eslint-plugin-unicorn-ts 0.0.1-security → 50.0.1

package/rules/no-new-buffer.js

@@ -0,0 +1,98 @@
+'use strict';
+const {getStaticValue} = require('@eslint-community/eslint-utils');
+const {switchNewExpressionToCallExpression} = require('./fix/index.js');
+const isNumber = require('./utils/is-number.js');
+const {isNewExpression} = require('./ast/index.js');
+
+const ERROR = 'error';
+const ERROR_UNKNOWN = 'error-unknown';
+const SUGGESTION = 'suggestion';
+const messages = {
+	[ERROR]: '`new Buffer()` is deprecated, use `Buffer.{{method}}()` instead.',
+	[ERROR_UNKNOWN]: '`new Buffer()` is deprecated, use `Buffer.alloc()` or `Buffer.from()` instead.',
+	[SUGGESTION]: 'Switch to `Buffer.{{replacement}}()`.',
+};
+
+const inferMethod = (bufferArguments, scope) => {
+	if (bufferArguments.length !== 1) {
+		return 'from';
+	}
+
+	const [firstArgument] = bufferArguments;
+	if (firstArgument.type === 'SpreadElement') {
+		return;
+	}
+
+	if (firstArgument.type === 'ArrayExpression' || firstArgument.type === 'TemplateLiteral') {
+		return 'from';
+	}
+
+	if (isNumber(firstArgument, scope)) {
+		return 'alloc';
+	}
+
+	const staticResult = getStaticValue(firstArgument, scope);
+	if (staticResult) {
+		const {value} = staticResult;
+		if (
+			typeof value === 'string'
+			|| Array.isArray(value)
+		) {
+			return 'from';
+		}
+	}
+};
+
+function fix(node, sourceCode, method) {
+	return function * (fixer) {
+		yield fixer.insertTextAfter(node.callee, `.${method}`);
+		yield * switchNewExpressionToCallExpression(node, sourceCode, fixer);
+	};
+}
+
+/** @param {import('eslint').Rule.RuleContext} context */
+const create = context => {
+	const {sourceCode} = context;
+	return {
+		NewExpression(node) {
+			if (!isNewExpression(node, {name: 'Buffer'})) {
+				return;
+			}
+
+			const method = inferMethod(node.arguments, sourceCode.getScope(node));
+
+			if (method) {
+				return {
+					node,
+					messageId: ERROR,
+					data: {method},
+					fix: fix(node, sourceCode, method),
+				};
+			}
+
+			return {
+				node,
+				messageId: ERROR_UNKNOWN,
+				suggest: ['from', 'alloc'].map(replacement => ({
+					messageId: SUGGESTION,
+					data: {replacement},
+					fix: fix(node, sourceCode, replacement),
+				})),
+			};
+		},
+	};
+};
+
+/** @type {import('eslint').Rule.RuleModule} */
+module.exports = {
+	create,
+	meta: {
+		type: 'problem',
+		docs: {
+			description: 'Enforce the use of `Buffer.from()` and `Buffer.alloc()` instead of the deprecated `new Buffer()`.',
+		},
+		fixable: 'code',
+		hasSuggestions: true,
+		messages,
+	},
+};

package/rules/no-null.js

@@ -0,0 +1,153 @@
+'use strict';
+const {
+	isMethodCall,
+	isCallExpression,
+	isLiteral,
+} = require('./ast/index.js');
+
+const ERROR_MESSAGE_ID = 'error';
+const SUGGESTION_REPLACE_MESSAGE_ID = 'replace';
+const SUGGESTION_REMOVE_MESSAGE_ID = 'remove';
+const messages = {
+	[ERROR_MESSAGE_ID]: 'Use `undefined` instead of `null`.',
+	[SUGGESTION_REPLACE_MESSAGE_ID]: 'Replace `null` with `undefined`.',
+	[SUGGESTION_REMOVE_MESSAGE_ID]: 'Remove `null`.',
+};
+
+const isLooseEqual = node => node.type === 'BinaryExpression' && ['==', '!='].includes(node.operator);
+const isStrictEqual = node => node.type === 'BinaryExpression' && ['===', '!=='].includes(node.operator);
+
+/** @param {import('eslint').Rule.RuleContext} context */
+const create = context => {
+	const {checkStrictEquality} = {
+		checkStrictEquality: false,
+		...context.options[0],
+	};
+
+	return {
+		Literal(node) {
+			if (
+				// eslint-disable-next-line unicorn/no-null
+				!isLiteral(node, null)
+				|| (!checkStrictEquality && isStrictEqual(node.parent))
+				// `Object.create(null)`, `Object.create(null, foo)`
+				|| (
+					isMethodCall(node.parent, {
+						object: 'Object',
+						method: 'create',
+						minimumArguments: 1,
+						maximumArguments: 2,
+						optionalCall: false,
+						optionalMember: false,
+					})
+					&& node.parent.arguments[0] === node
+				)
+				// `useRef(null)`
+				|| (
+					isCallExpression(node.parent, {
+						name: 'useRef',
+						argumentsLength: 1,
+						optionalCall: false,
+						optionalMember: false,
+					})
+					&& node.parent.arguments[0] === node
+				)
+				// `React.useRef(null)`
+				|| (
+					isMethodCall(node.parent, {
+						object: 'React',
+						method: 'useRef',
+						argumentsLength: 1,
+						optionalCall: false,
+						optionalMember: false,
+					})
+					&& node.parent.arguments[0] === node
+				)
+				// `foo.insertBefore(bar, null)`
+				|| (
+					isMethodCall(node.parent, {
+						method: 'insertBefore',
+						argumentsLength: 2,
+						optionalCall: false,
+						optionalMember: false,
+					})
+					&& node.parent.arguments[1] === node
+				)
+			) {
+				return;
+			}
+
+			const {parent} = node;
+
+			const problem = {
+				node,
+				messageId: ERROR_MESSAGE_ID,
+			};
+
+			const useUndefinedFix = fixer => fixer.replaceText(node, 'undefined');
+
+			if (isLooseEqual(parent)) {
+				problem.fix = useUndefinedFix;
+				return problem;
+			}
+
+			const useUndefinedSuggestion = {
+				messageId: SUGGESTION_REPLACE_MESSAGE_ID,
+				fix: useUndefinedFix,
+			};
+
+			if (parent.type === 'ReturnStatement' && parent.argument === node) {
+				problem.suggest = [
+					{
+						messageId: SUGGESTION_REMOVE_MESSAGE_ID,
+						fix: fixer => fixer.remove(node),
+					},
+					useUndefinedSuggestion,
+				];
+				return problem;
+			}
+
+			if (parent.type === 'VariableDeclarator' && parent.init === node && parent.parent.kind !== 'const') {
+				problem.suggest = [
+					{
+						messageId: SUGGESTION_REMOVE_MESSAGE_ID,
+						fix: fixer => fixer.removeRange([parent.id.range[1], node.range[1]]),
+					},
+					useUndefinedSuggestion,
+				];
+				return problem;
+			}
+
+			problem.suggest = [useUndefinedSuggestion];
+			return problem;
+		},
+	};
+};
+
+const schema = [
+	{
+		type: 'object',
+		additionalProperties: false,
+		properties: {
+			checkStrictEquality: {
+				type: 'boolean',
+				default: false,
+			},
+		},
+	},
+];
+
+/** @type {import('eslint').Rule.RuleModule} */
+module.exports = {
+	create,
+	meta: {
+		type: 'suggestion',
+		docs: {
+			description: 'Disallow the use of the `null` literal.',
+		},
+		fixable: 'code',
+		hasSuggestions: true,
+		schema,
+		messages,
+	},
+};

package/rules/no-object-as-default-parameter.js

@@ -0,0 +1,50 @@
+'use strict';
+const {isFunction} = require('./ast/index.js');
+
+const MESSAGE_ID_IDENTIFIER = 'identifier';
+const MESSAGE_ID_NON_IDENTIFIER = 'non-identifier';
+const messages = {
+	[MESSAGE_ID_IDENTIFIER]: 'Do not use an object literal as default for parameter `{{parameter}}`.',
+	[MESSAGE_ID_NON_IDENTIFIER]: 'Do not use an object literal as default.',
+};
+
+/** @param {import('eslint').Rule.RuleContext} context */
+const create = () => ({
+	AssignmentPattern(node) {
+		if (!(
+			node.right.type === 'ObjectExpression'
+			&& node.right.properties.length > 0
+			&& isFunction(node.parent)
+			&& node.parent.params.includes(node)
+		)) {
+			return;
+		}
+
+		const {left, right} = node;
+
+		if (left.type === 'Identifier') {
+			return {
+				node: left,
+				messageId: MESSAGE_ID_IDENTIFIER,
+				data: {parameter: left.name},
+			};
+		}
+
+		return {
+			node: right,
+			messageId: MESSAGE_ID_NON_IDENTIFIER,
+		};
+	},
+});
+
+/** @type {import('eslint').Rule.RuleModule} */
+module.exports = {
+	create,
+	meta: {
+		type: 'problem',
+		docs: {
+			description: 'Disallow the use of objects as default parameters.',
+		},
+		messages,
+	},
+};

package/rules/no-process-exit.js

@@ -0,0 +1,104 @@
+'use strict';
+const {isStaticRequire, isMethodCall, isLiteral} = require('./ast/index.js');
+
+const MESSAGE_ID = 'no-process-exit';
+const messages = {
+	[MESSAGE_ID]: 'Only use `process.exit()` in CLI apps. Throw an error instead.',
+};
+
+const isWorkerThreads = node =>
+	isLiteral(node, 'node:worker_threads')
+	|| isLiteral(node, 'worker_threads');
+
+/** @param {import('eslint').Rule.RuleContext} context */
+const create = context => {
+	const startsWithHashBang = context.sourceCode.lines[0].indexOf('#!') === 0;
+
+	if (startsWithHashBang) {
+		return {};
+	}
+
+	let processEventHandler;
+
+	// Only report if it's outside an worker thread context. See #328.
+	let requiredWorkerThreadsModule = false;
+	const problemNodes = [];
+
+	// `require('worker_threads')`
+	context.on('CallExpression', callExpression => {
+		if (
+			isStaticRequire(callExpression)
+			&& isWorkerThreads(callExpression.arguments[0])
+		) {
+			requiredWorkerThreadsModule = true;
+		}
+	});
+
+	// `import workerThreads from 'worker_threads'`
+	context.on('ImportDeclaration', importDeclaration => {
+		if (
+			importDeclaration.source.type === 'Literal'
+			&& isWorkerThreads(importDeclaration.source)
+		) {
+			requiredWorkerThreadsModule = true;
+		}
+	});
+
+	// Check `process.on` / `process.once` call
+	context.on('CallExpression', node => {
+		if (isMethodCall(node, {
+			object: 'process',
+			methods: ['on', 'once'],
+			minimumArguments: 1,
+			optionalCall: false,
+			optionalMember: false,
+		})) {
+			processEventHandler = node;
+		}
+	});
+	context.onExit('CallExpression', node => {
+		if (node === processEventHandler) {
+			processEventHandler = undefined;
+		}
+	});
+
+	// Check `process.exit` call
+	context.on('CallExpression', node => {
+		if (
+			!processEventHandler
+			&& isMethodCall(node, {
+				object: 'process',
+				method: 'exit',
+				optionalCall: false,
+				optionalMember: false,
+			})
+		) {
+			problemNodes.push(node);
+		}
+	});
+
+	context.onExit('Program', function * () {
+		if (requiredWorkerThreadsModule) {
+			return;
+		}
+
+		for (const node of problemNodes) {
+			yield {
+				node,
+				messageId: MESSAGE_ID,
+			};
+		}
+	});
+};
+
+/** @type {import('eslint').Rule.RuleModule} */
+module.exports = {
+	create,
+	meta: {
+		type: 'suggestion',
+		docs: {
+			description: 'Disallow `process.exit()`.',
+		},
+		messages,
+	},
+};

package/rules/no-static-only-class.js

@@ -0,0 +1,224 @@
+'use strict';
+const {isSemicolonToken} = require('@eslint-community/eslint-utils');
+const getClassHeadLocation = require('./utils/get-class-head-location.js');
+const assertToken = require('./utils/assert-token.js');
+const {removeSpacesAfter} = require('./fix/index.js');
+
+const MESSAGE_ID = 'no-static-only-class';
+const messages = {
+	[MESSAGE_ID]: 'Use an object instead of a class with only static members.',
+};
+
+const isEqualToken = ({type, value}) => type === 'Punctuator' && value === '=';
+const isDeclarationOfExportDefaultDeclaration = node =>
+	node.type === 'ClassDeclaration'
+	&& node.parent.type === 'ExportDefaultDeclaration'
+	&& node.parent.declaration === node;
+
+const isPropertyDefinition = node => node.type === 'PropertyDefinition';
+const isMethodDefinition = node => node.type === 'MethodDefinition';
+
+function isStaticMember(node) {
+	const {
+		private: isPrivate,
+		static: isStatic,
+		declare: isDeclare,
+		readonly: isReadonly,
+		accessibility,
+		decorators,
+		key,
+	} = node;
+
+	// Avoid matching unexpected node. For example: https://github.com/tc39/proposal-class-static-block
+	if (!isPropertyDefinition(node) && !isMethodDefinition(node)) {
+		return false;
+	}
+
+	if (!isStatic || isPrivate || key.type === 'PrivateIdentifier') {
+		return false;
+	}
+
+	// TypeScript class
+	if (
+		isDeclare
+		|| isReadonly
+		|| accessibility !== undefined
+		|| (Array.isArray(decorators) && decorators.length > 0)
+	) {
+		return false;
+	}
+
+	return true;
+}
+
+function * switchClassMemberToObjectProperty(node, sourceCode, fixer) {
+	const staticToken = sourceCode.getFirstToken(node);
+	assertToken(staticToken, {
+		expected: {type: 'Keyword', value: 'static'},
+		ruleId: 'no-static-only-class',
+	});
+
+	yield fixer.remove(staticToken);
+	yield removeSpacesAfter(staticToken, sourceCode, fixer);
+
+	const maybeSemicolonToken = isPropertyDefinition(node)
+		? sourceCode.getLastToken(node)
+		: sourceCode.getTokenAfter(node);
+	const hasSemicolonToken = isSemicolonToken(maybeSemicolonToken);
+
+	if (isPropertyDefinition(node)) {
+		const {key, value} = node;
+
+		if (value) {
+			// Computed key may have `]` after `key`
+			const equalToken = sourceCode.getTokenAfter(key, isEqualToken);
+			yield fixer.replaceText(equalToken, ':');
+		} else if (hasSemicolonToken) {
+			yield fixer.insertTextBefore(maybeSemicolonToken, ': undefined');
+		} else {
+			yield fixer.insertTextAfter(node, ': undefined');
+		}
+	}
+
+	yield (
+		hasSemicolonToken
+			? fixer.replaceText(maybeSemicolonToken, ',')
+			: fixer.insertTextAfter(node, ',')
+	);
+}
+
+function switchClassToObject(node, sourceCode) {
+	const {
+		type,
+		id,
+		body,
+		declare: isDeclare,
+		abstract: isAbstract,
+		implements: classImplements,
+		parent,
+	} = node;
+
+	if (
+		isDeclare
+		|| isAbstract
+		|| (Array.isArray(classImplements) && classImplements.length > 0)
+	) {
+		return;
+	}
+
+	if (type === 'ClassExpression' && id) {
+		return;
+	}
+
+	const isExportDefault = isDeclarationOfExportDefaultDeclaration(node);
+
+	if (isExportDefault && id) {
+		return;
+	}
+
+	for (const node of body.body) {
+		if (
+			isPropertyDefinition(node)
+			&& (
+				node.typeAnnotation
+				// This is a stupid way to check if `value` of `PropertyDefinition` uses `this`
+				|| (node.value && sourceCode.getText(node.value).includes('this'))
+			)
+		) {
+			return;
+		}
+	}
+
+	return function * (fixer) {
+		const classToken = sourceCode.getFirstToken(node);
+		/* c8 ignore next */
+		assertToken(classToken, {
+			expected: {type: 'Keyword', value: 'class'},
+			ruleId: 'no-static-only-class',
+		});
+
+		if (isExportDefault || type === 'ClassExpression') {
+			/*
+				There are comments after return, and `{` is not on same line
+
+				```js
+				function a() {
+					return class // comment
+					{
+						static a() {}
+					}
+				}
+				```
+			*/
+			if (
+				type === 'ClassExpression'
+				&& parent.type === 'ReturnStatement'
+				&& body.loc.start.line !== parent.loc.start.line
+				&& sourceCode.text.slice(classToken.range[1], body.range[0]).trim()
+			) {
+				yield fixer.replaceText(classToken, '{');
+
+				const openingBraceToken = sourceCode.getFirstToken(body);
+				yield fixer.remove(openingBraceToken);
+			} else {
+				yield fixer.replaceText(classToken, '');
+
+				/*
+						Avoid breaking case like
+
+						```js
+						return class
+						{};
+						```
+				*/
+				yield removeSpacesAfter(classToken, sourceCode, fixer);
+			}
+
+			// There should not be ASI problem
+		} else {
+			yield fixer.replaceText(classToken, 'const');
+			yield fixer.insertTextBefore(body, '= ');
+			yield fixer.insertTextAfter(body, ';');
+		}
+
+		for (const node of body.body) {
+			yield * switchClassMemberToObjectProperty(node, sourceCode, fixer);
+		}
+	};
+}
+
+function create(context) {
+	context.on(['ClassDeclaration', 'ClassExpression'], node => {
+		if (
+			node.superClass
+			|| (node.decorators && node.decorators.length > 0)
+			|| node.body.type !== 'ClassBody'
+			|| node.body.body.length === 0
+			|| node.body.body.some(node => !isStaticMember(node))
+		) {
+			return;
+		}
+
+		const {sourceCode} = context;
+
+		return {
+			node,
+			loc: getClassHeadLocation(node, sourceCode),
+			messageId: MESSAGE_ID,
+			fix: switchClassToObject(node, sourceCode),
+		};
+	});
+}
+
+/** @type {import('eslint').Rule.RuleModule} */
+module.exports = {
+	create,
+	meta: {
+		type: 'suggestion',
+		docs: {
+			description: 'Disallow classes that only have static members.',
+		},
+		fixable: 'code',
+		messages,
+	},
+};