jsxpression 0.1.41 → 0.2.1

package/src/analyze/jsx/element-children.ts

@@ -2,16 +2,12 @@ import type { Program } from "acorn";
 import { isJsxElement, isJsxFragment, isJsxLeafNode, isJsxText } from "../../jsx.js";
 import { getAllowedChildren, isSelfClosing, type Schema } from "../../schema.js";
 import { traverse } from "../../traverse.js";
-import { AnalysisReport } from "../analysis-report.js";
+import { createAnalysisReport, type AnalysisReport } from "../analysis-report.js";
 import { getBestSimilarityMatcherSuggestion, getElementSimilarityMatchers, getNodeRange } from "../utils.js";
 import type { ValidationContext } from "../validation-context.js";
 
-export function analyzeElementChildren(
-  ast: Program,
-  schema: Schema,
-  validationContext: ValidationContext
-): AnalysisReport {
-  const analysisReport = new AnalysisReport();
+export function analyzeElementChildren(ast: Program, schema: Schema, validationContext: ValidationContext): AnalysisReport {
+  const analysisReport = createAnalysisReport();
 
   const localFunctionNames = new Set<string>();
   for (const stmt of ast.body) {
@@ -59,7 +55,7 @@ export function analyzeElementChildren(
           analysisReport.addIssue(
             "SELF_CLOSING_WITH_CHILDREN",
             `Element <${parentTag}> cannot have children. It is self-closing.`,
-            getNodeRange(firstMeaningfulChild || node.children[0]),
+            getNodeRange(firstMeaningfulChild ?? node.children[0]),
             currentContext
           );
         }

package/src/analyze/jsx/element-tags.ts

@@ -1,12 +1,12 @@
 import type { Program } from "acorn";
 import { getAllElements, isElementAllowed, type Schema } from "../../schema.js";
 import { traverse } from "../../traverse.js";
-import { AnalysisReport } from "../analysis-report.js";
+import { createAnalysisReport, type AnalysisReport } from "../analysis-report.js";
 import { getBestSimilarityMatcherSuggestion, getElementSimilarityMatchers, getNodeRange } from "../utils.js";
 import type { ValidationContext } from "../validation-context.js";
 
 export function analyzeElementTags(ast: Program, schema: Schema, validationContext: ValidationContext): AnalysisReport {
-  const analysisReport = new AnalysisReport();
+  const analysisReport = createAnalysisReport();
 
   const localFunctionNames = new Set<string>();
   for (const stmt of ast.body) {

package/src/analyze/security/analyze.ts

@@ -1,16 +1,16 @@
 import type { Program } from "acorn";
 import type { Schema } from "../../schema.js";
-import { AnalysisReport } from "../analysis-report.js";
-import { ValidationContext } from "../validation-context.js";
+import { createAnalysisReport, type AnalysisReport } from "../analysis-report.js";
+import { createValidationContext } from "../validation-context.js";
 import { analyzeCallExpressions } from "./call-expressions.js";
 import { analyzeDeclarations } from "./declarations.js";
 import { analyzeExpressions } from "./expressions.js";
 // import { analyzeIdentifiers } from "./identifiers.js";
 
 export function analyzeSecurity(ast: Program, schema: Schema): AnalysisReport {
-  const validationContext = new ValidationContext();
+  const validationContext = createValidationContext();
 
-  return new AnalysisReport().merge(
+  return createAnalysisReport().merge(
     analyzeDeclarations(ast, schema, validationContext),
     // analyzeIdentifiers(ast, schema, validationContext),
     analyzeExpressions(ast, schema, validationContext),

package/src/analyze/security/call-expressions.ts

@@ -2,16 +2,12 @@ import type { Program } from "acorn";
 import { getBuiltinGlobals } from "../../builtins.js";
 import type { Schema } from "../../schema.js";
 import { traverse } from "../../traverse.js";
-import { AnalysisReport } from "../analysis-report.js";
+import { createAnalysisReport, type AnalysisReport } from "../analysis-report.js";
 import { getNodeRange } from "../utils.js";
 import type { ValidationContext } from "../validation-context.js";
 
-export function analyzeCallExpressions(
-  ast: Program,
-  schema: Schema,
-  validationContext: ValidationContext
-): AnalysisReport {
-  const analysisReport = new AnalysisReport();
+export function analyzeCallExpressions(ast: Program, schema: Schema, validationContext: ValidationContext): AnalysisReport {
+  const analysisReport = createAnalysisReport();
 
   const localFunctionNames = new Set<string>();
   for (const stmt of ast.body) {
@@ -39,21 +35,12 @@ export function analyzeCallExpressions(
       }
 
       if (callee.type === "Identifier") {
-        if (
-          localFunctionNames.has(callee.name) ||
-          schemaFunctionNames.has(callee.name) ||
-          builtinGlobals.has(callee.name)
-        ) {
+        if (localFunctionNames.has(callee.name) || schemaFunctionNames.has(callee.name) || builtinGlobals.has(callee.name)) {
           return;
         }
       }
 
-      analysisReport.addIssue(
-        "DIRECT_CALL_NOT_ALLOWED",
-        "only member calls allowed",
-        getNodeRange(node),
-        validationContext.getSnapshot()
-      );
+      analysisReport.addIssue("DIRECT_CALL_NOT_ALLOWED", "only member calls allowed", getNodeRange(node), validationContext.getSnapshot());
     },
   });
 

package/src/analyze/security/declarations.ts

@@ -1,46 +1,29 @@
-import type { Program } from "acorn";
+import type { FunctionDeclaration, Program } from "acorn";
 import { isJsxRoot } from "../../jsx.js";
 import type { Schema } from "../../schema.js";
 import { traverse } from "../../traverse.js";
-import { AnalysisReport } from "../analysis-report.js";
+import { createAnalysisReport, type AnalysisReport } from "../analysis-report.js";
 import { getNodeRange } from "../utils.js";
 import type { ValidationContext } from "../validation-context.js";
 
-export function analyzeDeclarations(
-  ast: Program,
-  _schema: Schema,
-  validationContext: ValidationContext
-): AnalysisReport {
-  const analysisReport = new AnalysisReport();
+export function analyzeDeclarations(ast: Program, _schema: Schema, validationContext: ValidationContext): AnalysisReport {
+  const analysisReport = createAnalysisReport();
   const topLevelNodes = new Set(ast.body);
 
   traverse(ast, {
     ImportDeclaration(node) {
-      analysisReport.addIssue(
-        "IMPORT_NOT_ALLOWED",
-        "import not allowed",
-        getNodeRange(node),
-        validationContext.getSnapshot()
-      );
+      analysisReport.addIssue("IMPORT_NOT_ALLOWED", "import not allowed", getNodeRange(node), validationContext.getSnapshot());
     },
     ExportNamedDeclaration(node) {
-      analysisReport.addIssue(
-        "EXPORT_NOT_ALLOWED",
-        "export not allowed",
-        getNodeRange(node),
-        validationContext.getSnapshot()
-      );
+      analysisReport.addIssue("EXPORT_NOT_ALLOWED", "export not allowed", getNodeRange(node), validationContext.getSnapshot());
     },
     ExportDefaultDeclaration(node) {
-      analysisReport.addIssue(
-        "EXPORT_NOT_ALLOWED",
-        "export not allowed",
-        getNodeRange(node),
-        validationContext.getSnapshot()
-      );
+      analysisReport.addIssue("EXPORT_NOT_ALLOWED", "export not allowed", getNodeRange(node), validationContext.getSnapshot());
     },
     FunctionDeclaration(node) {
-      if (!topLevelNodes.has(node as any)) {
+      // acorn-walk types this callback as FunctionDeclaration | AnonymousFunctionDeclaration, but Program-level
+      // function declarations always have an id, so the cast reflects that guarantee without changing behavior.
+      if (!topLevelNodes.has(node as FunctionDeclaration)) {
         analysisReport.addIssue(
           "FUNCTION_NOT_ALLOWED",
           "nested function declarations not allowed",
@@ -50,34 +33,22 @@ export function analyzeDeclarations(
       }
     },
     ClassDeclaration(node) {
-      analysisReport.addIssue(
-        "CLASS_NOT_ALLOWED",
-        "classes not allowed",
-        getNodeRange(node),
-        validationContext.getSnapshot()
-      );
+      analysisReport.addIssue("CLASS_NOT_ALLOWED", "classes not allowed", getNodeRange(node), validationContext.getSnapshot());
     },
     VariableDeclaration(node) {
       if (node.kind === "const") {
         return;
       }
-      analysisReport.addIssue(
-        "VARIABLE_NOT_ALLOWED",
-        `${node.kind} not allowed, use const`,
-        getNodeRange(node),
-        validationContext.getSnapshot()
-      );
+      analysisReport.addIssue("VARIABLE_NOT_ALLOWED", `${node.kind} not allowed, use const`, getNodeRange(node), validationContext.getSnapshot());
     },
   });
 
   const hasDeclarations = ast.body.some((s) => s.type === "VariableDeclaration" || s.type === "FunctionDeclaration");
   if (hasDeclarations) {
     const lastStatement = ast.body[ast.body.length - 1];
-    if (!lastStatement || lastStatement.type !== "ReturnStatement") {
+    if (lastStatement?.type !== "ReturnStatement") {
       const isBareJsx = lastStatement?.type === "ExpressionStatement" && isJsxRoot(lastStatement.expression);
-      const range = lastStatement
-        ? getNodeRange(lastStatement)
-        : { start: { line: 1, column: 0 }, end: { line: 1, column: 0 } };
+      const range = lastStatement ? getNodeRange(lastStatement) : { start: { line: 1, column: 0 }, end: { line: 1, column: 0 } };
       analysisReport.addIssue(
         "RETURN_REQUIRED",
         isBareJsx

package/src/analyze/security/expressions.ts

@@ -1,57 +1,28 @@
 import type { Program, Expression, Super } from "acorn";
-import { traverse } from "../../traverse.js";
 import type { Schema } from "../../schema.js";
-import type { ValidationContext } from "../validation-context.js";
-import { AnalysisReport } from "../analysis-report.js";
+import { traverse } from "../../traverse.js";
+import { createAnalysisReport, type AnalysisReport } from "../analysis-report.js";
 import { getNodeRange } from "../utils.js";
+import type { ValidationContext } from "../validation-context.js";
 
-export function analyzeExpressions(
-  ast: Program,
-  _schema: Schema,
-  validationContext: ValidationContext
-): AnalysisReport {
-  const analysisReport = new AnalysisReport();
+export function analyzeExpressions(ast: Program, _schema: Schema, validationContext: ValidationContext): AnalysisReport {
+  const analysisReport = createAnalysisReport();
 
   traverse(ast, {
     NewExpression(node) {
-      analysisReport.addIssue(
-        "NEW_NOT_ALLOWED",
-        "new not allowed",
-        getNodeRange(node),
-        validationContext.getSnapshot()
-      );
+      analysisReport.addIssue("NEW_NOT_ALLOWED", "new not allowed", getNodeRange(node), validationContext.getSnapshot());
     },
     ThisExpression(node) {
-      analysisReport.addIssue(
-        "THIS_NOT_ALLOWED",
-        "this not allowed",
-        getNodeRange(node),
-        validationContext.getSnapshot()
-      );
+      analysisReport.addIssue("THIS_NOT_ALLOWED", "this not allowed", getNodeRange(node), validationContext.getSnapshot());
     },
     WithStatement(node) {
-      analysisReport.addIssue(
-        "WITH_NOT_ALLOWED",
-        "with not allowed",
-        getNodeRange(node),
-        validationContext.getSnapshot()
-      );
+      analysisReport.addIssue("WITH_NOT_ALLOWED", "with not allowed", getNodeRange(node), validationContext.getSnapshot());
     },
     AwaitExpression(node) {
-      analysisReport.addIssue(
-        "AWAIT_NOT_ALLOWED",
-        "await not allowed",
-        getNodeRange(node),
-        validationContext.getSnapshot()
-      );
+      analysisReport.addIssue("AWAIT_NOT_ALLOWED", "await not allowed", getNodeRange(node), validationContext.getSnapshot());
     },
     YieldExpression(node) {
-      analysisReport.addIssue(
-        "YIELD_NOT_ALLOWED",
-        "yield not allowed",
-        getNodeRange(node),
-        validationContext.getSnapshot()
-      );
+      analysisReport.addIssue("YIELD_NOT_ALLOWED", "yield not allowed", getNodeRange(node), validationContext.getSnapshot());
     },
     ArrowFunctionExpression(node) {
       if (node.body.type === "BlockStatement") {
@@ -83,12 +54,7 @@ export function analyzeExpressions(
         currentNode = currentNode.object;
       }
       if (depth > 5) {
-        analysisReport.addIssue(
-          "MEMBER_CHAIN_TOO_DEEP",
-          "member chain too deep",
-          getNodeRange(node),
-          validationContext.getSnapshot()
-        );
+        analysisReport.addIssue("MEMBER_CHAIN_TOO_DEEP", "member chain too deep", getNodeRange(node), validationContext.getSnapshot());
       }
 
       if (node.computed) {
@@ -101,10 +67,7 @@ export function analyzeExpressions(
           "computed member access not allowed",
           getNodeRange(node),
           validationContext.getSnapshot(),
-          [
-            "Use dot notation: obj.prop instead of obj[prop]",
-            "For arrays, use numeric indices: array[0] instead of array[variable]",
-          ]
+          ["Use dot notation: obj.prop instead of obj[prop]", "For arrays, use numeric indices: array[0] instead of array[variable]"]
         );
       }
     },

package/src/analyze/security/identifiers.ts

@@ -2,12 +2,12 @@ import type { AnyNode, ArrowFunctionExpression, FunctionDeclaration, Identifier,
 import { getBuiltinGlobals } from "../../builtins.js";
 import type { Schema } from "../../schema.js";
 import { traverse } from "../../traverse.js";
-import { AnalysisReport } from "../analysis-report.js";
+import { createAnalysisReport, type AnalysisReport } from "../analysis-report.js";
 import { getNodeRange } from "../utils.js";
 import type { ValidationContext } from "../validation-context.js";
 
 export function analyzeIdentifiers(ast: Program, schema: Schema, validationContext: ValidationContext): AnalysisReport {
-  const analysisReport = new AnalysisReport();
+  const analysisReport = createAnalysisReport();
   const arrowParamScopes = getArrowParamScopes(ast);
   const functionParamScopes = getFunctionParamScopes(ast);
   const functionLocalConsts = getFunctionLocalConsts(ast);
@@ -36,14 +36,7 @@ export function analyzeIdentifiers(ast: Program, schema: Schema, validationConte
       }
 
       const dataKeys = Object.keys(schema.data ?? {});
-      const allowedRoots = [
-        "props",
-        ...dataKeys,
-        ...getBuiltinGlobals(),
-        ...constNames,
-        ...functionNames,
-        ...schemaFunctionNames,
-      ];
+      const allowedRoots = ["props", ...dataKeys, ...getBuiltinGlobals(), ...constNames, ...functionNames, ...schemaFunctionNames];
 
       if (allowedRoots.includes(name)) {
         return;
@@ -52,10 +45,7 @@ export function analyzeIdentifiers(ast: Program, schema: Schema, validationConte
       const scopeParent = findScopeParent(node, ast);
 
       if (scopeParent) {
-        const params =
-          scopeParent.type === "ArrowFunctionExpression"
-            ? arrowParamScopes.get(scopeParent)
-            : functionParamScopes.get(scopeParent);
+        const params = scopeParent.type === "ArrowFunctionExpression" ? arrowParamScopes.get(scopeParent) : functionParamScopes.get(scopeParent);
         if (params?.has(name)) {
           return;
         }
@@ -141,7 +131,7 @@ function collectParamNames(param: AnyNode, names: Set<string>): void {
       names.add(param.name);
       break;
     case "ObjectPattern":
-      for (const prop of (param as any).properties) {
+      for (const prop of param.properties) {
         if (prop.type === "RestElement") {
           collectParamNames(prop.argument, names);
         } else {
@@ -150,21 +140,25 @@ function collectParamNames(param: AnyNode, names: Set<string>): void {
       }
       break;
     case "ArrayPattern":
-      for (const el of (param as any).elements) {
-        if (el) collectParamNames(el, names);
+      for (const el of param.elements) {
+        if (el) {
+          collectParamNames(el, names);
+        }
       }
       break;
     case "AssignmentPattern":
-      collectParamNames((param as any).left, names);
+      collectParamNames(param.left, names);
       break;
     case "RestElement":
-      collectParamNames((param as any).argument, names);
+      collectParamNames(param.argument, names);
+      break;
+    default:
       break;
   }
 }
 
-function getTopLevelConstNames(ast: Program): string[] {
-  const names: string[] = [];
+function getTopLevelConstNames(ast: Program): Array<string> {
+  const names: Array<string> = [];
   for (const stmt of ast.body) {
     if (stmt.type === "VariableDeclaration" && stmt.kind === "const") {
       for (const decl of stmt.declarations) {
@@ -177,8 +171,8 @@ function getTopLevelConstNames(ast: Program): string[] {
   return names;
 }
 
-function getTopLevelFunctionNames(ast: Program): string[] {
-  const names: string[] = [];
+function getTopLevelFunctionNames(ast: Program): Array<string> {
+  const names: Array<string> = [];
   for (const stmt of ast.body) {
     if (stmt.type === "FunctionDeclaration" && stmt.id) {
       names.push(stmt.id.name);
@@ -201,17 +195,18 @@ function findScopeParent(targetNode: AnyNode, rootNode: AnyNode): ArrowFunctionE
       found = node as ArrowFunctionExpression | FunctionDeclaration;
     }
 
-    for (const key of Object.keys(node)) {
-      const value = (node as any)[key];
+    const record = node as unknown as Record<string, unknown>;
+    for (const key of Object.keys(record)) {
+      const value = record[key];
 
       if (value && typeof value === "object") {
         if (Array.isArray(value)) {
           for (const item of value) {
-            if (item && typeof item === "object" && walk(item)) {
+            if (item && typeof item === "object" && walk(item as AnyNode)) {
               return true;
             }
           }
-        } else if (walk(value)) {
+        } else if (walk(value as AnyNode)) {
           return true;
         }
       }
@@ -228,25 +223,28 @@ function findScopeParent(targetNode: AnyNode, rootNode: AnyNode): ArrowFunctionE
   return found;
 }
 
-function buildParentMap(ast: Program): Map<any, any> {
-  const parentMap = new Map<any, any>();
+function buildParentMap(ast: Program): Map<AnyNode, AnyNode | null> {
+  const parentMap = new Map<AnyNode, AnyNode | null>();
 
-  function visit(node: any, parent: any): void {
-    if (!node || typeof node !== "object") return;
-    if (node.type) {
-      parentMap.set(node, parent);
+  function visit(node: unknown, parent: AnyNode | null): void {
+    if (!node || typeof node !== "object") {
+      return;
+    }
+    const record = node as Record<string, unknown>;
+    if (record["type"]) {
+      parentMap.set(node as AnyNode, parent);
     }
-    for (const key of Object.keys(node)) {
-      const value = node[key];
+    for (const key of Object.keys(record)) {
+      const value = record[key];
       if (value && typeof value === "object") {
         if (Array.isArray(value)) {
           for (const child of value) {
-            if (child && typeof child === "object" && child.type) {
-              visit(child, node);
+            if (child && typeof child === "object" && (child as Record<string, unknown>)["type"]) {
+              visit(child, node as AnyNode);
             }
           }
-        } else if (value.type) {
-          visit(value, node);
+        } else if ((value as Record<string, unknown>)["type"]) {
+          visit(value, node as AnyNode);
         }
       }
     }

package/src/analyze/utils.ts

@@ -1,3 +1,5 @@
+import type { Node } from "acorn";
+
 export interface RangePosition {
   line: number;
   column: number;
@@ -8,7 +10,8 @@ export interface Range {
   end: RangePosition;
 }
 
-export function getNodeRange(node: any): Range {
+export function getNodeRange(nodeParam: unknown): Range {
+  const node = nodeParam as Node;
   if (node.loc) {
     return {
       start: {
@@ -34,15 +37,15 @@ export function getNodeRange(node: any): Range {
   };
 }
 
-export function getElementSimilarityMatchers(invalid: string, available: string[]): SimilarityMatcher[] {
+export function getElementSimilarityMatchers(invalid: string, available: Array<string>): Array<SimilarityMatcher> {
   return getSimilarityMatchers(invalid, available, "element");
 }
 
-export function getAttributeSimilarityMatchers(invalid: string, available: string[]): SimilarityMatcher[] {
+export function getAttributeSimilarityMatchers(invalid: string, available: Array<string>): Array<SimilarityMatcher> {
   return getSimilarityMatchers(invalid, available, "attribute");
 }
 
-export function getBestSimilarityMatcherSuggestion(invalid: string, available: string[]): string | null {
+export function getBestSimilarityMatcherSuggestion(invalid: string, available: Array<string>): string | null {
   const similarityMatchers = getElementSimilarityMatchers(invalid, available);
 
   if (similarityMatchers.length === 0) {
@@ -66,24 +69,27 @@ interface SimilarityMatcher {
   type: SimilarityMatcherType;
 }
 
-function getSimilarityMatchers(invalid: string, available: string[], type: SimilarityMatcherType): SimilarityMatcher[] {
+function getSimilarityMatchers(invalid: string, available: Array<string>, type: SimilarityMatcherType): Array<SimilarityMatcher> {
   if (available.length === 0) {
     return [];
   }
 
-  return available
-    .map((suggestion) => ({
-      suggestion,
-      distance: levenshteinDistance(invalid.toLowerCase(), suggestion.toLowerCase()),
-      type,
-    }))
-    .filter((similarityMatcher) => similarityMatcher.distance <= Math.max(2, Math.floor(invalid.length * 0.4)))
-    .sort((a, b) => a.distance - b.distance)
-    .slice(0, 3)
-    .map((similarityMatcher) => ({
-      ...similarityMatcher,
-      confidence: 1 - similarityMatcher.distance / Math.max(invalid.length, similarityMatcher.suggestion.length),
-    }));
+  return (
+    available
+      .map((suggestion) => ({
+        suggestion,
+        distance: levenshteinDistance(invalid.toLowerCase(), suggestion.toLowerCase()),
+        type,
+      }))
+      .filter((similarityMatcher) => similarityMatcher.distance <= Math.max(2, Math.floor(invalid.length * 0.4)))
+      // oxlint-disable-next-line unicorn/no-array-sort
+      .sort((a, b) => a.distance - b.distance)
+      .slice(0, 3)
+      .map((similarityMatcher) => ({
+        ...similarityMatcher,
+        confidence: 1 - similarityMatcher.distance / Math.max(invalid.length, similarityMatcher.suggestion.length),
+      }))
+  );
 }
 
 function levenshteinDistance(x: string, y: string): number {
@@ -94,7 +100,7 @@ function levenshteinDistance(x: string, y: string): number {
     return x.length;
   }
 
-  const matrix: number[][] = [];
+  const matrix: Array<Array<number>> = [];
 
   for (let i = 0; i <= y.length; i++) {
     matrix[i] = [i];

package/src/analyze/validation-context.ts

@@ -1,32 +1,41 @@
 export interface ValidationContextSnapshot {
-  elements: string[];
+  elements: Array<string>;
   currentElement?: string;
-  parentElements: string[];
+  parentElements: Array<string>;
 }
 
-export class ValidationContext {
-  #elements: string[] = [];
+export interface ValidationContext {
+  readonly currentPath: string;
+  enterElement: (element: string) => void;
+  exitElement: () => void;
+  getSnapshot: () => ValidationContextSnapshot;
+}
+
+export function createValidationContext(): ValidationContext {
+  const elements: Array<string> = [];
 
-  get currentPath(): string {
-    if (this.#elements.length > 0) {
-      return this.#elements.join(" > ");
-    }
-    return "";
-  }
+  return {
+    get currentPath(): string {
+      if (elements.length > 0) {
+        return elements.join(" > ");
+      }
+      return "";
+    },
 
-  enterElement(element: string): void {
-    this.#elements.push(element);
-  }
+    enterElement(element: string): void {
+      elements.push(element);
+    },
 
-  exitElement(): void {
-    this.#elements.pop();
-  }
+    exitElement(): void {
+      elements.pop();
+    },
 
-  getSnapshot(): ValidationContextSnapshot {
-    return {
-      elements: this.#elements.slice(),
-      currentElement: this.#elements[this.#elements.length - 1],
-      parentElements: this.#elements.slice(0, -1),
-    };
-  }
+    getSnapshot(): ValidationContextSnapshot {
+      return {
+        elements: elements.slice(),
+        currentElement: elements[elements.length - 1],
+        parentElements: elements.slice(0, -1),
+      };
+    },
+  };
 }