eslint-plugin-sonarjs 4.0.2 → 4.1.0

package/cjs/S5659/rule.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S5689/generated-meta.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -31,12 +31,12 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
+exports.skipOnGeneratedSource = exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
 __exportStar(require("./meta.js"), exports);
 exports.meta = {
     type: 'problem',
     docs: {
-        description: 'Disclosing fingerprints from web application technologies is security-sensitive',
+        description: 'Web application technologies should not disclose version information',
         recommended: true,
         url: 'https://sonarsource.github.io/rspec/#/rspec/S5689/javascript',
         requiresTypeChecking: false,
@@ -49,3 +49,4 @@ exports.sonarKey = 'S5689';
 exports.scope = 'Main';
 exports.languages = ['js', 'ts'];
 exports.requiredDependency = [];
+exports.skipOnGeneratedSource = false;

package/cjs/S5689/index.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S5689/meta.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.eslintId = exports.implementation = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S5689/rule.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S5691/generated-meta.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -31,21 +31,22 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
+exports.skipOnGeneratedSource = exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
 __exportStar(require("./meta.js"), exports);
 exports.meta = {
     type: 'problem',
     docs: {
-        description: 'Statically serving hidden files is security-sensitive',
-        recommended: true,
+        description: 'Hidden files should not be served statically',
+        recommended: false,
         url: 'https://sonarsource.github.io/rspec/#/rspec/S5691/javascript',
         requiresTypeChecking: false,
     },
     fixable: undefined,
-    deprecated: false,
+    deprecated: true,
     defaultOptions: [],
 };
 exports.sonarKey = 'S5691';
 exports.scope = 'Main';
 exports.languages = ['js', 'ts'];
 exports.requiredDependency = [];
+exports.skipOnGeneratedSource = false;

package/cjs/S5691/index.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S5691/meta.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.eslintId = exports.implementation = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S5691/rule.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S5693/config.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S5693/generated-meta.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -31,12 +31,12 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
+exports.skipOnGeneratedSource = exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
 __exportStar(require("./meta.js"), exports);
 exports.meta = {
     type: 'problem',
     docs: {
-        description: 'Allowing requests with excessive content length is security-sensitive',
+        description: 'HTTP request content length should be limited',
         recommended: true,
         url: 'https://sonarsource.github.io/rspec/#/rspec/S5693/javascript',
         requiresTypeChecking: false,
@@ -54,3 +54,4 @@ exports.sonarKey = 'S5693';
 exports.scope = 'Main';
 exports.languages = ['js', 'ts'];
 exports.requiredDependency = [];
+exports.skipOnGeneratedSource = false;

package/cjs/S5693/index.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S5693/meta.js

@@ -17,11 +17,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = exports.eslintId = exports.implementation = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S5693/rule.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -146,6 +146,13 @@ function checkMulter(context, callExpression) {
     if (callExpression.callee.type === 'MemberExpression') {
         return;
     }
+    // Skip destructured imports of multer sub-functions (e.g., `import { diskStorage } from 'multer'`)
+    if (callExpression.callee.type === 'Identifier') {
+        const fqn = (0, module_js_1.getFullyQualifiedName)(context, callExpression.callee);
+        if (fqn && fqn !== MULTER_MODULE) {
+            return;
+        }
+    }
     if (callExpression.arguments.length === 0) {
         report(context, callExpression.callee);
         return;
@@ -204,7 +211,41 @@ function visitAssignment(context, assignment) {
         }
     }
 }
-function getSizeValue(context, node) {
+function evaluateBinaryExpression(context, node, visited) {
+    const left = getSizeValue(context, node.left, visited);
+    const right = getSizeValue(context, node.right, visited);
+    if (left == null || right == null) {
+        return null;
+    }
+    let result = null;
+    switch (node.operator) {
+        case '*':
+            result = left * right;
+            break;
+        case '+':
+            result = left + right;
+            break;
+        case '-':
+            result = left - right;
+            break;
+        case '/':
+            result = left / right;
+            break;
+        case '**':
+            result = left ** right;
+            break;
+    }
+    return result != null && Number.isFinite(result) ? result : null;
+}
+function getSizeValue(context, node, visited = new Set()) {
+    if (visited.has(node)) {
+        return null;
+    }
+    visited.add(node);
+    const resolved = (0, ast_js_1.getUniqueWriteUsageOrNode)(context, node, true);
+    if (resolved !== node) {
+        return getSizeValue(context, resolved, visited);
+    }
     const literal = (0, ast_js_1.getValueOfExpression)(context, node, 'Literal');
     if (literal) {
         if (typeof literal.value === 'number') {
@@ -214,6 +255,9 @@ function getSizeValue(context, node) {
             return (0, bytes_1.parse)(literal.value);
         }
     }
+    if (node.type === 'BinaryExpression') {
+        return evaluateBinaryExpression(context, node, visited);
+    }
     return null;
 }
 function report(context, nodeToReport, size, useStandardSizeLimit = false) {

package/cjs/S5725/generated-meta.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -31,12 +31,12 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
+exports.skipOnGeneratedSource = exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
 __exportStar(require("./meta.js"), exports);
 exports.meta = {
     type: 'problem',
     docs: {
-        description: 'Using remote artifacts without integrity checks is security-sensitive',
+        description: 'Remote artifacts should not be used without integrity checks',
         recommended: true,
         url: 'https://sonarsource.github.io/rspec/#/rspec/S5725/javascript',
         requiresTypeChecking: true,
@@ -49,3 +49,4 @@ exports.sonarKey = 'S5725';
 exports.scope = 'Main';
 exports.languages = ['js', 'ts'];
 exports.requiredDependency = [];
+exports.skipOnGeneratedSource = false;

package/cjs/S5725/index.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S5725/meta.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.eslintId = exports.implementation = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S5725/rule.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -56,10 +56,18 @@ const type_js_1 = require("../helpers/type.js");
 const ast_js_1 = require("../helpers/ast.js");
 const parser_services_js_1 = require("../helpers/parser-services.js");
 const meta = __importStar(require("./generated-meta.js"));
+// Matches a path segment with a semantic version (e.g. /3.7.1/, /v5.3.0/, /1.2/, /3.7.1-rc.1/)
+// or a package@version alias (e.g. /jquery@3.7.1/, /bootstrap@5.3.0, /react@19.0.0-rc.1/).
+// Prerelease identifiers (e.g. -rc.1, -beta.3) are included.
+// The lookahead allows the version to be the last path segment (no trailing slash required).
+const SEMVER_PATH_REGEX = /\/v?\d+\.\d+(?:\.\d+)?(?:-[a-zA-Z0-9][a-zA-Z0-9.-]*)?(?=[/?#]|$)/;
+const ALIAS_PATH_REGEX = /\/[^/@]*@[\d.]+(?:-[a-zA-Z0-9][a-zA-Z0-9.-]*)?(?=[/?#]|$)/;
 exports.rule = {
     meta: (0, generate_meta_js_1.generateMeta)(meta, {
         messages: {
-            safeResource: 'Make sure not using resource integrity feature is safe here.',
+            missingBoth: 'Add integrity and crossorigin="anonymous" attributes to this element to enforce integrity checks.',
+            missingIntegrity: 'Add an integrity attribute to this element to enforce integrity checks.',
+            missingCrossOrigin: 'Add a crossorigin="anonymous" attribute to this element to enforce integrity checks.',
         },
     }),
     create(context) {
@@ -90,11 +98,9 @@ exports.rule = {
                 if (!assignedVariable) {
                     return;
                 }
-                if (shouldReport(assignedVariable)) {
-                    context.report({
-                        node: variableDeclarator,
-                        messageId: 'safeResource',
-                    });
+                const messageId = shouldReport(assignedVariable);
+                if (messageId) {
+                    context.report({ node: variableDeclarator, messageId });
                 }
             },
         };
@@ -107,6 +113,32 @@ function isIntegrityAssignment(memberExpression) {
     return (memberExpression.property.type === 'Identifier' &&
         memberExpression.property.name === 'integrity');
 }
+function isCrossOriginAssignment(memberExpression) {
+    if (memberExpression.type !== 'MemberExpression') {
+        return false;
+    }
+    if (memberExpression.property.type !== 'Identifier' ||
+        memberExpression.property.name !== 'crossOrigin') {
+        return false;
+    }
+    return memberExpression.parent?.type === 'AssignmentExpression';
+}
+function isCrossOriginAnonymousAssignment(memberExpression) {
+    if (!isCrossOriginAssignment(memberExpression)) {
+        return false;
+    }
+    const right = memberExpression.parent.right;
+    return right.type === 'Literal' && right.value === 'anonymous';
+}
+// Returns true when crossOrigin is assigned a non-literal value that cannot be statically
+// resolved — we treat this conservatively as potentially "anonymous" to avoid false positives.
+function isCrossOriginUnresolvedAssignment(memberExpression) {
+    if (!isCrossOriginAssignment(memberExpression)) {
+        return false;
+    }
+    const right = memberExpression.parent.right;
+    return right.type !== 'Literal';
+}
 function isSrcAssignment(memberExpression) {
     if (memberExpression.type !== 'MemberExpression') {
         return false;
@@ -117,28 +149,59 @@ function isSrcAssignment(memberExpression) {
     const assignmentExpression = memberExpression.parent;
     return assignmentExpression?.type === 'AssignmentExpression';
 }
-function isUnsafeSrcAssignment(memberExpression) {
+function isVersionedRemoteUrl(memberExpression) {
     if (!isSrcAssignment(memberExpression)) {
         return false;
     }
     const right = memberExpression.parent.right;
-    if (right.type !== 'Literal') {
+    if (right.type !== 'Literal' || typeof right.value !== 'string') {
         return false;
     }
-    return !!right.raw && (!!right.raw.match('^"http') || !!right.raw.match('^"//'));
+    const url = right.value;
+    return ((url.startsWith('http') || url.startsWith('//')) &&
+        (SEMVER_PATH_REGEX.test(url) || ALIAS_PATH_REGEX.test(url)));
 }
 function shouldReport(assignedVariable) {
     let nbSrcAssignment = 0;
-    let hasUnsafeSrcAssignment = false;
+    let hasVersionedRemoteUrl = false;
     let hasIntegrityAssignment = false;
+    let hasCrossOriginAnonymous = false;
+    let hasCrossOriginUnresolved = false;
     for (const ref of assignedVariable.references) {
         const parentNode = ref.identifier.parent;
         if (!parentNode) {
             continue;
         }
         nbSrcAssignment += isSrcAssignment(parentNode) ? 1 : 0;
-        hasUnsafeSrcAssignment = hasUnsafeSrcAssignment || isUnsafeSrcAssignment(parentNode);
+        hasVersionedRemoteUrl = hasVersionedRemoteUrl || isVersionedRemoteUrl(parentNode);
         hasIntegrityAssignment = hasIntegrityAssignment || isIntegrityAssignment(parentNode);
+        // Overwrite on each crossOrigin assignment so the last assignment wins.
+        // Using || would make an earlier "anonymous" mask a later "use-credentials".
+        if (isCrossOriginAnonymousAssignment(parentNode)) {
+            hasCrossOriginAnonymous = true;
+            hasCrossOriginUnresolved = false;
+        }
+        else if (isCrossOriginUnresolvedAssignment(parentNode)) {
+            hasCrossOriginAnonymous = false;
+            hasCrossOriginUnresolved = true;
+        }
+        else if (isCrossOriginAssignment(parentNode)) {
+            hasCrossOriginAnonymous = false;
+            hasCrossOriginUnresolved = false;
+        }
+    }
+    if (nbSrcAssignment !== 1 || !hasVersionedRemoteUrl) {
+        return null;
+    }
+    const crossOriginOk = hasCrossOriginAnonymous || hasCrossOriginUnresolved;
+    if (!hasIntegrityAssignment && !crossOriginOk) {
+        return 'missingBoth';
+    }
+    if (!hasIntegrityAssignment) {
+        return 'missingIntegrity';
+    }
+    if (!crossOriginOk) {
+        return 'missingCrossOrigin';
     }
-    return nbSrcAssignment === 1 && hasUnsafeSrcAssignment && !hasIntegrityAssignment;
+    return null;
 }

package/cjs/S5728/generated-meta.js

@@ -1,11 +1,11 @@
 "use strict";
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -31,12 +31,12 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
+exports.skipOnGeneratedSource = exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
 __exportStar(require("./meta.js"), exports);
 exports.meta = {
     type: 'problem',
     docs: {
-        description: 'Disabling content security policy fetch directives is security-sensitive',
+        description: 'Content security policy fetch directives should not be disabled',
         recommended: true,
         url: 'https://sonarsource.github.io/rspec/#/rspec/S5728/javascript',
         requiresTypeChecking: false,
@@ -49,3 +49,4 @@ exports.sonarKey = 'S5728';
 exports.scope = 'Main';
 exports.languages = ['js', 'ts'];
 exports.requiredDependency = [];
+exports.skipOnGeneratedSource = false;

package/cjs/S5728/index.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of

package/cjs/S5728/meta.js

@@ -3,11 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.hasSecondaries = exports.eslintId = exports.implementation = void 0;
 /*
  * SonarQube JavaScript Plugin
- * Copyright (C) 2011-2025 SonarSource Sàrl
+ * Copyright (C) SonarSource Sàrl
  * mailto:info AT sonarsource DOT com
  *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of