name !== null) {
         context.report({ node, messageId: "noRawBodyInLog", data: { name } });
+        return true;
       }
+      return false;
+    }
+    function literalProperties(value) {
+      const effective = /* @__PURE__ */ new Map();
+      for (const entry of value.properties) {
+        if (entry.type === "SpreadElement") {
+          if (entry.argument.type !== "ObjectExpression") {
+            effective.clear();
+            continue;
+          }
+          for (const property of literalProperties(entry.argument)) {
+            const key2 = propertyKeyName2(property);
+            if (key2 !== null) effective.set(key2, property);
+          }
+          continue;
+        }
+        const key = propertyKeyName2(entry);
+        if (key === null) {
+          effective.clear();
+          continue;
+        }
+        effective.set(key, entry);
+      }
+      return [...effective.values()];
+    }
+    function inspectLoggedValue(value) {
+      if (value.type === "ObjectExpression") {
+        for (const property of literalProperties(value)) {
+          if (reportSecretProperty(property) || reportRawBlob(property, property.value)) continue;
+          inspectLoggedValue(property.value);
+        }
+        return;
+      }
+      if (value.type === "ArrayExpression") {
+        for (const element of value.elements) {
+          if (element !== null && element.type !== "SpreadElement") inspectLoggedValue(element);
+        }
+        return;
+      }
+      if (value.type === "TemplateLiteral") {
+        for (const expression of value.expressions) inspectLoggedValue(expression);
+        return;
+      }
+      if (value.type === "BinaryExpression" && value.operator === "+") {
+        inspectLoggedValue(value.left);
+        inspectLoggedValue(value.right);
+        return;
+      }
+      if (!reportSecretArgument(value)) reportRawBlob(value, value);
     }
     return {
       CallExpression(node) {
@@ -9655,20 +9733,7 @@ var no_secret_in_log_default = createRule({
           return;
         }
         for (const arg of node.arguments) {
-          if (arg.type === "ObjectExpression") {
-            for (const prop of arg.properties) {
-              if (prop.type !== "Property") {
-                continue;
-              }
-              if (!reportSecretProperty(prop)) {
-                reportRawBlob(prop, prop.value);
-              }
-            }
-            continue;
-          }
-          if (!reportSecretArgument(arg)) {
-            reportRawBlob(arg, arg);
-          }
+          if (arg.type !== "SpreadElement") inspectLoggedValue(arg);
         }
       }
     };
@@ -23183,7 +23248,7 @@ var RULES = {
 };
 var meta = {
   name: "@sarj/eslint-plugin",
-  version: "15.26.7"
+  version: "15.26.8"
 };
 var APPLICATION_ONLY_RULES = [];
 var LIBRARY_IMPORT_POLICY = ["error", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sarj/eslint-plugin",
-  "version": "15.26.7",
+  "version": "15.26.8",
   "packageManager": "npm@12.1.0",
   "description": "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   "type": "module",