eslint-plugin-sonarjs 4.0.3 → 4.1.0

package/cjs/S5845/rule.js

@@ -0,0 +1,296 @@
+"use strict";
+/*
+ * SonarQube JavaScript Plugin
+ * Copyright (C) SonarSource Sàrl
+ * mailto:info AT sonarsource DOT com
+ *
+ * You can redistribute and/or modify this program under the terms of
+ * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the Sonar Source-Available License for more details.
+ *
+ * You should have received a copy of the Sonar Source-Available License
+ * along with this program; if not, see https://sonarsource.com/license/ssal/
+ */
+// https://sonarsource.github.io/rspec/#/rspec/S5845/javascript
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rule = void 0;
+const typescript_1 = __importDefault(require("typescript"));
+const ast_js_1 = require("../helpers/ast.js");
+const assertions_js_1 = require("../helpers/assertions.js");
+const generate_meta_js_1 = require("../helpers/generate-meta.js");
+const parser_services_js_1 = require("../helpers/parser-services.js");
+const type_js_1 = require("../helpers/type.js");
+const meta = __importStar(require("./generated-meta.js"));
+const messages = {
+    incompatibleStaticTypes: 'Review this equality assertion: the compared expressions have incompatible static types ("{{actual}}" and "{{expected}}").',
+};
+exports.rule = {
+    meta: (0, generate_meta_js_1.generateMeta)(meta, { messages }),
+    /*
+     * High-level idea:
+     * - only run when the parser provides type information;
+     * - only analyse strict and deep equality assertions;
+     * - reduce both assertion operands to broad primitive families instead of comparing exact
+     *   TypeScript types, because the rule is meant to highlight incompatible static typings on
+     *   equality checks rather than to model all runtime equality behavior;
+     * - stay conservative whenever the type is imprecise (`any`, `unknown`, type parameters, etc.),
+     *   or when a mutable identifier may have been reassigned to a different family.
+     */
+    create(context) {
+        const services = context.sourceCode.parserServices;
+        if (!(0, parser_services_js_1.isRequiredParserServices)(services)) {
+            return {};
+        }
+        const checker = services.program.getTypeChecker();
+        const monkeyPatchedReceivers = new Set();
+        // Expressions that are not rooted in a mutable local binding can rely directly on the
+        // expression type at the assertion site:
+        //   expect(getCount()).toBe('1');
+        //   expect(Number(title)).toBe('1');
+        //
+        // Bare identifiers and member expressions rooted in an identifier need one extra guard.
+        // `getTypeAtLocation(value)` can stay narrow even after an imprecise write, so using the
+        // current type alone would introduce false positives:
+        //   declare function readAny(): any;
+        //   let value: number = 1;
+        //   value = readAny();
+        //   expect(value).toBe('1'); // keep silent: runtime value may be string
+        //   let user: { id: number } = { id: 1 };
+        //   user = readAny();
+        //   expect(user.id).toBe('1'); // keep silent for the same reason
+        //
+        // We therefore trust the current type only when the root identifier of the expression has only
+        // been written with values that are themselves classifiable to primitive families. That still
+        // lets TypeScript's flow narrowing do the useful work for precise writes:
+        //   let value: number | string;
+        //   if (Math.random() > 0.5) value = 'ready'; else value = 1;
+        //   if (typeof value === 'string') expect(value).toBe(true); // report
+        //
+        // This is intentionally coarser than full reaching-definitions. If any write is `any`,
+        // `unknown`, a type parameter, indexed access, etc., we bail out conservatively.
+        function checkAssertion(node) {
+            const assertion = (0, assertions_js_1.extractTestAssertion)(context, node);
+            if (!isRelevantAssertion(assertion)) {
+                return;
+            }
+            const actualType = checker.getBaseTypeOfLiteralType((0, type_js_1.getTypeFromTreeNode)(assertion.actual, services));
+            const expectedType = checker.getBaseTypeOfLiteralType((0, type_js_1.getTypeFromTreeNode)(assertion.expected, services));
+            if (!hasStablePrimitiveType(assertion.actual, actualType) ||
+                !hasStablePrimitiveType(assertion.expected, expectedType)) {
+                return;
+            }
+            const incompatibility = getIncompatibility(actualType, expectedType, checker);
+            if (incompatibility) {
+                context.report({
+                    node: assertion.reportNode,
+                    messageId: 'incompatibleStaticTypes',
+                    data: incompatibility,
+                });
+            }
+        }
+        function hasStablePrimitiveType(node, nodeType) {
+            const monkeyPatchedReceiver = getMonkeyPatchedReceiver(node);
+            if (monkeyPatchedReceiver) {
+                return false;
+            }
+            const allowedCategories = getPrimitiveCategories(nodeType);
+            if (!allowedCategories) {
+                return false;
+            }
+            const rootIdentifier = getRootIdentifier(node);
+            if (!rootIdentifier) {
+                return true;
+            }
+            const variable = (0, ast_js_1.getVariableFromName)(context, rootIdentifier.name, node);
+            if (!variable) {
+                return true;
+            }
+            return variable.references
+                .filter(ref => ref.isWrite())
+                .every(ref => isPreciselyTypedWrite(ref.writeExpr, checker, services));
+        }
+        function getMonkeyPatchedReceiver(node) {
+            if (node.type !== 'CallExpression' || node.callee.type !== 'MemberExpression') {
+                return null;
+            }
+            const rootIdentifier = getRootIdentifier(node.callee.object);
+            if (!rootIdentifier) {
+                return null;
+            }
+            const variable = (0, ast_js_1.getVariableFromName)(context, rootIdentifier.name, node);
+            return variable && monkeyPatchedReceivers.has(variable) ? variable : null;
+        }
+        function collectMonkeyPatchedReceiver(node) {
+            if (node.type !== 'AssignmentExpression' ||
+                node.operator !== '=' ||
+                node.left.type !== 'MemberExpression' ||
+                !isFunctionLikeExpression(node.right)) {
+                return;
+            }
+            const rootIdentifier = getRootIdentifier(node.left.object);
+            if (!rootIdentifier) {
+                return;
+            }
+            const variable = (0, ast_js_1.getVariableFromName)(context, rootIdentifier.name, node);
+            if (variable) {
+                monkeyPatchedReceivers.add(variable);
+            }
+        }
+        return {
+            AssignmentExpression(node) {
+                collectMonkeyPatchedReceiver(node);
+            },
+            CallExpression(node) {
+                checkAssertion(node);
+            },
+        };
+    },
+};
+// Strict and deep equality assertions are in scope. Loose equality depends on coercion, while
+// deep equality is relevant here because the rule only reasons about primitive type families.
+function isRelevantAssertion(assertion) {
+    return (assertion?.kind === 'comparison' &&
+        (assertion.comparison === 'strict' || assertion.comparison === 'deep'));
+}
+// The rule reports only when the two operands have no plausible primitive-family overlap.
+// If they share a family, or either side falls into a conservative family, we skip reporting.
+function getIncompatibility(actualType, expectedType, checker) {
+    const actualCategories = getPrimitiveCategories(actualType);
+    const expectedCategories = getPrimitiveCategories(expectedType);
+    if (!actualCategories || !expectedCategories) {
+        return null;
+    }
+    for (const actualCategory of actualCategories) {
+        for (const expectedCategory of expectedCategories) {
+            if (actualCategory === expectedCategory ||
+                isConservativeCategory(actualCategory) ||
+                isConservativeCategory(expectedCategory)) {
+                return null;
+            }
+        }
+    }
+    return {
+        actual: checker.typeToString(actualType),
+        expected: checker.typeToString(expectedType),
+    };
+}
+// Objects, null, and undefined are kept conservative because structural typing and JS runtime
+// behavior make "always incompatible" claims too risky for this rule.
+function isConservativeCategory(category) {
+    return category === 'object' || category === 'null' || category === 'undefined';
+}
+// Normalise scalar and union types to a flat list so the rest of the logic can treat both cases
+// uniformly.
+function getUnionMembers(type) {
+    return type.isUnion() ? type.types : [type];
+}
+// Collapse a TypeScript type into primitive families. If any union member is too imprecise to
+// classify, return null so callers can stay conservative.
+function getPrimitiveCategories(type) {
+    const categories = getUnionMembers(type).map(getPrimitiveCategory);
+    return categories.every(isPrimitiveCategory) ? categories : null;
+}
+// Translate the detailed TypeScript type system into the coarse families this rule reasons about.
+// Anything outside those obvious buckets is treated as indeterminate.
+function getPrimitiveCategory(type) {
+    const indeterminateFlags = typescript_1.default.TypeFlags.Any |
+        typescript_1.default.TypeFlags.Unknown |
+        typescript_1.default.TypeFlags.TypeParameter |
+        typescript_1.default.TypeFlags.IndexedAccess;
+    if ((type.flags & indeterminateFlags) !== 0) {
+        return null;
+    }
+    if ((type.flags & typescript_1.default.TypeFlags.StringLike) !== 0) {
+        return 'string';
+    }
+    if ((type.flags & typescript_1.default.TypeFlags.NumberLike) !== 0) {
+        return 'number';
+    }
+    if ((type.flags & typescript_1.default.TypeFlags.BooleanLike) !== 0) {
+        return 'boolean';
+    }
+    if ((type.flags & typescript_1.default.TypeFlags.BigIntLike) !== 0) {
+        return 'bigint';
+    }
+    if ((type.flags & typescript_1.default.TypeFlags.ESSymbolLike) !== 0) {
+        return 'symbol';
+    }
+    if ((type.flags & typescript_1.default.TypeFlags.Null) !== 0) {
+        return 'null';
+    }
+    if ((type.flags & (typescript_1.default.TypeFlags.Undefined | typescript_1.default.TypeFlags.Void)) !== 0) {
+        return 'undefined';
+    }
+    if ((type.flags & typescript_1.default.TypeFlags.Object) !== 0) {
+        return 'object';
+    }
+    return null;
+}
+// Narrow the mapped category list back to `PrimitiveCategory[]` once null has been ruled out.
+function isPrimitiveCategory(category) {
+    return category !== null;
+}
+// A write is trustworthy when TypeScript can still classify the assigned value into primitive
+// families at the write site. If not, the identifier's current type is not reliable enough for
+// this rule:
+//   value = readAny();      // bail out
+//   value = values[index];  // bail out when the indexed access is imprecise
+//
+//   value = 'ready';        // precise
+//   value = 1;              // precise
+function isPreciselyTypedWrite(writeExpr, checker, services) {
+    if (!writeExpr) {
+        return false;
+    }
+    return (getPrimitiveCategories(checker.getBaseTypeOfLiteralType((0, type_js_1.getTypeFromTreeNode)(writeExpr, services))) !== null);
+}
+function getRootIdentifier(node) {
+    let current = node;
+    while (current.type === 'ChainExpression' || current.type === 'MemberExpression') {
+        current = current.type === 'ChainExpression' ? current.expression : current.object;
+    }
+    return current.type === 'Identifier' ? current : null;
+}
+function isFunctionLikeExpression(node) {
+    return node.type === 'FunctionExpression' || node.type === 'ArrowFunctionExpression';
+}

package/cjs/S5850/generated-meta.js

@@ -31,7 +31,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
+exports.skipOnGeneratedSource = exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
 __exportStar(require("./meta.js"), exports);
 exports.meta = {
     type: 'problem',
@@ -49,3 +49,4 @@ exports.sonarKey = 'S5850';
 exports.scope = 'Main';
 exports.languages = ['js', 'ts'];
 exports.requiredDependency = [];
+exports.skipOnGeneratedSource = false;

package/cjs/S5852/generated-meta.js

@@ -31,12 +31,12 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
+exports.skipOnGeneratedSource = exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
 __exportStar(require("./meta.js"), exports);
 exports.meta = {
     type: 'problem',
     docs: {
-        description: 'Using slow regular expressions is security-sensitive',
+        description: 'Regular expressions should not cause catastrophic backtracking',
         recommended: true,
         url: 'https://sonarsource.github.io/rspec/#/rspec/S5852/javascript',
         requiresTypeChecking: true,
@@ -49,3 +49,4 @@ exports.sonarKey = 'S5852';
 exports.scope = 'Main';
 exports.languages = ['js', 'ts'];
 exports.requiredDependency = [];
+exports.skipOnGeneratedSource = false;

package/cjs/S5852/rule.js

@@ -55,12 +55,20 @@ const scslre_1 = require("scslre");
 const generate_meta_js_1 = require("../helpers/generate-meta.js");
 const meta = __importStar(require("./generated-meta.js"));
 const rule_template_js_1 = require("../helpers/regex/rule-template.js");
-const message = `Make sure the regex used here, which is vulnerable to super-linear runtime due to backtracking, cannot lead to denial of service.`;
+const message = `Fix this regular expression that is vulnerable to exponential backtracking, as it can lead to denial of service.`;
 exports.rule = (0, rule_template_js_1.createRegExpRule)(context => {
     return {
         onRegExpLiteralEnter: (node) => {
-            const { reports } = (0, scslre_1.analyse)(node);
-            if (reports.length > 0) {
+            let reports;
+            try {
+                ({ reports } = (0, scslre_1.analyse)(node));
+            }
+            catch {
+                // `scslre` does not understand every regexp accepted by the JS parser.
+                // Skip the S5852 check for those literals instead of aborting analysis for the whole file.
+                return;
+            }
+            if (reports.some(r => r.exponential)) {
                 context.report({
                     message,
                     node: context.node,

package/cjs/S5856/generated-meta.js

@@ -31,7 +31,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
+exports.skipOnGeneratedSource = exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
 __exportStar(require("./meta.js"), exports);
 exports.meta = {
     type: 'problem',
@@ -49,3 +49,4 @@ exports.sonarKey = 'S5856';
 exports.scope = 'Main';
 exports.languages = ['js', 'ts'];
 exports.requiredDependency = [];
+exports.skipOnGeneratedSource = false;

package/cjs/S5860/generated-meta.js

@@ -31,7 +31,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
+exports.skipOnGeneratedSource = exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
 __exportStar(require("./meta.js"), exports);
 exports.meta = {
     type: 'suggestion',
@@ -49,3 +49,4 @@ exports.sonarKey = 'S5860';
 exports.scope = 'Main';
 exports.languages = ['js', 'ts'];
 exports.requiredDependency = [];
+exports.skipOnGeneratedSource = false;

package/cjs/S5863/generated-meta.js

@@ -31,7 +31,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
+exports.skipOnGeneratedSource = exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
 __exportStar(require("./meta.js"), exports);
 exports.meta = {
     type: 'problem',
@@ -49,3 +49,4 @@ exports.sonarKey = 'S5863';
 exports.scope = 'Tests';
 exports.languages = ['js', 'ts'];
 exports.requiredDependency = [];
+exports.skipOnGeneratedSource = true;

package/cjs/S5867/generated-meta.js

@@ -31,7 +31,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
+exports.skipOnGeneratedSource = exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
 __exportStar(require("./meta.js"), exports);
 exports.meta = {
     type: 'problem',
@@ -49,3 +49,4 @@ exports.sonarKey = 'S5867';
 exports.scope = 'Main';
 exports.languages = ['js', 'ts'];
 exports.requiredDependency = [];
+exports.skipOnGeneratedSource = false;

package/cjs/S5868/generated-meta.js

@@ -31,7 +31,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
+exports.skipOnGeneratedSource = exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
 __exportStar(require("./meta.js"), exports);
 exports.meta = {
     type: 'problem',
@@ -49,3 +49,4 @@ exports.sonarKey = 'S5868';
 exports.scope = 'Main';
 exports.languages = ['js', 'ts'];
 exports.requiredDependency = [];
+exports.skipOnGeneratedSource = false;

package/cjs/S5868/rule.js

@@ -51,7 +51,6 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.rule = void 0;
-const ancestor_js_1 = require("../helpers/ancestor.js");
 const generate_meta_js_1 = require("../helpers/generate-meta.js");
 const ast_js_1 = require("../helpers/ast.js");
 const regexpp_1 = require("@eslint-community/regexpp");
@@ -65,7 +64,21 @@ const MODIFIABLE_REGEXP_FLAGS_TYPES = new Set([
     'TemplateLiteral',
     'TaggedTemplateExpression',
 ]);
+const MIN_HIGH_SURROGATE = 0xd800;
+const MIN_LOW_SURROGATE = 0xdc00;
+const MAX_LOW_SURROGATE_EXCLUSIVE = 0xe000;
+const MIN_EMOJI_MODIFIER = 0x1f3fb;
+const MAX_EMOJI_MODIFIER = 0x1f3ff;
+const MIN_REGIONAL_INDICATOR = 0x1f1e6;
+const MAX_REGIONAL_INDICATOR = 0x1f1ff;
+const ZERO_WIDTH_JOINER = 0x200d;
 exports.rule = (0, rule_template_js_1.createRegExpRule)(context => {
+    let currentSeams = [];
+    // Seam positions are in pattern space, while regexpp positions include the opening slash.
+    // A pair straddles a seam only when the seam is exactly before charB.
+    function spansSeam(charA, charB) {
+        return charA.end === charB.start && currentSeams.some(seam => seam + 1 === charB.start);
+    }
     function checkSequence(sequence) {
         // Stop on the first illegal character in the sequence
         for (let index = 0; index < sequence.length; index++) {
@@ -75,20 +88,16 @@ exports.rule = (0, rule_template_js_1.createRegExpRule)(context => {
         }
     }
     function checkCharacter(character, index, characters) {
-        // Stop on the first failed check as there may be overlaps between checks
-        // for instance a zero-width-sequence containing a modified emoji.
-        for (const check of characterChecks) {
-            if (check(character, index, characters)) {
-                return true;
-            }
-        }
-        return false;
+        // Stop on the first check that fires as checks may overlap,
+        // for instance a zero-width sequence containing a modified emoji.
+        return characterChecks.some(check => check(character, index, characters));
     }
     function checkCombinedCharacter(character, index, characters) {
         let reported = false;
         if (index !== 0 &&
             isCombiningCharacter(character.value) &&
-            !isCombiningCharacter(characters[index - 1].value)) {
+            !isCombiningCharacter(characters[index - 1].value) &&
+            !spansSeam(characters[index - 1], character)) {
             const combinedChar = characters[index - 1].raw + characters[index].raw;
             const message = `Move this Unicode combined character '${combinedChar}' outside of the character class`;
             context.reportRegExpNode({ regexpNode: characters[index], node: context.node, message });
@@ -98,7 +107,9 @@ exports.rule = (0, rule_template_js_1.createRegExpRule)(context => {
     }
     function checkSurrogatePairTailCharacter(character, index, characters) {
         let reported = false;
-        if (index !== 0 && isSurrogatePair(characters[index - 1].value, character.value)) {
+        if (index !== 0 &&
+            isSurrogatePair(characters[index - 1].value, character.value) &&
+            !spansSeam(characters[index - 1], character)) {
             const surrogatePair = characters[index - 1].raw + characters[index].raw;
             const message = `Move this Unicode surrogate pair '${surrogatePair}' outside of the character class or use 'u' flag`;
             const pattern = (0, extract_js_1.getPatternFromNode)(context.node, context)?.pattern;
@@ -125,7 +136,7 @@ exports.rule = (0, rule_template_js_1.createRegExpRule)(context => {
         if ((0, ast_js_1.isRegexLiteral)(node)) {
             return insertTextAfter(fixer, node, 'u');
         }
-        const regExpConstructor = getRegExpConstructor(node);
+        const regExpConstructor = getRegExpConstructor(node, sourceCode);
         if (!regExpConstructor) {
             return null;
         }
@@ -144,7 +155,8 @@ exports.rule = (0, rule_template_js_1.createRegExpRule)(context => {
         let reported = false;
         if (index !== 0 &&
             isEmojiModifier(character.value) &&
-            !isEmojiModifier(characters[index - 1].value)) {
+            !isEmojiModifier(characters[index - 1].value) &&
+            !spansSeam(characters[index - 1], character)) {
             const modifiedEmoji = characters[index - 1].raw + characters[index].raw;
             const message = `Move this Unicode modified Emoji '${modifiedEmoji}' outside of the character class`;
             context.reportRegExpNode({ regexpNode: characters[index], node: context.node, message });
@@ -156,7 +168,8 @@ exports.rule = (0, rule_template_js_1.createRegExpRule)(context => {
         let reported = false;
         if (index !== 0 &&
             isRegionalIndicator(character.value) &&
-            isRegionalIndicator(characters[index - 1].value)) {
+            isRegionalIndicator(characters[index - 1].value) &&
+            !spansSeam(characters[index - 1], character)) {
             const regionalIndicator = characters[index - 1].raw + characters[index].raw;
             const message = `Move this Unicode regional indicator '${regionalIndicator}' outside of the character class`;
             context.reportRegExpNode({ regexpNode: characters[index], node: context.node, message });
@@ -170,7 +183,9 @@ exports.rule = (0, rule_template_js_1.createRegExpRule)(context => {
             index !== characters.length - 1 &&
             isZeroWidthJoiner(character.value) &&
             !isZeroWidthJoiner(characters[index - 1].value) &&
-            !isZeroWidthJoiner(characters[index + 1].value)) {
+            !isZeroWidthJoiner(characters[index + 1].value) &&
+            !spansSeam(characters[index - 1], character) &&
+            !spansSeam(character, characters[index + 1])) {
             // It's practically difficult to determine the full joined character sequence
             // as it may join more than 2 elements that consist of characters or modified Emojis
             // see: https://unicode.org/emoji/charts/emoji-zwj-sequences.html
@@ -186,7 +201,7 @@ exports.rule = (0, rule_template_js_1.createRegExpRule)(context => {
     }
     function isValidWithUnicodeFlag(pattern) {
         try {
-            validator.validatePattern(pattern, undefined, undefined, true);
+            validator.validatePattern(pattern, undefined, undefined, { unicode: true });
             return true;
         }
         catch {
@@ -205,6 +220,7 @@ exports.rule = (0, rule_template_js_1.createRegExpRule)(context => {
     ];
     return {
         onCharacterClassEnter(ccNode) {
+            currentSeams = (0, extract_js_1.getPatternFromNode)(context.node, context)?.seams ?? [];
             for (const chars of characters(ccNode.elements)) {
                 checkSequence(chars);
             }
@@ -219,10 +235,10 @@ function characters(nodes) {
             current.push(node);
         }
         else if (node.type === 'CharacterClassRange') {
-            // for following regexp [xa-z] we produce [[xa],[z]]
-            // we would report for example if instead of 'xa' there would be unicode combined class
+            // For [xa-z], check [xa] but do not pair z with the next range or character.
+            // Report if the sequence ending at the range minimum is a grapheme cluster.
             current.push(node.min);
-            current = [node.max];
+            current = [];
             sequences.push(current);
         }
         else if (node.type === 'CharacterSet' && current.length > 0) {
@@ -238,19 +254,32 @@ function isCombiningCharacter(codePoint) {
     return /^[\p{Mc}\p{Me}\p{Mn}]$/u.test(String.fromCodePoint(codePoint));
 }
 function isSurrogatePair(lead, tail) {
-    return lead >= 0xd800 && lead < 0xdc00 && tail >= 0xdc00 && tail < 0xe000;
+    return (lead >= MIN_HIGH_SURROGATE &&
+        lead < MIN_LOW_SURROGATE &&
+        tail >= MIN_LOW_SURROGATE &&
+        tail < MAX_LOW_SURROGATE_EXCLUSIVE);
 }
 function isEmojiModifier(code) {
-    return code >= 0x1f3fb && code <= 0x1f3ff;
+    return code >= MIN_EMOJI_MODIFIER && code <= MAX_EMOJI_MODIFIER;
 }
 function isRegionalIndicator(code) {
-    return code >= 0x1f1e6 && code <= 0x1f1ff;
+    return code >= MIN_REGIONAL_INDICATOR && code <= MAX_REGIONAL_INDICATOR;
 }
 function isZeroWidthJoiner(code) {
-    return code === 0x200d;
+    return code === ZERO_WIDTH_JOINER;
+}
+function getRegExpConstructor(node, sourceCode) {
+    const ancestors = sourceCode.getAncestors(node);
+    for (let i = ancestors.length - 1; i >= 0; i--) {
+        const ancestor = ancestors[i];
+        if (ancestor && isRegExpConstructorCallOrNew(ancestor)) {
+            return ancestor;
+        }
+    }
+    return undefined;
 }
-function getRegExpConstructor(node) {
-    return (0, ancestor_js_1.ancestorsChain)(node, new Set(['CallExpression', 'NewExpression'])).find(n => (0, ast_js_2.isRegExpConstructor)(n));
+function isRegExpConstructorCallOrNew(node) {
+    return (0, ast_js_2.isRegExpConstructor)(node);
 }
 function hasModifiableFlags(regExpConstructor) {
     const args = regExpConstructor.arguments;

package/cjs/S5869/generated-meta.js

@@ -31,7 +31,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
+exports.skipOnGeneratedSource = exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
 __exportStar(require("./meta.js"), exports);
 exports.meta = {
     type: 'suggestion',
@@ -49,3 +49,4 @@ exports.sonarKey = 'S5869';
 exports.scope = 'Main';
 exports.languages = ['js', 'ts'];
 exports.requiredDependency = [];
+exports.skipOnGeneratedSource = false;

package/cjs/S5876/generated-meta.js

@@ -31,7 +31,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
+exports.skipOnGeneratedSource = exports.requiredDependency = exports.languages = exports.scope = exports.sonarKey = exports.meta = void 0;
 __exportStar(require("./meta.js"), exports);
 exports.meta = {
     type: 'problem',
@@ -49,3 +49,4 @@ exports.sonarKey = 'S5876';
 exports.scope = 'Main';
 exports.languages = ['js', 'ts'];
 exports.requiredDependency = [];
+exports.skipOnGeneratedSource = false;