@ttsc/lint 0.18.4 → 0.19.1

package/linthost/rules_react_extras.go

@@ -1,6 +1,8 @@
 package linthost
 
 import (
+  "sync/atomic"
+
   shimast "github.com/microsoft/typescript-go/shim/ast"
 )
 
@@ -32,7 +34,7 @@ func (reactJSXNoUndef) Check(ctx *Context, node *shimast.Node) {
   if first < 'A' || first > 'Z' {
     return
   }
-  if reactExtrasFileHasDeclaration(ctx.File.AsNode(), name) {
+  if ctx.reactDeclaredNames()[name] {
     return
   }
   ctx.Report(info.opening, "'"+name+"' is not defined.")
@@ -102,77 +104,101 @@ func reactExtrasOpeningTagNameNode(opening *shimast.Node) *shimast.Node {
   return nil
 }
 
-// reactExtrasFileHasDeclaration reports whether `name` is bound anywhere
-// in the source file by an import, function declaration, class
-// declaration, variable declaration, parameter, or enum declaration. The
-// walk is whole-file because JSX names resolve lexically in the
-// surrounding closure, not against a single statement list.
-func reactExtrasFileHasDeclaration(root *shimast.Node, name string) bool {
-  if root == nil || name == "" {
-    return false
+// reactDeclaredNamesKey is the fileMemo sentinel under which a file's set
+// of value-level declared names is cached.
+type reactDeclaredNamesKey struct{}
+
+// reactDeclaredNamesCollectCount records how many times
+// reactExtrasFileDeclaredNames walks a file. The memoized accessor triggers
+// it once per file, so a regression back to the per-tag walk makes this scale
+// with the JSX-element count — the property the scaling test pins. Read only
+// by tests; the per-file atomic add is negligible next to the walk it guards.
+var reactDeclaredNamesCollectCount atomic.Int64
+
+// reactDeclaredNames returns the set of value-level names declared anywhere
+// in this file, computed once per file and cached on the shared fileMemo so
+// react/jsx-no-undef does an O(1) membership check per capitalized tag rather
+// than walking the whole file per JSX element. Without a memo (a Context built
+// outside the engine) it recomputes, matching the pre-memoization behavior.
+func (c *Context) reactDeclaredNames() map[string]bool {
+  if cached, ok := c.fileValue(reactDeclaredNamesKey{}); ok {
+    return cached.(map[string]bool)
+  }
+  names := reactExtrasFileDeclaredNames(c.File.AsNode())
+  c.setFileValue(reactDeclaredNamesKey{}, names)
+  return names
+}
+
+// reactExtrasFileDeclaredNames collects every name bound in the source file
+// by an import, function declaration, class declaration, variable
+// declaration, parameter, or enum declaration. The walk is whole-file because
+// JSX names resolve lexically in the surrounding closure, not against a single
+// statement list; membership in the returned set answers exactly what the old
+// per-name predicate did, so react/jsx-no-undef's findings are unchanged.
+func reactExtrasFileDeclaredNames(root *shimast.Node) map[string]bool {
+  reactDeclaredNamesCollectCount.Add(1)
+  names := map[string]bool{}
+  if root == nil {
+    return names
+  }
+  add := func(name string) {
+    if name != "" {
+      names[name] = true
+    }
   }
-  found := false
   walkDescendants(root, func(child *shimast.Node) {
-    if found || child == nil {
+    if child == nil {
       return
     }
     switch child.Kind {
     case shimast.KindFunctionDeclaration:
-      if fn := child.AsFunctionDeclaration(); fn != nil && identifierText(fn.Name()) == name {
-        found = true
+      if fn := child.AsFunctionDeclaration(); fn != nil {
+        add(identifierText(fn.Name()))
       }
     case shimast.KindClassDeclaration:
-      if cl := child.AsClassDeclaration(); cl != nil && identifierText(cl.Name()) == name {
-        found = true
+      if cl := child.AsClassDeclaration(); cl != nil {
+        add(identifierText(cl.Name()))
       }
     case shimast.KindVariableDeclaration:
-      if v := child.AsVariableDeclaration(); v != nil && identifierText(v.Name()) == name {
-        found = true
+      if v := child.AsVariableDeclaration(); v != nil {
+        add(identifierText(v.Name()))
       }
     case shimast.KindParameter:
-      if p := child.AsParameterDeclaration(); p != nil && identifierText(p.Name()) == name {
-        found = true
+      if p := child.AsParameterDeclaration(); p != nil {
+        add(identifierText(p.Name()))
       }
     case shimast.KindEnumDeclaration:
-      if e := child.AsEnumDeclaration(); e != nil && identifierText(e.Name()) == name {
-        found = true
+      if e := child.AsEnumDeclaration(); e != nil {
+        add(identifierText(e.Name()))
       }
     case shimast.KindImportClause:
       clause := child.AsImportClause()
       if clause == nil {
         return
       }
-      if identifierText(clause.Name()) == name {
-        found = true
+      add(identifierText(clause.Name()))
+      if clause.NamedBindings == nil {
         return
       }
-      if clause.NamedBindings != nil {
-        switch clause.NamedBindings.Kind {
-        case shimast.KindNamespaceImport:
-          ns := clause.NamedBindings.AsNamespaceImport()
-          if ns != nil && identifierText(ns.Name()) == name {
-            found = true
-          }
-        case shimast.KindNamedImports:
-          named := clause.NamedBindings.AsNamedImports()
-          if named == nil || named.Elements == nil {
-            return
-          }
-          for _, spec := range named.Elements.Nodes {
-            s := spec.AsImportSpecifier()
-            if s == nil {
-              continue
-            }
-            if identifierText(s.Name()) == name {
-              found = true
-              return
-            }
+      switch clause.NamedBindings.Kind {
+      case shimast.KindNamespaceImport:
+        if ns := clause.NamedBindings.AsNamespaceImport(); ns != nil {
+          add(identifierText(ns.Name()))
+        }
+      case shimast.KindNamedImports:
+        named := clause.NamedBindings.AsNamedImports()
+        if named == nil || named.Elements == nil {
+          return
+        }
+        for _, spec := range named.Elements.Nodes {
+          if s := spec.AsImportSpecifier(); s != nil {
+            add(identifierText(s.Name()))
           }
         }
       }
     }
   })
-  return found
+  return names
 }
 
 // reactExtrasIsDisplayNameWrapperCall reports whether the call

package/linthost/rules_react_hooks.go

@@ -174,6 +174,9 @@ func (a *reactHooksAnalyzer) checkComponentHookFactories(root *shimast.Node) {
 
 func (a *reactHooksAnalyzer) checkSetStateInRender(root *shimast.Node) {
   walkDescendants(root, func(node *shimast.Node) {
+    if node == nil || node.Kind != shimast.KindCallExpression {
+      return
+    }
     call := node.AsCallExpression()
     if call == nil {
       return
@@ -192,6 +195,9 @@ func (a *reactHooksAnalyzer) checkSetStateInRender(root *shimast.Node) {
 
 func (a *reactHooksAnalyzer) checkSetStateInEffect(root *shimast.Node) {
   walkDescendants(root, func(node *shimast.Node) {
+    if node == nil || node.Kind != shimast.KindCallExpression {
+      return
+    }
     call := node.AsCallExpression()
     if call == nil {
       return
@@ -255,6 +261,9 @@ func (a *reactHooksAnalyzer) reportImmutableWrite(target *shimast.Node, reportNo
 
 func (a *reactHooksAnalyzer) checkRefs(root *shimast.Node) {
   walkDescendants(root, func(node *shimast.Node) {
+    if node == nil || node.Kind != shimast.KindPropertyAccessExpression {
+      return
+    }
     access := node.AsPropertyAccessExpression()
     if access == nil || identifierText(access.Name()) != "current" {
       return
@@ -281,6 +290,9 @@ func (a *reactHooksAnalyzer) collectFunctionBindings(fn *reactHooksFunction) {
     if a.nearestFunction(node) != fn {
       return
     }
+    if node == nil || node.Kind != shimast.KindVariableDeclaration {
+      return
+    }
     decl := node.AsVariableDeclaration()
     if decl == nil || decl.Initializer == nil {
       return
@@ -487,7 +499,11 @@ func isNamedReactCallee(node *shimast.Node, name string) bool {
 }
 
 func isNamedReactCalleeFromCall(node *shimast.Node, name string) bool {
-  call := stripParens(node).AsCallExpression()
+  node = stripParens(node)
+  if node == nil || node.Kind != shimast.KindCallExpression {
+    return false
+  }
+  call := node.AsCallExpression()
   return call != nil && isNamedReactCallee(call.Expression, name)
 }
 
@@ -563,7 +579,7 @@ func statementContainsOwnReturn(stmt *shimast.Node, fnNode *shimast.Node) bool {
 func functionContainsReactHookCall(node *shimast.Node) bool {
   found := false
   walkDescendants(reactFunctionBody(node), func(child *shimast.Node) {
-    if found || child == node {
+    if found || child == nil || child == node || child.Kind != shimast.KindCallExpression {
       return
     }
     call := child.AsCallExpression()

package/linthost/rules_react_perf.go

@@ -12,6 +12,7 @@ import (
 type reactPerfMatcher func(*shimast.Node) bool
 
 type reactPerfRule struct {
+  optionsRule
   name    string
   message string
   matcher reactPerfMatcher

package/linthost/rules_react_refresh.go

@@ -9,7 +9,7 @@ import (
 // onlyExportComponents enforces React Fast Refresh's module boundary rule:
 // files that export React components should not also export non-components.
 // Ported from eslint-plugin-react-refresh's only-export-components rule.
-type onlyExportComponents struct{}
+type onlyExportComponents struct{ optionsRule }
 
 type onlyExportComponentsOptions struct {
   ExtraHOCs           []string `json:"extraHOCs"`

package/linthost/rules_regexp.go

@@ -4,8 +4,10 @@ import (
   "sort"
   "strconv"
   "strings"
+  "unicode"
 
   shimast "github.com/microsoft/typescript-go/shim/ast"
+  shimscanner "github.com/microsoft/typescript-go/shim/scanner"
 )
 
 // regexpSourceRule implements the high-confidence, source-text subset of
@@ -145,6 +147,43 @@ func regexpHasEmptyLookaround(parts regexpLiteralParts) bool {
   })
 }
 
+// regexpHasEmptyCharacterClass reports non-negated character classes whose
+// parsed element list is empty. The compiler's regexp parser is the syntax
+// authority; the structural walk runs only after that parser accepts the full
+// literal, so malformed escapes, flags, and class-set expressions cannot
+// create lint findings.
+func regexpHasEmptyCharacterClass(parts regexpLiteralParts) bool {
+  if !shimscanner.IsValidRegularExpressionLiteral(parts.raw) {
+    return false
+  }
+  unicodeSets := strings.Contains(parts.flags, "v")
+  depth := 0
+  for i := 0; i < len(parts.pattern); i++ {
+    switch parts.pattern[i] {
+    case '\\':
+      i++
+    case '[':
+      if depth != 0 && !unicodeSets {
+        continue
+      }
+      depth++
+      content := i + 1
+      negated := content < len(parts.pattern) && parts.pattern[content] == '^'
+      if negated {
+        content++
+      }
+      if !negated && content < len(parts.pattern) && parts.pattern[content] == ']' {
+        return true
+      }
+    case ']':
+      if depth > 0 {
+        depth--
+      }
+    }
+  }
+  return false
+}
+
 func regexpHasZeroQuantifier(parts regexpLiteralParts) bool {
   return scanRegexpQuantifiers(parts.pattern, func(min, max int, hasComma bool) bool {
     return min == 0 && (!hasComma || max == 0)
@@ -205,11 +244,32 @@ func regexpFlagOrder(flag byte) int {
   return len(order) + int(flag)
 }
 
+// regexpHasUselessFlag decides `regexp/no-useless-flag` for the two flags whose
+// effect is visible in the pattern alone: `i` (nothing it could re-case) and `m`
+// (no `^`/`$` for it to re-anchor).
+//
+// Both questions are answered on the regexp AST from regex_tree.go rather than
+// on a byte scan. `scanRegexpPattern` never enters a character class -- correct
+// for the rules that hunt `|`, `(`, `{` outside classes, and correct for `m`
+// (`^`/`$` are literals inside a class), but fatal for `i`, because `[a-z]` is
+// exactly where the flag earns its keep.
+//
+// A literal the parser rejects yields no finding at all: the rule tells people
+// to delete a flag, so it stays silent whenever it cannot see the whole pattern.
 func regexpHasUselessFlag(parts regexpLiteralParts) bool {
-  if strings.Contains(parts.flags, "i") && !regexpPatternHasAsciiLetter(parts.pattern) {
+  ignoreCase := strings.Contains(parts.flags, "i")
+  multiline := strings.Contains(parts.flags, "m")
+  if !ignoreCase && !multiline {
+    return false
+  }
+  parsed, err := regexParseLiteral(parts.raw)
+  if err != nil {
+    return false
+  }
+  if ignoreCase && !regexpNodeIsCaseVariant(parsed.Body, strings.ContainsAny(parts.flags, "uv")) {
     return true
   }
-  if strings.Contains(parts.flags, "m") && !regexpPatternHasLineAnchor(parts.pattern) {
+  if multiline && !regexpNodeHasLineAnchor(parsed.Body) {
     return true
   }
   return false
@@ -365,17 +425,175 @@ func classHasRange(content string) bool {
   return false
 }
 
-func regexpPatternHasAsciiLetter(pattern string) bool {
-  return scanRegexpPattern(pattern, func(pattern string, i int) bool {
-    ch := pattern[i]
-    return (ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z')
-  })
+// regexpCaseFoldScanLimit bounds the fold scan of a single character range.
+// The scan exists to prove a range case-*invariant*, so refusing to walk an
+// unbounded one costs at most a missed report, never a wrong one. Every script
+// block that carries cased letters is orders of magnitude narrower than this.
+const regexpCaseFoldScanLimit = 0x20000
+
+// regexpNodeIsCaseVariant reports whether toggling the `i` flag can change what
+// the node matches.
+//
+// Mirrors eslint-plugin-regexp's `isCaseVariant(pattern, flags, false)`, which
+// judges a character class element by element rather than as a whole set: an
+// element that the flag widens keeps the flag alive even when the class already
+// spells both cases out, so `/[a-zA-Z]/i` is case-variant.
+//
+// The analysis is one-sided. Every construct it cannot settle from the AST --
+// a Unicode property escape, a `v`-mode set-notation class, a range too wide to
+// fold-scan, an unmodeled node -- counts as case-variant, so the rule stays
+// quiet rather than order a load-bearing flag deleted. Backreferences are
+// case-variant for a real reason and not merely out of caution: `i` makes the
+// backreference comparison itself case-insensitive, so `/(.)\1/i` matches "aA"
+// while `/(.)\1/` does not, without a single letter in the source.
+func regexpNodeIsCaseVariant(node regexNode, unicodeMode bool) bool {
+  switch n := node.(type) {
+  case nil:
+    return false
+  case *regexCharNode:
+    return regexpCharIsCaseVariant(n, unicodeMode)
+  case *regexClassRangeNode:
+    return regexpClassRangeIsCaseVariant(n, unicodeMode)
+  case *regexClassNode:
+    for _, expression := range n.Expressions {
+      if regexpNodeIsCaseVariant(expression, unicodeMode) {
+        return true
+      }
+    }
+    return false
+  case *regexAlternativeNode:
+    for _, expression := range n.Expressions {
+      if regexpNodeIsCaseVariant(expression, unicodeMode) {
+        return true
+      }
+    }
+    return false
+  case *regexDisjunctionNode:
+    return regexpNodeIsCaseVariant(n.Left, unicodeMode) ||
+      regexpNodeIsCaseVariant(n.Right, unicodeMode)
+  case *regexGroupNode:
+    // A group name is never matched against the input, so `/(?<year>\d{4})/i`
+    // stays case-invariant despite the letters in `year`.
+    return regexpNodeIsCaseVariant(n.Expression, unicodeMode)
+  case *regexRepetitionNode:
+    return regexpNodeIsCaseVariant(n.Expression, unicodeMode)
+  case *regexAssertionNode:
+    switch n.Kind {
+    case "^", "$":
+      return false
+    case "\\b", "\\B":
+      // Word boundaries are defined in terms of `\w`, which grows by U+017F and
+      // U+212A under `iu`/`iv`.
+      return unicodeMode
+    }
+    return regexpNodeIsCaseVariant(n.Assertion, unicodeMode)
+  case *regexBackreferenceNode:
+    // `i` canonicalizes the backreference comparison itself.
+    return true
+  case *regexUnicodePropertyNode:
+    // Whether `\p{...}` is closed under case folding needs the Unicode property
+    // tables, not the source text: `\p{Lu}` moves under `i`, `\p{Nd}` does not.
+    return true
+  case *regexClassSetNode:
+    // A `v`-mode set-notation class is kept verbatim by the parser, so its
+    // members are not available to judge.
+    return true
+  }
+  // An unmodeled node keeps the flag: silence beats a wrong deletion.
+  return true
 }
 
-func regexpPatternHasLineAnchor(pattern string) bool {
-  return scanRegexpPattern(pattern, func(pattern string, i int) bool {
-    return pattern[i] == '^' || pattern[i] == '$'
-  })
+// regexpCharIsCaseVariant reports whether the `i` flag widens what a single
+// character node matches.
+func regexpCharIsCaseVariant(char *regexCharNode, unicodeMode bool) bool {
+  if !char.codePointIsNaN() {
+    return regexpRuneIsCaseVariant(rune(char.CodePoint))
+  }
+  switch char.Kind {
+  case "meta":
+    switch char.Value {
+    case "\\w", "\\W":
+      // `\w` is the one character set the flag moves: in Unicode mode
+      // Canonicalize folds U+017F and U+212A onto `s` and `k`, so they join the
+      // word characters (and leave `\W`).
+      return unicodeMode
+    case "\\d", "\\D", "\\s", "\\S", ".", "\\b":
+      return false
+    }
+  case "decimal":
+    // Annex B `\8` and `\9` match the bare digits.
+    return false
+  case "control":
+    // `\cX` is a control code point, but a dangling `\c` matches the two
+    // characters `\` and `c`, and that `c` re-cases.
+    return char.Value == "\\c"
+  }
+  return true
+}
+
+// regexpClassRangeIsCaseVariant reports whether the `i` flag widens a character
+// class range. A range is case-variant as soon as it contains one code point
+// with a case-folded counterpart, because that counterpart may sit outside the
+// range.
+func regexpClassRangeIsCaseVariant(node *regexClassRangeNode, unicodeMode bool) bool {
+  if node.From == nil || node.To == nil {
+    return true
+  }
+  if node.From.codePointIsNaN() || node.To.codePointIsNaN() {
+    // Annex B reads `[\d-z]` as three independent members while the AST still
+    // models it as a range, so judge the two ends on their own.
+    return regexpCharIsCaseVariant(node.From, unicodeMode) ||
+      regexpCharIsCaseVariant(node.To, unicodeMode)
+  }
+  low, high := rune(node.From.CodePoint), rune(node.To.CodePoint)
+  if low > high || high-low >= regexpCaseFoldScanLimit {
+    return true
+  }
+  for r := low; r <= high; r++ {
+    if regexpRuneIsCaseVariant(r) {
+      return true
+    }
+  }
+  return false
+}
+
+// regexpRuneIsCaseVariant reports whether a code point has any case-folded
+// counterpart.
+//
+// unicode.SimpleFold walks the simple case-folding orbit, which is exactly the
+// equivalence class ECMAScript's Canonicalize builds in `u`/`v` mode. Legacy
+// mode canonicalizes more narrowly -- it keeps U+017F, U+212A and U+00DF apart
+// from their ASCII or uppercase partners -- so there the orbit is a superset,
+// and the rule at worst keeps quiet about a flag it could have reported.
+func regexpRuneIsCaseVariant(r rune) bool {
+  return unicode.SimpleFold(r) != r
+}
+
+// regexpNodeHasLineAnchor reports whether the pattern contains a `^` or `$`
+// assertion, the only thing the `m` flag re-defines. Character classes are not
+// descended into: `^` and `$` are literal characters in there.
+func regexpNodeHasLineAnchor(node regexNode) bool {
+  switch n := node.(type) {
+  case *regexAssertionNode:
+    if n.Kind == "^" || n.Kind == "$" {
+      return true
+    }
+    return regexpNodeHasLineAnchor(n.Assertion)
+  case *regexAlternativeNode:
+    for _, expression := range n.Expressions {
+      if regexpNodeHasLineAnchor(expression) {
+        return true
+      }
+    }
+    return false
+  case *regexDisjunctionNode:
+    return regexpNodeHasLineAnchor(n.Left) || regexpNodeHasLineAnchor(n.Right)
+  case *regexGroupNode:
+    return regexpNodeHasLineAnchor(n.Expression)
+  case *regexRepetitionNode:
+    return regexpNodeHasLineAnchor(n.Expression)
+  }
+  return false
 }
 
 func init() {
@@ -385,9 +603,7 @@ func init() {
   Register(regexpSourceRule{name: "regexp/no-dupe-characters-character-class", check: regexpHasDuplicateClassCharacter})
   Register(regexpSourceRule{name: "regexp/no-empty-alternative", check: regexpHasEmptyAlternative})
   Register(regexpSourceRule{name: "regexp/no-empty-capturing-group", check: regexpHasEmptyCapturingGroup})
-  Register(regexpSourceRule{name: "regexp/no-empty-character-class", check: func(parts regexpLiteralParts) bool {
-    return hasEmptyCharClass(parts.raw)
-  }})
+  Register(regexpSourceRule{name: "regexp/no-empty-character-class", check: regexpHasEmptyCharacterClass})
   Register(regexpSourceRule{name: "regexp/no-empty-group", check: regexpHasEmptyGroup})
   Register(regexpSourceRule{name: "regexp/no-empty-lookarounds-assertion", check: regexpHasEmptyLookaround})
   Register(regexpSourceRule{name: "regexp/no-misleading-unicode-character", check: func(parts regexpLiteralParts) bool {

package/linthost/rules_security.go

@@ -2,6 +2,7 @@ package linthost
 
 import (
   "strings"
+  "sync/atomic"
   "unicode/utf8"
 
   shimast "github.com/microsoft/typescript-go/shim/ast"
@@ -9,6 +10,33 @@ import (
 
 const securityRulePrefix = "security/"
 
+// securityBindingsKey is the fileMemo sentinel under which a file's
+// security binding table is cached. Every `security/*` rule shares the
+// identical file-invariant table, so keying it on the type — not on a
+// per-rule value — lets one walk serve all of them for the whole file.
+type securityBindingsKey struct{}
+
+// securityBindingsCollectCount records how many times collectSecurityBindings
+// actually walks a file. The memoized accessor triggers it once per file, so a
+// regression that reintroduces the per-node rebuild makes this scale with the
+// visited call-node count — the property the scaling test pins. Read only by
+// tests; the per-file atomic add is negligible next to the walk it guards.
+var securityBindingsCollectCount atomic.Int64
+
+// securityBindings returns this file's binding table, computing it once
+// per file and caching it on the shared fileMemo so every security rule
+// and every visited call/new node reuses one table instead of rebuilding
+// it. Without a memo (a Context built outside the engine) it recomputes,
+// matching the pre-memoization behavior exactly.
+func (c *Context) securityBindings() securityBindings {
+  if cached, ok := c.fileValue(securityBindingsKey{}); ok {
+    return cached.(securityBindings)
+  }
+  bindings := collectSecurityBindings(c.File)
+  c.setFileValue(securityBindingsKey{}, bindings)
+  return bindings
+}
+
 type securityDetectBidiCharacters struct{}
 
 func (securityDetectBidiCharacters) Name() string {
@@ -63,7 +91,7 @@ func (securityDetectChildProcess) Check(ctx *Context, node *shimast.Node) {
   if call == nil {
     return
   }
-  bindings := collectSecurityBindings(ctx.File)
+  bindings := ctx.securityBindings()
   if module, ok := requireCallModule(call); ok && isChildProcessModule(module) {
     if isInlineChildProcessExecRequire(node, bindings) {
       return
@@ -112,7 +140,7 @@ func (securityDetectEvalWithExpression) Check(ctx *Context, node *shimast.Node)
   if call == nil || callCalleeName(call) != "eval" || call.Arguments == nil || len(call.Arguments.Nodes) == 0 {
     return
   }
-  bindings := collectSecurityBindings(ctx.File)
+  bindings := ctx.securityBindings()
   if !isSecurityStaticExpression(call.Arguments.Nodes[0], bindings, nil) {
     ctx.Report(node, "eval called with a non-literal expression.")
   }
@@ -129,7 +157,7 @@ func (securityDetectNewBuffer) Check(ctx *Context, node *shimast.Node) {
   if expr == nil || identifierText(expr.Expression) != "Buffer" || expr.Arguments == nil || len(expr.Arguments.Nodes) == 0 {
     return
   }
-  bindings := collectSecurityBindings(ctx.File)
+  bindings := ctx.securityBindings()
   if !isSecurityStaticExpression(expr.Arguments.Nodes[0], bindings, nil) {
     ctx.Report(node, "Found new Buffer with a non-literal argument.")
   }
@@ -178,7 +206,7 @@ func (securityDetectNonLiteralFSFilename) Check(ctx *Context, node *shimast.Node
   if call == nil || call.Arguments == nil || len(call.Arguments.Nodes) == 0 {
     return
   }
-  bindings := collectSecurityBindings(ctx.File)
+  bindings := ctx.securityBindings()
   method, module, ok := fsCallInfo(call, bindings)
   if !ok || !isFSFilenameMethod(method) {
     return
@@ -215,7 +243,7 @@ func (securityDetectNonLiteralRegexp) Check(ctx *Context, node *shimast.Node) {
   if len(args) == 0 {
     return
   }
-  bindings := collectSecurityBindings(ctx.File)
+  bindings := ctx.securityBindings()
   if !isSecurityStaticExpression(args[0], bindings, nil) {
     ctx.Report(node, "Found non-literal argument to RegExp constructor.")
   }
@@ -234,7 +262,7 @@ func (securityDetectNonLiteralRequire) Check(ctx *Context, node *shimast.Node) {
   if call == nil || callCalleeName(call) != "require" || call.Arguments == nil || len(call.Arguments.Nodes) == 0 {
     return
   }
-  bindings := collectSecurityBindings(ctx.File)
+  bindings := ctx.securityBindings()
   if !isSecurityStaticExpression(call.Arguments.Nodes[0], bindings, nil) {
     ctx.Report(node, "Found non-literal argument in require.")
   }
@@ -323,6 +351,7 @@ type securityBindings struct {
 }
 
 func collectSecurityBindings(file *shimast.SourceFile) securityBindings {
+  securityBindingsCollectCount.Add(1)
   bindings := securityBindings{
     Modules: map[string]string{},
     Named:   map[string]securityNamedBinding{},
@@ -367,7 +396,7 @@ func collectSecurityAssignedNames(node *shimast.Node) map[string]bool {
         return
       }
       if expr.Operator == shimast.KindPlusPlusToken || expr.Operator == shimast.KindMinusMinusToken {
-        if name := identifierText(expr.Operand); name != "" {
+        for _, name := range assignmentTargetNames(expr.Operand) {
           assigned[name] = true
         }
       }
@@ -377,10 +406,18 @@ func collectSecurityAssignedNames(node *shimast.Node) map[string]bool {
         return
       }
       if expr.Operator == shimast.KindPlusPlusToken || expr.Operator == shimast.KindMinusMinusToken {
-        if name := identifierText(expr.Operand); name != "" {
+        for _, name := range assignmentTargetNames(expr.Operand) {
           assigned[name] = true
         }
       }
+    case shimast.KindForOfStatement, shimast.KindForInStatement:
+      stmt := child.AsForInOrOfStatement()
+      if stmt == nil || stmt.Initializer == nil || stmt.Initializer.Kind == shimast.KindVariableDeclarationList {
+        return
+      }
+      for _, name := range assignmentTargetNames(stmt.Initializer) {
+        assigned[name] = true
+      }
     }
   })
   return assigned
@@ -748,17 +785,6 @@ func isFalseLiteral(node *shimast.Node) bool {
   return ok && !value
 }
 
-func isEqualityOperator(kind shimast.Kind) bool {
-  switch kind {
-  case shimast.KindEqualsEqualsToken,
-    shimast.KindEqualsEqualsEqualsToken,
-    shimast.KindExclamationEqualsToken,
-    shimast.KindExclamationEqualsEqualsToken:
-    return true
-  }
-  return false
-}
-
 func containsSecretIdentifier(node *shimast.Node) bool {
   found := false
   walkDescendants(node, func(child *shimast.Node) {