bahlint 28.58.6934

package/lib/rules/no-eval.js

@@ -0,0 +1,295 @@
+/**
+ * @fileoverview Rule to flag use of eval() statement
+ * @author Nicholas C. Zakas
+ */
+
+"use strict";
+
+//------------------------------------------------------------------------------
+// Requirements
+//------------------------------------------------------------------------------
+
+const astUtils = require("./utils/ast-utils");
+
+//------------------------------------------------------------------------------
+// Helpers
+//------------------------------------------------------------------------------
+
+const candidatesOfGlobalObject = Object.freeze([
+	"global",
+	"window",
+	"globalThis",
+]);
+
+/**
+ * Checks a given node is a MemberExpression node which has the specified name's
+ * property.
+ * @param {ASTNode} node A node to check.
+ * @param {string} name A name to check.
+ * @returns {boolean} `true` if the node is a MemberExpression node which has
+ *      the specified name's property
+ */
+function isMember(node, name) {
+	return astUtils.isSpecificMemberAccess(node, null, name);
+}
+
+//------------------------------------------------------------------------------
+// Rule Definition
+//------------------------------------------------------------------------------
+
+/** @type {import('../types').Rule.RuleModule} */
+module.exports = {
+	meta: {
+		type: "suggestion",
+
+		defaultOptions: [
+			{
+				allowIndirect: false,
+			},
+		],
+
+		docs: {
+			description: "Disallow the use of `eval()`",
+			recommended: false,
+			url: "https://eslint.org/docs/latest/rules/no-eval",
+		},
+
+		schema: [
+			{
+				type: "object",
+				properties: {
+					allowIndirect: { type: "boolean" },
+				},
+				additionalProperties: false,
+			},
+		],
+
+		messages: {
+			unexpected: "`eval` can be harmful.",
+		},
+	},
+
+	create(context) {
+		const [{ allowIndirect }] = context.options;
+		const sourceCode = context.sourceCode;
+		let funcInfo = null;
+
+		/**
+		 * Pushes a `this` scope (non-arrow function, class static block, or class field initializer) information to the stack.
+		 * Top-level scopes are handled separately.
+		 *
+		 * This is used in order to check whether or not `this` binding is a
+		 * reference to the global object.
+		 * @param {ASTNode} node A node of the scope.
+		 *      For functions, this is one of FunctionDeclaration, FunctionExpression.
+		 *      For class static blocks, this is StaticBlock.
+		 *      For class field initializers, this can be any node that is PropertyDefinition#value.
+		 * @returns {void}
+		 */
+		function enterThisScope(node) {
+			const strict = sourceCode.getScope(node).isStrict;
+
+			funcInfo = {
+				upper: funcInfo,
+				node,
+				strict,
+				isTopLevelOfScript: false,
+				defaultThis: false,
+				initialized: strict,
+			};
+		}
+
+		/**
+		 * Pops a variable scope from the stack.
+		 * @returns {void}
+		 */
+		function exitThisScope() {
+			funcInfo = funcInfo.upper;
+		}
+
+		/**
+		 * Reports a given node.
+		 *
+		 * `node` is `Identifier` or `MemberExpression`.
+		 * The parent of `node` might be `CallExpression`.
+		 *
+		 * The location of the report is always `eval` `Identifier` (or possibly
+		 * `Literal`). The type of the report is `CallExpression` if the parent is
+		 * `CallExpression`. Otherwise, it's the given node type.
+		 * @param {ASTNode} node A node to report.
+		 * @returns {void}
+		 */
+		function report(node) {
+			const parent = node.parent;
+			const locationNode =
+				node.type === "MemberExpression" ? node.property : node;
+
+			const reportNode =
+				parent.type === "CallExpression" && parent.callee === node
+					? parent
+					: node;
+
+			context.report({
+				node: reportNode,
+				loc: locationNode.loc,
+				messageId: "unexpected",
+			});
+		}
+
+		/**
+		 * Reports accesses of `eval` via the global object.
+		 * @param {eslint-scope.Scope} globalScope The global scope.
+		 * @returns {void}
+		 */
+		function reportAccessingEvalViaGlobalObject(globalScope) {
+			for (let i = 0; i < candidatesOfGlobalObject.length; ++i) {
+				const name = candidatesOfGlobalObject[i];
+				const variable = astUtils.getVariableByName(globalScope, name);
+
+				if (!variable) {
+					continue;
+				}
+
+				const references = variable.references;
+
+				for (let j = 0; j < references.length; ++j) {
+					const identifier = references[j].identifier;
+					let node = identifier.parent;
+
+					// To detect code like `window.window.eval`.
+					while (isMember(node, name)) {
+						node = node.parent;
+					}
+
+					// Reports.
+					if (isMember(node, "eval")) {
+						report(node);
+					}
+				}
+			}
+		}
+
+		/**
+		 * Reports all accesses of `eval` (excludes direct calls to eval).
+		 * @param {eslint-scope.Scope} globalScope The global scope.
+		 * @returns {void}
+		 */
+		function reportAccessingEval(globalScope) {
+			const variable = astUtils.getVariableByName(globalScope, "eval");
+
+			if (!variable) {
+				return;
+			}
+
+			const references = variable.references;
+
+			for (let i = 0; i < references.length; ++i) {
+				const reference = references[i];
+				const id = reference.identifier;
+
+				if (id.name === "eval" && !astUtils.isCallee(id)) {
+					// Is accessing to eval (excludes direct calls to eval)
+					report(id);
+				}
+			}
+		}
+
+		if (allowIndirect) {
+			// Checks only direct calls to eval. It's simple!
+			return {
+				"CallExpression:exit"(node) {
+					const callee = node.callee;
+
+					/*
+					 * Optional call (`eval?.("code")`) is not direct eval.
+					 * The direct eval is only step 6.a.vi of https://tc39.es/ecma262/#sec-function-calls-runtime-semantics-evaluation
+					 * But the optional call is https://tc39.es/ecma262/#sec-optional-chaining-chain-evaluation
+					 */
+					if (
+						!node.optional &&
+						astUtils.isSpecificId(callee, "eval")
+					) {
+						report(callee);
+					}
+				},
+			};
+		}
+
+		return {
+			"CallExpression:exit"(node) {
+				const callee = node.callee;
+
+				if (astUtils.isSpecificId(callee, "eval")) {
+					report(callee);
+				}
+			},
+
+			Program(node) {
+				const scope = sourceCode.getScope(node),
+					features =
+						context.languageOptions.parserOptions.ecmaFeatures ||
+						{},
+					strict =
+						scope.isStrict ||
+						node.sourceType === "module" ||
+						(features.globalReturn &&
+							scope.childScopes[0].isStrict),
+					isTopLevelOfScript =
+						node.sourceType !== "module" && !features.globalReturn;
+
+				funcInfo = {
+					upper: null,
+					node,
+					strict,
+					isTopLevelOfScript,
+					defaultThis: true,
+					initialized: true,
+				};
+			},
+
+			"Program:exit"(node) {
+				const globalScope = sourceCode.getScope(node);
+
+				exitThisScope();
+				reportAccessingEval(globalScope);
+				reportAccessingEvalViaGlobalObject(globalScope);
+			},
+
+			FunctionDeclaration: enterThisScope,
+			"FunctionDeclaration:exit": exitThisScope,
+			FunctionExpression: enterThisScope,
+			"FunctionExpression:exit": exitThisScope,
+			"PropertyDefinition > *.value": enterThisScope,
+			"PropertyDefinition > *.value:exit": exitThisScope,
+			StaticBlock: enterThisScope,
+			"StaticBlock:exit": exitThisScope,
+
+			ThisExpression(node) {
+				if (!isMember(node.parent, "eval")) {
+					return;
+				}
+
+				/*
+				 * `this.eval` is found.
+				 * Checks whether or not the value of `this` is the global object.
+				 */
+				if (!funcInfo.initialized) {
+					funcInfo.initialized = true;
+					funcInfo.defaultThis = astUtils.isDefaultThisBinding(
+						funcInfo.node,
+						sourceCode,
+					);
+				}
+
+				// `this` at the top level of scripts always refers to the global object
+				if (
+					funcInfo.isTopLevelOfScript ||
+					(!funcInfo.strict && funcInfo.defaultThis)
+				) {
+					// `this.eval` is possible built-in `eval`.
+					report(node.parent);
+				}
+			},
+		};
+	},
+};

package/lib/rules/no-ex-assign.js

@@ -0,0 +1,57 @@
+/**
+ * @fileoverview Rule to flag assignment of the exception parameter
+ * @author Stephen Murray <spmurrayzzz>
+ */
+
+"use strict";
+
+const astUtils = require("./utils/ast-utils");
+
+//------------------------------------------------------------------------------
+// Rule Definition
+//------------------------------------------------------------------------------
+
+/** @type {import('../types').Rule.RuleModule} */
+module.exports = {
+	meta: {
+		type: "problem",
+
+		docs: {
+			description: "Disallow reassigning exceptions in `catch` clauses",
+			recommended: true,
+			url: "https://eslint.org/docs/latest/rules/no-ex-assign",
+		},
+
+		schema: [],
+
+		messages: {
+			unexpected: "Do not assign to the exception parameter.",
+		},
+	},
+
+	create(context) {
+		const sourceCode = context.sourceCode;
+
+		/**
+		 * Finds and reports references that are non initializer and writable.
+		 * @param {Variable} variable A variable to check.
+		 * @returns {void}
+		 */
+		function checkVariable(variable) {
+			astUtils
+				.getModifyingReferences(variable.references)
+				.forEach(reference => {
+					context.report({
+						node: reference.identifier,
+						messageId: "unexpected",
+					});
+				});
+		}
+
+		return {
+			CatchClause(node) {
+				sourceCode.getDeclaredVariables(node).forEach(checkVariable);
+			},
+		};
+	},
+};

package/lib/rules/no-extend-native.js

@@ -0,0 +1,180 @@
+/**
+ * @fileoverview Rule to flag adding properties to native object's prototypes.
+ * @author David Nelson
+ */
+
+"use strict";
+
+//------------------------------------------------------------------------------
+// Requirements
+//------------------------------------------------------------------------------
+
+const astUtils = require("./utils/ast-utils");
+
+//------------------------------------------------------------------------------
+// Rule Definition
+//------------------------------------------------------------------------------
+
+/** @type {import('../types').Rule.RuleModule} */
+module.exports = {
+	meta: {
+		type: "suggestion",
+
+		defaultOptions: [{ exceptions: [] }],
+
+		docs: {
+			description: "Disallow extending native types",
+			recommended: false,
+			url: "https://eslint.org/docs/latest/rules/no-extend-native",
+		},
+
+		schema: [
+			{
+				type: "object",
+				properties: {
+					exceptions: {
+						type: "array",
+						items: {
+							type: "string",
+						},
+						uniqueItems: true,
+					},
+				},
+				additionalProperties: false,
+			},
+		],
+
+		messages: {
+			unexpected:
+				"{{builtin}} prototype is read only, properties should not be added.",
+		},
+	},
+
+	create(context) {
+		const sourceCode = context.sourceCode;
+		const exceptions = new Set(context.options[0].exceptions);
+		const modifiedBuiltins = new Set(
+			Object.keys(astUtils.ECMASCRIPT_GLOBALS)
+				.filter(builtin => builtin[0].toUpperCase() === builtin[0])
+				.filter(builtin => !exceptions.has(builtin)),
+		);
+
+		/**
+		 * Reports a lint error for the given node.
+		 * @param {ASTNode} node The node to report.
+		 * @param {string} builtin The name of the native builtin being extended.
+		 * @returns {void}
+		 */
+		function reportNode(node, builtin) {
+			context.report({
+				node,
+				messageId: "unexpected",
+				data: {
+					builtin,
+				},
+			});
+		}
+
+		/**
+		 * Check to see if the `prototype` property of the given object
+		 * identifier node is being accessed.
+		 * @param {ASTNode} identifierNode The Identifier representing the object
+		 * to check.
+		 * @returns {boolean} True if the identifier is the object of a
+		 * MemberExpression and its `prototype` property is being accessed,
+		 * false otherwise.
+		 */
+		function isPrototypePropertyAccessed(identifierNode) {
+			return Boolean(
+				identifierNode &&
+					identifierNode.parent &&
+					identifierNode.parent.type === "MemberExpression" &&
+					identifierNode.parent.object === identifierNode &&
+					astUtils.getStaticPropertyName(identifierNode.parent) ===
+						"prototype",
+			);
+		}
+
+		/**
+		 * Check if it's an assignment to the property of the given node.
+		 * Example: `*.prop = 0` // the `*` is the given node.
+		 * @param {ASTNode} node The node to check.
+		 * @returns {boolean} True if an assignment to the property of the node.
+		 */
+		function isAssigningToPropertyOf(node) {
+			return (
+				node.parent.type === "MemberExpression" &&
+				node.parent.object === node &&
+				node.parent.parent.type === "AssignmentExpression" &&
+				node.parent.parent.left === node.parent
+			);
+		}
+
+		/**
+		 * Checks if the given node is at the first argument of the method call of `Object.defineProperty()` or `Object.defineProperties()`.
+		 * @param {ASTNode} node The node to check.
+		 * @returns {boolean} True if the node is at the first argument of the method call of `Object.defineProperty()` or `Object.defineProperties()`.
+		 */
+		function isInDefinePropertyCall(node) {
+			return (
+				node.parent.type === "CallExpression" &&
+				node.parent.arguments[0] === node &&
+				astUtils.isSpecificMemberAccess(
+					node.parent.callee,
+					"Object",
+					/^definePropert(?:y|ies)$/u,
+				)
+			);
+		}
+
+		/**
+		 * Check to see if object prototype access is part of a prototype
+		 * extension. There are three ways a prototype can be extended:
+		 * 1. Assignment to prototype property (Object.prototype.foo = 1)
+		 * 2. Object.defineProperty()/Object.defineProperties() on a prototype
+		 * If prototype extension is detected, report the AssignmentExpression
+		 * or CallExpression node.
+		 * @param {ASTNode} identifierNode The Identifier representing the object
+		 * which prototype is being accessed and possibly extended.
+		 * @returns {void}
+		 */
+		function checkAndReportPrototypeExtension(identifierNode) {
+			if (!isPrototypePropertyAccessed(identifierNode)) {
+				return; // This is not `*.prototype` access.
+			}
+
+			/*
+			 * `identifierNode.parent` is a MemberExpression `*.prototype`.
+			 * If it's an optional member access, it may be wrapped by a `ChainExpression` node.
+			 */
+			const prototypeNode =
+				identifierNode.parent.parent.type === "ChainExpression"
+					? identifierNode.parent.parent
+					: identifierNode.parent;
+
+			if (isAssigningToPropertyOf(prototypeNode)) {
+				// `*.prototype` -> MemberExpression -> AssignmentExpression
+				reportNode(prototypeNode.parent.parent, identifierNode.name);
+			} else if (isInDefinePropertyCall(prototypeNode)) {
+				// `*.prototype` -> CallExpression
+				reportNode(prototypeNode.parent, identifierNode.name);
+			}
+		}
+
+		return {
+			"Program:exit"(node) {
+				const globalScope = sourceCode.getScope(node);
+
+				modifiedBuiltins.forEach(builtin => {
+					const builtinVar = globalScope.set.get(builtin);
+
+					if (builtinVar && builtinVar.references) {
+						builtinVar.references
+							.map(ref => ref.identifier)
+							.forEach(checkAndReportPrototypeExtension);
+					}
+				});
+			},
+		};
+	},
+};