@sarj/eslint-plugin 16.13.0 → 16.13.1

package/dist/index.cjs

@@ -52,7 +52,7 @@ module.exports = __toCommonJS(src_exports);
 // package.json
 var package_default = {
   name: "@sarj/eslint-plugin",
-  version: "16.13.0",
+  version: "16.13.1",
   packageManager: "npm@12.2.0",
   description: "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   type: "module",
@@ -5493,31 +5493,48 @@ function sqlTextOf(node) {
       const right = sqlTextOf(node.right);
       return left !== null && right !== null ? left + right : null;
     }
-    case import_utils32.AST_NODE_TYPES.ArrayExpression: {
-      const parts = [];
-      for (const element of node.elements) {
-        if (element === null) {
-          return null;
-        }
-        const part = sqlTextOf(element);
-        if (part === null) {
-          return null;
-        }
-        parts.push(part);
-      }
-      return parts.length > 0 ? parts.join(" ") : null;
-    }
+    case import_utils32.AST_NODE_TYPES.ArrayExpression:
+      return fragmentArrayText(node);
     default:
       return null;
   }
 }
-function isJoinedFragmentArray(node) {
+function fragmentArrayText(node) {
+  const join4 = joinedFragmentCall(node);
+  const separator = join4 === null ? " " : join4.arguments.length === 0 ? "," : join4.arguments.length === 1 ? staticString(join4.arguments[0]) : null;
+  if (separator === null) return null;
+  const parts = [];
+  for (const element of node.elements) {
+    if (element === null || join4 !== null && element.type === import_utils32.AST_NODE_TYPES.ArrayExpression) {
+      return null;
+    }
+    const part = sqlTextOf(element);
+    if (part === null) {
+      return null;
+    }
+    parts.push(part);
+  }
+  return parts.length > 0 ? parts.join(separator) : null;
+}
+function joinedFragmentCall(node) {
   const parent = node.parent;
-  return parent?.type === import_utils32.AST_NODE_TYPES.MemberExpression && parent.object === node && !parent.computed && parent.property.type === import_utils32.AST_NODE_TYPES.Identifier && parent.property.name === "join" && parent.parent?.type === import_utils32.AST_NODE_TYPES.CallExpression;
+  return parent?.type === import_utils32.AST_NODE_TYPES.MemberExpression && parent.object === node && !parent.computed && parent.property.type === import_utils32.AST_NODE_TYPES.Identifier && parent.property.name === "join" && parent.parent?.type === import_utils32.AST_NODE_TYPES.CallExpression && parent.parent.callee === parent ? parent.parent : null;
 }
 function markConsumed(node, consumed) {
   consumed.add(node);
-  forEachOwnAstChild(node, (child) => markConsumed(child, consumed));
+  const value = unwrapExpression(node);
+  if (value !== node) {
+    markConsumed(value, consumed);
+    return;
+  }
+  if (node.type === import_utils32.AST_NODE_TYPES.BinaryExpression && node.operator === "+") {
+    markConsumed(node.left, consumed);
+    markConsumed(node.right, consumed);
+  } else if (node.type === import_utils32.AST_NODE_TYPES.ArrayExpression) {
+    for (const element of node.elements) if (element !== null) markConsumed(element, consumed);
+  } else if (node.type === import_utils32.AST_NODE_TYPES.TaggedTemplateExpression) {
+    markConsumed(node.quasi, consumed);
+  }
 }
 function createSqlListener(handler) {
   const consumed = /* @__PURE__ */ new WeakSet();
@@ -5537,9 +5554,12 @@ function createSqlListener(handler) {
       visit(node);
     },
     ArrayExpression: (node) => {
-      if (isJoinedFragmentArray(node)) {
-        visit(node);
-      }
+      const join4 = joinedFragmentCall(node);
+      if (join4 === null) return;
+      visit(node);
+      markConsumed(node, consumed);
+      const separator = join4.arguments[0];
+      if (separator !== void 0 && staticString(separator) !== null) markConsumed(separator, consumed);
     },
     TemplateLiteral: (node) => {
       visit(node);
@@ -5570,7 +5590,7 @@ var NO_DYNAMIC_SQL_DOCUMENTATION = {
   remediation: "Bind data values through SQL placeholders. Select non-bindable identifiers or clauses from fixed, reviewed fragments instead of interpolating runtime text.",
   category: "security",
   limitations: [
-    "Template and concatenation fragments are inspected at recognized execution calls. Double-quoted identifiers, comments, and dollar strings are excluded; this is not a general SQL injection detector.",
+    "Template and concatenation fragments are inspected at recognized execution calls, including runtime pieces surrounded by literal text inside a quoted value. Double-quoted identifiers, comments, and dollar strings are excluded; this is not a general SQL injection detector.",
     "Literal fragments, legacy uppercase fragment names, and parameterizing tagged templates are exempt; uppercase spelling does not prove a value is static.",
     "The bounded lexer recognizes doubled quotes, comments, and PostgreSQL dollar strings; dialect-specific escape modes and SQL generated through other APIs require separate security review."
   ],
@@ -5618,6 +5638,7 @@ var NO_DYNAMIC_SQL_DOCUMENTATION = {
 var DEFAULT_METHODS = ["prepare", "exec", "query"];
 var CONSTANT_CASE_RE = /^[A-Z][A-Z0-9_]*$/;
 function isStaticFragment(expression) {
+  expression = unwrapExpression(expression);
   if (expression.type === import_utils33.AST_NODE_TYPES.Identifier) {
     return CONSTANT_CASE_RE.test(expression.name);
   }
@@ -5645,28 +5666,13 @@ function runtimeInterpolations(template) {
       const unquoted = visible.slice(offset, offset + RUNTIME_MARKER.length) === RUNTIME_MARKER;
       offset += RUNTIME_MARKER.length;
       if (isStaticFragment(expression)) return [];
-      if (inValue && endsWithSqlQuote(parts[index] ?? "") && startsWithSqlQuote(parts[index + 1] ?? "")) {
+      if (inValue) {
         return [{ expression, messageId: "dynamicSql" }];
       }
       return unquoted ? [{ expression, messageId: "dynamicFragment" }] : [];
     }
   );
 }
-function endsWithSqlQuote(text) {
-  return /'\s*$/u.test(text);
-}
-function startsWithSqlQuote(text) {
-  return /^\s*'/u.test(text);
-}
-function staticLiteralText(node) {
-  if (node.type === import_utils33.AST_NODE_TYPES.Literal && typeof node.value === "string") {
-    return node.value;
-  }
-  if (node.type === import_utils33.AST_NODE_TYPES.TemplateLiteral && node.expressions.length === 0) {
-    return node.quasis[0]?.value.raw;
-  }
-  return void 0;
-}
 function runtimeConcatOperands(node) {
   if (node.type !== import_utils33.AST_NODE_TYPES.BinaryExpression || node.operator !== "+") {
     return [];
@@ -5678,7 +5684,7 @@ function runtimeConcatOperands(node) {
   if (!hasStringLiteral) {
     return [];
   }
-  const parts = operands.map((operand) => staticLiteralText(operand) ?? RUNTIME_MARKER);
+  const parts = operands.map((operand) => staticString(operand) ?? RUNTIME_MARKER);
   const statement = parts.join("");
   const ranges = sqlSingleQuotedRanges(statement);
   const visible = stripSqlNoise(statement);
@@ -5688,9 +5694,7 @@ function runtimeConcatOperands(node) {
     const unquoted = visible.slice(offset, offset + RUNTIME_MARKER.length) === RUNTIME_MARKER;
     offset += parts[index]?.length ?? 0;
     if (isStaticFragment(operand)) return [];
-    const before = operands[index - 1];
-    const after = operands[index + 1];
-    if (inValue && before !== void 0 && after !== void 0 && endsWithSqlQuote(staticLiteralText(before) ?? "") && startsWithSqlQuote(staticLiteralText(after) ?? "")) {
+    if (inValue) {
       return [{ expression: operand, messageId: "dynamicSql" }];
     }
     return unquoted ? [{ expression: operand, messageId: "dynamicFragment" }] : [];

package/dist/index.js

@@ -1,7 +1,7 @@
 // package.json
 var package_default = {
   name: "@sarj/eslint-plugin",
-  version: "16.13.0",
+  version: "16.13.1",
   packageManager: "npm@12.2.0",
   description: "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   type: "module",
@@ -5454,31 +5454,48 @@ function sqlTextOf(node) {
       const right = sqlTextOf(node.right);
       return left !== null && right !== null ? left + right : null;
     }
-    case AST_NODE_TYPES28.ArrayExpression: {
-      const parts = [];
-      for (const element of node.elements) {
-        if (element === null) {
-          return null;
-        }
-        const part = sqlTextOf(element);
-        if (part === null) {
-          return null;
-        }
-        parts.push(part);
-      }
-      return parts.length > 0 ? parts.join(" ") : null;
-    }
+    case AST_NODE_TYPES28.ArrayExpression:
+      return fragmentArrayText(node);
     default:
       return null;
   }
 }
-function isJoinedFragmentArray(node) {
+function fragmentArrayText(node) {
+  const join4 = joinedFragmentCall(node);
+  const separator = join4 === null ? " " : join4.arguments.length === 0 ? "," : join4.arguments.length === 1 ? staticString(join4.arguments[0]) : null;
+  if (separator === null) return null;
+  const parts = [];
+  for (const element of node.elements) {
+    if (element === null || join4 !== null && element.type === AST_NODE_TYPES28.ArrayExpression) {
+      return null;
+    }
+    const part = sqlTextOf(element);
+    if (part === null) {
+      return null;
+    }
+    parts.push(part);
+  }
+  return parts.length > 0 ? parts.join(separator) : null;
+}
+function joinedFragmentCall(node) {
   const parent = node.parent;
-  return parent?.type === AST_NODE_TYPES28.MemberExpression && parent.object === node && !parent.computed && parent.property.type === AST_NODE_TYPES28.Identifier && parent.property.name === "join" && parent.parent?.type === AST_NODE_TYPES28.CallExpression;
+  return parent?.type === AST_NODE_TYPES28.MemberExpression && parent.object === node && !parent.computed && parent.property.type === AST_NODE_TYPES28.Identifier && parent.property.name === "join" && parent.parent?.type === AST_NODE_TYPES28.CallExpression && parent.parent.callee === parent ? parent.parent : null;
 }
 function markConsumed(node, consumed) {
   consumed.add(node);
-  forEachOwnAstChild(node, (child) => markConsumed(child, consumed));
+  const value = unwrapExpression(node);
+  if (value !== node) {
+    markConsumed(value, consumed);
+    return;
+  }
+  if (node.type === AST_NODE_TYPES28.BinaryExpression && node.operator === "+") {
+    markConsumed(node.left, consumed);
+    markConsumed(node.right, consumed);
+  } else if (node.type === AST_NODE_TYPES28.ArrayExpression) {
+    for (const element of node.elements) if (element !== null) markConsumed(element, consumed);
+  } else if (node.type === AST_NODE_TYPES28.TaggedTemplateExpression) {
+    markConsumed(node.quasi, consumed);
+  }
 }
 function createSqlListener(handler) {
   const consumed = /* @__PURE__ */ new WeakSet();
@@ -5498,9 +5515,12 @@ function createSqlListener(handler) {
       visit(node);
     },
     ArrayExpression: (node) => {
-      if (isJoinedFragmentArray(node)) {
-        visit(node);
-      }
+      const join4 = joinedFragmentCall(node);
+      if (join4 === null) return;
+      visit(node);
+      markConsumed(node, consumed);
+      const separator = join4.arguments[0];
+      if (separator !== void 0 && staticString(separator) !== null) markConsumed(separator, consumed);
     },
     TemplateLiteral: (node) => {
       visit(node);
@@ -5531,7 +5551,7 @@ var NO_DYNAMIC_SQL_DOCUMENTATION = {
   remediation: "Bind data values through SQL placeholders. Select non-bindable identifiers or clauses from fixed, reviewed fragments instead of interpolating runtime text.",
   category: "security",
   limitations: [
-    "Template and concatenation fragments are inspected at recognized execution calls. Double-quoted identifiers, comments, and dollar strings are excluded; this is not a general SQL injection detector.",
+    "Template and concatenation fragments are inspected at recognized execution calls, including runtime pieces surrounded by literal text inside a quoted value. Double-quoted identifiers, comments, and dollar strings are excluded; this is not a general SQL injection detector.",
     "Literal fragments, legacy uppercase fragment names, and parameterizing tagged templates are exempt; uppercase spelling does not prove a value is static.",
     "The bounded lexer recognizes doubled quotes, comments, and PostgreSQL dollar strings; dialect-specific escape modes and SQL generated through other APIs require separate security review."
   ],
@@ -5579,6 +5599,7 @@ var NO_DYNAMIC_SQL_DOCUMENTATION = {
 var DEFAULT_METHODS = ["prepare", "exec", "query"];
 var CONSTANT_CASE_RE = /^[A-Z][A-Z0-9_]*$/;
 function isStaticFragment(expression) {
+  expression = unwrapExpression(expression);
   if (expression.type === AST_NODE_TYPES29.Identifier) {
     return CONSTANT_CASE_RE.test(expression.name);
   }
@@ -5606,28 +5627,13 @@ function runtimeInterpolations(template) {
       const unquoted = visible.slice(offset, offset + RUNTIME_MARKER.length) === RUNTIME_MARKER;
       offset += RUNTIME_MARKER.length;
       if (isStaticFragment(expression)) return [];
-      if (inValue && endsWithSqlQuote(parts[index] ?? "") && startsWithSqlQuote(parts[index + 1] ?? "")) {
+      if (inValue) {
         return [{ expression, messageId: "dynamicSql" }];
       }
       return unquoted ? [{ expression, messageId: "dynamicFragment" }] : [];
     }
   );
 }
-function endsWithSqlQuote(text) {
-  return /'\s*$/u.test(text);
-}
-function startsWithSqlQuote(text) {
-  return /^\s*'/u.test(text);
-}
-function staticLiteralText(node) {
-  if (node.type === AST_NODE_TYPES29.Literal && typeof node.value === "string") {
-    return node.value;
-  }
-  if (node.type === AST_NODE_TYPES29.TemplateLiteral && node.expressions.length === 0) {
-    return node.quasis[0]?.value.raw;
-  }
-  return void 0;
-}
 function runtimeConcatOperands(node) {
   if (node.type !== AST_NODE_TYPES29.BinaryExpression || node.operator !== "+") {
     return [];
@@ -5639,7 +5645,7 @@ function runtimeConcatOperands(node) {
   if (!hasStringLiteral) {
     return [];
   }
-  const parts = operands.map((operand) => staticLiteralText(operand) ?? RUNTIME_MARKER);
+  const parts = operands.map((operand) => staticString(operand) ?? RUNTIME_MARKER);
   const statement = parts.join("");
   const ranges = sqlSingleQuotedRanges(statement);
   const visible = stripSqlNoise(statement);
@@ -5649,9 +5655,7 @@ function runtimeConcatOperands(node) {
     const unquoted = visible.slice(offset, offset + RUNTIME_MARKER.length) === RUNTIME_MARKER;
     offset += parts[index]?.length ?? 0;
     if (isStaticFragment(operand)) return [];
-    const before = operands[index - 1];
-    const after = operands[index + 1];
-    if (inValue && before !== void 0 && after !== void 0 && endsWithSqlQuote(staticLiteralText(before) ?? "") && startsWithSqlQuote(staticLiteralText(after) ?? "")) {
+    if (inValue) {
       return [{ expression: operand, messageId: "dynamicSql" }];
     }
     return unquoted ? [{ expression: operand, messageId: "dynamicFragment" }] : [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sarj/eslint-plugin",
-  "version": "16.13.0",
+  "version": "16.13.1",
   "packageManager": "npm@12.2.0",
   "description": "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   "type": "module",