oxlint-plugin-react-doctor 0.7.9-dev.6c5c91b → 0.7.9-dev.71892af

package/dist/index.js

@@ -1,8 +1,8 @@
 import { KEYS } from "eslint-visitor-keys";
 import * as path from "node:path";
+import { parseSync, visitorKeys } from "oxc-parser";
 import * as fs from "node:fs";
 import { readFileSync } from "node:fs";
-import { parseSync, visitorKeys } from "oxc-parser";
 import { analyze } from "eslint-scope";
 //#region src/plugin/utils/is-node-of-type.ts
 const isNodeOfType = (node, type) => node !== null && typeof node === "object" && "type" in node && node.type === type;
@@ -327,7 +327,15 @@ const defineRule = (rule) => {
 let lastContentLineIndex;
 const buildLineStartOffsets = (content) => {
 	const lineStartOffsets = [0];
-	for (let newlineIndex = content.indexOf("\n"); newlineIndex !== -1; newlineIndex = content.indexOf("\n", newlineIndex + 1)) lineStartOffsets.push(newlineIndex + 1);
+	for (let characterIndex = 0; characterIndex < content.length; characterIndex += 1) {
+		const character = content[characterIndex];
+		if (character === "\r" && content[characterIndex + 1] === "\n") {
+			characterIndex += 1;
+			lineStartOffsets.push(characterIndex + 1);
+			continue;
+		}
+		if (character === "\r" || character === "\n" || character === "\u2028" || character === "\u2029") lineStartOffsets.push(characterIndex + 1);
+	}
 	return lineStartOffsets;
 };
 const getLineStartOffsets = (content) => {
@@ -4342,7 +4350,8 @@ const SECRET_VALUE_PATTERNS = [
 ];
 const JWT_LITERAL_VALUE_PATTERN = /\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{16,}\b/;
 const PUBLIC_ENV_SECRET_NAME_PATTERN = /\b(?:NEXT_PUBLIC|VITE|REACT_APP|EXPO_PUBLIC)_[A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|PRIVATE|DATABASE_URL|SERVICE_ROLE|AWS_ACCESS_KEY|AWS_SECRET)[A-Z0-9_]*\b/i;
-const FULL_ENV_LEAK_CONTEXT_PATTERN = /\b(?:process\.env|import\.meta\.env|window\.__[A-Z0-9_]*ENV[A-Z0-9_]*__|__[A-Z0-9_]*ENV[A-Z0-9_]*__)\b/;
+const FULL_ENV_LEAK_CONTEXT_PATTERN = /\b(?:process\s*\.\s*env|import\s*\.\s*meta\s*\.\s*env|window\.__[A-Z0-9_]*ENV[A-Z0-9_]*__|__[A-Z0-9_]*ENV[A-Z0-9_]*__)\b/;
+const FULL_ENV_LEAK_COMMENT_TRIVIA_PATTERN = /\b(?:(?:process|window)\s*(?:\/[*/]|<!--|-->|\.\s*(?:\/[*/]|<!--|-->))|import\s*(?:\/[*/]|<!--|-->|\.\s*(?:\/[*/]|<!--|-->|meta\s*(?:\/[*/]|<!--|-->|\.\s*(?:\/[*/]|<!--|-->)))))/;
 const FULL_ENV_LEAK_SECRET_NAME_PATTERN = /\b(?:DATABASE_URL|AWS_SECRET_ACCESS_KEY|AWS_ACCESS_KEY_ID|MAILGUN_API_KEY|SALESFORCE_CLIENT_SECRET|OKTA_CLIENT_SECRET|SESSION_SECRET|COOKIE_SECRET|PRIVATE_KEY|SERVICE_ROLE)\b/;
 const TRUSTED_PUBLIC_SECRET_NAME_PATTERN = /(?:SENTRY_DSN|PUBLIC_KEY|PUBLISHABLE|ANON_KEY|POSTHOG_(?:PROJECT_)?TOKEN|POSTHOG_KEY|TLDRAW_LICENSE_KEY|CLERK_PUBLISHABLE_KEY|ALGOLIA_SEARCH_KEY|GC_API_KEY|GOOGLE_MAPS_API_KEY|MAPBOX_TOKEN|MIXPANEL_TOKEN|FACEBOOK_CLIENT_TOKEN|(?:NEXT_PUBLIC|VITE|REACT_APP|EXPO_PUBLIC)_(?:DISABLE|ENABLE|ALLOW|REQUIRE)_)|(?:TOKEN|SECRET|PASSWORD|PRIVATE)_(?:KIND|TYPE|URL|URI|ENDPOINT|HEADER|NAME)$/i;
 const PUBLIC_CLIENT_KEY_PATTERNS = [
@@ -4500,6 +4509,172 @@ const findSuspiciousPublicEnvSecretNamePattern = (content) => {
 //#region src/plugin/rules/security-scan/utils/has-full-env-leak-shape.ts
 const hasFullEnvLeakShape = (content) => FULL_ENV_LEAK_CONTEXT_PATTERN.test(content) && FULL_ENV_LEAK_SECRET_NAME_PATTERN.test(content);
 //#endregion
+//#region src/plugin/utils/attach-parent-references.ts
+const attachParentReferences = (root) => {
+	const visit = (node, parent) => {
+		const writableNode = node;
+		writableNode.parent = parent;
+		const nodeRecord = node;
+		for (const key of Object.keys(nodeRecord)) {
+			if (key === "parent") continue;
+			const child = nodeRecord[key];
+			if (Array.isArray(child)) {
+				for (const item of child) if (isAstNode(item)) visit(item, node);
+			} else if (isAstNode(child)) visit(child, node);
+		}
+	};
+	visit(root, null);
+};
+//#endregion
+//#region src/plugin/utils/cross-file-probe-recorder.ts
+let activeProbeTrace = null;
+const recordExistenceProbe = (absolutePath) => {
+	activeProbeTrace?.existencePaths.add(absolutePath);
+};
+const recordContentProbe = (absolutePath) => {
+	activeProbeTrace?.contentPaths.add(absolutePath);
+};
+const isProbeRecorderActive = () => activeProbeTrace !== null;
+const collectCrossFileProbes = (collect) => {
+	const previousTrace = activeProbeTrace;
+	const trace = {
+		existencePaths: /* @__PURE__ */ new Set(),
+		contentPaths: /* @__PURE__ */ new Set()
+	};
+	activeProbeTrace = trace;
+	try {
+		collect();
+	} finally {
+		activeProbeTrace = previousTrace;
+	}
+	return trace;
+};
+//#endregion
+//#region src/plugin/utils/parse-source-file.ts
+const FILENAME_TO_LANG = {
+	".ts": "ts",
+	".tsx": "tsx",
+	".js": "js",
+	".jsx": "jsx",
+	".mjs": "js",
+	".cjs": "js",
+	".mts": "ts",
+	".cts": "ts"
+};
+const resolveLang = (filename) => {
+	return FILENAME_TO_LANG[path.extname(filename).toLowerCase()] ?? "tsx";
+};
+const parseSourceText = ({ filename, sourceText, shouldAttachParentReferences = true }) => {
+	try {
+		const result = parseSync(filename, sourceText, {
+			astType: "ts",
+			lang: resolveLang(filename)
+		});
+		if (result.errors.some((parseError) => parseError.severity === "Error")) return null;
+		const parsedProgram = result.program;
+		if (shouldAttachParentReferences) attachParentReferences(parsedProgram);
+		return parsedProgram;
+	} catch {
+		return null;
+	}
+};
+const parseCache = /* @__PURE__ */ new Map();
+const parseSourceFile = (absoluteFilePath) => {
+	if (!(absoluteFilePath.endsWith(".d.ts") || absoluteFilePath.endsWith(".d.mts") || absoluteFilePath.endsWith(".d.cts"))) recordContentProbe(absoluteFilePath);
+	let fileStat;
+	try {
+		fileStat = fs.statSync(absoluteFilePath);
+	} catch {
+		return null;
+	}
+	if (!fileStat.isFile()) return null;
+	if (fileStat.size > 2e6) return null;
+	const cached = parseCache.get(absoluteFilePath);
+	if (cached && cached.mtimeMs === fileStat.mtimeMs && cached.size === fileStat.size) return cached.program;
+	if (absoluteFilePath.endsWith(".d.ts") || absoluteFilePath.endsWith(".d.mts") || absoluteFilePath.endsWith(".d.cts")) {
+		parseCache.set(absoluteFilePath, {
+			mtimeMs: fileStat.mtimeMs,
+			size: fileStat.size,
+			program: null
+		});
+		return null;
+	}
+	let sourceText;
+	try {
+		sourceText = fs.readFileSync(absoluteFilePath, "utf8");
+	} catch {
+		parseCache.set(absoluteFilePath, {
+			mtimeMs: fileStat.mtimeMs,
+			size: fileStat.size,
+			program: null
+		});
+		return null;
+	}
+	const parsedProgram = parseSourceText({
+		filename: absoluteFilePath,
+		sourceText
+	});
+	parseCache.set(absoluteFilePath, {
+		mtimeMs: fileStat.mtimeMs,
+		size: fileStat.size,
+		program: parsedProgram
+	});
+	return parsedProgram;
+};
+//#endregion
+//#region src/plugin/rules/security-scan/utils/mask-source-comments.ts
+const SOURCE_FILE_EXTENSION_PATTERN$1 = /\.(?:[cm]?[jt]sx?)$/i;
+const POSSIBLE_SOURCE_COMMENT_PATTERN = /\/\/|\/\*|<!--/;
+const LINE_TERMINATORS = new Set([
+	"\r",
+	"\n",
+	"\u2028",
+	"\u2029"
+]);
+const hasPossibleAnnexBClosingComment = (content) => {
+	let searchIndex = 0;
+	while (searchIndex < content.length) {
+		const closingCommentIndex = content.indexOf("-->", searchIndex);
+		if (closingCommentIndex === -1) return false;
+		let prefixIndex = closingCommentIndex - 1;
+		while (prefixIndex >= 0 && !LINE_TERMINATORS.has(content[prefixIndex] ?? "")) {
+			if (content[prefixIndex]?.trim() !== "") break;
+			prefixIndex -= 1;
+		}
+		if (prefixIndex < 0 || LINE_TERMINATORS.has(content[prefixIndex] ?? "")) return true;
+		searchIndex = closingCommentIndex + 3;
+	}
+	return false;
+};
+const maskSourceComments = (relativePath, content) => {
+	if (!SOURCE_FILE_EXTENSION_PATTERN$1.test(relativePath)) return content;
+	if (!content.startsWith("#!") && !POSSIBLE_SOURCE_COMMENT_PATTERN.test(content) && !hasPossibleAnnexBClosingComment(content)) return content;
+	try {
+		const result = parseSync(relativePath, content, {
+			astType: "ts",
+			lang: resolveLang(relativePath)
+		});
+		if (result.errors.some((parseError) => parseError.severity === "Error")) return void 0;
+		const firstLineTerminatorIndex = content.search(/[\r\n\u2028\u2029]/);
+		const ignoredRanges = [...content.startsWith("#!") ? [{
+			start: 0,
+			end: firstLineTerminatorIndex === -1 ? content.length : firstLineTerminatorIndex
+		}] : [], ...result.comments];
+		if (ignoredRanges.length === 0) return content;
+		const contentParts = [];
+		let previousEnd = 0;
+		for (const ignoredRange of ignoredRanges) {
+			contentParts.push(content.slice(previousEnd, ignoredRange.start));
+			contentParts.push(content.slice(ignoredRange.start, ignoredRange.end).replace(/[^\r\n\u2028\u2029]/g, " "));
+			previousEnd = ignoredRange.end;
+		}
+		contentParts.push(content.slice(previousEnd));
+		return contentParts.join("");
+	} catch {
+		return;
+	}
+};
+//#endregion
 //#region src/plugin/rules/security-scan/utils/scan-artifact-leak.ts
 const scanArtifactLeak = (file, findLeakPattern, message) => {
 	if (DOCUMENTATION_CONTEXT_PATTERN.test(file.relativePath)) return [];
@@ -4515,12 +4690,39 @@ const scanArtifactLeak = (file, findLeakPattern, message) => {
 };
 //#endregion
 //#region src/plugin/rules/security-scan/artifact-env-leak.ts
+const ARTIFACT_ENV_LEAK_MESSAGE = "A browser artifact contains server-secret environment names or a full environment dump shape.";
+const findArtifactEnvLeakPattern = (content) => findSuspiciousPublicEnvSecretNamePattern(content) ?? (hasFullEnvLeakShape(content) ? FULL_ENV_LEAK_SECRET_NAME_PATTERN : void 0);
 const artifactEnvLeak = defineRule({
 	id: "artifact-env-leak",
 	title: "Server env leaked to browser artifact",
 	severity: "error",
 	recommendation: "Treat public env prefixes as publication, not secrecy; keep secret env vars server-only and rebuild after rotating leaked keys.",
-	scan: (file) => scanArtifactLeak(file, (content) => findSuspiciousPublicEnvSecretNamePattern(content) ?? (hasFullEnvLeakShape(content) ? FULL_ENV_LEAK_SECRET_NAME_PATTERN : void 0), "A browser artifact contains server-secret environment names or a full environment dump shape.")
+	scan: (file) => {
+		let isRawCandidateExact = false;
+		const findRawCandidatePattern = (content) => {
+			const suspiciousPublicNamePattern = findSuspiciousPublicEnvSecretNamePattern(content);
+			if (suspiciousPublicNamePattern) {
+				isRawCandidateExact = true;
+				return suspiciousPublicNamePattern;
+			}
+			if (!FULL_ENV_LEAK_SECRET_NAME_PATTERN.test(content)) return void 0;
+			if (FULL_ENV_LEAK_CONTEXT_PATTERN.test(content)) {
+				isRawCandidateExact = true;
+				return FULL_ENV_LEAK_SECRET_NAME_PATTERN;
+			}
+			return FULL_ENV_LEAK_COMMENT_TRIVIA_PATTERN.test(content) ? FULL_ENV_LEAK_SECRET_NAME_PATTERN : void 0;
+		};
+		const rawCandidateFindings = scanArtifactLeak(file, findRawCandidatePattern, ARTIFACT_ENV_LEAK_MESSAGE);
+		if (rawCandidateFindings.length === 0) return rawCandidateFindings;
+		const rawFindings = isRawCandidateExact ? rawCandidateFindings : scanArtifactLeak(file, findArtifactEnvLeakPattern, ARTIFACT_ENV_LEAK_MESSAGE);
+		const executableContent = maskSourceComments(file.relativePath, file.content);
+		if (executableContent === void 0) return rawCandidateFindings;
+		if (executableContent === file.content) return rawFindings;
+		return scanArtifactLeak({
+			...file,
+			content: executableContent
+		}, findArtifactEnvLeakPattern, ARTIFACT_ENV_LEAK_MESSAGE);
+	}
 });
 //#endregion
 //#region src/plugin/rules/security-scan/artifact-secret-leak.ts
@@ -9083,119 +9285,6 @@ const findReExportTargetsForName = (programRoot, exportedName) => {
 	return exportAllTargets;
 };
 //#endregion
-//#region src/plugin/utils/attach-parent-references.ts
-const attachParentReferences = (root) => {
-	const visit = (node, parent) => {
-		const writableNode = node;
-		writableNode.parent = parent;
-		const nodeRecord = node;
-		for (const key of Object.keys(nodeRecord)) {
-			if (key === "parent") continue;
-			const child = nodeRecord[key];
-			if (Array.isArray(child)) {
-				for (const item of child) if (isAstNode(item)) visit(item, node);
-			} else if (isAstNode(child)) visit(child, node);
-		}
-	};
-	visit(root, null);
-};
-//#endregion
-//#region src/plugin/utils/cross-file-probe-recorder.ts
-let activeProbeTrace = null;
-const recordExistenceProbe = (absolutePath) => {
-	activeProbeTrace?.existencePaths.add(absolutePath);
-};
-const recordContentProbe = (absolutePath) => {
-	activeProbeTrace?.contentPaths.add(absolutePath);
-};
-const isProbeRecorderActive = () => activeProbeTrace !== null;
-const collectCrossFileProbes = (collect) => {
-	const previousTrace = activeProbeTrace;
-	const trace = {
-		existencePaths: /* @__PURE__ */ new Set(),
-		contentPaths: /* @__PURE__ */ new Set()
-	};
-	activeProbeTrace = trace;
-	try {
-		collect();
-	} finally {
-		activeProbeTrace = previousTrace;
-	}
-	return trace;
-};
-//#endregion
-//#region src/plugin/utils/parse-source-file.ts
-const FILENAME_TO_LANG = {
-	".ts": "ts",
-	".tsx": "tsx",
-	".js": "js",
-	".jsx": "jsx",
-	".mjs": "js",
-	".cjs": "js",
-	".mts": "ts",
-	".cts": "ts"
-};
-const resolveLang = (filename) => {
-	return FILENAME_TO_LANG[path.extname(filename).toLowerCase()] ?? "tsx";
-};
-const parseSourceText = ({ filename, sourceText, shouldAttachParentReferences = true }) => {
-	try {
-		const result = parseSync(filename, sourceText, {
-			astType: "ts",
-			lang: resolveLang(filename)
-		});
-		if (result.errors.some((parseError) => parseError.severity === "Error")) return null;
-		const parsedProgram = result.program;
-		if (shouldAttachParentReferences) attachParentReferences(parsedProgram);
-		return parsedProgram;
-	} catch {
-		return null;
-	}
-};
-const parseCache = /* @__PURE__ */ new Map();
-const parseSourceFile = (absoluteFilePath) => {
-	if (!(absoluteFilePath.endsWith(".d.ts") || absoluteFilePath.endsWith(".d.mts") || absoluteFilePath.endsWith(".d.cts"))) recordContentProbe(absoluteFilePath);
-	let fileStat;
-	try {
-		fileStat = fs.statSync(absoluteFilePath);
-	} catch {
-		return null;
-	}
-	if (!fileStat.isFile()) return null;
-	if (fileStat.size > 2e6) return null;
-	const cached = parseCache.get(absoluteFilePath);
-	if (cached && cached.mtimeMs === fileStat.mtimeMs && cached.size === fileStat.size) return cached.program;
-	if (absoluteFilePath.endsWith(".d.ts") || absoluteFilePath.endsWith(".d.mts") || absoluteFilePath.endsWith(".d.cts")) {
-		parseCache.set(absoluteFilePath, {
-			mtimeMs: fileStat.mtimeMs,
-			size: fileStat.size,
-			program: null
-		});
-		return null;
-	}
-	let sourceText;
-	try {
-		sourceText = fs.readFileSync(absoluteFilePath, "utf8");
-	} catch {
-		parseCache.set(absoluteFilePath, {
-			mtimeMs: fileStat.mtimeMs,
-			size: fileStat.size,
-			program: null
-		});
-		return null;
-	}
-	const parsedProgram = parseSourceText({
-		filename: absoluteFilePath,
-		sourceText
-	});
-	parseCache.set(absoluteFilePath, {
-		mtimeMs: fileStat.mtimeMs,
-		size: fileStat.size,
-		program: parsedProgram
-	});
-	return parsedProgram;
-};
-//#endregion
 //#region src/plugin/utils/resolve-relative-import-path.ts
 const MODULE_FILE_EXTENSIONS = [
 	".ts",
@@ -15016,6 +15105,11 @@ const doesResourceResultEscape = (resourceNode, allowReturnedResourceEscape, all
 			parentNode = currentNode.parent;
 			continue;
 		}
+		if (isNodeOfType(parentNode, "ConditionalExpression") && (parentNode.consequent === currentNode || parentNode.alternate === currentNode) || isNodeOfType(parentNode, "LogicalExpression") && (parentNode.right === currentNode || parentNode.left === currentNode && parentNode.operator !== "&&")) {
+			currentNode = parentNode;
+			parentNode = currentNode.parent;
+			continue;
+		}
 		if (isNodeOfType(parentNode, "VariableDeclarator") && parentNode.init === currentNode && isNodeOfType(parentNode.id, "Identifier") && isNodeOfType(parentNode.parent, "VariableDeclaration") && parentNode.parent.kind === "const") {
 			const ownerFunction = findEnclosingFunction$1(resourceNode);
 			const resourceSymbol = context.scopes.symbolFor(parentNode.id);
@@ -34082,6 +34176,7 @@ const noChainStateUpdates = defineRule({
 	id: "no-chain-state-updates",
 	title: "State updates chained through effects",
 	severity: "warn",
+	disabledWhen: ["react:18"],
 	tags: ["test-noise"],
 	recommendation: "Set all the related state together in the event handler that starts it, instead of having one useEffect react to a state change and set more state. See https://react.dev/learn/you-might-not-need-an-effect#chains-of-computations",
 	create: (context) => ({ CallExpression(node) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oxlint-plugin-react-doctor",
-  "version": "0.7.9-dev.6c5c91b",
+  "version": "0.7.9-dev.71892af",
   "description": "React Doctor rules for oxlint.",
   "keywords": [
     "accessibility",