openyida 2026.9.3 → 2026.9.4-beta.0

package/lib/app/canvas-compile.js

@@ -24,12 +24,13 @@
  *   3) 第三方依赖以 `window.<别名>` 形式引用（antd→window.antd、react→window.React …），
  *      这些 UMD 依赖由画布运行时依据 importedModules 白名单按需注入。
  *
- * 因此本地编译 = Babel 把 JSX/TS 转成 ES5 → 把 import 改写成 window 别名引用、
- * 把 export default 改写成画布入口 `YidaComp` → 正则抽出依赖包名。
+ * 因此本地编译 = Babel 把 JSX/TS 转成 JS → 把 import 改写成 window 别名引用、
+ * 把 export default 改写成画布入口 `YidaComp` → UglifyJS 压缩 → 正则抽出依赖包名。
  */
 
 const Babel = require('@babel/standalone');
 const globals = require('globals');
+const UglifyJS = require('uglify-js');
 const {
   assertNoEmojiInArtifactName,
   assertNoEmojiInText,
@@ -734,6 +735,36 @@ function assertCanvasRuntimeParseable(runtimeCode, options = {}) {
   }
 }
 
+/**
+ * 压缩画布运行态代码，并显式保留装配器读取的 YidaComp 入口名。
+ */
+function minifyCanvasRuntime(runtimeCode, options = {}) {
+  let result;
+  try {
+    result = UglifyJS.minify(runtimeCode, {
+      compress: true,
+      mangle: {
+        reserved: ['YidaComp'],
+      },
+    });
+  } catch (error) {
+    result = { error };
+  }
+  if (!result || result.error || typeof result.code !== 'string' || !result.code) {
+    const detail = result && result.error && result.error.message
+      ? result.error.message
+      : '压缩结果为空';
+    throw new CliError(`Code Canvas runtimeCode 压缩失败: ${detail}`, {
+      code: 'OPENYIDA_CANVAS_MINIFY_FAILED',
+      details: {
+        stage: 'canvas_minify',
+        sourcePath: options.sourcePath || '',
+      },
+    });
+  }
+  return result.code;
+}
+
 /**
  * 本地编译 Code Canvas 源码。
  * @param {string} source 原始 React/JSX/TSX 源码
@@ -839,11 +870,12 @@ function compileCanvasLocal(source, options = {}) {
     configFile: false,
   });
 
-  const runtimeCode = stage2.code || '';
-  assertNoEmojiInText(runtimeCode, {
+  const unminifiedRuntimeCode = stage2.code || '';
+  assertNoEmojiInText(unminifiedRuntimeCode, {
     artifact: options.sourcePath ? options.sourcePath + ' runtime' : 'Code Canvas runtime',
     code: 'OPENYIDA_CANVAS_SOURCE_EMOJI_FORBIDDEN',
   });
+  const runtimeCode = minifyCanvasRuntime(unminifiedRuntimeCode, options);
   assertCanvasRuntimeParseable(runtimeCode, options);
   return {
     runtimeCode,
@@ -910,6 +942,7 @@ module.exports = {
   resolveWindowAlias,
   shouldAllowUnsupportedBareImports,
   assertCanvasRuntimeParseable,
+  minifyCanvasRuntime,
   findBareDependencyGlobalIssues,
   MODULE_ALIAS_MAP,
 };

package/lib/app/display-page-readback.js

@@ -23,10 +23,30 @@ function fingerprint(value) {
   return crypto.createHash('sha256').update(normalized).digest('hex');
 }
 
+function rawFingerprint(value) {
+  if (typeof value !== 'string' || !value) {
+    return '';
+  }
+  return crypto.createHash('sha256').update(value, 'utf8').digest('hex');
+}
+
+function positiveSize(value) {
+  const size = Number(value);
+  return Number.isFinite(size) && size > 0 ? size : 0;
+}
+
+function sha256(value) {
+  const digest = String(value || '').toLowerCase();
+  return /^[a-f0-9]{64}$/.test(digest) ? digest : '';
+}
+
 function createEmptyDisplayInfo() {
   return {
     hasYidaCodeCanvas: false,
+    hasCodeBundle: false,
     hasNativeJsx: false,
+    codeBundleCount: 0,
+    bundleIds: [],
     runtimeCodeBytes: 0,
     sourceCodeBytes: 0,
     compiledCodeBytes: 0,
@@ -34,6 +54,8 @@ function createEmptyDisplayInfo() {
     componentCount: 0,
     canvasRuntimeCode: '',
     canvasSourceCode: '',
+    canvasRuntimeSha256: '',
+    canvasSourceSha256: '',
     nativeCompiledCode: '',
     nativeSourceCode: '',
   };
@@ -79,12 +101,37 @@ function traverseDisplayNodes(node, info) {
 
   if (node.componentName === 'YidaCodeCanvas') {
     const props = node.props || {};
+    const codeBundle = props.codeBundle && typeof props.codeBundle === 'object'
+      ? props.codeBundle
+      : null;
     info.hasYidaCodeCanvas = true;
     info.componentCount++;
-    info.canvasRuntimeCode = props.runtimeCode || '';
-    info.canvasSourceCode = props.code || '';
+    if (typeof props.runtimeCode === 'string' && props.runtimeCode) {
+      info.canvasRuntimeCode = props.runtimeCode;
+    }
+    if (typeof props.code === 'string' && props.code) {
+      info.canvasSourceCode = props.code;
+    }
     info.runtimeCodeBytes += codeBytes(props.runtimeCode);
     info.sourceCodeBytes += codeBytes(props.code);
+    if (codeBundle) {
+      const bundleId = String(codeBundle.bundleId || '');
+      const runtime = codeBundle.runtime && typeof codeBundle.runtime === 'object'
+        ? codeBundle.runtime
+        : {};
+      const source = codeBundle.source && typeof codeBundle.source === 'object'
+        ? codeBundle.source
+        : {};
+      info.hasCodeBundle = true;
+      info.codeBundleCount++;
+      if (bundleId && !info.bundleIds.includes(bundleId)) {
+        info.bundleIds.push(bundleId);
+      }
+      info.runtimeCodeBytes += positiveSize(runtime.size);
+      info.sourceCodeBytes += positiveSize(source.size);
+      info.canvasRuntimeSha256 = sha256(runtime.sha256) || info.canvasRuntimeSha256;
+      info.canvasSourceSha256 = sha256(source.sha256) || info.canvasSourceSha256;
+    }
     addImportedModules(info.importedModules, props.importedModules);
   } else if (node.componentName === 'Jsx') {
     info.hasNativeJsx = true;
@@ -133,7 +180,9 @@ function hasExpectedDisplayComponent(info, publishMode) {
     return false;
   }
   if (publishMode === 'canvas') {
-    return info.hasYidaCodeCanvas && info.runtimeCodeBytes > 0;
+    return info.hasYidaCodeCanvas && (
+      info.runtimeCodeBytes > 0 || !!info.canvasRuntimeSha256
+    );
   }
   return info.hasNativeJsx && info.compiledCodeBytes > 0;
 }
@@ -144,7 +193,10 @@ function summarizeDisplayPublishInfo(info) {
   }
   return {
     hasYidaCodeCanvas: info.hasYidaCodeCanvas,
+    hasCodeBundle: info.hasCodeBundle,
     hasNativeJsx: info.hasNativeJsx,
+    codeBundleCount: info.codeBundleCount,
+    bundleIds: info.bundleIds.slice(),
     runtimeCodeBytes: info.runtimeCodeBytes,
     sourceCodeBytes: info.sourceCodeBytes,
     compiledCodeBytes: info.compiledCodeBytes,
@@ -159,8 +211,13 @@ function verifyPublishedContentMatch(readbackSchema, expectedSchemaContent, publ
   const displayComponentPresent = hasExpectedDisplayComponent(readbackInfo, publishMode);
   const readbackArtifact = getPublishArtifact(readbackInfo, publishMode);
   const expectedArtifact = getPublishArtifact(expectedInfo, publishMode);
-  const readbackFingerprint = fingerprint(readbackArtifact);
-  const expectedFingerprint = fingerprint(expectedArtifact);
+  const codeBundleReadback = publishMode === 'canvas' && readbackInfo && readbackInfo.hasCodeBundle;
+  const readbackFingerprint = codeBundleReadback
+    ? readbackInfo.canvasRuntimeSha256
+    : fingerprint(readbackArtifact);
+  const expectedFingerprint = codeBundleReadback
+    ? rawFingerprint(expectedArtifact)
+    : fingerprint(expectedArtifact);
 
   return {
     readbackInfo,
@@ -180,6 +237,7 @@ function verifyPublishedContentMatch(readbackSchema, expectedSchemaContent, publ
 module.exports = {
   extractDisplayPublishInfo,
   fingerprint,
+  rawFingerprint,
   hasExpectedDisplayComponent,
   parseSchemaContent,
   summarizeDisplayPublishInfo,

package/lib/app/get-schema.js

@@ -9,6 +9,7 @@
 
 'use strict';
 
+const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 const {
@@ -16,6 +17,7 @@ const {
   triggerLogin,
   resolveBaseUrl,
   httpGet,
+  httpGetCodeBundleText,
   requestWithAutoLogin,
 } = require('../core/utils');
 const { t } = require('../core/i18n');
@@ -227,6 +229,122 @@ function resolveSchemaContent(schemaResult) {
   return parseJsonObject(content);
 }
 
+function validateCodeBundleDescriptor(codeBundle) {
+  const bundleId = String(codeBundle && codeBundle.bundleId || '');
+  const source = codeBundle && codeBundle.source;
+  const runtime = codeBundle && codeBundle.runtime;
+  const validSha256 = value => /^[a-f0-9]{64}$/.test(String(value || ''));
+  const validSize = value => Number.isFinite(Number(value)) && Number(value) > 0
+    && Number(value) <= 5 * 1024 * 1024;
+  if (!validSha256(bundleId)
+    || !source || !runtime
+    || !validSha256(source.sha256) || !validSize(source.size)
+    || !validSha256(runtime.sha256) || !validSize(runtime.size)
+    || Number(source.size) + Number(runtime.size) > 5 * 1024 * 1024) {
+    throw new Error('YidaCodeCanvas codeBundle 描述不合法');
+  }
+  return { bundleId, source, runtime };
+}
+
+function collectCodeBundleCanvases(content) {
+  const canvases = [];
+  function traverse(node) {
+    if (Array.isArray(node)) {
+      node.forEach(traverse);
+      return;
+    }
+    if (!node || typeof node !== 'object') {
+      return;
+    }
+    if (node.componentName === 'YidaCodeCanvas' && node.id && node.props
+      && node.props.codeBundle && typeof node.props.codeBundle === 'object') {
+      canvases.push({ props: node.props, descriptor: validateCodeBundleDescriptor(node.props.codeBundle) });
+    }
+    Object.values(node).forEach(traverse);
+  }
+  traverse(content);
+  return canvases;
+}
+
+async function downloadCodeBundleArtifact(appType, formUuid, bundleId, artifact, descriptor, authRef) {
+  let responseMetadata = null;
+  const expectedContentTypes = artifact === 'source'
+    ? ['text/plain']
+    : ['application/javascript', 'text/javascript', 'application/x-javascript'];
+  const value = await requestWithAutoLogin((auth) => httpGetCodeBundleText(
+    auth.baseUrl,
+    `/alibaba/web/${appType}/query/codeBundle/download.json`,
+    { formUuid, bundleId, artifact },
+    {
+      silentStatus: true,
+      maxBytes: 5 * 1024 * 1024,
+      expectedContentTypes,
+      onResponseMetadata: metadata => {
+        responseMetadata = metadata;
+      },
+    }
+  ), authRef);
+  if (typeof value !== 'string') {
+    const message = value && (value.errorMsg || value.message);
+    throw new Error(message || `下载 CodeBundle ${artifact} 失败`);
+  }
+  const size = Buffer.byteLength(value, 'utf8');
+  const digest = crypto.createHash('sha256').update(value, 'utf8').digest('hex');
+  if (size !== Number(descriptor.size) || digest !== descriptor.sha256) {
+    const context = responseMetadata && responseMetadata.context
+      ? responseMetadata.context
+      : `baseUrl=${authRef && authRef.baseUrl || 'unknown'}`;
+    const error = new Error(t('common.code_bundle_integrity_failed', artifact, context));
+    error.code = 'CODE_BUNDLE_INTEGRITY_MISMATCH';
+    error.details = {
+      artifact,
+      expectedSize: Number(descriptor.size),
+      actualSize: size,
+      expectedSha256: descriptor.sha256,
+      actualSha256: digest,
+      ...(responseMetadata || {}),
+    };
+    throw error;
+  }
+  return value;
+}
+
+async function resolveCodeBundleSchema(schemaResult, appType, formUuid, authRef) {
+  const content = resolveSchemaContent(schemaResult);
+  if (!content) {
+    return schemaResult;
+  }
+  const canvases = collectCodeBundleCanvases(content);
+  if (canvases.length === 0) {
+    return schemaResult;
+  }
+
+  const downloaded = new Map();
+  for (const canvas of canvases) {
+    const { bundleId, source, runtime } = canvas.descriptor;
+    let code = downloaded.get(bundleId);
+    if (!code) {
+      const [sourceCode, runtimeCode] = await Promise.all([
+        downloadCodeBundleArtifact(appType, formUuid, bundleId, 'source', source, authRef),
+        downloadCodeBundleArtifact(appType, formUuid, bundleId, 'runtime', runtime, authRef),
+      ]);
+      code = { sourceCode, runtimeCode };
+      downloaded.set(bundleId, code);
+    }
+    canvas.props.code = code.sourceCode;
+    canvas.props.runtimeCode = code.runtimeCode;
+    delete canvas.props.codeBundle;
+  }
+
+  if (schemaResult && Object.prototype.hasOwnProperty.call(schemaResult, 'content')) {
+    schemaResult.content = typeof schemaResult.content === 'string'
+      ? JSON.stringify(content)
+      : content;
+    return schemaResult;
+  }
+  return content;
+}
+
 function addImportedModules(target, value) {
   let modules = value;
   if (typeof modules === 'string') {
@@ -269,7 +387,10 @@ function extractDisplayPageSummary(schemaResult) {
 
   const displayPage = {
     hasYidaCodeCanvas: false,
+    hasCodeBundle: false,
     hasNativeJsx: false,
+    codeBundleCount: 0,
+    bundleIds: [],
     runtimeCodeBytes: 0,
     sourceCodeBytes: 0,
     compiledCodeBytes: 0,
@@ -291,10 +412,29 @@ function extractDisplayPageSummary(schemaResult) {
 
     if (node.componentName === 'YidaCodeCanvas' && isComponentInstance(node)) {
       const props = node.props || {};
+      const codeBundle = props.codeBundle && typeof props.codeBundle === 'object'
+        ? props.codeBundle
+        : null;
       displayPage.hasYidaCodeCanvas = true;
       displayPage.componentCount++;
       displayPage.runtimeCodeBytes += codeBytes(props.runtimeCode);
       displayPage.sourceCodeBytes += codeBytes(props.code);
+      if (codeBundle) {
+        const source = codeBundle.source && typeof codeBundle.source === 'object'
+          ? codeBundle.source
+          : {};
+        const runtime = codeBundle.runtime && typeof codeBundle.runtime === 'object'
+          ? codeBundle.runtime
+          : {};
+        const bundleId = String(codeBundle.bundleId || '');
+        displayPage.hasCodeBundle = true;
+        displayPage.codeBundleCount++;
+        displayPage.sourceCodeBytes += Number(source.size) || 0;
+        displayPage.runtimeCodeBytes += Number(runtime.size) || 0;
+        if (bundleId && !displayPage.bundleIds.includes(bundleId)) {
+          displayPage.bundleIds.push(bundleId);
+        }
+      }
       addImportedModules(displayPage.importedModules, props.importedModules);
     } else if (node.componentName === 'Jsx' && isComponentInstance(node)) {
       displayPage.hasNativeJsx = true;
@@ -581,12 +721,15 @@ async function mapLimit(items, limit, iterator) {
   return results;
 }
 
-async function fetchSchemaRecord(appType, form, authRef, retries) {
+async function fetchSchemaRecord(appType, form, authRef, retries, options = {}) {
   let lastError = null;
   for (let attempt = 0; attempt <= retries; attempt++) {
     try {
       const result = await fetchSchema(appType, form.formUuid, authRef);
       if (isSuccessfulSchemaResult(result)) {
+        const resolvedResult = options.resolveCodeBundles
+          ? await resolveCodeBundleSchema(result, appType, form.formUuid, authRef)
+          : result;
         const record = {
           formUuid: form.formUuid,
           formName: form.formName,
@@ -594,10 +737,10 @@ async function fetchSchemaRecord(appType, form, authRef, retries) {
           pathName: form.pathName,
           success: true,
           attempts: attempt + 1,
-          fieldSummary: extractFieldSummary(result),
-          schema: result,
+          fieldSummary: extractFieldSummary(resolvedResult),
+          schema: resolvedResult,
         };
-        const displayPage = extractDisplayPageSummary(result);
+        const displayPage = extractDisplayPageSummary(resolvedResult);
         if (displayPage) {
           record.displayPage = displayPage;
         }
@@ -694,6 +837,10 @@ async function runSingle(parsed, authRef) {
     throwCommandError(errorMsg);
   }
 
+  if (!parsed.field && !parsed.compact && !parsed.summaryJson) {
+    result = await resolveCodeBundleSchema(result, parsed.appType, parsed.formUuid, authRef);
+  }
+
   // 保留既有 --field 返回结构；新 contract 仅由 --compact / --resolve-fields 触发。
   if (parsed.field) {
     const allFieldNodes = collectFieldNodes(result);
@@ -782,7 +929,9 @@ async function runBatch(parsed, authRef) {
   info(`  批量获取 ${forms.length} 个表单 Schema，并发 ${parsed.concurrency}，重试 ${parsed.retries}`);
 
   const records = await mapLimit(forms, parsed.concurrency, async (form) => {
-    const record = await fetchSchemaRecord(parsed.appType, form, authRef, parsed.retries);
+    const record = await fetchSchemaRecord(parsed.appType, form, authRef, parsed.retries, {
+      resolveCodeBundles: !parsed.summaryJson,
+    });
     if (record.success && parsed.analysisJson) {
       record.semanticAnalysis = buildSemanticAnalysis(
         parsed.appType,
@@ -848,5 +997,9 @@ module.exports = {
   fetchSchemaRecord,
   collectFieldNodes,
   findFieldNode,
+  validateCodeBundleDescriptor,
+  collectCodeBundleCanvases,
+  downloadCodeBundleArtifact,
+  resolveCodeBundleSchema,
   run,
 };

package/lib/app/page-linter.js

@@ -15,6 +15,7 @@ const THEN_CALLBACK_LINE_LIMIT = 50;
 const CALLBACK_SCAN_LINE_LIMIT = 80;
 const parser = Babel.packages.parser;
 const traverse = Babel.packages.traverse.default || Babel.packages.traverse;
+const FORBIDDEN_SEARCH_FORM_DYNAMIC_ORDER_FIELDS = new Set(['gmtCreate']);
 
 const PARSER_OPTIONS = {
   sourceType: 'module',
@@ -404,6 +405,142 @@ function getNodeLine(node) {
   return node && node.loc && node.loc.start && node.loc.start.line ? node.loc.start.line : 1;
 }
 
+function getStaticPropertyName(property) {
+  if (!property || (property.type !== 'ObjectProperty' && property.type !== 'ObjectMethod')) {
+    return '';
+  }
+  const key = property.key;
+  if (!key) {
+    return '';
+  }
+  if (key.type === 'Identifier' && !property.computed) {
+    return key.name;
+  }
+  if (key.type === 'StringLiteral') {
+    return key.value;
+  }
+  return '';
+}
+
+function getMemberPropertyName(member) {
+  if (!member || (member.type !== 'MemberExpression' && member.type !== 'OptionalMemberExpression') || !member.property) {
+    return '';
+  }
+  if (member.property.type === 'Identifier' && !member.computed) {
+    return member.property.name;
+  }
+  if (member.property.type === 'StringLiteral') {
+    return member.property.value;
+  }
+  return '';
+}
+
+function getStaticStringValue(node) {
+  if (!node) {
+    return null;
+  }
+  if (node.type === 'StringLiteral') {
+    return node.value;
+  }
+  if (node.type === 'TemplateLiteral' && node.expressions.length === 0) {
+    return node.quasis.map(part => part.value.cooked || '').join('');
+  }
+  return null;
+}
+
+function unwrapJsonStringify(node) {
+  if (!node || node.type !== 'CallExpression' || !node.callee || node.callee.type !== 'MemberExpression') {
+    return node;
+  }
+  const object = node.callee.object;
+  if (object && object.type === 'Identifier' && object.name === 'JSON' && getMemberPropertyName(node.callee) === 'stringify') {
+    return node.arguments && node.arguments[0] ? node.arguments[0] : node;
+  }
+  return node;
+}
+
+function resolveStaticBinding(node, pathRef) {
+  if (!node || node.type !== 'Identifier' || !pathRef || !pathRef.scope) {
+    return node;
+  }
+  const binding = pathRef.scope.getBinding(node.name);
+  if (!binding || !binding.constant || !binding.path || binding.path.node.type !== 'VariableDeclarator') {
+    return node;
+  }
+  return binding.path.node.init || node;
+}
+
+function findForbiddenDynamicOrderFields(node, pathRef) {
+  const resolved = resolveStaticBinding(node, pathRef);
+  const value = resolveStaticBinding(unwrapJsonStringify(resolved), pathRef);
+  if (value && value.type === 'ObjectExpression') {
+    return value.properties
+      .map(getStaticPropertyName)
+      .filter(field => FORBIDDEN_SEARCH_FORM_DYNAMIC_ORDER_FIELDS.has(field));
+  }
+
+  const staticValue = getStaticStringValue(value);
+  if (staticValue === null) {
+    return [];
+  }
+  try {
+    const parsed = JSON.parse(staticValue);
+    if (!parsed || Array.isArray(parsed) || typeof parsed !== 'object') {
+      return [];
+    }
+    return Object.keys(parsed).filter(field => FORBIDDEN_SEARCH_FORM_DYNAMIC_ORDER_FIELDS.has(field));
+  } catch {
+    return [];
+  }
+}
+
+function findDynamicOrderProperty(params) {
+  if (!params || params.type !== 'ObjectExpression') {
+    return null;
+  }
+  return params.properties.find(property => getStaticPropertyName(property) === 'dynamicOrder') || null;
+}
+
+function reportForbiddenDynamicOrderValue(pathRef, value, issueNode, errors, disableMap) {
+  const forbiddenFields = findForbiddenDynamicOrderFields(value, pathRef);
+  if (forbiddenFields.length === 0) {
+    return;
+  }
+  pushIssue(
+    errors,
+    getNodeLine(issueNode),
+    'searchformdata-dynamic-order-metadata',
+    t('publish.lint_searchformdata_dynamic_order_metadata', forbiddenFields.join(', ')),
+    disableMap
+  );
+}
+
+function reportForbiddenDynamicOrder(pathRef, params, errors, disableMap) {
+  const resolvedParams = resolveStaticBinding(params, pathRef);
+  const dynamicOrderProperty = findDynamicOrderProperty(resolvedParams);
+  if (!dynamicOrderProperty) {
+    return;
+  }
+  reportForbiddenDynamicOrderValue(
+    pathRef,
+    dynamicOrderProperty.value,
+    dynamicOrderProperty,
+    errors,
+    disableMap
+  );
+}
+
+function isUrlSearchParamsInstance(node, pathRef) {
+  const resolved = resolveStaticBinding(node, pathRef);
+  return !!(
+    resolved &&
+    resolved.type === 'NewExpression' &&
+    resolved.callee &&
+    resolved.callee.type === 'Identifier' &&
+    resolved.callee.name === 'URLSearchParams'
+  );
+}
+
 function getJsxElementName(nameNode) {
   if (!nameNode) {
     return '';
@@ -633,6 +770,24 @@ function collectAstLintIssues(sourceCode, errors, warnings, disableMap) {
     },
     CallExpression(pathRef) {
       const callee = pathRef.node.callee;
+      if (getMemberPropertyName(callee) === 'searchFormDatas') {
+        const params = pathRef.node.arguments && pathRef.node.arguments[0];
+        reportForbiddenDynamicOrder(pathRef, params, errors, disableMap);
+      }
+
+      const urlSearchParamsMethod = getMemberPropertyName(callee);
+      if (
+        (urlSearchParamsMethod === 'append' || urlSearchParamsMethod === 'set') &&
+        callee &&
+        callee.type === 'MemberExpression' &&
+        isUrlSearchParamsInstance(callee.object, pathRef)
+      ) {
+        const args = pathRef.node.arguments || [];
+        if (getStaticStringValue(args[0]) === 'dynamicOrder') {
+          reportForbiddenDynamicOrderValue(pathRef, args[1], pathRef.node, errors, disableMap);
+        }
+      }
+
       const isSetState = callee &&
         callee.type === 'MemberExpression' &&
         (callee.object.type === 'ThisExpression' ||
@@ -670,6 +825,13 @@ function collectAstLintIssues(sourceCode, errors, warnings, disableMap) {
         pushIssue(warnings, getNodeLine(pathRef.node), 'setState-non-timestamp', t('publish.lint_setstate_non_timestamp'), disableMap);
       }
     },
+    NewExpression(pathRef) {
+      const callee = pathRef.node.callee;
+      if (callee && callee.type === 'Identifier' && callee.name === 'URLSearchParams') {
+        const params = pathRef.node.arguments && pathRef.node.arguments[0];
+        reportForbiddenDynamicOrder(pathRef, params, errors, disableMap);
+      }
+    },
     FunctionDeclaration(pathRef) {
       const id = pathRef.node.id;
       if (!id || id.name !== 'renderJsx') {