eslint-plugin-sfmc 0.1.0

package/docs/rules/ssjs/no-hardcoded-credentials.md

@@ -0,0 +1,52 @@
+# `sfmc/ssjs-no-hardcoded-credentials`
+
+> Disallow hardcoded keys, IVs, or salts in encryption/decryption calls.
+
+| | |
+|---|---|
+| **Type** | `problem` |
+| **Default severity** | `error` in `recommended` and `strict` |
+| **Fixable** | — |
+
+## Why This Rule Exists
+
+Hardcoding cryptographic keys, initialisation vectors, or salts as string literals in `Platform.Function.EncryptSymmetric` or `Platform.Function.DecryptSymmetric` calls is a security risk. The values are visible in plain text inside your content template, accessible to anyone with access to the Marketing Cloud account or its version history. Credentials should be stored in a Data Extension and retrieved at runtime so they are never committed to templates directly.
+
+## Settings
+
+| Setting | Values | Default |
+|---------|--------|---------|
+| severity | `"error"` \| `"warn"` \| `"off"` | `"error"` |
+
+This rule has no configuration options.
+
+The rule flags string literals at argument positions 1, 3, 5, and 7 (the key, IV, salt, and additional-key positions) of `EncryptSymmetric` and `DecryptSymmetric` calls.
+
+### Examples
+
+**Not allowed:**
+
+```js
+Platform.Load("core", "1.1.5");
+var encrypted = Platform.Function.EncryptSymmetric(plaintext, "AES", "my-secret-key", null, null, null);
+var decrypted = Platform.Function.DecryptSymmetric(ciphertext, "AES", "my-secret-key", null, null, null);
+```
+
+**Allowed:**
+
+```js
+Platform.Load("core", "1.1.5");
+var de = DataExtension.Init("EncryptionKeys");
+var filter = { Property: "Name", SimpleOperator: "equals", Value: "AES_KEY" };
+var rows = de.Rows.Lookup([filter]);
+var key = Platform.Function.Field(Platform.Function.Row(rows, 1), "KeyValue");
+
+var encrypted = Platform.Function.EncryptSymmetric(plaintext, "AES", key, null, null, null);
+```
+
+## When to Disable
+
+```js
+// eslint.config.js
+rules: { 'sfmc/ssjs-no-hardcoded-credentials': 'off' }
+```

package/docs/rules/ssjs/no-switch-default.md

@@ -0,0 +1,37 @@
+# ssjs-no-switch-default
+
+Disallow `default` case in `switch` statements.
+
+## Why
+
+SFMC's SSJS engine may silently skip the `default` case in `switch` statements. This is a known engine bug that causes code in the `default` block to never execute, leading to hard-to-debug logic errors.
+
+## Recommended approach
+
+Enumerate all expected values as explicit `case` labels:
+
+```js
+// Bad -- 'default' may not execute
+switch (status) {
+    case 'active':
+        doActive();
+        break;
+    default:
+        doFallback();
+        break;
+}
+
+// Good -- explicit cases
+switch (status) {
+    case 'active':
+        doActive();
+        break;
+    case 'inactive':
+        doFallback();
+        break;
+}
+```
+
+## Settings
+
+This rule has no options.

package/docs/rules/ssjs/no-treatascontent-injection.md

@@ -0,0 +1,38 @@
+# ssjs-no-treatascontent-injection
+
+Disallow string concatenation inside `TreatAsContent()` calls.
+
+## Why
+
+`Platform.Function.TreatAsContent()` evaluates its string argument as AMPscript. When dynamic values are concatenated into that string, an attacker (or unexpected data containing AMPscript syntax) can inject and execute arbitrary AMPscript code.
+
+## Unsafe pattern
+
+```js
+// UNSAFE -- 'string' could contain AMPscript code
+Platform.Function.TreatAsContent('%%[ Set @x = Trim("' + string + '")]%%');
+```
+
+## Safe pattern
+
+Pass dynamic values through `Variable.SetValue()` first, then reference the AMPscript variable inside `TreatAsContent()`:
+
+```js
+// SAFE -- no user data in the AMPscript string
+Variable.SetValue('@input', string);
+Platform.Function.TreatAsContent('%%[ Set @x = Trim(@input) ]%%');
+var result = Variable.GetValue('@x');
+```
+
+This approach ensures that dynamic values are never interpreted as AMPscript instructions.
+
+## Rule details
+
+This rule flags `TreatAsContent()` and `Platform.Function.TreatAsContent()` calls where the first argument contains:
+
+- String concatenation (`+` operator)
+- Template literals with expressions (`` `...${expr}...` ``)
+
+## Settings
+
+This rule has no options.

package/docs/rules/ssjs/no-unavailable-method.md

@@ -0,0 +1,134 @@
+# `sfmc/ssjs-no-unavailable-method`
+
+> Flag Array methods that are unavailable or broken in SFMC SSJS and suggest inserting a polyfill.
+
+| | |
+|---|---|
+| **Type** | `problem` |
+| **Default severity** | `warn` in `recommended` and `strict` |
+| **Fixable** | **Suggestion** only (lightbulb / `Ctrl+.` in VS Code) |
+
+## Why This Rule Exists
+
+SFMC Server-Side JavaScript runs on an old ECMAScript 3/5 engine (Jint). Many modern
+`Array` methods that developers expect to work either throw a runtime error or silently
+return wrong results:
+
+- **Unavailable** — the method does not exist on the object at all. Calling it throws
+  `expecting object: <methodName>` at runtime.
+- **Broken** — the method exists natively but its implementation is incorrect:
+  - `splice` ignores its first two parameters and replaces elements from the left.
+  - `lastIndexOf` always returns `-1`.
+
+This rule detects both categories and offers a lightbulb suggestion to insert a polyfill
+at the end of the file.
+
+## Covered methods
+
+| Method | Category | Notes |
+|--------|----------|-------|
+| `Array.prototype.copyWithin` | unavailable | |
+| `Array.prototype.entries` | unavailable | Returns a minimal iterator; `for...of` is also unsupported |
+| `Array.prototype.fill` | unavailable | |
+| `Array.prototype.filter` | unavailable | |
+| `Array.prototype.find` | unavailable | |
+| `Array.prototype.findIndex` | unavailable | |
+| `Array.prototype.forEach` | unavailable | |
+| `Array.prototype.includes` | unavailable | |
+| `Array.prototype.indexOf` | unavailable | Only flagged on array literals; string `.indexOf()` still works |
+| `Array.prototype.lastIndexOf` | broken | Natively always returns `-1` |
+| `Array.prototype.map` | unavailable | |
+| `Array.prototype.reduce` | unavailable | |
+| `Array.prototype.reduceRight` | unavailable | |
+| `Array.prototype.some` | unavailable | |
+| `Array.prototype.splice` | broken | Natively ignores `startIndex` and `deleteCount` |
+| `Array.isArray` | unavailable | |
+| `Array.of` | unavailable | |
+
+## Settings
+
+| Setting | Values | Default |
+|---------|--------|---------|
+| severity | `"error"` \| `"warn"` \| `"off"` | `"warn"` |
+| `ignore` | Array of method names to suppress | `[]` |
+
+Use `ignore` when polyfills are loaded externally via a Content Block or Code Resource
+that runs before your script.
+
+```js
+// eslint.config.js
+rules: {
+    'sfmc/ssjs-no-unavailable-method': ['warn', { ignore: ['map', 'filter', 'forEach'] }]
+}
+```
+
+## Examples
+
+### Not allowed (without polyfill)
+
+```js
+var nums = [1, 2, 3];
+var doubled = nums.map(function (n) { return n * 2; });   // unavailable
+
+var pos = nums.lastIndexOf(2);   // broken — always returns -1 natively
+
+var found = Array.isArray(nums); // unavailable
+```
+
+### Allowed
+
+```js
+// Polyfill defined in the same file — rule is suppressed
+Array.prototype.map = function (callback) { /* ... */ };
+
+var doubled = nums.map(function (n) { return n * 2; }); // ok
+
+// Native methods that work correctly are never flagged
+nums.push(4);
+nums.reverse();
+nums.join(', ');
+nums.slice(0, 2);
+```
+
+### With `ignore`
+
+```js
+// eslint.config.js
+rules: {
+    'sfmc/ssjs-no-unavailable-method': ['warn', { ignore: ['map', 'filter'] }]
+}
+```
+
+```js
+// No warning — 'map' and 'filter' are in the ignore list
+var doubled = nums.map(function (n) { return n * 2; });
+var evens   = nums.filter(function (n) { return n % 2 === 0; });
+```
+
+## Suggestion (lightbulb)
+
+When a violation is reported, a suggestion is available to insert the individual
+polyfill at the **end of the file**. Apply it via:
+
+- Click the **lightbulb** or press `Ctrl+.` in VS Code (requires the ESLint extension)
+- `eslint --fix` does **not** apply suggestions
+
+> **Important:** `Array.prototype.X = function () {}` is an assignment expression —
+> it is **not** hoisted like a function declaration. You must ensure the polyfill
+> executes before the first call to the method. If you apply the suggestion and the
+> method is called earlier in the file, move the polyfill above the first usage, or
+> load it from an external Content Block / Code Resource that runs first.
+
+## When to Disable
+
+```js
+// eslint.config.js
+rules: { 'sfmc/ssjs-no-unavailable-method': 'off' }
+```
+
+Or suppress per-line for a single call you know is safe:
+
+```js
+// eslint-disable-next-line sfmc/ssjs-no-unavailable-method
+var result = myArr.map(transform);
+```

package/docs/rules/ssjs/no-unknown-core-method.md

@@ -0,0 +1,46 @@
+# `sfmc/ssjs-no-unknown-core-method`
+
+> Disallow calls to methods that don't exist on a Core library object.
+
+| | |
+|---|---|
+| **Type** | `problem` |
+| **Default severity** | `warn` in `recommended`; `error` in `strict` |
+| **Fixable** | — |
+
+## Why This Rule Exists
+
+When a variable is initialised with a known Core library constructor (e.g. `var de = DataExtension.Init("MyDE")`), only the methods documented for that Core object type should be called on it. Calling an undocumented or misspelled method causes a runtime error. This rule infers the object type from the `.Init()` call and validates subsequent method calls.
+
+## Settings
+
+| Setting | Values | Default |
+|---------|--------|---------|
+| severity | `"error"` \| `"warn"` \| `"off"` | `"warn"` |
+
+This rule has no configuration options.
+
+### Examples
+
+**Not allowed:**
+
+```js
+Platform.Load("core", "1.1.5");
+var de = DataExtension.Init("MyDE");
+de.Execute();  /* 'Execute' is not a method of DataExtension */
+```
+
+**Allowed:**
+
+```js
+Platform.Load("core", "1.1.5");
+var de = DataExtension.Init("MyDE");
+var rows = de.Rows.Retrieve();
+```
+
+## When to Disable
+
+```js
+// eslint.config.js
+rules: { 'sfmc/ssjs-no-unknown-core-method': 'off' }
+```

package/docs/rules/ssjs/no-unknown-http-method.md

@@ -0,0 +1,44 @@
+# `sfmc/ssjs-no-unknown-http-method`
+
+> Disallow unknown `HTTP.*` method calls.
+
+| | |
+|---|---|
+| **Type** | `problem` |
+| **Default severity** | `error` in `recommended` and `strict` |
+| **Fixable** | — |
+
+## Why This Rule Exists
+
+SFMC's SSJS runtime exposes only four `HTTP` methods: `HTTP.Get`, `HTTP.Post`, `HTTP.GetRequest`, and `HTTP.PostRequest`. Calling any other `HTTP.*` method causes a runtime error. This rule validates every `HTTP.*` call against that fixed list.
+
+## Settings
+
+| Setting | Values | Default |
+|---------|--------|---------|
+| severity | `"error"` \| `"warn"` \| `"off"` | `"error"` |
+
+This rule has no configuration options.
+
+### Examples
+
+**Not allowed:**
+
+```js
+var response = HTTP.Delete("https://api.example.com/resource/1");
+var response = HTTP.Patch("https://api.example.com/resource/1", payload);
+```
+
+**Allowed:**
+
+```js
+var getResponse  = HTTP.Get("https://api.example.com/resource/1");
+var postResponse = HTTP.Post("https://api.example.com/resource", payload, contentType);
+```
+
+## When to Disable
+
+```js
+// eslint.config.js
+rules: { 'sfmc/ssjs-no-unknown-http-method': 'off' }
+```

package/docs/rules/ssjs/no-unknown-platform-client-browser.md

@@ -0,0 +1,44 @@
+# `sfmc/ssjs-no-unknown-platform-client-browser`
+
+> Disallow unknown `Platform.ClientBrowser.*` method calls.
+
+| | |
+|---|---|
+| **Type** | `problem` |
+| **Default severity** | `error` in `recommended` and `strict` |
+| **Fixable** | — |
+
+## Why This Rule Exists
+
+`Platform.ClientBrowser` exposes a small, fixed set of methods for writing to and redirecting the HTTP response on CloudPages and landing pages. Calling a method that does not exist in this catalog causes a runtime error. This rule validates every `Platform.ClientBrowser.*` call against the known list.
+
+## Settings
+
+| Setting | Values | Default |
+|---------|--------|---------|
+| severity | `"error"` \| `"warn"` \| `"off"` | `"error"` |
+
+This rule has no configuration options.
+
+### Examples
+
+**Not allowed:**
+
+```js
+Platform.ClientBrowser.Send("data");
+```
+
+**Allowed:**
+
+```js
+Platform.ClientBrowser.Redirect("https://example.com");
+Platform.ClientBrowser.Write("<p>Hello</p>");
+Platform.ClientBrowser.SetCookie("session", "abc123");
+```
+
+## When to Disable
+
+```js
+// eslint.config.js
+rules: { 'sfmc/ssjs-no-unknown-platform-client-browser': 'off' }
+```

package/docs/rules/ssjs/no-unknown-platform-function.md

@@ -0,0 +1,44 @@
+# `sfmc/ssjs-no-unknown-platform-function`
+
+> Disallow calls to unknown `Platform.Function.*` methods.
+
+| | |
+|---|---|
+| **Type** | `problem` |
+| **Default severity** | `error` in `recommended` and `strict` |
+| **Fixable** | — |
+
+## Why This Rule Exists
+
+`Platform.Function` exposes a fixed set of SFMC server-side utility functions (e.g. `Platform.Function.Lookup`, `Platform.Function.InsertData`). Calling a method that does not exist in the catalog causes a runtime error. This rule validates every `Platform.Function.*` call against the known list.
+
+## Settings
+
+| Setting | Values | Default |
+|---------|--------|---------|
+| severity | `"error"` \| `"warn"` \| `"off"` | `"error"` |
+
+This rule has no configuration options.
+
+### Examples
+
+**Not allowed:**
+
+```js
+Platform.Load("core", "1.1.5");
+var result = Platform.Function.CustomQuery("MyDE");
+```
+
+**Allowed:**
+
+```js
+Platform.Load("core", "1.1.5");
+var result = Platform.Function.Lookup("MyDE", "Value", "Key", keyValue);
+```
+
+## When to Disable
+
+```js
+// eslint.config.js
+rules: { 'sfmc/ssjs-no-unknown-platform-function': 'off' }
+```

package/docs/rules/ssjs/no-unknown-platform-request.md

@@ -0,0 +1,43 @@
+# `sfmc/ssjs-no-unknown-platform-request`
+
+> Disallow unknown `Platform.Request.*` method calls.
+
+| | |
+|---|---|
+| **Type** | `problem` |
+| **Default severity** | `error` in `recommended` and `strict` |
+| **Fixable** | — |
+
+## Why This Rule Exists
+
+`Platform.Request` exposes a fixed set of methods for reading incoming HTTP request data on CloudPages and landing pages (e.g. `Platform.Request.GetQueryStringParameter`, `Platform.Request.GetFormField`). Calling an unknown method causes a runtime error. This rule validates every `Platform.Request.*` call against the known list.
+
+## Settings
+
+| Setting | Values | Default |
+|---------|--------|---------|
+| severity | `"error"` \| `"warn"` \| `"off"` | `"error"` |
+
+This rule has no configuration options.
+
+### Examples
+
+**Not allowed:**
+
+```js
+var val = Platform.Request.ReadParam("myParam");
+```
+
+**Allowed:**
+
+```js
+var val = Platform.Request.GetQueryStringParameter("myParam");
+var field = Platform.Request.GetFormField("email");
+```
+
+## When to Disable
+
+```js
+// eslint.config.js
+rules: { 'sfmc/ssjs-no-unknown-platform-request': 'off' }
+```

package/docs/rules/ssjs/no-unknown-platform-response.md

@@ -0,0 +1,43 @@
+# `sfmc/ssjs-no-unknown-platform-response`
+
+> Disallow unknown `Platform.Response.*` method calls.
+
+| | |
+|---|---|
+| **Type** | `problem` |
+| **Default severity** | `error` in `recommended` and `strict` |
+| **Fixable** | — |
+
+## Why This Rule Exists
+
+`Platform.Response` exposes a fixed set of methods for controlling HTTP responses from CloudPages and landing pages (e.g. `Platform.Response.Write`, `Platform.Response.Redirect`). Calling an unknown method causes a runtime error. This rule validates every `Platform.Response.*` call against the known list.
+
+## Settings
+
+| Setting | Values | Default |
+|---------|--------|---------|
+| severity | `"error"` \| `"warn"` \| `"off"` | `"error"` |
+
+This rule has no configuration options.
+
+### Examples
+
+**Not allowed:**
+
+```js
+Platform.Response.Send("text/html", "<p>Hello</p>");
+```
+
+**Allowed:**
+
+```js
+Platform.Response.Write("<p>Hello</p>");
+Platform.Response.Redirect("https://example.com");
+```
+
+## When to Disable
+
+```js
+// eslint.config.js
+rules: { 'sfmc/ssjs-no-unknown-platform-response': 'off' }
+```

package/docs/rules/ssjs/no-unknown-platform-variable.md

@@ -0,0 +1,43 @@
+# `sfmc/ssjs-no-unknown-platform-variable`
+
+> Disallow unknown `Platform.Variable.*` method calls.
+
+| | |
+|---|---|
+| **Type** | `problem` |
+| **Default severity** | `error` in `recommended` and `strict` |
+| **Fixable** | — |
+
+## Why This Rule Exists
+
+`Platform.Variable` exposes a fixed set of methods for interacting with AMPscript variables from SSJS (e.g. `Platform.Variable.GetValue`, `Platform.Variable.SetValue`). Calling an unknown method causes a runtime error. This rule validates every `Platform.Variable.*` call against the known list.
+
+## Settings
+
+| Setting | Values | Default |
+|---------|--------|---------|
+| severity | `"error"` \| `"warn"` \| `"off"` | `"error"` |
+
+This rule has no configuration options.
+
+### Examples
+
+**Not allowed:**
+
+```js
+var val = Platform.Variable.ReadValue("@myVar");
+```
+
+**Allowed:**
+
+```js
+var val = Platform.Variable.GetValue("@myVar");
+Platform.Variable.SetValue("@myVar", "Hello");
+```
+
+## When to Disable
+
+```js
+// eslint.config.js
+rules: { 'sfmc/ssjs-no-unknown-platform-variable': 'off' }
+```

package/docs/rules/ssjs/no-unknown-wsproxy-method.md

@@ -0,0 +1,46 @@
+# `sfmc/ssjs-no-unknown-wsproxy-method`
+
+> Disallow unknown method calls on a `WSProxy` instance.
+
+| | |
+|---|---|
+| **Type** | `problem` |
+| **Default severity** | `warn` in `recommended`; `error` in `strict` |
+| **Fixable** | — |
+
+## Why This Rule Exists
+
+`WSProxy` is SFMC's SSJS wrapper around the SOAP API. It exposes a specific set of methods (`retrieve`, `retrieveAll`, `create`, `update`, `delete`, `execute`, `perform`). Calling an unknown method on a `WSProxy` instance causes a runtime error. This rule infers `WSProxy` variable usage and validates method calls against the known list.
+
+## Settings
+
+| Setting | Values | Default |
+|---------|--------|---------|
+| severity | `"error"` \| `"warn"` \| `"off"` | `"warn"` |
+
+This rule has no configuration options.
+
+### Examples
+
+**Not allowed:**
+
+```js
+Platform.Load("core", "1.1.5");
+var proxy = new Script.Util.WSProxy();
+var result = proxy.query({ ObjectType: "Subscriber" });
+```
+
+**Allowed:**
+
+```js
+Platform.Load("core", "1.1.5");
+var proxy = new Script.Util.WSProxy();
+var result = proxy.retrieve({ ObjectType: "Subscriber", Properties: ["SubscriberKey"] }, []);
+```
+
+## When to Disable
+
+```js
+// eslint.config.js
+rules: { 'sfmc/ssjs-no-unknown-wsproxy-method': 'off' }
+```