eslint-plugin-sonarjs 4.0.1 → 4.0.3

package/cjs/S1874/index.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S1874/meta.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.eslintId = exports.implementation = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S1874/rule.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -51,17 +51,18 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
-const index_js_1 = require("../helpers/index.js");
+const generate_meta_js_1 = require("../helpers/generate-meta.js");
+const parser_services_js_1 = require("../helpers/parser-services.js");
 const meta = __importStar(require("./generated-meta.js"));
 exports.rule = {
-    meta: (0, index_js_1.generateMeta)(meta, {
+    meta: (0, generate_meta_js_1.generateMeta)(meta, {
         messages: {
             deprecation: '{{deprecation}}',
         },
     }),
     create(context) {
         const services = context.sourceCode.parserServices;
-        if (!(0, index_js_1.isRequiredParserServices)(services)) {
+        if (!(0, parser_services_js_1.isRequiredParserServices)(services)) {
             return {};
         }
         return {

package/cjs/S1940/generated-meta.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S1940/index.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S1940/meta.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.eslintId = exports.implementation = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S1940/rule.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -51,7 +51,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
-const index_js_1 = require("../helpers/index.js");
+const generate_meta_js_1 = require("../helpers/generate-meta.js");
 const meta = __importStar(require("./generated-meta.js"));
 const invertedOperators = {
     '==': '!=',
@@ -64,7 +64,7 @@ const invertedOperators = {
     '<=': '>',
 };
 exports.rule = {
-    meta: (0, index_js_1.generateMeta)(meta, {
+    meta: (0, generate_meta_js_1.generateMeta)(meta, {
         messages: {
             useOppositeOperator: 'Use the opposite operator ({{invertedOperator}}) instead.',
             suggestOperationInversion: 'Invert inner operation (apply if NaN is not expected)',

package/cjs/S1994/generated-meta.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S1994/index.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S1994/meta.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.eslintId = exports.implementation = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S1994/rule.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -51,7 +51,10 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
-const index_js_1 = require("../helpers/index.js");
+const equivalence_js_1 = require("../helpers/equivalence.js");
+const generate_meta_js_1 = require("../helpers/generate-meta.js");
+const ancestor_js_1 = require("../helpers/ancestor.js");
+const collection_js_1 = require("../helpers/collection.js");
 const meta = __importStar(require("./generated-meta.js"));
 class ForInfo {
     constructor(forLoop) {
@@ -61,7 +64,7 @@ class ForInfo {
     }
 }
 exports.rule = {
-    meta: (0, index_js_1.generateMeta)(meta, {
+    meta: (0, generate_meta_js_1.generateMeta)(meta, {
         messages: {
             misplacedCounter: `This loop's stop condition tests "{{test}}" but the incrementer updates "{{update}}".`,
         },
@@ -90,7 +93,7 @@ exports.rule = {
             return false;
         }
         function peekFor() {
-            return (0, index_js_1.last)(forLoopStack);
+            return (0, collection_js_1.last)(forLoopStack);
         }
         return {
             ForStatement: (node) => {
@@ -101,7 +104,7 @@ exports.rule = {
                 if (forInfo.updatedExpressions.length === 0 || !forInfo.forLoop.test) {
                     return;
                 }
-                const hasIntersection = forInfo.testedExpressions.some(testedExpr => forInfo.updatedExpressions.some(updatedExpr => (0, index_js_1.areEquivalent)(updatedExpr, testedExpr, context.sourceCode)));
+                const hasIntersection = forInfo.testedExpressions.some(testedExpr => forInfo.updatedExpressions.some(updatedExpr => (0, equivalence_js_1.areEquivalent)(updatedExpr, testedExpr, context.sourceCode)));
                 if (!hasIntersection) {
                     context.report({
                         loc: context.sourceCode.getFirstToken(forInfo.forLoop).loc,
@@ -140,7 +143,7 @@ exports.rule = {
             },
             'ForStatement Identifier': (node) => {
                 if (isInsideTest(node)) {
-                    const parent = (0, index_js_1.getParent)(context, node);
+                    const parent = (0, ancestor_js_1.getParent)(context, node);
                     if (parent.type !== 'MemberExpression' || parent.computed || parent.object === node) {
                         peekFor().testedExpressions.push(node);
                     }
@@ -148,8 +151,8 @@ exports.rule = {
             },
             'ForStatement MemberExpression': (node) => {
                 if (isInsideTest(node) &&
-                    (0, index_js_1.getParent)(context, node).type !== 'MemberExpression' &&
-                    (0, index_js_1.getParent)(context, node).type !== 'CallExpression') {
+                    (0, ancestor_js_1.getParent)(context, node).type !== 'MemberExpression' &&
+                    (0, ancestor_js_1.getParent)(context, node).type !== 'CallExpression') {
                     peekFor().testedExpressions.push(node);
                 }
             },

package/cjs/S2004/config.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S2004/generated-meta.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S2004/index.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S2004/meta.js

@@ -17,11 +17,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = exports.hasSecondaries = exports.eslintId = exports.implementation = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S2004/rule.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -51,7 +51,9 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
-const index_js_1 = require("../helpers/index.js");
+const generate_meta_js_1 = require("../helpers/generate-meta.js");
+const location_js_1 = require("../helpers/location.js");
+const test_frameworks_js_1 = require("../helpers/test-frameworks.js");
 const meta = __importStar(require("./generated-meta.js"));
 const DEFAULT_THRESHOLD = 4;
 /**
@@ -63,10 +65,10 @@ function isTestFrameworkCallback(node) {
     if (parent?.type !== 'CallExpression') {
         return false;
     }
-    return (0, index_js_1.isTestFrameworkCall)(parent);
+    return (0, test_frameworks_js_1.isTestFrameworkCall)(parent);
 }
 exports.rule = {
-    meta: (0, index_js_1.generateMeta)(meta),
+    meta: (0, generate_meta_js_1.generateMeta)(meta),
     create(context) {
         const max = context.options[0]?.threshold ?? DEFAULT_THRESHOLD;
         const nestedStack = [];
@@ -80,11 +82,11 @@ exports.rule = {
                 nestedStack.push(fn);
                 if (nestedStack.length === max + 1) {
                     const secondaries = nestedStack.slice(0, -1);
-                    (0, index_js_1.report)(context, {
-                        loc: (0, index_js_1.getMainFunctionTokenLocation)(fn, fn.parent, context),
+                    (0, location_js_1.report)(context, {
+                        loc: (0, location_js_1.getMainFunctionTokenLocation)(fn, fn.parent, context),
                         message: `Refactor this code to not nest functions more than ${max} levels deep.`,
-                    }, secondaries.map(n => (0, index_js_1.toSecondaryLocation)({
-                        loc: (0, index_js_1.getMainFunctionTokenLocation)(n, n.parent, context),
+                    }, secondaries.map(n => (0, location_js_1.toSecondaryLocation)({
+                        loc: (0, location_js_1.getMainFunctionTokenLocation)(n, n.parent, context),
                     }, 'Nesting +1')));
                 }
             },

package/cjs/S2068/config.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S2068/generated-meta.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S2068/index.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S2068/meta.js

@@ -17,11 +17,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = exports.eslintId = exports.implementation = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S2068/rule.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -54,17 +54,27 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
-const index_js_1 = require("../helpers/index.js");
+const generate_meta_js_1 = require("../helpers/generate-meta.js");
+const ast_js_1 = require("../helpers/ast.js");
+const entropy_js_1 = require("../helpers/entropy.js");
 const node_path_1 = __importDefault(require("node:path"));
 const meta = __importStar(require("./generated-meta.js"));
 const DEFAULT_NAMES = ['password', 'pwd', 'passwd', 'passphrase'];
+const ENTROPY_THRESHOLD = 3;
+const MIN_PASSWORD_LENGTH = 5;
+const NON_CREDENTIAL_CHARS = /[\s/["'\]<>]/;
+const TEST_FILE_PATTERN = /\.(spec|test|mock)\.[jt]sx?$/;
 const messages = {
     reviewPassword: 'Review this potentially hard-coded password.',
 };
 exports.rule = {
-    meta: (0, index_js_1.generateMeta)(meta, { messages }),
+    meta: (0, generate_meta_js_1.generateMeta)(meta, { messages }),
     create(context) {
-        const dir = node_path_1.default.dirname(context.physicalFilename);
+        const filename = context.physicalFilename;
+        if (TEST_FILE_PATTERN.test(filename)) {
+            return {};
+        }
+        const dir = node_path_1.default.dirname(filename);
         const parts = dir.split(node_path_1.default.sep).map(part => part.toLowerCase());
         if (parts.includes('l10n')) {
             return {};
@@ -89,6 +99,10 @@ exports.rule = {
                 const literal = node;
                 checkLiteral(context, literalRegExp, literal);
             },
+            TemplateLiteral: (node) => {
+                const templateLiteral = node;
+                checkTemplateLiteral(context, literalRegExp, templateLiteral);
+            },
             PropertyDefinition: (node) => {
                 const property = node;
                 checkAssignment(context, lowerCaseVariableNames, property.key, property.value);
@@ -98,21 +112,94 @@ exports.rule = {
 };
 function checkAssignment(context, patterns, variable, initializer) {
     if (initializer &&
-        (0, index_js_1.isStringLiteral)(initializer) &&
-        initializer.value.length > 0 &&
-        patterns.some(pattern => context.sourceCode.getText(variable).toLowerCase().includes(pattern))) {
+        patterns.some(pattern => context.sourceCode.getText(variable).toLowerCase().includes(pattern)) &&
+        findValueSuspect(initializer)) {
         context.report({
             messageId: 'reviewPassword',
             node: initializer,
         });
     }
 }
+function findValueSuspect(node) {
+    if (!node) {
+        return false;
+    }
+    if ((0, ast_js_1.isStaticTemplateLiteral)(node)) {
+        const value = node.quasis[0].value.cooked;
+        return (value != null &&
+            value.length >= MIN_PASSWORD_LENGTH &&
+            !NON_CREDENTIAL_CHARS.test(value) &&
+            hasHighEntropy(value));
+    }
+    if ((0, ast_js_1.isStringLiteral)(node)) {
+        const value = node.value;
+        return (value.length >= MIN_PASSWORD_LENGTH &&
+            !NON_CREDENTIAL_CHARS.test(value) &&
+            hasHighEntropy(value));
+    }
+    if (node.type === 'ConditionalExpression') {
+        return findValueSuspect(node.consequent) || findValueSuspect(node.alternate);
+    }
+    if ((0, ast_js_1.isLogicalExpression)(node) &&
+        ['??', '||'].includes(node.operator)) {
+        return findValueSuspect(node.right);
+    }
+    return false;
+}
 function checkLiteral(context, patterns, literal) {
-    if ((0, index_js_1.isStringLiteral)(literal) &&
-        patterns.some(pattern => pattern.test(literal.value.toLowerCase()))) {
-        context.report({
-            messageId: 'reviewPassword',
-            node: literal,
-        });
+    if (!(0, ast_js_1.isStringLiteral)(literal)) {
+        return;
     }
+    const value = literal.value;
+    checkStringValue(context, patterns, value, literal);
+}
+function checkTemplateLiteral(context, patterns, templateLiteral) {
+    if (!(0, ast_js_1.isStaticTemplateLiteral)(templateLiteral)) {
+        return;
+    }
+    const value = templateLiteral.quasis[0].value.cooked;
+    if (value == null) {
+        return;
+    }
+    checkStringValue(context, patterns, value, templateLiteral);
+}
+function checkStringValue(context, patterns, value, node) {
+    const lowerValue = value.toLowerCase();
+    for (const pattern of patterns) {
+        const match = pattern.exec(lowerValue);
+        if (!match) {
+            continue;
+        }
+        const eqIndex = value.indexOf('=', match.index);
+        if (eqIndex === -1) {
+            continue;
+        }
+        const passwordValue = extractPasswordValue(value, eqIndex);
+        if (passwordValue.length >= MIN_PASSWORD_LENGTH && hasHighEntropy(passwordValue)) {
+            context.report({
+                messageId: 'reviewPassword',
+                node,
+            });
+            return;
+        }
+    }
+}
+function extractPasswordValue(value, eqIndex) {
+    const passwordPart = value.substring(eqIndex + 1);
+    const nextSep = findNextSeparator(passwordPart);
+    return nextSep === -1 ? passwordPart : passwordPart.substring(0, nextSep);
+}
+function findNextSeparator(str) {
+    const separators = ['&', ' ', ';'];
+    let minIndex = -1;
+    for (const sep of separators) {
+        const idx = str.indexOf(sep);
+        if (idx !== -1 && (minIndex === -1 || idx < minIndex)) {
+            minIndex = idx;
+        }
+    }
+    return minIndex;
+}
+function hasHighEntropy(value) {
+    return (0, entropy_js_1.shannonEntropy)(value) > ENTROPY_THRESHOLD;
 }

package/cjs/S2077/generated-meta.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of