eslint-plugin-sfmc 4.1.2 → 4.3.0

package/README.md

@@ -130,6 +130,8 @@ export default [...sfmc.configs['recommended-next'], ...sfmc.configs['embedded-n
 | [`sfmc/ssjs-no-mcn-unsupported`](docs/rules/ssjs/no-mcn-unsupported.md)                     | off (`error` in `-next`) | Flag all SSJS API usage as unsupported in Marketing Cloud Next           |
 | [`sfmc/ssjs-no-deprecated-function`](docs/rules/ssjs/no-deprecated-function.md)             | `error`                  | Flag use of deprecated SFMC SSJS APIs (e.g. ContentArea, ContentAreaObj) |
 | [`sfmc/ssjs-no-property-call`](docs/rules/ssjs/no-property-call.md)                         | `error`                  | Disallow calling Platform.Request/Response properties as functions       |
+| [`sfmc/ssjs-no-clr-header-access`](docs/rules/ssjs/no-clr-header-access.md)                 | `error`                  | Disallow CLR-unsafe reads of `HttpResponse.headers`; read via `for..in`  |
+| [`sfmc/ssjs-require-string-clr-content`](docs/rules/ssjs/require-string-clr-content.md)     | `error`                  | Require wrapping `HttpResponse.content` with `String()` before use       |
 | [`sfmc/ssjs-platform-function-arity`](docs/rules/ssjs/platform-function-arity.md)           | `error`                  | Enforce correct arity for `Platform.Function.*`                          |
 | [`sfmc/ssjs-require-platform-load-order`](docs/rules/ssjs/require-platform-load-order.md)   | `error`                  | Require `Platform.Load()` before Core usage in order                     |
 | [`sfmc/ssjs-no-hardcoded-credentials`](docs/rules/ssjs/no-hardcoded-credentials.md)         | `error`                  | Flag hardcoded keys in encryption calls                                  |

package/docs/rules/ssjs/http-property-value.md

@@ -0,0 +1,71 @@
+# `sfmc/ssjs-http-property-value`
+
+Flags literal assignments to writable `Script.Util.HttpRequest` / `Script.Util.HttpGet`
+instance properties whose value violates the property's documented, runtime-confirmed
+constraint (allowed enum, integer-ness, or minimum).
+
+Several request properties only accept a fixed set of values. Assigning something outside
+that set throws or silently misbehaves in the SFMC SSJS engine:
+
+| Property | Allowed values |
+|---|---|
+| `method` | `GET`, `POST`, `PUT`, `PATCH`, `DELETE` |
+| `emptyContentHandling` | `0`, `1`, `2` |
+| `retries` | non-negative integer |
+| `timeout` | non-negative integer |
+
+The allowed values live in [`ssjs-data`](../../../..) (`SCRIPT_UTIL_REQUEST_PROPERTIES` /
+`SCRIPT_UTIL_HTTPGET_PROPERTIES` → `valueConstraint`), so this rule and the VS Code /
+Cursor diagnostic (`ssjs/invalid-http-property-value`) share one source of truth.
+
+## Detection
+
+The rule tracks data flow, so it only fires on a genuine request object:
+
+1. A **request** variable is one assigned from `new Script.Util.HttpRequest(...)` or
+   `Script.Util.HttpGet(...)`.
+2. An assignment `<requestVar>.<prop> = <literal>` where `<prop>` has a `valueConstraint`
+   and the right-hand side is a **literal** (string, number, or a negative numeric like
+   `-2.45`) is validated against the constraint.
+
+Only literal values are checked. Variable / expression assignments cannot be verified
+statically and are left alone to avoid false positives.
+
+## Examples
+
+### ❌ Incorrect
+
+```js
+var req = new Script.Util.HttpRequest("https://api.example.com/data");
+
+req.emptyContentHandling = 5;   // ← allowed: 0 | 1 | 2
+req.retries = -2.45;            // ← must be a non-negative integer
+req.method = 'POT';             // ← allowed: GET | POST | PUT | PATCH | DELETE
+```
+
+### ✅ Correct
+
+```js
+var req = new Script.Util.HttpRequest("https://api.example.com/data");
+
+req.emptyContentHandling = 1;
+req.retries = 3;
+req.method = 'POST';
+```
+
+## Fix (suggestions)
+
+For enum violations the rule offers a suggestion per allowed value (e.g. replace `'POT'`
+with `'GET'`, `'POST'`, …). Numeric violations are reported without an automatic
+replacement, since there is no single unambiguous valid value.
+
+The same diagnostic and quick-fix are available in the VS Code / Cursor extension
+(`ssjs/invalid-http-property-value`).
+
+## Rule details
+
+- **Type:** `problem`
+- **Fixable:** No (offers suggestions)
+- **Recommended:** Yes (`error`)
+- **Strict:** Yes (`error`)
+- **MCN:** Off (SSJS is not supported on Marketing Cloud Next)

package/docs/rules/ssjs/no-clr-header-access.md

@@ -0,0 +1,91 @@
+# `sfmc/ssjs-no-clr-header-access`
+
+Flags CLR-unsafe reads of the `headers` property of an `HttpResponse` — the object
+returned by `req.send()` on a `Script.Util.HttpRequest` or `Script.Util.HttpGet`.
+
+`resp.headers` is a Common Language Runtime (CLR) object. Reading an individual
+header by indexing it (`resp.headers["Content-Type"]`), or by calling `.Get()` /
+`.Item()`, throws at runtime:
+
+```
+Use of Common Language Runtime (CLR) is not allowed
+```
+
+The only reliable way to read header values is to enumerate `resp.headers` with a
+`for..in` loop. Each enumeration key is shaped `"[Name, Value]"`, so the value is
+embedded in the key string. The `getHeaderMap()` helper parses those keys into a
+plain `{ name: value }` map (with lowercased names).
+
+## Detection
+
+The rule tracks data flow, so it only fires on a genuine response object:
+
+1. A **request** variable is one assigned from `new Script.Util.HttpRequest(...)`
+   or `Script.Util.HttpGet(...)`.
+2. A **response** variable is one assigned from `<requestVar>.send()`.
+3. CLR-style reads of `<responseVar>.headers` are then flagged.
+
+`.headers` access on any other object is ignored, so there are no false positives
+on unrelated `headers` properties.
+
+## Examples
+
+### ❌ Incorrect — CLR-style reads throw at runtime
+
+```js
+var req = new Script.Util.HttpRequest("https://api.example.com/data");
+var resp = req.send();
+
+var ct  = resp.headers["Content-Type"];       // ← throws (CLR not allowed)
+var loc = resp.headers.Get("Location");        // ← throws (CLR not allowed)
+var enc = resp.headers.Item("Content-Encoding"); // ← throws (CLR not allowed)
+```
+
+### ✅ Correct — read via a `getHeaderMap()` helper
+
+```js
+/**
+ * Build a plain { name: value } header map from an HttpResponse.
+ * Reads only the for..in enumeration keys (shaped "[Name, Value]") so it never
+ * touches a CLR value — avoiding "Use of Common Language Runtime (CLR) is not allowed".
+ * @param {object} resp - the response returned by req.send()
+ * @returns {object} map of lowercased header name => value string
+ */
+function getHeaderMap(resp) {
+    var map = {};
+    for (var k in resp.headers) {
+        var pair = String(k);
+        if (pair.charAt(0) === "[") { pair = pair.substring(1); }
+        if (pair.charAt(pair.length - 1) === "]") { pair = pair.substring(0, pair.length - 1); }
+        var idx = pair.indexOf(", ");
+        if (idx > -1) {
+            map[pair.substring(0, idx).toLowerCase()] = pair.substring(idx + 2);
+        }
+    }
+    return map;
+}
+
+var req = new Script.Util.HttpRequest("https://api.example.com/data");
+var resp = req.send();
+
+var headers = getHeaderMap(resp);
+var ct = headers["content-type"]; // names are lowercased
+```
+
+## Suggestion (quick-fix)
+
+The rule provides a suggestion that:
+
+1. Inserts the `getHeaderMap()` helper once, at the top of the file (skipped if a
+   `getHeaderMap(` function already exists).
+2. Rewrites the flagged access to `getHeaderMap(<resp>)[<key>]`.
+
+The same diagnostic and quick-fix are available in the VS Code / Cursor extension
+(`ssjs/clr-header-access`).
+
+## Rule details
+
+- **Type:** `problem`
+- **Fixable:** No (offers a suggestion)
+- **Recommended:** Yes (`error`)
+- **Strict:** Yes (`error`)

package/docs/rules/ssjs/no-unavailable-method.md

@@ -21,7 +21,8 @@ return wrong results:
   - `lastIndexOf` always returns `-1`.
 
 This rule detects both categories and offers a lightbulb suggestion to insert a polyfill
-at the end of the file.
+at the top of the file (after a leading `/* global … */` directive when present), matching
+the language-server quick-fix so both tools place polyfills consistently.
 
 ## Covered methods
 

package/docs/rules/ssjs/require-string-clr-content.md

@@ -0,0 +1,69 @@
+# `sfmc/ssjs-require-string-clr-content`
+
+Requires wrapping the `content` property of an `HttpResponse` with `String()` before
+use — the object returned by `req.send()` on a `Script.Util.HttpRequest` or
+`Script.Util.HttpGet`.
+
+`resp.content` is a Common Language Runtime (CLR) string, **not** a native JavaScript
+string. Passing it directly to `Platform.Function.ParseJSON()`, calling a string
+method on it, concatenating it, or assigning it to a variable used as a string is
+unreliable in the SFMC SSJS (ES3/CLR) engine. The verified fix is to convert it with
+`String(resp.content)` first:
+
+```js
+var responseJSON = Platform.Function.ParseJSON(String(resp.content));
+```
+
+## Detection
+
+The rule tracks data flow, so it only fires on a genuine response object:
+
+1. A **request** variable is one assigned from `new Script.Util.HttpRequest(...)`
+   or `Script.Util.HttpGet(...)`.
+2. A **response** variable is one assigned from `<requestVar>.send()`.
+3. Any read of `<responseVar>.content` that is **not** already the direct argument
+   of a `String(...)` call is flagged.
+
+`.content` access on any other object is ignored, so there are no false positives on
+unrelated `content` properties.
+
+## Examples
+
+### ❌ Incorrect — raw CLR content used directly
+
+```js
+var req = new Script.Util.HttpRequest("https://api.example.com/data");
+var resp = req.send();
+
+var parsed = Platform.Function.ParseJSON(resp.content); // ← unreliable
+var body   = resp.content;                              // ← unreliable
+var msg    = "Body: " + resp.content;                   // ← unreliable
+var head   = resp.content.substring(0, 20);             // ← unreliable
+```
+
+### ✅ Correct — wrap with `String()` first
+
+```js
+var req = new Script.Util.HttpRequest("https://api.example.com/data");
+var resp = req.send();
+
+var parsed = Platform.Function.ParseJSON(String(resp.content));
+var body   = String(resp.content);
+var head   = String(resp.content).substring(0, 20);
+```
+
+## Fix (auto-fix)
+
+The rule is auto-fixable: it wraps the flagged `<resp>.content` access in
+`String(...)`. For example `ParseJSON(resp.content)` becomes
+`ParseJSON(String(resp.content))`.
+
+The same diagnostic and quick-fix are available in the VS Code / Cursor extension
+(`ssjs/clr-content-access`).
+
+## Rule details
+
+- **Type:** `problem`
+- **Fixable:** Yes (`code`)
+- **Recommended:** Yes (`error`)
+- **Strict:** Yes (`error`)

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "eslint-plugin-sfmc",
-    "version": "4.1.2",
+    "version": "4.3.0",
     "description": "ESLint plugin for Salesforce Marketing Cloud Engagement+Next - AMPscript, Server-Side JavaScript (SSJS) and Handlebars",
     "type": "module",
     "main": "src/index.js",
@@ -42,7 +42,7 @@
         "eslint-plugin-mso-email": "^2.0.0",
         "handlebars-data": "^0.3.0",
         "mso-conditional-parser": "^2.0.1",
-        "ssjs-data": "^0.14.0"
+        "ssjs-data": "^0.18.0"
     },
     "peerDependencies": {
         "eslint": ">=9.0.0"

package/src/index.js

@@ -56,6 +56,9 @@ import ssjsNoSwitchDefault from './rules/ssjs/no-switch-default.js';
 import ssjsNoTreatAsContentInjection from './rules/ssjs/no-treatascontent-injection.js';
 import ssjsArgumentTypes from './rules/ssjs/ssjs-argument-types.js';
 import ssjsCoreMethodArity from './rules/ssjs/ssjs-core-method-arity.js';
+import ssjsNoClrHeaderAccess from './rules/ssjs/no-clr-header-access.js';
+import ssjsRequireStringClrContent from './rules/ssjs/require-string-clr-content.js';
+import ssjsHttpPropertyValue from './rules/ssjs/http-property-value.js';
 
 // ── Handlebars (MCN) rules ──────────────────────────────────────────────────────
 
@@ -135,6 +138,9 @@ const plugin = {
         'ssjs-no-treatascontent-injection': ssjsNoTreatAsContentInjection,
         'ssjs-arg-types': ssjsArgumentTypes,
         'ssjs-core-method-arity': ssjsCoreMethodArity,
+        'ssjs-no-clr-header-access': ssjsNoClrHeaderAccess,
+        'ssjs-require-string-clr-content': ssjsRequireStringClrContent,
+        'ssjs-http-property-value': ssjsHttpPropertyValue,
 
         // Handlebars (MCN) rules (hbs- prefix)
         'hbs-no-unknown-helper': hbsNoUnknownHelper,
@@ -178,6 +184,9 @@ const ssjsMcnRules = {
     'sfmc/ssjs-no-treatascontent-injection': 'off',
     'sfmc/ssjs-arg-types': 'off',
     'sfmc/ssjs-core-method-arity': 'off',
+    'sfmc/ssjs-no-clr-header-access': 'off',
+    'sfmc/ssjs-require-string-clr-content': 'off',
+    'sfmc/ssjs-http-property-value': 'off',
     'no-cond-assign': 'off',
 };
 
@@ -246,6 +255,9 @@ const ssjsRecommendedRules = {
     'sfmc/ssjs-no-treatascontent-injection': 'warn',
     'sfmc/ssjs-arg-types': 'warn',
     'sfmc/ssjs-core-method-arity': 'warn',
+    'sfmc/ssjs-no-clr-header-access': 'error',
+    'sfmc/ssjs-require-string-clr-content': 'error',
+    'sfmc/ssjs-http-property-value': 'error',
     'no-cond-assign': 'error',
 };
 
@@ -267,6 +279,9 @@ const ssjsStrictRules = {
     'sfmc/ssjs-no-treatascontent-injection': 'error',
     'sfmc/ssjs-arg-types': 'warn',
     'sfmc/ssjs-core-method-arity': 'error',
+    'sfmc/ssjs-no-clr-header-access': 'error',
+    'sfmc/ssjs-require-string-clr-content': 'error',
+    'sfmc/ssjs-http-property-value': 'error',
     'no-cond-assign': 'error',
 };
 

package/src/rules/ssjs/http-property-value.js

@@ -0,0 +1,232 @@
+/**
+ * Rule: ssjs-http-property-value
+ *
+ * Flags literal assignments to writable `Script.Util.HttpRequest` /
+ * `Script.Util.HttpGet` instance properties whose value violates the property's
+ * documented, runtime-confirmed constraint (allowed enum, integer-ness, or
+ * minimum). Examples that throw or misbehave at runtime:
+ *
+ *     req.emptyContentHandling = 5;   // allowed: 0 | 1 | 2
+ *     req.retries = -2.45;            // must be a non-negative integer
+ *     req.method = 'POT';             // allowed: GET | POST | PUT | PATCH | DELETE
+ *
+ * Constraints live in ssjs-data (`SCRIPT_UTIL_REQUEST_PROPERTIES` /
+ * `SCRIPT_UTIL_HTTPGET_PROPERTIES` -> `valueConstraint`) so the LSP diagnostic
+ * (`ssjs/invalid-http-property-value`) and this rule share one source of truth.
+ * Only **literal** right-hand sides are checked; variables / expressions cannot
+ * be statically verified and are left alone to avoid false positives.
+ */
+
+import { SCRIPT_UTIL_REQUEST_PROPERTIES, SCRIPT_UTIL_HTTPGET_PROPERTIES } from 'ssjs-data';
+
+/**
+ * Map of property name => valueConstraint, built once from ssjs-data. When both
+ * request and get define the same property, the constraints are identical.
+ *
+ * @returns {Map<string, object>} property name -> valueConstraint
+ */
+function buildConstraintLookup() {
+    const lookup = new Map();
+    for (const property of [...SCRIPT_UTIL_REQUEST_PROPERTIES, ...SCRIPT_UTIL_HTTPGET_PROPERTIES]) {
+        if (property && property.valueConstraint && !lookup.has(property.name)) {
+            lookup.set(property.name, property.valueConstraint);
+        }
+    }
+    return lookup;
+}
+
+const constraintLookup = buildConstraintLookup();
+
+/**
+ * Returns true when the node is `Script.Util.HttpRequest` or
+ * `Script.Util.HttpGet` (a MemberExpression, optionally the callee of `new`).
+ *
+ * @param {import('eslint').Rule.Node} node - MemberExpression to test
+ * @returns {boolean} Whether it references a Script.Util HTTP constructor
+ */
+function isHttpConstructorMember(node) {
+    return (
+        node.type === 'MemberExpression' &&
+        node.property.type === 'Identifier' &&
+        (node.property.name === 'HttpRequest' || node.property.name === 'HttpGet') &&
+        node.object.type === 'MemberExpression' &&
+        node.object.property.type === 'Identifier' &&
+        node.object.property.name === 'Util' &&
+        node.object.object.type === 'Identifier' &&
+        node.object.object.name === 'Script'
+    );
+}
+
+/**
+ * Returns true when the node constructs a Script.Util HTTP request, i.e.
+ * `new Script.Util.HttpRequest(...)` or `Script.Util.HttpGet(...)`.
+ *
+ * @param {import('eslint').Rule.Node} node - init expression of a declarator
+ * @returns {boolean} Whether the expression yields an HTTP request instance
+ */
+function isHttpRequestInit(node) {
+    if (!node) {
+        return false;
+    }
+    if (node.type === 'NewExpression' || node.type === 'CallExpression') {
+        return isHttpConstructorMember(node.callee);
+    }
+    return false;
+}
+
+/**
+ * Extracts the literal value from a RHS node, or null when it is not a plain
+ * literal (string / number / boolean, incl. a negative numeric like `-2.45`).
+ *
+ * @param {import('eslint').Rule.Node} node - the assignment right-hand side
+ * @returns {{value: string|number|boolean}|null} parsed value wrapper or null
+ */
+function parseLiteral(node) {
+    if (node.type === 'Literal' && typeof node.value !== 'object' && node.value !== null) {
+        return { value: node.value };
+    }
+    // Unary minus / plus on a numeric literal, e.g. -2.45.
+    if (
+        node.type === 'UnaryExpression' &&
+        (node.operator === '-' || node.operator === '+') &&
+        node.argument.type === 'Literal' &&
+        typeof node.argument.value === 'number'
+    ) {
+        const n = node.operator === '-' ? -node.argument.value : node.argument.value;
+        return { value: n };
+    }
+    return null;
+}
+
+/**
+ * Validates a value against a constraint. Returns a human-readable violation
+ * fragment (e.g. `must be one of "GET", "POST"`) or null when the value is ok.
+ *
+ * @param {string|number|boolean} value - the parsed literal value
+ * @param {object} constraint - the valueConstraint from ssjs-data
+ * @returns {string|null} violation description or null when valid
+ */
+function checkConstraint(value, constraint) {
+    if (Array.isArray(constraint.enum)) {
+        if (!constraint.enum.includes(value)) {
+            const allowed = constraint.enum
+                .map((v) => (typeof v === 'string' ? `"${v}"` : String(v)))
+                .join(', ');
+            return `must be one of ${allowed}`;
+        }
+        return null;
+    }
+    if (constraint.numeric) {
+        if (typeof value !== 'number') {
+            return 'must be a number';
+        }
+        if (constraint.numeric === 'integer' && !Number.isSafeInteger(value)) {
+            return 'must be an integer';
+        }
+        if (typeof constraint.min === 'number' && value < constraint.min) {
+            return `must be >= ${constraint.min}`;
+        }
+        return null;
+    }
+    return null;
+}
+
+/**
+ * Builds source-ready replacement suggestions for a violation. Enum -> each
+ * allowed value (quoted for strings) with its optional `enumLabels` meaning.
+ * Numeric -> nothing (no single fix).
+ *
+ * @param {object} constraint - the valueConstraint from ssjs-data
+ * @returns {{code: string, label?: string}[]} replacement snippets to offer as suggestions
+ */
+function buildSuggestions(constraint) {
+    if (Array.isArray(constraint.enum)) {
+        const labels = constraint.enumLabels;
+        return constraint.enum.map((v) => ({
+            code: typeof v === 'string' ? `'${v}'` : String(v),
+            label: labels ? labels[String(v)] : undefined,
+        }));
+    }
+    return [];
+}
+
+export default {
+    meta: {
+        type: 'problem',
+        hasSuggestions: true,
+        docs: {
+            description:
+                'Disallow invalid literal values assigned to Script.Util.HttpRequest/HttpGet properties (e.g. method, emptyContentHandling, retries) based on their documented allowed values',
+        },
+        messages: {
+            invalidValue: 'Invalid value for {{ prop }}: it {{ violation }}.',
+            replaceWith: 'Replace with {{ value }}',
+            replaceWithLabel: 'Replace with {{ value }} ({{ label }})',
+        },
+        schema: [],
+    },
+
+    create(context) {
+        const requestVariables = new Set();
+        const pending = [];
+
+        return {
+            VariableDeclarator(node) {
+                if (node.id.type === 'Identifier' && isHttpRequestInit(node.init)) {
+                    requestVariables.add(node.id.name);
+                }
+            },
+
+            AssignmentExpression(node) {
+                if (
+                    node.operator !== '=' ||
+                    node.left.type !== 'MemberExpression' ||
+                    node.left.computed ||
+                    node.left.object.type !== 'Identifier' ||
+                    !requestVariables.has(node.left.object.name) ||
+                    node.left.property.type !== 'Identifier'
+                ) {
+                    return;
+                }
+                const propertyName = node.left.property.name;
+                const constraint = constraintLookup.get(propertyName);
+                if (!constraint) {
+                    return;
+                }
+                const parsed = parseLiteral(node.right);
+                if (!parsed) {
+                    return;
+                }
+                const violation = checkConstraint(parsed.value, constraint);
+                if (!violation) {
+                    return;
+                }
+                pending.push({ rhs: node.right, propName: propertyName, violation, constraint });
+            },
+
+            'Program:exit'() {
+                for (const { rhs, propName, violation, constraint } of pending) {
+                    const suggest = buildSuggestions(constraint).map(({ code, label }) =>
+                        label
+                            ? {
+                                  messageId: 'replaceWithLabel',
+                                  data: { value: code, label },
+                                  fix: (fixer) => fixer.replaceText(rhs, code),
+                              }
+                            : {
+                                  messageId: 'replaceWith',
+                                  data: { value: code },
+                                  fix: (fixer) => fixer.replaceText(rhs, code),
+                              },
+                    );
+                    context.report({
+                        node: rhs,
+                        messageId: 'invalidValue',
+                        data: { prop: propName, violation },
+                        suggest,
+                    });
+                }
+            },
+        };
+    },
+};

package/src/rules/ssjs/no-clr-header-access.js

@@ -0,0 +1,237 @@
+/**
+ * Rule: ssjs-no-clr-header-access
+ *
+ * The `headers` property of an HttpResponse (returned by `req.send()` on a
+ * `Script.Util.HttpRequest` or `Script.Util.HttpGet`) is a CLR object. Reading
+ * an individual header via indexing (`resp.headers["Content-Type"]`), a `.Get()`
+ * / `.Item()` call, or `String(resp.headers[key])` throws at runtime:
+ *
+ *     "Use of Common Language Runtime (CLR) is not allowed"
+ *
+ * The only reliable way to read header values is to enumerate `resp.headers`
+ * with a `for..in` loop — each key is shaped `"[Name, Value]"`, so the value is
+ * embedded in the key string. The `getHeaderMap()` helper parses those keys into
+ * a plain `{ name: value }` map.
+ *
+ * This rule tracks variables assigned from `req.send()` (where `req` came from a
+ * `Script.Util.HttpRequest`/`HttpGet`) and flags CLR-style reads of their
+ * `.headers`. It offers a suggestion that inserts the `getHeaderMap()` helper
+ * and rewrites the access to `getHeaderMap(resp)["name"]`.
+ */
+
+/** Canonical helper inserted by the quick-fix, mirrored from ssjs.guide. */
+const HEADER_MAP_HELPER = `/**
+ * Build a plain { name: value } header map from an HttpResponse.
+ * Reads only the for..in enumeration keys (shaped "[Name, Value]") so it never
+ * touches a CLR value — avoiding "Use of Common Language Runtime (CLR) is not allowed".
+ * @param {object} resp - the response returned by req.send()
+ * @returns {object} map of lowercased header name => value string
+ */
+function getHeaderMap(resp) {
+    var map = {};
+    for (var k in resp.headers) {
+        var pair = String(k);
+        if (pair.charAt(0) === "[") { pair = pair.substring(1); }
+        if (pair.charAt(pair.length - 1) === "]") { pair = pair.substring(0, pair.length - 1); }
+        var idx = pair.indexOf(", ");
+        if (idx > -1) {
+            map[pair.substring(0, idx).toLowerCase()] = pair.substring(idx + 2);
+        }
+    }
+    return map;
+}
+`;
+
+/**
+ * Returns true when the node is `Script.Util.HttpRequest` or
+ * `Script.Util.HttpGet` (a MemberExpression, optionally the callee of `new`).
+ *
+ * @param {import('eslint').Rule.Node} node - MemberExpression to test
+ * @returns {boolean} Whether it references a Script.Util HTTP constructor
+ */
+function isHttpConstructorMember(node) {
+    return (
+        node.type === 'MemberExpression' &&
+        node.property.type === 'Identifier' &&
+        (node.property.name === 'HttpRequest' || node.property.name === 'HttpGet') &&
+        node.object.type === 'MemberExpression' &&
+        node.object.property.type === 'Identifier' &&
+        node.object.property.name === 'Util' &&
+        node.object.object.type === 'Identifier' &&
+        node.object.object.name === 'Script'
+    );
+}
+
+/**
+ * Returns true when the node constructs a Script.Util HTTP request, i.e.
+ * `new Script.Util.HttpRequest(...)` or `Script.Util.HttpGet(...)` (the latter
+ * is commonly called without `new`).
+ *
+ * @param {import('eslint').Rule.Node} node - init expression of a declarator
+ * @returns {boolean} Whether the expression yields an HTTP request instance
+ */
+function isHttpRequestInit(node) {
+    if (!node) {
+        return false;
+    }
+    if (node.type === 'NewExpression') {
+        return isHttpConstructorMember(node.callee);
+    }
+    if (node.type === 'CallExpression') {
+        return isHttpConstructorMember(node.callee);
+    }
+    return false;
+}
+
+export default {
+    meta: {
+        type: 'problem',
+        hasSuggestions: true,
+        docs: {
+            description:
+                'Disallow CLR-unsafe reads of HttpResponse.headers (indexing, .Get(), .Item(), String()) — read headers via a for..in map instead',
+        },
+        messages: {
+            clrHeaderAccess:
+                'Reading `{{ text }}` throws "Use of Common Language Runtime (CLR) is not allowed" at runtime. ' +
+                'HttpResponse headers are only readable by enumerating with for..in — use a getHeaderMap() helper.',
+            insertHelperAndRewrite:
+                'Insert getHeaderMap() helper and read via getHeaderMap({{ respName }})[…]',
+        },
+        schema: [],
+    },
+
+    create(context) {
+        const sourceCode = context.sourceCode;
+
+        // Variable names that hold an HttpRequest/HttpGet instance.
+        const requestVariables = new Set();
+        // Variable names that hold the response of `<requestVar>.send()`.
+        const responseVariables = new Set();
+        // Deferred reports so name collection completes before we decide.
+        const pending = [];
+
+        /**
+         * Returns true when `node` is a `<requestVar>.send()` call.
+         *
+         * @param {import('eslint').Rule.Node} node - init expression
+         * @returns {boolean} Whether it is a tracked request's send() call
+         */
+        function isTrackedSendCall(node) {
+            return Boolean(
+                node &&
+                node.type === 'CallExpression' &&
+                node.callee.type === 'MemberExpression' &&
+                node.callee.property.type === 'Identifier' &&
+                node.callee.property.name === 'send' &&
+                node.callee.object.type === 'Identifier' &&
+                requestVariables.has(node.callee.object.name),
+            );
+        }
+
+        /**
+         * Returns the response variable name for a `<obj>.headers` member
+         * expression when `<obj>` is a tracked response variable, else null.
+         *
+         * @param {import('eslint').Rule.Node} headersMember - the `.headers` MemberExpression
+         * @returns {string|null} Response variable name or null
+         */
+        function trackedResponseName(headersMember) {
+            if (
+                headersMember.type === 'MemberExpression' &&
+                headersMember.property.type === 'Identifier' &&
+                headersMember.property.name === 'headers' &&
+                headersMember.object.type === 'Identifier' &&
+                responseVariables.has(headersMember.object.name)
+            ) {
+                return headersMember.object.name;
+            }
+            return null;
+        }
+
+        /**
+         * Builds the suggestion descriptor: insert the helper at the top of the
+         * program (once) and rewrite the flagged access to use getHeaderMap().
+         *
+         * @param {import('eslint').Rule.Node} reportNode - node covered by the diagnostic
+         * @param {import('eslint').Rule.Node} keyNode - the header-key expression
+         * @param {string} respName - tracked response variable name
+         * @returns {object} ESLint suggestion object
+         */
+        function buildSuggestion(reportNode, keyNode, respName) {
+            const keyText = keyNode ? sourceCode.getText(keyNode) : '';
+            return {
+                messageId: 'insertHelperAndRewrite',
+                data: { respName },
+                fix(fixer) {
+                    const fixes = [
+                        fixer.replaceText(reportNode, `getHeaderMap(${respName})[${keyText}]`),
+                    ];
+                    // Insert the helper once, at the very top of the program.
+                    if (!sourceCode.getText().includes('function getHeaderMap(')) {
+                        const program = sourceCode.ast;
+                        fixes.push(fixer.insertTextBefore(program, `${HEADER_MAP_HELPER}\n`));
+                    }
+                    return fixes;
+                },
+            };
+        }
+
+        return {
+            VariableDeclarator(node) {
+                if (node.id.type !== 'Identifier') {
+                    return;
+                }
+                if (isHttpRequestInit(node.init)) {
+                    requestVariables.add(node.id.name);
+                } else if (isTrackedSendCall(node.init)) {
+                    responseVariables.add(node.id.name);
+                }
+            },
+
+            // resp.headers["Content-Type"]  — computed index read.
+            'MemberExpression[computed=true]'(node) {
+                const respName = trackedResponseName(node.object);
+                if (!respName) {
+                    return;
+                }
+                pending.push({
+                    reportNode: node,
+                    keyNode: node.property,
+                    respName,
+                });
+            },
+
+            // resp.headers.Get(...) / resp.headers.Item(...) — CLR method call.
+            'CallExpression > MemberExpression.callee'(node) {
+                if (
+                    node.property.type !== 'Identifier' ||
+                    (node.property.name !== 'Get' && node.property.name !== 'Item')
+                ) {
+                    return;
+                }
+                const respName = trackedResponseName(node.object);
+                if (!respName) {
+                    return;
+                }
+                const call = node.parent;
+                pending.push({
+                    reportNode: call,
+                    keyNode: call.arguments.length > 0 ? call.arguments[0] : null,
+                    respName,
+                });
+            },
+
+            'Program:exit'() {
+                for (const { reportNode, keyNode, respName } of pending) {
+                    context.report({
+                        node: reportNode,
+                        messageId: 'clrHeaderAccess',
+                        data: { text: sourceCode.getText(reportNode) },
+                        suggest: [buildSuggestion(reportNode, keyNode, respName)],
+                    });
+                }
+            },
+        };
+    },
+};

package/src/rules/ssjs/no-unavailable-method.js

@@ -7,7 +7,7 @@
  * Two catalogs from ssjs-data feed this rule:
  *
  * 1. POLYFILLABLE_METHODS — a shipped ES3-safe polyfill exists. The report
- *    carries a suggestion that inserts the polyfill at the end of the file.
+ *    carries a suggestion that inserts the polyfill at the top of the file.
  * 2. KNOWN_UNSUPPORTED — no polyfill is feasible. The report has no fix; the
  *    message carries the ssjs-data `suggestion` (e.g. use Platform.Function.X).
  *
@@ -15,8 +15,9 @@
  * - category 'broken': method exists natively but returns incorrect results.
  *
  * No auto-fix is applied because prototype assignments are not hoisted —
- * the suggestion inserts the polyfill at the end of the file, and users
- * should verify placement before the first call (or load via Content Block).
+ * the suggestion inserts the polyfill at the top of the file (after a leading
+ * `/* global *\/` directive when present), and users should verify placement
+ * before the first call (or load via Content Block).
  */
 
 import {
@@ -58,7 +59,7 @@ export default {
             broken:
                 "'{{owner}}.{{method}}' exists in SFMC SSJS but produces incorrect results. " +
                 'Add a polyfill to get the correct behavior.',
-            addPolyfill: "Insert '{{owner}}.{{method}}' polyfill at end of file",
+            addPolyfill: "Insert '{{owner}}.{{method}}' polyfill at top of file",
             unavailableNoPolyfill:
                 "'{{owner}}.{{method}}' is not available in SFMC SSJS (ECMAScript 3). {{suggestion}}",
             brokenNoPolyfill:
@@ -99,8 +100,21 @@ export default {
         function buildSuggestFix(entry) {
             return function fix(fixer) {
                 const source = context.sourceCode;
-                const end = source.ast.range[1];
-                return fixer.insertTextAfterRange([end, end], '\n\n' + entry.polyfill);
+                // Insert the polyfill at the TOP of the file so it is defined
+                // before any call site (SSJS does not hoist prototype
+                // assignments). This mirrors the LSP quick-fix. When a leading
+                // `/* global ... */` ESLint directive is the first comment,
+                // insert right after it so the directive stays at the very top.
+                const leadingGlobal = source
+                    .getAllComments()
+                    .find(
+                        (c) =>
+                            c.type === 'Block' && c.range[0] === 0 && /^\s*global\b/.test(c.value),
+                    );
+                if (leadingGlobal) {
+                    return fixer.insertTextAfterRange(leadingGlobal.range, '\n\n' + entry.polyfill);
+                }
+                return fixer.insertTextBeforeRange([0, 0], entry.polyfill + '\n\n');
             };
         }
 

package/src/rules/ssjs/require-string-clr-content.js

@@ -0,0 +1,180 @@
+/**
+ * Rule: ssjs-require-string-clr-content
+ *
+ * The `content` property of an HttpResponse (returned by `req.send()` on a
+ * `Script.Util.HttpRequest` or `Script.Util.HttpGet`) is a CLR string object,
+ * not a native JavaScript string. Using it directly — passing it to
+ * `Platform.Function.ParseJSON()`, calling a string method on it, concatenating
+ * it, or assigning it to a variable used as a string — is unreliable in the
+ * SFMC SSJS (ES3/CLR) engine.
+ *
+ * The verified fix is to wrap the value with `String(resp.content)` before any
+ * further use, e.g. `Platform.Function.ParseJSON(String(resp.content))`.
+ *
+ * This rule tracks variables assigned from `req.send()` (where `req` came from a
+ * `Script.Util.HttpRequest`/`HttpGet`) and flags any read of their `.content`
+ * that is not already the direct argument of a `String(...)` call. The quick-fix
+ * wraps the access in `String(...)`.
+ */
+
+/**
+ * Returns true when the node is `Script.Util.HttpRequest` or
+ * `Script.Util.HttpGet` (a MemberExpression, optionally the callee of `new`).
+ *
+ * @param {import('eslint').Rule.Node} node - MemberExpression to test
+ * @returns {boolean} Whether it references a Script.Util HTTP constructor
+ */
+function isHttpConstructorMember(node) {
+    return (
+        node.type === 'MemberExpression' &&
+        node.property.type === 'Identifier' &&
+        (node.property.name === 'HttpRequest' || node.property.name === 'HttpGet') &&
+        node.object.type === 'MemberExpression' &&
+        node.object.property.type === 'Identifier' &&
+        node.object.property.name === 'Util' &&
+        node.object.object.type === 'Identifier' &&
+        node.object.object.name === 'Script'
+    );
+}
+
+/**
+ * Returns true when the node constructs a Script.Util HTTP request, i.e.
+ * `new Script.Util.HttpRequest(...)` or `Script.Util.HttpGet(...)` (the latter
+ * is commonly called without `new`).
+ *
+ * @param {import('eslint').Rule.Node} node - init expression of a declarator
+ * @returns {boolean} Whether the expression yields an HTTP request instance
+ */
+function isHttpRequestInit(node) {
+    if (!node) {
+        return false;
+    }
+    if (node.type === 'NewExpression') {
+        return isHttpConstructorMember(node.callee);
+    }
+    if (node.type === 'CallExpression') {
+        return isHttpConstructorMember(node.callee);
+    }
+    return false;
+}
+
+/**
+ * Returns true when the `.content` member is already the direct single argument
+ * of a `String(...)` call — the verified-safe pattern.
+ *
+ * @param {import('eslint').Rule.Node} node - the `.content` MemberExpression
+ * @returns {boolean} Whether it is wrapped by String(...)
+ */
+function isWrappedInString(node) {
+    const parent = node.parent;
+    return Boolean(
+        parent &&
+        parent.type === 'CallExpression' &&
+        parent.callee.type === 'Identifier' &&
+        parent.callee.name === 'String' &&
+        parent.arguments.length === 1 &&
+        parent.arguments[0] === node,
+    );
+}
+
+export default {
+    meta: {
+        type: 'problem',
+        fixable: 'code',
+        docs: {
+            description:
+                'Require wrapping HttpResponse.content with String() before use — the raw CLR string is unreliable in the SSJS engine',
+        },
+        messages: {
+            clrContentAccess:
+                'Reading `{{ text }}` directly is unreliable — `content` is a CLR string, not a JavaScript string. ' +
+                'Wrap it with `String({{ text }})` before passing it to ParseJSON() or any string operation.',
+        },
+        schema: [],
+    },
+
+    create(context) {
+        const sourceCode = context.sourceCode;
+
+        // Variable names that hold an HttpRequest/HttpGet instance.
+        const requestVariables = new Set();
+        // Variable names that hold the response of `<requestVar>.send()`.
+        const responseVariables = new Set();
+        // Deferred reports so name collection completes before we decide.
+        const pending = [];
+
+        /**
+         * Returns true when `node` is a `<requestVar>.send()` call.
+         *
+         * @param {import('eslint').Rule.Node} node - init expression
+         * @returns {boolean} Whether it is a tracked request's send() call
+         */
+        function isTrackedSendCall(node) {
+            return Boolean(
+                node &&
+                node.type === 'CallExpression' &&
+                node.callee.type === 'MemberExpression' &&
+                node.callee.property.type === 'Identifier' &&
+                node.callee.property.name === 'send' &&
+                node.callee.object.type === 'Identifier' &&
+                requestVariables.has(node.callee.object.name),
+            );
+        }
+
+        /**
+         * Returns true when `node` is a `<responseVar>.content` member read on a
+         * tracked response variable.
+         *
+         * @param {import('eslint').Rule.Node} node - MemberExpression to test
+         * @returns {boolean} Whether it reads .content on a tracked response var
+         */
+        function isTrackedContentMember(node) {
+            return (
+                node.type === 'MemberExpression' &&
+                !node.computed &&
+                node.property.type === 'Identifier' &&
+                node.property.name === 'content' &&
+                node.object.type === 'Identifier' &&
+                responseVariables.has(node.object.name)
+            );
+        }
+
+        return {
+            VariableDeclarator(node) {
+                if (node.id.type !== 'Identifier') {
+                    return;
+                }
+                if (isHttpRequestInit(node.init)) {
+                    requestVariables.add(node.id.name);
+                } else if (isTrackedSendCall(node.init)) {
+                    responseVariables.add(node.id.name);
+                }
+            },
+
+            // resp.content — non-computed member read on a tracked response var.
+            'MemberExpression[computed=false]'(node) {
+                if (!isTrackedContentMember(node)) {
+                    return;
+                }
+                if (isWrappedInString(node)) {
+                    return;
+                }
+                pending.push(node);
+            },
+
+            'Program:exit'() {
+                for (const node of pending) {
+                    const text = sourceCode.getText(node);
+                    context.report({
+                        node,
+                        messageId: 'clrContentAccess',
+                        data: { text },
+                        fix(fixer) {
+                            return fixer.replaceText(node, `String(${text})`);
+                        },
+                    });
+                }
+            },
+        };
+    },
+};