@sarj/eslint-plugin 16.22.0 → 16.22.1

package/dist/index.cjs

@@ -866,7 +866,7 @@ function isSearchParamReceiver(call, services) {
 // package.json
 var package_default = {
   name: "@sarj/eslint-plugin",
-  version: "16.22.0",
+  version: "16.22.1",
   packageManager: "npm@12.2.0",
   description: "Custom ESLint rules for hypermodern TypeScript / React / Next.js projects",
   type: "module",
@@ -7294,10 +7294,10 @@ var import_utils44 = require("@typescript-eslint/utils");
 function stripSqlNoise(text) {
   return scanSqlNoise(text);
 }
-function sqlSingleQuotedRanges(text) {
-  const ranges = [];
-  scanSqlNoise(text, (start, end) => ranges.push([start, end]));
-  return ranges;
+function sqlNoiseInfo(text) {
+  const singleQuotedRanges = [];
+  const masked = scanSqlNoise(text, (start, end) => singleQuotedRanges.push([start, end]));
+  return { text: masked, singleQuotedRanges };
 }
 function scanSqlNoise(text, onSingleQuoted) {
   const out = text.split("");
@@ -7383,6 +7383,7 @@ function maskSqlRange(text, out, start, end) {
 }
 var SUBSTITUTION_MARKER = "?";
 function sqlTextOf(node) {
+  node = unwrapExpression(node);
   switch (node.type) {
     case import_utils44.AST_NODE_TYPES.Literal:
       return typeof node.value === "string" ? node.value : null;
@@ -7410,7 +7411,7 @@ function fragmentArrayText(node) {
   if (separator === null) return null;
   const parts = [];
   for (const element of node.elements) {
-    if (element === null || join4 !== null && element.type === import_utils44.AST_NODE_TYPES.ArrayExpression) {
+    if (element === null || join4 !== null && unwrapExpression(element).type === import_utils44.AST_NODE_TYPES.ArrayExpression) {
       return null;
     }
     const part = sqlTextOf(element);
@@ -7422,8 +7423,10 @@ function fragmentArrayText(node) {
   return parts.length > 0 ? parts.join(separator) : null;
 }
 function joinedFragmentCall(node) {
-  const parent = node.parent;
-  return parent?.type === import_utils44.AST_NODE_TYPES.MemberExpression && parent.object === node && !parent.computed && parent.property.type === import_utils44.AST_NODE_TYPES.Identifier && parent.property.name === "join" && parent.parent?.type === import_utils44.AST_NODE_TYPES.CallExpression && parent.parent.callee === parent ? parent.parent : null;
+  const value = outerExpression(node);
+  const parent = value.parent;
+  const callee = parent?.type === import_utils44.AST_NODE_TYPES.MemberExpression ? outerExpression(parent) : null;
+  return parent?.type === import_utils44.AST_NODE_TYPES.MemberExpression && parent.object === value && import_utils44.ASTUtils.getPropertyName(parent) === "join" && callee?.parent?.type === import_utils44.AST_NODE_TYPES.CallExpression && callee.parent.callee === callee ? callee.parent : null;
 }
 function markConsumed(node, consumed) {
   consumed.add(node);
@@ -7465,6 +7468,8 @@ function createSqlListener(handler) {
       markConsumed(node, consumed);
       const separator = join4.arguments[0];
       if (separator !== void 0 && staticString(separator) !== null) markConsumed(separator, consumed);
+      const member = unwrapExpression(join4.callee);
+      if (member.type === import_utils44.AST_NODE_TYPES.MemberExpression && member.computed) markConsumed(member.property, consumed);
     },
     TemplateLiteral: (node) => {
       visit(node);
@@ -7475,11 +7480,11 @@ function createSqlListener(handler) {
   };
 }
 function isDiscardedSqlText(node) {
-  let current = node;
+  let current = outerExpression(node);
   let parent = current.parent;
   while (parent !== void 0 && parent !== null) {
-    if (unwrapExpression(parent) === current || parent.type === import_utils44.AST_NODE_TYPES.BinaryExpression && parent.operator === "+") {
-      current = parent;
+    if (parent.type === import_utils44.AST_NODE_TYPES.BinaryExpression && parent.operator === "+") {
+      current = outerExpression(parent);
       parent = current.parent;
       continue;
     }
@@ -7561,8 +7566,7 @@ function isStaticFragment(expression) {
 function runtimeInterpolations(template) {
   const parts = template.quasis.map((quasi) => quasi.value.cooked ?? quasi.value.raw);
   const statement = parts.join(RUNTIME_MARKER);
-  const ranges = sqlSingleQuotedRanges(statement);
-  const visible = stripSqlNoise(statement);
+  const { singleQuotedRanges: ranges, text: visible } = sqlNoiseInfo(statement);
   let offset = 0;
   return template.expressions.flatMap(
     (expression, index) => {
@@ -7583,16 +7587,13 @@ function runtimeConcatOperands(node) {
     return [];
   }
   const operands = concatOperands(node);
-  const hasStringLiteral = operands.some(
-    (operand) => operand.type === import_utils45.AST_NODE_TYPES.Literal && typeof operand.value === "string" || operand.type === import_utils45.AST_NODE_TYPES.TemplateLiteral && operand.expressions.length === 0
-  );
+  const hasStringLiteral = operands.some((operand) => staticString(operand) !== null);
   if (!hasStringLiteral) {
     return [];
   }
   const parts = operands.map((operand) => staticString(operand) ?? RUNTIME_MARKER);
   const statement = parts.join("");
-  const ranges = sqlSingleQuotedRanges(statement);
-  const visible = stripSqlNoise(statement);
+  const { singleQuotedRanges: ranges, text: visible } = sqlNoiseInfo(statement);
   let offset = 0;
   return operands.flatMap((operand, index) => {
     const inValue = ranges.some(([start, end]) => start < offset && offset < end);
@@ -7606,10 +7607,17 @@ function runtimeConcatOperands(node) {
   });
 }
 function concatOperands(node) {
-  if (node.type === import_utils45.AST_NODE_TYPES.BinaryExpression && node.operator === "+") {
-    return [...concatOperands(node.left), ...concatOperands(node.right)];
+  const operands = [];
+  const pending = [node];
+  while (pending.length > 0) {
+    const next = pending.pop();
+    if (next === void 0) continue;
+    const value = unwrapExpression(next);
+    if (value.type === import_utils45.AST_NODE_TYPES.BinaryExpression && value.operator === "+") {
+      pending.push(value.right, value.left);
+    } else operands.push(value);
   }
-  return [node];
+  return operands;
 }
 var SQL_STATEMENT_RE = /\b(?:select\s|insert\s+into\b|insert\s+or\b|update\s+\w|delete\s+from\b|replace\s+into\b|merge\s+into\b|upsert\s+into\b|create\s+(?:temp(?:orary)?\s+)?(?:table|index|view|trigger|schema|database)\b|alter\s+table\b|drop\s+(?:table|index|view|trigger)\b|truncate\s+table\b|pragma\s+\w|with\s+\w+\s+as\s*\(|from\s+\w+\s+where\b)/i;
 var RUNTIME_MARKER = " ? ";
@@ -7617,6 +7625,7 @@ function looksLikeSql(node) {
   return SQL_STATEMENT_RE.test(stripSqlNoise(staticStatementText(node)));
 }
 function staticStatementText(node) {
+  node = unwrapExpression(node);
   if (node.type === import_utils45.AST_NODE_TYPES.TemplateLiteral) {
     return node.quasis.map((quasi) => quasi.value.cooked ?? quasi.value.raw).join(RUNTIME_MARKER);
   }
@@ -8686,46 +8695,15 @@ var STRONG_SECURITY_WORDS = /* @__PURE__ */ new Set([
   "uuid",
   "verificationcode"
 ]);
-var NON_SECURITY_ID_WORDS = /* @__PURE__ */ new Set([
-  "aria",
-  "cache",
-  "component",
-  "correlation",
-  "dev",
-  "dialog",
-  "dom",
-  "element",
-  "execution",
-  "field",
-  "form",
-  "hmr",
-  "input",
-  "marker",
-  "menu",
-  "mock",
-  "perf",
-  "req",
-  "request",
-  "select",
-  "tab",
-  "temp",
-  "test",
-  "tmp",
-  "trace"
-]);
-function nameWords(name) {
-  return name.replaceAll(/([a-z0-9])([A-Z])/gu, "$1 $2").split(/[^A-Za-z0-9]+/u).filter(Boolean).map((word) => word.toLowerCase());
-}
 function isStrongSecurityName(name) {
   const words2 = nameWords(name);
   return words2.some((word) => STRONG_SECURITY_WORDS.has(word)) || words2.some(
     (word, index) => word === "api" && words2[index + 1] === "key" || word === "auth" && words2[index + 1] === "id" || word === "verification" && words2[index + 1] === "code"
   );
 }
-function isNonSecurityName(name) {
-  return nameWords(name).some((word) => NON_SECURITY_ID_WORDS.has(word));
+function nameWords(name) {
+  return name.replaceAll(/([a-z0-9])([A-Z])/gu, "$1 $2").split(/[^A-Za-z0-9]+/u).filter(Boolean).map((word) => word.toLowerCase());
 }
-var PATH_OR_DOM_MARKER = /[\\/#]|\.[A-Za-z0-9]/;
 function isMathRandomCall(node) {
   if (node.type !== "CallExpression") {
     return false;
@@ -8769,67 +8747,6 @@ function findEnclosingNames(node) {
   }
   return names;
 }
-function isConcatenatedIntoPathOrDomId(node) {
-  const valueNode = climbValueChain(node);
-  let current = valueNode;
-  let parent = current.parent;
-  let top;
-  while (parent) {
-    if (parent.type === "BinaryExpression" && parent.operator === "+" && (parent.left === current || parent.right === current)) {
-      top = parent;
-      current = parent;
-      parent = current.parent;
-      continue;
-    }
-    if (parent.type === "TemplateLiteral") {
-      top = parent;
-      current = parent;
-      parent = current.parent;
-      continue;
-    }
-    break;
-  }
-  if (!top) {
-    return false;
-  }
-  const parts = [];
-  collectStaticStringParts(top, parts);
-  return parts.some((part) => PATH_OR_DOM_MARKER.test(part));
-}
-function climbValueChain(node) {
-  let current = node;
-  let parent = current.parent;
-  while (parent) {
-    if (parent.type === "MemberExpression" && parent.object === current && import_utils51.ASTUtils.getPropertyName(parent) !== null) {
-      current = parent;
-      parent = current.parent;
-      continue;
-    }
-    if (parent.type === "CallExpression" && parent.callee === current) {
-      current = parent;
-      parent = current.parent;
-      continue;
-    }
-    break;
-  }
-  return current;
-}
-function collectStaticStringParts(node, out) {
-  if (node.type === "Literal" && typeof node.value === "string") {
-    out.push(node.value);
-    return;
-  }
-  if (node.type === "TemplateLiteral") {
-    for (const quasi of node.quasis) {
-      out.push(quasi.value.cooked ?? quasi.value.raw);
-    }
-    return;
-  }
-  if (node.type === "BinaryExpression" && node.operator === "+") {
-    collectStaticStringParts(node.left, out);
-    collectStaticStringParts(node.right, out);
-  }
-}
 var no_insecure_random_id_default = createRule({
   name: "no-insecure-random-id",
   documentation: NO_INSECURE_RANDOM_ID_DOCUMENTATION,
@@ -8857,13 +8774,6 @@ var no_insecure_random_id_default = createRule({
         const names = findEnclosingNames(node);
         if (names.some(isStrongSecurityName)) {
           context.report({ node, messageId: "insecureRandomId" });
-          return;
-        }
-        if (names.some(isNonSecurityName)) {
-          return;
-        }
-        if (isConcatenatedIntoPathOrDomId(node)) {
-          return;
         }
       }
     };
@@ -9795,15 +9705,24 @@ function typeMayContainObject(type, checker) {
 function syntaxMayContainObject(node) {
   const expression = unwrapComparisonExpression(node);
   if (expression.type === import_utils55.AST_NODE_TYPES.ObjectExpression) return true;
+  if (expression.type === import_utils55.AST_NODE_TYPES.Literal) return "regex" in expression;
+  if (expression.type === import_utils55.AST_NODE_TYPES.TemplateLiteral || expression.type === import_utils55.AST_NODE_TYPES.UnaryExpression) return false;
   if (expression.type !== import_utils55.AST_NODE_TYPES.ArrayExpression) return null;
+  let unknown = false;
   for (const element of expression.elements) {
     if (element === null) continue;
-    if (element.type === import_utils55.AST_NODE_TYPES.SpreadElement) return null;
-    if (element.type !== import_utils55.AST_NODE_TYPES.Literal && !(element.type === import_utils55.AST_NODE_TYPES.TemplateLiteral && element.expressions.length === 0)) {
-      return true;
-    }
+    const result = element.type === import_utils55.AST_NODE_TYPES.SpreadElement ? null : syntaxMayContainObject(element);
+    if (result === true) return true;
+    if (result === null) unknown = true;
   }
-  return false;
+  return unknown ? null : false;
+}
+function untypedArrayMayContainObject(node) {
+  return node.elements.some((element) => {
+    if (element === null || element.type === import_utils55.AST_NODE_TYPES.SpreadElement) return false;
+    const value = unwrapComparisonExpression(element);
+    return value.type === import_utils55.AST_NODE_TYPES.ArrayExpression ? untypedArrayMayContainObject(value) : syntaxMayContainObject(value) !== false;
+  });
 }
 var no_json_stringify_object_equality_default = createRule({
   name: "no-json-stringify-object-equality",
@@ -9832,7 +9751,10 @@ var no_json_stringify_object_equality_default = createRule({
     function mayContainObject(node) {
       const syntax = syntaxMayContainObject(node);
       if (syntax !== null) return syntax;
-      if (services === null || checker === void 0) return false;
+      if (services === null || checker === void 0) {
+        const expression = unwrapComparisonExpression(node);
+        return expression.type === import_utils55.AST_NODE_TYPES.ArrayExpression && untypedArrayMayContainObject(expression);
+      }
       const type = checker.getTypeAtLocation(
         services.esTreeNodeToTSNodeMap.get(node)
       );