eslint-plugin-unicorn-ts 0.0.1-security → 50.0.1

package/rules/utils/index.js

@@ -0,0 +1,53 @@
+'use strict';
+
+const {
+	isParenthesized,
+	getParenthesizedTimes,
+	getParentheses,
+	getParenthesizedRange,
+	getParenthesizedText,
+} = require('./parentheses.js');
+const {
+	isArrayPrototypeProperty,
+	isObjectPrototypeProperty,
+} = require('./array-or-object-prototype-property.js');
+const {isNodeMatches, isNodeMatchesNameOrPath} = require('./is-node-matches.js');
+const {isBooleanNode, getBooleanAncestor} = require('./boolean.js');
+
+module.exports = {
+	avoidCapture: require('./avoid-capture.js'),
+	escapeString: require('./escape-string.js'),
+	getBooleanAncestor,
+	getParentheses,
+	getParenthesizedRange,
+	getParenthesizedText,
+	getParenthesizedTimes,
+	getReferences: require('./get-references.js'),
+	getScopes: require('./get-scopes.js'),
+	getVariableIdentifiers: require('./get-variable-identifiers.js'),
+	hasOptionalChainElement: require('./has-optional-chain-element.js'),
+	isArrayPrototypeProperty,
+	isBooleanNode,
+	isFunctionSelfUsedInside: require('./is-function-self-used-inside.js'),
+	isLeftHandSide: require('./is-left-hand-side.js'),
+	isLogicalExpression: require('./is-logical-expression.js'),
+	isMethodNamed: require('./is-method-named.js'),
+	isNodeMatches,
+	isNodeMatchesNameOrPath,
+	isNodeValueNotDomNode: require('./is-node-value-not-dom-node.js'),
+	isNodeValueNotFunction: require('./is-node-value-not-function.js'),
+	isObjectPrototypeProperty,
+	isOnSameLine: require('./is-on-same-line.js'),
+	isParenthesized,
+	isSameIdentifier: require('./is-same-identifier.js'),
+	isSameReference: require('./is-same-reference.js'),
+	isShadowed: require('./is-shadowed.js'),
+	isValueNotUsable: require('./is-value-not-usable.js'),
+	needsSemicolon: require('./needs-semicolon.js'),
+	shouldAddParenthesesToMemberExpressionObject: require('./should-add-parentheses-to-member-expression-object.js'),
+	shouldAddParenthesesToSpreadElementArgument: require('./should-add-parentheses-to-spread-element-argument.js'),
+	singular: require('./singular.js'),
+	toLocation: require('./to-location.js'),
+	getAncestor: require('./get-ancestor.js'),
+};
+

package/rules/utils/is-function-self-used-inside.js

@@ -0,0 +1,43 @@
+'use strict';
+const {findVariable} = require('@eslint-community/eslint-utils');
+
+const getReferences = (scope, nodeOrName) => {
+	const {references = []} = findVariable(scope, nodeOrName) || {};
+	return references;
+};
+
+/**
+Check if `this`, `arguments`, or the function name is used inside of itself.
+
+@param {Node} functionNode - The function node.
+@param {Scope} functionScope - The scope of the function node.
+@returns {boolean}
+*/
+function isFunctionSelfUsedInside(functionNode, functionScope) {
+	/* c8 ignore next 3 */
+	if (functionScope.block !== functionNode) {
+		throw new Error('"functionScope" should be the scope of "functionNode".');
+	}
+
+	const {type, id} = functionNode;
+
+	if (type === 'ArrowFunctionExpression') {
+		return false;
+	}
+
+	if (functionScope.thisFound) {
+		return true;
+	}
+
+	if (getReferences(functionScope, 'arguments').some(({from}) => from === functionScope)) {
+		return true;
+	}
+
+	if (id && getReferences(functionScope, id).length > 0) {
+		return true;
+	}
+
+	return false;
+}
+
+module.exports = isFunctionSelfUsedInside;

package/rules/utils/is-left-hand-side.js

@@ -0,0 +1,22 @@
+'use strict';
+
+const isLeftHandSide = node =>
+	(
+		(node.parent.type === 'AssignmentExpression' || node.parent.type === 'AssignmentPattern')
+		&& node.parent.left === node
+	)
+	|| (node.parent.type === 'UpdateExpression' && node.parent.argument === node)
+	|| (node.parent.type === 'ArrayPattern' && node.parent.elements.includes(node))
+	|| (
+		node.parent.type === 'Property'
+		&& node.parent.value === node
+		&& node.parent.parent.type === 'ObjectPattern'
+		&& node.parent.parent.properties.includes(node.parent)
+	)
+	|| (
+		node.parent.type === 'UnaryExpression'
+		&& node.parent.operator === 'delete'
+		&& node.parent.argument === node
+	);
+
+module.exports = isLeftHandSide;

package/rules/utils/is-logical-expression.js

@@ -0,0 +1,16 @@
+'use strict';
+
+/**
+Check if the given node is a true logical expression or not.
+
+The three binary expressions logical-or (`||`), logical-and (`&&`), and coalesce (`??`) are known as `ShortCircuitExpression`, but ESTree represents these by the `LogicalExpression` node type. This function rejects coalesce expressions of `LogicalExpression` node type.
+
+@param {Node} node - The node to check.
+@returns {boolean} `true` if the node is `&&` or `||`.
+@see https://tc39.es/ecma262/#prod-ShortCircuitExpression
+*/
+const isLogicalExpression = node =>
+	node?.type === 'LogicalExpression'
+	&& (node.operator === '&&' || node.operator === '||');
+
+module.exports = isLogicalExpression;

package/rules/utils/is-method-named.js

@@ -0,0 +1,9 @@
+'use strict';
+
+const isMethodNamed = (node, name) =>
+	node.type === 'CallExpression'
+	&& node.callee.type === 'MemberExpression'
+	&& node.callee.property.type === 'Identifier'
+	&& node.callee.property.name === name;
+
+module.exports = isMethodNamed;

package/rules/utils/is-new-expression-with-parentheses.js

@@ -0,0 +1,26 @@
+'use strict';
+
+const {isOpeningParenToken, isClosingParenToken} = require('@eslint-community/eslint-utils');
+
+/**
+Determine if a constructor function is newed-up with parens.
+
+@param {Node} node - The `NewExpression` node to be checked.
+@param {SourceCode} sourceCode - The source code object.
+@returns {boolean} True if the constructor is called with parens.
+
+Copied from https://github.com/eslint/eslint/blob/cc4871369645c3409dc56ded7a555af8a9f63d51/lib/rules/no-extra-parens.js#L252
+*/
+function isNewExpressionWithParentheses(node, sourceCode) {
+	if (node.arguments.length > 0) {
+		return true;
+	}
+
+	const [penultimateToken, lastToken] = sourceCode.getLastTokens(node, 2);
+	// The expression should end with its own parens, for example, `new new Foo()` is not a new expression with parens.
+	return isOpeningParenToken(penultimateToken)
+		&& isClosingParenToken(lastToken)
+		&& node.callee.range[1] < node.range[1];
+}
+
+module.exports = isNewExpressionWithParentheses;

package/rules/utils/is-node-matches.js

@@ -0,0 +1,53 @@
+'use strict';
+
+/**
+Check if node matches object name or key path.
+
+@param {Node} node - The AST node to check.
+@param {string} nameOrPath - The object name or key path.
+@returns {boolean}
+*/
+function isNodeMatchesNameOrPath(node, nameOrPath) {
+	const names = nameOrPath.trim().split('.');
+	for (let index = names.length - 1; index >= 0; index--) {
+		const name = names[index];
+		if (!name) {
+			return false;
+		}
+
+		if (index === 0) {
+			return (
+				(node.type === 'Identifier' && node.name === name)
+				|| (name === 'this' && node.type === 'ThisExpression')
+			);
+		}
+
+		if (
+			node.type !== 'MemberExpression'
+			|| node.optional
+			|| node.computed
+			|| node.property.type !== 'Identifier'
+			|| node.property.name !== name
+		) {
+			return false;
+		}
+
+		node = node.object;
+	}
+}
+
+/**
+Check if node matches any object name or key path.
+
+@param {Node} node - The AST node to check.
+@param {string[]} nameOrPaths - The object name or key paths.
+@returns {boolean}
+*/
+function isNodeMatches(node, nameOrPaths) {
+	return nameOrPaths.some(nameOrPath => isNodeMatchesNameOrPath(node, nameOrPath));
+}
+
+module.exports = {
+	isNodeMatchesNameOrPath,
+	isNodeMatches,
+};

package/rules/utils/is-node-value-not-dom-node.js

@@ -0,0 +1,21 @@
+'use strict';
+const {isUndefined} = require('../ast/index.js');
+
+// AST Types:
+// https://github.com/eslint/espree/blob/master/lib/ast-node-types.js#L18
+// Only types possible to be `callee` or `argument` are listed
+const impossibleNodeTypes = new Set([
+	'ArrayExpression',
+	'ArrowFunctionExpression',
+	'ClassExpression',
+	'FunctionExpression',
+	'Literal',
+	'ObjectExpression',
+	'TemplateLiteral',
+]);
+
+const isNodeValueNotDomNode = node =>
+	impossibleNodeTypes.has(node.type)
+	|| isUndefined(node);
+
+module.exports = isNodeValueNotDomNode;

package/rules/utils/is-node-value-not-function.js

@@ -0,0 +1,42 @@
+'use strict';
+const {isUndefined, isCallExpression, isMethodCall} = require('../ast/index.js');
+
+// AST Types:
+// https://github.com/eslint/espree/blob/master/lib/ast-node-types.js#L18
+// Only types possible to be `argument` are listed
+const impossibleNodeTypes = new Set([
+	'ArrayExpression',
+	'BinaryExpression',
+	'ClassExpression',
+	'Literal',
+	'ObjectExpression',
+	'TemplateLiteral',
+	'UnaryExpression',
+	'UpdateExpression',
+]);
+
+// Technically these nodes could be a function, but most likely not
+const mostLikelyNotNodeTypes = new Set([
+	'AssignmentExpression',
+	'AwaitExpression',
+	'LogicalExpression',
+	'NewExpression',
+	'TaggedTemplateExpression',
+	'ThisExpression',
+]);
+
+const isNodeValueNotFunction = node => (
+	impossibleNodeTypes.has(node.type)
+	|| mostLikelyNotNodeTypes.has(node.type)
+	|| isUndefined(node)
+	|| (
+		isCallExpression(node)
+		&& !(isMethodCall(node, {
+			method: 'bind',
+			optionalCall: false,
+			optionalMember: false,
+		}))
+	)
+);
+
+module.exports = isNodeValueNotFunction;

package/rules/utils/is-number.js

@@ -0,0 +1,224 @@
+'use strict';
+const {getStaticValue} = require('@eslint-community/eslint-utils');
+const {isNumberLiteral} = require('../ast/index.js');
+
+const isStaticProperties = (node, object, properties) =>
+	node.type === 'MemberExpression'
+	&& !node.computed
+	&& !node.optional
+	&& node.object.type === 'Identifier'
+	&& node.object.name === object
+	&& node.property.type === 'Identifier'
+	&& properties.has(node.property.name);
+const isFunctionCall = (node, functionName) => node.type === 'CallExpression'
+	&& !node.optional
+	&& node.callee.type === 'Identifier'
+	&& node.callee.name === functionName;
+
+// https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Math#static_properties
+const mathProperties = new Set([
+	'E',
+	'LN2',
+	'LN10',
+	'LOG2E',
+	'LOG10E',
+	'PI',
+	'SQRT1_2',
+	'SQRT2',
+]);
+
+// `Math.{E,LN2,LN10,LOG2E,LOG10E,PI,SQRT1_2,SQRT2}`
+const isMathProperty = node => isStaticProperties(node, 'Math', mathProperties);
+
+// https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Math#static_methods
+const mathMethods = new Set([
+	'abs',
+	'acos',
+	'acosh',
+	'asin',
+	'asinh',
+	'atan',
+	'atanh',
+	'atan2',
+	'cbrt',
+	'ceil',
+	'clz32',
+	'cos',
+	'cosh',
+	'exp',
+	'expm1',
+	'floor',
+	'fround',
+	'hypot',
+	'imul',
+	'log',
+	'log1p',
+	'log10',
+	'log2',
+	'max',
+	'min',
+	'pow',
+	'random',
+	'round',
+	'sign',
+	'sin',
+	'sinh',
+	'sqrt',
+	'tan',
+	'tanh',
+	'trunc',
+]);
+// `Math.{abs, …, trunc}(…)`
+const isMathMethodCall = node =>
+	node.type === 'CallExpression'
+	&& !node.optional
+	&& isStaticProperties(node.callee, 'Math', mathMethods);
+
+// `Number(…)`
+const isNumberCall = node => isFunctionCall(node, 'Number');
+
+// https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Number#static_properties
+const numberProperties = new Set([
+	'EPSILON',
+	'MAX_SAFE_INTEGER',
+	'MAX_VALUE',
+	'MIN_SAFE_INTEGER',
+	'MIN_VALUE',
+	'NaN',
+	'NEGATIVE_INFINITY',
+	'POSITIVE_INFINITY',
+]);
+const isNumberProperty = node => isStaticProperties(node, 'Number', numberProperties);
+
+// https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Number#static_methods
+const numberMethods = new Set([
+	'parseFloat',
+	'parseInt',
+]);
+const isNumberMethodCall = node =>
+	node.type === 'CallExpression'
+	&& !node.optional
+	&& isStaticProperties(node.callee, 'Number', numberMethods);
+const isGlobalParseToNumberFunctionCall = node => isFunctionCall(node, 'parseInt') || isFunctionCall(node, 'parseFloat');
+
+const isStaticNumber = (node, scope) =>
+	typeof getStaticValue(node, scope)?.value === 'number';
+
+const isLengthProperty = node =>
+	node.type === 'MemberExpression'
+	&& !node.computed
+	&& !node.optional
+	&& node.property.type === 'Identifier'
+	&& node.property.name === 'length';
+
+// `+` and `>>>` operators are handled separately
+const mathOperators = new Set(['-', '*', '/', '%', '**', '<<', '>>', '|', '^', '&']);
+function isNumber(node, scope) {
+	if (
+		isNumberLiteral(node)
+		|| isMathProperty(node)
+		|| isMathMethodCall(node)
+		|| isNumberCall(node)
+		|| isNumberProperty(node)
+		|| isNumberMethodCall(node)
+		|| isGlobalParseToNumberFunctionCall(node)
+		|| isLengthProperty(node)
+	) {
+		return true;
+	}
+
+	switch (node.type) {
+		case 'AssignmentExpression': {
+			const {operator} = node;
+			if (operator === '=' && isNumber(node.right, scope)) {
+				return true;
+			}
+
+			// Fall through
+		}
+
+		case 'BinaryExpression': {
+			let {operator} = node;
+
+			if (node.type === 'AssignmentExpression') {
+				operator = operator.slice(0, -1);
+			}
+
+			if (operator === '+' && isNumber(node.left, scope) && isNumber(node.right, scope)) {
+				return true;
+			}
+
+			// `>>>` (zero-fill right shift) can't use on `BigInt`
+			// https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/BigInt#operators
+			if (operator === '>>>') {
+				return true;
+			}
+
+			// `a * b` can be `BigInt`, we need make sure at least one side is number
+			if (mathOperators.has(operator) && (isNumber(node.left, scope) || isNumber(node.right, scope))) {
+				return true;
+			}
+
+			break;
+		}
+
+		case 'UnaryExpression': {
+			const {operator} = node;
+
+			// `+` can't use on `BigInt`
+			// https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/BigInt#operators
+			if (operator === '+') {
+				return true;
+			}
+
+			if ((operator === '-' || operator === '~') && isNumber(node.argument, scope)) {
+				return true;
+			}
+
+			break;
+		}
+
+		case 'UpdateExpression': {
+			if (isNumber(node.argument, scope)) {
+				return true;
+			}
+
+			break;
+		}
+
+		case 'ConditionalExpression': {
+			const isConsequentNumber = isNumber(node.consequent, scope);
+			const isAlternateNumber = isNumber(node.alternate, scope);
+
+			if (isConsequentNumber && isAlternateNumber) {
+				return true;
+			}
+
+			const testStaticValueResult = getStaticValue(node.test, scope);
+			if (
+				testStaticValueResult !== null
+				&& (
+					(testStaticValueResult.value && isConsequentNumber)
+					|| (!testStaticValueResult.value && isAlternateNumber)
+				)
+			) {
+				return true;
+			}
+
+			break;
+		}
+
+		case 'SequenceExpression': {
+			if (isNumber(node.expressions.at(-1), scope)) {
+				return true;
+			}
+
+			break;
+		}
+		// No default
+	}
+
+	return isStaticNumber(node, scope);
+}
+
+module.exports = isNumber;

package/rules/utils/is-object-method.js

@@ -0,0 +1,11 @@
+'use strict';
+module.exports = (node, object, method) => {
+	const {callee} = node;
+	return (
+		callee.type === 'MemberExpression'
+		&& callee.object.type === 'Identifier'
+		&& callee.object.name === object
+		&& callee.property.type === 'Identifier'
+		&& callee.property.name === method
+	);
+};

package/rules/utils/is-on-same-line.js

@@ -0,0 +1,7 @@
+'use strict';
+
+function isOnSameLine(nodeOrTokenA, nodeOrTokenB) {
+	return nodeOrTokenA.loc.start.line === nodeOrTokenB.loc.start.line;
+}
+
+module.exports = isOnSameLine;

package/rules/utils/is-same-identifier.js

@@ -0,0 +1,8 @@
+'use strict';
+
+const isSameIdentifier = (nodeA, nodeB) =>
+	nodeA.type === 'Identifier'
+	&& nodeB.type === 'Identifier'
+	&& nodeA.name === nodeB.name;
+
+module.exports = isSameIdentifier;