oxlint-plugin-react-doctor 0.5.8-dev.c72b560 → 0.5.8-dev.e2393c4

package/dist/index.js

@@ -1176,6 +1176,20 @@ const getImportSourceForName = (contextNode, localIdentifierName) => {
 	if (!lookup) return null;
 	return lookup.get(localIdentifierName)?.source ?? null;
 };
+const getImportBindingForName = (contextNode, localIdentifierName) => {
+	const info = getImportLookup(contextNode)?.get(localIdentifierName);
+	if (!info) return null;
+	if (info.isNamespace) return {
+		source: info.source,
+		exportedName: null,
+		isNamespace: true
+	};
+	return {
+		source: info.source,
+		exportedName: info.isDefault ? "default" : info.imported,
+		isNamespace: false
+	};
+};
 //#endregion
 //#region src/plugin/utils/find-variable-initializer.ts
 const FUNCTION_LIKE_TYPES$1 = new Set([
@@ -29473,6 +29487,19 @@ const REACT_NATIVE_TEXT_COMPONENTS = new Set([
 	"H5",
 	"H6"
 ]);
+const REACT_NATIVE_RAW_TEXT_HOST_COMPONENTS = new Set([
+	"View",
+	"ScrollView",
+	"SafeAreaView",
+	"KeyboardAvoidingView",
+	"ImageBackground",
+	"Modal",
+	"Pressable",
+	"TouchableOpacity",
+	"TouchableHighlight",
+	"TouchableWithoutFeedback",
+	"TouchableNativeFeedback"
+]);
 const REACT_NATIVE_TEXT_COMPONENT_KEYWORDS = new Set([
 	"Text",
 	"Title",
@@ -29485,7 +29512,11 @@ const REACT_NATIVE_TEXT_COMPONENT_KEYWORDS = new Set([
 	"Description",
 	"Body"
 ]);
-const REACT_NATIVE_TEXT_TRANSPARENT_COMPONENTS = new Set(["fbt", "fbs"]);
+const REACT_NATIVE_TEXT_TRANSPARENT_COMPONENTS = new Set([
+	"Fragment",
+	"fbt",
+	"fbs"
+]);
 const DEPRECATED_RN_MODULE_REPLACEMENTS = new Map([
 	["AsyncStorage", "@react-native-async-storage/async-storage"],
 	["Picker", "@react-native-picker/picker"],
@@ -30443,23 +30474,29 @@ const jsxRootForwardsChildrenIntoText = (jsxRoot, bindings, isTextHandlingElemen
 	return didForwardIntoText;
 };
 const isMeaningfulJsxChild = (child) => !isNodeOfType(child, "JSXText") || Boolean(child.value?.trim());
-const jsxRootRendersChildrenOutsideText = (jsxRoot, bindings, isTextHandlingElement) => {
-	let didRenderOutsideText = false;
+const jsxRootForwardsChildren = (jsxRoot, bindings, isTextHandlingElement, countsAsForwardTarget) => {
+	let didForward = false;
 	walkAst(jsxRoot, (node) => {
-		if (didRenderOutsideText || isFunctionNode(node)) return false;
+		if (didForward || isFunctionNode(node)) return false;
 		if (!isNodeOfType(node, "JSXElement") && !isNodeOfType(node, "JSXFragment")) return;
 		if (isNodeOfType(node, "JSXElement")) {
 			const elementName = resolveJsxElementName(node.openingElement);
 			if (elementName && isTextHandlingElement(elementName)) return false;
-			if (!(node.children ?? []).some(isMeaningfulJsxChild) && (node.openingElement.attributes ?? []).some((attribute) => isChildrenForwardingAttribute(attribute, bindings))) {
-				didRenderOutsideText = true;
+			if (!(node.children ?? []).some(isMeaningfulJsxChild) && countsAsForwardTarget(node) && (node.openingElement.attributes ?? []).some((attribute) => isChildrenForwardingAttribute(attribute, bindings))) {
+				didForward = true;
 				return;
 			}
 		}
-		didRenderOutsideText = (node.children ?? []).some((child) => isChildrenForwardingJsxChild(child, bindings));
+		if (countsAsForwardTarget(node) && (node.children ?? []).some((child) => isChildrenForwardingJsxChild(child, bindings))) didForward = true;
 	});
-	return didRenderOutsideText;
+	return didForward;
 };
+const jsxRootRendersChildrenOutsideText = (jsxRoot, bindings, isTextHandlingElement) => jsxRootForwardsChildren(jsxRoot, bindings, isTextHandlingElement, () => true);
+const jsxRootRendersChildrenIntoNonTextHost = (jsxRoot, bindings, isTextHandlingElement, isNonTextHostElement) => jsxRootForwardsChildren(jsxRoot, bindings, isTextHandlingElement, (node) => {
+	if (!isNodeOfType(node, "JSXElement")) return false;
+	const elementName = resolveJsxElementName(node.openingElement);
+	return elementName !== null && isNonTextHostElement(elementName);
+});
 const resolveStyledFactoryBaseName = (definitionNode) => {
 	let current = stripParenExpression(definitionNode);
 	while (current) {
@@ -30496,49 +30533,71 @@ const resolveClassRenderFunction = (classNode) => {
 	}
 	return null;
 };
-const recordWrapperFromDeclaration = (componentName, definitionNode, isTextHandlingElement, wrappers) => {
-	if (!componentName || !isReactComponentName(componentName)) return;
-	if (wrappers.has(componentName)) return;
-	if (!definitionNode) return;
+const classifyChildrenForwarding = (definitionNode, isTextHandlingElement, isNonTextHostElement) => {
 	const unwrapped = unwrapComponentDefinition(definitionNode);
 	const styledBaseName = resolveStyledFactoryBaseName(unwrapped);
-	if (styledBaseName && isTextHandlingElement(styledBaseName)) {
-		wrappers.add(componentName);
-		return;
+	if (styledBaseName) {
+		if (isTextHandlingElement(styledBaseName)) return "text";
+		if (isNonTextHostElement(styledBaseName)) return "nonText";
+		return "unknown";
 	}
 	const functionNode = resolveClassRenderFunction(unwrapped) ?? (isFunctionNode(unwrapped) ? unwrapped : null);
-	if (!functionNode) return;
+	if (!functionNode) return "unknown";
 	const bindings = resolveParamChildrenBindings(functionNode);
 	collectChildrenAliases(functionNode, bindings);
 	const jsxRoots = collectReturnedJsxRoots(functionNode);
-	if (jsxRoots.some((jsxRoot) => jsxRootRendersChildrenOutsideText(jsxRoot, bindings, isTextHandlingElement))) return;
+	if (jsxRoots.some((jsxRoot) => jsxRootRendersChildrenIntoNonTextHost(jsxRoot, bindings, isTextHandlingElement, isNonTextHostElement))) return "nonText";
+	if (jsxRoots.some((jsxRoot) => jsxRootRendersChildrenOutsideText(jsxRoot, bindings, isTextHandlingElement))) return "unknown";
 	for (const jsxRoot of jsxRoots) {
 		if (isNodeOfType(jsxRoot, "JSXElement")) {
 			const rootName = resolveJsxElementName(jsxRoot.openingElement);
-			if (rootName && isTextHandlingElement(rootName)) {
-				wrappers.add(componentName);
-				return;
-			}
-		}
-		if (jsxRootForwardsChildrenIntoText(jsxRoot, bindings, isTextHandlingElement)) {
-			wrappers.add(componentName);
-			return;
+			if (rootName && isTextHandlingElement(rootName)) return "text";
 		}
+		if (jsxRootForwardsChildrenIntoText(jsxRoot, bindings, isTextHandlingElement)) return "text";
 	}
+	return "unknown";
+};
+const recordWrapperFromDeclaration = (componentName, definitionNode, isTextHandlingElement, isNonTextHostElement, wrappers, nonTextWrappers) => {
+	if (!componentName || !isReactComponentName(componentName)) return;
+	if (wrappers.has(componentName)) return;
+	if (!definitionNode) return;
+	const kind = classifyChildrenForwarding(definitionNode, isTextHandlingElement, isNonTextHostElement);
+	if (kind === "text") wrappers.add(componentName);
+	else if (kind === "nonText") nonTextWrappers.add(componentName);
 };
 const MAX_TRANSITIVE_WRAPPER_PASSES = 3;
-const collectTextWrapperComponents = (programNode, isTextHandlingRoot) => {
+const collectTextWrapperComponents = (programNode, isTextHandlingRoot, isNonTextHostRoot) => {
 	const wrappers = /* @__PURE__ */ new Set();
+	const nonTextWrappers = /* @__PURE__ */ new Set();
 	const isTextHandlingElement = (elementName) => isTextHandlingRoot(elementName) || wrappers.has(elementName);
+	const isNonTextHostElement = (elementName) => isNonTextHostRoot(elementName) || nonTextWrappers.has(elementName);
+	const recordDeclaration = (componentName, definitionNode) => recordWrapperFromDeclaration(componentName, definitionNode, isTextHandlingElement, isNonTextHostElement, wrappers, nonTextWrappers);
 	for (let pass = 0; pass < MAX_TRANSITIVE_WRAPPER_PASSES; pass += 1) {
-		const sizeBeforePass = wrappers.size;
+		const wrappersSizeBeforePass = wrappers.size;
+		const nonTextSizeBeforePass = nonTextWrappers.size;
 		walkAst(programNode, (node) => {
-			if (isNodeOfType(node, "VariableDeclarator")) recordWrapperFromDeclaration(node.id && isNodeOfType(node.id, "Identifier") ? node.id.name : null, node.init, isTextHandlingElement, wrappers);
-			else if (isNodeOfType(node, "FunctionDeclaration") || isNodeOfType(node, "ClassDeclaration")) recordWrapperFromDeclaration(node.id && isNodeOfType(node.id, "Identifier") ? node.id.name : null, node, isTextHandlingElement, wrappers);
+			if (isNodeOfType(node, "VariableDeclarator")) recordDeclaration(node.id && isNodeOfType(node.id, "Identifier") ? node.id.name : null, node.init ?? null);
+			else if (isNodeOfType(node, "FunctionDeclaration") || isNodeOfType(node, "ClassDeclaration")) recordDeclaration(node.id && isNodeOfType(node.id, "Identifier") ? node.id.name : null, node);
 		});
-		if (wrappers.size === sizeBeforePass) break;
+		if (wrappers.size === wrappersSizeBeforePass && nonTextWrappers.size === nonTextSizeBeforePass) break;
 	}
-	return wrappers;
+	for (const wrapperName of wrappers) nonTextWrappers.delete(wrapperName);
+	return {
+		textWrappers: wrappers,
+		nonTextWrappers
+	};
+};
+//#endregion
+//#region src/plugin/rules/react-native/utils/resolve-imported-component-forwarding.ts
+const resolveImportedComponentForwarding = (contextNode, fromFilename, localName, isTextHandlingRoot, isNonTextHostRoot) => {
+	const binding = getImportBindingForName(contextNode, localName);
+	if (!binding || binding.isNamespace || binding.exportedName === null) return null;
+	const resolvedNode = resolveCrossFileFunctionExport(fromFilename, binding.source, binding.exportedName);
+	if (!resolvedNode) return null;
+	const moduleProgram = findProgramRoot(resolvedNode);
+	if (moduleProgram === null) return classifyChildrenForwarding(resolvedNode, isTextHandlingRoot, isNonTextHostRoot);
+	const { textWrappers, nonTextWrappers } = collectTextWrapperComponents(moduleProgram, isTextHandlingRoot, isNonTextHostRoot);
+	return classifyChildrenForwarding(resolvedNode, (elementName) => isTextHandlingRoot(elementName) || textWrappers.has(elementName), (elementName) => isNonTextHostRoot(elementName) || nonTextWrappers.has(elementName));
 };
 //#endregion
 //#region src/plugin/rules/react-native/utils/is-expo-ui-component-element.ts
@@ -30609,19 +30668,37 @@ const rnNoRawText = defineRule({
 	recommendation: "Text outside a `<Text>` component crashes on React Native. Wrap it like `<Text>{value}</Text>`.",
 	create: (context) => {
 		let isDomComponentFile = false;
-		let autoDetectedWrappers = /* @__PURE__ */ new Set();
+		let autoDetectedTextWrappers = /* @__PURE__ */ new Set();
+		let autoDetectedNonTextWrappers = /* @__PURE__ */ new Set();
+		const isNonTextHostName = (elementName) => !isReactComponentName(elementName) || REACT_NATIVE_RAW_TEXT_HOST_COMPONENTS.has(elementName);
+		const isRawTextReportTarget = (elementName) => elementName !== null && (isNonTextHostName(elementName) || autoDetectedNonTextWrappers.has(elementName));
+		const importedNonTextWrapperCache = /* @__PURE__ */ new Map();
+		const isImportedNonTextWrapper = (elementName, contextNode) => {
+			if (elementName === null || !isReactComponentName(elementName)) return false;
+			const { filename } = context;
+			if (filename === void 0) return false;
+			const cached = importedNonTextWrapperCache.get(elementName);
+			if (cached !== void 0) return cached;
+			const isNonTextWrapper = resolveImportedComponentForwarding(contextNode, filename, elementName, isTextHandlingComponent, isNonTextHostName) === "nonText";
+			importedNonTextWrapperCache.set(elementName, isNonTextWrapper);
+			return isNonTextWrapper;
+		};
 		return {
 			Program(programNode) {
 				isDomComponentFile = hasDirective(programNode, "use dom");
-				autoDetectedWrappers = collectTextWrapperComponents(programNode, isTextHandlingComponent);
+				const childrenForwarding = collectTextWrapperComponents(programNode, isTextHandlingComponent, isNonTextHostName);
+				autoDetectedTextWrappers = childrenForwarding.textWrappers;
+				autoDetectedNonTextWrappers = childrenForwarding.nonTextWrappers;
 			},
 			JSXElement(node) {
 				if (isDomComponentFile) return;
 				const elementName = resolveTextBoundaryName(node.openingElement);
-				if (elementName && (isTextHandlingComponent(elementName) || autoDetectedWrappers.has(elementName))) return;
+				if (elementName && (isTextHandlingComponent(elementName) || autoDetectedTextWrappers.has(elementName))) return;
 				if (isExpoUiComponentElement(node.openingElement, node, "ListItem")) return;
 				if (isInsidePlatformOsWebBranch(node)) return;
 				if (isTransparentTextWrapper(elementName) && isInsideTextHandlingComponent(node)) return;
+				if (!(node.children ?? []).some(isRawTextContent)) return;
+				if (!isRawTextReportTarget(elementName) && !isImportedNonTextWrapper(elementName, node)) return;
 				for (const child of node.children ?? []) {
 					if (!isRawTextContent(child)) continue;
 					context.report({
@@ -35864,22 +35941,6 @@ const isSupabaseMigrationPath = (relativePath) => /(?:^|\/)supabase\/(?:migratio
 //#endregion
 //#region src/plugin/rules/security-scan/utils/is-sql-path.ts
 const isSqlPath = (relativePath) => relativePath.endsWith(".sql") || isSupabaseMigrationPath(relativePath);
-const supabaseRlsPolicyRisk = defineRule({
-	id: "supabase-rls-policy-risk",
-	title: "Permissive Supabase RLS policy",
-	severity: "error",
-	recommendation: "Keep public-read policies explicit, but gate inserts, updates, deletes, and service-role bypasses behind `auth.uid()` plus trusted tenant membership.",
-	scan: scanByPattern({
-		shouldScan: (file) => isSqlPath(file.relativePath),
-		pattern: [
-			/disable\s+row\s+level\s+security/i,
-			/create\s+policy[\s\S]{0,700}auth\.role\(\)\s*=\s*["']service_role["']/i,
-			/create\s+policy[\s\S]{0,700}\bfor\s+(?:all|insert|update|delete)\b[\s\S]{0,500}\b(?:using|with\s+check)\s*\(\s*true\s*\)/i,
-			/create\s+policy(?:(?!\bfor\s+select\b)[\s\S]){0,700}\b(?:using|with\s+check)\s*\(\s*true\s*\)/i
-		],
-		message: "Supabase policy SQL disables RLS, permits writes broadly, or references a service-role bypass."
-	})
-});
 //#endregion
 //#region src/plugin/rules/security-scan/utils/sanitize-sql-for-scan.ts
 const DOLLAR_QUOTE_TAG_PATTERN = /^\$[A-Za-z_]?\w*\$/;
@@ -36056,6 +36117,60 @@ const sanitizeSqlForScan = (content) => {
 	return characters.join("");
 };
 //#endregion
+//#region src/plugin/rules/security-scan/supabase-rls-policy-risk.ts
+const DISABLED_RLS_PATTERN = /disable\s+row\s+level\s+security/i;
+const SERVICE_ROLE_BODY_BYPASS_PATTERN = /auth\.role\(\)\s*=\s*["']service_role["']/i;
+const CREATE_POLICY_PATTERN = /create\s+policy/gi;
+const STATEMENT_END_PATTERN = /;|create\s+policy/i;
+const PERMISSIVE_TRUE_PATTERN = /\b(?:using|with\s+check)\s*\(\s*true\s*\)/i;
+const FOR_SELECT_PATTERN = /\bfor\s+select\b/i;
+const TO_CLAUSE_PATTERN = /\bto\s+([\s\S]+?)(?=\s+(?:using|with\s+check|as|for)\b|;|$)/i;
+const SERVER_ONLY_ROLES = new Set([
+	"service_role",
+	"postgres",
+	"supabase_admin"
+]);
+const isServerOnlyScoped = (statement) => {
+	const toClause = TO_CLAUSE_PATTERN.exec(statement);
+	if (toClause === null) return false;
+	const roles = toClause[1].split(",").map((role) => role.trim().replace(/["'`]/g, "").toLowerCase()).filter(Boolean);
+	return roles.length > 0 && roles.every((role) => SERVER_ONLY_ROLES.has(role));
+};
+const isRiskyPolicyStatement = (statement, rawStatement) => {
+	if (SERVICE_ROLE_BODY_BYPASS_PATTERN.test(rawStatement)) return true;
+	if (!PERMISSIVE_TRUE_PATTERN.test(statement)) return false;
+	if (FOR_SELECT_PATTERN.test(statement)) return false;
+	return !isServerOnlyScoped(statement);
+};
+const POLICY_RISK_MESSAGE = "Supabase policy SQL disables RLS, permits writes broadly, or references a service-role bypass.";
+const supabaseRlsPolicyRisk = defineRule({
+	id: "supabase-rls-policy-risk",
+	title: "Permissive Supabase RLS policy",
+	severity: "error",
+	recommendation: "Keep public-read policies explicit, but gate inserts, updates, deletes, and service-role bypasses behind `auth.uid()` plus trusted tenant membership.",
+	scan: (file) => {
+		if (!isSqlPath(file.relativePath)) return [];
+		const content = sanitizeSqlForScan(file.content);
+		let earliestRiskIndex = content.search(DISABLED_RLS_PATTERN);
+		CREATE_POLICY_PATTERN.lastIndex = 0;
+		for (let policyMatch = CREATE_POLICY_PATTERN.exec(content); policyMatch !== null; policyMatch = CREATE_POLICY_PATTERN.exec(content)) {
+			const afterKeyword = policyMatch.index + policyMatch[0].length;
+			const terminatorOffset = content.slice(afterKeyword).search(STATEMENT_END_PATTERN);
+			const statementEnd = terminatorOffset < 0 ? content.length : afterKeyword + terminatorOffset;
+			if (!isRiskyPolicyStatement(content.slice(policyMatch.index, statementEnd), file.content.slice(policyMatch.index, statementEnd))) continue;
+			if (earliestRiskIndex < 0 || policyMatch.index < earliestRiskIndex) earliestRiskIndex = policyMatch.index;
+			break;
+		}
+		if (earliestRiskIndex < 0) return [];
+		const { line, column } = getLocationAtIndex(content, earliestRiskIndex);
+		return [{
+			message: POLICY_RISK_MESSAGE,
+			line,
+			column
+		}];
+	}
+});
+//#endregion
 //#region src/plugin/rules/security-scan/supabase-table-missing-rls.ts
 const CREATE_PUBLIC_TABLE_PATTERN = /create\s+(?:unlogged\s+)?table\s+(?:if\s+not\s+exists\s+)?(?!(?:auth|storage|realtime|vault|extensions|graphql|graphql_public|pgbouncer|net|supabase_functions|supabase_migrations|cron|pgsodium|pgmq|information_schema|pg_catalog|pg_temp|private|internal)\s*\.)(?:public\s*\.\s*)?["`]?([A-Za-z_][\w$]*)["`]?(?:\s*\(|\s+as\b)/gi;
 const enableRlsForTablePattern = (tableName) => new RegExp(`alter\\s+table\\s+(?:if\\s+exists\\s+)?(?:only\\s+)?(?:public\\s*\\.\\s*)?["\`]?${escapeRegExp(tableName)}["\`]?\\s+(?:force\\s+)?enable\\s+row\\s+level\\s+security`, "i");
@@ -42546,6 +42661,7 @@ const CROSS_FILE_RULE_IDS = new Set([
 	"nextjs-missing-metadata",
 	"nextjs-no-use-search-params-without-suspense",
 	"no-mutating-reducer-state",
+	"rn-no-raw-text",
 	"rn-prefer-expo-image"
 ]);
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oxlint-plugin-react-doctor",
-  "version": "0.5.8-dev.c72b560",
+  "version": "0.5.8-dev.e2393c4",
   "description": "React Doctor rules for oxlint.",
   "keywords": [
     "accessibility",