@zimbra/eslint-config 2.1.1-main.96dc8a5.0 → 2.2.0

package/.circleci/config.yml

@@ -45,8 +45,15 @@ feature-branch: &feature-branch
   filters:
     branches:
       ignore:
+        - main
         - /(custom_)?release\/.*/
 
+main-branch: &main-branch
+  filters:
+    branches:
+      only:
+        - main
+
 ############################################################################
 # COMMANDS
 ############################################################################
@@ -126,7 +133,7 @@ jobs:
 workflows:
   version: 2
 
-  lint-and-publish:
+  commit-workflow:
     jobs:
       - lint:
           <<: *feature-branch
@@ -141,4 +148,15 @@ workflows:
           <<: *feature-branch
           <<: *env-context
           requires:
-            - publish-approval
+            - publish-approval
+
+  main-branch-workflow:
+    jobs:
+      - lint:
+          <<: *main-branch
+
+      - publish:
+          <<: *main-branch
+          <<: *env-context
+          requires:
+            - lint

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zimbra/eslint-config",
-  "version": "2.1.1-main.96dc8a5.0",
+  "version": "2.2.0",
   "type": "module",
   "description": "ESLint configuration for Zimbra javascript projects.",
   "main": "src/index.js",

package/src/configs/custom-config.js

@@ -1,5 +1,6 @@
 import customRules from '../rules/custom-rules/custom-rules.js';
 import noDirectMemoize from '../rules/custom-rules/no-direct-memoize.js';
+import noUnsafeWindowOpen from '../rules/custom-rules/no-unsafe-window-open.js';
 
 export default {
 	files: ['**/*.{js,jsx,mjs,cjs}'],
@@ -7,7 +8,8 @@ export default {
 	plugins: {
 		custom: {
 			rules: {
-				'no-direct-memoize': noDirectMemoize
+				'no-direct-memoize': noDirectMemoize,
+				'no-unsafe-window-open': noUnsafeWindowOpen
 			}
 		}
 	},

package/src/rules/custom-rules/custom-rules.js

@@ -1,3 +1,4 @@
 export default {
-	'custom/no-direct-memoize': 'error'
+	'custom/no-direct-memoize': 'error',
+	'custom/no-unsafe-window-open': 'error'
 };

package/src/rules/custom-rules/no-unsafe-window-open.js

@@ -0,0 +1,70 @@
+export default {
+	meta: {
+		type: 'problem',
+		docs: {
+			description: "Require 'noopener' in window.open() when target is '_blank'",
+			recommended: true
+		},
+		fixable: null,
+		messages: {
+			requireNoopener:
+				"Security risk: open() with '_blank' must include 'noopener' in the 3rd argument (e.g. 'noopener,noreferrer')."
+		},
+		schema: []
+	},
+
+	create(context) {
+		return {
+			CallExpression(node) {
+				const isWindowOpen =
+					node.callee.type === 'MemberExpression' &&
+					node.callee.object.name === 'window' &&
+					node.callee.property.name === 'open';
+
+				const isBareOpen = node.callee.type === 'Identifier' && node.callee.name === 'open';
+
+				if (!isWindowOpen && !isBareOpen) {
+					return;
+				}
+
+				const targetArg = node.arguments[1];
+				let isBlank = false;
+
+				if (!targetArg) {
+					isBlank = true;
+				} else if (targetArg.type === 'Literal' && typeof targetArg.value === 'string') {
+					if (targetArg.value.toLowerCase() === '_blank') {
+						isBlank = true;
+					}
+				} else {
+					// Skips genuinely dynamic values to avoid false positives
+					return;
+				}
+
+				if (!isBlank) {
+					return;
+				}
+
+				const featuresArg = node.arguments[2];
+
+				if (!featuresArg) {
+					context.report({
+						node,
+						messageId: 'requireNoopener'
+					});
+					return;
+				}
+
+				if (featuresArg.type === 'Literal' && typeof featuresArg.value === 'string') {
+					const features = featuresArg.value.split(',').map(s => s.trim().toLowerCase());
+					if (!features.includes('noopener')) {
+						context.report({
+							node,
+							messageId: 'requireNoopener'
+						});
+					}
+				}
+			}
+		};
+	}
+};

package/src/rules/react.js

@@ -16,6 +16,7 @@ export const reactRules = {
 
 	// Security related rules
 	'react/no-danger': 'error',
+	'react/jsx-no-target-blank': ['error', { allowReferrer: true }],
 
 	// TODO: Enable these rules once the codebase is updated to follow best practices
 	'react/react-in-jsx-scope': 'off',