@sarj/eslint-plugin 19.15.0 → 19.17.0

package/dist/catalog.js

@@ -2,7 +2,7 @@ import {
   publicDocumentation,
   ruleSpec,
   src_default
-} from "./chunk-SIHWYU24.js";
+} from "./chunk-4USNCXB3.js";
 
 // src/docs/directive-disable-enable-pair.ts
 var DIRECTIVE_DISABLE_ENABLE_PAIR_DOCUMENTATION = {
@@ -636,6 +636,56 @@ var NO_BESPOKE_API_CASE_CONVERSION_DOCUMENTATION = {
   ]
 };
 
+// src/docs/no-blocked-input-paste.ts
+var NO_BLOCKED_INPUT_PASTE_DOCUMENTATION = {
+  defaultLevel: "warning",
+  summary: "Allow clipboard input when a text control has no replacement paste handling.",
+  rationale: "An editable text control that only cancels paste prevents users from entering generated passwords, authentication codes and copied data. This creates avoidable accessibility and password-manager barriers.",
+  remediation: "Allow native paste. If the product must normalize clipboard content, provide explicit replacement processing and preserve keyboard and password-manager access; review the behavior instead of applying an automatic edit.",
+  category: "correctness",
+  requiresTypeInformation: false,
+  limitations: [
+    "An unresolved alternate paste phase or spread may supply replacement handling and suppresses the warning.",
+    "Only intrinsic editable input and textarea handlers whose complete inline body is a direct preventDefault() call are reported.",
+    "Clipboard processing, conditional cancellation, referenced handlers, rich editors, non-text inputs, custom components, optional calls and uncertain effective props remain outside the detector."
+  ],
+  references: [
+    "https://github.com/GoogleChrome/modern-web-guidance/blob/4dd968349e54ca45a05dd5c818fb035c9054b022/skills/modern-web-guidance/guides/forms/forms.md",
+    "https://github.com/GoogleChrome/modern-web-guidance/blob/4dd968349e54ca45a05dd5c818fb035c9054b022/skills/modern-web-guidance/guides/forms/autofill-sign-in-form.md",
+    "https://github.com/GoogleChrome/modern-web-guidance/blob/4dd968349e54ca45a05dd5c818fb035c9054b022/skills/modern-web-guidance/guides/forms/sms-otp-form.md"
+  ],
+  examples: [
+    {
+      id: "native-paste",
+      title: "Allow native clipboard input",
+      outcome: "no-match",
+      files: [
+        {
+          path: "src/view.tsx",
+          source: '<input type="password" />'
+        }
+      ],
+      focusPath: "src/view.tsx",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "pure-paste-blocker",
+      title: "Review unconditional paste cancellation",
+      outcome: "match",
+      files: [
+        {
+          path: "src/view.tsx",
+          source: '<input type="password" onPaste={event => event.preventDefault()} />'
+        }
+      ],
+      focusPath: "src/view.tsx",
+      expectedCount: 1,
+      public: true
+    }
+  ]
+};
+
 // src/docs/no-boolean-selector-parameter.ts
 var NO_BOOLEAN_SELECTOR_PARAMETER_DOCUMENTATION = {
   summary: "Prefer intention-revealing operations over a boolean parameter selecting between actions.",
@@ -1918,6 +1968,88 @@ var NO_INVALID_TYPED_MUTATION_DOCUMENTATION = {
   ]
 };
 
+// src/docs/no-invalid-web-resource-hints.ts
+var NO_INVALID_WEB_RESOURCE_HINTS_DOCUMENTATION = {
+  defaultLevel: "warning",
+  summary: "Keep native resource hints consistent with browser loading and preload request modes.",
+  rationale: "Lazy loading delays even explicitly high-priority images until layout. Font preloads with incompatible credentials modes cannot satisfy the subsequent font request. The unsupported loading=auto value and obsolete importance attribute do not express supported native loading behavior. Oxlint 1.91 still accepts importance, so this advisory fills that verified upstream gap.",
+  remediation: "Review whether the image is critical or offscreen, use the matching loading policy, specify the preload destination, and use anonymous CORS for font preloads. Do not change request behavior automatically.",
+  category: "performance",
+  requiresTypeInformation: false,
+  limitations: [
+    "Only intrinsic JSX img, iframe, video, audio, script and link attributes are inspected. Custom framework media components, HTML strings and DOM mutations are outside this rule.",
+    "Stable local string bindings are resolved. Later unknown spreads and dynamic values remain unproven; explicit attributes after spreads can establish a finding.",
+    "The rule does not infer which element is LCP, count page-wide priority hints, require image dimensions that may come from CSS, or require sizes when 100vw may be correct."
+  ],
+  references: [
+    "https://github.com/GoogleChrome/modern-web-guidance/blob/4dd968349e54ca45a05dd5c818fb035c9054b022/skills/modern-web-guidance/guides/performance/optimize-image-priority.md",
+    "https://github.com/GoogleChrome/modern-web-guidance/blob/4dd968349e54ca45a05dd5c818fb035c9054b022/skills/modern-web-guidance/guides/performance/optimize-preload-priority.md",
+    "https://github.com/GoogleChrome/modern-web-guidance/blob/4dd968349e54ca45a05dd5c818fb035c9054b022/skills/modern-web-guidance/guides/performance/optimize-script-priority.md"
+  ],
+  examples: [
+    {
+      id: "eager-critical-image",
+      scenarioId: "image-loading",
+      title: "Load a declared critical image eagerly",
+      outcome: "no-match",
+      files: [
+        {
+          path: "src/view.tsx",
+          source: '<img loading="eager" fetchPriority="high" />'
+        }
+      ],
+      focusPath: "src/view.tsx",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "lazy-critical-image",
+      scenarioId: "image-loading",
+      title: "Review conflicting image hints",
+      outcome: "match",
+      files: [
+        {
+          path: "src/view.tsx",
+          source: '<img loading="lazy" fetchPriority="high" />'
+        }
+      ],
+      focusPath: "src/view.tsx",
+      expectedCount: 1,
+      public: true
+    },
+    {
+      id: "anonymous-font-preload",
+      scenarioId: "font-preload",
+      title: "Match the font request mode",
+      outcome: "no-match",
+      files: [
+        {
+          path: "src/view.tsx",
+          source: '<link rel="preload" as="font" href="/font.woff2" crossOrigin="anonymous" />'
+        }
+      ],
+      focusPath: "src/view.tsx",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "font-preload-without-cors",
+      scenarioId: "font-preload",
+      title: "Review a non-reusable font preload",
+      outcome: "match",
+      files: [
+        {
+          path: "src/view.tsx",
+          source: '<link rel="preload" as="font" href="/font.woff2" />'
+        }
+      ],
+      focusPath: "src/view.tsx",
+      expectedCount: 1,
+      public: true
+    }
+  ]
+};
+
 // src/docs/no-invalid-zod-custom-parse.ts
 var NO_INVALID_ZOD_CUSTOM_PARSE_DOCUMENTATION = {
   summary: "Do not parse an incompatible primitive literal through an unvalidated Zod custom schema.",
@@ -2179,6 +2311,55 @@ export function PortBars() { return null; }`
   ]
 };
 
+// src/docs/no-message-origin-string-matching.ts
+var NO_MESSAGE_ORIGIN_STRING_MATCHING_DOCUMENTATION = {
+  defaultLevel: "warning",
+  summary: "Compare incoming browser message origins against exact trusted origins.",
+  rationale: "Prefix, suffix and substring checks do not establish an origin trust boundary. For example, https://trusted.example.attacker.invalid passes a prefix check against https://trusted.example.",
+  remediation: "Compare exact allowlisted origins or parse the origin and validate the intended scheme, host and port. Reject opaque null origins unless a separately verified source/capability contract establishes trust; do not require an experimental Origin API.",
+  category: "security",
+  requiresTypeInformation: false,
+  limitations: [
+    "Only inline callbacks registered for message on ambient addEventListener, window, self or globalThis are tracked by variable identity.",
+    "Named listeners, event aliases, transformed origin strings, regular expressions and cross-file authorization helpers are not followed. Ordinary object.origin strings and shadowed globals are preserved.",
+    "This detects imprecise incoming origin matching, not all missing authorization checks. Outgoing target origins remain owned by Unicorn's require-post-message-target-origin rule."
+  ],
+  references: [
+    "https://github.com/GoogleChrome/modern-web-guidance/blob/4dd968349e54ca45a05dd5c818fb035c9054b022/skills/modern-web-guidance/guides/security/validate-origins.md",
+    "https://github.com/GoogleChrome/modern-web-guidance/blob/4dd968349e54ca45a05dd5c818fb035c9054b022/skills/modern-web-guidance/guides/security/security.md"
+  ],
+  examples: [
+    {
+      id: "exact-origin",
+      title: "Compare an explicit trusted origin",
+      outcome: "no-match",
+      files: [
+        {
+          path: "src/listener.ts",
+          source: 'window.addEventListener("message", event => { if (event.origin === "https://trusted.example") accept(event.data); });'
+        }
+      ],
+      focusPath: "src/listener.ts",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "prefix-origin",
+      title: "Review a spoofable origin prefix",
+      outcome: "match",
+      files: [
+        {
+          path: "src/listener.ts",
+          source: 'window.addEventListener("message", event => { if (event.origin.startsWith("https://trusted.example")) accept(event.data); });'
+        }
+      ],
+      focusPath: "src/listener.ts",
+      expectedCount: 1,
+      public: true
+    }
+  ]
+};
+
 // src/docs/no-mutating-container-transform.ts
 var NO_MUTATING_CONTAINER_TRANSFORM_DOCUMENTATION = {
   defaultLevel: "warning",
@@ -2382,6 +2563,55 @@ var NO_PARTIAL_TYPE_PREDICATE_DOCUMENTATION = {
   ]
 };
 
+// src/docs/no-password-get-form.ts
+var NO_PASSWORD_GET_FORM_DOCUMENTATION = {
+  defaultLevel: "warning",
+  summary: "Keep named password controls out of native GET form submissions.",
+  rationale: "Native GET submission serializes enabled, named password controls into the URL, exposing credentials through browser history and request logs. GET is also the default for missing or invalid method attributes.",
+  remediation: "Review the destination endpoint and submit credentials with POST. Keep server-side validation, HTTPS and the appropriate anti-CSRF protections; this rule only checks the native form serialization boundary.",
+  category: "security",
+  requiresTypeInformation: false,
+  limitations: [
+    "Only native form elements and direct intrinsic/fragment descendants are proved. Custom components, expressions, external form ownership, disabled fieldsets and unknown spreads are preserved.",
+    "Forms with custom submission handlers, function or dynamic actions, or dynamic methods are left to review. React function actions submit using POST even when the method is omitted.",
+    "Unnamed, empty-name and disabled password controls are not successful controls. The detector reports once per offending form and does not infer sensitive data from field names."
+  ],
+  references: [
+    "https://github.com/GoogleChrome/modern-web-guidance/blob/4dd968349e54ca45a05dd5c818fb035c9054b022/skills/modern-web-guidance/guides/forms/forms.md",
+    "https://github.com/GoogleChrome/modern-web-guidance/blob/4dd968349e54ca45a05dd5c818fb035c9054b022/skills/modern-web-guidance/guides/forms/autofill-sign-in-form.md"
+  ],
+  examples: [
+    {
+      id: "post-password",
+      title: "Submit the password with POST",
+      outcome: "no-match",
+      files: [
+        {
+          path: "src/view.tsx",
+          source: '<form method="post"><input type="password" name="password" /></form>'
+        }
+      ],
+      focusPath: "src/view.tsx",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "default-get-password",
+      title: "Review password serialization into the URL",
+      outcome: "match",
+      files: [
+        {
+          path: "src/view.tsx",
+          source: '<form><input type="password" name="password" /></form>'
+        }
+      ],
+      focusPath: "src/view.tsx",
+      expectedCount: 1,
+      public: true
+    }
+  ]
+};
+
 // src/docs/no-positional-tuple-return.ts
 var NO_POSITIONAL_TUPLE_RETURN_DOCUMENTATION = {
   summary: "Disallow returning a multi-field tuple from a named function; return a named object so call sites cannot mismatch slots.",
@@ -6223,14 +6453,15 @@ var REPEATED_STATIC_CALL_CASES_DOCUMENTATION = {
 
 // src/docs/require-assert-never.ts
 var REQUIRE_ASSERT_NEVER_DOCUMENTATION = {
-  summary: "Require an empty switch default to call `assertNever` so discriminated unions remain exhaustive at compile time.",
+  summary: "Require a never witness in empty switch defaults so discriminated unions remain exhaustive at compile time.",
   rationale: "An empty default silently accepts new union members instead of making the compiler identify the missing case.",
-  remediation: "Call `assertNever` with the discriminant in the exhaustive switch default.",
+  remediation: "Use `void (value satisfies never)` or a helper accepting never, preserving the intended runtime fallback.",
   category: "correctness",
   autofix: "safe",
   limitations: [
     "Requires type information and singleton case values covering the current union. The helper must accept never to provide a compile-time check; its spelling alone is not a proof of that contract. Review the desired runtime behavior for unexpected external values.",
-    "Automatic fixes reuse only an existing private ordinary assertNever function with one never parameter, explicit void return and an exactly empty body. The complete comment-free module must otherwise contain only one exported ordinary function with an explicit primitive return type, one string-literal-union parameter, a complete switch with primitive literal returns and a final empty or break default, followed by a primitive fallback return. The existing helper is called in that default, preserving unexpected-value continuation while adding the never compile guard. Throwing helpers, other statements or exports, imports, defaults, aliases and dynamic behavior remain manual."
+    "Unique-symbol alternatives are compared by native compiler type identity. Distinct symbols can share the same printed type name; a handled symbol or its typed alias covers only that identity. Unavailable literal names do not establish coverage.",
+    "Automatic fixes add void (parameter satisfies never), which only reads the existing parameter at runtime and introduces no helper dependency when the exported function is serialized on its own. The complete comment-free module must contain one exported ordinary function, optionally preceded by an exactly empty private ordinary assertNever helper with one never parameter and explicit void return. The dispatcher needs one string-literal-union parameter, an explicit primitive return type, a complete switch with primitive literal returns and a final empty or break default, followed by a primitive fallback return. Other module statements, imports, defaults, aliases, async functions and dynamic behavior remain manual."
   ],
   examples: [
     {
@@ -6263,18 +6494,18 @@ var REQUIRE_ASSERT_NEVER_DOCUMENTATION = {
     },
     {
       id: "safe-autofix",
-      title: "Reuse the existing no-op never guard",
+      title: "Keep the never witness local to the dispatcher",
       outcome: "match",
       files: [
         {
           path: "src/render.ts",
-          source: "function assertNever(_value: never): void {}\nexport function render(kind: 'a' | 'b'): number { switch (kind) { case 'a': return 1; case 'b': return 2; default: break; } return 0; }"
+          source: "export function render(kind: 'a' | 'b'): number { switch (kind) { case 'a': return 1; case 'b': return 2; default: break; } return 0; }"
         }
       ],
       fixedFiles: [
         {
           path: "src/render.ts",
-          source: "function assertNever(_value: never): void {}\nexport function render(kind: 'a' | 'b'): number { switch (kind) { case 'a': return 1; case 'b': return 2; default: assertNever(kind); break; } return 0; }"
+          source: "export function render(kind: 'a' | 'b'): number { switch (kind) { case 'a': return 1; case 'b': return 2; default: void (kind satisfies never); break; } return 0; }"
         }
       ],
       focusPath: "src/render.ts",
@@ -6564,6 +6795,53 @@ var REQUIRE_FETCH_TIMEOUT_DOCUMENTATION = {
   ]
 };
 
+// src/docs/require-ime-safe-enter-handler.ts
+var REQUIRE_IME_SAFE_ENTER_HANDLER_DOCUMENTATION = {
+  defaultLevel: "warning",
+  summary: "Preserve IME composition before Enter submits or blurs a native text control.",
+  rationale: "The Enter key confirms Japanese, Chinese and Korean composition as well as triggering custom actions. An unguarded native form submission or blur interrupts composing text.",
+  remediation: "Check the native keyboard event composition state before the action. Retain the Safari keyCode 229 or composition-timestamp fallback required by the browser policy; offer a native submit button.",
+  category: "correctness",
+  requiresTypeInformation: false,
+  limitations: [
+    "Only inline editable input/textarea keydown handlers with direct Enter equality (optionally combined with !shiftKey) and currentTarget.blur() or currentTarget.form.requestSubmit() are checked. Unknown guards and rebound event parameters remain unproven. Referenced handlers, custom components, arbitrary submission helpers, logical/conditional branches and DOM listeners need review.",
+    "The presence of a composition/keyCode/modifier check or composition listener suppresses the warning conservatively; this does not prove the guard dominates the action or implements the correct Safari fallback."
+  ],
+  references: [
+    "https://github.com/GoogleChrome/modern-web-guidance/blob/4dd968349e54ca45a05dd5c818fb035c9054b022/skills/modern-web-guidance/guides/forms/ime-safe-enter-submit.md"
+  ],
+  examples: [
+    {
+      id: "guarded-composition",
+      title: "guarded composition",
+      outcome: "no-match",
+      files: [
+        {
+          path: "src/input.tsx",
+          source: '<textarea onKeyDown={e => { if (e.nativeEvent.isComposing || e.nativeEvent.keyCode === 229) return; if (e.key === "Enter") { e.preventDefault(); e.currentTarget.form?.requestSubmit(); } }} />'
+        }
+      ],
+      focusPath: "src/input.tsx",
+      expectedCount: 0,
+      public: true
+    },
+    {
+      id: "interrupted-composition",
+      title: "interrupted composition",
+      outcome: "match",
+      files: [
+        {
+          path: "src/input.tsx",
+          source: '<textarea onKeyDown={e => { if (e.key === "Enter") e.currentTarget.form?.requestSubmit(); }} />'
+        }
+      ],
+      focusPath: "src/input.tsx",
+      expectedCount: 1,
+      public: true
+    }
+  ]
+};
+
 // src/docs/require-interface-for-exported-class.ts
 var REQUIRE_INTERFACE_FOR_EXPORTED_CLASS_DOCUMENTATION = {
   defaultLevel: "error",
@@ -7166,6 +7444,7 @@ var RULE_DOCUMENTATION = {
   "named-child-schema-type": NAMED_CHILD_SCHEMA_TYPE_DOCUMENTATION,
   "no-bare-return-from-test-catch": NO_BARE_RETURN_FROM_TEST_CATCH_DOCUMENTATION,
   "no-bespoke-api-case-conversion": NO_BESPOKE_API_CASE_CONVERSION_DOCUMENTATION,
+  "no-blocked-input-paste": NO_BLOCKED_INPUT_PASTE_DOCUMENTATION,
   "no-boolean-selector-parameter": NO_BOOLEAN_SELECTOR_PARAMETER_DOCUMENTATION,
   "no-broad-return-type": NO_BROAD_RETURN_TYPE_DOCUMENTATION,
   "no-client-side-data-fetching": NO_CLIENT_SIDE_DATA_FETCHING_DOCUMENTATION,
@@ -7199,6 +7478,7 @@ var RULE_DOCUMENTATION = {
   "no-in-operator-on-built-in-collections": NO_IN_OPERATOR_ON_BUILT_IN_COLLECTIONS_DOCUMENTATION,
   "no-insecure-random-id": NO_INSECURE_RANDOM_ID_DOCUMENTATION,
   "no-invalid-typed-mutation": NO_INVALID_TYPED_MUTATION_DOCUMENTATION,
+  "no-invalid-web-resource-hints": NO_INVALID_WEB_RESOURCE_HINTS_DOCUMENTATION,
   "no-invalid-zod-custom-parse": NO_INVALID_ZOD_CUSTOM_PARSE_DOCUMENTATION,
   "no-json-stringify-error": NO_JSON_STRINGIFY_ERROR_DOCUMENTATION,
   "no-json-stringify-object-equality": NO_JSON_STRINGIFY_OBJECT_EQUALITY_DOCUMENTATION,
@@ -7206,6 +7486,7 @@ var RULE_DOCUMENTATION = {
   "no-log-only-catch": NO_LOG_ONLY_CATCH_DOCUMENTATION,
   "no-logical-or-fallback": NO_LOGICAL_OR_FALLBACK_DOCUMENTATION,
   "no-long-comment": NO_LONG_COMMENT_DOCUMENTATION,
+  "no-message-origin-string-matching": NO_MESSAGE_ORIGIN_STRING_MATCHING_DOCUMENTATION,
   "no-mutating-container-transform": NO_MUTATING_CONTAINER_TRANSFORM_DOCUMENTATION,
   "no-mutating-input-with-result": NO_MUTATING_INPUT_WITH_RESULT_DOCUMENTATION,
   "no-negative-only-http-status-assertion": NO_NEGATIVE_ONLY_HTTP_STATUS_ASSERTION_DOCUMENTATION,
@@ -7213,6 +7494,7 @@ var RULE_DOCUMENTATION = {
   "no-offset-pagination": NO_OFFSET_PAGINATION_DOCUMENTATION,
   "no-oxlint-directive": NO_OXLINT_DIRECTIVE_DOCUMENTATION,
   "no-partial-type-predicate": NO_PARTIAL_TYPE_PREDICATE_DOCUMENTATION,
+  "no-password-get-form": NO_PASSWORD_GET_FORM_DOCUMENTATION,
   "no-positional-tuple-return": NO_POSITIONAL_TUPLE_RETURN_DOCUMENTATION,
   "no-production-browser-source-maps": NO_PRODUCTION_BROWSER_SOURCE_MAPS_DOCUMENTATION,
   "no-raw-env": NO_RAW_ENV_DOCUMENTATION,
@@ -7300,6 +7582,7 @@ var RULE_DOCUMENTATION = {
   "require-explicit-contract-implementation": REQUIRE_EXPLICIT_CONTRACT_IMPLEMENTATION_DOCUMENTATION,
   "require-explicit-service-contract": REQUIRE_EXPLICIT_SERVICE_CONTRACT_DOCUMENTATION,
   "require-fetch-timeout": REQUIRE_FETCH_TIMEOUT_DOCUMENTATION,
+  "require-ime-safe-enter-handler": REQUIRE_IME_SAFE_ENTER_HANDLER_DOCUMENTATION,
   "require-interface-for-exported-class": REQUIRE_INTERFACE_FOR_EXPORTED_CLASS_DOCUMENTATION,
   "require-jwt-lifetime": REQUIRE_JWT_LIFETIME_DOCUMENTATION,
   "require-pascal-case-zod-schema-name": REQUIRE_PASCAL_CASE_ZOD_SCHEMA_NAME_DOCUMENTATION,
@@ -7312,7 +7595,7 @@ var RULE_DOCUMENTATION = {
   "require-zod-form-validation": REQUIRE_ZOD_FORM_VALIDATION_DOCUMENTATION,
   "sole-export-matches-filename": SOLE_EXPORT_MATCHES_FILENAME_DOCUMENTATION,
   "source-coupled-test": SOURCE_COUPLED_TEST_DOCUMENTATION,
-  "stepdown": STEPDOWN_DOCUMENTATION,
+  stepdown: STEPDOWN_DOCUMENTATION,
   "store-insert-requires-on-conflict": STORE_INSERT_REQUIRES_ON_CONFLICT_DOCUMENTATION,
   "test-loops-over-literal-cases": TEST_LOOPS_OVER_LITERAL_CASES_DOCUMENTATION,
   "test-phase-label-comment": TEST_PHASE_LABEL_COMMENT_DOCUMENTATION