jsxpression 0.1.2 → 0.1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/analyze/analysis-error.js +1 -5
- package/lib/analyze/analysis-error.js.map +1 -1
- package/lib/analyze/analysis-report.js +1 -5
- package/lib/analyze/analysis-report.js.map +1 -1
- package/lib/analyze/analyze.d.ts +1 -1
- package/lib/analyze/analyze.d.ts.map +1 -1
- package/lib/analyze/analyze.js +6 -9
- package/lib/analyze/analyze.js.map +1 -1
- package/lib/analyze/analyze.test.js +312 -314
- package/lib/analyze/analyze.test.js.map +1 -1
- package/lib/analyze/data/analyze.d.ts +1 -1
- package/lib/analyze/data/analyze.d.ts.map +1 -1
- package/lib/analyze/data/analyze.js +7 -10
- package/lib/analyze/data/analyze.js.map +1 -1
- package/lib/analyze/data/data-access.d.ts +1 -1
- package/lib/analyze/data/data-access.d.ts.map +1 -1
- package/lib/analyze/data/data-access.js +20 -24
- package/lib/analyze/data/data-access.js.map +1 -1
- package/lib/analyze/data/index.d.ts +1 -1
- package/lib/analyze/data/index.d.ts.map +1 -1
- package/lib/analyze/data/index.js +1 -5
- package/lib/analyze/data/index.js.map +1 -1
- package/lib/analyze/data/method-calls.d.ts +1 -1
- package/lib/analyze/data/method-calls.d.ts.map +1 -1
- package/lib/analyze/data/method-calls.js +17 -20
- package/lib/analyze/data/method-calls.js.map +1 -1
- package/lib/analyze/data/utils.d.ts +1 -1
- package/lib/analyze/data/utils.d.ts.map +1 -1
- package/lib/analyze/data/utils.js +22 -29
- package/lib/analyze/data/utils.js.map +1 -1
- package/lib/analyze/index.d.ts +1 -1
- package/lib/analyze/index.d.ts.map +1 -1
- package/lib/analyze/index.js +3 -9
- package/lib/analyze/index.js.map +1 -1
- package/lib/analyze/jsx/analyze.d.ts +1 -1
- package/lib/analyze/jsx/analyze.d.ts.map +1 -1
- package/lib/analyze/jsx/analyze.js +8 -11
- package/lib/analyze/jsx/analyze.js.map +1 -1
- package/lib/analyze/jsx/element-attributes.d.ts +1 -1
- package/lib/analyze/jsx/element-attributes.d.ts.map +1 -1
- package/lib/analyze/jsx/element-attributes.js +21 -24
- package/lib/analyze/jsx/element-attributes.js.map +1 -1
- package/lib/analyze/jsx/element-children.d.ts +1 -1
- package/lib/analyze/jsx/element-children.d.ts.map +1 -1
- package/lib/analyze/jsx/element-children.js +20 -23
- package/lib/analyze/jsx/element-children.js.map +1 -1
- package/lib/analyze/jsx/element-tags.d.ts +1 -1
- package/lib/analyze/jsx/element-tags.d.ts.map +1 -1
- package/lib/analyze/jsx/element-tags.js +12 -15
- package/lib/analyze/jsx/element-tags.js.map +1 -1
- package/lib/analyze/jsx/index.d.ts +1 -1
- package/lib/analyze/jsx/index.d.ts.map +1 -1
- package/lib/analyze/jsx/index.js +1 -5
- package/lib/analyze/jsx/index.js.map +1 -1
- package/lib/analyze/security/analyze.d.ts +1 -1
- package/lib/analyze/security/analyze.d.ts.map +1 -1
- package/lib/analyze/security/analyze.js +10 -13
- package/lib/analyze/security/analyze.js.map +1 -1
- package/lib/analyze/security/call-expressions.d.ts +1 -1
- package/lib/analyze/security/call-expressions.d.ts.map +1 -1
- package/lib/analyze/security/call-expressions.js +8 -11
- package/lib/analyze/security/call-expressions.js.map +1 -1
- package/lib/analyze/security/declarations.d.ts +1 -1
- package/lib/analyze/security/declarations.d.ts.map +1 -1
- package/lib/analyze/security/declarations.js +12 -15
- package/lib/analyze/security/declarations.js.map +1 -1
- package/lib/analyze/security/expressions.d.ts +1 -1
- package/lib/analyze/security/expressions.d.ts.map +1 -1
- package/lib/analyze/security/expressions.js +14 -17
- package/lib/analyze/security/expressions.js.map +1 -1
- package/lib/analyze/security/identifiers.d.ts +1 -1
- package/lib/analyze/security/identifiers.d.ts.map +1 -1
- package/lib/analyze/security/identifiers.js +10 -13
- package/lib/analyze/security/identifiers.js.map +1 -1
- package/lib/analyze/security/index.d.ts +1 -1
- package/lib/analyze/security/index.d.ts.map +1 -1
- package/lib/analyze/security/index.js +1 -5
- package/lib/analyze/security/index.js.map +1 -1
- package/lib/analyze/security/member-access.d.ts +1 -1
- package/lib/analyze/security/member-access.d.ts.map +1 -1
- package/lib/analyze/security/member-access.js +7 -10
- package/lib/analyze/security/member-access.js.map +1 -1
- package/lib/analyze/utils.js +4 -10
- package/lib/analyze/utils.js.map +1 -1
- package/lib/analyze/validation-context.js +1 -5
- package/lib/analyze/validation-context.js.map +1 -1
- package/lib/builtins.js +9 -20
- package/lib/builtins.js.map +1 -1
- package/lib/codegen/builtins/builtin-types.js +3 -6
- package/lib/codegen/builtins/builtin-types.js.map +1 -1
- package/lib/codegen/builtins/index.js +1 -5
- package/lib/codegen/builtins/index.js.map +1 -1
- package/lib/codegen/generate-typescript-definitions.js +4 -7
- package/lib/codegen/generate-typescript-definitions.js.map +1 -1
- package/lib/codegen/generate-typescript-definitions.test.js +190 -192
- package/lib/codegen/generate-typescript-definitions.test.js.map +1 -1
- package/lib/codegen/index.js +1 -5
- package/lib/codegen/index.js.map +1 -1
- package/lib/codegen/schema/component-types.js +3 -6
- package/lib/codegen/schema/component-types.js.map +1 -1
- package/lib/codegen/schema/data-types.js +3 -6
- package/lib/codegen/schema/data-types.js.map +1 -1
- package/lib/codegen/schema/index.js +2 -7
- package/lib/codegen/schema/index.js.map +1 -1
- package/lib/codegen/schema/utils.js +3 -8
- package/lib/codegen/schema/utils.js.map +1 -1
- package/lib/compile/compilation-error.js +1 -5
- package/lib/compile/compilation-error.js.map +1 -1
- package/lib/compile/compile.d.ts +1 -1
- package/lib/compile/compile.d.ts.map +1 -1
- package/lib/compile/compile.js +20 -25
- package/lib/compile/compile.js.map +1 -1
- package/lib/compile/compile.test.js +110 -112
- package/lib/compile/compile.test.js.map +1 -1
- package/lib/compile/index.d.ts +1 -1
- package/lib/compile/index.d.ts.map +1 -1
- package/lib/compile/index.js +2 -7
- package/lib/compile/index.js.map +1 -1
- package/lib/evaluate/evaluate.js +5 -8
- package/lib/evaluate/evaluate.js.map +1 -1
- package/lib/evaluate/evaluate.test.js +56 -58
- package/lib/evaluate/evaluate.test.js.map +1 -1
- package/lib/evaluate/evaluation-error.js +1 -5
- package/lib/evaluate/evaluation-error.js.map +1 -1
- package/lib/evaluate/index.d.ts +1 -1
- package/lib/evaluate/index.d.ts.map +1 -1
- package/lib/evaluate/index.js +2 -7
- package/lib/evaluate/index.js.map +1 -1
- package/lib/index.js +6 -15
- package/lib/index.js.map +1 -1
- package/lib/jsx.d.ts +1 -1
- package/lib/jsx.d.ts.map +1 -1
- package/lib/jsx.js +10 -22
- package/lib/jsx.js.map +1 -1
- package/lib/parse/index.d.ts +1 -1
- package/lib/parse/index.d.ts.map +1 -1
- package/lib/parse/index.js +2 -7
- package/lib/parse/index.js.map +1 -1
- package/lib/parse/parse-error.js +1 -5
- package/lib/parse/parse-error.js.map +1 -1
- package/lib/parse/parse.d.ts +1 -1
- package/lib/parse/parse.d.ts.map +1 -1
- package/lib/parse/parse.js +7 -13
- package/lib/parse/parse.js.map +1 -1
- package/lib/parse/parse.test.js +56 -58
- package/lib/parse/parse.test.js.map +1 -1
- package/lib/render.d.ts +1 -1
- package/lib/render.d.ts.map +1 -1
- package/lib/render.js +9 -12
- package/lib/render.js.map +1 -1
- package/lib/render.test.js +62 -64
- package/lib/render.test.js.map +1 -1
- package/lib/schema.js +18 -38
- package/lib/schema.js.map +1 -1
- package/lib/traverse.d.ts +3 -3
- package/lib/traverse.d.ts.map +1 -1
- package/lib/traverse.js +8 -11
- package/lib/traverse.js.map +1 -1
- package/lib/traverse.test.js +34 -36
- package/lib/traverse.test.js.map +1 -1
- package/lib/types.js +1 -2
- package/lib/validate.js +7 -10
- package/lib/validate.js.map +1 -1
- package/package.json +1 -1
- package/src/compile/compile.ts +3 -4
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"analyze.d.ts","sourceRoot":"","sources":["../../../src/analyze/security/analyze.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"analyze.d.ts","sourceRoot":"","sources":["../../../src/analyze/security/analyze.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAQvD,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAU5E"}
|
|
@@ -1,15 +1,12 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
const
|
|
10
|
-
|
|
11
|
-
function analyzeSecurity(ast, schema) {
|
|
12
|
-
const validationContext = new validation_context_js_1.ValidationContext();
|
|
13
|
-
return new analysis_report_js_1.AnalysisReport().merge((0, declarations_js_1.analyzeDeclarations)(ast, schema, validationContext), (0, identifiers_js_1.analyzeIdentifiers)(ast, schema, validationContext), (0, expressions_js_1.analyzeExpressions)(ast, schema, validationContext), (0, member_access_js_1.analyzeMemberAccess)(ast, schema, validationContext), (0, call_expressions_js_1.analyzeCallExpressions)(ast, schema, validationContext));
|
|
1
|
+
import { AnalysisReport } from "../analysis-report.js";
|
|
2
|
+
import { ValidationContext } from "../validation-context.js";
|
|
3
|
+
import { analyzeCallExpressions } from "./call-expressions.js";
|
|
4
|
+
import { analyzeDeclarations } from "./declarations.js";
|
|
5
|
+
import { analyzeExpressions } from "./expressions.js";
|
|
6
|
+
import { analyzeIdentifiers } from "./identifiers.js";
|
|
7
|
+
import { analyzeMemberAccess } from "./member-access.js";
|
|
8
|
+
export function analyzeSecurity(ast, schema) {
|
|
9
|
+
const validationContext = new ValidationContext();
|
|
10
|
+
return new AnalysisReport().merge(analyzeDeclarations(ast, schema, validationContext), analyzeIdentifiers(ast, schema, validationContext), analyzeExpressions(ast, schema, validationContext), analyzeMemberAccess(ast, schema, validationContext), analyzeCallExpressions(ast, schema, validationContext));
|
|
14
11
|
}
|
|
15
12
|
//# sourceMappingURL=analyze.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"analyze.js","sourceRoot":"","sources":["../../../src/analyze/security/analyze.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"analyze.js","sourceRoot":"","sources":["../../../src/analyze/security/analyze.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,MAAM,UAAU,eAAe,CAAC,GAAY,EAAE,MAAc;IAC1D,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAElD,OAAO,IAAI,cAAc,EAAE,CAAC,KAAK,CAC/B,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,iBAAiB,CAAC,EACnD,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAClD,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAClD,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,iBAAiB,CAAC,EACnD,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,iBAAiB,CAAC,CACvD,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"call-expressions.d.ts","sourceRoot":"","sources":["../../../src/analyze/security/call-expressions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"call-expressions.d.ts","sourceRoot":"","sources":["../../../src/analyze/security/call-expressions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAErC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,OAAO,EACZ,OAAO,EAAE,MAAM,EACf,iBAAiB,EAAE,iBAAiB,GACnC,cAAc,CA6BhB"}
|
|
@@ -1,20 +1,17 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
const
|
|
6
|
-
|
|
7
|
-
function analyzeCallExpressions(ast, _schema, validationContext) {
|
|
8
|
-
const analysisReport = new analysis_report_js_1.AnalysisReport();
|
|
9
|
-
(0, traverse_js_1.traverse)(ast, {
|
|
1
|
+
import { traverse } from "../../traverse.js";
|
|
2
|
+
import { AnalysisReport } from "../analysis-report.js";
|
|
3
|
+
import { getNodeRange } from "../utils.js";
|
|
4
|
+
export function analyzeCallExpressions(ast, _schema, validationContext) {
|
|
5
|
+
const analysisReport = new AnalysisReport();
|
|
6
|
+
traverse(ast, {
|
|
10
7
|
CallExpression(node) {
|
|
11
8
|
const { callee } = node;
|
|
12
9
|
if (callee.type !== "MemberExpression") {
|
|
13
|
-
analysisReport.addIssue("DIRECT_CALL_NOT_ALLOWED", "only member calls allowed",
|
|
10
|
+
analysisReport.addIssue("DIRECT_CALL_NOT_ALLOWED", "only member calls allowed", getNodeRange(node), validationContext.getSnapshot());
|
|
14
11
|
return;
|
|
15
12
|
}
|
|
16
13
|
if (callee.property.type !== "Identifier" || callee.computed) {
|
|
17
|
-
analysisReport.addIssue("DYNAMIC_METHOD_NOT_ALLOWED", "only explicitly allowed methods are permitted",
|
|
14
|
+
analysisReport.addIssue("DYNAMIC_METHOD_NOT_ALLOWED", "only explicitly allowed methods are permitted", getNodeRange(callee), validationContext.getSnapshot());
|
|
18
15
|
}
|
|
19
16
|
},
|
|
20
17
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"call-expressions.js","sourceRoot":"","sources":["../../../src/analyze/security/call-expressions.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"call-expressions.js","sourceRoot":"","sources":["../../../src/analyze/security/call-expressions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAG7C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,UAAU,sBAAsB,CACpC,GAAY,EACZ,OAAe,EACf,iBAAoC;IAEpC,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAE5C,QAAQ,CAAC,GAAG,EAAE;QACZ,cAAc,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;YAExB,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACvC,cAAc,CAAC,QAAQ,CACrB,yBAAyB,EACzB,2BAA2B,EAC3B,YAAY,CAAC,IAAI,CAAC,EAClB,iBAAiB,CAAC,WAAW,EAAE,CAChC,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC7D,cAAc,CAAC,QAAQ,CACrB,4BAA4B,EAC5B,+CAA+C,EAC/C,YAAY,CAAC,MAAM,CAAC,EACpB,iBAAiB,CAAC,WAAW,EAAE,CAChC,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,OAAO,cAAc,CAAC;AACxB,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"declarations.d.ts","sourceRoot":"","sources":["../../../src/analyze/security/declarations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"declarations.d.ts","sourceRoot":"","sources":["../../../src/analyze/security/declarations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAErC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,OAAO,EACZ,OAAO,EAAE,MAAM,EACf,iBAAiB,EAAE,iBAAiB,GACnC,cAAc,CAuDhB"}
|
|
@@ -1,29 +1,26 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
const
|
|
6
|
-
|
|
7
|
-
function analyzeDeclarations(ast, _schema, validationContext) {
|
|
8
|
-
const analysisReport = new analysis_report_js_1.AnalysisReport();
|
|
9
|
-
(0, traverse_js_1.traverse)(ast, {
|
|
1
|
+
import { traverse } from "../../traverse.js";
|
|
2
|
+
import { AnalysisReport } from "../analysis-report.js";
|
|
3
|
+
import { getNodeRange } from "../utils.js";
|
|
4
|
+
export function analyzeDeclarations(ast, _schema, validationContext) {
|
|
5
|
+
const analysisReport = new AnalysisReport();
|
|
6
|
+
traverse(ast, {
|
|
10
7
|
ImportDeclaration(node) {
|
|
11
|
-
analysisReport.addIssue("IMPORT_NOT_ALLOWED", "import not allowed",
|
|
8
|
+
analysisReport.addIssue("IMPORT_NOT_ALLOWED", "import not allowed", getNodeRange(node), validationContext.getSnapshot());
|
|
12
9
|
},
|
|
13
10
|
ExportNamedDeclaration(node) {
|
|
14
|
-
analysisReport.addIssue("EXPORT_NOT_ALLOWED", "export not allowed",
|
|
11
|
+
analysisReport.addIssue("EXPORT_NOT_ALLOWED", "export not allowed", getNodeRange(node), validationContext.getSnapshot());
|
|
15
12
|
},
|
|
16
13
|
ExportDefaultDeclaration(node) {
|
|
17
|
-
analysisReport.addIssue("EXPORT_NOT_ALLOWED", "export not allowed",
|
|
14
|
+
analysisReport.addIssue("EXPORT_NOT_ALLOWED", "export not allowed", getNodeRange(node), validationContext.getSnapshot());
|
|
18
15
|
},
|
|
19
16
|
FunctionDeclaration(node) {
|
|
20
|
-
analysisReport.addIssue("FUNCTION_NOT_ALLOWED", "function declarations not allowed",
|
|
17
|
+
analysisReport.addIssue("FUNCTION_NOT_ALLOWED", "function declarations not allowed", getNodeRange(node), validationContext.getSnapshot());
|
|
21
18
|
},
|
|
22
19
|
ClassDeclaration(node) {
|
|
23
|
-
analysisReport.addIssue("CLASS_NOT_ALLOWED", "classes not allowed",
|
|
20
|
+
analysisReport.addIssue("CLASS_NOT_ALLOWED", "classes not allowed", getNodeRange(node), validationContext.getSnapshot());
|
|
24
21
|
},
|
|
25
22
|
VariableDeclaration(node) {
|
|
26
|
-
analysisReport.addIssue("VARIABLE_NOT_ALLOWED", "variables not allowed",
|
|
23
|
+
analysisReport.addIssue("VARIABLE_NOT_ALLOWED", "variables not allowed", getNodeRange(node), validationContext.getSnapshot());
|
|
27
24
|
},
|
|
28
25
|
});
|
|
29
26
|
return analysisReport;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"declarations.js","sourceRoot":"","sources":["../../../src/analyze/security/declarations.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"declarations.js","sourceRoot":"","sources":["../../../src/analyze/security/declarations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAG7C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,UAAU,mBAAmB,CACjC,GAAY,EACZ,OAAe,EACf,iBAAoC;IAEpC,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAE5C,QAAQ,CAAC,GAAG,EAAE;QACZ,iBAAiB,CAAC,IAAI;YACpB,cAAc,CAAC,QAAQ,CACrB,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,CAAC,IAAI,CAAC,EAClB,iBAAiB,CAAC,WAAW,EAAE,CAChC,CAAC;QACJ,CAAC;QACD,sBAAsB,CAAC,IAAI;YACzB,cAAc,CAAC,QAAQ,CACrB,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,CAAC,IAAI,CAAC,EAClB,iBAAiB,CAAC,WAAW,EAAE,CAChC,CAAC;QACJ,CAAC;QACD,wBAAwB,CAAC,IAAI;YAC3B,cAAc,CAAC,QAAQ,CACrB,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,CAAC,IAAI,CAAC,EAClB,iBAAiB,CAAC,WAAW,EAAE,CAChC,CAAC;QACJ,CAAC;QACD,mBAAmB,CAAC,IAAI;YACtB,cAAc,CAAC,QAAQ,CACrB,sBAAsB,EACtB,mCAAmC,EACnC,YAAY,CAAC,IAAI,CAAC,EAClB,iBAAiB,CAAC,WAAW,EAAE,CAChC,CAAC;QACJ,CAAC;QACD,gBAAgB,CAAC,IAAI;YACnB,cAAc,CAAC,QAAQ,CACrB,mBAAmB,EACnB,qBAAqB,EACrB,YAAY,CAAC,IAAI,CAAC,EAClB,iBAAiB,CAAC,WAAW,EAAE,CAChC,CAAC;QACJ,CAAC;QACD,mBAAmB,CAAC,IAAI;YACtB,cAAc,CAAC,QAAQ,CACrB,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,CAAC,IAAI,CAAC,EAClB,iBAAiB,CAAC,WAAW,EAAE,CAChC,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,OAAO,cAAc,CAAC;AACxB,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"expressions.d.ts","sourceRoot":"","sources":["../../../src/analyze/security/expressions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"expressions.d.ts","sourceRoot":"","sources":["../../../src/analyze/security/expressions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAErC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,EACZ,OAAO,EAAE,MAAM,EACf,iBAAiB,EAAE,iBAAiB,GACnC,cAAc,CAwFhB"}
|
|
@@ -1,36 +1,33 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
const
|
|
6
|
-
|
|
7
|
-
function analyzeExpressions(ast, _schema, validationContext) {
|
|
8
|
-
const analysisReport = new analysis_report_js_1.AnalysisReport();
|
|
9
|
-
(0, traverse_js_1.traverse)(ast, {
|
|
1
|
+
import { traverse } from "../../traverse.js";
|
|
2
|
+
import { AnalysisReport } from "../analysis-report.js";
|
|
3
|
+
import { getNodeRange } from "../utils.js";
|
|
4
|
+
export function analyzeExpressions(ast, _schema, validationContext) {
|
|
5
|
+
const analysisReport = new AnalysisReport();
|
|
6
|
+
traverse(ast, {
|
|
10
7
|
NewExpression(node) {
|
|
11
|
-
analysisReport.addIssue("NEW_NOT_ALLOWED", "new not allowed",
|
|
8
|
+
analysisReport.addIssue("NEW_NOT_ALLOWED", "new not allowed", getNodeRange(node), validationContext.getSnapshot());
|
|
12
9
|
},
|
|
13
10
|
ThisExpression(node) {
|
|
14
|
-
analysisReport.addIssue("THIS_NOT_ALLOWED", "this not allowed",
|
|
11
|
+
analysisReport.addIssue("THIS_NOT_ALLOWED", "this not allowed", getNodeRange(node), validationContext.getSnapshot());
|
|
15
12
|
},
|
|
16
13
|
WithStatement(node) {
|
|
17
|
-
analysisReport.addIssue("WITH_NOT_ALLOWED", "with not allowed",
|
|
14
|
+
analysisReport.addIssue("WITH_NOT_ALLOWED", "with not allowed", getNodeRange(node), validationContext.getSnapshot());
|
|
18
15
|
},
|
|
19
16
|
AwaitExpression(node) {
|
|
20
|
-
analysisReport.addIssue("AWAIT_NOT_ALLOWED", "await not allowed",
|
|
17
|
+
analysisReport.addIssue("AWAIT_NOT_ALLOWED", "await not allowed", getNodeRange(node), validationContext.getSnapshot());
|
|
21
18
|
},
|
|
22
19
|
YieldExpression(node) {
|
|
23
|
-
analysisReport.addIssue("YIELD_NOT_ALLOWED", "yield not allowed",
|
|
20
|
+
analysisReport.addIssue("YIELD_NOT_ALLOWED", "yield not allowed", getNodeRange(node), validationContext.getSnapshot());
|
|
24
21
|
},
|
|
25
22
|
ArrowFunctionExpression(node) {
|
|
26
23
|
if (node.body.type === "BlockStatement") {
|
|
27
|
-
analysisReport.addIssue("ARROW_FUNCTION_BLOCK_BODY_NOT_ALLOWED", "arrow functions with block body not allowed",
|
|
24
|
+
analysisReport.addIssue("ARROW_FUNCTION_BLOCK_BODY_NOT_ALLOWED", "arrow functions with block body not allowed", getNodeRange(node), validationContext.getSnapshot());
|
|
28
25
|
}
|
|
29
26
|
},
|
|
30
27
|
ObjectExpression(node) {
|
|
31
28
|
for (const property of node.properties) {
|
|
32
29
|
if (property.type === "Property" && property.computed) {
|
|
33
|
-
analysisReport.addIssue("COMPUTED_PROPERTY_NOT_ALLOWED", "computed object properties not allowed",
|
|
30
|
+
analysisReport.addIssue("COMPUTED_PROPERTY_NOT_ALLOWED", "computed object properties not allowed", getNodeRange(property), validationContext.getSnapshot());
|
|
34
31
|
}
|
|
35
32
|
}
|
|
36
33
|
},
|
|
@@ -40,7 +37,7 @@ function analyzeExpressions(ast, _schema, validationContext) {
|
|
|
40
37
|
if (node.property.type === "Literal" && typeof node.property.value === "number") {
|
|
41
38
|
return; // Allow numeric array indices
|
|
42
39
|
}
|
|
43
|
-
analysisReport.addIssue("COMPUTED_ACCESS_NOT_ALLOWED", "computed member access not allowed",
|
|
40
|
+
analysisReport.addIssue("COMPUTED_ACCESS_NOT_ALLOWED", "computed member access not allowed", getNodeRange(node), validationContext.getSnapshot(), [
|
|
44
41
|
"Use dot notation: obj.prop instead of obj[prop]",
|
|
45
42
|
"For arrays, use numeric indices: array[0] instead of array[variable]",
|
|
46
43
|
]);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"expressions.js","sourceRoot":"","sources":["../../../src/analyze/security/expressions.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"expressions.js","sourceRoot":"","sources":["../../../src/analyze/security/expressions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAG7C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,UAAU,kBAAkB,CAChC,GAAY,EACZ,OAAe,EACf,iBAAoC;IAEpC,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAE5C,QAAQ,CAAC,GAAG,EAAE;QACZ,aAAa,CAAC,IAAI;YAChB,cAAc,CAAC,QAAQ,CACrB,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,CAAC,IAAI,CAAC,EAClB,iBAAiB,CAAC,WAAW,EAAE,CAChC,CAAC;QACJ,CAAC;QACD,cAAc,CAAC,IAAI;YACjB,cAAc,CAAC,QAAQ,CACrB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,CAAC,IAAI,CAAC,EAClB,iBAAiB,CAAC,WAAW,EAAE,CAChC,CAAC;QACJ,CAAC;QACD,aAAa,CAAC,IAAI;YAChB,cAAc,CAAC,QAAQ,CACrB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,CAAC,IAAI,CAAC,EAClB,iBAAiB,CAAC,WAAW,EAAE,CAChC,CAAC;QACJ,CAAC;QACD,eAAe,CAAC,IAAI;YAClB,cAAc,CAAC,QAAQ,CACrB,mBAAmB,EACnB,mBAAmB,EACnB,YAAY,CAAC,IAAI,CAAC,EAClB,iBAAiB,CAAC,WAAW,EAAE,CAChC,CAAC;QACJ,CAAC;QACD,eAAe,CAAC,IAAI;YAClB,cAAc,CAAC,QAAQ,CACrB,mBAAmB,EACnB,mBAAmB,EACnB,YAAY,CAAC,IAAI,CAAC,EAClB,iBAAiB,CAAC,WAAW,EAAE,CAChC,CAAC;QACJ,CAAC;QACD,uBAAuB,CAAC,IAAI;YAC1B,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACxC,cAAc,CAAC,QAAQ,CACrB,uCAAuC,EACvC,6CAA6C,EAC7C,YAAY,CAAC,IAAI,CAAC,EAClB,iBAAiB,CAAC,WAAW,EAAE,CAChC,CAAC;YACJ,CAAC;QACH,CAAC;QACD,gBAAgB,CAAC,IAAI;YACnB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACvC,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;oBACtD,cAAc,CAAC,QAAQ,CACrB,+BAA+B,EAC/B,wCAAwC,EACxC,YAAY,CAAC,QAAQ,CAAC,EACtB,iBAAiB,CAAC,WAAW,EAAE,CAChC,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QACD,gBAAgB,CAAC,IAAI;YACnB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,6DAA6D;gBAC7D,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAChF,OAAO,CAAC,8BAA8B;gBACxC,CAAC;gBAED,cAAc,CAAC,QAAQ,CACrB,6BAA6B,EAC7B,oCAAoC,EACpC,YAAY,CAAC,IAAI,CAAC,EAClB,iBAAiB,CAAC,WAAW,EAAE,EAC/B;oBACE,iDAAiD;oBACjD,sEAAsE;iBACvE,CACF,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,OAAO,cAAc,CAAC;AACxB,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"identifiers.d.ts","sourceRoot":"","sources":["../../../src/analyze/security/identifiers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAgD,OAAO,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"identifiers.d.ts","sourceRoot":"","sources":["../../../src/analyze/security/identifiers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAgD,OAAO,EAAE,MAAM,OAAO,CAAC;AAEnF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,EACZ,OAAO,EAAE,MAAM,EACf,iBAAiB,EAAE,iBAAiB,GACnC,cAAc,CAkChB"}
|
|
@@ -1,17 +1,14 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
const
|
|
7
|
-
const utils_js_1 = require("../utils.js");
|
|
8
|
-
function analyzeIdentifiers(ast, _schema, validationContext) {
|
|
9
|
-
const analysisReport = new analysis_report_js_1.AnalysisReport();
|
|
1
|
+
import { traverse } from "../../traverse.js";
|
|
2
|
+
import { getBuiltinGlobals } from "../../builtins.js";
|
|
3
|
+
import { AnalysisReport } from "../analysis-report.js";
|
|
4
|
+
import { getNodeRange } from "../utils.js";
|
|
5
|
+
export function analyzeIdentifiers(ast, _schema, validationContext) {
|
|
6
|
+
const analysisReport = new AnalysisReport();
|
|
10
7
|
const arrowParamScopes = getArrowParamScopes(ast);
|
|
11
|
-
|
|
8
|
+
traverse(ast, {
|
|
12
9
|
Identifier(node) {
|
|
13
10
|
const { name } = node;
|
|
14
|
-
const allowedRoots = ["props", "data", ...
|
|
11
|
+
const allowedRoots = ["props", "data", ...getBuiltinGlobals()];
|
|
15
12
|
if (allowedRoots.includes(name)) {
|
|
16
13
|
return;
|
|
17
14
|
}
|
|
@@ -22,7 +19,7 @@ function analyzeIdentifiers(ast, _schema, validationContext) {
|
|
|
22
19
|
return;
|
|
23
20
|
}
|
|
24
21
|
}
|
|
25
|
-
analysisReport.addIssue("IDENTIFIER_NOT_ALLOWED", `Identifier "${name}" not allowed`,
|
|
22
|
+
analysisReport.addIssue("IDENTIFIER_NOT_ALLOWED", `Identifier "${name}" not allowed`, getNodeRange(node), validationContext.getSnapshot(), allowedRoots);
|
|
26
23
|
},
|
|
27
24
|
});
|
|
28
25
|
return analysisReport;
|
|
@@ -33,7 +30,7 @@ function analyzeIdentifiers(ast, _schema, validationContext) {
|
|
|
33
30
|
// main validation pass.
|
|
34
31
|
function getArrowParamScopes(ast) {
|
|
35
32
|
const arrowParamScopes = new Map();
|
|
36
|
-
|
|
33
|
+
traverse(ast, {
|
|
37
34
|
ArrowFunctionExpression(node) {
|
|
38
35
|
const { params } = node;
|
|
39
36
|
if (Array.isArray(params)) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"identifiers.js","sourceRoot":"","sources":["../../../src/analyze/security/identifiers.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"identifiers.js","sourceRoot":"","sources":["../../../src/analyze/security/identifiers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,UAAU,kBAAkB,CAChC,GAAY,EACZ,OAAe,EACf,iBAAoC;IAEpC,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC5C,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAElD,QAAQ,CAAC,GAAG,EAAE;QACZ,UAAU,CAAC,IAAgB;YACzB,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;YAEtB,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC,CAAC;YAE/D,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,OAAO;YACT,CAAC;YAED,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAE/C,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACjD,IAAI,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtB,OAAO;gBACT,CAAC;YACH,CAAC;YAED,cAAc,CAAC,QAAQ,CACrB,wBAAwB,EACxB,eAAe,IAAI,eAAe,EAClC,YAAY,CAAC,IAAI,CAAC,EAClB,iBAAiB,CAAC,WAAW,EAAE,EAC/B,YAAY,CACb,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,gFAAgF;AAChF,+EAA+E;AAC/E,kFAAkF;AAClF,wBAAwB;AACxB,SAAS,mBAAmB,CAAC,GAAY;IACvC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAwC,CAAC;IACzE,QAAQ,CAAC,GAAG,EAAE;QACZ,uBAAuB,CAAC,IAAI;YAC1B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;YACxB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;gBACrC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;oBACnB,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBAC5B,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBACzB,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IACH,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,2EAA2E;AAC3E,kFAAkF;AAClF,SAAS,eAAe,CAAC,UAAmB,EAAE,QAAiB;IAC7D,IAAI,KAAK,GAAmC,IAAI,CAAC;IAEjD,SAAS,IAAI,CAAC,IAAa;QACzB,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,yBAAyB,CAAC;QAExD,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,GAAG,IAA+B,CAAC;QAC1C,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,KAAK,GAAI,IAAY,CAAC,GAAG,CAAC,CAAC;YAEjC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;wBACzB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;4BACnD,OAAO,IAAI,CAAC;wBACd,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACvB,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,CAAC;IACf,OAAO,KAAK,CAAC;AACf,CAAC"}
|
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
export { analyzeSecurity } from "./analyze
|
|
1
|
+
export { analyzeSecurity } from "./analyze.js";
|
|
2
2
|
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/analyze/security/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/analyze/security/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC"}
|
|
@@ -1,6 +1,2 @@
|
|
|
1
|
-
|
|
2
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.analyzeSecurity = void 0;
|
|
4
|
-
var index_js_1 = require("./analyze/index.js");
|
|
5
|
-
Object.defineProperty(exports, "analyzeSecurity", { enumerable: true, get: function () { return index_js_1.analyzeSecurity; } });
|
|
1
|
+
export { analyzeSecurity } from "./analyze.js";
|
|
6
2
|
//# sourceMappingURL=index.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/analyze/security/index.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/analyze/security/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"member-access.d.ts","sourceRoot":"","sources":["../../../src/analyze/security/member-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,
|
|
1
|
+
{"version":3,"file":"member-access.d.ts","sourceRoot":"","sources":["../../../src/analyze/security/member-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,OAAO,CAAC;AAExD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,OAAO,EACZ,OAAO,EAAE,MAAM,EACf,iBAAiB,EAAE,iBAAiB,GACnC,cAAc,CAuBhB"}
|
|
@@ -1,12 +1,9 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
const
|
|
6
|
-
|
|
7
|
-
function analyzeMemberAccess(ast, _schema, validationContext) {
|
|
8
|
-
const analysisReport = new analysis_report_js_1.AnalysisReport();
|
|
9
|
-
(0, traverse_js_1.traverse)(ast, {
|
|
1
|
+
import { traverse } from "../../traverse.js";
|
|
2
|
+
import { AnalysisReport } from "../analysis-report.js";
|
|
3
|
+
import { getNodeRange } from "../utils.js";
|
|
4
|
+
export function analyzeMemberAccess(ast, _schema, validationContext) {
|
|
5
|
+
const analysisReport = new AnalysisReport();
|
|
6
|
+
traverse(ast, {
|
|
10
7
|
MemberExpression(node) {
|
|
11
8
|
let depth = 0;
|
|
12
9
|
let currentNode = node;
|
|
@@ -15,7 +12,7 @@ function analyzeMemberAccess(ast, _schema, validationContext) {
|
|
|
15
12
|
currentNode = currentNode.object;
|
|
16
13
|
}
|
|
17
14
|
if (depth > 5) {
|
|
18
|
-
analysisReport.addIssue("MEMBER_CHAIN_TOO_DEEP", "member chain too deep",
|
|
15
|
+
analysisReport.addIssue("MEMBER_CHAIN_TOO_DEEP", "member chain too deep", getNodeRange(node), validationContext.getSnapshot());
|
|
19
16
|
}
|
|
20
17
|
},
|
|
21
18
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"member-access.js","sourceRoot":"","sources":["../../../src/analyze/security/member-access.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"member-access.js","sourceRoot":"","sources":["../../../src/analyze/security/member-access.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAG7C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,UAAU,mBAAmB,CACjC,GAAY,EACZ,OAAe,EACf,iBAAoC;IAEpC,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAE5C,QAAQ,CAAC,GAAG,EAAE;QACZ,gBAAgB,CAAC,IAAI;YACnB,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,IAAI,WAAW,GAAuB,IAAI,CAAC;YAC3C,OAAO,WAAW,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAC/C,KAAK,IAAI,CAAC,CAAC;gBACX,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC;YACnC,CAAC;YACD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,cAAc,CAAC,QAAQ,CACrB,uBAAuB,EACvB,uBAAuB,EACvB,YAAY,CAAC,IAAI,CAAC,EAClB,iBAAiB,CAAC,WAAW,EAAE,CAChC,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,OAAO,cAAc,CAAC;AACxB,CAAC"}
|
package/lib/analyze/utils.js
CHANGED
|
@@ -1,10 +1,4 @@
|
|
|
1
|
-
|
|
2
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.getNodeRange = getNodeRange;
|
|
4
|
-
exports.getElementSimilarityMatchers = getElementSimilarityMatchers;
|
|
5
|
-
exports.getAttributeSimilarityMatchers = getAttributeSimilarityMatchers;
|
|
6
|
-
exports.getBestSimilarityMatcherSuggestion = getBestSimilarityMatcherSuggestion;
|
|
7
|
-
function getNodeRange(node) {
|
|
1
|
+
export function getNodeRange(node) {
|
|
8
2
|
if (node.loc) {
|
|
9
3
|
return {
|
|
10
4
|
start: {
|
|
@@ -28,13 +22,13 @@ function getNodeRange(node) {
|
|
|
28
22
|
},
|
|
29
23
|
};
|
|
30
24
|
}
|
|
31
|
-
function getElementSimilarityMatchers(invalid, available) {
|
|
25
|
+
export function getElementSimilarityMatchers(invalid, available) {
|
|
32
26
|
return getSimilarityMatchers(invalid, available, "element");
|
|
33
27
|
}
|
|
34
|
-
function getAttributeSimilarityMatchers(invalid, available) {
|
|
28
|
+
export function getAttributeSimilarityMatchers(invalid, available) {
|
|
35
29
|
return getSimilarityMatchers(invalid, available, "attribute");
|
|
36
30
|
}
|
|
37
|
-
function getBestSimilarityMatcherSuggestion(invalid, available) {
|
|
31
|
+
export function getBestSimilarityMatcherSuggestion(invalid, available) {
|
|
38
32
|
const similarityMatchers = getElementSimilarityMatchers(invalid, available);
|
|
39
33
|
if (similarityMatchers.length === 0) {
|
|
40
34
|
return null;
|
package/lib/analyze/utils.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/analyze/utils.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/analyze/utils.ts"],"names":[],"mappings":"AAUA,MAAM,UAAU,YAAY,CAAC,IAAS;IACpC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;gBAC7B,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM;aAC9B;YACD,GAAG,EAAE;gBACH,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;gBAC3B,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM;aAC5B;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL,IAAI,EAAE,CAAC;YACP,MAAM,EAAE,CAAC;SACV;QACD,GAAG,EAAE;YACH,IAAI,EAAE,CAAC;YACP,MAAM,EAAE,CAAC;SACV;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,OAAe,EAAE,SAAmB;IAC/E,OAAO,qBAAqB,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,OAAe,EAAE,SAAmB;IACjF,OAAO,qBAAqB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,OAAe,EAAE,SAAmB;IACrF,MAAM,kBAAkB,GAAG,4BAA4B,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAE5E,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAUD,SAAS,qBAAqB,CAAC,OAAe,EAAE,SAAmB,EAAE,IAA2B;IAC9F,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,SAAS;SACb,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACpB,UAAU;QACV,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC;QAC9E,IAAI;KACL,CAAC,CAAC;SACF,MAAM,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC;SAC1G,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;SACvC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACX,GAAG,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QAC3B,GAAG,iBAAiB;QACpB,UAAU,EAAE,CAAC,GAAG,iBAAiB,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,UAAU,CAAC,MAAM,CAAC;KAC3G,CAAC,CAAC,CAAC;AACR,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAS,EAAE,CAAS;IAC/C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,CAAC,CAAC,MAAM,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,CAAC,CAAC,MAAM,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAe,EAAE,CAAC;IAE9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAChG,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC"}
|
|
@@ -1,7 +1,4 @@
|
|
|
1
|
-
|
|
2
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.ValidationContext = void 0;
|
|
4
|
-
class ValidationContext {
|
|
1
|
+
export class ValidationContext {
|
|
5
2
|
#elements = [];
|
|
6
3
|
get currentPath() {
|
|
7
4
|
if (this.#elements.length > 0) {
|
|
@@ -23,5 +20,4 @@ class ValidationContext {
|
|
|
23
20
|
};
|
|
24
21
|
}
|
|
25
22
|
}
|
|
26
|
-
exports.ValidationContext = ValidationContext;
|
|
27
23
|
//# sourceMappingURL=validation-context.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"validation-context.js","sourceRoot":"","sources":["../../src/analyze/validation-context.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"validation-context.js","sourceRoot":"","sources":["../../src/analyze/validation-context.ts"],"names":[],"mappings":"AAMA,MAAM,OAAO,iBAAiB;IAC5B,SAAS,GAAa,EAAE,CAAC;IAEzB,IAAI,WAAW;QACb,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,YAAY,CAAC,OAAe;QAC1B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,WAAW;QACT,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;IACvB,CAAC;IAED,WAAW;QACT,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE;YAChC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;YACzD,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;SAC5C,CAAC;IACJ,CAAC;CACF"}
|
package/lib/builtins.js
CHANGED
|
@@ -1,14 +1,3 @@
|
|
|
1
|
-
"use strict";
|
|
2
|
-
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.getBuiltins = getBuiltins;
|
|
4
|
-
exports.getBuiltinGlobals = getBuiltinGlobals;
|
|
5
|
-
exports.isAllowedOnArray = isAllowedOnArray;
|
|
6
|
-
exports.isAllowedOnString = isAllowedOnString;
|
|
7
|
-
exports.isMethodAllowed = isMethodAllowed;
|
|
8
|
-
exports.getMethodDefinition = getMethodDefinition;
|
|
9
|
-
exports.getAvailableArrayMembers = getAvailableArrayMembers;
|
|
10
|
-
exports.getAvailableStringMembers = getAvailableStringMembers;
|
|
11
|
-
exports.getMethodDisplayName = getMethodDisplayName;
|
|
12
1
|
const MATH = "Math";
|
|
13
2
|
const NUMBER = "Number";
|
|
14
3
|
const NUMBER_PROTOTYPE = "Number.prototype";
|
|
@@ -1007,23 +996,23 @@ const BUILTINS = {
|
|
|
1007
996
|
},
|
|
1008
997
|
},
|
|
1009
998
|
};
|
|
1010
|
-
function getBuiltins() {
|
|
999
|
+
export function getBuiltins() {
|
|
1011
1000
|
return structuredClone(BUILTINS);
|
|
1012
1001
|
}
|
|
1013
|
-
function getBuiltinGlobals() {
|
|
1002
|
+
export function getBuiltinGlobals() {
|
|
1014
1003
|
return Object.keys(BUILTINS).filter((name) => BUILTINS[name].global === true);
|
|
1015
1004
|
}
|
|
1016
|
-
function isAllowedOnArray(prop) {
|
|
1005
|
+
export function isAllowedOnArray(prop) {
|
|
1017
1006
|
const arrayMethods = BUILTINS[ARRAY_PROTOTYPE]?.methods || {};
|
|
1018
1007
|
const arrayProperties = BUILTINS[ARRAY_PROTOTYPE]?.properties || {};
|
|
1019
1008
|
return prop in arrayMethods || prop in arrayProperties;
|
|
1020
1009
|
}
|
|
1021
|
-
function isAllowedOnString(prop) {
|
|
1010
|
+
export function isAllowedOnString(prop) {
|
|
1022
1011
|
const stringMethods = BUILTINS[STRING_PROTOTYPE]?.methods || {};
|
|
1023
1012
|
const stringProperties = BUILTINS[STRING_PROTOTYPE]?.properties || {};
|
|
1024
1013
|
return prop in stringMethods || prop in stringProperties;
|
|
1025
1014
|
}
|
|
1026
|
-
function isMethodAllowed(methodName) {
|
|
1015
|
+
export function isMethodAllowed(methodName) {
|
|
1027
1016
|
for (const schema of Object.values(BUILTINS)) {
|
|
1028
1017
|
if (schema.methods?.[methodName]) {
|
|
1029
1018
|
return true;
|
|
@@ -1031,7 +1020,7 @@ function isMethodAllowed(methodName) {
|
|
|
1031
1020
|
}
|
|
1032
1021
|
return false;
|
|
1033
1022
|
}
|
|
1034
|
-
function getMethodDefinition(methodName) {
|
|
1023
|
+
export function getMethodDefinition(methodName) {
|
|
1035
1024
|
for (const schema of Object.values(BUILTINS)) {
|
|
1036
1025
|
if (schema.methods?.[methodName]) {
|
|
1037
1026
|
return schema.methods[methodName];
|
|
@@ -1039,19 +1028,19 @@ function getMethodDefinition(methodName) {
|
|
|
1039
1028
|
}
|
|
1040
1029
|
return null;
|
|
1041
1030
|
}
|
|
1042
|
-
function getAvailableArrayMembers() {
|
|
1031
|
+
export function getAvailableArrayMembers() {
|
|
1043
1032
|
const arrayNamespace = BUILTINS[ARRAY_PROTOTYPE];
|
|
1044
1033
|
const methods = Object.keys(arrayNamespace?.methods || {});
|
|
1045
1034
|
const properties = Object.keys(arrayNamespace?.properties || {});
|
|
1046
1035
|
return [...methods, ...properties];
|
|
1047
1036
|
}
|
|
1048
|
-
function getAvailableStringMembers() {
|
|
1037
|
+
export function getAvailableStringMembers() {
|
|
1049
1038
|
const stringNamespace = BUILTINS[STRING_PROTOTYPE];
|
|
1050
1039
|
const methods = Object.keys(stringNamespace?.methods || {});
|
|
1051
1040
|
const properties = Object.keys(stringNamespace?.properties || {});
|
|
1052
1041
|
return [...methods, ...properties];
|
|
1053
1042
|
}
|
|
1054
|
-
function getMethodDisplayName(methodName) {
|
|
1043
|
+
export function getMethodDisplayName(methodName) {
|
|
1055
1044
|
for (const [namespace, schema] of Object.entries(BUILTINS)) {
|
|
1056
1045
|
if (schema.methods?.[methodName]) {
|
|
1057
1046
|
if (schema.global) {
|