oxlint-plugin-react-doctor 0.7.5-dev.bc49aaa → 0.7.5-dev.dbd4067

package/dist/index.js

@@ -23108,61 +23108,73 @@ const PURE_GLOBAL_CALLEE_NAMES = new Set([
 	"Array",
 	"BigInt",
 	"Boolean",
+	"encodeURIComponent",
 	"Number",
 	"Object",
 	"String",
 	"parseFloat",
-	"parseInt"
+	"parseInt",
+	"structuredClone"
+]);
+const PURE_GLOBAL_CONSTRUCTOR_NAMES = new Set(["Date", "Set"]);
+const PURE_HELPER_NAMESPACE_MEMBER_NAMES = new Map([
+	["Array", new Set(["from"])],
+	["JSON", new Set([
+		"isRawJSON",
+		"parse",
+		"rawJSON",
+		"stringify"
+	])],
+	["Math", new Set([
+		"abs",
+		"acos",
+		"acosh",
+		"asin",
+		"asinh",
+		"atan",
+		"atan2",
+		"atanh",
+		"cbrt",
+		"ceil",
+		"clz32",
+		"cos",
+		"cosh",
+		"exp",
+		"floor",
+		"fround",
+		"hypot",
+		"imul",
+		"log",
+		"log10",
+		"log1p",
+		"log2",
+		"max",
+		"min",
+		"pow",
+		"round",
+		"sign",
+		"sin",
+		"sinh",
+		"sqrt",
+		"tan",
+		"tanh",
+		"trunc"
+	])],
+	["Object", new Set(["assign"])]
 ]);
-const PURE_GLOBAL_NAMESPACE_NAMES = new Set(["JSON", "Math"]);
-const PURE_HELPER_NAMESPACE_MEMBER_NAMES = new Map([["JSON", new Set([
-	"isRawJSON",
-	"parse",
-	"rawJSON",
-	"stringify"
-])], ["Math", new Set([
-	"abs",
-	"acos",
-	"acosh",
-	"asin",
-	"asinh",
-	"atan",
-	"atan2",
-	"atanh",
-	"cbrt",
-	"ceil",
-	"clz32",
-	"cos",
-	"cosh",
-	"exp",
-	"floor",
-	"fround",
-	"hypot",
-	"imul",
-	"log",
-	"log10",
-	"log1p",
-	"log2",
-	"max",
-	"min",
-	"pow",
-	"round",
-	"sign",
-	"sin",
-	"sinh",
-	"sqrt",
-	"tan",
-	"tanh",
-	"trunc"
-])]]);
 const PURE_MEMBER_TRANSFORM_NAMES = new Set([
 	"concat",
 	"filter",
+	"flatMap",
 	"join",
 	"map",
+	"reduce",
+	"replace",
+	"slice",
 	"split",
 	"toLowerCase",
 	"toString",
+	"toSorted",
 	"toUpperCase",
 	"trim"
 ]);
@@ -23544,6 +23556,11 @@ const analyzeHelperExpression = (expression, environment, usedParameterIndices)
 		const callbackSummary = analyzeHelperStatements(node.body.body ?? [], callbackEnvironment, usedParameterIndices, analyzeHelperExpression);
 		return callbackSummary.isValid && !callbackSummary.canContinue;
 	}
+	if (isNodeOfType(node, "NewExpression")) {
+		const callee = stripParenExpression(node.callee);
+		if (!isNodeOfType(callee, "Identifier") || !PURE_GLOBAL_CONSTRUCTOR_NAMES.has(callee.name) || environment.parameterIndices.has(callee.name) || environment.recursiveNames.has(callee.name) || environment.shadowedGlobalNames.has(callee.name)) return false;
+		return (node.arguments ?? []).every((argument) => analyzeHelperExpression(argument, environment, usedParameterIndices));
+	}
 	if (isNodeOfType(node, "CallExpression")) {
 		const callee = stripParenExpression(node.callee);
 		const calleeRoot = getMemberRoot(callee);
@@ -23746,7 +23763,7 @@ const collectValueEvidence = (analysis, expression, frame, remainingCallFrames,
 		}
 		const callee = stripParenExpression(node.callee);
 		const calleeRoot = getMemberRoot(callee);
-		const isPureGlobalCall = isNodeOfType(callee, "Identifier") && PURE_GLOBAL_CALLEE_NAMES.has(callee.name) && getIdentifierBindingIdentity(analysis, callee) === null || isNodeOfType(calleeRoot, "Identifier") && PURE_GLOBAL_NAMESPACE_NAMES.has(calleeRoot.name) && getIdentifierBindingIdentity(analysis, calleeRoot) === null;
+		const isPureGlobalCall = isNodeOfType(callee, "Identifier") && PURE_GLOBAL_CALLEE_NAMES.has(callee.name) && getIdentifierBindingIdentity(analysis, callee) === null || isNodeOfType(callee, "MemberExpression") && isNodeOfType(calleeRoot, "Identifier") && getIdentifierBindingIdentity(analysis, calleeRoot) === null && PURE_HELPER_NAMESPACE_MEMBER_NAMES.get(calleeRoot.name)?.has(getStaticMemberName$1(callee) ?? "") === true;
 		const isPureMemberTransform = isNodeOfType(callee, "MemberExpression") && PURE_MEMBER_TRANSFORM_NAMES.has(getStaticMemberName$1(callee) ?? "");
 		if (isPureGlobalCall || isPureMemberTransform) {
 			if (isPureMemberTransform && isNodeOfType(callee, "MemberExpression")) mergeEvidence(evidence, collectValueEvidence(analysis, callee.object, frame, remainingCallFrames, new Set(visitedBindings)));
@@ -23799,6 +23816,15 @@ const collectValueEvidence = (analysis, expression, frame, remainingCallFrames,
 		}
 		return evidence;
 	}
+	if (isNodeOfType(node, "NewExpression")) {
+		const callee = stripParenExpression(node.callee);
+		if (!isNodeOfType(callee, "Identifier") || !PURE_GLOBAL_CONSTRUCTOR_NAMES.has(callee.name) || getIdentifierBindingIdentity(analysis, callee) !== null) {
+			evidence.hasUnknownSource = true;
+			return evidence;
+		}
+		for (const argument of node.arguments ?? []) mergeEvidence(evidence, collectValueEvidence(analysis, argument, frame, remainingCallFrames, new Set(visitedBindings)));
+		return evidence;
+	}
 	if (isFunctionLike$1(node) || isNodeOfType(node, "AwaitExpression")) {
 		evidence.hasUnknownSource = true;
 		return evidence;
@@ -28348,20 +28374,31 @@ const noDocumentStartViewTransition = defineRule({
 	} })
 });
 //#endregion
+//#region src/plugin/utils/get-static-property-name.ts
+const getStaticPropertyName = (memberExpression) => {
+	const property = memberExpression.property;
+	if (!memberExpression.computed && isNodeOfType(property, "Identifier")) return property.name;
+	if (memberExpression.computed && isNodeOfType(property, "Literal")) return typeof property.value === "string" ? property.value : null;
+	if (memberExpression.computed && isNodeOfType(property, "TemplateLiteral") && property.expressions.length === 0) return property.quasis[0]?.value.cooked ?? property.quasis[0]?.value.raw ?? null;
+	return null;
+};
+//#endregion
 //#region src/plugin/rules/js-performance/no-document-write.ts
 const MESSAGE$24 = "`document.write()` blocks parsing, is ignored (or wipes the page) after load, and is flagged by browsers as a performance anti-pattern. Build DOM nodes or set `innerHTML`/`textContent` on a target element instead.";
 const WRITE_METHODS = new Set(["write", "writeln"]);
+const isGlobalDocumentReference = (node, context) => node.name === "document" && context.scopes.isGlobalReference(node);
 const noDocumentWrite = defineRule({
 	id: "no-document-write",
 	title: "document.write/writeln",
 	severity: "warn",
 	recommendation: "Don't use `document.write()`/`document.writeln()`. Append DOM nodes or set `innerHTML`/`textContent` on a specific element instead.",
 	create: (context) => ({ CallExpression(node) {
-		const callee = node.callee;
-		if (!isNodeOfType(callee, "MemberExpression") || callee.computed) return;
+		const callee = stripParenExpression(node.callee);
+		if (!isNodeOfType(callee, "MemberExpression")) return;
 		const receiver = stripParenExpression(callee.object);
-		if (!isNodeOfType(receiver, "Identifier") || receiver.name !== "document") return;
-		if (!isNodeOfType(callee.property, "Identifier") || !WRITE_METHODS.has(callee.property.name)) return;
+		if (!isNodeOfType(receiver, "Identifier") || !isGlobalDocumentReference(receiver, context)) return;
+		const methodName = getStaticPropertyName(callee);
+		if (methodName === null || !WRITE_METHODS.has(methodName)) return;
 		context.report({
 			node,
 			message: MESSAGE$24
@@ -29168,6 +29205,14 @@ const noEffectWithFreshDeps = defineRule({
 //#endregion
 //#region src/plugin/rules/security/no-eval.ts
 const SANDBOX_SURFACE_PATH_PATTERN = /(?:^|[/-])sandbox(?:$|[/-])|(?:^|\/)[\w.]+-sandbox(?:\/|\.[cm]?[jt]sx?$)/i;
+const getExecutableGlobalName = (node, context) => {
+	const expression = stripParenExpression(node);
+	if (isNodeOfType(expression, "Identifier")) return context.scopes.isGlobalReference(expression) ? expression.name : null;
+	if (!isNodeOfType(expression, "MemberExpression")) return null;
+	const receiver = stripParenExpression(expression.object);
+	if (!isNodeOfType(receiver, "Identifier") || receiver.name !== "globalThis" || !context.scopes.isGlobalReference(receiver)) return null;
+	return getStaticPropertyName(expression);
+};
 const noEval = defineRule({
 	id: "no-eval",
 	title: "eval() runs untrusted code strings",
@@ -29177,20 +29222,21 @@ const noEval = defineRule({
 		if (SANDBOX_SURFACE_PATH_PATTERN.test(normalizeFilename(context.filename ?? ""))) return {};
 		return {
 			CallExpression(node) {
-				if (isNodeOfType(node.callee, "Identifier") && node.callee.name === "eval") {
+				const executableGlobalName = getExecutableGlobalName(node.callee, context);
+				if (executableGlobalName === "eval") {
 					context.report({
 						node,
 						message: "eval() is a code-injection vulnerability: it runs any string as code."
 					});
 					return;
 				}
-				if (isNodeOfType(node.callee, "Identifier") && (node.callee.name === "setTimeout" || node.callee.name === "setInterval") && isNodeOfType(node.arguments?.[0], "Literal") && typeof node.arguments[0].value === "string") context.report({
+				if ((executableGlobalName === "setTimeout" || executableGlobalName === "setInterval") && isNodeOfType(node.arguments?.[0], "Literal") && typeof node.arguments[0].value === "string") context.report({
 					node,
-					message: `Passing a string to ${node.callee.name}() is a code-injection vulnerability, since it runs that string as code.`
+					message: `Passing a string to ${executableGlobalName}() is a code-injection vulnerability, since it runs that string as code.`
 				});
 			},
 			NewExpression(node) {
-				if (isNodeOfType(node.callee, "Identifier") && node.callee.name === "Function") {
+				if (getExecutableGlobalName(node.callee, context) === "Function") {
 					const onlyArgument = node.arguments.length === 1 ? node.arguments[0] : void 0;
 					if (isNodeOfType(onlyArgument, "Literal") && typeof onlyArgument.value === "string" && onlyArgument.value.trim() === "return this") return;
 					context.report({
@@ -54751,12 +54797,6 @@ const webhookSignatureRisk = defineRule({
 //#region src/plugin/rules/zod/utils/zod-ast.ts
 const ZOD_MODULE = "zod";
 const ZOD_MODULE_SOURCES = [ZOD_MODULE];
-const getStaticPropertyName = (member) => {
-	const property = member.property;
-	if (!member.computed && isNodeOfType(property, "Identifier")) return property.name;
-	if (member.computed && isNodeOfType(property, "Literal") && typeof property.value === "string") return property.value;
-	return null;
-};
 const importInfoCache = /* @__PURE__ */ new WeakMap();
 const getImportInfoForIdentifier = (identifier) => {
 	if (importInfoCache.has(identifier)) return importInfoCache.get(identifier) ?? null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oxlint-plugin-react-doctor",
-  "version": "0.7.5-dev.bc49aaa",
+  "version": "0.7.5-dev.dbd4067",
   "description": "React Doctor rules for oxlint.",
   "keywords": [
     "accessibility",