eslint-plugin-react-dom 2.0.0-next.52 → 2.0.0-next.53

package/dist/index.d.ts

@@ -2,6 +2,10 @@ import { CamelCase } from 'string-ts';
 import * as _typescript_eslint_utils_ts_eslint from '@typescript-eslint/utils/ts-eslint';
 import { RulePreset } from '@eslint-react/kit';
 
+declare const RULE_NAME$2 = "no-unsafe-target-blank";
+type MessageID$2 = CamelCase<typeof RULE_NAME$2> | RuleSuggestMessageID$2;
+type RuleSuggestMessageID$2 = "addRelNoreferrerNoopener";
+
 declare const RULE_NAME$1 = "no-missing-iframe-sandbox";
 type MessageID$1 = CamelCase<typeof RULE_NAME$1> | RuleSuggestMessageID$1;
 type RuleSuggestMessageID$1 = "addIframeSandbox";
@@ -33,7 +37,7 @@ declare const _default: {
                         readonly "no-script-url": _typescript_eslint_utils_ts_eslint.RuleModule<"noScriptUrl", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener>;
                         readonly "no-unknown-property": _typescript_eslint_utils_ts_eslint.RuleModule<"dataLowercaseRequired" | "invalidPropOnTag" | "unknownProp" | "unknownPropWithStandardName", unknown[], unknown, _typescript_eslint_utils_ts_eslint.RuleListener>;
                         readonly "no-unsafe-iframe-sandbox": _typescript_eslint_utils_ts_eslint.RuleModule<"noUnsafeIframeSandbox", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener>;
-                        readonly "no-unsafe-target-blank": _typescript_eslint_utils_ts_eslint.RuleModule<"noUnsafeTargetBlank", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener>;
+                        readonly "no-unsafe-target-blank": _typescript_eslint_utils_ts_eslint.RuleModule<MessageID$2, [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener>;
                         readonly "no-use-form-state": _typescript_eslint_utils_ts_eslint.RuleModule<"noUseFormState", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener>;
                         readonly "no-void-elements-with-children": _typescript_eslint_utils_ts_eslint.RuleModule<"noVoidElementsWithChildren", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener>;
                     };
@@ -65,7 +69,7 @@ declare const _default: {
         readonly "no-script-url": _typescript_eslint_utils_ts_eslint.RuleModule<"noScriptUrl", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener>;
         readonly "no-unknown-property": _typescript_eslint_utils_ts_eslint.RuleModule<"dataLowercaseRequired" | "invalidPropOnTag" | "unknownProp" | "unknownPropWithStandardName", unknown[], unknown, _typescript_eslint_utils_ts_eslint.RuleListener>;
         readonly "no-unsafe-iframe-sandbox": _typescript_eslint_utils_ts_eslint.RuleModule<"noUnsafeIframeSandbox", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener>;
-        readonly "no-unsafe-target-blank": _typescript_eslint_utils_ts_eslint.RuleModule<"noUnsafeTargetBlank", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener>;
+        readonly "no-unsafe-target-blank": _typescript_eslint_utils_ts_eslint.RuleModule<MessageID$2, [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener>;
         readonly "no-use-form-state": _typescript_eslint_utils_ts_eslint.RuleModule<"noUseFormState", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener>;
         readonly "no-void-elements-with-children": _typescript_eslint_utils_ts_eslint.RuleModule<"noVoidElementsWithChildren", [], unknown, _typescript_eslint_utils_ts_eslint.RuleListener>;
     };

package/dist/index.js

@@ -1,11 +1,11 @@
 import { getDocsUrl, getSettingsFromContext, DEFAULT_ESLINT_REACT_SETTINGS } from '@eslint-react/shared';
 import * as ER from '@eslint-react/core';
 import { ESLintUtils } from '@typescript-eslint/utils';
+import { unit } from '@eslint-react/eff';
 import * as AST from '@eslint-react/ast';
 import { AST_NODE_TYPES } from '@typescript-eslint/types';
 import { compare } from 'compare-versions';
 import { RegExp, Reporter } from '@eslint-react/kit';
-import { unit } from '@eslint-react/eff';
 
 var __defProp = Object.defineProperty;
 var __export = (target, all) => {
@@ -44,7 +44,7 @@ var settings = {
 
 // package.json
 var name2 = "eslint-plugin-react-dom";
-var version = "2.0.0-next.52";
+var version = "2.0.0-next.53";
 function createJsxElementResolver(context) {
   const { components, polymorphicPropName } = getSettingsFromContext(context);
   return {
@@ -89,6 +89,39 @@ var createRule = ESLintUtils.RuleCreator(getDocsUrl("dom"));
 function findCustomComponentProp(name3, props) {
   return props.findLast((a) => a.as === name3);
 }
+function resolveAttribute(context, attributes, elementNode, attributeName) {
+  const customComponentProp = findCustomComponentProp(attributeName, attributes);
+  const propNameOnJsx = customComponentProp?.name ?? attributeName;
+  const attribute = ER.getAttribute(
+    context,
+    propNameOnJsx,
+    elementNode.openingElement.attributes,
+    context.sourceCode.getScope(elementNode)
+  );
+  if (attribute == null) {
+    return {
+      attribute: unit,
+      attributeName: propNameOnJsx,
+      attributeValue: unit,
+      attributeValueString: customComponentProp?.defaultValue
+    };
+  }
+  const attributeValue = ER.getAttributeValue(context, attribute, propNameOnJsx);
+  if (attributeValue.kind === "some" && typeof attributeValue.value === "string") {
+    return {
+      attribute,
+      attributeName: propNameOnJsx,
+      attributeValue,
+      attributeValueString: attributeValue.value
+    };
+  }
+  return {
+    attribute,
+    attributeName: propNameOnJsx,
+    attributeValue: unit,
+    attributeValueString: customComponentProp?.defaultValue ?? unit
+  };
+}
 
 // src/rules/no-dangerously-set-innerhtml.ts
 var RULE_NAME = "no-dangerously-set-innerhtml";
@@ -322,6 +355,8 @@ function getFix(context, node) {
     ];
   };
 }
+
+// src/rules/no-missing-button-type.ts
 var RULE_NAME6 = "no-missing-button-type";
 var RULE_FEATURES6 = [
   "FIX"
@@ -351,40 +386,26 @@ function create6(context) {
     JSXElement(node) {
       const { attributes, domElementType } = resolver.resolve(node);
       if (domElementType !== "button") return;
-      const customComponentProp = findCustomComponentProp("type", attributes);
-      const propNameOnJsx = customComponentProp?.name ?? "type";
-      const attributeNode = ER.getAttribute(
-        context,
-        propNameOnJsx,
-        node.openingElement.attributes,
-        context.sourceCode.getScope(node)
-      );
-      if (attributeNode != null) {
-        const attributeValue = ER.getAttributeValue(
-          context,
-          attributeNode,
-          propNameOnJsx
-        );
-        if (attributeValue.kind !== "some" || typeof attributeValue.value !== "string") {
-          context.report({
-            messageId: "noMissingButtonType",
-            node: attributeNode,
-            suggest: getSuggest((type) => (fixer) => {
-              return fixer.replaceText(attributeNode, `${propNameOnJsx}="${type}"`);
-            })
-          });
-        }
-        return;
-      }
-      if (typeof customComponentProp?.defaultValue !== "string") {
+      const typeAttribute = resolveAttribute(context, attributes, node, "type");
+      if (typeAttribute.attributeValueString != null) return;
+      if (typeAttribute.attribute == null) {
         context.report({
           messageId: "noMissingButtonType",
-          node,
+          node: node.openingElement,
           suggest: getSuggest((type) => (fixer) => {
-            return fixer.insertTextAfter(node.openingElement.name, ` ${propNameOnJsx}="${type}"`);
+            return fixer.insertTextAfter(node.openingElement.name, ` ${typeAttribute.attributeName}="${type}"`);
           })
         });
+        return;
       }
+      context.report({
+        messageId: "noMissingButtonType",
+        node: typeAttribute.attributeValue?.node ?? typeAttribute.attribute,
+        suggest: getSuggest((type) => (fixer) => {
+          if (typeAttribute.attribute == null) return null;
+          return fixer.replaceText(typeAttribute.attribute, `${typeAttribute.attributeName}="${type}"`);
+        })
+      });
     }
   };
 }
@@ -395,6 +416,8 @@ function getSuggest(getFix4) {
     fix: getFix4(type)
   }));
 }
+
+// src/rules/no-missing-iframe-sandbox.ts
 var RULE_NAME7 = "no-missing-iframe-sandbox";
 var RULE_FEATURES7 = [
   "FIX"
@@ -424,52 +447,34 @@ function create7(context) {
     JSXElement(node) {
       const { attributes, domElementType } = resolver.resolve(node);
       if (domElementType !== "iframe") return;
-      const customComponentProp = findCustomComponentProp("sandbox", attributes);
-      const propNameOnJsx = customComponentProp?.name ?? "sandbox";
-      const attributeNode = ER.getAttribute(
-        context,
-        propNameOnJsx,
-        node.openingElement.attributes,
-        context.sourceCode.getScope(node)
-      );
-      if (attributeNode != null) {
-        const attributeValue = ER.getAttributeValue(
-          context,
-          attributeNode,
-          propNameOnJsx
-        );
-        if (attributeValue.kind !== "some" || typeof attributeValue.value !== "string") {
-          context.report({
-            messageId: "noMissingIframeSandbox",
-            node: attributeNode,
-            suggest: [
-              {
-                messageId: "addIframeSandbox",
-                data: { value: "" },
-                fix(fixer) {
-                  return fixer.replaceText(attributeNode, `${propNameOnJsx}=""`);
-                }
-              }
-            ]
-          });
-        }
-        return;
-      }
-      if (typeof customComponentProp?.defaultValue !== "string") {
+      const sandboxAttribute = resolveAttribute(context, attributes, node, "sandbox");
+      if (sandboxAttribute.attributeValueString != null) return;
+      if (sandboxAttribute.attribute == null) {
         context.report({
           messageId: "noMissingIframeSandbox",
-          node,
-          suggest: [
-            {
-              messageId: "addIframeSandbox",
-              data: { value: "" },
-              fix(fixer) {
-                return fixer.insertTextAfter(node.openingElement.name, ` ${propNameOnJsx}=""`);
-              }
+          node: node.openingElement,
+          suggest: [{
+            messageId: "addIframeSandbox",
+            data: { value: "" },
+            fix(fixer) {
+              return fixer.insertTextAfter(node.openingElement.name, ` ${sandboxAttribute.attributeName}=""`);
             }
-          ]
+          }]
         });
+        return;
       }
+      context.report({
+        messageId: "noMissingIframeSandbox",
+        node: sandboxAttribute.attributeValue?.node ?? sandboxAttribute.attribute,
+        suggest: [{
+          messageId: "addIframeSandbox",
+          data: { value: "" },
+          fix(fixer) {
+            if (sandboxAttribute.attribute == null) return null;
+            return fixer.replaceText(sandboxAttribute.attribute, `${sandboxAttribute.attributeName}=""`);
+          }
+        }]
+      });
     }
   };
 }
@@ -1743,12 +1748,14 @@ function testReactVersion(context, comparator, version2) {
   const { version: localVersion } = getSettingsFromContext(context);
   return compare(localVersion, version2, comparator);
 }
+
+// src/rules/no-unsafe-iframe-sandbox.ts
 var RULE_NAME13 = "no-unsafe-iframe-sandbox";
 var RULE_FEATURES12 = [];
 var unsafeSandboxValues = [
   ["allow-scripts", "allow-same-origin"]
 ];
-function hasSafeSandbox(value) {
+function isSafeSandbox(value) {
   if (typeof value !== "string") return false;
   return !unsafeSandboxValues.some((values) => {
     return values.every((v) => value.includes(v));
@@ -1776,40 +1783,22 @@ function create13(context) {
     JSXElement(node) {
       const { attributes, domElementType } = resolver.resolve(node);
       if (domElementType !== "iframe") return;
-      const customComponentProp = findCustomComponentProp("sandbox", attributes);
-      const propNameOnJsx = customComponentProp?.name ?? "sandbox";
-      const attributeNode = ER.getAttribute(
-        context,
-        propNameOnJsx,
-        node.openingElement.attributes,
-        context.sourceCode.getScope(node)
-      );
-      if (attributeNode != null) {
-        const attributeValue = ER.getAttributeValue(
-          context,
-          attributeNode,
-          propNameOnJsx
-        );
-        if (attributeValue.kind === "some" && !hasSafeSandbox(attributeValue.value)) {
-          context.report({
-            messageId: "noUnsafeIframeSandbox",
-            node: attributeNode
-          });
-          return;
-        }
-      }
-      if (customComponentProp?.defaultValue == null) return;
-      if (!hasSafeSandbox(customComponentProp.defaultValue)) {
+      const sandboxAttribute = resolveAttribute(context, attributes, node, "sandbox");
+      if (!isSafeSandbox(sandboxAttribute.attributeValueString)) {
         context.report({
           messageId: "noUnsafeIframeSandbox",
-          node
+          node: sandboxAttribute.attributeValue?.node ?? sandboxAttribute.attribute ?? node
         });
       }
     }
   };
 }
+
+// src/rules/no-unsafe-target-blank.ts
 var RULE_NAME14 = "no-unsafe-target-blank";
-var RULE_FEATURES13 = [];
+var RULE_FEATURES13 = [
+  "FIX"
+];
 function isExternalLinkLike(value) {
   if (value == null) return false;
   return value.startsWith("https://") || /^(?:\w+:|\/\/)/u.test(value);
@@ -1825,7 +1814,10 @@ var no_unsafe_target_blank_default = createRule({
       description: 'Disallow `target="_blank"` without `rel="noreferrer noopener"`.',
       [Symbol.for("rule_features")]: RULE_FEATURES13
     },
+    fixable: "code",
+    hasSuggestions: true,
     messages: {
+      addRelNoreferrerNoopener: `Add 'rel="noreferrer noopener"' to the link to prevent security risks.`,
       noUnsafeTargetBlank: `Using 'target="_blank"' on an external link without 'rel="noreferrer noopener"' is a security risk.`
     },
     schema: []
@@ -1840,35 +1832,44 @@ function create14(context) {
     JSXElement(node) {
       const { attributes, domElementType } = resolver.resolve(node);
       if (domElementType !== "a") return;
-      const elementScope = context.sourceCode.getScope(node);
-      const getAttributeStringValue = (name3) => {
-        const customComponentProp = findCustomComponentProp(name3, attributes);
-        const propNameOnJsx = customComponentProp?.name ?? name3;
-        const attributeNode = ER.getAttribute(
-          context,
-          propNameOnJsx,
-          node.openingElement.attributes,
-          elementScope
-        );
-        if (attributeNode == null) return customComponentProp?.defaultValue;
-        const attributeValue = ER.getAttributeValue(context, attributeNode, propNameOnJsx);
-        if (attributeValue.kind === "some" && typeof attributeValue.value === "string") {
-          return attributeValue.value;
-        }
-        return unit;
-      };
-      if (getAttributeStringValue("target") !== "_blank") {
+      const targetAttribute = resolveAttribute(context, attributes, node, "target");
+      if (targetAttribute.attributeValueString !== "_blank") {
+        return;
+      }
+      const hrefAttribute = resolveAttribute(context, attributes, node, "href");
+      if (!isExternalLinkLike(hrefAttribute.attributeValueString)) {
         return;
       }
-      if (!isExternalLinkLike(getAttributeStringValue("href"))) {
+      const relAttribute = resolveAttribute(context, attributes, node, "rel");
+      if (isSafeRel(relAttribute.attributeValueString)) {
         return;
       }
-      if (isSafeRel(getAttributeStringValue("rel"))) {
+      if (relAttribute.attribute == null) {
+        context.report({
+          messageId: "noUnsafeTargetBlank",
+          node: node.openingElement,
+          suggest: [{
+            messageId: "addRelNoreferrerNoopener",
+            fix(fixer) {
+              return fixer.insertTextAfter(
+                node.openingElement.name,
+                ` ${relAttribute.attributeName}="noreferrer noopener"`
+              );
+            }
+          }]
+        });
         return;
       }
       context.report({
         messageId: "noUnsafeTargetBlank",
-        node
+        node: relAttribute.attributeValue?.node ?? relAttribute.attribute,
+        suggest: [{
+          messageId: "addRelNoreferrerNoopener",
+          fix(fixer) {
+            if (relAttribute.attribute == null) return null;
+            return fixer.replaceText(relAttribute.attribute, `${relAttribute.attributeName}="noreferrer noopener"`);
+          }
+        }]
       });
     }
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-react-dom",
-  "version": "2.0.0-next.52",
+  "version": "2.0.0-next.53",
   "description": "ESLint React's ESLint plugin for React DOM related rules.",
   "keywords": [
     "react",
@@ -41,12 +41,12 @@
     "compare-versions": "^6.1.1",
     "string-ts": "^2.2.1",
     "ts-pattern": "^5.7.1",
-    "@eslint-react/ast": "2.0.0-next.52",
-    "@eslint-react/core": "2.0.0-next.52",
-    "@eslint-react/eff": "2.0.0-next.52",
-    "@eslint-react/kit": "2.0.0-next.52",
-    "@eslint-react/var": "2.0.0-next.52",
-    "@eslint-react/shared": "2.0.0-next.52"
+    "@eslint-react/ast": "2.0.0-next.53",
+    "@eslint-react/eff": "2.0.0-next.53",
+    "@eslint-react/kit": "2.0.0-next.53",
+    "@eslint-react/core": "2.0.0-next.53",
+    "@eslint-react/shared": "2.0.0-next.53",
+    "@eslint-react/var": "2.0.0-next.53"
   },
   "devDependencies": {
     "@types/react": "^19.1.8",