jsxpression 0.1.0

package/src/analyze/security/call-expressions.ts

@@ -0,0 +1,41 @@
+import type { Program } from "acorn";
+import { traverse } from "../../traverse";
+import type { Schema } from "../../schema";
+import { ValidationContext } from "../validation-context";
+import { AnalysisReport } from "../analysis-report";
+import { getNodeRange } from "../utils";
+
+export function analyzeCallExpressions(
+  ast: Program,
+  _schema: Schema,
+  validationContext: ValidationContext
+): AnalysisReport {
+  const analysisReport = new AnalysisReport();
+
+  traverse(ast, {
+    CallExpression(node) {
+      const { callee } = node;
+
+      if (callee.type !== "MemberExpression") {
+        analysisReport.addIssue(
+          "DIRECT_CALL_NOT_ALLOWED",
+          "only member calls allowed",
+          getNodeRange(node),
+          validationContext.getSnapshot()
+        );
+        return;
+      }
+
+      if (callee.property.type !== "Identifier" || callee.computed) {
+        analysisReport.addIssue(
+          "DYNAMIC_METHOD_NOT_ALLOWED",
+          "only explicitly allowed methods are permitted",
+          getNodeRange(callee),
+          validationContext.getSnapshot()
+        );
+      }
+    },
+  });
+
+  return analysisReport;
+}

package/src/analyze/security/declarations.ts

@@ -0,0 +1,67 @@
+import type { Program } from "acorn";
+import { traverse } from "../../traverse";
+import type { Schema } from "../../schema";
+import { ValidationContext } from "../validation-context";
+import { AnalysisReport } from "../analysis-report";
+import { getNodeRange } from "../utils";
+
+export function analyzeDeclarations(
+  ast: Program,
+  _schema: Schema,
+  validationContext: ValidationContext
+): AnalysisReport {
+  const analysisReport = new AnalysisReport();
+
+  traverse(ast, {
+    ImportDeclaration(node) {
+      analysisReport.addIssue(
+        "IMPORT_NOT_ALLOWED",
+        "import not allowed",
+        getNodeRange(node),
+        validationContext.getSnapshot()
+      );
+    },
+    ExportNamedDeclaration(node) {
+      analysisReport.addIssue(
+        "EXPORT_NOT_ALLOWED",
+        "export not allowed",
+        getNodeRange(node),
+        validationContext.getSnapshot()
+      );
+    },
+    ExportDefaultDeclaration(node) {
+      analysisReport.addIssue(
+        "EXPORT_NOT_ALLOWED",
+        "export not allowed",
+        getNodeRange(node),
+        validationContext.getSnapshot()
+      );
+    },
+    FunctionDeclaration(node) {
+      analysisReport.addIssue(
+        "FUNCTION_NOT_ALLOWED",
+        "function declarations not allowed",
+        getNodeRange(node),
+        validationContext.getSnapshot()
+      );
+    },
+    ClassDeclaration(node) {
+      analysisReport.addIssue(
+        "CLASS_NOT_ALLOWED",
+        "classes not allowed",
+        getNodeRange(node),
+        validationContext.getSnapshot()
+      );
+    },
+    VariableDeclaration(node) {
+      analysisReport.addIssue(
+        "VARIABLE_NOT_ALLOWED",
+        "variables not allowed",
+        getNodeRange(node),
+        validationContext.getSnapshot()
+      );
+    },
+  });
+
+  return analysisReport;
+}

package/src/analyze/security/expressions.ts

@@ -0,0 +1,100 @@
+import type { Program } from "acorn";
+import { traverse } from "../../traverse";
+import type { Schema } from "../../schema";
+import { ValidationContext } from "../validation-context";
+import { AnalysisReport } from "../analysis-report";
+import { getNodeRange } from "../utils";
+
+export function analyzeExpressions(
+  ast: Program,
+  _schema: Schema,
+  validationContext: ValidationContext
+): AnalysisReport {
+  const analysisReport = new AnalysisReport();
+
+  traverse(ast, {
+    NewExpression(node) {
+      analysisReport.addIssue(
+        "NEW_NOT_ALLOWED",
+        "new not allowed",
+        getNodeRange(node),
+        validationContext.getSnapshot()
+      );
+    },
+    ThisExpression(node) {
+      analysisReport.addIssue(
+        "THIS_NOT_ALLOWED",
+        "this not allowed",
+        getNodeRange(node),
+        validationContext.getSnapshot()
+      );
+    },
+    WithStatement(node) {
+      analysisReport.addIssue(
+        "WITH_NOT_ALLOWED",
+        "with not allowed",
+        getNodeRange(node),
+        validationContext.getSnapshot()
+      );
+    },
+    AwaitExpression(node) {
+      analysisReport.addIssue(
+        "AWAIT_NOT_ALLOWED",
+        "await not allowed",
+        getNodeRange(node),
+        validationContext.getSnapshot()
+      );
+    },
+    YieldExpression(node) {
+      analysisReport.addIssue(
+        "YIELD_NOT_ALLOWED",
+        "yield not allowed",
+        getNodeRange(node),
+        validationContext.getSnapshot()
+      );
+    },
+    ArrowFunctionExpression(node) {
+      if (node.body.type === "BlockStatement") {
+        analysisReport.addIssue(
+          "ARROW_FUNCTION_BLOCK_BODY_NOT_ALLOWED",
+          "arrow functions with block body not allowed",
+          getNodeRange(node),
+          validationContext.getSnapshot()
+        );
+      }
+    },
+    ObjectExpression(node) {
+      for (const property of node.properties) {
+        if (property.type === "Property" && property.computed) {
+          analysisReport.addIssue(
+            "COMPUTED_PROPERTY_NOT_ALLOWED",
+            "computed object properties not allowed",
+            getNodeRange(property),
+            validationContext.getSnapshot()
+          );
+        }
+      }
+    },
+    MemberExpression(node) {
+      if (node.computed) {
+        // We allow numeric literals for array access (data.items[0])
+        if (node.property.type === "Literal" && typeof node.property.value === "number") {
+          return; // Allow numeric array indices
+        }
+
+        analysisReport.addIssue(
+          "COMPUTED_ACCESS_NOT_ALLOWED",
+          "computed member access not allowed",
+          getNodeRange(node),
+          validationContext.getSnapshot(),
+          [
+            "Use dot notation: obj.prop instead of obj[prop]",
+            "For arrays, use numeric indices: array[0] instead of array[variable]",
+          ]
+        );
+      }
+    },
+  });
+
+  return analysisReport;
+}

package/src/analyze/security/identifiers.ts

@@ -0,0 +1,113 @@
+import type { AnyNode, ArrowFunctionExpression, Identifier, Program } from "acorn";
+import { traverse } from "../../traverse";
+import type { Schema } from "../../schema";
+import { getBuiltinGlobals } from "../../builtins";
+import { ValidationContext } from "../validation-context";
+import { AnalysisReport } from "../analysis-report";
+import { getNodeRange } from "../utils";
+
+export function analyzeIdentifiers(
+  ast: Program,
+  _schema: Schema,
+  validationContext: ValidationContext
+): AnalysisReport {
+  const analysisReport = new AnalysisReport();
+  const arrowParamScopes = getArrowParamScopes(ast);
+
+  traverse(ast, {
+    Identifier(node: Identifier) {
+      const { name } = node;
+
+      const allowedRoots = ["props", "data", ...getBuiltinGlobals()];
+
+      if (allowedRoots.includes(name)) {
+        return;
+      }
+
+      const arrowParent = findArrowParent(node, ast);
+
+      if (arrowParent) {
+        const params = arrowParamScopes.get(arrowParent);
+        if (params?.has(name)) {
+          return;
+        }
+      }
+
+      analysisReport.addIssue(
+        "IDENTIFIER_NOT_ALLOWED",
+        `Identifier "${name}" not allowed`,
+        getNodeRange(node),
+        validationContext.getSnapshot(),
+        allowedRoots
+      );
+    },
+  });
+
+  return analysisReport;
+}
+
+// Build a map of arrow functions to their parameter names so we can check if an
+// identifier is a legit arrow function param or something shady. We do this in
+// a separate traversal because it's cleaner than trying to track scope during the
+// main validation pass.
+function getArrowParamScopes(ast: Program): Map<ArrowFunctionExpression, Set<string>> {
+  const arrowParamScopes = new Map<ArrowFunctionExpression, Set<string>>();
+  traverse(ast, {
+    ArrowFunctionExpression(node) {
+      const { params } = node;
+      if (Array.isArray(params)) {
+        const paramNames = new Set<string>();
+        params.forEach((p) => {
+          if (p.type === "Identifier") {
+            paramNames.add(p.name);
+          }
+        });
+        arrowParamScopes.set(node, paramNames);
+      }
+    },
+  });
+  return arrowParamScopes;
+}
+
+// Walk up the AST tree to find the nearest ArrowFunctionExpression parent.
+// This lets us check if an identifier is in scope as an arrow function parameter.
+function findArrowParent(targetNode: AnyNode, rootNode: AnyNode): ArrowFunctionExpression | null {
+  let found: ArrowFunctionExpression | null = null;
+
+  function walk(node: AnyNode): boolean {
+    if (node === targetNode) {
+      return true;
+    }
+
+    const isArrow = node.type === "ArrowFunctionExpression";
+
+    if (isArrow) {
+      found = node as ArrowFunctionExpression;
+    }
+
+    for (const key of Object.keys(node)) {
+      const value = (node as any)[key];
+
+      if (value && typeof value === "object") {
+        if (Array.isArray(value)) {
+          for (const item of value) {
+            if (item && typeof item === "object" && walk(item)) {
+              return true;
+            }
+          }
+        } else if (walk(value)) {
+          return true;
+        }
+      }
+    }
+
+    if (isArrow) {
+      found = null;
+    }
+
+    return false;
+  }
+
+  walk(rootNode);
+  return found;
+}

package/src/analyze/security/index.ts

@@ -0,0 +1 @@
+export { analyzeSecurity } from "./analyze";

package/src/analyze/security/member-access.ts

@@ -0,0 +1,35 @@
+import type { Program, Expression, Super } from "acorn";
+import { traverse } from "../../traverse";
+import type { Schema } from "../../schema";
+import { ValidationContext } from "../validation-context";
+import { AnalysisReport } from "../analysis-report";
+import { getNodeRange } from "../utils";
+
+export function analyzeMemberAccess(
+  ast: Program,
+  _schema: Schema,
+  validationContext: ValidationContext
+): AnalysisReport {
+  const analysisReport = new AnalysisReport();
+
+  traverse(ast, {
+    MemberExpression(node) {
+      let depth = 0;
+      let currentNode: Expression | Super = node;
+      while (currentNode.type === "MemberExpression") {
+        depth += 1;
+        currentNode = currentNode.object;
+      }
+      if (depth > 5) {
+        analysisReport.addIssue(
+          "MEMBER_CHAIN_TOO_DEEP",
+          "member chain too deep",
+          getNodeRange(node),
+          validationContext.getSnapshot()
+        );
+      }
+    },
+  });
+
+  return analysisReport;
+}

package/src/analyze/utils.ts

@@ -0,0 +1,118 @@
+export interface RangePosition {
+  line: number;
+  column: number;
+}
+
+export interface Range {
+  start: RangePosition;
+  end: RangePosition;
+}
+
+export function getNodeRange(node: any): Range {
+  if (node.loc) {
+    return {
+      start: {
+        line: node.loc.start.line - 1,
+        column: node.loc.start.column,
+      },
+      end: {
+        line: node.loc.end.line - 1,
+        column: node.loc.end.column,
+      },
+    };
+  }
+
+  return {
+    start: {
+      line: 0,
+      column: 0,
+    },
+    end: {
+      line: 0,
+      column: 0,
+    },
+  };
+}
+
+export function getElementSimilarityMatchers(invalid: string, available: string[]): SimilarityMatcher[] {
+  return getSimilarityMatchers(invalid, available, "element");
+}
+
+export function getAttributeSimilarityMatchers(invalid: string, available: string[]): SimilarityMatcher[] {
+  return getSimilarityMatchers(invalid, available, "attribute");
+}
+
+export function getBestSimilarityMatcherSuggestion(invalid: string, available: string[]): string | null {
+  const similarityMatchers = getElementSimilarityMatchers(invalid, available);
+
+  if (similarityMatchers.length === 0) {
+    return null;
+  }
+
+  const best = similarityMatchers[0];
+
+  if (best.confidence > 0.6) {
+    return best.suggestion;
+  }
+
+  return null;
+}
+
+type SimilarityMatcherType = "element" | "attribute" | "property" | "method";
+
+interface SimilarityMatcher {
+  suggestion: string;
+  confidence: number;
+  type: SimilarityMatcherType;
+}
+
+function getSimilarityMatchers(invalid: string, available: string[], type: SimilarityMatcherType): SimilarityMatcher[] {
+  if (available.length === 0) {
+    return [];
+  }
+
+  return available
+    .map((suggestion) => ({
+      suggestion,
+      distance: levenshteinDistance(invalid.toLowerCase(), suggestion.toLowerCase()),
+      type,
+    }))
+    .filter((similarityMatcher) => similarityMatcher.distance <= Math.max(2, Math.floor(invalid.length * 0.4)))
+    .sort((a, b) => a.distance - b.distance)
+    .slice(0, 3)
+    .map((similarityMatcher) => ({
+      ...similarityMatcher,
+      confidence: 1 - similarityMatcher.distance / Math.max(invalid.length, similarityMatcher.suggestion.length),
+    }));
+}
+
+function levenshteinDistance(x: string, y: string): number {
+  if (x.length === 0) {
+    return y.length;
+  }
+  if (y.length === 0) {
+    return x.length;
+  }
+
+  const matrix: number[][] = [];
+
+  for (let i = 0; i <= y.length; i++) {
+    matrix[i] = [i];
+  }
+
+  for (let j = 0; j <= x.length; j++) {
+    matrix[0][j] = j;
+  }
+
+  for (let i = 1; i <= y.length; i++) {
+    for (let j = 1; j <= x.length; j++) {
+      if (y.charAt(i - 1) === x.charAt(j - 1)) {
+        matrix[i][j] = matrix[i - 1][j - 1];
+      } else {
+        matrix[i][j] = Math.min(matrix[i - 1][j - 1] + 1, matrix[i][j - 1] + 1, matrix[i - 1][j] + 1);
+      }
+    }
+  }
+
+  return matrix[y.length][x.length];
+}

package/src/analyze/validation-context.ts

@@ -0,0 +1,32 @@
+export interface ValidationContextSnapshot {
+  elements: string[];
+  currentElement?: string;
+  parentElements: string[];
+}
+
+export class ValidationContext {
+  #elements: string[] = [];
+
+  get currentPath(): string {
+    if (this.#elements.length > 0) {
+      return this.#elements.join(" > ");
+    }
+    return "";
+  }
+
+  enterElement(element: string): void {
+    this.#elements.push(element);
+  }
+
+  exitElement(): void {
+    this.#elements.pop();
+  }
+
+  getSnapshot(): ValidationContextSnapshot {
+    return {
+      elements: this.#elements.slice(),
+      currentElement: this.#elements[this.#elements.length - 1],
+      parentElements: this.#elements.slice(0, -1),
+    };
+  }
+}