oxlint-plugin-react-doctor 0.7.5-dev.3075e10 → 0.7.5-dev.3afd146

package/dist/index.js

@@ -397,6 +397,7 @@ const isProductionFilePath = (relativePath, sourceFilePattern) => {
 //#endregion
 //#region src/plugin/rules/security-scan/utils/is-production-source-path.ts
 const isProductionSourcePath = (relativePath) => {
+	if (/\.d\.[cm]?[jt]s$/i.test(relativePath)) return false;
 	return isProductionFilePath(relativePath, SOURCE_FILE_PATTERN);
 };
 //#endregion
@@ -5178,8 +5179,10 @@ const STORAGE_GLOBALS = new Set([
 const SENSITIVE_KEY_PATTERN = /token|jwt|secret|password|passwd|credential|api[-_]?key|bearer|private[-_]?key/i;
 const NON_AUTH_TOKEN_PATTERN = /csrf|xsrf|device|fcm|apns|push|design|tokeniz|syntax|css|theme|color/i;
 const STRONG_AUTH_KEY_PATTERN = /jwt|secret|password|passwd|credential|private[-_]?key|api[-_]?key|bearer|access[-_]?token|refresh[-_]?token|auth[-_]?token|id[-_]?token|session/i;
+const PRODUCT_API_KEY_RECORDS_PATTERN = /(?:^|[._:-])(?:created|saved|integration|mailing)[-_]?api[-_]?keys$/i;
 const PRODUCT_API_KEY_COLLECTION_PATTERN = /[._:-](?:created|generated|saved)[-_]?api[-_]?keys$/i;
 const isAuthCredentialKey = (key) => {
+	if (PRODUCT_API_KEY_RECORDS_PATTERN.test(key)) return false;
 	if (!SENSITIVE_KEY_PATTERN.test(key)) return false;
 	if (PRODUCT_API_KEY_COLLECTION_PATTERN.test(key)) return false;
 	if (NON_AUTH_TOKEN_PATTERN.test(key) && !STRONG_AUTH_KEY_PATTERN.test(key)) return false;
@@ -6868,11 +6871,10 @@ const getTemplateInterpolations = (valueTail) => {
 	const interpolations = valueTail.slice(1, closingBacktickIndex).match(/\$\{[^}]*\}/g);
 	return interpolations === null ? "" : interpolations.join(" ");
 };
-const getIdentifierDeclarationInitializer = (identifier, fileContent) => {
-	const declarationMatch = new RegExp(`(?:const|let|var)\\s+${escapeRegExp(identifier)}\\s*(?::[^=\\n]{0,120})?=\\s*`).exec(fileContent);
-	if (declarationMatch === null) return null;
-	const initializerStartIndex = declarationMatch.index + declarationMatch[0].length;
-	return fileContent.slice(initializerStartIndex, initializerStartIndex + STATIC_TEMPLATE_MAX_CHARS);
+const getIdentifierDeclarationInitializer = (identifier, sinkIndex, fileContent) => {
+	const declaration = findVisibleIdentifierDeclaration(identifier, sinkIndex, fileContent);
+	if (declaration === null) return null;
+	return fileContent.slice(declaration.initializerStartIndex, declaration.initializerStartIndex + STATIC_TEMPLATE_MAX_CHARS);
 };
 const isPureStringLiteralConcat = (initializerText) => {
 	if (!/^["']/.test(initializerText)) return false;
@@ -6942,6 +6944,153 @@ const isAllOperandsDomContentConcat = (valueExpression) => {
 		return !HTML_TAINT_PATTERN.test(withoutCast.replace(DOM_CONTENT_SOURCE_VALUE_PATTERN, ""));
 	});
 };
+const findMatchingBraceIndex = (fileContent, openingBraceIndex) => {
+	let depth = 0;
+	let quote = null;
+	for (let index = openingBraceIndex; index < fileContent.length; index += 1) {
+		const character = fileContent[index];
+		if (quote !== null) {
+			if (character === quote && fileContent[index - 1] !== "\\") quote = null;
+			continue;
+		}
+		if (character === "\"" || character === "'" || character === "`") {
+			quote = character;
+			continue;
+		}
+		if (character === "{") depth += 1;
+		if (character === "}") {
+			depth -= 1;
+			if (depth === 0) return index;
+		}
+	}
+	return fileContent.length;
+};
+const findContainingBlockEndIndex = (fileContent, targetIndex) => {
+	const openingBraceIndexes = [];
+	let quote = null;
+	let isLineComment = false;
+	let isBlockComment = false;
+	for (let index = 0; index < targetIndex; index += 1) {
+		const character = fileContent[index];
+		const nextCharacter = fileContent[index + 1];
+		if (isLineComment) {
+			if (character === "\n") isLineComment = false;
+			continue;
+		}
+		if (isBlockComment) {
+			if (character === "*" && nextCharacter === "/") {
+				isBlockComment = false;
+				index += 1;
+			}
+			continue;
+		}
+		if (quote !== null) {
+			if (character === quote && fileContent[index - 1] !== "\\") quote = null;
+			continue;
+		}
+		if (character === "/" && nextCharacter === "/") {
+			isLineComment = true;
+			index += 1;
+			continue;
+		}
+		if (character === "/" && nextCharacter === "*") {
+			isBlockComment = true;
+			index += 1;
+			continue;
+		}
+		if (character === "\"" || character === "'" || character === "`") {
+			quote = character;
+			continue;
+		}
+		if (character === "{") openingBraceIndexes.push(index);
+		if (character === "}") openingBraceIndexes.pop();
+	}
+	const openingBraceIndex = openingBraceIndexes.at(-1);
+	return openingBraceIndex === void 0 ? fileContent.length : findMatchingBraceIndex(fileContent, openingBraceIndex);
+};
+const findVisibleIdentifierDeclaration = (identifier, sinkIndex, fileContent) => {
+	const initializerPattern = new RegExp(`(?:const|let|var)\\s+${escapeRegExp(identifier)}\\s*(?::[^=\\n]*)?=\\s*([^;\\n]+)`, "g");
+	let nearestDeclaration = null;
+	let nearestDeclarationIndex = -1;
+	for (const match of fileContent.matchAll(initializerPattern)) {
+		const declarationIndex = match.index;
+		if (declarationIndex === void 0 || declarationIndex >= sinkIndex || declarationIndex <= nearestDeclarationIndex || findContainingBlockEndIndex(fileContent, declarationIndex) < sinkIndex) continue;
+		nearestDeclarationIndex = declarationIndex;
+		const initializer = match[1];
+		if (initializer === void 0) continue;
+		nearestDeclaration = {
+			initializer,
+			initializerStartIndex: declarationIndex + match[0].length - initializer.length
+		};
+	}
+	return nearestDeclaration;
+};
+const findContainingFunctionParameterSource = (identifier, sinkIndex, fileContent) => {
+	const patterns = [/function\s+([\w$]+)\s*\(([^)]*)\)\s*\{/g, /(?:const|let|var)\s+([\w$]+)\s*=\s*(?:async\s*)?\(([^)]*)\)\s*=>\s*\{/g];
+	let closestSource = null;
+	let closestStartIndex = -1;
+	for (const pattern of patterns) for (const match of fileContent.matchAll(pattern)) {
+		const matchIndex = match.index;
+		if (matchIndex === void 0 || matchIndex >= sinkIndex || matchIndex < closestStartIndex) continue;
+		if (findMatchingBraceIndex(fileContent, matchIndex + match[0].lastIndexOf("{")) < sinkIndex) continue;
+		const parameterIndex = (match[2] ?? "").split(",").findIndex((parameter) => parameter.trim().match(/^(?:\.\.\.)?([\w$]+)/)?.[1] === identifier);
+		if (parameterIndex < 0) continue;
+		closestStartIndex = matchIndex;
+		closestSource = {
+			functionName: match[1] ?? "",
+			parameterIndex
+		};
+	}
+	return closestSource;
+};
+const splitTopLevelArguments = (argumentText) => {
+	const argumentsList = [];
+	let startIndex = 0;
+	let depth = 0;
+	let quote = null;
+	for (let index = 0; index < argumentText.length; index += 1) {
+		const character = argumentText[index];
+		if (quote !== null) {
+			if (character === quote && argumentText[index - 1] !== "\\") quote = null;
+			continue;
+		}
+		if (character === "\"" || character === "'" || character === "`") {
+			quote = character;
+			continue;
+		}
+		if (character === "(" || character === "[" || character === "{") depth += 1;
+		if (character === ")" || character === "]" || character === "}") depth -= 1;
+		if (character === "," && depth === 0) {
+			argumentsList.push(argumentText.slice(startIndex, index).trim());
+			startIndex = index + 1;
+		}
+	}
+	argumentsList.push(argumentText.slice(startIndex).trim());
+	return argumentsList;
+};
+const isHtmlTainted = (expression, fileContent, sinkIndex, visitedIdentifiers) => {
+	const trimmedExpression = expression.trim();
+	if (STRING_LITERAL_VALUE_PATTERN.test(`${trimmedExpression};`)) return false;
+	if (MODULE_CONSTANT_VALUE_PATTERN.test(`${trimmedExpression};`)) return false;
+	if (SANITIZER_PATTERN.test(trimmedExpression)) return false;
+	if (ENV_CONFIG_VALUE_PATTERN.test(trimmedExpression)) return false;
+	if (I18N_VALUE_PATTERN.test(trimmedExpression)) return false;
+	if (ESCAPING_SERIALIZER_CALL_PATTERN.test(trimmedExpression)) return false;
+	if (HTML_TAINT_PATTERN.test(trimmedExpression)) return true;
+	const identifier = trimmedExpression.match(/^([\w$]+)\s*(?:[;,})\n]|$)/)?.[1];
+	if (identifier === void 0 || visitedIdentifiers.has(identifier)) return false;
+	visitedIdentifiers.add(identifier);
+	const declaration = findVisibleIdentifierDeclaration(identifier, sinkIndex, fileContent);
+	if (declaration !== null && isHtmlTainted(declaration.initializer, fileContent, sinkIndex, visitedIdentifiers)) return true;
+	const parameterSource = findContainingFunctionParameterSource(identifier, sinkIndex, fileContent);
+	if (parameterSource === null || parameterSource.functionName.length === 0) return false;
+	const callPattern = new RegExp(`\\b${escapeRegExp(parameterSource.functionName)}\\s*\\(([^)]*)\\)`, "g");
+	for (const callMatch of fileContent.matchAll(callPattern)) {
+		const argument = splitTopLevelArguments(callMatch[1] ?? "")[parameterSource.parameterIndex];
+		if (argument !== void 0 && isHtmlTainted(argument, fileContent, sinkIndex, new Set(visitedIdentifiers))) return true;
+	}
+	return false;
+};
 const dangerousHtmlSink = defineRule({
 	id: "dangerous-html-sink",
 	title: "HTML injection sink with dynamic content",
@@ -6968,6 +7117,7 @@ const dangerousHtmlSink = defineRule({
 			const valueTail = fullValueTail.slice(0, VALUE_EXPRESSION_MAX_CHARS);
 			const terminatorIndex = valueTail.search(/[;}]/);
 			const valueExpression = terminatorIndex >= 0 ? valueTail.slice(0, terminatorIndex + 1) : valueTail;
+			const sinkIndex = lines.slice(0, lineIndex).join("\n").length + (lineIndex > 0 ? 1 : 0) + line.search(DANGEROUS_HTML_PATTERN);
 			if (STRING_LITERAL_VALUE_PATTERN.test(valueExpression)) continue;
 			if (MODULE_CONSTANT_VALUE_PATTERN.test(valueExpression)) continue;
 			if (DOM_CONTENT_SOURCE_VALUE_PATTERN.test(valueExpression) && !valueExpression.includes("+")) {
@@ -6979,7 +7129,7 @@ const dangerousHtmlSink = defineRule({
 			let templateInterpolations = getTemplateInterpolations(longValueTail ?? fullValueTail);
 			const valueIdentifier = BARE_IDENTIFIER_VALUE_PATTERN.test(valueExpression) || MEMBER_OR_INDEX_ACCESS_VALUE_PATTERN.test(valueExpression) || IDENTIFIER_WITH_LITERAL_FALLBACK_PATTERN.test(valueExpression) ? valueExpression.match(/^[\w$]+/)?.[0] : void 0;
 			if (templateInterpolations === null && valueIdentifier !== void 0 && BARE_IDENTIFIER_VALUE_PATTERN.test(valueExpression)) {
-				const declarationInitializer = getIdentifierDeclarationInitializer(valueIdentifier, file.content);
+				const declarationInitializer = getIdentifierDeclarationInitializer(valueIdentifier, sinkIndex, file.content);
 				if (declarationInitializer !== null) {
 					if (isPureStringLiteralConcat(declarationInitializer)) continue;
 					templateInterpolations = getTemplateInterpolations(declarationInitializer);
@@ -6990,7 +7140,7 @@ const dangerousHtmlSink = defineRule({
 			if (SANITIZER_PATTERN.test(judgedExpression)) continue;
 			if (ENV_CONFIG_VALUE_PATTERN.test(judgedExpression)) continue;
 			if (I18N_VALUE_PATTERN.test(judgedExpression)) continue;
-			if (!HTML_TAINT_PATTERN.test(judgedExpression)) continue;
+			if (!isHtmlTainted(judgedExpression, file.content, sinkIndex, /* @__PURE__ */ new Set())) continue;
 			if (ESCAPING_SERIALIZER_CALL_PATTERN.test(valueExpression)) continue;
 			if (/highlighted/i.test(valueExpression)) continue;
 			if (/highlight/i.test(valueExpression) && HIGHLIGHTER_LIBRARY_PATTERN.test(file.content)) continue;
@@ -7737,9 +7887,9 @@ const isImportedFromReact = (symbol) => {
 	const importDeclaration = symbol.declarationNode.parent;
 	return Boolean(importDeclaration && isNodeOfType(importDeclaration, "ImportDeclaration") && typeof importDeclaration.source.value === "string" && REACT_RUNTIME_MODULE_SOURCES.has(importDeclaration.source.value));
 };
-const isNamedReactApiImport = (identifier, apiNames, scopes) => {
+const isNamedReactApiImport = (identifier, apiNames, scopes, resolveAliases) => {
 	if (!isNodeOfType(identifier, "Identifier")) return false;
-	const symbol = scopes.symbolFor(identifier);
+	const symbol = resolveAliases ? resolveConstIdentifierAlias(identifier, scopes) : scopes.symbolFor(identifier);
 	if (!symbol || !isImportedFromReact(symbol)) return false;
 	const importedName = getImportedName(symbol.declarationNode);
 	return Boolean(importedName && includesApiName(apiNames, importedName));
@@ -7753,7 +7903,7 @@ const isReactApiCall = (node, apiNames, scopes, options = {}) => {
 	if (!isNodeOfType(node, "CallExpression")) return false;
 	const callee = stripParenExpression(node.callee);
 	if (isNodeOfType(callee, "Identifier")) {
-		if (isNamedReactApiImport(callee, apiNames, scopes)) return true;
+		if (isNamedReactApiImport(callee, apiNames, scopes, Boolean(options.resolveNamedAliases))) return true;
 		return Boolean(options.allowUnboundBareCalls && includesApiName(apiNames, callee.name) && scopes.isGlobalReference(callee));
 	}
 	if (!isNodeOfType(callee, "MemberExpression") || callee.computed || !isNodeOfType(callee.property, "Identifier") || !includesApiName(apiNames, callee.property.name)) return false;
@@ -10962,6 +11112,11 @@ If the missing value is recreated every render, move it inside the hook or stabi
 		return { CallExpression(node) {
 			const hookName = getHookName(node.callee, context.scopes);
 			if (!hookName || !isHookOfInterest(hookName, node.callee)) return;
+			if (HOOKS_REQUIRING_DEPS_MATCH.has(hookName) && !isReactApiCall(node, HOOKS_REQUIRING_DEPS_MATCH, context.scopes, {
+				allowGlobalReactNamespace: true,
+				allowUnboundBareCalls: true,
+				resolveNamedAliases: true
+			})) return;
 			const callbackArgumentIndex = getCallbackArgumentIndex(hookName);
 			const depsArgumentIndex = getDepsArgumentIndex(hookName);
 			const callbackArgument = node.arguments[callbackArgumentIndex];
@@ -23998,6 +24153,26 @@ const STATEFUL_HTML_DESCENDANT_TAGS = new Set([
 	"dialog",
 	"canvas"
 ]);
+const STATEFUL_HTML_ATTRIBUTE_NAMES = new Set([
+	"autofocus",
+	"contenteditable",
+	"draggable",
+	"tabindex"
+]);
+const isStaticallyFalseAttributeValue = (attribute) => {
+	if (!isNodeOfType(attribute, "JSXAttribute") || !attribute.value) return false;
+	const value = isNodeOfType(attribute.value, "JSXExpressionContainer") ? attribute.value.expression : attribute.value;
+	return isNodeOfType(value, "Literal") && (value.value === false || value.value === "false");
+};
+const hasStatefulHtmlAttribute = (openingElement) => {
+	if (!isNodeOfType(openingElement, "JSXOpeningElement")) return false;
+	return openingElement.attributes.some((attribute) => {
+		if (!isNodeOfType(attribute, "JSXAttribute") || !isNodeOfType(attribute.name, "JSXIdentifier")) return false;
+		const attributeName = attribute.name.name.toLowerCase();
+		if (!STATEFUL_HTML_ATTRIBUTE_NAMES.has(attributeName)) return false;
+		return attributeName === "tabindex" || !isStaticallyFalseAttributeValue(attribute);
+	});
+};
 const STATEFUL_DESCENDANT_SCAN_BUDGET = 200;
 const rootIdentifierNameOf = (expression) => {
 	let object = expression;
@@ -24015,7 +24190,8 @@ const containsStatefulDescendant = (jsxElement, options = {}) => {
 		budget -= 1;
 		const node = stack.pop();
 		if (isNodeOfType(node, "JSXElement")) {
-			const name = node.openingElement.name;
+			const opening = node.openingElement;
+			const name = opening.name;
 			if (name && isNodeOfType(name, "JSXIdentifier")) {
 				const tagName = name.name;
 				const firstChar = tagName.charCodeAt(0);
@@ -24023,6 +24199,7 @@ const containsStatefulDescendant = (jsxElement, options = {}) => {
 				if (STATEFUL_HTML_DESCENDANT_TAGS.has(tagName)) return true;
 			}
 			if (name && isNodeOfType(name, "JSXMemberExpression")) return true;
+			if (hasStatefulHtmlAttribute(opening)) return true;
 			const children = node.children ?? [];
 			for (const child of children) stack.push(child);
 			continue;
@@ -24582,6 +24759,14 @@ const templateHasOuterMemberIdentity = (template, bindingFunction) => {
 	}
 	return false;
 };
+const findBareItemNamesReferencedByTemplate = (template, itemNames) => {
+	const referencedItemNames = /* @__PURE__ */ new Set();
+	for (const expression of template.expressions ?? []) {
+		const unwrappedExpression = stripParenExpression(expression);
+		if (isNodeOfType(unwrappedExpression, "Identifier") && itemNames.has(unwrappedExpression.name)) referencedItemNames.add(unwrappedExpression.name);
+	}
+	return referencedItemNames;
+};
 const forLoopTestReadsDataLength = (test) => {
 	let didFindLengthRead = false;
 	walkAst(test, (child) => {
@@ -24718,9 +24903,11 @@ const noArrayIndexAsKey = defineRule({
 				} else if (STATELESS_HTML_LEAF_TAGS.has(elementName.name)) {
 					const jsxElement = openingElement.parent;
 					if (jsxElement && isNodeOfType(jsxElement, "JSXElement")) {
+						const isInlineTextRun = INLINE_TEXT_LEAF_TAGS.has(elementName.name);
+						const primitiveItemNames = keyTemplate ? findBareItemNamesReferencedByTemplate(keyTemplate, itemNames) : EMPTY_NAME_SET;
 						if (!containsStatefulDescendant(jsxElement, {
-							memberRootNames: INLINE_TEXT_LEAF_TAGS.has(elementName.name) ? itemNames : EMPTY_NAME_SET,
-							bareIdentifierNames: derivedNames
+							memberRootNames: isInlineTextRun ? itemNames : EMPTY_NAME_SET,
+							bareIdentifierNames: primitiveItemNames.size > 0 ? new Set([...derivedNames, ...primitiveItemNames]) : derivedNames
 						})) return;
 					}
 				}
@@ -24888,7 +25075,11 @@ const noAsyncEffectCallback = defineRule({
 	severity: "warn",
 	recommendation: "Don't make the effect callback `async`. Define an async function inside the effect and call it, then return a real cleanup function if you need one.",
 	create: (context) => ({ CallExpression(node) {
-		if (!isHookCall$2(node, EFFECT_HOOK_NAMES$1)) return;
+		if (!isReactApiCall(node, EFFECT_HOOK_NAMES$1, context.scopes, {
+			allowGlobalReactNamespace: true,
+			allowUnboundBareCalls: true,
+			resolveNamedAliases: true
+		})) return;
 		const callback = getEffectCallback(node);
 		if (!callback) return;
 		if (!isNodeOfType(callback, "ArrowFunctionExpression") && !isNodeOfType(callback, "FunctionExpression")) return;
@@ -30169,7 +30360,11 @@ const noFetchInEffect = defineRule({
 	severity: "warn",
 	recommendation: "Use a data-fetching layer or Server Component so fetches do not race, double-fire, or leak from `useEffect`.",
 	create: (context) => ({ CallExpression(node) {
-		if (!isHookCall$2(node, EFFECT_HOOK_NAMES$1)) return;
+		if (!isReactApiCall(node, EFFECT_HOOK_NAMES$1, context.scopes, {
+			allowGlobalReactNamespace: true,
+			allowUnboundBareCalls: true,
+			resolveNamedAliases: true
+		})) return;
 		const callback = getEffectCallback(node);
 		if (!callback) return;
 		const analysisFunctions = collectEffectAnalysisFunctions(callback, context);
@@ -35017,6 +35212,30 @@ const guardsRenderShape = (comparison) => {
 	}
 	return false;
 };
+const isPropsChildrenLength = (node, scopes) => {
+	const unwrappedNode = stripParenExpression(node);
+	return isNodeOfType(unwrappedNode, "MemberExpression") && !unwrappedNode.computed && isNodeOfType(unwrappedNode.property, "Identifier") && unwrappedNode.property.name === "length" && resolvesToPropsChildren(stripParenExpression(unwrappedNode.object), scopes);
+};
+const isLargeTextLengthComparison = (node, scopes) => {
+	const unwrappedNode = stripParenExpression(node);
+	if (!isNodeOfType(unwrappedNode, "BinaryExpression")) return false;
+	const leftIsLength = isPropsChildrenLength(unwrappedNode.left, scopes);
+	const rightIsLength = isPropsChildrenLength(unwrappedNode.right, scopes);
+	const thresholdNode = leftIsLength ? unwrappedNode.right : unwrappedNode.left;
+	if (!leftIsLength && !rightIsLength || !isNodeOfType(thresholdNode, "Literal")) return false;
+	if (typeof thresholdNode.value !== "number" || thresholdNode.value < 1e3) return false;
+	return leftIsLength ? unwrappedNode.operator === ">" || unwrappedNode.operator === ">=" : unwrappedNode.operator === "<" || unwrappedNode.operator === "<=";
+};
+const isLargeStringOptimizationGuard = (comparison, scopes) => {
+	let current = findTransparentExpressionRoot(comparison);
+	while (current.parent) {
+		const parent = current.parent;
+		if (!isNodeOfType(parent, "LogicalExpression") || parent.operator !== "&&") return false;
+		if (isLargeTextLengthComparison(parent.left === current ? parent.right : parent.left, scopes)) return true;
+		current = findTransparentExpressionRoot(parent);
+	}
+	return false;
+};
 const noPolymorphicChildren = defineRule({
 	id: "no-polymorphic-children",
 	title: "Children type checked at runtime",
@@ -35030,6 +35249,7 @@ const noPolymorphicChildren = defineRule({
 		const isStringLiteral = (operand) => isNodeOfType(operand, "Literal") && operand.value === "string";
 		if (!isStringLiteral(node.left) && !isStringLiteral(node.right)) return;
 		if (!guardsRenderShape(node)) return;
+		if (isLargeStringOptimizationGuard(node, context.scopes)) return;
 		context.report({
 			node,
 			message: "Your users hit inconsistent behavior because `typeof children === \"string\"` makes this component switch on what callers pass, so add clear subcomponents like `<Button.Text>` instead."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oxlint-plugin-react-doctor",
-  "version": "0.7.5-dev.3075e10",
+  "version": "0.7.5-dev.3afd146",
   "description": "React Doctor rules for oxlint.",
   "keywords": [
     "accessibility",