eslint-plugin-unicorn-ts 0.0.1-security → 50.0.1

package/rules/relative-url-style.js

@@ -0,0 +1,168 @@
+'use strict';
+const {getStaticValue} = require('@eslint-community/eslint-utils');
+const {isNewExpression, isStringLiteral} = require('./ast/index.js');
+const {replaceStringLiteral} = require('./fix/index.js');
+
+const MESSAGE_ID_NEVER = 'never';
+const MESSAGE_ID_ALWAYS = 'always';
+const MESSAGE_ID_REMOVE = 'remove';
+const messages = {
+	[MESSAGE_ID_NEVER]: 'Remove the `./` prefix from the relative URL.',
+	[MESSAGE_ID_ALWAYS]: 'Add a `./` prefix to the relative URL.',
+	[MESSAGE_ID_REMOVE]: 'Remove leading `./`.',
+};
+
+const DOT_SLASH = './';
+const TEST_URL_BASES = [
+	'https://example.com/a/b/',
+	'https://example.com/a/b.html',
+];
+const isSafeToAddDotSlashToUrl = (url, base) => {
+	try {
+		return new URL(url, base).href === new URL(DOT_SLASH + url, base).href;
+	} catch {}
+
+	return false;
+};
+
+const isSafeToAddDotSlash = (url, bases = TEST_URL_BASES) => bases.every(base => isSafeToAddDotSlashToUrl(url, base));
+const isSafeToRemoveDotSlash = (url, bases = TEST_URL_BASES) => bases.every(base => isSafeToAddDotSlashToUrl(url.slice(DOT_SLASH.length), base));
+
+function canAddDotSlash(node, sourceCode) {
+	const url = node.value;
+	if (url.startsWith(DOT_SLASH) || url.startsWith('.') || url.startsWith('/')) {
+		return false;
+	}
+
+	const baseNode = node.parent.arguments[1];
+	const staticValueResult = getStaticValue(baseNode, sourceCode.getScope(node));
+
+	if (
+		typeof staticValueResult?.value === 'string'
+		&& isSafeToAddDotSlash(url, [staticValueResult.value])
+	) {
+		return true;
+	}
+
+	return isSafeToAddDotSlash(url);
+}
+
+function canRemoveDotSlash(node, sourceCode) {
+	const rawValue = node.raw.slice(1, -1);
+	if (!rawValue.startsWith(DOT_SLASH)) {
+		return false;
+	}
+
+	const baseNode = node.parent.arguments[1];
+	const staticValueResult = getStaticValue(baseNode, sourceCode.getScope(node));
+
+	if (
+		typeof staticValueResult?.value === 'string'
+		&& isSafeToRemoveDotSlash(node.value, [staticValueResult.value])
+	) {
+		return true;
+	}
+
+	return isSafeToRemoveDotSlash(node.value);
+}
+
+function addDotSlash(node, sourceCode) {
+	if (!canAddDotSlash(node, sourceCode)) {
+		return;
+	}
+
+	return fixer => replaceStringLiteral(fixer, node, DOT_SLASH, 0, 0);
+}
+
+function removeDotSlash(node, sourceCode) {
+	if (!canRemoveDotSlash(node, sourceCode)) {
+		return;
+	}
+
+	return fixer => replaceStringLiteral(fixer, node, '', 0, 2);
+}
+
+/** @param {import('eslint').Rule.RuleContext} context */
+const create = context => {
+	const style = context.options[0] || 'never';
+
+	const listeners = {};
+
+	// TemplateLiteral are not always safe to remove `./`, but if it's starts with `./` we'll report
+	if (style === 'never') {
+		listeners.TemplateLiteral = function (node) {
+			if (!(
+				isNewExpression(node.parent, {name: 'URL', argumentsLength: 2})
+				&& node.parent.arguments[0] === node
+			)) {
+				return;
+			}
+
+			const firstPart = node.quasis[0];
+			if (!firstPart.value.raw.startsWith(DOT_SLASH)) {
+				return;
+			}
+
+			return {
+				node,
+				messageId: style,
+				suggest: [
+					{
+						messageId: MESSAGE_ID_REMOVE,
+						fix(fixer) {
+							const start = firstPart.range[0] + 1;
+							return fixer.removeRange([start, start + 2]);
+						},
+					},
+				],
+			};
+		};
+	}
+
+	listeners.Literal = function (node) {
+		if (!(
+			isStringLiteral(node)
+			&& isNewExpression(node.parent, {name: 'URL', argumentsLength: 2})
+			&& node.parent.arguments[0] === node
+		)) {
+			return;
+		}
+
+		const {sourceCode} = context;
+		const fix = (style === 'never' ? removeDotSlash : addDotSlash)(node, sourceCode);
+
+		if (!fix) {
+			return;
+		}
+
+		return {
+			node,
+			messageId: style,
+			fix,
+		};
+	};
+
+	return listeners;
+};
+
+const schema = [
+	{
+		enum: ['never', 'always'],
+		default: 'never',
+	},
+];
+
+/** @type {import('eslint').Rule.RuleModule} */
+module.exports = {
+	create,
+	meta: {
+		type: 'suggestion',
+		docs: {
+			description: 'Enforce consistent relative URL style.',
+		},
+		fixable: 'code',
+		hasSuggestions: true,
+		schema,
+		messages,
+	},
+};

package/rules/require-array-join-separator.js

@@ -0,0 +1,63 @@
+'use strict';
+const {appendArgument} = require('./fix/index.js');
+const {isMethodCall} = require('./ast/index.js');
+const {isArrayPrototypeProperty} = require('./utils/index.js');
+
+const MESSAGE_ID = 'require-array-join-separator';
+const messages = {
+	[MESSAGE_ID]: 'Missing the separator argument.',
+};
+
+/** @param {import('eslint').Rule.RuleContext} context */
+const create = context => ({
+	CallExpression(node) {
+		if (!(
+			// `foo.join()`
+			isMethodCall(node, {
+				method: 'join',
+				argumentsLength: 0,
+				optionalCall: false,
+			})
+			// `[].join.call(foo)` and `Array.prototype.join.call(foo)`
+			|| (
+				isMethodCall(node, {
+					method: 'call',
+					argumentsLength: 1,
+					optionalCall: false,
+					optionalMember: false,
+				})
+				&& isArrayPrototypeProperty(node.callee.object, {
+					property: 'join',
+				})
+			)
+		)) {
+			return;
+		}
+
+		const {sourceCode} = context;
+		const [penultimateToken, lastToken] = sourceCode.getLastTokens(node, 2);
+		const isPrototypeMethod = node.arguments.length === 1;
+		return {
+			loc: {
+				start: penultimateToken.loc[isPrototypeMethod ? 'end' : 'start'],
+				end: lastToken.loc.end,
+			},
+			messageId: MESSAGE_ID,
+			/** @param {import('eslint').Rule.RuleFixer} fixer */
+			fix: fixer => appendArgument(fixer, node, '\',\'', sourceCode),
+		};
+	},
+});
+
+/** @type {import('eslint').Rule.RuleModule} */
+module.exports = {
+	create,
+	meta: {
+		type: 'suggestion',
+		docs: {
+			description: 'Enforce using the separator argument with `Array#join()`.',
+		},
+		fixable: 'code',
+		messages,
+	},
+};

package/rules/require-number-to-fixed-digits-argument.js

@@ -0,0 +1,54 @@
+'use strict';
+const {appendArgument} = require('./fix/index.js');
+const {isMethodCall} = require('./ast/index.js');
+
+const MESSAGE_ID = 'require-number-to-fixed-digits-argument';
+const messages = {
+	[MESSAGE_ID]: 'Missing the digits argument.',
+};
+
+/** @param {import('eslint').Rule.RuleContext} context */
+const create = context => ({
+	CallExpression(node) {
+		if (
+			!isMethodCall(node, {
+				method: 'toFixed',
+				argumentsLength: 0,
+				optionalCall: false,
+				optionalMember: false,
+			})
+			|| node.callee.object.type === 'NewExpression'
+		) {
+			return;
+		}
+
+		const {sourceCode} = context;
+		const [
+			openingParenthesis,
+			closingParenthesis,
+		] = sourceCode.getLastTokens(node, 2);
+
+		return {
+			loc: {
+				start: openingParenthesis.loc.start,
+				end: closingParenthesis.loc.end,
+			},
+			messageId: MESSAGE_ID,
+			/** @param {import('eslint').Rule.RuleFixer} fixer */
+			fix: fixer => appendArgument(fixer, node, '0', sourceCode),
+		};
+	},
+});
+
+/** @type {import('eslint').Rule.RuleModule} */
+module.exports = {
+	create,
+	meta: {
+		type: 'suggestion',
+		docs: {
+			description: 'Enforce using the digits argument with `Number#toFixed()`.',
+		},
+		fixable: 'code',
+		messages,
+	},
+};

package/rules/require-post-message-target-origin.js

@@ -0,0 +1,71 @@
+'use strict';
+const {isMethodCall} = require('./ast/index.js');
+const {appendArgument} = require('./fix/index.js');
+
+const ERROR = 'error';
+const SUGGESTION = 'suggestion';
+const messages = {
+	[ERROR]: 'Missing the `targetOrigin` argument.',
+	[SUGGESTION]: 'Use `{{code}}`.',
+};
+
+/** @param {import('eslint').Rule.RuleContext} context */
+function create(context) {
+	const {sourceCode} = context;
+	return {
+		CallExpression(node) {
+			if (!isMethodCall(node, {
+				method: 'postMessage',
+				argumentsLength: 1,
+				optionalCall: false,
+				optionalMember: false,
+			})) {
+				return;
+			}
+
+			const [penultimateToken, lastToken] = sourceCode.getLastTokens(node, 2);
+			const replacements = [];
+			const target = node.callee.object;
+			if (target.type === 'Identifier') {
+				const {name} = target;
+
+				replacements.push(`${name}.location.origin`);
+
+				if (name !== 'self' && name !== 'window' && name !== 'globalThis') {
+					replacements.push('self.location.origin');
+				}
+			} else {
+				replacements.push('self.location.origin');
+			}
+
+			replacements.push('\'*\'');
+
+			return {
+				loc: {
+					start: penultimateToken.loc.end,
+					end: lastToken.loc.end,
+				},
+				messageId: ERROR,
+				suggest: replacements.map(code => ({
+					messageId: SUGGESTION,
+					data: {code},
+					/** @param {import('eslint').Rule.RuleFixer} fixer */
+					fix: fixer => appendArgument(fixer, node, code, sourceCode),
+				})),
+			};
+		},
+	};
+}
+
+/** @type {import('eslint').Rule.RuleModule} */
+module.exports = {
+	create,
+	meta: {
+		type: 'problem',
+		docs: {
+			description: 'Enforce using the `targetOrigin` argument with `window.postMessage()`.',
+		},
+		hasSuggestions: true,
+		messages,
+	},
+};

package/rules/shared/abbreviations.js

@@ -0,0 +1,262 @@
+/* eslint sort-keys: ["error", "asc", {"caseSensitive": false}] */
+'use strict';
+module.exports.defaultReplacements = {
+	acc: {
+		accumulator: true,
+	},
+	arg: {
+		argument: true,
+	},
+	args: {
+		arguments: true,
+	},
+	arr: {
+		array: true,
+	},
+	attr: {
+		attribute: true,
+	},
+	attrs: {
+		attributes: true,
+	},
+	btn: {
+		button: true,
+	},
+	cb: {
+		callback: true,
+	},
+	conf: {
+		config: true,
+	},
+	ctx: {
+		context: true,
+	},
+	cur: {
+		current: true,
+	},
+	curr: {
+		current: true,
+	},
+	db: {
+		database: true,
+	},
+	def: {
+		defer: true,
+		deferred: true,
+		define: true,
+		definition: true,
+	},
+	dest: {
+		destination: true,
+	},
+	dev: {
+		development: true,
+	},
+	dir: {
+		direction: true,
+		directory: true,
+	},
+	dirs: {
+		directories: true,
+	},
+	dist: {
+		distribution: true,
+	},
+	doc: {
+		document: true,
+	},
+	docs: {
+		documentation: true,
+		documents: true,
+	},
+	dst: {
+		daylightSavingTime: true,
+		destination: true,
+		distribution: true,
+	},
+	e: {
+		error: true,
+		event: true,
+	},
+	el: {
+		element: true,
+	},
+	elem: {
+		element: true,
+	},
+	elems: {
+		elements: true,
+	},
+	env: {
+		environment: true,
+	},
+	envs: {
+		environments: true,
+	},
+	err: {
+		error: true,
+	},
+	ev: {
+		event: true,
+	},
+	evt: {
+		event: true,
+	},
+	ext: {
+		extension: true,
+	},
+	exts: {
+		extensions: true,
+	},
+	fn: {
+		function: true,
+	},
+	func: {
+		function: true,
+	},
+	i: {
+		index: true,
+	},
+	idx: {
+		index: true,
+	},
+	j: {
+		index: true,
+	},
+	len: {
+		length: true,
+	},
+	lib: {
+		library: true,
+	},
+	mod: {
+		module: true,
+	},
+	msg: {
+		message: true,
+	},
+	num: {
+		number: true,
+	},
+	obj: {
+		object: true,
+	},
+	opts: {
+		options: true,
+	},
+	param: {
+		parameter: true,
+	},
+	params: {
+		parameters: true,
+	},
+	pkg: {
+		package: true,
+	},
+	prev: {
+		previous: true,
+	},
+	prod: {
+		production: true,
+	},
+	prop: {
+		property: true,
+	},
+	props: {
+		properties: true,
+	},
+	ref: {
+		reference: true,
+	},
+	refs: {
+		references: true,
+	},
+	rel: {
+		related: true,
+		relationship: true,
+		relative: true,
+	},
+	req: {
+		request: true,
+	},
+	res: {
+		resource: true,
+		response: true,
+		result: true,
+	},
+	ret: {
+		returnValue: true,
+	},
+	retval: {
+		returnValue: true,
+	},
+	sep: {
+		separator: true,
+	},
+	src: {
+		source: true,
+	},
+	stdDev: {
+		standardDeviation: true,
+	},
+	str: {
+		string: true,
+	},
+	tbl: {
+		table: true,
+	},
+	temp: {
+		temporary: true,
+	},
+	tit: {
+		title: true,
+	},
+	tmp: {
+		temporary: true,
+	},
+	val: {
+		value: true,
+	},
+	var: {
+		variable: true,
+	},
+	vars: {
+		variables: true,
+	},
+	ver: {
+		version: true,
+	},
+};
+
+module.exports.defaultAllowList = {
+	// React.Component Class property
+	// https://reactjs.org/docs/react-component.html#defaultprops
+	defaultProps: true,
+	// `package.json` field
+	// https://docs.npmjs.com/specifying-dependencies-and-devdependencies-in-a-package-json-file
+	devDependencies: true,
+	// Ember class name
+	// https://api.emberjs.com/ember/3.10/classes/Ember.EmberENV/properties
+	EmberENV: true,
+	// React.Component static method
+	// https://reactjs.org/docs/react-component.html#static-getderivedstatefromprops
+	getDerivedStateFromProps: true,
+	// Next.js function
+	// https://nextjs.org/learn/basics/fetching-data-for-pages
+	getInitialProps: true,
+	getServerSideProps: true,
+	getStaticProps: true,
+	// React PropTypes
+	// https://reactjs.org/docs/typechecking-with-proptypes.html
+	propTypes: true,
+	// Jest configuration
+	// https://jestjs.io/docs/en/configuration#setupfilesafterenv-array
+	setupFilesAfterEnv: true,
+};
+
+module.exports.defaultIgnore = [
+	// Internationalization and localization
+	// https://github.com/sindresorhus/eslint-plugin-unicorn/issues/1188
+	'i18n',
+	'l10n',
+];