eslint-plugin-sfmc 0.1.0

package/src/rules/ssjs/no-treatascontent-injection.js

@@ -0,0 +1,76 @@
+/**
+ * Rule: no-treatascontent-injection
+ *
+ * Flags string concatenation inside TreatAsContent() calls. When dynamic
+ * values are concatenated into the AMPscript string, an attacker (or
+ * unexpected data) can inject arbitrary AMPscript code.
+ *
+ * Safe pattern: use Variable.SetValue() to pass values into AMPscript
+ * variables, then reference those variables inside TreatAsContent().
+ */
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description:
+                'Disallow string concatenation in TreatAsContent() to prevent AMPscript injection',
+        },
+        messages: {
+            injection:
+                'Concatenating dynamic values into TreatAsContent() risks AMPscript injection. ' +
+                "Use Variable.SetValue() to pass values into AMPscript variables, then reference " +
+                "them with @varName inside the TreatAsContent string.",
+        },
+        schema: [],
+    },
+
+    create(context) {
+        return {
+            CallExpression(node) {
+                if (!isTreatAsContentCall(node)) return;
+                if (node.arguments.length === 0) return;
+
+                const arg = node.arguments[0];
+                if (containsConcatenation(arg)) {
+                    context.report({ node: arg, messageId: 'injection' });
+                }
+            },
+        };
+    },
+};
+
+function isTreatAsContentCall(node) {
+    const callee = node.callee;
+
+    // TreatAsContent(...)
+    if (callee.type === 'Identifier' && callee.name === 'TreatAsContent') {
+        return true;
+    }
+
+    // Platform.Function.TreatAsContent(...)
+    if (
+        callee.type === 'MemberExpression' &&
+        callee.property.type === 'Identifier' &&
+        callee.property.name === 'TreatAsContent' &&
+        callee.object.type === 'MemberExpression' &&
+        callee.object.property.type === 'Identifier' &&
+        callee.object.property.name === 'Function' &&
+        callee.object.object.type === 'Identifier' &&
+        callee.object.object.name === 'Platform'
+    ) {
+        return true;
+    }
+
+    return false;
+}
+
+function containsConcatenation(node) {
+    if (node.type === 'BinaryExpression' && node.operator === '+') {
+        return true;
+    }
+    if (node.type === 'TemplateLiteral' && node.expressions.length > 0) {
+        return true;
+    }
+    return false;
+}

package/src/rules/ssjs/no-unavailable-method.js

@@ -0,0 +1,190 @@
+/**
+ * Rule: no-unavailable-method
+ *
+ * Flags calls to Array methods that are either missing or broken in SFMC's
+ * legacy ECMAScript engine (Jint/ECMAScript 3) and suggests inserting a
+ * polyfill at the end of the file.
+ *
+ * - category 'unavailable': method does not exist; calling it throws a runtime error.
+ * - category 'broken': method exists natively but returns incorrect results.
+ *
+ * No auto-fix is applied because prototype assignments are not hoisted —
+ * the suggestion inserts the polyfill at the end of the file, and users
+ * should verify placement before the first call (or load via Content Block).
+ */
+
+import { polyfillByPrototypeName, polyfillByStaticName } from 'ssjs-data';
+
+// SFMC-specific top-level objects whose methods must never be flagged even
+// when their method names collide with Array.prototype (e.g. Platform.find).
+const SFMC_RECEIVERS = new Set([
+    'Platform',
+    'HTTP',
+    'WSProxy',
+    'Variable',
+    'Request',
+    'Response',
+    'Automation',
+    'DataExtension',
+    'Subscriber',
+    'Email',
+    'List',
+    'Query',
+]);
+
+export default {
+    meta: {
+        type: 'problem',
+        hasSuggestions: true,
+        docs: {
+            description:
+                'Flag Array methods unavailable or broken in SFMC SSJS and suggest polyfills',
+        },
+        messages: {
+            unavailable:
+                "'{{owner}}.{{method}}' is not available in SFMC SSJS (ECMAScript 3). " +
+                'Add a polyfill before using it.',
+            broken:
+                "'{{owner}}.{{method}}' exists in SFMC SSJS but produces incorrect results. " +
+                'Add a polyfill to get the correct behavior.',
+            addPolyfill: "Insert '{{owner}}.{{method}}' polyfill at end of file",
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    ignore: {
+                        type: 'array',
+                        items: { type: 'string' },
+                        uniqueItems: true,
+                        description: 'Method names to ignore (e.g. when loaded via Content Block).',
+                    },
+                },
+                additionalProperties: false,
+            },
+        ],
+    },
+
+    create(context) {
+        const options = context.options[0] || {};
+        const ignored = new Set(options.ignore || []);
+
+        // Track which methods already have a polyfill assignment in this file.
+        // We detect: Array.prototype.X = function ...  or  Array.X = function ...
+        const alreadyPolyfilled = new Set();
+
+        // Defer reports until Program:exit so we can suppress ones that have
+        // a polyfill definition earlier in the file.
+        const pendingReports = [];
+
+        function isAlreadyPolyfilled(method) {
+            return alreadyPolyfilled.has(method);
+        }
+
+        function buildSuggestFix(entry) {
+            return function fix(fixer) {
+                const src = context.sourceCode;
+                const end = src.ast.range[1];
+                return fixer.insertTextAfterRange([end, end], '\n\n' + entry.polyfill);
+            };
+        }
+
+        return {
+            // Detect polyfill assignments already present in the file:
+            // Array.prototype.map = ...  /  Array.isArray = ...  /  String.prototype.trim = ...
+            AssignmentExpression(node) {
+                const left = node.left;
+                if (left.type !== 'MemberExpression') return;
+
+                const obj = left.object;
+                const prop = left.property;
+                if (prop.type !== 'Identifier') return;
+
+                // Array.X = ...
+                if (obj.type === 'Identifier' && obj.name === 'Array') {
+                    alreadyPolyfilled.add(prop.name);
+                    return;
+                }
+
+                // Array.prototype.X = ...  or  String.prototype.X = ...
+                if (
+                    obj.type === 'MemberExpression' &&
+                    obj.object.type === 'Identifier' &&
+                    (obj.object.name === 'Array' || obj.object.name === 'String') &&
+                    obj.property.type === 'Identifier' &&
+                    obj.property.name === 'prototype'
+                ) {
+                    alreadyPolyfilled.add(prop.name);
+                }
+            },
+
+            CallExpression(node) {
+                const callee = node.callee;
+                if (callee.type !== 'MemberExpression') return;
+
+                const prop = callee.property;
+                if (prop.type !== 'Identifier') return;
+
+                const methodName = prop.name;
+                const receiver = callee.object;
+
+                // ── Static Array methods: Array.isArray(), Array.of() ──────────
+                if (
+                    receiver.type === 'Identifier' &&
+                    receiver.name === 'Array' &&
+                    polyfillByStaticName.has(methodName)
+                ) {
+                    if (ignored.has(methodName)) return;
+                    const entry = polyfillByStaticName.get(methodName);
+                    pendingReports.push({ node: prop, entry });
+                    return;
+                }
+
+                // ── Prototype methods ─────────────────────────────────────────
+                if (!polyfillByPrototypeName.has(methodName)) return;
+                if (ignored.has(methodName)) return;
+
+                const entry = polyfillByPrototypeName.get(methodName);
+
+                // Skip known SFMC top-level objects to avoid false positives.
+                if (receiver.type === 'Identifier' && SFMC_RECEIVERS.has(receiver.name)) return;
+
+                // For methods that also exist on String.prototype in ES3
+                // (indexOf, lastIndexOf), only flag when the receiver is
+                // a literal array or the call is chained from an array method
+                // we already know about — otherwise we'd falsely flag string usage.
+                if (entry.ambiguousWithString) {
+                    const isDefinitelyArray =
+                        receiver.type === 'ArrayExpression' ||
+                        // arr.filter(...).indexOf(...) — left side is a CallExpression
+                        // whose callee refers to another Array method
+                        (receiver.type === 'CallExpression' &&
+                            receiver.callee.type === 'MemberExpression' &&
+                            polyfillByPrototypeName.has(receiver.callee.property.name));
+                    if (!isDefinitelyArray) return;
+                }
+
+                pendingReports.push({ node: prop, entry });
+            },
+
+            'Program:exit'() {
+                for (const { node, entry } of pendingReports) {
+                    if (isAlreadyPolyfilled(entry.method)) continue;
+
+                    context.report({
+                        node,
+                        messageId: entry.category,
+                        data: { owner: entry.owner, method: entry.method },
+                        suggest: [
+                            {
+                                messageId: 'addPolyfill',
+                                data: { owner: entry.owner, method: entry.method },
+                                fix: buildSuggestFix(entry),
+                            },
+                        ],
+                    });
+                }
+            },
+        };
+    },
+};

package/src/rules/ssjs/no-unknown-core-method.js

@@ -0,0 +1,103 @@
+/**
+ * Rule: no-unknown-core-method
+ *
+ * Flags calls to Core library object methods that don't exist on that
+ * object type, when the object type can be inferred from an Init call.
+ *
+ * Example:
+ *   var de = DataExtension.Init("MyDE");
+ *   de.Foo();  // error: 'Foo' is not a method of DataExtension
+ */
+
+import { coreObjectLookup, coreObjectNames } from 'ssjs-data';
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: "Disallow calls to methods that don't exist on a Core library object",
+        },
+        messages: {
+            unknownMethod:
+                "'{{method}}' is not a known method of {{objectType}}. Available methods: {{available}}.",
+        },
+        schema: [],
+    },
+
+    create(context) {
+        const variableTypes = new Map();
+
+        return {
+            VariableDeclaration(node) {
+                for (const decl of node.declarations) {
+                    if (!decl.init || !decl.id || decl.id.type !== 'Identifier') continue;
+                    const coreType = getCoreInitType(decl.init);
+                    if (coreType) {
+                        variableTypes.set(decl.id.name, coreType);
+                    }
+                }
+            },
+
+            AssignmentExpression(node) {
+                if (node.left.type !== 'Identifier') return;
+                const coreType = getCoreInitType(node.right);
+                if (coreType) {
+                    variableTypes.set(node.left.name, coreType);
+                }
+            },
+
+            CallExpression(node) {
+                const callee = node.callee;
+                if (callee.type !== 'MemberExpression') return;
+                if (callee.object.type !== 'Identifier') return;
+                if (callee.property.type !== 'Identifier') return;
+
+                const objectName = callee.object.name;
+                const method = callee.property.name;
+
+                const coreType = variableTypes.get(objectName);
+                if (!coreType) return;
+
+                const objectDef = coreObjectLookup.get(coreType);
+                if (!objectDef) return;
+
+                const knownMethods = new Set(objectDef.methods.map((m) => m.toLowerCase()));
+                if (!knownMethods.has(method.toLowerCase())) {
+                    context.report({
+                        node: callee.property,
+                        messageId: 'unknownMethod',
+                        data: {
+                            method,
+                            objectType: coreType,
+                            available: objectDef.methods.join(', '),
+                        },
+                    });
+                }
+            },
+        };
+    },
+};
+
+function getCoreInitType(node) {
+    if (!node || node.type !== 'CallExpression') return null;
+    const callee = node.callee;
+    if (callee.type !== 'MemberExpression') return null;
+
+    if (callee.property.type === 'Identifier' && callee.property.name === 'Init') {
+        if (callee.object.type === 'Identifier' && coreObjectNames.has(callee.object.name)) {
+            return callee.object.name;
+        }
+        if (
+            callee.object.type === 'MemberExpression' &&
+            callee.object.object.type === 'Identifier' &&
+            callee.object.property.type === 'Identifier'
+        ) {
+            const fullName = `${callee.object.object.name}.${callee.object.property.name}`;
+            if (coreObjectNames.has(fullName)) {
+                return fullName;
+            }
+        }
+    }
+
+    return null;
+}

package/src/rules/ssjs/no-unknown-http-method.js

@@ -0,0 +1,41 @@
+/**
+ * Rule: no-unknown-http-method
+ *
+ * Flags calls to HTTP.* where the method name does not exist
+ * in the known SFMC HTTP method catalog.
+ */
+
+import { httpMethodNames } from 'ssjs-data';
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow calls to unknown HTTP object methods',
+        },
+        messages: {
+            unknownMethod: "'HTTP.{{name}}' is not a recognized SFMC HTTP method.",
+        },
+        schema: [],
+    },
+
+    create(context) {
+        return {
+            CallExpression(node) {
+                const callee = node.callee;
+                if (callee.type !== 'MemberExpression') return;
+                if (callee.object.type !== 'Identifier' || callee.object.name !== 'HTTP') return;
+                if (callee.property.type !== 'Identifier') return;
+
+                const methodName = callee.property.name;
+                if (!httpMethodNames.has(methodName.toLowerCase())) {
+                    context.report({
+                        node: callee.property,
+                        messageId: 'unknownMethod',
+                        data: { name: methodName },
+                    });
+                }
+            },
+        };
+    },
+};

package/src/rules/ssjs/no-unknown-platform-client-browser.js

@@ -0,0 +1,50 @@
+/**
+ * Rule: no-unknown-platform-client-browser
+ *
+ * Flags calls to Platform.ClientBrowser.* where the method name does not
+ * exist in the known SFMC Platform.ClientBrowser catalog.
+ */
+
+import { PLATFORM_CLIENT_BROWSER_METHODS } from 'ssjs-data';
+
+const knownMethods = new Set(PLATFORM_CLIENT_BROWSER_METHODS.map((m) => m.name.toLowerCase()));
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow calls to unknown Platform.ClientBrowser methods',
+        },
+        messages: {
+            unknownMethod: "'Platform.ClientBrowser.{{name}}' is not a recognized method.",
+        },
+        schema: [],
+    },
+
+    create(context) {
+        return {
+            CallExpression(node) {
+                const callee = node.callee;
+                if (callee.type !== 'MemberExpression') return;
+
+                if (
+                    callee.object.type === 'MemberExpression' &&
+                    callee.object.object.type === 'Identifier' &&
+                    callee.object.object.name === 'Platform' &&
+                    callee.object.property.type === 'Identifier' &&
+                    callee.object.property.name === 'ClientBrowser' &&
+                    callee.property.type === 'Identifier'
+                ) {
+                    const methodName = callee.property.name;
+                    if (!knownMethods.has(methodName.toLowerCase())) {
+                        context.report({
+                            node: callee.property,
+                            messageId: 'unknownMethod',
+                            data: { name: methodName },
+                        });
+                    }
+                }
+            },
+        };
+    },
+};

package/src/rules/ssjs/no-unknown-platform-function.js

@@ -0,0 +1,49 @@
+/**
+ * Rule: no-unknown-platform-function
+ *
+ * Flags calls to Platform.Function.* where the method name does not
+ * exist in the known SFMC Platform.Function catalog.
+ */
+
+import { platformFunctionNames } from 'ssjs-data';
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow calls to unknown Platform.Function methods',
+        },
+        messages: {
+            unknownFunction:
+                "'Platform.Function.{{name}}' is not a recognized SFMC Platform function.",
+        },
+        schema: [],
+    },
+
+    create(context) {
+        return {
+            CallExpression(node) {
+                const callee = node.callee;
+                if (callee.type !== 'MemberExpression') return;
+
+                if (
+                    callee.object.type === 'MemberExpression' &&
+                    callee.object.object.type === 'Identifier' &&
+                    callee.object.object.name === 'Platform' &&
+                    callee.object.property.type === 'Identifier' &&
+                    callee.object.property.name === 'Function' &&
+                    callee.property.type === 'Identifier'
+                ) {
+                    const methodName = callee.property.name;
+                    if (!platformFunctionNames.has(methodName.toLowerCase())) {
+                        context.report({
+                            node: callee.property,
+                            messageId: 'unknownFunction',
+                            data: { name: methodName },
+                        });
+                    }
+                }
+            },
+        };
+    },
+};

package/src/rules/ssjs/no-unknown-platform-request.js

@@ -0,0 +1,50 @@
+/**
+ * Rule: no-unknown-platform-request
+ *
+ * Flags calls to Platform.Request.* where the method name does not
+ * exist in the known SFMC Platform.Request catalog.
+ */
+
+import { PLATFORM_REQUEST_METHODS } from 'ssjs-data';
+
+const knownMethods = new Set(PLATFORM_REQUEST_METHODS.map((m) => m.name.toLowerCase()));
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow calls to unknown Platform.Request methods',
+        },
+        messages: {
+            unknownMethod: "'Platform.Request.{{name}}' is not a recognized method.",
+        },
+        schema: [],
+    },
+
+    create(context) {
+        return {
+            CallExpression(node) {
+                const callee = node.callee;
+                if (callee.type !== 'MemberExpression') return;
+
+                if (
+                    callee.object.type === 'MemberExpression' &&
+                    callee.object.object.type === 'Identifier' &&
+                    callee.object.object.name === 'Platform' &&
+                    callee.object.property.type === 'Identifier' &&
+                    callee.object.property.name === 'Request' &&
+                    callee.property.type === 'Identifier'
+                ) {
+                    const methodName = callee.property.name;
+                    if (!knownMethods.has(methodName.toLowerCase())) {
+                        context.report({
+                            node: callee.property,
+                            messageId: 'unknownMethod',
+                            data: { name: methodName },
+                        });
+                    }
+                }
+            },
+        };
+    },
+};

package/src/rules/ssjs/no-unknown-platform-response.js

@@ -0,0 +1,50 @@
+/**
+ * Rule: no-unknown-platform-response
+ *
+ * Flags calls to Platform.Response.* where the method name does not
+ * exist in the known SFMC Platform.Response catalog.
+ */
+
+import { PLATFORM_RESPONSE_METHODS } from 'ssjs-data';
+
+const knownMethods = new Set(PLATFORM_RESPONSE_METHODS.map((m) => m.name.toLowerCase()));
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow calls to unknown Platform.Response methods',
+        },
+        messages: {
+            unknownMethod: "'Platform.Response.{{name}}' is not a recognized method.",
+        },
+        schema: [],
+    },
+
+    create(context) {
+        return {
+            CallExpression(node) {
+                const callee = node.callee;
+                if (callee.type !== 'MemberExpression') return;
+
+                if (
+                    callee.object.type === 'MemberExpression' &&
+                    callee.object.object.type === 'Identifier' &&
+                    callee.object.object.name === 'Platform' &&
+                    callee.object.property.type === 'Identifier' &&
+                    callee.object.property.name === 'Response' &&
+                    callee.property.type === 'Identifier'
+                ) {
+                    const methodName = callee.property.name;
+                    if (!knownMethods.has(methodName.toLowerCase())) {
+                        context.report({
+                            node: callee.property,
+                            messageId: 'unknownMethod',
+                            data: { name: methodName },
+                        });
+                    }
+                }
+            },
+        };
+    },
+};

package/src/rules/ssjs/no-unknown-platform-variable.js

@@ -0,0 +1,50 @@
+/**
+ * Rule: no-unknown-platform-variable
+ *
+ * Flags calls to Platform.Variable.* where the method name does not
+ * exist in the known SFMC Platform.Variable catalog.
+ */
+
+import { PLATFORM_VARIABLE_METHODS } from 'ssjs-data';
+
+const knownMethods = new Set(PLATFORM_VARIABLE_METHODS.map((m) => m.name.toLowerCase()));
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow calls to unknown Platform.Variable methods',
+        },
+        messages: {
+            unknownMethod: "'Platform.Variable.{{name}}' is not a recognized method.",
+        },
+        schema: [],
+    },
+
+    create(context) {
+        return {
+            CallExpression(node) {
+                const callee = node.callee;
+                if (callee.type !== 'MemberExpression') return;
+
+                if (
+                    callee.object.type === 'MemberExpression' &&
+                    callee.object.object.type === 'Identifier' &&
+                    callee.object.object.name === 'Platform' &&
+                    callee.object.property.type === 'Identifier' &&
+                    callee.object.property.name === 'Variable' &&
+                    callee.property.type === 'Identifier'
+                ) {
+                    const methodName = callee.property.name;
+                    if (!knownMethods.has(methodName.toLowerCase())) {
+                        context.report({
+                            node: callee.property,
+                            messageId: 'unknownMethod',
+                            data: { name: methodName },
+                        });
+                    }
+                }
+            },
+        };
+    },
+};