eslint-plugin-sfmc 0.1.0

package/src/rules/amp/no-smart-quotes.js

@@ -0,0 +1,78 @@
+const SMART_QUOTE_RE = /[\u2018\u2019\u201C\u201D\u201A\u201E\u2039\u203A]/;
+
+const SMART_QUOTES = {
+    '\u2018': 'left single curly quote \u2018',
+    '\u2019': 'right single curly quote \u2019',
+    '\u201C': 'left double curly quote \u201C',
+    '\u201D': 'right double curly quote \u201D',
+    '\u201A': 'single low-9 quote \u201A',
+    '\u201E': 'double low-9 quote \u201E',
+    '\u2039': 'single left angle quote \u2039',
+    '\u203A': 'single right angle quote \u203A',
+};
+
+// Maps each smart-quote char to its nearest ASCII equivalent.
+// Single-flavour smart quotes -> ' ; double-flavour -> "
+const SMART_TO_ASCII = {
+    '\u2018': "'",
+    '\u2019': "'",
+    '\u201A': "'",
+    '\u2039': "'",
+    '\u203A': "'",
+    '\u201C': '"',
+    '\u201D': '"',
+    '\u201E': '"',
+};
+
+export default {
+    meta: {
+        type: 'problem',
+        fixable: 'code',
+        docs: {
+            description:
+                'Disallow smart/curly quotes in string literals (AMPscript requires ASCII quotes)',
+            recommended: true,
+        },
+        messages: {
+            smartQuote:
+                'String contains {{kind}}. AMPscript only supports straight ASCII quotes (\' or ").',
+        },
+        schema: [],
+    },
+
+    create(context) {
+        return {
+            StringLiteral(node) {
+                if (SMART_QUOTE_RE.test(node.value)) {
+                    for (const [char, kind] of Object.entries(SMART_QUOTES)) {
+                        if (node.value.includes(char)) {
+                            context.report({
+                                node,
+                                messageId: 'smartQuote',
+                                data: { kind },
+                                fix(fixer) {
+                                    const fixed = node.value.replace(
+                                        /[\u2018\u2019\u201C\u201D\u201A\u201E\u2039\u203A]/g,
+                                        (c) => SMART_TO_ASCII[c],
+                                    );
+                                    const q = node.quote;
+                                    // If the replacement introduces the outer delimiter, try switching quotes.
+                                    if (fixed.includes(q)) {
+                                        const other = q === '"' ? "'" : '"';
+                                        if (!fixed.includes(other)) {
+                                            return fixer.replaceText(node, other + fixed + other);
+                                        }
+                                        // Both quote chars present — cannot safely auto-fix.
+                                        return null;
+                                    }
+                                    return fixer.replaceText(node, q + fixed + q);
+                                },
+                            });
+                            return;
+                        }
+                    }
+                }
+            },
+        };
+    },
+};

package/src/rules/amp/no-unknown-function.js

@@ -0,0 +1,31 @@
+import { functionNames } from 'ampscript-data';
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description:
+                'Disallow function calls to names not in the known AMPscript function catalog',
+            recommended: true,
+        },
+        messages: {
+            unknownFunction:
+                "'{{name}}' is not a recognized AMPscript function. AMPscript does not support custom functions.",
+        },
+        schema: [],
+    },
+
+    create(context) {
+        return {
+            FunctionCall(node) {
+                if (!functionNames.has(node.name.toLowerCase())) {
+                    context.report({
+                        node,
+                        messageId: 'unknownFunction',
+                        data: { name: node.name },
+                    });
+                }
+            },
+        };
+    },
+};

package/src/rules/amp/no-var-redeclaration.js

@@ -0,0 +1,36 @@
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description:
+                'Disallow re-declaring a variable with `var` (silently resets value to null)',
+            recommended: true,
+        },
+        messages: {
+            redeclared:
+                "'{{name}}' has already been declared. Re-declaring with `var` silently resets its value to null.",
+        },
+        schema: [],
+    },
+
+    create(context) {
+        const declared = new Map();
+
+        return {
+            VarDeclaration(node) {
+                for (const variable of node.variables) {
+                    const lower = variable.value.toLowerCase();
+                    if (declared.has(lower)) {
+                        context.report({
+                            node: variable,
+                            messageId: 'redeclared',
+                            data: { name: variable.value },
+                        });
+                    } else {
+                        declared.set(lower, variable);
+                    }
+                }
+            },
+        };
+    },
+};

package/src/rules/amp/prefer-attribute-value.js

@@ -0,0 +1,94 @@
+/**
+ * Suggests wrapping bare personalization-string identifiers (e.g. `FirstName`)
+ * in `AttributeValue("FirstName")` to prevent send-aborting errors when the
+ * attribute is missing from the subscriber context.
+ *
+ * Only flags Identifier nodes that appear directly in SetStatement values or
+ * as standalone ExpressionStatements — contexts where a bare attribute
+ * reference is likely intentional data access rather than a function name or
+ * a value inside a function call.
+ */
+
+import { functionNames } from 'ampscript-data';
+
+const AMPSCRIPT_KEYWORDS = new Set([
+    'var',
+    'set',
+    'if',
+    'then',
+    'elseif',
+    'else',
+    'endif',
+    'for',
+    'to',
+    'downto',
+    'do',
+    'next',
+    'and',
+    'or',
+    'not',
+    'true',
+    'false',
+]);
+
+function isLikelyPersonalization(node) {
+    if (node.type !== 'Identifier') return false;
+    const lower = node.value.toLowerCase();
+    if (functionNames.has(lower)) return false;
+    if (AMPSCRIPT_KEYWORDS.has(lower)) return false;
+    return true;
+}
+
+export default {
+    meta: {
+        type: 'suggestion',
+        hasSuggestions: true,
+        docs: {
+            description:
+                'Prefer AttributeValue() over bare personalization strings for safe attribute access',
+            recommended: false,
+        },
+        messages: {
+            preferAttributeValue:
+                'Use `AttributeValue("{{name}}")` instead of bare `{{name}}` to safely handle missing attributes.',
+            wrapWithAttributeValue: 'Wrap \'{{name}}\' in AttributeValue() for safe attribute access',
+        },
+        schema: [],
+    },
+
+    create(context) {
+        function reportWithSuggestion(identNode) {
+            context.report({
+                node: identNode,
+                messageId: 'preferAttributeValue',
+                data: { name: identNode.value },
+                suggest: [
+                    {
+                        messageId: 'wrapWithAttributeValue',
+                        data: { name: identNode.value },
+                        fix(fixer) {
+                            return fixer.replaceText(
+                                identNode,
+                                `AttributeValue("${identNode.value}")`,
+                            );
+                        },
+                    },
+                ],
+            });
+        }
+
+        return {
+            SetStatement(node) {
+                if (node.value && isLikelyPersonalization(node.value)) {
+                    reportWithSuggestion(node.value);
+                }
+            },
+
+            AmpExpressionStatement(node) {
+                if (isLikelyPersonalization(node.expression)) {
+                    reportWithSuggestion(node.expression);
+                }
+            },
+        };
+    },
+};

package/src/rules/amp/require-rowcount-check.js

@@ -0,0 +1,116 @@
+/**
+ * Requires a RowCount > 0 guard before iterating over a LookupRows result
+ * with a FOR loop.
+ *
+ * Without the check, a RowCount of 0 causes a runtime error inside the loop.
+ * This rule tracks variables assigned from LookupRows/LookupOrderedRows
+ * (and their CS variants), then verifies that a RowCount check appears in
+ * an IF condition before the variable is used as a FOR loop's data source.
+ */
+
+const LOOKUP_FUNCTIONS = new Set([
+    'lookuprows',
+    'lookuporderedrows',
+    'lookuprowscs',
+    'lookuporderedrowscs',
+]);
+
+function isLookupCall(node) {
+    return node && node.type === 'FunctionCall' && LOOKUP_FUNCTIONS.has(node.name.toLowerCase());
+}
+
+function isRowCountCall(node) {
+    return node && node.type === 'FunctionCall' && node.name.toLowerCase() === 'rowcount';
+}
+
+function extractRowCountVariables(node, into) {
+    if (!node) return;
+
+    if (isRowCountCall(node) && node.arguments && node.arguments.length > 0) {
+        const argument = node.arguments[0];
+        if (argument.type === 'Variable') {
+            into.add(argument.value.toLowerCase());
+        }
+    }
+
+    if (node.type === 'BinaryExpression') {
+        extractRowCountVariables(node.left, into);
+        extractRowCountVariables(node.right, into);
+    }
+
+    if (node.type === 'LogicalExpression') {
+        extractRowCountVariables(node.left, into);
+        extractRowCountVariables(node.right, into);
+    }
+
+    if (node.type === 'FunctionCall' && node.arguments) {
+        for (const argument of node.arguments) {
+            extractRowCountVariables(argument, into);
+        }
+    }
+}
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description:
+                'Require a RowCount > 0 check before using a LookupRows result in a FOR loop',
+            recommended: true,
+        },
+        messages: {
+            missingRowCount:
+                "Variable '{{name}}' is used in a FOR loop without a prior RowCount > 0 check. This causes a runtime error when the rowset is empty.",
+        },
+        schema: [],
+    },
+
+    create(context) {
+        const lookupVariables = new Map();
+        const checkedVariables = new Set();
+        const forLoops = [];
+
+        return {
+            SetStatement(node) {
+                if (node.target && node.value && isLookupCall(node.value)) {
+                    lookupVariables.set(node.target.value.toLowerCase(), node.target);
+                }
+            },
+
+            AmpIfStatement(node) {
+                if (node.condition) {
+                    extractRowCountVariables(node.condition, checkedVariables);
+                }
+            },
+
+            AmpForStatement(node) {
+                if (
+                    node.endExpr &&
+                    isRowCountCall(node.endExpr) &&
+                    node.endExpr.arguments &&
+                    node.endExpr.arguments.length > 0
+                ) {
+                    const argument = node.endExpr.arguments[0];
+                    if (argument.type === 'Variable') {
+                        forLoops.push({
+                            varName: argument.value.toLowerCase(),
+                            node,
+                        });
+                    }
+                }
+            },
+
+            'Program:exit'() {
+                for (const loop of forLoops) {
+                    if (lookupVariables.has(loop.varName) && !checkedVariables.has(loop.varName)) {
+                        context.report({
+                            node: loop.node,
+                            messageId: 'missingRowCount',
+                            data: { name: lookupVariables.get(loop.varName).value },
+                        });
+                    }
+                }
+            },
+        };
+    },
+};

package/src/rules/amp/require-variable-declaration.js

@@ -0,0 +1,49 @@
+/**
+ * Requires that @variables are declared with `var` before being used in
+ * `set` statements. System variables (@@) and personalization strings
+ * (no @ prefix) are not affected.
+ *
+ * AMPscript does not technically require `var`, but the ampscript.guide
+ * best-practices documentation recommends always declaring variables to
+ * make code self-documenting and catch typos.
+ */
+
+export default {
+    meta: {
+        type: 'suggestion',
+        docs: {
+            description: 'Require variables to be declared with `var` before use',
+            recommended: false,
+        },
+        messages: {
+            undeclared:
+                "'{{name}}' is used before being declared. Add `var {{name}}` before this `set` statement.",
+        },
+        schema: [],
+    },
+
+    create(context) {
+        const declared = new Set();
+
+        return {
+            VarDeclaration(node) {
+                for (const v of node.variables) {
+                    declared.add(v.value.toLowerCase());
+                }
+            },
+
+            SetStatement(node) {
+                if (!node.target) return;
+                const name = node.target.value;
+                if (name.startsWith('@@')) return;
+                if (!declared.has(name.toLowerCase())) {
+                    context.report({
+                        node: node.target,
+                        messageId: 'undeclared',
+                        data: { name },
+                    });
+                }
+            },
+        };
+    },
+};

package/src/rules/amp/set-requires-target.js

@@ -0,0 +1,27 @@
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Require `set` statements to have a target variable',
+            recommended: true,
+        },
+        messages: {
+            missingTarget:
+                '`set` statement is missing a target variable. Expected: `set @variable = expression`.',
+        },
+        schema: [],
+    },
+
+    create(context) {
+        return {
+            SetStatement(node) {
+                if (!node.target) {
+                    context.report({
+                        node,
+                        messageId: 'missingTarget',
+                    });
+                }
+            },
+        };
+    },
+};

package/src/rules/ssjs/cache-loop-length.js

@@ -0,0 +1,92 @@
+/**
+ * Rule: cache-loop-length
+ *
+ * Flags `for` loops where `.length` is re-evaluated on every iteration.
+ * Recommends caching the length in a variable for better SSJS performance.
+ *
+ * Bad:  for (var i = 0; i < arr.length; i++)
+ * Good: for (var i = 0, _len = arr.length; i < _len; i++)
+ *
+ * Suggestion: when the for-loop init is a VariableDeclaration (the common
+ * case), the suggestion appends `, _len = arr.length` to the declarator
+ * list and replaces `arr.length` with `_len` in the test expression.
+ */
+
+export default {
+    meta: {
+        type: 'suggestion',
+        hasSuggestions: true,
+        docs: {
+            description: 'Require caching array length in for-loop conditions',
+        },
+        messages: {
+            cacheLength:
+                "Cache '.length' in a variable to avoid re-evaluation on each iteration (e.g. `for (var i = 0, _len = arr.length; i < _len; i++)`).",
+            suggestCacheLength:
+                'Cache .length in a variable (e.g. add `, _len = {{obj}}.length` to the init and replace `{{obj}}.length` with `_len` in the condition)',
+        },
+        schema: [],
+    },
+
+    create(context) {
+        return {
+            ForStatement(node) {
+                const test = node.test;
+                if (!test || test.type !== 'BinaryExpression') return;
+
+                let lengthExpr = null;
+                if (containsMemberLength(test.right)) {
+                    lengthExpr = test.right;
+                } else if (containsMemberLength(test.left)) {
+                    lengthExpr = test.left;
+                }
+
+                if (!lengthExpr) return;
+
+                context.report({
+                    node: test,
+                    messageId: 'cacheLength',
+                    suggest: buildCacheSuggestion(node, lengthExpr, context),
+                });
+            },
+        };
+    },
+};
+
+function containsMemberLength(node) {
+    if (!node) return false;
+    if (
+        node.type === 'MemberExpression' &&
+        node.property.type === 'Identifier' &&
+        node.property.name === 'length'
+    ) {
+        return true;
+    }
+    return false;
+}
+
+function buildCacheSuggestion(forNode, lengthExpr, context) {
+    const init = forNode.init;
+    // Only suggest when init is a VariableDeclaration so we can safely
+    // append a new declarator without restructuring the loop header.
+    if (!init || init.type !== 'VariableDeclaration' || init.declarations.length === 0) {
+        return [];
+    }
+
+    const objText = context.sourceCode.getText(lengthExpr.object);
+    const lenVar = '_len';
+
+    return [
+        {
+            messageId: 'suggestCacheLength',
+            data: { obj: objText },
+            fix(fixer) {
+                const lastDecl = init.declarations[init.declarations.length - 1];
+                return [
+                    fixer.insertTextAfter(lastDecl, `, ${lenVar} = ${objText}.length`),
+                    fixer.replaceText(lengthExpr, lenVar),
+                ];
+            },
+        },
+    ];
+}

package/src/rules/ssjs/no-hardcoded-credentials.js

@@ -0,0 +1,66 @@
+/**
+ * Rule: no-hardcoded-credentials
+ *
+ * Detects string literals passed as key/IV/salt arguments to
+ * Platform.Function.DecryptSymmetric and EncryptSymmetric calls.
+ * These should use variable references (e.g. from a DE lookup)
+ * instead of hardcoded values.
+ */
+
+const ENCRYPT_FUNCTIONS = new Set(['encryptsymmetric', 'decryptsymmetric']);
+
+const KEY_ARG_INDICES = [1, 3, 5, 7];
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow hardcoded credentials in encryption/decryption calls',
+        },
+        messages: {
+            hardcodedCredential:
+                'Avoid hardcoded keys, IVs, or salts in {{fn}}(). Use a variable or DE lookup instead.',
+        },
+        schema: [],
+    },
+
+    create(context) {
+        return {
+            CallExpression(node) {
+                const callee = node.callee;
+
+                let functionName = null;
+
+                if (
+                    callee.type === 'MemberExpression' &&
+                    callee.object.type === 'MemberExpression' &&
+                    callee.object.object.type === 'Identifier' &&
+                    callee.object.object.name === 'Platform' &&
+                    callee.object.property.type === 'Identifier' &&
+                    callee.object.property.name === 'Function' &&
+                    callee.property.type === 'Identifier'
+                ) {
+                    functionName = callee.property.name;
+                }
+
+                if (!functionName || !ENCRYPT_FUNCTIONS.has(functionName.toLowerCase())) return;
+
+                for (const index of KEY_ARG_INDICES) {
+                    const argument = node.arguments[index];
+                    if (
+                        argument &&
+                        argument.type === 'Literal' &&
+                        typeof argument.value === 'string' &&
+                        argument.value.length > 0
+                    ) {
+                        context.report({
+                            node: argument,
+                            messageId: 'hardcodedCredential',
+                            data: { fn: functionName },
+                        });
+                    }
+                }
+            },
+        };
+    },
+};

package/src/rules/ssjs/no-switch-default.js

@@ -0,0 +1,32 @@
+/**
+ * Rule: no-switch-default
+ *
+ * The `default` case in switch statements may silently fail to execute in
+ * SFMC's SSJS engine. Explicitly enumerate all expected values instead.
+ */
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description:
+                "Disallow 'default' case in switch statements because SFMC SSJS may not process it",
+        },
+        messages: {
+            noDefault:
+                "The 'default' case in a switch statement may not execute in SFMC SSJS. " +
+                'List all expected values as explicit cases instead.',
+        },
+        schema: [],
+    },
+
+    create(context) {
+        return {
+            SwitchCase(node) {
+                if (node.test === null) {
+                    context.report({ node, messageId: 'noDefault' });
+                }
+            },
+        };
+    },
+};