jsxpression 0.1.27 → 0.1.29

package/src/analyze/data/data-access.ts

@@ -3,12 +3,13 @@ import { traverse } from "../../traverse.js";
 import type { ArrayPropertySchema, PropertySchema, Schema } from "../../schema.js";
 import { ValidationContext } from "../validation-context.js";
 import { AnalysisReport } from "../analysis-report.js";
-import { isSimpleDataAccess, extractPath, getParentNode, validateSchemaPath } from "./utils.js";
+import { isSimpleDataAccess, extractPath, validateSchemaPath } from "./utils.js";
 import { getNodeRange } from "../utils.js";
 
 export function analyzeDataAccess(ast: Program, schema: Schema, validationContext: ValidationContext): AnalysisReport {
   const analysisReport = new AnalysisReport();
 
+  const dataKeys = new Set(Object.keys(schema.data ?? {}));
   const dataPaths = new Set<string>();
   const arrowFunctionContexts = new Map<any, Map<string, any>>();
 
@@ -71,9 +72,9 @@ export function analyzeDataAccess(ast: Program, schema: Schema, validationContex
 
   traverse(ast, {
     MemberExpression(node) {
-      if (isSimpleDataAccess(node)) {
+      if (isSimpleDataAccess(node, dataKeys)) {
         const path = extractPath(node);
-        if (path[0] === "data") {
+        if (dataKeys.has(path[0])) {
           dataPaths.add(path.join("."));
         }
       }
@@ -83,6 +84,8 @@ export function analyzeDataAccess(ast: Program, schema: Schema, validationContex
   // Collect all arrow function contexts including nested ones
   collectArrowFunctionContexts(ast);
 
+  const parentMap = buildParentMap(ast);
+
   const validatablePaths = new Set<string>();
 
   for (const path of dataPaths) {
@@ -101,13 +104,13 @@ export function analyzeDataAccess(ast: Program, schema: Schema, validationContex
   // Second pass: validate with context awareness
   traverse(ast, {
     MemberExpression(node) {
-      const parent = getParentNode(node, ast);
+      const parent = parentMap.get(node);
       if (parent && parent.type === "CallExpression" && parent.callee === node) {
         return;
       }
 
       // Check if this is inside an arrow function with parameter context
-      const arrowFunctionContext = findArrowFunctionContext(node, ast, arrowFunctionContexts);
+      const arrowFunctionContext = findEnclosingArrowContext(node, arrowFunctionContexts);
 
       if (arrowFunctionContext && node.object.type === "Identifier") {
         const paramType = arrowFunctionContext.get(node.object.name);
@@ -117,15 +120,14 @@ export function analyzeDataAccess(ast: Program, schema: Schema, validationContex
         }
       }
 
-      if (isSimpleDataAccess(node)) {
+      if (isSimpleDataAccess(node, dataKeys)) {
         const path = extractPath(node);
 
-        if (path[0] === "data") {
+        if (dataKeys.has(path[0])) {
           const pathString = path.join(".");
 
           if (validatablePaths.has(pathString)) {
-            const schemaPath = path.slice(1);
-            validateSchemaPath(schemaPath, schema, analysisReport, node, validationContext);
+            validateSchemaPath(path, schema, analysisReport, node, validationContext);
           }
         }
       }
@@ -135,48 +137,20 @@ export function analyzeDataAccess(ast: Program, schema: Schema, validationContex
   return analysisReport;
 }
 
-function findArrowFunctionContext(
+function findEnclosingArrowContext(
   targetNode: any,
-  ast: Program,
   arrowFunctionContexts: Map<any, Map<string, any>>
 ): Map<string, any> | null {
-  function findInNode(node: any, depth: number = 0): any {
-    if (node === targetNode) {
-      return { found: true, depth };
-    }
-
-    if (node.type === "ArrowFunctionExpression" && arrowFunctionContexts.has(node)) {
-      const result = findInNode(node.body, depth + 1);
-      if (result?.found) {
-        return { arrowFunction: node, depth: result.depth };
-      }
-    }
-
-    for (const key of Object.keys(node)) {
-      const value = node[key];
-      if (value && typeof value === "object") {
-        if (Array.isArray(value)) {
-          for (const child of value) {
-            if (child && typeof child === "object" && child.type) {
-              const result = findInNode(child, depth);
-              if (result?.found || result?.arrowFunction) {
-                return result;
-              }
-            }
-          }
-        } else if (value.type) {
-          const result = findInNode(value, depth);
-          if (result?.found || result?.arrowFunction) {
-            return result;
-          }
-        }
+  let best: { arrowFn: any; size: number } | null = null;
+  for (const arrowFn of arrowFunctionContexts.keys()) {
+    if (targetNode.start >= arrowFn.start && targetNode.end <= arrowFn.end) {
+      const size = arrowFn.end - arrowFn.start;
+      if (!best || size < best.size) {
+        best = { arrowFn, size };
       }
     }
-    return null;
   }
-
-  const result = findInNode(ast);
-  return result?.arrowFunction ? arrowFunctionContexts.get(result.arrowFunction) || null : null;
+  return best ? arrowFunctionContexts.get(best.arrowFn) || null : null;
 }
 
 function getArrayElementTypeFromCall(
@@ -185,15 +159,16 @@ function getArrayElementTypeFromCall(
   arrowFunctionContexts: Map<any, Map<string, any>>
 ): any {
   const { callee } = node;
+  const dataKeys = new Set(Object.keys(schema.data ?? {}));
 
   if (callee.type !== "MemberExpression") {
     return null;
   }
 
-  if (isSimpleDataAccess(callee)) {
+  if (isSimpleDataAccess(callee, dataKeys)) {
     const path = extractPath(callee);
-    if (path[0] === "data") {
-      const schemaPath = path.slice(1, -1); // Remove "data" prefix and method name
+    if (dataKeys.has(path[0])) {
+      const schemaPath = path.slice(0, -1); // Remove method name
       const arraySchema = getSchemaAtPath(schemaPath, schema);
 
       if (arraySchema?.type === "array") {
@@ -219,14 +194,6 @@ function getArrayElementTypeFromCall(
           return getArrayElementType(propertySchema);
         }
       }
-
-      // Fallback: try to find any matching property in schema
-      if (propertyName === "items" || propertyName === "employees") {
-        const itemsArraySchema = findArrayPropertyInSchema(schema, propertyName);
-        if (itemsArraySchema) {
-          return getArrayElementType(itemsArraySchema);
-        }
-      }
     }
   }
 
@@ -258,40 +225,6 @@ function isNodeInsideArrowFunction(targetNode: any, arrowFunction: any): boolean
   return false;
 }
 
-function findArrayPropertyInSchema(schema: Schema, propertyName: string): any {
-  function searchInObject(obj: any): any {
-    if (!obj || typeof obj !== "object") return null;
-
-    if (obj.type === "object" && obj.shape) {
-      // Check if this object has the property we're looking for
-      if (obj.shape[propertyName] && obj.shape[propertyName].type === "array") {
-        return obj.shape[propertyName];
-      }
-
-      // Recursively search in nested objects
-      for (const key of Object.keys(obj.shape)) {
-        const result = searchInObject(obj.shape[key]);
-        if (result) return result;
-      }
-    }
-
-    if (obj.type === "array" && obj.shape) {
-      return searchInObject(obj.shape);
-    }
-
-    return null;
-  }
-
-  if (!schema.data) return null;
-
-  for (const key of Object.keys(schema.data)) {
-    const result = searchInObject(schema.data[key]);
-    if (result) return result;
-  }
-
-  return null;
-}
-
 function getSchemaAtPath(path: string[], schema: Schema): any {
   if (!schema.data || path.length === 0) {
     return schema.data;
@@ -347,3 +280,25 @@ function validateParameterAccess(
 export function getArrayElementType(schema: ArrayPropertySchema): PropertySchema | null {
   return schema.shape || null;
 }
+
+function buildParentMap(ast: Program): Map<any, any> {
+  const map = new Map<any, any>();
+  function visit(node: any, parent: any): void {
+    if (!node || typeof node !== "object" || !node.type) return;
+    map.set(node, parent);
+    for (const key of Object.keys(node)) {
+      const value = node[key];
+      if (value && typeof value === "object") {
+        if (Array.isArray(value)) {
+          for (const child of value) {
+            visit(child, node);
+          }
+        } else {
+          visit(value, node);
+        }
+      }
+    }
+  }
+  visit(ast, null);
+  return map;
+}

package/src/analyze/data/method-calls.ts

@@ -9,6 +9,7 @@ import { getNodeRange } from "../utils.js";
 
 export function analyzeMethodCalls(ast: Program, schema: Schema, validationContext: ValidationContext): AnalysisReport {
   const analysisReport = new AnalysisReport();
+  const dataKeys = new Set(Object.keys(schema.data ?? {}));
 
   traverse(ast, {
     CallExpression(node) {
@@ -17,10 +18,10 @@ export function analyzeMethodCalls(ast: Program, schema: Schema, validationConte
       if (callee.type === "MemberExpression" && !callee.computed && callee.property.type === "Identifier") {
         const method = callee.property.name;
 
-        if (isSimpleDataAccess(callee)) {
+        if (isSimpleDataAccess(callee, dataKeys)) {
           const path = extractPath(callee);
-          if (path[0] === "data") {
-            const schemaPath = path.slice(1, -1);
+          if (dataKeys.has(path[0])) {
+            const schemaPath = path.slice(0, -1);
             if (schemaPath.length > 0) {
               validateSchemaPath(schemaPath, schema, analysisReport, callee, validationContext);
             }

package/src/analyze/data/utils.ts

@@ -1,4 +1,4 @@
-import type { MemberExpression, Program } from "acorn";
+import type { MemberExpression } from "acorn";
 import {
   isAllowedOnArray,
   isAllowedOnString,
@@ -10,7 +10,7 @@ import { AnalysisReport } from "../analysis-report.js";
 import { getNodeRange } from "../utils.js";
 import { ValidationContext } from "../validation-context.js";
 
-export function isSimpleDataAccess(node: MemberExpression): boolean {
+export function isSimpleDataAccess(node: MemberExpression, dataKeys: ReadonlySet<string>): boolean {
   if (node.computed) {
     return node.property.type === "Literal" && typeof node.property.value === "number";
   }
@@ -22,7 +22,7 @@ export function isSimpleDataAccess(node: MemberExpression): boolean {
 
   while (current) {
     if (current.type === "Identifier") {
-      return current.name === "data";
+      return dataKeys.has(current.name);
     }
 
     if (current.type === "MemberExpression") {
@@ -70,35 +70,6 @@ export function extractPath(node: MemberExpression): string[] {
   return path;
 }
 
-export function getParentNode(targetNode: any, ast: Program): any | null {
-  let parent: any = null;
-
-  function traverseForParent(node: any, currentParent: any = null): void {
-    if (node === targetNode) {
-      parent = currentParent;
-      return;
-    }
-
-    for (const key of Object.keys(node)) {
-      const value = node[key];
-      if (value && typeof value === "object") {
-        if (Array.isArray(value)) {
-          value.forEach((child) => {
-            if (child && typeof child === "object" && child.type) {
-              traverseForParent(child, node);
-            }
-          });
-        } else if (value.type) {
-          traverseForParent(value, node);
-        }
-      }
-    }
-  }
-
-  traverseForParent(ast);
-  return parent;
-}
-
 export function getAvailablePropsAtPath(path: string[], depth: number, schemaData: any): string[] {
   if (!schemaData || depth < 0) {
     return schemaData ? Object.keys(schemaData) : [];
@@ -148,7 +119,7 @@ export function validateSchemaPath(
   if (!current) {
     analysisReport.addIssue(
       "INVALID_DATA_ACCESS",
-      `Property 'data.${path[0]}' does not exist in schema`,
+      `Property '${path[0]}' does not exist in schema`,
       getNodeRange(node),
       validationContext.getSnapshot(),
       Object.keys(schemaData)
@@ -160,7 +131,7 @@ export function validateSchemaPath(
 
   for (let i = 1; i < path.length; i++) {
     const prop = path[i];
-    const isElementAccess = elementAccessFlags[i];
+    const isElementAccess = elementAccessFlags[i - 1];
 
     if (current.type === "array") {
       if (!isElementAccess) {
@@ -168,7 +139,7 @@ export function validateSchemaPath(
           return;
         }
 
-        const accessedPath = ["data", ...path.slice(0, i), prop].join(".");
+        const accessedPath = [...path.slice(0, i), prop].join(".");
         analysisReport.addIssue(
           "INVALID_DATA_ACCESS",
           `Property '${accessedPath}' does not exist on array type`,
@@ -201,7 +172,7 @@ export function validateSchemaPath(
 
           analysisReport.addIssue(
             "INVALID_DATA_ACCESS",
-            `Property 'data.${paths.join(".")}' does not exist in schema`,
+            `Property '${paths.join(".")}' does not exist in schema`,
             getNodeRange(node),
             validationContext.getSnapshot(),
             suggestions
@@ -218,7 +189,7 @@ export function validateSchemaPath(
           return;
         }
 
-        const accessedPath = ["data", ...path.slice(0, i), prop].join(".");
+        const accessedPath = [...path.slice(0, i), prop].join(".");
         analysisReport.addIssue(
           "INVALID_DATA_ACCESS",
           `Property '${accessedPath}' does not exist on array type`,
@@ -234,7 +205,7 @@ export function validateSchemaPath(
           return;
         }
 
-        const accessedPath = ["data", ...path.slice(0, i), prop].join(".");
+        const accessedPath = [...path.slice(0, i), prop].join(".");
         analysisReport.addIssue(
           "INVALID_DATA_ACCESS",
           `Property '${accessedPath}' does not exist on string type`,
@@ -259,7 +230,7 @@ export function validateSchemaPath(
         return;
       }
 
-      const accessedPath = ["data", ...path.slice(0, i), prop].join(".");
+      const accessedPath = [...path.slice(0, i), prop].join(".");
       analysisReport.addIssue(
         "INVALID_DATA_ACCESS",
         `Property '${accessedPath}' does not exist on string type`,
@@ -288,7 +259,7 @@ export function validateSchemaPath(
 
       analysisReport.addIssue(
         "INVALID_DATA_ACCESS",
-        `Property 'data.${paths.join(".")}' does not exist in schema`,
+        `Property '${paths.join(".")}' does not exist in schema`,
         getNodeRange(node),
         validationContext.getSnapshot(),
         availableProps

package/src/analyze/jsx/element-attributes.ts

@@ -1,18 +1,17 @@
 import type { Program } from "acorn";
-import { traverse } from "../../traverse.js";
+import { isJsxAttribute, isJsxExpressionContainer, type JSXAttribute } from "../../jsx.js";
 import {
-  type Schema,
-  isAttributeAllowed,
   getAllowedAttributes,
-  getRequiredAttributes,
   getAttributeSchema,
   getEnumValues,
+  getRequiredAttributes,
+  isAttributeAllowed,
+  type Schema,
 } from "../../schema.js";
-import { isJsxAttribute, isJsxExpressionContainer, type JSXAttribute } from "../../jsx.js";
-import { ValidationContext } from "../validation-context.js";
+import { traverse } from "../../traverse.js";
 import { AnalysisReport } from "../analysis-report.js";
-
-import { getNodeRange, getAttributeSimilarityMatchers, getBestSimilarityMatcherSuggestion } from "../utils.js";
+import { getAttributeSimilarityMatchers, getBestSimilarityMatcherSuggestion, getNodeRange } from "../utils.js";
+import type { ValidationContext } from "../validation-context.js";
 
 export function analyzeElementAttributes(
   ast: Program,
@@ -21,11 +20,24 @@ export function analyzeElementAttributes(
 ): AnalysisReport {
   const analysisReport = new AnalysisReport();
 
+  const localFunctionNames = new Set<string>();
+  for (const stmt of ast.body) {
+    if (stmt.type === "FunctionDeclaration" && stmt.id) {
+      localFunctionNames.add(stmt.id.name);
+    }
+  }
+
   traverse(ast, {
     JSXElement(node) {
       const tagName = node.openingElement.name.name;
 
       validationContext.enterElement(tagName);
+
+      if (localFunctionNames.has(tagName)) {
+        validationContext.exitElement();
+        return;
+      }
+
       const currentContext = validationContext.getSnapshot();
 
       const allowedAttributes = getAllowedAttributes(schema, tagName);
@@ -132,7 +144,10 @@ function getAttributeLiteralValue(attribute: JSXAttribute): string | number | bo
   }
 
   if (isJsxExpressionContainer(attribute.value)) {
-    const expression = attribute.value.expression as { type?: string; value?: unknown };
+    const expression = attribute.value.expression as {
+      type?: string;
+      value?: unknown;
+    };
 
     if (expression?.type === "Literal") {
       return expression.value as string | number | boolean | null | undefined;

package/src/analyze/jsx/element-children.ts

@@ -1,10 +1,10 @@
 import type { Program } from "acorn";
+import { isJsxElement, isJsxFragment, isJsxLeafNode, isJsxText } from "../../jsx.js";
+import { getAllowedChildren, isSelfClosing, type Schema } from "../../schema.js";
 import { traverse } from "../../traverse.js";
-import { type Schema, getAllowedChildren, isSelfClosing } from "../../schema.js";
-import { isJsxElement, isJsxFragment, isJsxText, isJsxLeafNode } from "../../jsx.js";
-import { ValidationContext } from "../validation-context.js";
 import { AnalysisReport } from "../analysis-report.js";
-import { getNodeRange, getElementSimilarityMatchers, getBestSimilarityMatcherSuggestion } from "../utils.js";
+import { getBestSimilarityMatcherSuggestion, getElementSimilarityMatchers, getNodeRange } from "../utils.js";
+import type { ValidationContext } from "../validation-context.js";
 
 export function analyzeElementChildren(
   ast: Program,
@@ -13,12 +13,24 @@ export function analyzeElementChildren(
 ): AnalysisReport {
   const analysisReport = new AnalysisReport();
 
+  const localFunctionNames = new Set<string>();
+  for (const stmt of ast.body) {
+    if (stmt.type === "FunctionDeclaration" && stmt.id) {
+      localFunctionNames.add(stmt.id.name);
+    }
+  }
+
   traverse(ast, {
     JSXElement(node) {
       const parentTag = node.openingElement.name.name;
 
       validationContext.enterElement(parentTag);
 
+      if (localFunctionNames.has(parentTag)) {
+        validationContext.exitElement();
+        return;
+      }
+
       const currentContext = validationContext.getSnapshot();
 
       const allowedChildren = getAllowedChildren(schema, parentTag);
@@ -57,6 +69,10 @@ export function analyzeElementChildren(
         if (isJsxElement(child)) {
           const childTag = child.openingElement.name.name;
 
+          if (localFunctionNames.has(childTag)) {
+            continue;
+          }
+
           if (!allowedChildren.includes(childTag)) {
             const elementSimilarityMatchers = getElementSimilarityMatchers(childTag, allowedChildren);
             const bestSimilarityMatcherSuggestion = getBestSimilarityMatcherSuggestion(childTag, allowedChildren);
@@ -83,8 +99,6 @@ export function analyzeElementChildren(
         } else if (isJsxText(child)) {
           const hasContent = child.value.trim().length > 0;
           if (!hasContent) {
-            // Allow whitespace-only text nodes (very common in JSX formatting)
-            continue;
           }
         }
       }

package/src/analyze/jsx/element-tags.ts

@@ -1,19 +1,31 @@
 import type { Program } from "acorn";
+import { getAllElements, isElementAllowed, type Schema } from "../../schema.js";
 import { traverse } from "../../traverse.js";
-import { type Schema, isElementAllowed, getAllElements } from "../../schema.js";
-import { ValidationContext } from "../validation-context.js";
 import { AnalysisReport } from "../analysis-report.js";
-import { getNodeRange, getElementSimilarityMatchers, getBestSimilarityMatcherSuggestion } from "../utils.js";
+import { getBestSimilarityMatcherSuggestion, getElementSimilarityMatchers, getNodeRange } from "../utils.js";
+import type { ValidationContext } from "../validation-context.js";
 
 export function analyzeElementTags(ast: Program, schema: Schema, validationContext: ValidationContext): AnalysisReport {
   const analysisReport = new AnalysisReport();
 
+  const localFunctionNames = new Set<string>();
+  for (const stmt of ast.body) {
+    if (stmt.type === "FunctionDeclaration" && stmt.id) {
+      localFunctionNames.add(stmt.id.name);
+    }
+  }
+
   traverse(ast, {
     JSXElement(node) {
       const tagName = node.openingElement.name.name;
 
       validationContext.enterElement(tagName);
 
+      if (localFunctionNames.has(tagName)) {
+        validationContext.exitElement();
+        return;
+      }
+
       const snapshot = validationContext.getSnapshot();
       const range = getNodeRange(node);
 

package/src/analyze/security/analyze.ts

@@ -6,16 +6,14 @@ import { analyzeCallExpressions } from "./call-expressions.js";
 import { analyzeDeclarations } from "./declarations.js";
 import { analyzeExpressions } from "./expressions.js";
 import { analyzeIdentifiers } from "./identifiers.js";
-import { analyzeMemberAccess } from "./member-access.js";
 
 export function analyzeSecurity(ast: Program, schema: Schema): AnalysisReport {
   const validationContext = new ValidationContext();
 
   return new AnalysisReport().merge(
     analyzeDeclarations(ast, schema, validationContext),
-    //analyzeIdentifiers(ast, schema, validationContext),
+    analyzeIdentifiers(ast, schema, validationContext),
     analyzeExpressions(ast, schema, validationContext),
-    analyzeMemberAccess(ast, schema, validationContext),
     analyzeCallExpressions(ast, schema, validationContext)
   );
 }

package/src/analyze/security/call-expressions.ts

@@ -1,39 +1,59 @@
 import type { Program } from "acorn";
-import { traverse } from "../../traverse.js";
+import { getBuiltinGlobals } from "../../builtins.js";
 import type { Schema } from "../../schema.js";
-import { ValidationContext } from "../validation-context.js";
+import { traverse } from "../../traverse.js";
 import { AnalysisReport } from "../analysis-report.js";
 import { getNodeRange } from "../utils.js";
+import type { ValidationContext } from "../validation-context.js";
 
 export function analyzeCallExpressions(
   ast: Program,
-  _schema: Schema,
+  schema: Schema,
   validationContext: ValidationContext
 ): AnalysisReport {
   const analysisReport = new AnalysisReport();
 
+  const localFunctionNames = new Set<string>();
+  for (const stmt of ast.body) {
+    if (stmt.type === "FunctionDeclaration" && stmt.id) {
+      localFunctionNames.add(stmt.id.name);
+    }
+  }
+  const schemaFunctionNames = new Set(Object.keys(schema.functions ?? {}));
+  const builtinGlobals = new Set(getBuiltinGlobals());
+
   traverse(ast, {
     CallExpression(node) {
       const { callee } = node;
 
-      if (callee.type !== "MemberExpression") {
-        analysisReport.addIssue(
-          "DIRECT_CALL_NOT_ALLOWED",
-          "only member calls allowed",
-          getNodeRange(node),
-          validationContext.getSnapshot()
-        );
+      if (callee.type === "MemberExpression") {
+        if (callee.property.type !== "Identifier" || callee.computed) {
+          analysisReport.addIssue(
+            "DYNAMIC_METHOD_NOT_ALLOWED",
+            "only explicitly allowed methods are permitted",
+            getNodeRange(callee),
+            validationContext.getSnapshot()
+          );
+        }
         return;
       }
 
-      if (callee.property.type !== "Identifier" || callee.computed) {
-        analysisReport.addIssue(
-          "DYNAMIC_METHOD_NOT_ALLOWED",
-          "only explicitly allowed methods are permitted",
-          getNodeRange(callee),
-          validationContext.getSnapshot()
-        );
+      if (callee.type === "Identifier") {
+        if (
+          localFunctionNames.has(callee.name) ||
+          schemaFunctionNames.has(callee.name) ||
+          builtinGlobals.has(callee.name)
+        ) {
+          return;
+        }
       }
+
+      analysisReport.addIssue(
+        "DIRECT_CALL_NOT_ALLOWED",
+        "only member calls allowed",
+        getNodeRange(node),
+        validationContext.getSnapshot()
+      );
     },
   });