oxlint-plugin-react-doctor 0.5.8-dev.e2393c4 → 0.5.8-dev.f028d8b

package/dist/index.js

@@ -3,6 +3,48 @@ import * as fs from "node:fs";
 import { parseSync } from "oxc-parser";
 import { analyze } from "eslint-scope";
 import * as eslintVisitorKeys from "eslint-visitor-keys";
+//#region src/plugin/utils/has-type-property.ts
+const hasTypeProperty = (value) => Boolean(value && typeof value === "object" && "type" in value);
+//#endregion
+//#region src/plugin/utils/is-node-of-type.ts
+const isNodeOfType = (node, type) => Boolean(hasTypeProperty(node) && node.type === type);
+//#endregion
+//#region src/plugin/utils/non-react-jsx-dialect.ts
+const NON_REACT_JSX_DIALECT_PACKAGES = new Set([
+	"solid-js",
+	"solid-js/web",
+	"solid-js/store",
+	"solid-js/h",
+	"solid-js/html",
+	"@builder.io/qwik",
+	"@builder.io/qwik-city",
+	"@builder.io/qwik-react",
+	"voby",
+	"vidode"
+]);
+const NON_REACT_JSX_DIALECT_PACKAGE_PREFIXES = ["solid-js", "@builder.io/qwik"];
+const startsWithAny = (source, prefixes) => prefixes.some((prefix) => source === prefix || source.startsWith(`${prefix}/`));
+const fileImportsNonReactJsxDialect = (program) => {
+	for (const statement of program.body) {
+		if (!isNodeOfType(statement, "ImportDeclaration")) continue;
+		const source = statement.source;
+		const value = source && typeof source.value === "string" ? source.value : null;
+		if (!value) continue;
+		if (NON_REACT_JSX_DIALECT_PACKAGES.has(value)) return true;
+		if (startsWithAny(value, NON_REACT_JSX_DIALECT_PACKAGE_PREFIXES)) return true;
+	}
+	return false;
+};
+const jsxAttributeIsNonReactDialectMarker = (openingNode) => {
+	for (const attribute of openingNode.attributes) {
+		if (!isNodeOfType(attribute, "JSXAttribute")) continue;
+		if (!isNodeOfType(attribute.name, "JSXIdentifier")) continue;
+		if (attribute.name.name === "classList") return true;
+		if (attribute.name.name.startsWith("class:") || attribute.name.name.startsWith("bind:")) return true;
+	}
+	return false;
+};
+//#endregion
 //#region src/plugin/utils/is-testlike-filename.ts
 const NON_PRODUCTION_PATH_SEGMENTS = [
 	"/test/",
@@ -180,53 +222,10 @@ const isTestlikeFilename = (rawFilename) => {
 	return false;
 };
 //#endregion
-//#region src/plugin/utils/has-type-property.ts
-const hasTypeProperty = (value) => Boolean(value && typeof value === "object" && "type" in value);
-//#endregion
-//#region src/plugin/utils/is-node-of-type.ts
-const isNodeOfType = (node, type) => Boolean(hasTypeProperty(node) && node.type === type);
-//#endregion
-//#region src/plugin/utils/non-react-jsx-dialect.ts
-const NON_REACT_JSX_DIALECT_PACKAGES = new Set([
-	"solid-js",
-	"solid-js/web",
-	"solid-js/store",
-	"solid-js/h",
-	"solid-js/html",
-	"@builder.io/qwik",
-	"@builder.io/qwik-city",
-	"@builder.io/qwik-react",
-	"voby",
-	"vidode"
-]);
-const NON_REACT_JSX_DIALECT_PACKAGE_PREFIXES = ["solid-js", "@builder.io/qwik"];
-const startsWithAny = (source, prefixes) => prefixes.some((prefix) => source === prefix || source.startsWith(`${prefix}/`));
-const fileImportsNonReactJsxDialect = (program) => {
-	for (const statement of program.body) {
-		if (!isNodeOfType(statement, "ImportDeclaration")) continue;
-		const source = statement.source;
-		const value = source && typeof source.value === "string" ? source.value : null;
-		if (!value) continue;
-		if (NON_REACT_JSX_DIALECT_PACKAGES.has(value)) return true;
-		if (startsWithAny(value, NON_REACT_JSX_DIALECT_PACKAGE_PREFIXES)) return true;
-	}
-	return false;
-};
-const jsxAttributeIsNonReactDialectMarker = (openingNode) => {
-	for (const attribute of openingNode.attributes) {
-		if (!isNodeOfType(attribute, "JSXAttribute")) continue;
-		if (!isNodeOfType(attribute.name, "JSXIdentifier")) continue;
-		if (attribute.name.name === "classList") return true;
-		if (attribute.name.name.startsWith("class:") || attribute.name.name.startsWith("bind:")) return true;
-	}
-	return false;
-};
+//#region src/plugin/utils/skip-non-production-files.ts
+const skipNonProductionFiles = (create) => (context) => isTestlikeFilename(context.filename) ? {} : create(context);
 //#endregion
 //#region src/plugin/utils/define-rule.ts
-const wrapCreateForTestNoise = (create) => ((context) => {
-	if (isTestlikeFilename(context.filename)) return {};
-	return create(context);
-});
 const VISITOR_NODE_NAME_PATTERN = /^[A-Z]/;
 const wrapCreateForReactJsxOnly = (create) => ((context) => {
 	const innerVisitors = create(context);
@@ -273,7 +272,7 @@ const defineRule = (rule) => {
 	};
 	const tags = rule.tags;
 	let wrappedCreate = rule.create;
-	if (tags?.includes("test-noise") && !tags?.includes("migration-hint")) wrappedCreate = wrapCreateForTestNoise(wrappedCreate);
+	if (tags?.includes("test-noise") && !tags?.includes("migration-hint")) wrappedCreate = skipNonProductionFiles(wrappedCreate);
 	if (tags?.includes("react-jsx-only")) wrappedCreate = wrapCreateForReactJsxOnly(wrappedCreate);
 	if (wrappedCreate === rule.create) return rule;
 	return {
@@ -1428,6 +1427,14 @@ const NEXTJS_NAVIGATION_FUNCTIONS = new Set([
 	"forbidden",
 	"unauthorized"
 ]);
+const CACHE_REVALIDATION_FUNCTION_NAMES = new Set([
+	"revalidateTag",
+	"revalidatePath",
+	"expireTag",
+	"expirePath",
+	"unstable_expireTag",
+	"unstable_expirePath"
+]);
 const GOOGLE_FONTS_PATTERN = /fonts\.googleapis\.com/;
 const POLYFILL_SCRIPT_PATTERN = /polyfill\.io|polyfill\.min\.js|cdn\.polyfill/;
 const APP_DIRECTORY_PATTERN = /\/app\//;
@@ -4363,7 +4370,7 @@ const authTokenInWebStorage = defineRule({
 	title: "Auth token in web storage",
 	severity: "warn",
 	recommendation: "Don't persist auth tokens (JWTs, access/refresh tokens, secrets) in `localStorage`/`sessionStorage`; they're readable by any XSS. Use an `HttpOnly` cookie set by the server.",
-	create: (context) => ({
+	create: skipNonProductionFiles((context) => ({
 		CallExpression(node) {
 			const callee = node.callee;
 			if (!isNodeOfType(callee, "MemberExpression") || callee.computed) return;
@@ -4388,7 +4395,7 @@ const authTokenInWebStorage = defineRule({
 				message: MESSAGE$57
 			});
 		}
-	})
+	}))
 });
 //#endregion
 //#region src/plugin/rules/a11y/autocomplete-valid.ts
@@ -6735,7 +6742,7 @@ const TRANSPARENT_WRAPPER_TYPES = new Set([
 	"ParenthesizedExpression",
 	"ChainExpression"
 ]);
-const unwrapExpression$1 = (node) => {
+const unwrapExpression$2 = (node) => {
 	let current = node;
 	while (TRANSPARENT_WRAPPER_TYPES.has(current.type)) {
 		const inner = current.expression;
@@ -6842,7 +6849,7 @@ const symbolHasStableHookOrigin = (symbol) => {
 	if (!declarator || !isNodeOfType(declarator, "VariableDeclarator")) return false;
 	const initializerRaw = declarator.init;
 	if (!initializerRaw) return false;
-	const initializer = unwrapExpression$1(initializerRaw);
+	const initializer = unwrapExpression$2(initializerRaw);
 	if (symbol.kind === "const") {
 		if (isNodeOfType(initializer, "Literal") && (initializer.value === null || typeof initializer.value === "number" || typeof initializer.value === "string" || typeof initializer.value === "boolean")) return true;
 		if (isNodeOfType(initializer, "TemplateLiteral") && getStaticTemplateLiteralValue(initializer) !== null) return true;
@@ -6862,13 +6869,13 @@ const symbolHasStableHookOrigin = (symbol) => {
 	return false;
 };
 const symbolHasUseEffectEventOrigin = (symbol) => {
-	const initializer = symbol.initializer ? unwrapExpression$1(symbol.initializer) : null;
+	const initializer = symbol.initializer ? unwrapExpression$2(symbol.initializer) : null;
 	if (!initializer || !isNodeOfType(initializer, "CallExpression")) return false;
 	return getHookName(initializer.callee) === "useEffectEvent";
 };
 const getFunctionValueNode = (symbol) => {
 	if (symbol.kind === "function" && isNodeOfType(symbol.declarationNode, "FunctionDeclaration")) return symbol.declarationNode;
-	const initializer = symbol.initializer ? unwrapExpression$1(symbol.initializer) : null;
+	const initializer = symbol.initializer ? unwrapExpression$2(symbol.initializer) : null;
 	if (initializer && (isNodeOfType(initializer, "FunctionExpression") || isNodeOfType(initializer, "ArrowFunctionExpression"))) return initializer;
 	return null;
 };
@@ -7004,23 +7011,23 @@ const computeDepKey = (reference) => {
 	return fullName;
 };
 const computeDeclaredDepKey = (entry) => {
-	const stripped = unwrapExpression$1(entry);
+	const stripped = unwrapExpression$2(entry);
 	if (isNodeOfType(stripped, "Identifier")) return stripped.name;
 	if (isNodeOfType(stripped, "MemberExpression")) return stringifyMemberChain(stripped);
 	return null;
 };
 const depsArrayContainsIdentifier = (depsArgument, identifierName) => {
 	if (!depsArgument) return false;
-	const strippedDepsArgument = unwrapExpression$1(depsArgument);
+	const strippedDepsArgument = unwrapExpression$2(depsArgument);
 	if (!isNodeOfType(strippedDepsArgument, "ArrayExpression")) return false;
 	return strippedDepsArgument.elements.some((element) => {
 		if (!element) return false;
-		const strippedElement = unwrapExpression$1(element);
+		const strippedElement = unwrapExpression$2(element);
 		return isNodeOfType(strippedElement, "Identifier") && strippedElement.name === identifierName;
 	});
 };
 const stringifyMemberChain = (node) => {
-	const stripped = unwrapExpression$1(node);
+	const stripped = unwrapExpression$2(node);
 	if (isNodeOfType(stripped, "Identifier")) return stripped.name;
 	if (isNodeOfType(stripped, "ThisExpression")) return "this";
 	if (isNodeOfType(stripped, "MemberExpression")) {
@@ -7062,13 +7069,13 @@ const hasBroaderDeclaredDependency = (declaredKey, declaredKeys) => {
 	return false;
 };
 const getMemberRootIdentifier = (node) => {
-	const stripped = unwrapExpression$1(node);
+	const stripped = unwrapExpression$2(node);
 	if (isNodeOfType(stripped, "Identifier")) return stripped;
 	if (isNodeOfType(stripped, "MemberExpression")) return getMemberRootIdentifier(stripped.object);
 	return null;
 };
 const hasComputedMemberExpression = (node) => {
-	const stripped = unwrapExpression$1(node);
+	const stripped = unwrapExpression$2(node);
 	if (!isNodeOfType(stripped, "MemberExpression")) return false;
 	if (stripped.computed) return true;
 	return hasComputedMemberExpression(stripped.object);
@@ -7089,7 +7096,7 @@ const isRegExpLiteral = (node) => {
 };
 const isUnstableInitializer = (node) => {
 	if (!node) return false;
-	const stripped = unwrapExpression$1(node);
+	const stripped = unwrapExpression$2(node);
 	if (isRegExpLiteral(stripped)) return true;
 	if (isNodeOfType(stripped, "ConditionalExpression")) return isUnstableInitializer(stripped.consequent) || isUnstableInitializer(stripped.alternate);
 	if (isNodeOfType(stripped, "LogicalExpression")) return isUnstableInitializer(stripped.left) || isUnstableInitializer(stripped.right);
@@ -7245,7 +7252,7 @@ const hasMemberCallForRoot = (node, rootName) => {
 	const visit = (current) => {
 		if (didFindMemberCall) return;
 		if (isNodeOfType(current, "CallExpression")) {
-			if (getMemberRootIdentifier(unwrapExpression$1(current.callee))?.name === rootName) {
+			if (getMemberRootIdentifier(unwrapExpression$2(current.callee))?.name === rootName) {
 				didFindMemberCall = true;
 				return;
 			}
@@ -7308,7 +7315,7 @@ If the missing value is recreated every render, move it inside the hook or stabi
 				return;
 			}
 			const depsArgumentRaw = node.arguments[depsArgumentIndex];
-			const callbackExpression = unwrapExpression$1(callbackArgument);
+			const callbackExpression = unwrapExpression$2(callbackArgument);
 			let callbackToAnalyze = null;
 			const forcedCaptureKeys = /* @__PURE__ */ new Set();
 			if (isNodeOfType(callbackExpression, "ArrowFunctionExpression") || isNodeOfType(callbackExpression, "FunctionExpression")) callbackToAnalyze = callbackExpression;
@@ -7316,7 +7323,7 @@ If the missing value is recreated every render, move it inside the hook or stabi
 				const callbackSymbol = context.scopes.symbolFor(callbackExpression);
 				const functionValueNode = callbackSymbol ? getFunctionValueNode(callbackSymbol) : null;
 				if (functionValueNode) callbackToAnalyze = functionValueNode;
-				else if (callbackSymbol?.initializer && isNodeOfType(unwrapExpression$1(callbackSymbol.initializer), "CallExpression")) forcedCaptureKeys.add(callbackExpression.name);
+				else if (callbackSymbol?.initializer && isNodeOfType(unwrapExpression$2(callbackSymbol.initializer), "CallExpression")) forcedCaptureKeys.add(callbackExpression.name);
 				else if (depsArgumentRaw) {
 					if (depsArrayContainsIdentifier(depsArgumentRaw, callbackExpression.name)) return;
 					context.report({
@@ -7373,7 +7380,7 @@ If the missing value is recreated every render, move it inside the hook or stabi
 				});
 				return;
 			}
-			const depsArgument = unwrapExpression$1(depsArgumentRaw);
+			const depsArgument = unwrapExpression$2(depsArgumentRaw);
 			if (isNodeOfType(depsArgument, "Literal") && depsArgument.value === null || isNodeOfType(depsArgument, "Identifier") && depsArgument.name === "undefined") {
 				if (isAutoDependenciesHook(hookName)) return;
 				if (HOOKS_REQUIRING_DEPS_ARRAY.has(hookName)) {
@@ -7414,11 +7421,11 @@ If the missing value is recreated every render, move it inside the hook or stabi
 			for (const forcedCaptureKey of forcedCaptureKeys) captureKeys.add(forcedCaptureKey);
 			const hasLiteralDepElement = depsArgument.elements.some((element) => {
 				if (!element) return false;
-				return isLiteralOrEmptyTemplate(unwrapExpression$1(element));
+				return isLiteralOrEmptyTemplate(unwrapExpression$2(element));
 			});
 			const hasNonStringLiteralDep = depsArgument.elements.some((element) => {
 				if (!element) return false;
-				return isNonStringLiteral(unwrapExpression$1(element));
+				return isNonStringLiteral(unwrapExpression$2(element));
 			});
 			if (hasNonStringLiteralDep) context.report({
 				node: depsArgument,
@@ -7439,7 +7446,7 @@ If the missing value is recreated every render, move it inside the hook or stabi
 					});
 					continue;
 				}
-				const stripped = unwrapExpression$1(elementNode);
+				const stripped = unwrapExpression$2(elementNode);
 				if (isLiteralOrEmptyTemplate(stripped)) continue;
 				if (isNodeOfType(stripped, "Identifier")) {
 					const depSymbol = context.scopes.symbolFor(stripped);
@@ -18960,7 +18967,7 @@ const noEval = defineRule({
 	title: "eval() runs untrusted code strings",
 	severity: "error",
 	recommendation: "Use `JSON.parse` for data, or rewrite the code so it doesn't build and run code from strings.",
-	create: (context) => ({
+	create: skipNonProductionFiles((context) => ({
 		CallExpression(node) {
 			if (isNodeOfType(node.callee, "Identifier") && node.callee.name === "eval") {
 				context.report({
@@ -18980,7 +18987,7 @@ const noEval = defineRule({
 				message: "new Function() is a code-injection vulnerability: it builds & runs code from a string."
 			});
 		}
-	})
+	}))
 });
 //#endregion
 //#region src/plugin/rules/state-and-effects/no-event-handler.ts
@@ -27034,7 +27041,7 @@ const preferHtmlDialog = defineRule({
 });
 //#endregion
 //#region src/plugin/utils/function-returns-object-literal.ts
-const unwrapExpression = (node) => {
+const unwrapExpression$1 = (node) => {
 	let current = node;
 	for (;;) {
 		if ((current.type === "TSAsExpression" || current.type === "TSSatisfiesExpression" || current.type === "TSNonNullExpression") && "expression" in current && isAstNode(current.expression)) {
@@ -27047,7 +27054,7 @@ const unwrapExpression = (node) => {
 const doesFunctionReturnsObjectLiteral = (functionNode) => {
 	if (functionNode.type === "ArrowFunctionExpression" && "body" in functionNode) {
 		const body = functionNode.body;
-		if (body && body.type !== "BlockStatement") return unwrapExpression(body).type === "ObjectExpression";
+		if (body && body.type !== "BlockStatement") return unwrapExpression$1(body).type === "ObjectExpression";
 	}
 	const body = functionNode.body;
 	if (!body || body.type !== "BlockStatement") return false;
@@ -27055,7 +27062,7 @@ const doesFunctionReturnsObjectLiteral = (functionNode) => {
 	const visit = (node) => {
 		if (returnsObject) return;
 		if (node.type === "ReturnStatement" && "argument" in node && node.argument != null) {
-			if (unwrapExpression(node.argument).type === "ObjectExpression") returnsObject = true;
+			if (unwrapExpression$1(node.argument).type === "ObjectExpression") returnsObject = true;
 			return;
 		}
 		const nodeRecord = node;
@@ -35242,6 +35249,67 @@ const isAuthGuardName = (calleeName) => {
 	return false;
 };
 //#endregion
+//#region src/plugin/utils/is-non-privileged-server-action.ts
+const NON_DATA_EFFECT_FUNCTION_NAMES = new Set([...CACHE_REVALIDATION_FUNCTION_NAMES, ...NEXTJS_NAVIGATION_FUNCTIONS]);
+const isCacheOrNavigationCall = (node) => isNodeOfType(node, "CallExpression") && isNodeOfType(node.callee, "Identifier") && NON_DATA_EFFECT_FUNCTION_NAMES.has(node.callee.name);
+const unwrapExpression = (node) => {
+	let current = node;
+	while (current) {
+		if (isNodeOfType(current, "TSAsExpression") || isNodeOfType(current, "TSNonNullExpression") || isNodeOfType(current, "TSSatisfiesExpression") || isNodeOfType(current, "ChainExpression")) {
+			current = current.expression;
+			continue;
+		}
+		if (isNodeOfType(current, "SequenceExpression")) {
+			current = current.expressions?.[current.expressions.length - 1];
+			continue;
+		}
+		return current;
+	}
+	return null;
+};
+const isDataExposingValue = (node) => {
+	const value = unwrapExpression(node);
+	if (!value) return false;
+	if (isCacheOrNavigationCall(value)) return false;
+	return !isLiteralOnlyExpression(value);
+};
+const isLiteralOnlyExpression = (node) => {
+	if (!node) return false;
+	if (isNodeOfType(node, "Literal")) return true;
+	if (isNodeOfType(node, "TemplateLiteral")) return (node.expressions ?? []).every(isLiteralOnlyExpression);
+	if (isNodeOfType(node, "UnaryExpression")) return isLiteralOnlyExpression(node.argument);
+	if (isNodeOfType(node, "ArrayExpression")) return (node.elements ?? []).every((element) => element === null || !isNodeOfType(element, "SpreadElement") && isLiteralOnlyExpression(element));
+	if (isNodeOfType(node, "ObjectExpression")) return (node.properties ?? []).every((property) => isNodeOfType(property, "Property") && (!property.computed || isLiteralOnlyExpression(property.key)) && isLiteralOnlyExpression(property.value));
+	return false;
+};
+const getReturnedOrThrownArgument = (node) => {
+	if (isNodeOfType(node, "ReturnStatement")) return node.argument ?? null;
+	if (isNodeOfType(node, "ThrowStatement")) return node.argument ?? null;
+	return null;
+};
+const isDataExposingReturnOrThrow = (node) => isDataExposingValue(getReturnedOrThrownArgument(node));
+const isPrivilegedEffect = (node) => isNodeOfType(node, "CallExpression") || isNodeOfType(node, "TaggedTemplateExpression") || isNodeOfType(node, "NewExpression") || isNodeOfType(node, "AssignmentExpression") || isNodeOfType(node, "UpdateExpression") || isNodeOfType(node, "UnaryExpression") && node.operator === "delete" || isDataExposingReturnOrThrow(node);
+const isNonPrivilegedServerAction = (functionNode) => {
+	const functionBody = functionNode.body;
+	if (!functionBody) return false;
+	if (!isNodeOfType(functionBody, "BlockStatement") && isDataExposingValue(functionBody)) return false;
+	let hasNonDataEffectCall = false;
+	let hasPrivilegedEffect = false;
+	walkAst(functionBody, (child) => {
+		if (hasPrivilegedEffect) return false;
+		if (child !== functionBody && isFunctionLike$2(child)) return false;
+		if (isCacheOrNavigationCall(child)) {
+			hasNonDataEffectCall = true;
+			return;
+		}
+		if (isPrivilegedEffect(child)) {
+			hasPrivilegedEffect = true;
+			return false;
+		}
+	});
+	return hasNonDataEffectCall && !hasPrivilegedEffect;
+};
+//#endregion
 //#region src/plugin/rules/server/server-auth-actions.ts
 const isAsyncFunctionLikeNode = (node) => {
 	if (!node) return false;
@@ -35316,6 +35384,7 @@ const getAuthScanRoots = (functionNode) => {
 const inspectServerAction = (candidate, fileHasUseServerDirective, allowedFunctionNames, context) => {
 	if (!(fileHasUseServerDirective || hasUseServerDirective(candidate.functionNode))) return;
 	if (containsAuthCheck(getAuthScanRoots(candidate.functionNode), allowedFunctionNames, GENERIC_AUTH_METHOD_NAMES)) return;
+	if (isNonPrivilegedServerAction(candidate.functionNode)) return;
 	context.report({
 		node: candidate.reportNode,
 		message: `Anyone can call server action "${candidate.displayName}" without logging in, since it has no auth check.`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oxlint-plugin-react-doctor",
-  "version": "0.5.8-dev.e2393c4",
+  "version": "0.5.8-dev.f028d8b",
   "description": "React Doctor rules for oxlint.",
   "keywords": [
     "accessibility",