eslint-plugin-sfmc 4.1.2 → 4.2.0

package/README.md

@@ -130,6 +130,8 @@ export default [...sfmc.configs['recommended-next'], ...sfmc.configs['embedded-n
 | [`sfmc/ssjs-no-mcn-unsupported`](docs/rules/ssjs/no-mcn-unsupported.md)                     | off (`error` in `-next`) | Flag all SSJS API usage as unsupported in Marketing Cloud Next           |
 | [`sfmc/ssjs-no-deprecated-function`](docs/rules/ssjs/no-deprecated-function.md)             | `error`                  | Flag use of deprecated SFMC SSJS APIs (e.g. ContentArea, ContentAreaObj) |
 | [`sfmc/ssjs-no-property-call`](docs/rules/ssjs/no-property-call.md)                         | `error`                  | Disallow calling Platform.Request/Response properties as functions       |
+| [`sfmc/ssjs-no-clr-header-access`](docs/rules/ssjs/no-clr-header-access.md)                 | `error`                  | Disallow CLR-unsafe reads of `HttpResponse.headers`; read via `for..in`  |
+| [`sfmc/ssjs-require-string-clr-content`](docs/rules/ssjs/require-string-clr-content.md)     | `error`                  | Require wrapping `HttpResponse.content` with `String()` before use       |
 | [`sfmc/ssjs-platform-function-arity`](docs/rules/ssjs/platform-function-arity.md)           | `error`                  | Enforce correct arity for `Platform.Function.*`                          |
 | [`sfmc/ssjs-require-platform-load-order`](docs/rules/ssjs/require-platform-load-order.md)   | `error`                  | Require `Platform.Load()` before Core usage in order                     |
 | [`sfmc/ssjs-no-hardcoded-credentials`](docs/rules/ssjs/no-hardcoded-credentials.md)         | `error`                  | Flag hardcoded keys in encryption calls                                  |

package/docs/rules/ssjs/no-clr-header-access.md

@@ -0,0 +1,91 @@
+# `sfmc/ssjs-no-clr-header-access`
+
+Flags CLR-unsafe reads of the `headers` property of an `HttpResponse` — the object
+returned by `req.send()` on a `Script.Util.HttpRequest` or `Script.Util.HttpGet`.
+
+`resp.headers` is a Common Language Runtime (CLR) object. Reading an individual
+header by indexing it (`resp.headers["Content-Type"]`), or by calling `.Get()` /
+`.Item()`, throws at runtime:
+
+```
+Use of Common Language Runtime (CLR) is not allowed
+```
+
+The only reliable way to read header values is to enumerate `resp.headers` with a
+`for..in` loop. Each enumeration key is shaped `"[Name, Value]"`, so the value is
+embedded in the key string. The `getHeaderMap()` helper parses those keys into a
+plain `{ name: value }` map (with lowercased names).
+
+## Detection
+
+The rule tracks data flow, so it only fires on a genuine response object:
+
+1. A **request** variable is one assigned from `new Script.Util.HttpRequest(...)`
+   or `Script.Util.HttpGet(...)`.
+2. A **response** variable is one assigned from `<requestVar>.send()`.
+3. CLR-style reads of `<responseVar>.headers` are then flagged.
+
+`.headers` access on any other object is ignored, so there are no false positives
+on unrelated `headers` properties.
+
+## Examples
+
+### ❌ Incorrect — CLR-style reads throw at runtime
+
+```js
+var req = new Script.Util.HttpRequest("https://api.example.com/data");
+var resp = req.send();
+
+var ct  = resp.headers["Content-Type"];       // ← throws (CLR not allowed)
+var loc = resp.headers.Get("Location");        // ← throws (CLR not allowed)
+var enc = resp.headers.Item("Content-Encoding"); // ← throws (CLR not allowed)
+```
+
+### ✅ Correct — read via a `getHeaderMap()` helper
+
+```js
+/**
+ * Build a plain { name: value } header map from an HttpResponse.
+ * Reads only the for..in enumeration keys (shaped "[Name, Value]") so it never
+ * touches a CLR value — avoiding "Use of Common Language Runtime (CLR) is not allowed".
+ * @param {object} resp - the response returned by req.send()
+ * @returns {object} map of lowercased header name => value string
+ */
+function getHeaderMap(resp) {
+    var map = {};
+    for (var k in resp.headers) {
+        var pair = String(k);
+        if (pair.charAt(0) === "[") { pair = pair.substring(1); }
+        if (pair.charAt(pair.length - 1) === "]") { pair = pair.substring(0, pair.length - 1); }
+        var idx = pair.indexOf(", ");
+        if (idx > -1) {
+            map[pair.substring(0, idx).toLowerCase()] = pair.substring(idx + 2);
+        }
+    }
+    return map;
+}
+
+var req = new Script.Util.HttpRequest("https://api.example.com/data");
+var resp = req.send();
+
+var headers = getHeaderMap(resp);
+var ct = headers["content-type"]; // names are lowercased
+```
+
+## Suggestion (quick-fix)
+
+The rule provides a suggestion that:
+
+1. Inserts the `getHeaderMap()` helper once, at the top of the file (skipped if a
+   `getHeaderMap(` function already exists).
+2. Rewrites the flagged access to `getHeaderMap(<resp>)[<key>]`.
+
+The same diagnostic and quick-fix are available in the VS Code / Cursor extension
+(`ssjs/clr-header-access`).
+
+## Rule details
+
+- **Type:** `problem`
+- **Fixable:** No (offers a suggestion)
+- **Recommended:** Yes (`error`)
+- **Strict:** Yes (`error`)

package/docs/rules/ssjs/require-string-clr-content.md

@@ -0,0 +1,69 @@
+# `sfmc/ssjs-require-string-clr-content`
+
+Requires wrapping the `content` property of an `HttpResponse` with `String()` before
+use — the object returned by `req.send()` on a `Script.Util.HttpRequest` or
+`Script.Util.HttpGet`.
+
+`resp.content` is a Common Language Runtime (CLR) string, **not** a native JavaScript
+string. Passing it directly to `Platform.Function.ParseJSON()`, calling a string
+method on it, concatenating it, or assigning it to a variable used as a string is
+unreliable in the SFMC SSJS (ES3/CLR) engine. The verified fix is to convert it with
+`String(resp.content)` first:
+
+```js
+var responseJSON = Platform.Function.ParseJSON(String(resp.content));
+```
+
+## Detection
+
+The rule tracks data flow, so it only fires on a genuine response object:
+
+1. A **request** variable is one assigned from `new Script.Util.HttpRequest(...)`
+   or `Script.Util.HttpGet(...)`.
+2. A **response** variable is one assigned from `<requestVar>.send()`.
+3. Any read of `<responseVar>.content` that is **not** already the direct argument
+   of a `String(...)` call is flagged.
+
+`.content` access on any other object is ignored, so there are no false positives on
+unrelated `content` properties.
+
+## Examples
+
+### ❌ Incorrect — raw CLR content used directly
+
+```js
+var req = new Script.Util.HttpRequest("https://api.example.com/data");
+var resp = req.send();
+
+var parsed = Platform.Function.ParseJSON(resp.content); // ← unreliable
+var body   = resp.content;                              // ← unreliable
+var msg    = "Body: " + resp.content;                   // ← unreliable
+var head   = resp.content.substring(0, 20);             // ← unreliable
+```
+
+### ✅ Correct — wrap with `String()` first
+
+```js
+var req = new Script.Util.HttpRequest("https://api.example.com/data");
+var resp = req.send();
+
+var parsed = Platform.Function.ParseJSON(String(resp.content));
+var body   = String(resp.content);
+var head   = String(resp.content).substring(0, 20);
+```
+
+## Fix (auto-fix)
+
+The rule is auto-fixable: it wraps the flagged `<resp>.content` access in
+`String(...)`. For example `ParseJSON(resp.content)` becomes
+`ParseJSON(String(resp.content))`.
+
+The same diagnostic and quick-fix are available in the VS Code / Cursor extension
+(`ssjs/clr-content-access`).
+
+## Rule details
+
+- **Type:** `problem`
+- **Fixable:** Yes (`code`)
+- **Recommended:** Yes (`error`)
+- **Strict:** Yes (`error`)

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "eslint-plugin-sfmc",
-    "version": "4.1.2",
+    "version": "4.2.0",
     "description": "ESLint plugin for Salesforce Marketing Cloud Engagement+Next - AMPscript, Server-Side JavaScript (SSJS) and Handlebars",
     "type": "module",
     "main": "src/index.js",
@@ -42,7 +42,7 @@
         "eslint-plugin-mso-email": "^2.0.0",
         "handlebars-data": "^0.3.0",
         "mso-conditional-parser": "^2.0.1",
-        "ssjs-data": "^0.14.0"
+        "ssjs-data": "^0.16.0"
     },
     "peerDependencies": {
         "eslint": ">=9.0.0"

package/src/index.js

@@ -56,6 +56,8 @@ import ssjsNoSwitchDefault from './rules/ssjs/no-switch-default.js';
 import ssjsNoTreatAsContentInjection from './rules/ssjs/no-treatascontent-injection.js';
 import ssjsArgumentTypes from './rules/ssjs/ssjs-argument-types.js';
 import ssjsCoreMethodArity from './rules/ssjs/ssjs-core-method-arity.js';
+import ssjsNoClrHeaderAccess from './rules/ssjs/no-clr-header-access.js';
+import ssjsRequireStringClrContent from './rules/ssjs/require-string-clr-content.js';
 
 // ── Handlebars (MCN) rules ──────────────────────────────────────────────────────
 
@@ -135,6 +137,8 @@ const plugin = {
         'ssjs-no-treatascontent-injection': ssjsNoTreatAsContentInjection,
         'ssjs-arg-types': ssjsArgumentTypes,
         'ssjs-core-method-arity': ssjsCoreMethodArity,
+        'ssjs-no-clr-header-access': ssjsNoClrHeaderAccess,
+        'ssjs-require-string-clr-content': ssjsRequireStringClrContent,
 
         // Handlebars (MCN) rules (hbs- prefix)
         'hbs-no-unknown-helper': hbsNoUnknownHelper,
@@ -178,6 +182,8 @@ const ssjsMcnRules = {
     'sfmc/ssjs-no-treatascontent-injection': 'off',
     'sfmc/ssjs-arg-types': 'off',
     'sfmc/ssjs-core-method-arity': 'off',
+    'sfmc/ssjs-no-clr-header-access': 'off',
+    'sfmc/ssjs-require-string-clr-content': 'off',
     'no-cond-assign': 'off',
 };
 
@@ -246,6 +252,8 @@ const ssjsRecommendedRules = {
     'sfmc/ssjs-no-treatascontent-injection': 'warn',
     'sfmc/ssjs-arg-types': 'warn',
     'sfmc/ssjs-core-method-arity': 'warn',
+    'sfmc/ssjs-no-clr-header-access': 'error',
+    'sfmc/ssjs-require-string-clr-content': 'error',
     'no-cond-assign': 'error',
 };
 
@@ -267,6 +275,8 @@ const ssjsStrictRules = {
     'sfmc/ssjs-no-treatascontent-injection': 'error',
     'sfmc/ssjs-arg-types': 'warn',
     'sfmc/ssjs-core-method-arity': 'error',
+    'sfmc/ssjs-no-clr-header-access': 'error',
+    'sfmc/ssjs-require-string-clr-content': 'error',
     'no-cond-assign': 'error',
 };
 

package/src/rules/ssjs/no-clr-header-access.js

@@ -0,0 +1,237 @@
+/**
+ * Rule: ssjs-no-clr-header-access
+ *
+ * The `headers` property of an HttpResponse (returned by `req.send()` on a
+ * `Script.Util.HttpRequest` or `Script.Util.HttpGet`) is a CLR object. Reading
+ * an individual header via indexing (`resp.headers["Content-Type"]`), a `.Get()`
+ * / `.Item()` call, or `String(resp.headers[key])` throws at runtime:
+ *
+ *     "Use of Common Language Runtime (CLR) is not allowed"
+ *
+ * The only reliable way to read header values is to enumerate `resp.headers`
+ * with a `for..in` loop — each key is shaped `"[Name, Value]"`, so the value is
+ * embedded in the key string. The `getHeaderMap()` helper parses those keys into
+ * a plain `{ name: value }` map.
+ *
+ * This rule tracks variables assigned from `req.send()` (where `req` came from a
+ * `Script.Util.HttpRequest`/`HttpGet`) and flags CLR-style reads of their
+ * `.headers`. It offers a suggestion that inserts the `getHeaderMap()` helper
+ * and rewrites the access to `getHeaderMap(resp)["name"]`.
+ */
+
+/** Canonical helper inserted by the quick-fix, mirrored from ssjs.guide. */
+const HEADER_MAP_HELPER = `/**
+ * Build a plain { name: value } header map from an HttpResponse.
+ * Reads only the for..in enumeration keys (shaped "[Name, Value]") so it never
+ * touches a CLR value — avoiding "Use of Common Language Runtime (CLR) is not allowed".
+ * @param {object} resp - the response returned by req.send()
+ * @returns {object} map of lowercased header name => value string
+ */
+function getHeaderMap(resp) {
+    var map = {};
+    for (var k in resp.headers) {
+        var pair = String(k);
+        if (pair.charAt(0) === "[") { pair = pair.substring(1); }
+        if (pair.charAt(pair.length - 1) === "]") { pair = pair.substring(0, pair.length - 1); }
+        var idx = pair.indexOf(", ");
+        if (idx > -1) {
+            map[pair.substring(0, idx).toLowerCase()] = pair.substring(idx + 2);
+        }
+    }
+    return map;
+}
+`;
+
+/**
+ * Returns true when the node is `Script.Util.HttpRequest` or
+ * `Script.Util.HttpGet` (a MemberExpression, optionally the callee of `new`).
+ *
+ * @param {import('eslint').Rule.Node} node - MemberExpression to test
+ * @returns {boolean} Whether it references a Script.Util HTTP constructor
+ */
+function isHttpConstructorMember(node) {
+    return (
+        node.type === 'MemberExpression' &&
+        node.property.type === 'Identifier' &&
+        (node.property.name === 'HttpRequest' || node.property.name === 'HttpGet') &&
+        node.object.type === 'MemberExpression' &&
+        node.object.property.type === 'Identifier' &&
+        node.object.property.name === 'Util' &&
+        node.object.object.type === 'Identifier' &&
+        node.object.object.name === 'Script'
+    );
+}
+
+/**
+ * Returns true when the node constructs a Script.Util HTTP request, i.e.
+ * `new Script.Util.HttpRequest(...)` or `Script.Util.HttpGet(...)` (the latter
+ * is commonly called without `new`).
+ *
+ * @param {import('eslint').Rule.Node} node - init expression of a declarator
+ * @returns {boolean} Whether the expression yields an HTTP request instance
+ */
+function isHttpRequestInit(node) {
+    if (!node) {
+        return false;
+    }
+    if (node.type === 'NewExpression') {
+        return isHttpConstructorMember(node.callee);
+    }
+    if (node.type === 'CallExpression') {
+        return isHttpConstructorMember(node.callee);
+    }
+    return false;
+}
+
+export default {
+    meta: {
+        type: 'problem',
+        hasSuggestions: true,
+        docs: {
+            description:
+                'Disallow CLR-unsafe reads of HttpResponse.headers (indexing, .Get(), .Item(), String()) — read headers via a for..in map instead',
+        },
+        messages: {
+            clrHeaderAccess:
+                'Reading `{{ text }}` throws "Use of Common Language Runtime (CLR) is not allowed" at runtime. ' +
+                'HttpResponse headers are only readable by enumerating with for..in — use a getHeaderMap() helper.',
+            insertHelperAndRewrite:
+                'Insert getHeaderMap() helper and read via getHeaderMap({{ respName }})[…]',
+        },
+        schema: [],
+    },
+
+    create(context) {
+        const sourceCode = context.sourceCode;
+
+        // Variable names that hold an HttpRequest/HttpGet instance.
+        const requestVariables = new Set();
+        // Variable names that hold the response of `<requestVar>.send()`.
+        const responseVariables = new Set();
+        // Deferred reports so name collection completes before we decide.
+        const pending = [];
+
+        /**
+         * Returns true when `node` is a `<requestVar>.send()` call.
+         *
+         * @param {import('eslint').Rule.Node} node - init expression
+         * @returns {boolean} Whether it is a tracked request's send() call
+         */
+        function isTrackedSendCall(node) {
+            return Boolean(
+                node &&
+                node.type === 'CallExpression' &&
+                node.callee.type === 'MemberExpression' &&
+                node.callee.property.type === 'Identifier' &&
+                node.callee.property.name === 'send' &&
+                node.callee.object.type === 'Identifier' &&
+                requestVariables.has(node.callee.object.name),
+            );
+        }
+
+        /**
+         * Returns the response variable name for a `<obj>.headers` member
+         * expression when `<obj>` is a tracked response variable, else null.
+         *
+         * @param {import('eslint').Rule.Node} headersMember - the `.headers` MemberExpression
+         * @returns {string|null} Response variable name or null
+         */
+        function trackedResponseName(headersMember) {
+            if (
+                headersMember.type === 'MemberExpression' &&
+                headersMember.property.type === 'Identifier' &&
+                headersMember.property.name === 'headers' &&
+                headersMember.object.type === 'Identifier' &&
+                responseVariables.has(headersMember.object.name)
+            ) {
+                return headersMember.object.name;
+            }
+            return null;
+        }
+
+        /**
+         * Builds the suggestion descriptor: insert the helper at the top of the
+         * program (once) and rewrite the flagged access to use getHeaderMap().
+         *
+         * @param {import('eslint').Rule.Node} reportNode - node covered by the diagnostic
+         * @param {import('eslint').Rule.Node} keyNode - the header-key expression
+         * @param {string} respName - tracked response variable name
+         * @returns {object} ESLint suggestion object
+         */
+        function buildSuggestion(reportNode, keyNode, respName) {
+            const keyText = keyNode ? sourceCode.getText(keyNode) : '';
+            return {
+                messageId: 'insertHelperAndRewrite',
+                data: { respName },
+                fix(fixer) {
+                    const fixes = [
+                        fixer.replaceText(reportNode, `getHeaderMap(${respName})[${keyText}]`),
+                    ];
+                    // Insert the helper once, at the very top of the program.
+                    if (!sourceCode.getText().includes('function getHeaderMap(')) {
+                        const program = sourceCode.ast;
+                        fixes.push(fixer.insertTextBefore(program, `${HEADER_MAP_HELPER}\n`));
+                    }
+                    return fixes;
+                },
+            };
+        }
+
+        return {
+            VariableDeclarator(node) {
+                if (node.id.type !== 'Identifier') {
+                    return;
+                }
+                if (isHttpRequestInit(node.init)) {
+                    requestVariables.add(node.id.name);
+                } else if (isTrackedSendCall(node.init)) {
+                    responseVariables.add(node.id.name);
+                }
+            },
+
+            // resp.headers["Content-Type"]  — computed index read.
+            'MemberExpression[computed=true]'(node) {
+                const respName = trackedResponseName(node.object);
+                if (!respName) {
+                    return;
+                }
+                pending.push({
+                    reportNode: node,
+                    keyNode: node.property,
+                    respName,
+                });
+            },
+
+            // resp.headers.Get(...) / resp.headers.Item(...) — CLR method call.
+            'CallExpression > MemberExpression.callee'(node) {
+                if (
+                    node.property.type !== 'Identifier' ||
+                    (node.property.name !== 'Get' && node.property.name !== 'Item')
+                ) {
+                    return;
+                }
+                const respName = trackedResponseName(node.object);
+                if (!respName) {
+                    return;
+                }
+                const call = node.parent;
+                pending.push({
+                    reportNode: call,
+                    keyNode: call.arguments.length > 0 ? call.arguments[0] : null,
+                    respName,
+                });
+            },
+
+            'Program:exit'() {
+                for (const { reportNode, keyNode, respName } of pending) {
+                    context.report({
+                        node: reportNode,
+                        messageId: 'clrHeaderAccess',
+                        data: { text: sourceCode.getText(reportNode) },
+                        suggest: [buildSuggestion(reportNode, keyNode, respName)],
+                    });
+                }
+            },
+        };
+    },
+};

package/src/rules/ssjs/require-string-clr-content.js

@@ -0,0 +1,180 @@
+/**
+ * Rule: ssjs-require-string-clr-content
+ *
+ * The `content` property of an HttpResponse (returned by `req.send()` on a
+ * `Script.Util.HttpRequest` or `Script.Util.HttpGet`) is a CLR string object,
+ * not a native JavaScript string. Using it directly — passing it to
+ * `Platform.Function.ParseJSON()`, calling a string method on it, concatenating
+ * it, or assigning it to a variable used as a string — is unreliable in the
+ * SFMC SSJS (ES3/CLR) engine.
+ *
+ * The verified fix is to wrap the value with `String(resp.content)` before any
+ * further use, e.g. `Platform.Function.ParseJSON(String(resp.content))`.
+ *
+ * This rule tracks variables assigned from `req.send()` (where `req` came from a
+ * `Script.Util.HttpRequest`/`HttpGet`) and flags any read of their `.content`
+ * that is not already the direct argument of a `String(...)` call. The quick-fix
+ * wraps the access in `String(...)`.
+ */
+
+/**
+ * Returns true when the node is `Script.Util.HttpRequest` or
+ * `Script.Util.HttpGet` (a MemberExpression, optionally the callee of `new`).
+ *
+ * @param {import('eslint').Rule.Node} node - MemberExpression to test
+ * @returns {boolean} Whether it references a Script.Util HTTP constructor
+ */
+function isHttpConstructorMember(node) {
+    return (
+        node.type === 'MemberExpression' &&
+        node.property.type === 'Identifier' &&
+        (node.property.name === 'HttpRequest' || node.property.name === 'HttpGet') &&
+        node.object.type === 'MemberExpression' &&
+        node.object.property.type === 'Identifier' &&
+        node.object.property.name === 'Util' &&
+        node.object.object.type === 'Identifier' &&
+        node.object.object.name === 'Script'
+    );
+}
+
+/**
+ * Returns true when the node constructs a Script.Util HTTP request, i.e.
+ * `new Script.Util.HttpRequest(...)` or `Script.Util.HttpGet(...)` (the latter
+ * is commonly called without `new`).
+ *
+ * @param {import('eslint').Rule.Node} node - init expression of a declarator
+ * @returns {boolean} Whether the expression yields an HTTP request instance
+ */
+function isHttpRequestInit(node) {
+    if (!node) {
+        return false;
+    }
+    if (node.type === 'NewExpression') {
+        return isHttpConstructorMember(node.callee);
+    }
+    if (node.type === 'CallExpression') {
+        return isHttpConstructorMember(node.callee);
+    }
+    return false;
+}
+
+/**
+ * Returns true when the `.content` member is already the direct single argument
+ * of a `String(...)` call — the verified-safe pattern.
+ *
+ * @param {import('eslint').Rule.Node} node - the `.content` MemberExpression
+ * @returns {boolean} Whether it is wrapped by String(...)
+ */
+function isWrappedInString(node) {
+    const parent = node.parent;
+    return Boolean(
+        parent &&
+        parent.type === 'CallExpression' &&
+        parent.callee.type === 'Identifier' &&
+        parent.callee.name === 'String' &&
+        parent.arguments.length === 1 &&
+        parent.arguments[0] === node,
+    );
+}
+
+export default {
+    meta: {
+        type: 'problem',
+        fixable: 'code',
+        docs: {
+            description:
+                'Require wrapping HttpResponse.content with String() before use — the raw CLR string is unreliable in the SSJS engine',
+        },
+        messages: {
+            clrContentAccess:
+                'Reading `{{ text }}` directly is unreliable — `content` is a CLR string, not a JavaScript string. ' +
+                'Wrap it with `String({{ text }})` before passing it to ParseJSON() or any string operation.',
+        },
+        schema: [],
+    },
+
+    create(context) {
+        const sourceCode = context.sourceCode;
+
+        // Variable names that hold an HttpRequest/HttpGet instance.
+        const requestVariables = new Set();
+        // Variable names that hold the response of `<requestVar>.send()`.
+        const responseVariables = new Set();
+        // Deferred reports so name collection completes before we decide.
+        const pending = [];
+
+        /**
+         * Returns true when `node` is a `<requestVar>.send()` call.
+         *
+         * @param {import('eslint').Rule.Node} node - init expression
+         * @returns {boolean} Whether it is a tracked request's send() call
+         */
+        function isTrackedSendCall(node) {
+            return Boolean(
+                node &&
+                node.type === 'CallExpression' &&
+                node.callee.type === 'MemberExpression' &&
+                node.callee.property.type === 'Identifier' &&
+                node.callee.property.name === 'send' &&
+                node.callee.object.type === 'Identifier' &&
+                requestVariables.has(node.callee.object.name),
+            );
+        }
+
+        /**
+         * Returns true when `node` is a `<responseVar>.content` member read on a
+         * tracked response variable.
+         *
+         * @param {import('eslint').Rule.Node} node - MemberExpression to test
+         * @returns {boolean} Whether it reads .content on a tracked response var
+         */
+        function isTrackedContentMember(node) {
+            return (
+                node.type === 'MemberExpression' &&
+                !node.computed &&
+                node.property.type === 'Identifier' &&
+                node.property.name === 'content' &&
+                node.object.type === 'Identifier' &&
+                responseVariables.has(node.object.name)
+            );
+        }
+
+        return {
+            VariableDeclarator(node) {
+                if (node.id.type !== 'Identifier') {
+                    return;
+                }
+                if (isHttpRequestInit(node.init)) {
+                    requestVariables.add(node.id.name);
+                } else if (isTrackedSendCall(node.init)) {
+                    responseVariables.add(node.id.name);
+                }
+            },
+
+            // resp.content — non-computed member read on a tracked response var.
+            'MemberExpression[computed=false]'(node) {
+                if (!isTrackedContentMember(node)) {
+                    return;
+                }
+                if (isWrappedInString(node)) {
+                    return;
+                }
+                pending.push(node);
+            },
+
+            'Program:exit'() {
+                for (const node of pending) {
+                    const text = sourceCode.getText(node);
+                    context.report({
+                        node,
+                        messageId: 'clrContentAccess',
+                        data: { text },
+                        fix(fixer) {
+                            return fixer.replaceText(node, `String(${text})`);
+                        },
+                    });
+                }
+            },
+        };
+    },
+};