@stll/oxlint-plugin 0.2.1 → 0.3.0

package/dist/no-unsafe-inner-html.cjs

@@ -5,119 +5,511 @@ Object.defineProperties(exports, {
 const require_utils = require("./utils.cjs");
 let _oxlint_plugins = require("@oxlint/plugins");
 //#region src/no-unsafe-inner-html.ts
+const DOM_ELEMENT_PRODUCERS = [
+	{
+		name: "body",
+		kind: "property",
+		receiver: "document"
+	},
+	{
+		name: "head",
+		kind: "property",
+		receiver: "document"
+	},
+	{
+		name: "documentElement",
+		kind: "property",
+		receiver: "document"
+	},
+	{
+		name: "activeElement",
+		kind: "property",
+		receiver: "document"
+	},
+	{
+		name: "scrollingElement",
+		kind: "property",
+		receiver: "document"
+	},
+	{
+		name: "fullscreenElement",
+		kind: "property",
+		receiver: "document"
+	},
+	{
+		name: "createElement",
+		kind: "method",
+		receiver: "document"
+	},
+	{
+		name: "createElementNS",
+		kind: "method",
+		receiver: "document"
+	},
+	{
+		name: "getElementById",
+		kind: "method",
+		receiver: "document"
+	},
+	{
+		name: "querySelector",
+		kind: "method",
+		receiver: "either"
+	},
+	{
+		name: "closest",
+		kind: "method",
+		receiver: "element"
+	},
+	{
+		name: "elementFromPoint",
+		kind: "method",
+		receiver: "document"
+	},
+	{
+		name: "getElementsByClassName",
+		kind: "collection",
+		receiver: "either"
+	},
+	{
+		name: "getElementsByTagName",
+		kind: "collection",
+		receiver: "either"
+	},
+	{
+		name: "getElementsByTagNameNS",
+		kind: "collection",
+		receiver: "either"
+	},
+	{
+		name: "getElementsByName",
+		kind: "collection",
+		receiver: "document"
+	},
+	{
+		name: "querySelectorAll",
+		kind: "collection",
+		receiver: "either"
+	},
+	{
+		name: "parentElement",
+		kind: "property",
+		receiver: "element"
+	},
+	{
+		name: "firstElementChild",
+		kind: "property",
+		receiver: "element"
+	},
+	{
+		name: "lastElementChild",
+		kind: "property",
+		receiver: "element"
+	},
+	{
+		name: "nextElementSibling",
+		kind: "property",
+		receiver: "element"
+	},
+	{
+		name: "previousElementSibling",
+		kind: "property",
+		receiver: "element"
+	},
+	{
+		name: "offsetParent",
+		kind: "property",
+		receiver: "element"
+	}
+];
+const WAIVER_RE = /^\s*safe-html:\s*\S/u;
+const REACT_HTML_PROPS = [
+	{
+		name: "dangerouslySetInnerHTML",
+		kind: "payload",
+		htmlKey: "__html"
+	},
+	{
+		name: "srcDoc",
+		kind: "value"
+	},
+	{
+		name: "srcdoc",
+		kind: "value"
+	}
+];
+const REACT_ELEMENT_FACTORIES = /* @__PURE__ */ new Set([
+	"createElement",
+	"React.createElement",
+	"jsx",
+	"jsxs",
+	"jsxDEV"
+]);
+const HTML_PROPERTIES = /* @__PURE__ */ new Set([
+	"innerHTML",
+	"outerHTML",
+	"srcdoc"
+]);
+const HTML_FIRST_ARGUMENT_METHODS = /* @__PURE__ */ new Set(["createContextualFragment", "setHTMLUnsafe"]);
+const DOCUMENT_WRITE_METHODS = /* @__PURE__ */ new Set(["write", "writeln"]);
+const DOCUMENT_MEMBERS = /* @__PURE__ */ new Set([
+	"contentDocument",
+	"document",
+	"ownerDocument"
+]);
 const HTML_SANITIZER_LEAF_RE = /^(?:escape(?:html|xml)|sanitize(?:html|dom)|purify(?:html|dom)|dompurify)$/iu;
-const DOM_PURIFY_RE = /^dompurify$/iu;
 const SANITIZER_RESULT_MEMBERS = /* @__PURE__ */ new Set([
 	"value",
 	"data",
 	"html"
 ]);
-const ESCAPE_HATCH_RE = /^\s*safe-html:/u;
-const isComment = (value) => typeof value === "object" && value !== null && typeof value.value === "string" && typeof value.loc === "object" && value.loc !== null;
-const isJsxIdentifier = (node, name) => typeof node === "object" && node !== null && node.type === "JSXIdentifier" && node.name === name;
-const isHtmlSanitizerCalleeName = (dotted) => {
+const SANITIZER_POLICY = {
+	allowlist: "allowlist",
+	provenance: "provenance"
+};
+const SANITIZER_POLICY_VALUES = Object.values(SANITIZER_POLICY);
+const sanitizerPolicyFrom = (option) => {
+	if (option === void 0) return SANITIZER_POLICY.allowlist;
+	if (typeof option !== "object" || option === null || Array.isArray(option)) throw new Error("no-unsafe-inner-html options must be an object");
+	const policy = Reflect.get(option, "sanitizerPolicy");
+	switch (policy) {
+		case void 0:
+		case SANITIZER_POLICY.allowlist: return SANITIZER_POLICY.allowlist;
+		case SANITIZER_POLICY.provenance: return SANITIZER_POLICY.provenance;
+		default: throw new Error(`unknown sanitizer policy: ${String(policy)}`);
+	}
+};
+const staticCalleeName = (node) => {
+	const expression = require_utils.unwrapExpression(node);
+	if (require_utils.isIdentifier(expression)) return expression.name;
+	if (expression?.type !== "MemberExpression") return null;
+	const receiver = staticCalleeName(expression.object);
+	const property = require_utils.memberPropertyName(expression);
+	return receiver === null || property === null ? null : `${receiver}.${property}`;
+};
+const isSanitizerCall = (node) => {
+	if (!require_utils.isAstNode(node) || node.type !== "CallExpression") return false;
+	const dotted = staticCalleeName(node.callee);
+	if (dotted === null) return false;
 	const parts = dotted.split(".");
 	const leaf = parts.at(-1);
 	if (leaf === void 0) return false;
 	if (HTML_SANITIZER_LEAF_RE.test(leaf)) return true;
-	const objectName = parts.at(-2);
-	return leaf === "sanitize" && DOM_PURIFY_RE.test(objectName ?? "");
+	return leaf === "sanitize" && /^dompurify$/iu.test(parts.at(-2) ?? "");
 };
-const isSanitizerCall = (node) => {
-	if (node.type !== "CallExpression") return false;
-	const dotted = require_utils.getCalleeName(node.callee);
-	return dotted !== null && isHtmlSanitizerCalleeName(dotted);
+const isSanitizerResult = (node) => {
+	const expression = require_utils.unwrapExpression(node);
+	if (expression?.type !== "MemberExpression") return false;
+	const property = require_utils.memberPropertyName(expression);
+	return property !== null && SANITIZER_RESULT_MEMBERS.has(property) && isSanitizerCall(expression.object);
+};
+const hasLocation = (node) => typeof node === "object" && node !== null && "loc" in node && typeof node.loc === "object" && node.loc !== null && "start" in node.loc && typeof node.loc.start === "object" && node.loc.start !== null && "line" in node.loc.start && typeof node.loc.start.line === "number";
+const startLine = (node) => hasLocation(node) ? node.loc.start.line : NaN;
+const isWaiverComment = (value) => typeof value === "object" && value !== null && "value" in value && typeof value.value === "string" && WAIVER_RE.test(value.value) && "loc" in value && typeof value.loc === "object" && value.loc !== null;
+const jsxAttributeName = (node) => require_utils.isAstNode(node) && node.type === "JSXIdentifier" && typeof node.name === "string" ? node.name : null;
+const isProvenSafeValue = (node, sanitizerPolicy) => {
+	const expression = require_utils.unwrapExpression(node);
+	if (expression === null) return false;
+	if (require_utils.isStringLiteral(expression)) return true;
+	if (sanitizerPolicy === SANITIZER_POLICY.allowlist && (isSanitizerCall(expression) || isSanitizerResult(expression))) return true;
+	return expression.type === "TemplateLiteral" && Array.isArray(expression.expressions) && expression.expressions.every((entry) => isProvenSafeValue(entry, sanitizerPolicy));
 };
-const isProvenSafeValue = (node) => {
-	if (!node || typeof node.type !== "string") return false;
-	if (node.type === "Literal" && typeof node.value === "string") return true;
-	if (node.type === "TemplateLiteral") return Array.isArray(node.expressions) && node.expressions.every(isProvenSafeValue);
-	if (isSanitizerCall(node)) return true;
-	if (node.type === "MemberExpression" && node.computed === false && isProvenSafeMemberLeaf(node)) return true;
-	return false;
+const objectPropertyKey = (property) => {
+	if (!require_utils.isAstNode(property)) return null;
+	if (property.computed === true) return require_utils.staticStringValue(property.key);
+	return require_utils.getPropertyName(property.key);
 };
-const isProvenSafeMemberLeaf = (node) => {
-	const propertyName = require_utils.getPropertyName(node.property);
-	if (propertyName === null || !SANITIZER_RESULT_MEMBERS.has(propertyName)) return false;
-	return isSanitizerCall(node.object);
+const isOpaqueProperty = (property) => property.type === "SpreadElement" || property.type === "Property" && property.computed === true && objectPropertyKey(property) === null;
+const objectProperties = (node) => {
+	const expression = require_utils.unwrapExpression(node);
+	if (expression?.type !== "ObjectExpression" || !Array.isArray(expression.properties)) return [];
+	return expression.properties.filter(require_utils.isAstNode);
 };
-const isDangerouslySetInnerHtmlValue = (property) => {
-	if (require_utils.getPropertyName(property.key) !== "__html") return false;
-	const objectExpression = property.parent;
-	if (objectExpression?.type !== "ObjectExpression") return false;
-	let current = objectExpression.parent;
-	while (current?.type === "TSAsExpression" || current?.type === "TSSatisfiesExpression") current = current.parent;
-	if (current?.type !== "JSXExpressionContainer") return false;
-	const attribute = current.parent;
-	return attribute?.type === "JSXAttribute" && isJsxIdentifier(attribute.name, "dangerouslySetInnerHTML");
+const appliedArgumentsFor = (args) => {
+	const applied = require_utils.unwrapExpression(args.at(1));
+	if (applied === null || applied.type === "Literal" && applied.value === null || require_utils.isIdentifier(applied, "undefined")) return {
+		status: "known",
+		args: []
+	};
+	if (applied.type !== "ArrayExpression" || !Array.isArray(applied.elements)) return {
+		status: "opaque",
+		args: [],
+		spread: args.at(1),
+		tail: []
+	};
+	return require_utils.resolveLiteralArraySpreads(applied.elements);
+};
+const invokedArguments = (call) => {
+	if (!require_utils.isAstNode(call)) return {
+		status: "known",
+		args: []
+	};
+	const rawArguments = Array.isArray(call.arguments) ? call.arguments : [];
+	const resolved = require_utils.resolveLiteralArraySpreads(rawArguments);
+	const callee = require_utils.unwrapExpression(call.callee);
+	if (callee?.type !== "MemberExpression") return resolved;
+	const method = require_utils.memberPropertyName(callee);
+	if (method === "call") return {
+		...resolved,
+		args: resolved.args.slice(1)
+	};
+	if (method !== "apply") return resolved;
+	if (resolved.status === "opaque") {
+		if (resolved.args.length >= 2) return appliedArgumentsFor(resolved.args);
+		return {
+			...resolved,
+			args: [],
+			tail: []
+		};
+	}
+	return appliedArgumentsFor(resolved.args);
+};
+const isDocumentReceiver = (node) => {
+	const receiver = require_utils.unwrapExpression(node);
+	if (require_utils.isIdentifier(receiver, "document")) return true;
+	if (receiver?.type !== "MemberExpression") return false;
+	const name = require_utils.memberPropertyName(receiver);
+	return name !== null && DOCUMENT_MEMBERS.has(name);
 };
 var no_unsafe_inner_html_default = (0, _oxlint_plugins.eslintCompatPlugin)({
 	meta: { name: "no-unsafe-inner-html" },
 	rules: { "no-unsafe-inner-html": {
 		meta: {
 			type: "problem",
+			schema: [{
+				type: "object",
+				properties: { sanitizerPolicy: {
+					type: "string",
+					enum: SANITIZER_POLICY_VALUES
+				} },
+				additionalProperties: false
+			}],
 			messages: {
-				unsafeInnerHtml: "Raw HTML injected into the DOM must come from a provably sanitized/escaped value: a static string, an HTML/DOM sanitize/escape call (or its .value/.data/.html result). Wrap the value in a sanitizer, or add a `// safe-html: <reason naming the sanitizer/source>` comment on the line directly above if it is escaped at its source.",
+				unsafeInnerHtml: "Dynamic HTML injected into the DOM must be static, proven by the configured sanitizer policy, or have an adjacent `// safe-html: <provenance>` comment naming the trusted source. Function names outside the allowlist are not proof because a local identity function can shadow them.",
 				unsafeInnerHtmlSpread: "Do not spread an object into dangerouslySetInnerHTML. Keep `__html` inline so this rule can prove the HTML value is sanitized or escaped."
 			}
 		},
 		createOnce(context) {
-			const escapeHatchLines = /* @__PURE__ */ new Set();
-			const recordEscapeHatches = (node) => {
-				const comments = node && Array.isArray(node.comments) ? node.comments.filter(isComment) : [];
-				for (const comment of comments) if (ESCAPE_HATCH_RE.test(comment.value)) escapeHatchLines.add(comment.loc.end.line);
+			const isKnownDomTarget = ({ node, scope, seen = /* @__PURE__ */ new Set(), kind = "element" }) => {
+				const target = require_utils.unwrapExpression(node);
+				if (require_utils.isIdentifier(target)) {
+					let current = scope;
+					while (current !== null) {
+						const variable = current.set.get(target.name);
+						if (variable === void 0) {
+							current = current.upper;
+							continue;
+						}
+						if (variable.defs.length === 0) return kind === "element" && isDocumentReceiver(target);
+						if (seen.has(variable)) return false;
+						seen.add(variable);
+						const definition = variable.defs.at(0);
+						if (variable.defs.length !== 1 || definition?.type !== "Variable" || definition.node.type !== "VariableDeclarator" || definition.node.id.type !== "Identifier" || definition.node.init === null || variable.references.some((reference) => reference.isWrite() && !reference.init)) return false;
+						return isKnownDomTarget({
+							node: definition.node.init,
+							scope: context.sourceCode.getScope(definition.node),
+							seen,
+							kind
+						});
+					}
+				}
+				const hasProducerReceiver = (receiver, producer) => {
+					if (producer.receiver !== "element" && isDocumentReceiver(receiver)) return true;
+					return producer.receiver !== "document" && isKnownDomTarget({
+						node: receiver,
+						scope,
+						seen
+					});
+				};
+				const isElementCollection = (collection) => isKnownDomTarget({
+					node: collection,
+					scope,
+					seen,
+					kind: "collection"
+				});
+				if (kind === "element" && target?.type === "MemberExpression") {
+					const property = require_utils.memberPropertyName(target);
+					const producer = DOM_ELEMENT_PRODUCERS.find((entry) => entry.kind === "property" && entry.name === property);
+					if (producer !== void 0) return hasProducerReceiver(target.object, producer);
+					const index = require_utils.unwrapExpression(target.property);
+					if (target.computed === true && index?.type === "Literal" && typeof index.value === "number" && Number.isInteger(index.value) && index.value >= 0) return isElementCollection(target.object);
+				}
+				if (target?.type === "CallExpression") {
+					const callee = require_utils.invokedCallee(target);
+					if (callee?.type !== "MemberExpression") return false;
+					const method = require_utils.memberPropertyName(callee);
+					if (kind === "element" && method === "item" && isElementCollection(callee.object)) return true;
+					const producer = DOM_ELEMENT_PRODUCERS.find((entry) => entry.kind === (kind === "collection" ? "collection" : "method") && entry.name === method);
+					return producer !== void 0 && hasProducerReceiver(callee.object, producer);
+				}
+				return kind === "element" && isDocumentReceiver(target);
 			};
-			const hasEscapeHatchAbove = (node) => escapeHatchLines.has(node.loc.start.line - 1);
-			const reportIfUnsafe = (node) => {
-				if (isProvenSafeValue(node)) return;
-				if (hasEscapeHatchAbove(node)) return;
-				context.report({
+			let sanitizerPolicy = SANITIZER_POLICY.allowlist;
+			const waiverLines = /* @__PURE__ */ new Set();
+			const sinks = [];
+			const observeSink = (node, kind) => {
+				if (require_utils.isAstNode(node)) sinks.push({
 					node,
-					messageId: "unsafeInnerHtml"
+					kind
 				});
 			};
-			const reportPayloadSpreads = (objectNode) => {
-				for (const property of objectNode.properties) {
-					if (property?.type !== "SpreadElement") continue;
-					context.report({
-						node: property,
-						messageId: "unsafeInnerHtmlSpread"
-					});
+			const consumeWaiver = (node) => {
+				const line = startLine(node) - 1;
+				if (!waiverLines.has(line)) return false;
+				waiverLines.delete(line);
+				return true;
+			};
+			const reportIfUnsafe = (node) => {
+				observeSink(node, isProvenSafeValue(node, sanitizerPolicy) ? "safe" : "unsafe");
+			};
+			const checkDangerousPayload = (value, htmlKey) => {
+				const expression = require_utils.unwrapExpression(value);
+				if (expression?.type !== "ObjectExpression") {
+					reportIfUnsafe(value);
+					return;
+				}
+				for (const property of objectProperties(expression)) {
+					if (isOpaqueProperty(property)) {
+						observeSink(property, "opaque-payload");
+						continue;
+					}
+					if (property.type === "Property" && objectPropertyKey(property) === htmlKey) reportIfUnsafe(property.value);
+				}
+			};
+			const checkReactHtmlProp = (prop, value) => {
+				switch (prop.kind) {
+					case "payload":
+						checkDangerousPayload(value, prop.htmlKey);
+						return;
+					case "value":
+						reportIfUnsafe(value);
+						return;
+					default: throw new Error(`Unknown React HTML prop: ${String(prop)}`);
+				}
+			};
+			const checkHtmlPropertySources = (sources, domTarget) => {
+				for (const source of sources) {
+					if (require_utils.unwrapExpression(source)?.type !== "ObjectExpression") {
+						if (domTarget) reportIfUnsafe(source);
+						continue;
+					}
+					for (const property of objectProperties(source)) {
+						if (isOpaqueProperty(property)) {
+							if (domTarget) reportIfUnsafe(property);
+							continue;
+						}
+						const key = property.type === "Property" ? objectPropertyKey(property) : null;
+						if (key !== null && HTML_PROPERTIES.has(key)) reportIfUnsafe(property.value);
+					}
 				}
 			};
 			return {
 				before() {
-					escapeHatchLines.clear();
+					sanitizerPolicy = sanitizerPolicyFrom(context.options.at(0));
+					waiverLines.clear();
+					sinks.length = 0;
+				},
+				"Program:exit"() {
+					sinks.sort((left, right) => left.node.range[0] - right.node.range[0]);
+					for (const { node, kind } of sinks) {
+						const waived = consumeWaiver(node);
+						if (kind === "safe" || kind === "unsafe" && waived) continue;
+						context.report({
+							node,
+							messageId: kind === "opaque-payload" ? "unsafeInnerHtmlSpread" : "unsafeInnerHtml"
+						});
+					}
+					sinks.length = 0;
 				},
 				Program(node) {
-					recordEscapeHatches(node);
+					const comments = Array.isArray(node.comments) ? node.comments : [];
+					for (const comment of comments) if (isWaiverComment(comment)) waiverLines.add(comment.loc.end.line);
 				},
 				JSXAttribute(node) {
-					if (!isJsxIdentifier(node.name, "dangerouslySetInnerHTML")) return;
-					const value = node.value;
-					if (value?.type !== "JSXExpressionContainer") return;
-					if (!value.expression) return;
-					const expression = require_utils.unwrapExpression(value.expression);
-					if (expression?.type === "ObjectExpression") {
-						reportPayloadSpreads(expression);
-						return;
-					}
-					reportIfUnsafe(value.expression);
+					const name = jsxAttributeName(node.name);
+					const prop = REACT_HTML_PROPS.find((entry) => entry.name === name);
+					if (prop === void 0) return;
+					const value = require_utils.unwrapExpression(node.value);
+					checkReactHtmlProp(prop, value?.type === "JSXExpressionContainer" ? value.expression : value);
 				},
 				Property(node) {
-					if (!isDangerouslySetInnerHtmlValue(node)) return;
-					reportIfUnsafe(node.value);
+					const key = objectPropertyKey(node);
+					const prop = REACT_HTML_PROPS.find((entry) => entry.name === key);
+					if (prop?.kind !== "payload") return;
+					const container = node.parent;
+					if (require_utils.isAstNode(container) && container.type === "ObjectExpression") checkReactHtmlProp(prop, node.value);
 				},
 				AssignmentExpression(node) {
-					const target = node.left;
-					if (target.type !== "MemberExpression" || target.computed !== false || !require_utils.isIdentifier(target.property, "innerHTML")) return;
-					reportIfUnsafe(node.right);
+					const target = require_utils.unwrapExpression(node.left);
+					if (target?.type !== "MemberExpression") return;
+					const name = require_utils.memberPropertyName(target);
+					if (name !== null && HTML_PROPERTIES.has(name)) reportIfUnsafe(node.right);
+				},
+				CallExpression(node) {
+					const call = node;
+					const callee = require_utils.isAstNode(call) ? require_utils.invokedCallee(call) : null;
+					const invoked = invokedArguments(node);
+					const factory = staticCalleeName(callee);
+					if (factory !== null && REACT_ELEMENT_FACTORIES.has(factory)) {
+						for (const property of objectProperties(invoked.args.at(1))) {
+							if (property.type !== "Property") continue;
+							const key = objectPropertyKey(property);
+							const prop = REACT_HTML_PROPS.find((entry) => entry.name === key);
+							if (prop?.kind === "value") checkReactHtmlProp(prop, property.value);
+						}
+						return;
+					}
+					if (callee?.type !== "MemberExpression") return;
+					const method = require_utils.memberPropertyName(callee);
+					if (method === null) return;
+					if (HTML_FIRST_ARGUMENT_METHODS.has(method)) {
+						if (invoked.status === "opaque") {
+							reportIfUnsafe(node);
+							return;
+						}
+						reportIfUnsafe(invoked.args.at(0));
+						return;
+					}
+					if (method === "insertAdjacentHTML") {
+						if (invoked.status === "opaque") {
+							reportIfUnsafe(node);
+							return;
+						}
+						reportIfUnsafe(invoked.args.at(1));
+						return;
+					}
+					if (method === "setAttribute") {
+						if (invoked.status === "opaque") {
+							reportIfUnsafe(node);
+							return;
+						}
+						if (require_utils.staticStringValue(invoked.args.at(0))?.toLowerCase() === "srcdoc") reportIfUnsafe(invoked.args.at(1));
+						return;
+					}
+					if (DOCUMENT_WRITE_METHODS.has(method) && isDocumentReceiver(callee.object)) {
+						if (invoked.status === "opaque") {
+							reportIfUnsafe(node);
+							return;
+						}
+						observeSink(node, invoked.args.every((argument) => isProvenSafeValue(argument, sanitizerPolicy)) ? "safe" : "unsafe");
+						return;
+					}
+					if (require_utils.isIdentifier(callee.object, "Object") && method === "assign") {
+						const domTarget = isKnownDomTarget({
+							node: invoked.args.at(0),
+							scope: context.sourceCode.getScope(node)
+						});
+						checkHtmlPropertySources([...invoked.args.slice(1), ...invoked.status === "opaque" ? invoked.tail : []], domTarget);
+						if (invoked.status === "opaque" && domTarget) reportIfUnsafe(invoked.spread);
+					}
 				}
 			};
 		}
 	} }
 });
 //#endregion
+exports.DOM_ELEMENT_PRODUCERS = DOM_ELEMENT_PRODUCERS;
+exports.REACT_HTML_PROPS = REACT_HTML_PROPS;
 exports.default = no_unsafe_inner_html_default;
 
 //# sourceMappingURL=no-unsafe-inner-html.cjs.map