eslint-plugin-unicorn-ts 0.0.1-security → 50.0.1

package/rules/shared/dom-events.js

@@ -0,0 +1,275 @@
+'use strict';
+
+const getVendorPrefixedName = eventName => [
+	`webkit${eventName}`,
+	`o${eventName.toLowerCase()}`,
+	eventName.toLowerCase(),
+];
+
+// https://github.com/google/closure-library/blob/8782d8ba16ef2dd4a508d2081a6938f054fc60e8/closure/goog/events/eventtype.js#L44
+module.exports = new Set([
+	// Mouse events
+	'click',
+	'rightclick',
+	'dblclick',
+	'auxclick',
+	'mousedown',
+	'mouseup',
+	'mouseover',
+	'mouseout',
+	'mousemove',
+	'mouseenter',
+	'mouseleave',
+
+	// Non-existent event; will never fire. This exists as a mouse counterpart to
+	// POINTERCANCEL.
+	'mousecancel',
+
+	// Selection events.
+	// https://www.w3.org/TR/selection-api/
+	'selectionchange',
+	'selectstart',	// IE, Safari, Chrome
+
+	// Wheel events
+	// http://www.w3.org/TR/DOM-Level-3-Events/#events-wheelevents
+	'wheel',
+
+	// Key events
+	'keypress',
+	'keydown',
+	'keyup',
+
+	// Focus
+	'blur',
+	'focus',
+	'deactivate',	// IE only
+	'focusin',
+	'focusout',
+
+	// Forms
+	'change',
+	'reset',
+	'select',
+	'submit',
+	'input',
+	'propertychange',	// IE only
+
+	// Drag and drop
+	'dragstart',
+	'drag',
+	'dragenter',
+	'dragover',
+	'dragleave',
+	'drop',
+	'dragend',
+
+	// Touch events
+	// Note that other touch events exist, but we should follow the W3C list here.
+	// http://www.w3.org/TR/touch-events/#list-of-touchevent-types
+	'touchstart',
+	'touchmove',
+	'touchend',
+	'touchcancel',
+
+	// Misc
+	'beforeunload',
+	'consolemessage',
+	'contextmenu',
+	'devicechange',
+	'devicemotion',
+	'deviceorientation',
+	'DOMContentLoaded',
+	'error',
+	'help',
+	'load',
+	'losecapture',
+	'orientationchange',
+	'readystatechange',
+	'resize',
+	'scroll',
+	'unload',
+
+	// Media events
+	'canplay',
+	'canplaythrough',
+	'durationchange',
+	'emptied',
+	'ended',
+	'loadeddata',
+	'loadedmetadata',
+	'pause',
+	'play',
+	'playing',
+	'progress',
+	'ratechange',
+	'seeked',
+	'seeking',
+	'stalled',
+	'suspend',
+	'timeupdate',
+	'volumechange',
+	'waiting',
+
+	// Media Source Extensions events
+	// https://www.w3.org/TR/media-source/#mediasource-events
+	'sourceopen',
+	'sourceended',
+	'sourceclosed',
+	// https://www.w3.org/TR/media-source/#sourcebuffer-events
+	'abort',
+	'update',
+	'updatestart',
+	'updateend',
+
+	// HTML 5 History events
+	// See http://www.w3.org/TR/html5/browsers.html#event-definitions-0
+	'hashchange',
+	'pagehide',
+	'pageshow',
+	'popstate',
+
+	// Copy and Paste
+	// Support is limited. Make sure it works on your favorite browser
+	// before using.
+	// http://www.quirksmode.org/dom/events/cutcopypaste.html
+	'copy',
+	'paste',
+	'cut',
+	'beforecopy',
+	'beforecut',
+	'beforepaste',
+
+	// HTML5 online/offline events.
+	// http://www.w3.org/TR/offline-webapps/#related
+	'online',
+	'offline',
+
+	// HTML 5 worker events
+	'message',
+	'connect',
+
+	// Service Worker Events - ServiceWorkerGlobalScope context
+	// See https://w3c.github.io/ServiceWorker/#execution-context-events
+	// message event defined in worker events section
+	'install',
+	'activate',
+	'fetch',
+	'foreignfetch',
+	'messageerror',
+
+	// Service Worker Events - Document context
+	// See https://w3c.github.io/ServiceWorker/#document-context-events
+	'statechange',
+	'updatefound',
+	'controllerchange',
+
+	// CSS animation events.
+	...getVendorPrefixedName('AnimationStart'),
+	...getVendorPrefixedName('AnimationEnd'),
+	...getVendorPrefixedName('AnimationIteration'),
+
+	// CSS transition events. Based on the browser support described at:
+	// https://developer.mozilla.org/en/css/css_transitions#Browser_compatibility
+	...getVendorPrefixedName('TransitionEnd'),
+
+	// W3C Pointer Events
+	// http://www.w3.org/TR/pointerevents/
+	'pointerdown',
+	'pointerup',
+	'pointercancel',
+	'pointermove',
+	'pointerover',
+	'pointerout',
+	'pointerenter',
+	'pointerleave',
+	'gotpointercapture',
+	'lostpointercapture',
+
+	// IE specific events.
+	// See http://msdn.microsoft.com/en-us/library/ie/hh772103(v=vs.85).aspx
+	// these events will be supplanted in IE11.
+	'MSGestureChange',
+	'MSGestureEnd',
+	'MSGestureHold',
+	'MSGestureStart',
+	'MSGestureTap',
+	'MSGotPointerCapture',
+	'MSInertiaStart',
+	'MSLostPointerCapture',
+	'MSPointerCancel',
+	'MSPointerDown',
+	'MSPointerEnter',
+	'MSPointerHover',
+	'MSPointerLeave',
+	'MSPointerMove',
+	'MSPointerOut',
+	'MSPointerOver',
+	'MSPointerUp',
+
+	// Native IMEs/input tools events.
+	'text',
+	// The textInput event is supported in IE9+, but only in lower case. All other
+	// browsers use the camel-case event name.
+	'textinput',
+	'textInput',
+	'compositionstart',
+	'compositionupdate',
+	'compositionend',
+
+	// The beforeinput event is initially only supported in Safari. See
+	// https://bugs.chromium.org/p/chromium/issues/detail?id=342670 for Chrome
+	// implementation tracking.
+	'beforeinput',
+
+	// Webview tag events
+	// See https://developer.chrome.com/apps/tags/webview
+	'exit',
+	'loadabort',
+	'loadcommit',
+	'loadredirect',
+	'loadstart',
+	'loadstop',
+	'responsive',
+	'sizechanged',
+	'unresponsive',
+
+	// HTML5 Page Visibility API.	See details at
+	// `goog.labs.dom.PageVisibilityMonitor`.
+	'visibilitychange',
+
+	// LocalStorage event.
+	'storage',
+
+	// DOM Level 2 mutation events (deprecated).
+	'DOMSubtreeModified',
+	'DOMNodeInserted',
+	'DOMNodeRemoved',
+	'DOMNodeRemovedFromDocument',
+	'DOMNodeInsertedIntoDocument',
+	'DOMAttrModified',
+	'DOMCharacterDataModified',
+
+	// Print events.
+	'beforeprint',
+	'afterprint',
+
+	// Web app manifest events.
+	'beforeinstallprompt',
+	'appinstalled',
+
+	// https://github.com/facebook/react/blob/cae635054e17a6f107a39d328649137b83f25972/packages/react-dom/src/events/DOMEventNames.js#L12
+	'afterblur',
+	'beforeblur',
+	'cancel',
+	'close',
+	'dragexit',
+	'encrypted',
+	'fullscreenchange',
+	'invalid',
+	'toggle',
+
+	// https://github.com/sindresorhus/eslint-plugin-unicorn/pull/147
+	'search',
+	'open',
+	'show',
+]);

package/rules/shared/event-keys.js

@@ -0,0 +1,52 @@
+/* eslint sort-keys: ["error", "asc", {natural: true}] */
+'use strict';
+// https://github.com/facebook/react/blob/b87aabd/packages/react-dom/src/events/getEventKey.js#L36
+// Only meta characters which can't be deciphered from `String.fromCharCode()`
+module.exports = {
+	8: 'Backspace',
+	9: 'Tab',
+	12: 'Clear',
+	13: 'Enter',
+	16: 'Shift',
+	17: 'Control',
+	18: 'Alt',
+	19: 'Pause',
+	20: 'CapsLock',
+	27: 'Escape',
+	32: ' ',
+	33: 'PageUp',
+	34: 'PageDown',
+	35: 'End',
+	36: 'Home',
+	37: 'ArrowLeft',
+	38: 'ArrowUp',
+	39: 'ArrowRight',
+	40: 'ArrowDown',
+	45: 'Insert',
+	46: 'Delete',
+	112: 'F1',
+	113: 'F2',
+	114: 'F3',
+	115: 'F4',
+	116: 'F5',
+	117: 'F6',
+	118: 'F7',
+	119: 'F8',
+	120: 'F9',
+	121: 'F10',
+	122: 'F11',
+	123: 'F12',
+	144: 'NumLock',
+	145: 'ScrollLock',
+	186: ';',
+	187: '=',
+	188: ',',
+	189: '-',
+	190: '.',
+	191: '/',
+	219: '[',
+	220: '\\',
+	221: ']',
+	222: '\'',
+	224: 'Meta',
+};

package/rules/shared/negative-index.js

@@ -0,0 +1,46 @@
+'use strict';
+const isSameReference = require('../utils/is-same-reference.js');
+const {getParenthesizedRange} = require('../utils/parentheses.js');
+const {isNumberLiteral} = require('../ast/index.js');
+
+const isLengthMemberExpression = node =>
+	node.type === 'MemberExpression'
+	&& !node.computed
+	&& !node.optional
+	&& node.property.type === 'Identifier'
+	&& node.property.name === 'length';
+const isLiteralPositiveNumber = node =>
+	isNumberLiteral(node)
+	&& node.value > 0;
+
+function getNegativeIndexLengthNode(node, objectNode) {
+	if (!node) {
+		return;
+	}
+
+	const {type, operator, left, right} = node;
+
+	if (type !== 'BinaryExpression' || operator !== '-' || !isLiteralPositiveNumber(right)) {
+		return;
+	}
+
+	if (isLengthMemberExpression(left) && isSameReference(left.object, objectNode)) {
+		return left;
+	}
+
+	// Nested BinaryExpression
+	return getNegativeIndexLengthNode(left, objectNode);
+}
+
+function removeLengthNode(node, fixer, sourceCode) {
+	const [start, end] = getParenthesizedRange(node, sourceCode);
+	return fixer.removeRange([
+		start,
+		end + sourceCode.text.slice(end).match(/\S|$/).index,
+	]);
+}
+
+module.exports = {
+	getNegativeIndexLengthNode,
+	removeLengthNode,
+};

package/rules/shared/simple-array-search-rule.js

@@ -0,0 +1,128 @@
+'use strict';
+
+const {hasSideEffect, isParenthesized, findVariable} = require('@eslint-community/eslint-utils');
+const {isMethodCall} = require('../ast/index.js');
+const {isSameIdentifier, isFunctionSelfUsedInside} = require('../utils/index.js');
+
+const isSimpleCompare = (node, compareNode) =>
+	node.type === 'BinaryExpression'
+	&& node.operator === '==='
+	&& (
+		isSameIdentifier(node.left, compareNode)
+		|| isSameIdentifier(node.right, compareNode)
+	);
+const isSimpleCompareCallbackFunction = node =>
+	// Matches `foo.findIndex(bar => bar === baz)`
+	(
+		node.type === 'ArrowFunctionExpression'
+		&& !node.async
+		&& node.params.length === 1
+		&& isSimpleCompare(node.body, node.params[0])
+	)
+	// Matches `foo.findIndex(bar => {return bar === baz})`
+	// Matches `foo.findIndex(function (bar) {return bar === baz})`
+	|| (
+		(node.type === 'ArrowFunctionExpression' || node.type === 'FunctionExpression')
+		&& !node.async
+		&& !node.generator
+		&& node.params.length === 1
+		&& node.body.type === 'BlockStatement'
+		&& node.body.body.length === 1
+		&& node.body.body[0].type === 'ReturnStatement'
+		&& isSimpleCompare(node.body.body[0].argument, node.params[0])
+	);
+const isIdentifierNamed = ({type, name}, expectName) => type === 'Identifier' && name === expectName;
+
+function simpleArraySearchRule({method, replacement}) {
+	// Add prefix to avoid conflicts in `prefer-includes` rule
+	const MESSAGE_ID_PREFIX = `prefer-${replacement}-over-${method}/`;
+	const ERROR = `${MESSAGE_ID_PREFIX}error`;
+	const SUGGESTION = `${MESSAGE_ID_PREFIX}suggestion`;
+	const ERROR_MESSAGES = {
+		findIndex: 'Use `.indexOf()` instead of `.findIndex()` when looking for the index of an item.',
+		findLastIndex: 'Use `.lastIndexOf()` instead of `findLastIndex() when looking for the index of an item.`',
+		some: `Use \`.${replacement}()\` instead of \`.${method}()\` when checking value existence.`,
+	};
+
+	const messages = {
+		[ERROR]: ERROR_MESSAGES[method],
+		[SUGGESTION]: `Replace \`.${method}()\` with \`.${replacement}()\`.`,
+	};
+
+	function listen(context) {
+		const {sourceCode} = context;
+		const {scopeManager} = sourceCode;
+
+		context.on('CallExpression', callExpression => {
+			if (
+				!isMethodCall(callExpression, {
+					method,
+					argumentsLength: 1,
+					optionalCall: false,
+					optionalMember: false,
+				})
+				|| !isSimpleCompareCallbackFunction(callExpression.arguments[0])
+			) {
+				return;
+			}
+
+			const [callback] = callExpression.arguments;
+			const binaryExpression = callback.body.type === 'BinaryExpression'
+				? callback.body
+				: callback.body.body[0].argument;
+			const [parameter] = callback.params;
+			const {left, right} = binaryExpression;
+			const {name} = parameter;
+
+			let searchValueNode;
+			let parameterInBinaryExpression;
+			if (isIdentifierNamed(left, name)) {
+				searchValueNode = right;
+				parameterInBinaryExpression = left;
+			} else if (isIdentifierNamed(right, name)) {
+				searchValueNode = left;
+				parameterInBinaryExpression = right;
+			} else {
+				return;
+			}
+
+			const callbackScope = scopeManager.acquire(callback);
+			if (
+				// `parameter` is used somewhere else
+				findVariable(callbackScope, parameter).references.some(({identifier}) => identifier !== parameterInBinaryExpression)
+				|| isFunctionSelfUsedInside(callback, callbackScope)
+			) {
+				return;
+			}
+
+			const methodNode = callExpression.callee.property;
+			const problem = {
+				node: methodNode,
+				messageId: ERROR,
+				suggest: [],
+			};
+
+			const fix = function * (fixer) {
+				let text = sourceCode.getText(searchValueNode);
+				if (isParenthesized(searchValueNode, sourceCode) && !isParenthesized(callback, sourceCode)) {
+					text = `(${text})`;
+				}
+
+				yield fixer.replaceText(methodNode, replacement);
+				yield fixer.replaceText(callback, text);
+			};
+
+			if (hasSideEffect(searchValueNode, sourceCode)) {
+				problem.suggest.push({messageId: SUGGESTION, fix});
+			} else {
+				problem.fix = fix;
+			}
+
+			return problem;
+		});
+	}
+
+	return {messages, listen};
+}
+
+module.exports = simpleArraySearchRule;

package/rules/shared/typed-array.js

@@ -0,0 +1,16 @@
+'use strict';
+
+// https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/TypedArray#description
+module.exports = [
+	'Int8Array',
+	'Uint8Array',
+	'Uint8ClampedArray',
+	'Int16Array',
+	'Uint16Array',
+	'Int32Array',
+	'Uint32Array',
+	'Float32Array',
+	'Float64Array',
+	'BigInt64Array',
+	'BigUint64Array',
+];

package/rules/string-content.js

@@ -0,0 +1,187 @@
+'use strict';
+const escapeString = require('./utils/escape-string.js');
+const escapeTemplateElementRaw = require('./utils/escape-template-element-raw.js');
+const {replaceTemplateElement} = require('./fix/index.js');
+
+const defaultMessage = 'Prefer `{{suggest}}` over `{{match}}`.';
+const SUGGESTION_MESSAGE_ID = 'replace';
+const messages = {
+	[SUGGESTION_MESSAGE_ID]: 'Replace `{{match}}` with `{{suggest}}`.',
+};
+
+const ignoredIdentifier = new Set([
+	'gql',
+	'html',
+	'svg',
+]);
+
+const ignoredMemberExpressionObject = new Set([
+	'styled',
+]);
+
+const isIgnoredTag = node => {
+	if (!node.parent || !node.parent.parent || !node.parent.parent.tag) {
+		return false;
+	}
+
+	const {tag} = node.parent.parent;
+
+	if (tag.type === 'Identifier' && ignoredIdentifier.has(tag.name)) {
+		return true;
+	}
+
+	if (tag.type === 'MemberExpression') {
+		const {object} = tag;
+		if (
+			object.type === 'Identifier'
+			&& ignoredMemberExpressionObject.has(object.name)
+		) {
+			return true;
+		}
+	}
+
+	return false;
+};
+
+function getReplacements(patterns) {
+	return Object.entries(patterns)
+		.map(([match, options]) => {
+			if (typeof options === 'string') {
+				options = {
+					suggest: options,
+				};
+			}
+
+			return {
+				match,
+				regex: new RegExp(match, 'gu'),
+				fix: true,
+				...options,
+			};
+		});
+}
+
+/** @param {import('eslint').Rule.RuleContext} context */
+const create = context => {
+	const {patterns} = {
+		patterns: {},
+		...context.options[0],
+	};
+	const replacements = getReplacements(patterns);
+
+	if (replacements.length === 0) {
+		return;
+	}
+
+	context.on(['Literal', 'TemplateElement'], node => {
+		const {type, value, raw} = node;
+
+		let string;
+		if (type === 'Literal') {
+			string = value;
+		} else if (!isIgnoredTag(node)) {
+			string = value.raw;
+		}
+
+		if (!string || typeof string !== 'string') {
+			return;
+		}
+
+		const replacement = replacements.find(({regex}) => regex.test(string));
+
+		if (!replacement) {
+			return;
+		}
+
+		const {fix: autoFix, message = defaultMessage, match, suggest, regex} = replacement;
+		const problem = {
+			node,
+			message,
+			data: {
+				match,
+				suggest,
+			},
+		};
+
+		const fixed = string.replace(regex, suggest);
+		const fix = type === 'Literal'
+			? fixer => {
+				const [quote] = raw;
+				return fixer.replaceText(
+					node,
+					node.parent.type === 'JSXAttribute' ? quote + fixed + quote : escapeString(fixed, quote),
+				);
+			}
+			: fixer => replaceTemplateElement(
+				fixer,
+				node,
+				escapeTemplateElementRaw(fixed),
+			);
+
+		if (autoFix) {
+			problem.fix = fix;
+		} else {
+			problem.suggest = [
+				{
+					messageId: SUGGESTION_MESSAGE_ID,
+					fix,
+				},
+			];
+		}
+
+		return problem;
+	});
+};
+
+const schema = [
+	{
+		type: 'object',
+		additionalProperties: false,
+		properties: {
+			patterns: {
+				type: 'object',
+				additionalProperties: {
+					anyOf: [
+						{
+							type: 'string',
+						},
+						{
+							type: 'object',
+							required: [
+								'suggest',
+							],
+							properties: {
+								suggest: {
+									type: 'string',
+								},
+								fix: {
+									type: 'boolean',
+									// Default: true
+								},
+								message: {
+									type: 'string',
+									// Default: ''
+								},
+							},
+							additionalProperties: false,
+						},
+					],
+				}},
+		},
+	},
+];
+
+/** @type {import('eslint').Rule.RuleModule} */
+module.exports = {
+	create,
+	meta: {
+		type: 'suggestion',
+		docs: {
+			description: 'Enforce better string content.',
+		},
+		fixable: 'code',
+		hasSuggestions: true,
+		schema,
+		messages,
+	},
+};