eslint-plugin-unicorn-ts 0.0.1-security → 50.0.1

package/rules/prefer-string-slice.js

@@ -0,0 +1,182 @@
+'use strict';
+const {getStaticValue} = require('@eslint-community/eslint-utils');
+const {getParenthesizedText, getParenthesizedRange} = require('./utils/parentheses.js');
+const isNumber = require('./utils/is-number.js');
+const {replaceArgument} = require('./fix/index.js');
+const {isNumberLiteral, isMethodCall} = require('./ast/index.js');
+
+const MESSAGE_ID_SUBSTR = 'substr';
+const MESSAGE_ID_SUBSTRING = 'substring';
+const messages = {
+	[MESSAGE_ID_SUBSTR]: 'Prefer `String#slice()` over `String#substr()`.',
+	[MESSAGE_ID_SUBSTRING]: 'Prefer `String#slice()` over `String#substring()`.',
+};
+
+const getNumericValue = node => {
+	if (isNumberLiteral(node)) {
+		return node.value;
+	}
+
+	if (node.type === 'UnaryExpression' && node.operator === '-') {
+		return -getNumericValue(node.argument);
+	}
+};
+
+// This handles cases where the argument is very likely to be a number, such as `.substring('foo'.length)`.
+const isLengthProperty = node => (
+	node?.type === 'MemberExpression'
+	&& node.computed === false
+	&& node.property.type === 'Identifier'
+	&& node.property.name === 'length'
+);
+
+function * fixSubstrArguments({node, fixer, context, abort}) {
+	const argumentNodes = node.arguments;
+	const [firstArgument, secondArgument] = argumentNodes;
+
+	if (!secondArgument) {
+		return;
+	}
+
+	const {sourceCode} = context;
+	const scope = sourceCode.getScope(node);
+	const firstArgumentStaticResult = getStaticValue(firstArgument, scope);
+	const secondArgumentRange = getParenthesizedRange(secondArgument, sourceCode);
+	const replaceSecondArgument = text => replaceArgument(fixer, secondArgument, text, sourceCode);
+
+	if (firstArgumentStaticResult?.value === 0) {
+		if (isNumberLiteral(secondArgument) || isLengthProperty(secondArgument)) {
+			return;
+		}
+
+		if (typeof getNumericValue(secondArgument) === 'number') {
+			yield replaceSecondArgument(Math.max(0, getNumericValue(secondArgument)));
+			return;
+		}
+
+		yield fixer.insertTextBeforeRange(secondArgumentRange, 'Math.max(0, ');
+		yield fixer.insertTextAfterRange(secondArgumentRange, ')');
+		return;
+	}
+
+	if (argumentNodes.every(node => isNumberLiteral(node))) {
+		yield replaceSecondArgument(firstArgument.value + secondArgument.value);
+		return;
+	}
+
+	if (argumentNodes.every(node => isNumber(node, scope))) {
+		const firstArgumentText = getParenthesizedText(firstArgument, sourceCode);
+
+		yield fixer.insertTextBeforeRange(secondArgumentRange, `${firstArgumentText} + `);
+		return;
+	}
+
+	return abort();
+}
+
+function * fixSubstringArguments({node, fixer, context, abort}) {
+	const {sourceCode} = context;
+	const [firstArgument, secondArgument] = node.arguments;
+
+	const firstNumber = firstArgument ? getNumericValue(firstArgument) : undefined;
+	const firstArgumentText = getParenthesizedText(firstArgument, sourceCode);
+	const replaceFirstArgument = text => replaceArgument(fixer, firstArgument, text, sourceCode);
+
+	if (!secondArgument) {
+		if (isLengthProperty(firstArgument)) {
+			return;
+		}
+
+		if (firstNumber !== undefined) {
+			yield replaceFirstArgument(Math.max(0, firstNumber));
+			return;
+		}
+
+		const firstArgumentRange = getParenthesizedRange(firstArgument, sourceCode);
+		yield fixer.insertTextBeforeRange(firstArgumentRange, 'Math.max(0, ');
+		yield fixer.insertTextAfterRange(firstArgumentRange, ')');
+		return;
+	}
+
+	const secondNumber = getNumericValue(secondArgument);
+	const secondArgumentText = getParenthesizedText(secondArgument, sourceCode);
+	const replaceSecondArgument = text => replaceArgument(fixer, secondArgument, text, sourceCode);
+
+	if (firstNumber !== undefined && secondNumber !== undefined) {
+		const argumentsValue = [Math.max(0, firstNumber), Math.max(0, secondNumber)];
+		if (firstNumber > secondNumber) {
+			argumentsValue.reverse();
+		}
+
+		if (argumentsValue[0] !== firstNumber) {
+			yield replaceFirstArgument(argumentsValue[0]);
+		}
+
+		if (argumentsValue[1] !== secondNumber) {
+			yield replaceSecondArgument(argumentsValue[1]);
+		}
+
+		return;
+	}
+
+	if (firstNumber === 0 || secondNumber === 0) {
+		yield replaceFirstArgument(0);
+		yield replaceSecondArgument(`Math.max(0, ${firstNumber === 0 ? secondArgumentText : firstArgumentText})`);
+		return;
+	}
+
+	// As values aren't Literal, we can not know whether secondArgument will become smaller than the first or not, causing an issue:
+	//   .substring(0, 2) and .substring(2, 0) returns the same result
+	//   .slice(0, 2) and .slice(2, 0) doesn't return the same result
+	// There's also an issue with us now knowing whether the value will be negative or not, due to:
+	//   .substring() treats a negative number the same as it treats a zero.
+	// The latter issue could be solved by wrapping all dynamic numbers in Math.max(0, <value>), but the resulting code would not be nice
+
+	return abort();
+}
+
+/** @param {import('eslint').Rule.RuleContext} context */
+const create = context => ({
+	CallExpression(node) {
+		if (!isMethodCall(node, {methods: ['substr', 'substring']})) {
+			return;
+		}
+
+		const method = node.callee.property.name;
+
+		return {
+			node,
+			messageId: method,
+			* fix(fixer, {abort}) {
+				yield fixer.replaceText(node.callee.property, 'slice');
+
+				if (node.arguments.length === 0) {
+					return;
+				}
+
+				if (
+					node.arguments.length > 2
+					|| node.arguments.some(node => node.type === 'SpreadElement')
+				) {
+					return abort();
+				}
+
+				const fixArguments = method === 'substr' ? fixSubstrArguments : fixSubstringArguments;
+				yield * fixArguments({node, fixer, context, abort});
+			},
+		};
+	},
+});
+
+/** @type {import('eslint').Rule.RuleModule} */
+module.exports = {
+	create,
+	meta: {
+		type: 'suggestion',
+		docs: {
+			description: 'Prefer `String#slice()` over `String#substr()` and `String#substring()`.',
+		},
+		fixable: 'code',
+		messages,
+	},
+};

package/rules/prefer-string-starts-ends-with.js

@@ -0,0 +1,199 @@
+'use strict';
+const {isParenthesized, getStaticValue} = require('@eslint-community/eslint-utils');
+const escapeString = require('./utils/escape-string.js');
+const shouldAddParenthesesToMemberExpressionObject = require('./utils/should-add-parentheses-to-member-expression-object.js');
+const shouldAddParenthesesToLogicalExpressionChild = require('./utils/should-add-parentheses-to-logical-expression-child.js');
+const {getParenthesizedText, getParenthesizedRange} = require('./utils/parentheses.js');
+const {isMethodCall, isRegexLiteral} = require('./ast/index.js');
+
+const MESSAGE_STARTS_WITH = 'prefer-starts-with';
+const MESSAGE_ENDS_WITH = 'prefer-ends-with';
+const FIX_TYPE_STRING_CASTING = 'useStringCasting';
+const FIX_TYPE_OPTIONAL_CHAINING = 'useOptionalChaining';
+const FIX_TYPE_NULLISH_COALESCING = 'useNullishCoalescing';
+const messages = {
+	[MESSAGE_STARTS_WITH]: 'Prefer `String#startsWith()` over a regex with `^`.',
+	[MESSAGE_ENDS_WITH]: 'Prefer `String#endsWith()` over a regex with `$`.',
+	[FIX_TYPE_STRING_CASTING]: 'Convert to string `String(…).{{method}}()`.',
+	[FIX_TYPE_OPTIONAL_CHAINING]: 'Use optional chaining `…?.{{method}}()`.',
+	[FIX_TYPE_NULLISH_COALESCING]: 'Use nullish coalescing `(… ?? \'\').{{method}}()`.',
+};
+
+const doesNotContain = (string, characters) => characters.every(character => !string.includes(character));
+const isSimpleString = string => doesNotContain(
+	string,
+	['^', '$', '+', '[', '{', '(', '\\', '.', '?', '*', '|'],
+);
+const addParentheses = text => `(${text})`;
+
+const checkRegex = ({pattern, flags}) => {
+	if (flags.includes('i') || flags.includes('m')) {
+		return;
+	}
+
+	if (pattern.startsWith('^')) {
+		const string = pattern.slice(1);
+
+		if (isSimpleString(string)) {
+			return {
+				messageId: MESSAGE_STARTS_WITH,
+				string,
+			};
+		}
+	}
+
+	if (pattern.endsWith('$')) {
+		const string = pattern.slice(0, -1);
+
+		if (isSimpleString(string)) {
+			return {
+				messageId: MESSAGE_ENDS_WITH,
+				string,
+			};
+		}
+	}
+};
+
+/** @param {import('eslint').Rule.RuleContext} context */
+const create = context => {
+	const {sourceCode} = context;
+
+	return {
+		CallExpression(node) {
+			if (
+				!isMethodCall(node, {
+					method: 'test',
+					argumentsLength: 1,
+					optionalCall: false,
+					optionalMember: false,
+				})
+				|| !isRegexLiteral(node.callee.object)
+			) {
+				return;
+			}
+
+			const regexNode = node.callee.object;
+			const {regex} = regexNode;
+			const result = checkRegex(regex);
+			if (!result) {
+				return;
+			}
+
+			const [target] = node.arguments;
+			const method = result.messageId === MESSAGE_STARTS_WITH ? 'startsWith' : 'endsWith';
+
+			let isString = target.type === 'TemplateLiteral'
+				|| (
+					target.type === 'CallExpression'
+					&& target.callee.type === 'Identifier'
+					&& target.callee.name === 'String'
+				);
+			let isNonString = false;
+			if (!isString) {
+				const staticValue = getStaticValue(target, sourceCode.getScope(target));
+
+				if (staticValue) {
+					isString = typeof staticValue.value === 'string';
+					isNonString = !isString;
+				}
+			}
+
+			const problem = {
+				node,
+				messageId: result.messageId,
+			};
+
+			function * fix(fixer, fixType) {
+				let targetText = getParenthesizedText(target, sourceCode);
+				const isRegexParenthesized = isParenthesized(regexNode, sourceCode);
+				const isTargetParenthesized = isParenthesized(target, sourceCode);
+
+				switch (fixType) {
+					// Goal: `(target ?? '').startsWith(pattern)`
+					case FIX_TYPE_NULLISH_COALESCING: {
+						if (
+							!isTargetParenthesized
+							&& shouldAddParenthesesToLogicalExpressionChild(target, {operator: '??', property: 'left'})
+						) {
+							targetText = addParentheses(targetText);
+						}
+
+						targetText += ' ?? \'\'';
+
+						// `LogicalExpression` need add parentheses to call `.startsWith()`,
+						// but if regex is parenthesized, we can reuse it
+						if (!isRegexParenthesized) {
+							targetText = addParentheses(targetText);
+						}
+
+						break;
+					}
+
+					// Goal: `String(target).startsWith(pattern)`
+					case FIX_TYPE_STRING_CASTING: {
+						// `target` was a call argument, don't need check parentheses
+						targetText = `String(${targetText})`;
+						// `CallExpression` don't need add parentheses to call `.startsWith()`
+						break;
+					}
+
+					// Goal: `target.startsWith(pattern)` or `target?.startsWith(pattern)`
+					case FIX_TYPE_OPTIONAL_CHAINING: {
+						// Optional chaining: `target.startsWith` => `target?.startsWith`
+						yield fixer.replaceText(sourceCode.getTokenBefore(node.callee.property), '?.');
+					}
+
+					// Fallthrough
+					default: {
+						if (
+							!isRegexParenthesized
+							&& !isTargetParenthesized
+							&& shouldAddParenthesesToMemberExpressionObject(target, sourceCode)
+						) {
+							targetText = addParentheses(targetText);
+						}
+					}
+				}
+
+				// The regex literal always starts with `/` or `(`, so we don't need check ASI
+
+				// Replace regex with string
+				yield fixer.replaceText(regexNode, targetText);
+
+				// `.test` => `.startsWith` / `.endsWith`
+				yield fixer.replaceText(node.callee.property, method);
+
+				// Replace argument with result.string
+				yield fixer.replaceTextRange(getParenthesizedRange(target, sourceCode), escapeString(result.string));
+			}
+
+			if (isString || !isNonString) {
+				problem.fix = fix;
+			}
+
+			if (!isString) {
+				problem.suggest = [
+					FIX_TYPE_STRING_CASTING,
+					FIX_TYPE_OPTIONAL_CHAINING,
+					FIX_TYPE_NULLISH_COALESCING,
+				].map(type => ({messageId: type, data: {method}, fix: fixer => fix(fixer, type)}));
+			}
+
+			return problem;
+		},
+	};
+};
+
+/** @type {import('eslint').Rule.RuleModule} */
+module.exports = {
+	create,
+	meta: {
+		type: 'suggestion',
+		docs: {
+			description: 'Prefer `String#startsWith()` & `String#endsWith()` over `RegExp#test()`.',
+		},
+		fixable: 'code',
+		hasSuggestions: true,
+		messages,
+	},
+};

package/rules/prefer-string-trim-start-end.js

@@ -0,0 +1,44 @@
+'use strict';
+const {isMethodCall} = require('./ast/index.js');
+
+const MESSAGE_ID = 'prefer-string-trim-start-end';
+const messages = {
+	[MESSAGE_ID]: 'Prefer `String#{{replacement}}()` over `String#{{method}}()`.',
+};
+
+/** @param {import('eslint').Rule.RuleContext} context */
+const create = () => ({
+	CallExpression(callExpression) {
+		if (!isMethodCall(callExpression, {
+			methods: ['trimLeft', 'trimRight'],
+			argumentsLength: 0,
+			optionalCall: false,
+		})) {
+			return;
+		}
+
+		const node = callExpression.callee.property;
+		const method = node.name;
+		const replacement = method === 'trimLeft' ? 'trimStart' : 'trimEnd';
+
+		return {
+			node,
+			messageId: MESSAGE_ID,
+			data: {method, replacement},
+			fix: fixer => fixer.replaceText(node, replacement),
+		};
+	},
+});
+
+/** @type {import('eslint').Rule.RuleModule} */
+module.exports = {
+	create,
+	meta: {
+		type: 'suggestion',
+		docs: {
+			description: 'Prefer `String#trimStart()` / `String#trimEnd()` over `String#trimLeft()` / `String#trimRight()`.',
+		},
+		fixable: 'code',
+		messages,
+	},
+};