eslint-plugin-sonarjs 4.0.2 → 4.0.3

package/cjs/S8479/rule.js

@@ -0,0 +1,239 @@
+"use strict";
+/*
+ * SonarQube JavaScript Plugin
+ * Copyright (C) SonarSource Sàrl
+ * mailto:info AT sonarsource DOT com
+ *
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the Sonar Source-Available License for more details.
+ *
+ * You should have received a copy of the Sonar Source-Available License
+ * along with this program; if not, see https://sonarsource.com/license/ssal/
+ */
+// https://sonarsource.github.io/rspec/#/rspec/S8479/javascript
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rule = void 0;
+const generate_meta_js_1 = require("../helpers/generate-meta.js");
+const module_js_1 = require("../helpers/module.js");
+const module_ts_js_1 = require("../helpers/module-ts.js");
+const parser_services_js_1 = require("../helpers/parser-services.js");
+const meta = __importStar(require("./generated-meta.js"));
+const DANGEROUS_TAGS = new Set([
+    'script',
+    'iframe',
+    'object',
+    'embed',
+    'form',
+    'input',
+    'textarea',
+    'select',
+    'meta',
+    'link',
+    'style',
+    'base',
+    'svg',
+    'math',
+]);
+const EVENT_HANDLER_PATTERN = /^on[a-z]/i;
+/**
+ * URI-carrying attributes that must never be added to ADD_URI_SAFE_ATTR.
+ * Marking them as "URI-safe" skips DOMPurify's javascript: URI check,
+ * enabling 1-click XSS via crafted href/src/action values.
+ */
+const DANGEROUS_URI_ATTRS = new Set(['href', 'src', 'action', 'formaction', 'xlink:href', 'data']);
+/**
+ * Boolean options that are dangerous when set to the specified value.
+ */
+const DANGEROUS_BOOLEAN_OPTIONS = {
+    ALLOW_UNKNOWN_PROTOCOLS: true,
+    WHOLE_DOCUMENT: true,
+    SAFE_FOR_XML: false,
+    SANITIZE_DOM: false,
+    RETURN_TRUSTED_TYPE: false,
+};
+const MAX_ACTIONS_IN_MESSAGE = 2;
+const SANITIZE_FQNS = new Set(['dompurify.sanitize', 'isomorphic-dompurify.sanitize']);
+exports.rule = {
+    meta: (0, generate_meta_js_1.generateMeta)(meta, {
+        messages: {
+            unsafeConfig: 'unsafeConfig',
+        },
+    }),
+    create(context) {
+        const services = context.sourceCode.parserServices;
+        const hasTypeInformation = (0, parser_services_js_1.isRequiredParserServices)(services);
+        return {
+            CallExpression(node) {
+                let fqn = null;
+                if (hasTypeInformation) {
+                    const tsNode = services.esTreeNodeToTSNodeMap.get(node);
+                    fqn = (0, module_ts_js_1.getFullyQualifiedNameTS)(services, tsNode);
+                }
+                else {
+                    fqn = (0, module_js_1.getFullyQualifiedName)(context, node);
+                }
+                if (!fqn || !SANITIZE_FQNS.has(fqn)) {
+                    return;
+                }
+                const configArg = node.arguments[1];
+                if (configArg?.type !== 'ObjectExpression') {
+                    return;
+                }
+                const actions = collectActions(configArg);
+                if (actions.length > 0) {
+                    context.report({
+                        message: buildMessage(actions),
+                        node: configArg,
+                    });
+                }
+            },
+        };
+    },
+};
+function collectActions(config) {
+    const actions = [];
+    for (const prop of config.properties) {
+        if (prop.type !== 'Property') {
+            continue;
+        }
+        const action = getActionForProperty(prop);
+        if (action) {
+            actions.push(action);
+        }
+    }
+    return actions;
+}
+function getActionForProperty(prop) {
+    const key = getPropertyName(prop);
+    if (!key) {
+        return undefined;
+    }
+    switch (key) {
+        case 'ADD_TAGS':
+        case 'ALLOWED_TAGS': {
+            const dangerous = getDangerousArrayElements(prop.value, DANGEROUS_TAGS);
+            return dangerous.length > 0 ? `remove ${formatList(dangerous)} from '${key}'` : undefined;
+        }
+        case 'ADD_ATTR':
+        case 'ALLOWED_ATTR': {
+            const dangerous = getDangerousAttributes(prop.value);
+            return dangerous.length > 0 ? `remove ${formatList(dangerous)} from '${key}'` : undefined;
+        }
+        case 'ADD_URI_SAFE_ATTR': {
+            const dangerous = getDangerousArrayElements(prop.value, DANGEROUS_URI_ATTRS);
+            return dangerous.length > 0 ? `remove ${formatList(dangerous)} from '${key}'` : undefined;
+        }
+        case 'ALLOWED_URI_REGEXP':
+            return isUnanchoredRegex(prop.value)
+                ? `anchor the 'ALLOWED_URI_REGEXP' pattern with '^' to prevent partial URI matches`
+                : undefined;
+        default:
+            if (key in DANGEROUS_BOOLEAN_OPTIONS) {
+                const dangerousValue = DANGEROUS_BOOLEAN_OPTIONS[key];
+                return isBooleanLiteral(prop.value, dangerousValue)
+                    ? `set '${key}' to '${!dangerousValue}'`
+                    : undefined;
+            }
+            return undefined;
+    }
+}
+function buildMessage(actions) {
+    const shown = actions.slice(0, MAX_ACTIONS_IN_MESSAGE);
+    const remaining = actions.length - shown.length;
+    let message = `To prevent DOM-based attacks, ${joinActions(shown)}.`;
+    if (remaining > 0) {
+        message += ` Plus ${remaining} more ${remaining === 1 ? 'issue' : 'issues'}. Read 'How to fix it' for all details.`;
+    }
+    return message;
+}
+function joinActions(actions) {
+    if (actions.length === 1) {
+        return actions[0];
+    }
+    return `${actions.slice(0, -1).join(', ')}, and ${actions.at(-1)}`;
+}
+function getPropertyName(prop) {
+    if (prop.key.type === 'Identifier') {
+        return prop.key.name;
+    }
+    if (prop.key.type === 'Literal' && typeof prop.key.value === 'string') {
+        return prop.key.value;
+    }
+    return undefined;
+}
+function getDangerousArrayElements(node, dangerousSet) {
+    if (node.type !== 'ArrayExpression') {
+        return [];
+    }
+    return node.elements
+        .filter((el) => el !== null &&
+        el.type === 'Literal' &&
+        typeof el.value === 'string' &&
+        dangerousSet.has(el.value.toLowerCase()))
+        .map(el => el.value);
+}
+function getDangerousAttributes(node) {
+    if (node.type !== 'ArrayExpression') {
+        return [];
+    }
+    return node.elements
+        .filter((el) => el !== null &&
+        el.type === 'Literal' &&
+        typeof el.value === 'string' &&
+        EVENT_HANDLER_PATTERN.test(el.value))
+        .map(el => el.value);
+}
+function formatList(items) {
+    const quoted = items.map(item => `'${item}'`);
+    if (quoted.length === 1) {
+        return quoted[0];
+    }
+    return `${quoted.slice(0, -1).join(', ')} and ${quoted.at(-1)}`;
+}
+function isBooleanLiteral(node, value) {
+    return node.type === 'Literal' && node.value === value;
+}
+function isUnanchoredRegex(node) {
+    if (node.type === 'Literal' && 'regex' in node && node.regex) {
+        return !node.regex.pattern.startsWith('^');
+    }
+    return false;
+}

package/cjs/S881/generated-meta.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S881/index.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S881/meta.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.eslintId = exports.implementation = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S881/rule.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S888/generated-meta.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S888/index.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S888/meta.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.eslintId = exports.implementation = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S888/rule.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S930/generated-meta.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S930/index.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S930/meta.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.hasSecondaries = exports.eslintId = exports.implementation = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S930/rule.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/helpers/accessibility.js

@@ -7,11 +7,11 @@ exports.getElementType = void 0;
 exports.isPresentationTable = isPresentationTable;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/helpers/ast.js

@@ -188,7 +188,7 @@ function isUndefined(node) {
  *  myObj.prop1 += 3;
  */
 function isElementWrite(statement, ref, recursive = true) {
-    if (statement.expression.type === 'AssignmentExpression') {
+    if (statement.expression?.type === 'AssignmentExpression') {
         const assignmentExpression = statement.expression;
         const lhs = assignmentExpression.left;
         return isMemberExpressionReference(lhs, ref, recursive);

package/cjs/helpers/cache.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ComputedCache = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/helpers/collection.js

@@ -5,11 +5,11 @@ exports.flatMap = flatMap;
 exports.last = last;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/helpers/configs.js

@@ -93,8 +93,8 @@ function applyTransformations(fields, mergedValues) {
             // fieldDefinition is a single property: { default, customForConfiguration, ... }
             // mergedConfigEntry is a scalar value (string, number, boolean)
             //
-            // Example — S1441 fieldDefinition = { default: 'single', customDefault: true, customForConfiguration: (v) => v ? 'single' : 'double' }
-            // mergedConfigEntry = true (boolean from SQ)
+            // Example — S1441 fieldDefinition = { default: 'single', customForConfiguration: (v) => ... }
+            // mergedConfigEntry = 'true' (string from SQ)
             // After transform: 'single' (string expected by ESLint quotes rule)
             return fieldDefinition.customForConfiguration(mergedConfigEntry);
         }

package/cjs/helpers/entropy.js

@@ -1,11 +1,13 @@
 "use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.shannonEntropy = shannonEntropy;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -15,8 +17,6 @@
  * You should have received a copy of the Sonar Source-Available License
  * along with this program; if not, see https://sonarsource.com/license/ssal/
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.shannonEntropy = shannonEntropy;
 function shannonEntropy(str) {
     if (!str) {
         return 0;

package/cjs/helpers/files.js

@@ -11,11 +11,11 @@ exports.joinPaths = joinPaths;
 exports.basenamePath = basenamePath;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -35,6 +35,7 @@ exports.ROOT_PATH = '/';
  * Byte Order Marker
  */
 const BOM_BYTE = 0xfeff;
+const isWindows = process.platform === 'win32';
 /**
  * Removes any Byte Order Marker (BOM) from a string's head
  *
@@ -49,7 +50,6 @@ function stripBOM(str) {
     }
     return str;
 }
-const isWindows = process.platform === 'win32';
 /**
  * Normalizes a path to Unix format (forward slashes).
  * For absolute paths on Windows, resolves them to ensure they have a drive letter.

package/cjs/helpers/find-up/closest.js

@@ -6,11 +6,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.closestPatternCache = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/helpers/internal-metrics.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toInternalMetricsSettings = toInternalMetricsSettings;
+exports.getInternalMetricsSink = getInternalMetricsSink;
+const SONAR_INTERNAL_SETTINGS_KEY = 'sonarInternal';
+const SONAR_INTERNAL_METRICS_SINK_KEY = 'metricsSink';
+function toInternalMetricsSettings(metricsSink) {
+    return {
+        [SONAR_INTERNAL_SETTINGS_KEY]: {
+            [SONAR_INTERNAL_METRICS_SINK_KEY]: metricsSink,
+        },
+    };
+}
+function getInternalMetricsSink(settings) {
+    if (!settings || typeof settings !== 'object') {
+        return undefined;
+    }
+    const sonarInternal = settings[SONAR_INTERNAL_SETTINGS_KEY];
+    if (!sonarInternal || typeof sonarInternal !== 'object') {
+        return undefined;
+    }
+    const metricsSink = sonarInternal[SONAR_INTERNAL_METRICS_SINK_KEY];
+    if (!metricsSink || typeof metricsSink !== 'object') {
+        return undefined;
+    }
+    return metricsSink;
+}

package/cjs/helpers/module-ts.js

@@ -6,11 +6,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getFullyQualifiedNameTS = getFullyQualifiedNameTS;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -26,7 +26,12 @@ const module_js_1 = require("./module.js");
 function getFullyQualifiedNameTS(services, rootNode) {
     const result = [];
     let node = rootNode;
+    const visitedNodes = new Set();
     while (node) {
+        if (visitedNodes.has(node)) {
+            return null;
+        }
+        visitedNodes.add(node);
         switch (node.kind) {
             case typescript_1.default.SyntaxKind.CallExpression: {
                 const callExpressionNode = node;

package/cjs/helpers/package-jsons/closest.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getClosestPackageJSONDir = getClosestPackageJSONDir;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of