eslint-plugin-reliability 3.0.0

package/src/rules/reliability/no-missing-null-checks.js

@@ -0,0 +1,351 @@
+"use strict";
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noMissingNullChecks = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const eslint_devkit_2 = require("@interlace/eslint-devkit");
+/**
+ * Check if property access has null/undefined check
+ */
+function hasNullCheck(node, sourceCode) {
+    // Check if node itself uses optional chaining
+    if (node.optional) {
+        return true;
+    }
+    // Check if parent is optional chaining
+    const parent = node.parent;
+    if (parent && parent.type === 'ChainExpression') {
+        return true; // Optional chaining handles null/undefined
+    }
+    // Check if used with nullish coalescing
+    if (usesNullishCoalescing(node)) {
+        return true;
+    }
+    // Check for basic explicit null checks in if statements
+    // This is a simplified check that looks for patterns like:
+    // if (obj !== null) { obj.property; }
+    if (hasExplicitNullCheck(node, sourceCode)) {
+        return true;
+    }
+    // For more sophisticated null checking, we'd need control flow analysis
+    // This is a simplified implementation that checks for basic patterns
+    return false;
+}
+/**
+ * Check for explicit null checks in if statements
+ */
+function hasExplicitNullCheck(node, sourceCode) {
+    // Walk up the AST to find if statements
+    let current = node;
+    let depth = 0;
+    const maxDepth = 10;
+    while (current && depth < maxDepth) {
+        const parent = current
+            .parent;
+        if (parent && parent.type === 'IfStatement') {
+            // Check if the test condition contains a null check for our object
+            const test = parent.test;
+            if (isNullCheckForObject(test, node.object, sourceCode)) {
+                return true;
+            }
+        }
+        current = parent;
+        depth++;
+    }
+    return false;
+}
+/**
+ * Check if a test expression is a null check for a specific object
+ */
+function isNullCheckForObject(test, object, sourceCode) {
+    // Handle binary expressions like obj !== null
+    if (test.type === 'BinaryExpression') {
+        const { left, right, operator } = test;
+        if (operator === '!==' ||
+            operator === '!=' ||
+            operator === '===' ||
+            operator === '==') {
+            const leftText = sourceCode.getText(left);
+            const rightText = sourceCode.getText(right);
+            const objectText = sourceCode.getText(object);
+            // Check if one side matches our object and the other is null/undefined
+            if ((leftText === objectText &&
+                (rightText === 'null' || rightText === 'undefined')) ||
+                (rightText === objectText &&
+                    (leftText === 'null' || leftText === 'undefined'))) {
+                return true;
+            }
+        }
+    }
+    // Handle logical expressions like obj !== null && obj !== undefined
+    if (test.type === 'LogicalExpression') {
+        return (isNullCheckForObject(test.left, object, sourceCode) ||
+            isNullCheckForObject(test.right, object, sourceCode));
+    }
+    return false;
+}
+/**
+ * Check if expression uses nullish coalescing
+ */
+function usesNullishCoalescing(node) {
+    let current = node;
+    let depth = 0;
+    const maxDepth = 5;
+    while (current && depth < maxDepth) {
+        const parent = current
+            .parent;
+        if (parent &&
+            parent.type === 'LogicalExpression' &&
+            parent.operator === '??') {
+            return true;
+        }
+        current = parent;
+        depth++;
+    }
+    return false;
+}
+exports.noMissingNullChecks = (0, eslint_devkit_2.createRule)({
+    name: 'no-missing-null-checks',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Detects potential null pointer dereferences',
+        },
+        hasSuggestions: true,
+        messages: {
+            missingNullCheck: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.WARNING,
+                issueName: 'Missing null check',
+                cwe: 'CWE-476',
+                description: 'Potential null/undefined dereference detected',
+                severity: 'HIGH',
+                fix: 'Use optional chaining (?.) or add explicit null check',
+                documentationLink: 'https://rules.sonarsource.com/javascript/RSPEC-2259/',
+            }),
+            useOptionalChaining: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use Optional Chaining',
+                description: 'Use optional chaining operator',
+                severity: 'LOW',
+                fix: 'obj?.property?.method()',
+                documentationLink: 'https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Optional_chaining',
+            }),
+            useNullishCoalescing: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use Nullish Coalescing',
+                description: 'Use nullish coalescing operator',
+                severity: 'LOW',
+                fix: 'value ?? defaultValue',
+                documentationLink: 'https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Nullish_coalescing',
+            }),
+            addExplicitCheck: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Add Explicit Check',
+                description: 'Add explicit null check',
+                severity: 'LOW',
+                fix: 'if (obj !== null) { obj.property }',
+                documentationLink: 'https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/null',
+            }),
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    ignoreInTests: {
+                        type: 'boolean',
+                        default: true,
+                        description: 'Ignore in test files',
+                    },
+                    requireExplicitChecks: {
+                        type: 'boolean',
+                        default: false,
+                        description: 'Require explicit null checks',
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            ignoreInTests: true,
+            requireExplicitChecks: false,
+        },
+    ],
+    create(context, [options = {}]) {
+        const { ignoreInTests = true,
+        // requireExplicitChecks = false, // Not used
+         } = options || {};
+        const filename = context.getFilename();
+        const isTestFile = ignoreInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
+        if (isTestFile) {
+            return {};
+        }
+        const sourceCode = context.sourceCode || context.sourceCode;
+        // Track reported MemberExpression nodes to prevent duplicate reports
+        // Key format: "start-end" from node.range
+        const reportedMemberExpressions = new Set();
+        /**
+         * Get a unique key for a MemberExpression node to track if it's been reported
+         */
+        function getMemberExpressionKey(node) {
+            // Use the node's range for a unique identifier
+            // Range is [start, end] character positions in the source
+            if (node.range && Array.isArray(node.range) && node.range.length >= 2) {
+                return `me-${node.range[0]}-${node.range[1]}`;
+            }
+            // Fallback: use location if range is not available
+            const loc = node
+                .loc;
+            if (loc && loc.start) {
+                return `me-${loc.start.line}-${loc.start.column}-${loc.end?.line || loc.start.line}-${loc.end?.column || loc.start.column}`;
+            }
+            // Last resort: use a hash of the node structure
+            return `me-${JSON.stringify(node).slice(0, 50)}`;
+        }
+        /**
+         * Check member expressions for null safety
+         */
+        function checkMemberExpression(node) {
+            // Skip if already using optional chaining
+            if (node.optional) {
+                return;
+            }
+            // Skip if parent is optional chaining
+            const parent = node
+                .parent;
+            if (parent && parent.type === 'ChainExpression') {
+                return;
+            }
+            // Only report on the "deepest" member expression in a chain
+            // If this member expression is the object of another member expression,
+            // don't report it yet - let the deepest one be reported
+            if (parent &&
+                parent.type === 'MemberExpression' &&
+                parent.object === node) {
+                return; // This is an intermediate member expression
+            }
+            // Check if object might be null/undefined
+            // Check for Identifier or nested MemberExpression
+            const objectNode = node.object;
+            let shouldCheck = false;
+            if (objectNode.type === 'Identifier') {
+                shouldCheck = true;
+            }
+            else if (objectNode.type === 'MemberExpression') {
+                // Nested member expressions like value.nested.deep
+                shouldCheck = true;
+            }
+            if (shouldCheck && !hasNullCheck(node, sourceCode)) {
+                const nodeKey = getMemberExpressionKey(node);
+                if (reportedMemberExpressions.has(nodeKey)) {
+                    return; // Already reported
+                }
+                try {
+                    reportedMemberExpressions.add(nodeKey);
+                    context.report({
+                        node,
+                        messageId: 'missingNullCheck',
+                        suggest: [
+                            {
+                                messageId: 'useOptionalChaining',
+                                fix: () => null,
+                            },
+                            {
+                                messageId: 'useNullishCoalescing',
+                                fix: () => null,
+                            },
+                            {
+                                messageId: 'addExplicitCheck',
+                                fix: () => null,
+                            },
+                        ],
+                    });
+                    /* c8 ignore next 4 -- defensive error handling, hard to trigger in tests */
+                }
+                catch {
+                    // Silently skip if there's an error
+                    return;
+                }
+            }
+        }
+        /**
+         * Check call expressions for null safety (e.g., obj.method())
+         * Only check if it's an actual method call, not just a property access
+         */
+        function checkCallExpression(node) {
+            /* c8 ignore next 4 -- defensive type check, always true when called by ESLint visitor */
+            // Ensure this is actually a CallExpression (not just a MemberExpression)
+            if (node.type !== 'CallExpression') {
+                return;
+            }
+            // Only check if callee is a member expression (e.g., obj.method())
+            // This ensures we only check method calls, not property accesses
+            if (node.callee.type === 'MemberExpression') {
+                const memberExpr = node.callee;
+                // Skip if already using optional chaining
+                if (memberExpr.optional) {
+                    return;
+                }
+                // Skip if parent is optional chaining
+                const parent = memberExpr.parent;
+                if (parent && parent.type === 'ChainExpression') {
+                    return;
+                }
+                // Skip if this MemberExpression was already reported by checkMemberExpression
+                // We can't easily check this, so we'll rely on the fact that CallExpression
+                // is only triggered for actual method calls, not property accesses
+                // Check if object might be null/undefined
+                const objectNode = memberExpr.object;
+                let shouldCheck = false;
+                if (objectNode.type === 'Identifier') {
+                    shouldCheck = true;
+                }
+                else if (objectNode.type === 'MemberExpression') {
+                    // Nested member expressions
+                    shouldCheck = true;
+                }
+                if (shouldCheck && !hasNullCheck(memberExpr, sourceCode)) {
+                    const nodeKey = getMemberExpressionKey(memberExpr);
+                    if (reportedMemberExpressions.has(nodeKey)) {
+                        return; // Already reported by checkMemberExpression
+                    }
+                    try {
+                        reportedMemberExpressions.add(nodeKey);
+                        context.report({
+                            node: memberExpr,
+                            messageId: 'missingNullCheck',
+                            suggest: [
+                                {
+                                    messageId: 'useOptionalChaining',
+                                    fix: () => null,
+                                },
+                                {
+                                    messageId: 'useNullishCoalescing',
+                                    fix: () => null,
+                                },
+                                {
+                                    messageId: 'addExplicitCheck',
+                                    fix: () => null,
+                                },
+                            ],
+                        });
+                        /* c8 ignore next 4 -- defensive error handling, hard to trigger in tests */
+                    }
+                    catch {
+                        // Silently skip if there's an error
+                        return;
+                    }
+                }
+            }
+        }
+        return {
+            MemberExpression: checkMemberExpression,
+            CallExpression: checkCallExpression,
+        };
+    },
+});

package/src/rules/reliability/no-unsafe-type-narrowing.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+/**
+ * ESLint Rule: no-unsafe-type-narrowing
+ * Detects unsafe type narrowing patterns
+ *
+ * @see https://rules.sonarsource.com/javascript/RSPEC-4326/
+ */
+import type { TSESLint } from '@interlace/eslint-devkit';
+type MessageIds = 'unsafeTypeNarrowing' | 'useTypeGuard' | 'useProperNarrowing' | 'validateBeforeAssert';
+export interface Options {
+    /** Ignore in test files. Default: true */
+    ignoreInTests?: boolean;
+    /** Allow type assertions with comments. Default: false */
+    allowWithComment?: boolean;
+}
+type RuleOptions = [Options?];
+export declare const noUnsafeTypeNarrowing: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
+    name: string;
+};
+export {};

package/src/rules/reliability/no-unsafe-type-narrowing.js

@@ -0,0 +1,176 @@
+"use strict";
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noUnsafeTypeNarrowing = void 0;
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+const eslint_devkit_2 = require("@interlace/eslint-devkit");
+/**
+ * Check if type assertion is unsafe (as unknown as T)
+ */
+function isUnsafeTypeAssertion(node) {
+    // Check for double assertion pattern: as unknown as T or as any as T
+    if (node.expression.type === 'TSAsExpression') {
+        const innerAssertion = node.expression;
+        // Check if inner assertion is to 'unknown'
+        if (innerAssertion.typeAnnotation.type === 'TSUnknownKeyword') {
+            return true; // as unknown as T pattern
+        }
+        // Also check for 'any' type
+        if (innerAssertion.typeAnnotation.type === 'TSAnyKeyword') {
+            return true; // as any as T pattern
+        }
+    }
+    // Don't flag direct assertions to unknown/any - those are handled by TSC
+    // Only flag the double assertion pattern which bypasses type safety
+    return false;
+}
+/**
+ * Check if type assertion has explanatory comment
+ */
+function hasExplanatoryComment(node, sourceCode) {
+    const comments = sourceCode.getAllComments();
+    const nodeStart = node.loc?.start;
+    if (!nodeStart || !comments.length) {
+        return false;
+    }
+    // Look for explanatory comments near the type assertion
+    const explanatoryPatterns = [
+        /type.?guard/i,
+        /validated/i,
+        /checked/i,
+        /safe/i,
+        /known/i,
+        /intentional/i,
+        /necessary/i,
+        /framework/i,
+        /library/i,
+        /third.?party/i,
+        /legacy/i,
+        /todo/i,
+        /fixme/i,
+    ];
+    // Check comments before the assertion (within 1 line)
+    for (const comment of comments) {
+        if (comment.loc && nodeStart.line - comment.loc.end.line <= 1) {
+            const commentText = comment.value.toLowerCase();
+            if (explanatoryPatterns.some((pattern) => pattern.test(commentText))) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+exports.noUnsafeTypeNarrowing = (0, eslint_devkit_2.createRule)({
+    name: 'no-unsafe-type-narrowing',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Detects unsafe type narrowing patterns',
+        },
+        hasSuggestions: true,
+        messages: {
+            unsafeTypeNarrowing: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.WARNING,
+                issueName: 'Unsafe type narrowing',
+                description: 'Unsafe type assertion or narrowing detected',
+                severity: 'MEDIUM',
+                fix: 'Use type guards or proper validation before type assertion',
+                documentationLink: 'https://rules.sonarsource.com/javascript/RSPEC-4326/',
+            }),
+            useTypeGuard: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use Type Guard',
+                description: 'Use type guard function',
+                severity: 'LOW',
+                fix: 'function isType(value: unknown): value is Type { return ... }',
+                documentationLink: 'https://www.typescriptlang.org/docs/handbook/2/narrowing.html#using-type-predicates',
+            }),
+            useProperNarrowing: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Use Type Narrowing',
+                description: 'Use proper type narrowing',
+                severity: 'LOW',
+                fix: 'if (typeof value === "string") { ... }',
+                documentationLink: 'https://www.typescriptlang.org/docs/handbook/2/narrowing.html',
+            }),
+            validateBeforeAssert: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.INFO,
+                issueName: 'Validate First',
+                description: 'Validate before type assertion',
+                severity: 'LOW',
+                fix: 'if (isValid(value)) { const typed = value as Type; }',
+                documentationLink: 'https://www.typescriptlang.org/docs/handbook/2/narrowing.html',
+            }),
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    ignoreInTests: {
+                        type: 'boolean',
+                        default: true,
+                        description: 'Ignore in test files',
+                    },
+                    allowWithComment: {
+                        type: 'boolean',
+                        default: false,
+                        description: 'Allow type assertions with comments',
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+    defaultOptions: [
+        {
+            ignoreInTests: true,
+            allowWithComment: false,
+        },
+    ],
+    create(context, [options = {}]) {
+        const { ignoreInTests = true, allowWithComment = false } = options || {};
+        const filename = context.getFilename();
+        const isTestFile = ignoreInTests && /\.(test|spec)\.(ts|tsx|js|jsx)$/.test(filename);
+        if (isTestFile) {
+            return {};
+        }
+        const sourceCode = context.sourceCode || context.sourceCode;
+        /**
+         * Check type assertions
+         */
+        function checkTypeAssertion(node) {
+            if (!isUnsafeTypeAssertion(node)) {
+                return;
+            }
+            // Check if comment explains the unsafe assertion
+            if (allowWithComment && hasExplanatoryComment(node, sourceCode)) {
+                return;
+            }
+            context.report({
+                node,
+                messageId: 'unsafeTypeNarrowing',
+                suggest: [
+                    {
+                        messageId: 'useTypeGuard',
+                        fix: () => null, // Cannot auto-fix without context
+                    },
+                    {
+                        messageId: 'useProperNarrowing',
+                        fix: () => null,
+                    },
+                    {
+                        messageId: 'validateBeforeAssert',
+                        fix: () => null,
+                    },
+                ],
+            });
+        }
+        return {
+            TSAsExpression: checkTypeAssertion,
+        };
+    },
+});

package/src/rules/reliability/require-network-timeout.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+export interface Options {
+}
+type RuleOptions = [Options?];
+export declare const requireNetworkTimeout: import("@typescript-eslint/utils/ts-eslint").RuleModule<"violationDetected", RuleOptions, unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener> & {
+    name: string;
+};
+export {};

package/src/rules/reliability/require-network-timeout.js

@@ -0,0 +1,57 @@
+"use strict";
+/**
+ * Copyright (c) 2025 Ofri Peretz
+ * Licensed under the MIT License. Use of this source code is governed by the
+ * MIT license that can be found in the LICENSE file.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireNetworkTimeout = void 0;
+/**
+ * @fileoverview Require timeout limits for network requests
+ * @see https://owasp.org/www-project-mobile-top-10/
+ * @see https://cwe.mitre.org/data/definitions/770.html
+ */
+const eslint_devkit_1 = require("@interlace/eslint-devkit");
+exports.requireNetworkTimeout = (0, eslint_devkit_1.createRule)({
+    name: 'require-network-timeout',
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Require timeout limits for network requests',
+        },
+        messages: {
+            violationDetected: (0, eslint_devkit_1.formatLLMMessage)({
+                icon: eslint_devkit_1.MessageIcons.SECURITY,
+                issueName: 'violation Detected',
+                cwe: 'CWE-400',
+                description: 'Require timeout limits for network requests detected - fetch/axios without timeout option',
+                severity: 'MEDIUM',
+                fix: 'Review and apply secure practices',
+                documentationLink: 'https://cwe.mitre.org/data/definitions/400.html',
+            }),
+        },
+        schema: [],
+    },
+    defaultOptions: [],
+    create(context) {
+        return {
+            CallExpression(node) {
+                const callee = node.callee;
+                const isFetch = callee.type === eslint_devkit_1.AST_NODE_TYPES.Identifier && callee.name === 'fetch';
+                const isAxios = callee.type === eslint_devkit_1.AST_NODE_TYPES.MemberExpression &&
+                    callee.object.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                    callee.object.name === 'axios';
+                if (isFetch || isAxios) {
+                    const optionsArg = node.arguments[1];
+                    const hasTimeout = optionsArg?.type === eslint_devkit_1.AST_NODE_TYPES.ObjectExpression &&
+                        optionsArg.properties.some((p) => p.type === eslint_devkit_1.AST_NODE_TYPES.Property &&
+                            p.key.type === eslint_devkit_1.AST_NODE_TYPES.Identifier &&
+                            p.key.name === 'timeout');
+                    if (!hasTimeout) {
+                        context.report({ node, messageId: 'violationDetected' });
+                    }
+                }
+            },
+        };
+    },
+});