eslint-plugin-sonarjs 4.0.1 → 4.0.3

package/cjs/S5122/generated-meta.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -36,7 +36,7 @@ __exportStar(require("./meta.js"), exports);
 exports.meta = {
     type: 'problem',
     docs: {
-        description: 'Having a permissive Cross-Origin Resource Sharing policy is security-sensitive',
+        description: 'Cross-Origin Resource Sharing (CORS) policy should be restricted to trusted origins',
         recommended: true,
         url: 'https://sonarsource.github.io/rspec/#/rspec/S5122/javascript',
         requiresTypeChecking: false,

package/cjs/S5122/index.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S5122/meta.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.hasSecondaries = exports.eslintId = exports.implementation = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S5122/rule.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -51,7 +51,11 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
-const index_js_1 = require("../helpers/index.js");
+const ancestor_js_1 = require("../helpers/ancestor.js");
+const generate_meta_js_1 = require("../helpers/generate-meta.js");
+const module_js_1 = require("../helpers/module.js");
+const ast_js_1 = require("../helpers/ast.js");
+const location_js_1 = require("../helpers/location.js");
 const meta = __importStar(require("./generated-meta.js"));
 const MESSAGE = `Make sure that enabling CORS is safe here.`;
 const SECONDARY_MESSAGE = 'Sensitive configuration';
@@ -83,7 +87,7 @@ const ROUTINE_METHODS = new Set([
     'unsubscribe',
 ]);
 exports.rule = {
-    meta: (0, index_js_1.generateMeta)(meta),
+    meta: (0, generate_meta_js_1.generateMeta)(meta),
     create(context) {
         return {
             CallExpression(node) {
@@ -99,7 +103,7 @@ exports.rule = {
  */
 function checkNodeHttp(context, node) {
     // Check if the node is a call to the 'http.createServer' method
-    const fqn = (0, index_js_1.getFullyQualifiedName)(context, node.callee);
+    const fqn = (0, module_js_1.getFullyQualifiedName)(context, node.callee);
     if (fqn !== 'http.createServer') {
         return;
     }
@@ -109,13 +113,13 @@ function checkNodeHttp(context, node) {
         return;
     }
     // Check if the first argument is a callback function
-    const callback = (0, index_js_1.resolveFunction)(context, arg0);
+    const callback = (0, ast_js_1.resolveFunction)(context, arg0);
     if (!callback) {
         return;
     }
     // Check if the callback has a response parameter
     const resParameter = callback.params[1];
-    if (!resParameter || !(0, index_js_1.isIdentifier)(resParameter)) {
+    if (!resParameter || !(0, ast_js_1.isIdentifier)(resParameter)) {
         return;
     }
     // Retrieve the variable declaration of the response parameter
@@ -131,26 +135,26 @@ function checkNodeHttp(context, node) {
         const identifier = resUsage.identifier;
         // Find the first ancestor that is a call to the 'writeHead' method
         const writeHeadCall = identifier?.parent?.parent;
-        if (!(writeHeadCall?.type === 'CallExpression' && (0, index_js_1.isCallingMethod)(writeHeadCall, 2, 'writeHead'))) {
+        if (!(writeHeadCall?.type === 'CallExpression' && (0, ast_js_1.isCallingMethod)(writeHeadCall, 2, 'writeHead'))) {
             continue;
         }
         // Check if the header argument of the 'writeHead' method is defined
-        const headerValue = (0, index_js_1.getValueOfExpression)(context, writeHeadCall.arguments[1], 'ObjectExpression');
+        const headerValue = (0, ast_js_1.getValueOfExpression)(context, writeHeadCall.arguments[1], 'ObjectExpression');
         if (!headerValue) {
             continue;
         }
         // Check if the header argument contains the 'Access-Control-Allow-Origin' property
-        const accessProperty = (0, index_js_1.getProperty)(headerValue, ACCESS_CONTROL_ALLOW_ORIGIN, context);
+        const accessProperty = (0, ast_js_1.getProperty)(headerValue, ACCESS_CONTROL_ALLOW_ORIGIN, context);
         if (!accessProperty) {
             continue;
         }
         // Check if the 'Access-Control-Allow-Origin' property is set to '*'
-        const accessValue = (0, index_js_1.getValueOfExpression)(context, accessProperty.value, 'Literal');
+        const accessValue = (0, ast_js_1.getValueOfExpression)(context, accessProperty.value, 'Literal');
         if (accessValue?.value === '*') {
-            (0, index_js_1.report)(context, {
+            (0, location_js_1.report)(context, {
                 node: writeHeadCall.callee,
                 message: MESSAGE,
-            }, [(0, index_js_1.toSecondaryLocation)(accessProperty, SECONDARY_MESSAGE)]);
+            }, [(0, location_js_1.toSecondaryLocation)(accessProperty, SECONDARY_MESSAGE)]);
         }
     }
 }
@@ -159,50 +163,50 @@ function checkNodeHttp(context, node) {
  */
 function checkExpressCors(context, node) {
     // Check if the node is a call to the 'express.use' method
-    const fqn = (0, index_js_1.getFullyQualifiedName)(context, node.callee);
+    const fqn = (0, module_js_1.getFullyQualifiedName)(context, node.callee);
     if (fqn !== 'express.use') {
         return;
     }
     // Check if the first argument is defined
-    const argValue = (0, index_js_1.getValueOfExpression)(context, node.arguments[0], 'CallExpression');
+    const argValue = (0, ast_js_1.getValueOfExpression)(context, node.arguments[0], 'CallExpression');
     if (!argValue) {
         return;
     }
     // Check if the first argument is a call to the 'cors' method
-    const argFqn = (0, index_js_1.getFullyQualifiedName)(context, argValue);
+    const argFqn = (0, module_js_1.getFullyQualifiedName)(context, argValue);
     if (argFqn !== 'cors') {
         return;
     }
     // Check if the call to the 'cors' method has an argument (default configuration is sensitive)
     const corsOptions = argValue.arguments[0];
     if (!corsOptions) {
-        (0, index_js_1.report)(context, {
+        (0, location_js_1.report)(context, {
             node,
             message: MESSAGE,
         });
         return;
     }
     // Check if the argument of the 'cors' method is an object
-    const corsOptionsValue = (0, index_js_1.getValueOfExpression)(context, corsOptions, 'ObjectExpression');
+    const corsOptionsValue = (0, ast_js_1.getValueOfExpression)(context, corsOptions, 'ObjectExpression');
     if (!corsOptionsValue) {
         return;
     }
     // Check if the 'origin' property is defined  (default configuration is sensitive)
-    const originProperty = (0, index_js_1.getProperty)(corsOptionsValue, 'origin', context);
+    const originProperty = (0, ast_js_1.getProperty)(corsOptionsValue, 'origin', context);
     if (!originProperty) {
-        (0, index_js_1.report)(context, {
+        (0, location_js_1.report)(context, {
             node: node.callee,
             message: MESSAGE,
-        }, [(0, index_js_1.toSecondaryLocation)(corsOptions, SECONDARY_MESSAGE)]);
+        }, [(0, location_js_1.toSecondaryLocation)(corsOptions, SECONDARY_MESSAGE)]);
         return;
     }
     // Check if the 'origin' property is set to '*'
-    const originValue = (0, index_js_1.getValueOfExpression)(context, originProperty.value, 'Literal');
+    const originValue = (0, ast_js_1.getValueOfExpression)(context, originProperty.value, 'Literal');
     if (originValue?.value === '*') {
-        (0, index_js_1.report)(context, {
+        (0, location_js_1.report)(context, {
             node: node.callee,
             message: MESSAGE,
-        }, [(0, index_js_1.toSecondaryLocation)(originProperty, SECONDARY_MESSAGE)]);
+        }, [(0, location_js_1.toSecondaryLocation)(originProperty, SECONDARY_MESSAGE)]);
     }
 }
 /**
@@ -210,7 +214,7 @@ function checkExpressCors(context, node) {
  */
 function checkExpressUserControlledOrigin(context, node) {
     // Check if the node is a call to an express routine method
-    const fqn = (0, index_js_1.getFullyQualifiedName)(context, node.callee)?.split('.');
+    const fqn = (0, module_js_1.getFullyQualifiedName)(context, node.callee)?.split('.');
     if (!(fqn?.length === 2 && fqn[0] === 'express' && ROUTINE_METHODS.has(fqn[1]))) {
         return;
     }
@@ -220,18 +224,18 @@ function checkExpressUserControlledOrigin(context, node) {
         return;
     }
     // Check if the second argument is a callback function
-    const callback = (0, index_js_1.resolveFunction)(context, arg1);
+    const callback = (0, ast_js_1.resolveFunction)(context, arg1);
     if (!callback) {
         return;
     }
     // Check if the callback has a request parameter
     const reqParameter = callback.params[0];
-    if (!reqParameter || !(0, index_js_1.isIdentifier)(reqParameter)) {
+    if (!reqParameter || !(0, ast_js_1.isIdentifier)(reqParameter)) {
         return;
     }
     // Check if the callback has a response parameter
     const resParameter = callback.params[1];
-    if (!resParameter || !(0, index_js_1.isIdentifier)(resParameter)) {
+    if (!resParameter || !(0, ast_js_1.isIdentifier)(resParameter)) {
         return;
     }
     // Retrieve the variable declaration of the response parameter
@@ -247,11 +251,11 @@ function checkExpressUserControlledOrigin(context, node) {
         const identifier = resUsage.identifier;
         // Find the first ancestor that is a call to the 'setHeader' method
         const setHeaderCall = identifier?.parent?.parent;
-        if (!(setHeaderCall?.type === 'CallExpression' && (0, index_js_1.isCallingMethod)(setHeaderCall, 2, 'setHeader'))) {
+        if (!(setHeaderCall?.type === 'CallExpression' && (0, ast_js_1.isCallingMethod)(setHeaderCall, 2, 'setHeader'))) {
             continue;
         }
         // Check if the first argument of the 'setHeader' method is 'Access-Control-Allow-Origin'
-        const headerName = (0, index_js_1.getValueOfExpression)(context, setHeaderCall.arguments[0], 'Literal');
+        const headerName = (0, ast_js_1.getValueOfExpression)(context, setHeaderCall.arguments[0], 'Literal');
         if (!headerName ||
             typeof headerName.value !== 'string' ||
             headerName.value.toLowerCase() !== ACCESS_CONTROL_ALLOW_ORIGIN.toLowerCase()) {
@@ -259,7 +263,7 @@ function checkExpressUserControlledOrigin(context, node) {
         }
         // Retrieve the value of the header argument
         const headerArg = setHeaderCall.arguments[1];
-        const headerValue = (0, index_js_1.getUniqueWriteUsageOrNode)(context, headerArg);
+        const headerValue = (0, ast_js_1.getUniqueWriteUsageOrNode)(context, headerArg);
         // Check if the header value is a user-controlled origin header
         switch (headerValue.type) {
             // Check if the header value is a call to the 'req.header' method with 'origin' as argument
@@ -267,14 +271,14 @@ function checkExpressUserControlledOrigin(context, node) {
                 const callee = headerValue.callee;
                 const calleeText = context.sourceCode.getText(callee);
                 if (calleeText === `${reqParameter.name}.header`) {
-                    const originValue = (0, index_js_1.getValueOfExpression)(context, headerValue.arguments[0], 'Literal');
+                    const originValue = (0, ast_js_1.getValueOfExpression)(context, headerValue.arguments[0], 'Literal');
                     if (typeof originValue?.value === 'string' &&
                         originValue.value.toLowerCase() === 'origin' &&
                         !isValidated(callback, headerArg)) {
-                        (0, index_js_1.report)(context, {
+                        (0, location_js_1.report)(context, {
                             node: setHeaderCall.callee,
                             message: MESSAGE,
-                        }, [(0, index_js_1.toSecondaryLocation)(headerValue, SECONDARY_MESSAGE)]);
+                        }, [(0, location_js_1.toSecondaryLocation)(headerValue, SECONDARY_MESSAGE)]);
                     }
                 }
                 break;
@@ -284,10 +288,10 @@ function checkExpressUserControlledOrigin(context, node) {
                 const headerValueText = context.sourceCode.getText(headerValue);
                 if (headerValueText === `${reqParameter.name}.headers.origin` &&
                     !isValidated(callback, headerArg)) {
-                    (0, index_js_1.report)(context, {
+                    (0, location_js_1.report)(context, {
                         node: setHeaderCall.callee,
                         message: MESSAGE,
-                    }, [(0, index_js_1.toSecondaryLocation)(headerValue, SECONDARY_MESSAGE)]);
+                    }, [(0, location_js_1.toSecondaryLocation)(headerValue, SECONDARY_MESSAGE)]);
                 }
                 break;
             }
@@ -297,7 +301,7 @@ function checkExpressUserControlledOrigin(context, node) {
      * Checks if the user-controlled origin header is validated in the callback through a comparison.
      */
     function isValidated(callback, header) {
-        if (!(0, index_js_1.isIdentifier)(header)) {
+        if (!(0, ast_js_1.isIdentifier)(header)) {
             return false;
         }
         // Find the variable declaration of the header
@@ -311,7 +315,7 @@ function checkExpressUserControlledOrigin(context, node) {
         const headerUsages = headerVariable.references;
         for (const headerUsage of headerUsages) {
             const identifier = headerUsage.identifier;
-            const validated = (0, index_js_1.findFirstMatchingLocalAncestor)(identifier, node => node.type === 'BinaryExpression' && ['==', '!=', '===', '!=='].includes(node.operator));
+            const validated = (0, ancestor_js_1.findFirstMatchingLocalAncestor)(identifier, node => node.type === 'BinaryExpression' && ['==', '!=', '===', '!=='].includes(node.operator));
             if (validated) {
                 return true;
             }

package/cjs/S5148/generated-meta.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -36,7 +36,7 @@ __exportStar(require("./meta.js"), exports);
 exports.meta = {
     type: 'problem',
     docs: {
-        description: 'Authorizing an opened window to access back to the originating window is security-sensitive',
+        description: 'Opened windows should not have access to the originating page',
         recommended: true,
         url: 'https://sonarsource.github.io/rspec/#/rspec/S5148/javascript',
         requiresTypeChecking: false,

package/cjs/S5148/index.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S5148/meta.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.eslintId = exports.implementation = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S5148/rule.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -51,13 +51,14 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
-const index_js_1 = require("../helpers/index.js");
+const generate_meta_js_1 = require("../helpers/generate-meta.js");
+const ast_js_1 = require("../helpers/ast.js");
 const meta = __importStar(require("./generated-meta.js"));
 const REQUIRED_OPTION = 'noopener';
 const REQUIRED_OPTION_INDEX = 2;
 const URL_INDEX = 0;
 exports.rule = {
-    meta: (0, index_js_1.generateMeta)(meta, {
+    meta: (0, generate_meta_js_1.generateMeta)(meta, {
         messages: {
             missingNoopener: 'Make sure not using "noopener" is safe here.',
         },
@@ -65,12 +66,12 @@ exports.rule = {
     create(context) {
         return {
             CallExpression: (node) => {
-                if (!(0, index_js_1.isMethodCall)(node)) {
+                if (!(0, ast_js_1.isMethodCall)(node)) {
                     return;
                 }
                 const { object, property } = node.callee;
-                const isWindowOpen = (0, index_js_1.isIdentifier)(property, 'open') &&
-                    ((0, index_js_1.isIdentifier)(object, 'window') || isThisWindow(object));
+                const isWindowOpen = (0, ast_js_1.isIdentifier)(property, 'open') &&
+                    ((0, ast_js_1.isIdentifier)(object, 'window') || isThisWindow(object));
                 if (!isWindowOpen) {
                     return;
                 }
@@ -93,7 +94,7 @@ exports.rule = {
 function isThisWindow(node) {
     return (node.type === 'MemberExpression' &&
         node.object.type === 'ThisExpression' &&
-        (0, index_js_1.isIdentifier)(node.property, 'window'));
+        (0, ast_js_1.isIdentifier)(node.property, 'window'));
 }
 function hasRequiredOption(context, argument) {
     const stringOrNothing = extractString(context, argument);
@@ -105,8 +106,8 @@ function isHttpUrl(context, argument) {
         (stringOrNothing.startsWith('http://') || stringOrNothing.startsWith('https://')));
 }
 function extractString(context, node) {
-    const literalNodeOrNothing = (0, index_js_1.getValueOfExpression)(context, node, 'Literal');
-    if (literalNodeOrNothing === undefined || !(0, index_js_1.isStringLiteral)(literalNodeOrNothing)) {
+    const literalNodeOrNothing = (0, ast_js_1.getValueOfExpression)(context, node, 'Literal');
+    if (literalNodeOrNothing === undefined || !(0, ast_js_1.isStringLiteral)(literalNodeOrNothing)) {
         return undefined;
     }
     else {

package/cjs/S5247/generated-meta.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S5247/index.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S5247/meta.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.hasSecondaries = exports.eslintId = exports.implementation = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S5247/rule.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -51,18 +51,22 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
-const index_js_1 = require("../helpers/index.js");
+const ast_js_1 = require("../helpers/ast.js");
+const generate_meta_js_1 = require("../helpers/generate-meta.js");
+const module_js_1 = require("../helpers/module.js");
+const parser_services_js_1 = require("../helpers/parser-services.js");
+const location_js_1 = require("../helpers/location.js");
 const meta = __importStar(require("./generated-meta.js"));
 const MESSAGE = 'Make sure disabling auto-escaping feature is safe here.';
 exports.rule = {
-    meta: (0, index_js_1.generateMeta)(meta),
+    meta: (0, generate_meta_js_1.generateMeta)(meta),
     create(context) {
         const services = context.sourceCode.parserServices;
         function isInvalidSanitizerFunction(node) {
-            let assignedFunction = (0, index_js_1.getValueOfExpression)(context, node, 'FunctionExpression') ??
-                (0, index_js_1.getValueOfExpression)(context, node, 'ArrowFunctionExpression');
-            if (!assignedFunction && node.type === 'Identifier' && (0, index_js_1.isRequiredParserServices)(services)) {
-                assignedFunction = (0, index_js_1.resolveFromFunctionReference)(context, node);
+            let assignedFunction = (0, ast_js_1.getValueOfExpression)(context, node, 'FunctionExpression') ??
+                (0, ast_js_1.getValueOfExpression)(context, node, 'ArrowFunctionExpression');
+            if (!assignedFunction && node.type === 'Identifier' && (0, parser_services_js_1.isRequiredParserServices)(services)) {
+                assignedFunction = (0, ast_js_1.resolveFromFunctionReference)(context, node);
             }
             if (assignedFunction) {
                 return isEmptySanitizerFunction(assignedFunction);
@@ -72,24 +76,24 @@ exports.rule = {
         return {
             CallExpression: (node) => {
                 const callExpression = node;
-                const fqn = (0, index_js_1.getFullyQualifiedName)(context, callExpression);
+                const fqn = (0, module_js_1.getFullyQualifiedName)(context, callExpression);
                 if (fqn === 'handlebars.compile') {
-                    (0, index_js_1.checkSensitiveCall)(context, callExpression, 1, 'noEscape', true, MESSAGE);
+                    (0, ast_js_1.checkSensitiveCall)(context, callExpression, 1, 'noEscape', true, MESSAGE);
                 }
                 if (fqn === 'marked.setOptions') {
-                    (0, index_js_1.checkSensitiveCall)(context, callExpression, 0, 'sanitize', false, MESSAGE);
+                    (0, ast_js_1.checkSensitiveCall)(context, callExpression, 0, 'sanitize', false, MESSAGE);
                 }
                 if (fqn === 'markdown-it') {
-                    (0, index_js_1.checkSensitiveCall)(context, callExpression, 0, 'html', true, MESSAGE);
+                    (0, ast_js_1.checkSensitiveCall)(context, callExpression, 0, 'html', true, MESSAGE);
                 }
                 if (fqn === 'swig.setDefaults') {
-                    (0, index_js_1.checkSensitiveCall)(context, callExpression, 0, 'autoescape', false, MESSAGE);
+                    (0, ast_js_1.checkSensitiveCall)(context, callExpression, 0, 'autoescape', false, MESSAGE);
                 }
             },
             NewExpression: (node) => {
                 const newExpression = node;
-                if ((0, index_js_1.getFullyQualifiedName)(context, newExpression) === 'kramed.Renderer') {
-                    (0, index_js_1.checkSensitiveCall)(context, newExpression, 0, 'sanitize', false, MESSAGE);
+                if ((0, module_js_1.getFullyQualifiedName)(context, newExpression) === 'kramed.Renderer') {
+                    (0, ast_js_1.checkSensitiveCall)(context, newExpression, 0, 'sanitize', false, MESSAGE);
                 }
             },
             AssignmentExpression: (node) => {
@@ -98,12 +102,12 @@ exports.rule = {
                 if (left.type !== 'MemberExpression') {
                     return;
                 }
-                if (!((0, index_js_1.getFullyQualifiedName)(context, left) === 'mustache.escape' ||
-                    (isMustacheIdentifier(left.object) && (0, index_js_1.isIdentifier)(left.property, 'escape')))) {
+                if (!((0, module_js_1.getFullyQualifiedName)(context, left) === 'mustache.escape' ||
+                    (isMustacheIdentifier(left.object) && (0, ast_js_1.isIdentifier)(left.property, 'escape')))) {
                     return;
                 }
                 if (isInvalidSanitizerFunction(right)) {
-                    (0, index_js_1.report)(context, {
+                    (0, location_js_1.report)(context, {
                         node: left,
                         message: MESSAGE,
                     });
@@ -131,8 +135,8 @@ function isEmptySanitizerFunction(sanitizerFunction) {
     const onlyStatement = body[0];
     return !!(onlyStatement.type === 'ReturnStatement' &&
         onlyStatement.argument &&
-        (0, index_js_1.isIdentifier)(onlyStatement.argument, firstParamName));
+        (0, ast_js_1.isIdentifier)(onlyStatement.argument, firstParamName));
 }
 function isMustacheIdentifier(node) {
-    return (0, index_js_1.isIdentifier)(node, 'Mustache');
+    return (0, ast_js_1.isIdentifier)(node, 'Mustache');
 }

package/cjs/S5256/generated-meta.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S5256/index.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S5256/meta.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.eslintId = exports.implementation = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of