eslint-plugin-sonarjs 4.0.1 → 4.0.3

package/cjs/S8479/rule.js

@@ -0,0 +1,239 @@
+"use strict";
+/*
+ * SonarQube JavaScript Plugin
+ * Copyright (C) SonarSource Sàrl
+ * mailto:info AT sonarsource DOT com
+ *
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the Sonar Source-Available License for more details.
+ *
+ * You should have received a copy of the Sonar Source-Available License
+ * along with this program; if not, see https://sonarsource.com/license/ssal/
+ */
+// https://sonarsource.github.io/rspec/#/rspec/S8479/javascript
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rule = void 0;
+const generate_meta_js_1 = require("../helpers/generate-meta.js");
+const module_js_1 = require("../helpers/module.js");
+const module_ts_js_1 = require("../helpers/module-ts.js");
+const parser_services_js_1 = require("../helpers/parser-services.js");
+const meta = __importStar(require("./generated-meta.js"));
+const DANGEROUS_TAGS = new Set([
+    'script',
+    'iframe',
+    'object',
+    'embed',
+    'form',
+    'input',
+    'textarea',
+    'select',
+    'meta',
+    'link',
+    'style',
+    'base',
+    'svg',
+    'math',
+]);
+const EVENT_HANDLER_PATTERN = /^on[a-z]/i;
+/**
+ * URI-carrying attributes that must never be added to ADD_URI_SAFE_ATTR.
+ * Marking them as "URI-safe" skips DOMPurify's javascript: URI check,
+ * enabling 1-click XSS via crafted href/src/action values.
+ */
+const DANGEROUS_URI_ATTRS = new Set(['href', 'src', 'action', 'formaction', 'xlink:href', 'data']);
+/**
+ * Boolean options that are dangerous when set to the specified value.
+ */
+const DANGEROUS_BOOLEAN_OPTIONS = {
+    ALLOW_UNKNOWN_PROTOCOLS: true,
+    WHOLE_DOCUMENT: true,
+    SAFE_FOR_XML: false,
+    SANITIZE_DOM: false,
+    RETURN_TRUSTED_TYPE: false,
+};
+const MAX_ACTIONS_IN_MESSAGE = 2;
+const SANITIZE_FQNS = new Set(['dompurify.sanitize', 'isomorphic-dompurify.sanitize']);
+exports.rule = {
+    meta: (0, generate_meta_js_1.generateMeta)(meta, {
+        messages: {
+            unsafeConfig: 'unsafeConfig',
+        },
+    }),
+    create(context) {
+        const services = context.sourceCode.parserServices;
+        const hasTypeInformation = (0, parser_services_js_1.isRequiredParserServices)(services);
+        return {
+            CallExpression(node) {
+                let fqn = null;
+                if (hasTypeInformation) {
+                    const tsNode = services.esTreeNodeToTSNodeMap.get(node);
+                    fqn = (0, module_ts_js_1.getFullyQualifiedNameTS)(services, tsNode);
+                }
+                else {
+                    fqn = (0, module_js_1.getFullyQualifiedName)(context, node);
+                }
+                if (!fqn || !SANITIZE_FQNS.has(fqn)) {
+                    return;
+                }
+                const configArg = node.arguments[1];
+                if (configArg?.type !== 'ObjectExpression') {
+                    return;
+                }
+                const actions = collectActions(configArg);
+                if (actions.length > 0) {
+                    context.report({
+                        message: buildMessage(actions),
+                        node: configArg,
+                    });
+                }
+            },
+        };
+    },
+};
+function collectActions(config) {
+    const actions = [];
+    for (const prop of config.properties) {
+        if (prop.type !== 'Property') {
+            continue;
+        }
+        const action = getActionForProperty(prop);
+        if (action) {
+            actions.push(action);
+        }
+    }
+    return actions;
+}
+function getActionForProperty(prop) {
+    const key = getPropertyName(prop);
+    if (!key) {
+        return undefined;
+    }
+    switch (key) {
+        case 'ADD_TAGS':
+        case 'ALLOWED_TAGS': {
+            const dangerous = getDangerousArrayElements(prop.value, DANGEROUS_TAGS);
+            return dangerous.length > 0 ? `remove ${formatList(dangerous)} from '${key}'` : undefined;
+        }
+        case 'ADD_ATTR':
+        case 'ALLOWED_ATTR': {
+            const dangerous = getDangerousAttributes(prop.value);
+            return dangerous.length > 0 ? `remove ${formatList(dangerous)} from '${key}'` : undefined;
+        }
+        case 'ADD_URI_SAFE_ATTR': {
+            const dangerous = getDangerousArrayElements(prop.value, DANGEROUS_URI_ATTRS);
+            return dangerous.length > 0 ? `remove ${formatList(dangerous)} from '${key}'` : undefined;
+        }
+        case 'ALLOWED_URI_REGEXP':
+            return isUnanchoredRegex(prop.value)
+                ? `anchor the 'ALLOWED_URI_REGEXP' pattern with '^' to prevent partial URI matches`
+                : undefined;
+        default:
+            if (key in DANGEROUS_BOOLEAN_OPTIONS) {
+                const dangerousValue = DANGEROUS_BOOLEAN_OPTIONS[key];
+                return isBooleanLiteral(prop.value, dangerousValue)
+                    ? `set '${key}' to '${!dangerousValue}'`
+                    : undefined;
+            }
+            return undefined;
+    }
+}
+function buildMessage(actions) {
+    const shown = actions.slice(0, MAX_ACTIONS_IN_MESSAGE);
+    const remaining = actions.length - shown.length;
+    let message = `To prevent DOM-based attacks, ${joinActions(shown)}.`;
+    if (remaining > 0) {
+        message += ` Plus ${remaining} more ${remaining === 1 ? 'issue' : 'issues'}. Read 'How to fix it' for all details.`;
+    }
+    return message;
+}
+function joinActions(actions) {
+    if (actions.length === 1) {
+        return actions[0];
+    }
+    return `${actions.slice(0, -1).join(', ')}, and ${actions.at(-1)}`;
+}
+function getPropertyName(prop) {
+    if (prop.key.type === 'Identifier') {
+        return prop.key.name;
+    }
+    if (prop.key.type === 'Literal' && typeof prop.key.value === 'string') {
+        return prop.key.value;
+    }
+    return undefined;
+}
+function getDangerousArrayElements(node, dangerousSet) {
+    if (node.type !== 'ArrayExpression') {
+        return [];
+    }
+    return node.elements
+        .filter((el) => el !== null &&
+        el.type === 'Literal' &&
+        typeof el.value === 'string' &&
+        dangerousSet.has(el.value.toLowerCase()))
+        .map(el => el.value);
+}
+function getDangerousAttributes(node) {
+    if (node.type !== 'ArrayExpression') {
+        return [];
+    }
+    return node.elements
+        .filter((el) => el !== null &&
+        el.type === 'Literal' &&
+        typeof el.value === 'string' &&
+        EVENT_HANDLER_PATTERN.test(el.value))
+        .map(el => el.value);
+}
+function formatList(items) {
+    const quoted = items.map(item => `'${item}'`);
+    if (quoted.length === 1) {
+        return quoted[0];
+    }
+    return `${quoted.slice(0, -1).join(', ')} and ${quoted.at(-1)}`;
+}
+function isBooleanLiteral(node, value) {
+    return node.type === 'Literal' && node.value === value;
+}
+function isUnanchoredRegex(node) {
+    if (node.type === 'Literal' && 'regex' in node && node.regex) {
+        return !node.regex.pattern.startsWith('^');
+    }
+    return false;
+}

package/cjs/S881/generated-meta.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S881/index.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S881/meta.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.eslintId = exports.implementation = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S881/rule.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -51,10 +51,10 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
-const index_js_1 = require("../helpers/index.js");
+const generate_meta_js_1 = require("../helpers/generate-meta.js");
 const meta = __importStar(require("./generated-meta.js"));
 exports.rule = {
-    meta: (0, index_js_1.generateMeta)(meta, {
+    meta: (0, generate_meta_js_1.generateMeta)(meta, {
         messages: {
             extractOperation: 'Extract this {{incrementType}} operation into a dedicated statement.',
         },

package/cjs/S888/generated-meta.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S888/index.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S888/meta.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.eslintId = exports.implementation = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S888/rule.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -51,13 +51,14 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
-const index_js_1 = require("../helpers/index.js");
+const generate_meta_js_1 = require("../helpers/generate-meta.js");
+const ast_js_1 = require("../helpers/ast.js");
 const meta = __importStar(require("./generated-meta.js"));
 const allEqualityOperators = new Set(['!=', '==', '!==', '===']);
 const notEqualOperators = new Set(['!==', '!=']);
 const plusMinusOperators = new Set(['+=', '-=']);
 exports.rule = {
-    meta: (0, index_js_1.generateMeta)(meta, {
+    meta: (0, generate_meta_js_1.generateMeta)(meta, {
         messages: {
             replaceOperator: "Replace '{{operator}}' operator with one of '<=', '>=', '<', or '>' comparison operators.",
         },
@@ -164,7 +165,7 @@ function isUpdateByOne(update, loopBody, context) {
 }
 function isUsedInsideBody(id, loopBody, context) {
     if (id.type === 'Identifier') {
-        const variable = (0, index_js_1.getVariableFromName)(context, id.name, id);
+        const variable = (0, ast_js_1.getVariableFromName)(context, id.name, id);
         const bodyRange = loopBody.range;
         if (variable && bodyRange) {
             return variable.references.some(ref => isInBody(ref.identifier, bodyRange));

package/cjs/S930/generated-meta.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S930/index.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S930/meta.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.hasSecondaries = exports.eslintId = exports.implementation = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S930/rule.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -51,11 +51,13 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
-const index_js_1 = require("../helpers/index.js");
+const location_js_1 = require("../helpers/location.js");
+const generate_meta_js_1 = require("../helpers/generate-meta.js");
+const ast_js_1 = require("../helpers/ast.js");
 const meta = __importStar(require("./generated-meta.js"));
 const message = 'This function expects {{expectedArguments}}, but {{providedArguments}} provided.';
 exports.rule = {
-    meta: (0, index_js_1.generateMeta)(meta, {
+    meta: (0, generate_meta_js_1.generateMeta)(meta, {
         messages: {
             tooManyArguments: message,
         },
@@ -66,7 +68,7 @@ exports.rule = {
         const emptyFunctions = new Set();
         return {
             CallExpression(callExpr) {
-                if ((0, index_js_1.isIdentifier)(callExpr.callee)) {
+                if ((0, ast_js_1.isIdentifier)(callExpr.callee)) {
                     const reference = context.sourceCode
                         .getScope(callExpr)
                         .references.find(ref => ref.identifier === callExpr.callee);
@@ -77,14 +79,14 @@ exports.rule = {
                         }
                         else if (definition.type === 'Variable') {
                             const { init } = definition.node;
-                            if (init && ((0, index_js_1.isFunctionExpression)(init) || (0, index_js_1.isArrowFunctionExpression)(init))) {
+                            if (init && ((0, ast_js_1.isFunctionExpression)(init) || (0, ast_js_1.isArrowFunctionExpression)(init))) {
                                 checkFunction(callExpr, init);
                             }
                         }
                     }
                 }
-                else if ((0, index_js_1.isArrowFunctionExpression)(callExpr.callee) ||
-                    (0, index_js_1.isFunctionExpression)(callExpr.callee)) {
+                else if ((0, ast_js_1.isArrowFunctionExpression)(callExpr.callee) ||
+                    (0, ast_js_1.isFunctionExpression)(callExpr.callee)) {
                     // IIFE
                     checkFunction(callExpr, callExpr.callee);
                 }
@@ -120,8 +122,8 @@ exports.rule = {
                 // special `arguments` variable has no definition
                 if (!definition) {
                     const ancestors = context.sourceCode.getAncestors(identifier).reverse();
-                    const fn = ancestors.find(node => (0, index_js_1.isFunctionDeclaration)(node) ||
-                        (0, index_js_1.isFunctionExpression)(node));
+                    const fn = ancestors.find(node => (0, ast_js_1.isFunctionDeclaration)(node) ||
+                        (0, ast_js_1.isFunctionExpression)(node));
                     if (fn) {
                         usingArguments.add(fn);
                     }
@@ -145,7 +147,7 @@ exports.rule = {
             const providedArguments = argsLength === 0 ? "none was" :
                 argsLength === 1 ? "1 was" :
                     `${argsLength} were`;
-            (0, index_js_1.report)(context, {
+            (0, location_js_1.report)(context, {
                 message,
                 messageId: 'tooManyArguments',
                 data: {
@@ -159,13 +161,13 @@ exports.rule = {
             const paramLength = functionNode.params.length;
             const secondaryLocations = [];
             if (paramLength > 0) {
-                secondaryLocations.push((0, index_js_1.toSecondaryLocation)(functionNode.params[0], functionNode.params[paramLength - 1], 'Formal parameters'));
+                secondaryLocations.push((0, location_js_1.toSecondaryLocation)(functionNode.params[0], functionNode.params[paramLength - 1], 'Formal parameters'));
             }
             else {
                 // as we're not providing parent node, `getMainFunctionTokenLocation` may return `undefined`
-                const fnToken = (0, index_js_1.getMainFunctionTokenLocation)(functionNode, undefined, context);
+                const fnToken = (0, location_js_1.getMainFunctionTokenLocation)(functionNode, undefined, context);
                 if (fnToken) {
-                    secondaryLocations.push((0, index_js_1.toSecondaryLocation)({ loc: fnToken }, 'Formal parameters'));
+                    secondaryLocations.push((0, location_js_1.toSecondaryLocation)({ loc: fnToken }, 'Formal parameters'));
                 }
             }
             // find actual extra arguments to highlight

package/cjs/helpers/accessibility.js

@@ -7,11 +7,11 @@ exports.getElementType = void 0;
 exports.isPresentationTable = isPresentationTable;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/helpers/ast.js

@@ -56,7 +56,10 @@ exports.isProperty = isProperty;
 exports.isUnresolved = isUnresolved;
 exports.hasParent = hasParent;
 exports.hasTypePredicateReturn = hasTypePredicateReturn;
-const index_js_1 = require("./index.js");
+const ancestor_js_1 = require("./ancestor.js");
+const collection_js_1 = require("./collection.js");
+const module_js_1 = require("./module.js");
+const location_js_1 = require("./location.js");
 const MODULE_DECLARATION_NODES = new Set([
     'ImportDeclaration',
     'ExportNamedDeclaration',
@@ -185,7 +188,7 @@ function isUndefined(node) {
  *  myObj.prop1 += 3;
  */
 function isElementWrite(statement, ref, recursive = true) {
-    if (statement.expression.type === 'AssignmentExpression') {
+    if (statement.expression?.type === 'AssignmentExpression') {
         const assignmentExpression = statement.expression;
         const lhs = assignmentExpression.left;
         return isMemberExpressionReference(lhs, ref, recursive);
@@ -256,7 +259,7 @@ function isNodeType(node, type) {
  */
 function getLhsVariable(context, node) {
     const ancestors = context.sourceCode.getAncestors(node);
-    const parent = (0, index_js_1.last)(ancestors);
+    const parent = (0, collection_js_1.last)(ancestors);
     let formIdentifier;
     if (parent.type === 'VariableDeclarator' && parent.id.type === 'Identifier') {
         formIdentifier = parent.id;
@@ -304,13 +307,13 @@ function flattenArgs(context, args) {
     function recHelper(nodePossiblyIdentifier) {
         const n = getUniqueWriteUsageOrNode(context, nodePossiblyIdentifier);
         if (n.type === 'ArrayExpression') {
-            return (0, index_js_1.flatMap)(n.elements, recHelper);
+            return (0, collection_js_1.flatMap)(n.elements, recHelper);
         }
         else {
             return [n];
         }
     }
-    return (0, index_js_1.flatMap)(args, recHelper);
+    return (0, collection_js_1.flatMap)(args, recHelper);
 }
 function resolveIdentifiers(node, acceptShorthand = false) {
     const identifiers = [];
@@ -363,7 +366,7 @@ function getPropertyWithValue(context, objectExpression, propertyName, propertyV
 }
 function getPropertyFromSpreadElement(spreadElement, key, ctx) {
     const props = getValueOfExpression(ctx, spreadElement.argument, 'ObjectExpression');
-    const recursiveDefinition = (0, index_js_1.findFirstMatchingAncestor)(spreadElement.argument, node => node === props);
+    const recursiveDefinition = (0, ancestor_js_1.findFirstMatchingAncestor)(spreadElement.argument, node => node === props);
     if (recursiveDefinition || props === undefined) {
         return undefined;
     }
@@ -436,10 +439,10 @@ function checkSensitiveCall(context, callExpression, sensitiveArgumentIndex, sen
     }
     const unsafeProperty = getPropertyWithValue(context, options, sensitiveProperty, sensitivePropertyValue);
     if (unsafeProperty) {
-        (0, index_js_1.report)(context, {
+        (0, location_js_1.report)(context, {
             node: callExpression.callee,
             message,
-        }, [(0, index_js_1.toSecondaryLocation)(unsafeProperty)]);
+        }, [(0, location_js_1.toSecondaryLocation)(unsafeProperty)]);
     }
 }
 function isStringLiteral(node) {
@@ -509,7 +512,7 @@ function isProperty(node) {
  * @param ctx Rule context
  */
 function isUnresolved(node, ctx) {
-    if (!node || (0, index_js_1.getFullyQualifiedName)(ctx, node) || isUndefined(node)) {
+    if (!node || (0, module_js_1.getFullyQualifiedName)(ctx, node) || isUndefined(node)) {
         return false;
     }
     let nodeToCheck = node;