oxlint-plugin-react-doctor 0.7.9-dev.b392093 → 0.7.9-dev.b51022f

package/dist/index.js

@@ -6736,6 +6736,28 @@ const asyncParallel = defineRule({
 	}
 });
 //#endregion
+//#region src/plugin/utils/collect-function-return-statements.ts
+const collectFunctionReturnStatements = (functionNode) => {
+	if (!isFunctionLike$1(functionNode) || !isNodeOfType(functionNode.body, "BlockStatement")) return [];
+	const returnStatements = [];
+	walkAst(functionNode.body, (node) => {
+		if (node !== functionNode.body && (isFunctionLike$1(node) || isNodeOfType(node, "ClassDeclaration") || isNodeOfType(node, "ClassExpression"))) return false;
+		if (isNodeOfType(node, "ReturnStatement")) returnStatements.push(node);
+	});
+	return returnStatements;
+};
+//#endregion
+//#region src/plugin/utils/is-nullish-expression.ts
+const isNullishExpression = (expression) => isNodeOfType(expression, "Literal") && expression.value === null || isNodeOfType(expression, "Identifier") && expression.name === "undefined" || isNodeOfType(expression, "UnaryExpression") && expression.operator === "void";
+//#endregion
+//#region src/plugin/utils/strip-this-parameter.ts
+const stripThisParameter = (parameters) => {
+	const firstParameter = parameters[0];
+	if (!firstParameter) return parameters;
+	if (isNodeOfType(firstParameter, "Identifier") && firstParameter.name === "this") return parameters.slice(1);
+	return parameters;
+};
+//#endregion
 //#region src/plugin/rules/security/auth-token-in-web-storage.ts
 const MESSAGE$60 = "Storing an auth token in `localStorage`/`sessionStorage` exposes it to any XSS on the page: JavaScript can read web storage and exfiltrate the token. Keep tokens in an `HttpOnly`, `Secure`, `SameSite` cookie instead.";
 const STORAGE_NAMES = new Set(["localStorage", "sessionStorage"]);
@@ -6747,12 +6769,8 @@ const STORAGE_GLOBALS = new Set([
 const SENSITIVE_KEY_PATTERN = /token|jwt|secret|password|passwd|credential|api[-_]?key|bearer|private[-_]?key/i;
 const NON_AUTH_TOKEN_PATTERN = /csrf|xsrf|device|fcm|apns|push|design|tokeniz|syntax|css|theme|color/i;
 const STRONG_AUTH_KEY_PATTERN = /jwt|secret|password|passwd|credential|private[-_]?key|api[-_]?key|bearer|access[-_]?token|refresh[-_]?token|auth[-_]?token|id[-_]?token|session/i;
-const PRODUCT_API_KEY_RECORDS_PATTERN = /(?:^|[._:-])(?:created|saved|integration|mailing)[-_]?api[-_]?keys$/i;
-const PRODUCT_API_KEY_COLLECTION_PATTERN = /[._:-](?:created|generated|saved)[-_]?api[-_]?keys$/i;
 const isAuthCredentialKey = (key) => {
-	if (PRODUCT_API_KEY_RECORDS_PATTERN.test(key)) return false;
 	if (!SENSITIVE_KEY_PATTERN.test(key)) return false;
-	if (PRODUCT_API_KEY_COLLECTION_PATTERN.test(key)) return false;
 	if (NON_AUTH_TOKEN_PATTERN.test(key) && !STRONG_AUTH_KEY_PATTERN.test(key)) return false;
 	return true;
 };
@@ -6761,11 +6779,63 @@ const isDirectWebStorageObject = (node) => {
 	if (isNodeOfType(node, "MemberExpression") && !node.computed && isNodeOfType(node.object, "Identifier") && STORAGE_GLOBALS.has(node.object.name) && isNodeOfType(node.property, "Identifier")) return STORAGE_NAMES.has(node.property.name);
 	return false;
 };
-const isWebStorageObject = (node) => {
-	if (isDirectWebStorageObject(node)) return true;
-	if (!isNodeOfType(node, "Identifier")) return false;
-	const binding = findVariableInitializer(node, node.name);
-	return binding?.initializer ? isDirectWebStorageObject(binding.initializer) : false;
+const immutableInitializer = (identifier, visitedIdentifiers = /* @__PURE__ */ new Set()) => {
+	if (visitedIdentifiers.has(identifier)) return null;
+	visitedIdentifiers.add(identifier);
+	const binding = findVariableInitializer(identifier, identifier.name);
+	if (!binding?.initializer) return null;
+	if (isNodeOfType(binding.initializer, "FunctionDeclaration")) return binding.initializer;
+	const declarator = binding.bindingIdentifier.parent;
+	if (!declarator || !isNodeOfType(declarator, "VariableDeclarator")) return null;
+	const declaration = declarator.parent;
+	if (!declaration || !isNodeOfType(declaration, "VariableDeclaration")) return null;
+	if (declaration.kind !== "const") return null;
+	const initializer = stripParenExpression(binding.initializer);
+	if (!isNodeOfType(initializer, "Identifier")) return initializer;
+	return immutableInitializer(initializer, visitedIdentifiers) ?? initializer;
+};
+const isWebStorageFactoryResult = (node, visitedNodes) => {
+	const expression = stripParenExpression(node);
+	if (isWebStorageObject(expression, new Set(visitedNodes))) return true;
+	if (isNodeOfType(expression, "ConditionalExpression")) {
+		const consequent = stripParenExpression(expression.consequent);
+		const alternate = stripParenExpression(expression.alternate);
+		return (isNullishExpression(consequent) || isWebStorageFactoryResult(consequent, visitedNodes)) && (isNullishExpression(alternate) || isWebStorageFactoryResult(alternate, visitedNodes)) && (!isNullishExpression(consequent) || !isNullishExpression(alternate));
+	}
+	if (isNodeOfType(expression, "LogicalExpression")) {
+		if (expression.operator === "&&") return isWebStorageFactoryResult(expression.right, visitedNodes);
+		const left = stripParenExpression(expression.left);
+		const right = stripParenExpression(expression.right);
+		const isLeftStorage = isWebStorageFactoryResult(left, visitedNodes);
+		const isRightStorage = isWebStorageFactoryResult(right, visitedNodes);
+		return (isLeftStorage || isNullishExpression(left)) && (isRightStorage || isNullishExpression(right)) && (isLeftStorage || isRightStorage);
+	}
+	return false;
+};
+const isWebStorageObject = (node, visitedNodes = /* @__PURE__ */ new Set()) => {
+	const expression = stripParenExpression(node);
+	if (visitedNodes.has(expression)) return false;
+	visitedNodes.add(expression);
+	if (isDirectWebStorageObject(expression)) return true;
+	if (isNodeOfType(expression, "Identifier")) {
+		const initializer = immutableInitializer(expression);
+		return initializer ? isWebStorageObject(initializer, new Set(visitedNodes)) : false;
+	}
+	if (!isNodeOfType(expression, "CallExpression")) return false;
+	const callee = stripParenExpression(expression.callee);
+	if (!isNodeOfType(callee, "Identifier")) return false;
+	const factory = immutableInitializer(callee);
+	if (!isFunctionLike$1(factory)) return false;
+	if (isNodeOfType(factory, "ArrowFunctionExpression") && !isNodeOfType(factory.body, "BlockStatement")) return isWebStorageFactoryResult(factory.body, visitedNodes);
+	let didReturnWebStorage = false;
+	for (const returnStatement of collectFunctionReturnStatements(factory)) {
+		if (!returnStatement.argument) continue;
+		const strippedReturn = stripParenExpression(returnStatement.argument);
+		if (isNullishExpression(strippedReturn)) continue;
+		if (!isWebStorageFactoryResult(strippedReturn, visitedNodes)) return false;
+		didReturnWebStorage = true;
+	}
+	return didReturnWebStorage;
 };
 const resolveStaticKeyString = (node) => {
 	if (isNodeOfType(node, "Literal") && typeof node.value === "string") return node.value;
@@ -6785,6 +6855,56 @@ const staticMemberName = (member) => {
 	if (member.computed && isNodeOfType(member.property, "Literal") && typeof member.property.value === "string") return member.property.value;
 	return null;
 };
+const parameterIndex = (expression, parameterSymbolIds, scopes, canUnwrapSerialization, visitedNodes = /* @__PURE__ */ new Set()) => {
+	const strippedExpression = stripParenExpression(expression);
+	if (visitedNodes.has(strippedExpression)) return null;
+	visitedNodes.add(strippedExpression);
+	if (isNodeOfType(strippedExpression, "Identifier")) {
+		const directSymbolId = scopes.symbolFor(strippedExpression)?.id;
+		const directIndex = directSymbolId === void 0 ? -1 : parameterSymbolIds.indexOf(directSymbolId);
+		if (directIndex !== -1) return directIndex;
+		const initializer = immutableInitializer(strippedExpression);
+		return initializer ? parameterIndex(initializer, parameterSymbolIds, scopes, canUnwrapSerialization, visitedNodes) : null;
+	}
+	if (canUnwrapSerialization && isNodeOfType(strippedExpression, "CallExpression") && isNodeOfType(strippedExpression.callee, "MemberExpression") && !strippedExpression.callee.computed && isNodeOfType(strippedExpression.callee.object, "Identifier") && strippedExpression.callee.object.name === "JSON" && isNodeOfType(strippedExpression.callee.property, "Identifier") && strippedExpression.callee.property.name === "stringify") {
+		const serializedArgument = strippedExpression.arguments[0];
+		return serializedArgument ? parameterIndex(serializedArgument, parameterSymbolIds, scopes, true, visitedNodes) : null;
+	}
+	return null;
+};
+const storageHelperSinkCache = /* @__PURE__ */ new WeakMap();
+const findStorageHelperSinks = (functionNode, scopes) => {
+	const cachedSinks = storageHelperSinkCache.get(functionNode);
+	if (cachedSinks) return cachedSinks;
+	if (!isNodeOfType(functionNode, "FunctionDeclaration") && !isNodeOfType(functionNode, "FunctionExpression") && !isNodeOfType(functionNode, "ArrowFunctionExpression")) {
+		storageHelperSinkCache.set(functionNode, []);
+		return [];
+	}
+	const parameterSymbolIds = stripThisParameter(functionNode.params).map((parameter) => {
+		const strippedParameter = stripParenExpression(parameter);
+		const identifier = isNodeOfType(strippedParameter, "Identifier") ? strippedParameter : isNodeOfType(strippedParameter, "AssignmentPattern") && isNodeOfType(strippedParameter.left, "Identifier") ? strippedParameter.left : null;
+		return identifier ? scopes.symbolFor(identifier)?.id ?? null : null;
+	});
+	const helperSinks = [];
+	walkAst(functionNode.body, (child) => {
+		if (child !== functionNode.body && isFunctionLike$1(child)) return false;
+		if (!isNodeOfType(child, "CallExpression")) return;
+		const callee = stripParenExpression(child.callee);
+		if (!isNodeOfType(callee, "MemberExpression") || callee.computed || !isNodeOfType(callee.property, "Identifier") || callee.property.name !== "setItem" || !isWebStorageObject(callee.object)) return;
+		const keyExpression = child.arguments[0];
+		const valueExpression = child.arguments[1];
+		if (!keyExpression || !valueExpression) return;
+		const keyParameterIndex = parameterIndex(keyExpression, parameterSymbolIds, scopes, false);
+		const valueParameterIndex = parameterIndex(valueExpression, parameterSymbolIds, scopes, true);
+		if (keyParameterIndex === null || valueParameterIndex === null) return;
+		helperSinks.push({
+			keyParameterIndex,
+			valueParameterIndex
+		});
+	});
+	storageHelperSinkCache.set(functionNode, helperSinks);
+	return helperSinks;
+};
 const authTokenInWebStorage = defineRule({
 	id: "auth-token-in-web-storage",
 	title: "Auth token in web storage",
@@ -6792,14 +6912,23 @@ const authTokenInWebStorage = defineRule({
 	recommendation: "Don't persist auth tokens (JWTs, access/refresh tokens, secrets) in `localStorage`/`sessionStorage`; they're readable by any XSS. Use an `HttpOnly` cookie set by the server.",
 	create: skipNonProductionFiles((context) => ({
 		CallExpression(node) {
-			const callee = node.callee;
-			if (!isNodeOfType(callee, "MemberExpression") || callee.computed) return;
-			if (!isNodeOfType(callee.property, "Identifier") || callee.property.name !== "setItem") return;
-			if (!isWebStorageObject(stripParenExpression(callee.object))) return;
-			const keyArgument = node.arguments?.[0];
-			if (!keyArgument) return;
-			const keyString = resolveStaticKeyString(keyArgument);
-			if (keyString === null || !isAuthCredentialKey(keyString)) return;
+			const callee = stripParenExpression(node.callee);
+			const keyArguments = [];
+			if (isNodeOfType(callee, "MemberExpression") && !callee.computed && isNodeOfType(callee.property, "Identifier") && callee.property.name === "setItem" && isWebStorageObject(stripParenExpression(callee.object))) {
+				const keyArgument = node.arguments[0];
+				if (keyArgument) keyArguments.push(keyArgument);
+			} else if (isNodeOfType(callee, "Identifier")) {
+				const helperFunction = immutableInitializer(callee);
+				const helperSinks = helperFunction ? findStorageHelperSinks(helperFunction, context.scopes) : [];
+				for (const helperSink of helperSinks) {
+					const keyArgument = node.arguments[helperSink.keyParameterIndex];
+					if (keyArgument && node.arguments[helperSink.valueParameterIndex]) keyArguments.push(keyArgument);
+				}
+			}
+			if (!keyArguments.some((keyArgument) => {
+				const keyString = resolveStaticKeyString(keyArgument);
+				return keyString !== null && isAuthCredentialKey(keyString);
+			})) return;
 			context.report({
 				node,
 				message: MESSAGE$60
@@ -7047,9 +7176,6 @@ const isCreateElementCall = (node) => {
 	return false;
 };
 //#endregion
-//#region src/plugin/utils/is-nullish-expression.ts
-const isNullishExpression = (expression) => isNodeOfType(expression, "Literal") && expression.value === null || isNodeOfType(expression, "Identifier") && expression.name === "undefined" || isNodeOfType(expression, "UnaryExpression") && expression.operator === "void";
-//#endregion
 //#region src/plugin/rules/react-builtins/button-has-type.ts
 const MISSING_MESSAGE$2 = "Your users can submit the form by accident because a `<button>` with no `type` defaults to submit.";
 const INVALID_MESSAGE = "This button has an invalid `type`, so the browser may treat it like a submit button.";
@@ -8566,17 +8692,6 @@ const createMethodMutationAnalysis = (context) => {
 //#region src/plugin/utils/is-member-property.ts
 const isMemberProperty = (node, propertyName) => Boolean(node && isNodeOfType(node, "MemberExpression") && isNodeOfType(node.property, "Identifier") && node.property.name === propertyName);
 //#endregion
-//#region src/plugin/utils/collect-function-return-statements.ts
-const collectFunctionReturnStatements = (functionNode) => {
-	if (!isFunctionLike$1(functionNode) || !isNodeOfType(functionNode.body, "BlockStatement")) return [];
-	const returnStatements = [];
-	walkAst(functionNode.body, (node) => {
-		if (node !== functionNode.body && (isFunctionLike$1(node) || isNodeOfType(node, "ClassDeclaration") || isNodeOfType(node, "ClassExpression"))) return false;
-		if (isNodeOfType(node, "ReturnStatement")) returnStatements.push(node);
-	});
-	return returnStatements;
-};
-//#endregion
 //#region src/plugin/utils/statement-always-exits.ts
 const statementAlwaysExits = (statement) => {
 	if (isNodeOfType(statement, "ReturnStatement") || isNodeOfType(statement, "ThrowStatement")) return true;
@@ -14751,6 +14866,29 @@ const getReleaseVerbName = (node) => {
 	}
 	return null;
 };
+const isRetainedAbortControllerRefRelease = (releaseReceiver, usage, context) => {
+	const releaseFunction = findEnclosingFunction$1(releaseReceiver);
+	const usageFunction = findEnclosingFunction$1(usage.node);
+	if (!releaseFunction || !usageFunction || !isFunctionLike$1(usageFunction) || !isReturnedEffectCleanupFunction(releaseFunction) || !hasReactRefCurrentOrigin(releaseReceiver, context.scopes)) return false;
+	const controllerKey = getListenerAbortControllerKey(usage, context);
+	const refCurrentKey = resolveExpressionKey(releaseReceiver, context);
+	if (controllerKey === null || refCurrentKey === null) return false;
+	const usageFunctionBody = usageFunction.body;
+	const previousAbortCalls = [];
+	const ownershipAssignments = [];
+	walkAst(usageFunctionBody, (child) => {
+		if (child !== usageFunctionBody && isFunctionLike$1(child)) return false;
+		if (isNodeOfType(child, "AssignmentExpression") && resolveExpressionKey(child.left, context) === refCurrentKey && resolveExpressionKey(child.right, context) === controllerKey) {
+			ownershipAssignments.push(child);
+			return;
+		}
+		if (!isNodeOfType(child, "CallExpression")) return;
+		const childCallee = isNodeOfType(child.callee, "ChainExpression") ? child.callee.expression : stripParenExpression(child.callee);
+		if (isNodeOfType(childCallee, "MemberExpression") && !childCallee.computed && isNodeOfType(childCallee.property, "Identifier") && childCallee.property.name === "abort" && resolveExpressionKey(childCallee.object, context) === refCurrentKey) previousAbortCalls.push(child);
+	});
+	const safeOwnershipAssignments = ownershipAssignments.filter((assignment) => doMatchingNodesCoverEveryPathBeforeUsage(assignment, previousAbortCalls, usageFunction, context));
+	return doMatchingNodesCoverEveryPathBeforeUsage(usage.node, safeOwnershipAssignments, usageFunction, context);
+};
 const doesReleaseCallMatchUsage = (node, usage, context) => {
 	const callNode = isNodeOfType(node, "ChainExpression") ? node.expression : node;
 	if (!isNodeOfType(callNode, "CallExpression")) return false;
@@ -14770,6 +14908,7 @@ const doesReleaseCallMatchUsage = (node, usage, context) => {
 	if (usage.kind === "socket") return usage.handleKey !== null && releaseReceiverKey === usage.handleKey && (SOCKET_RELEASE_VERB_NAMES.has(releaseVerbName) || UNIVERSAL_RELEASE_VERB_NAMES.has(releaseVerbName));
 	if (usage.handleKey !== null && releaseReceiverKey === usage.handleKey && (releaseVerbName === "unsubscribe" || releaseVerbName === "unsub" || releaseVerbName === "close" || releaseVerbName === "unwatch" || releaseVerbName === "unlisten" || BOUND_RESOURCE_RELEASE_METHOD_NAMES.has(releaseVerbName))) return true;
 	if (releaseVerbName === "abort" && releaseReceiverKey === getListenerAbortControllerKey(usage, context)) return true;
+	if (releaseVerbName === "abort" && isRetainedAbortControllerRefRelease(callee.object, usage, context)) return true;
 	if (usage.receiverKey === null || releaseReceiverKey !== usage.receiverKey) return false;
 	const pairedVerbNames = usage.registrationVerbName ? PAIRED_RELEASE_VERB_NAMES_BY_REGISTRATION_VERB.get(usage.registrationVerbName) : null;
 	if (!pairedVerbNames || !matchesPairedReleaseVerb(releaseVerbName, pairedVerbNames)) return false;
@@ -14803,9 +14942,11 @@ const doesReleaseCallMatchUsage = (node, usage, context) => {
 		return isNodeOfType(handlerArgument, "Literal") && handlerArgument.value === null;
 	}
 	if (releaseVerbName === "removeEventListener" || releaseVerbName === "removeListener" || releaseVerbName === "off") {
-		const releaseHandler = callNode.arguments?.[1];
+		const usesUnaryListenerSignature = usage.registrationVerbName === "addListener" && isNodeOfType(usage.node, "CallExpression") && usage.node.arguments?.length === 1 && callNode.arguments?.length === 1;
+		const releaseHandler = usesUnaryListenerSignature ? callNode.arguments?.[0] : callNode.arguments?.[1];
 		if (!releaseHandler) return releaseVerbName === "off";
-		return usage.handlerKey !== null && resolveExpressionKey(releaseHandler, context) === usage.handlerKey;
+		const expectedHandlerKey = usesUnaryListenerSignature ? usage.eventKey : usage.handlerKey;
+		return expectedHandlerKey !== null && resolveExpressionKey(releaseHandler, context) === expectedHandlerKey;
 	}
 	if (releaseVerbName === "unobserve" && usage.eventKey !== null) return releaseEventKey === usage.eventKey;
 	return true;
@@ -14818,8 +14959,7 @@ const isReturnedEffectCleanupFunction = (functionNode) => {
 		currentNode = parentNode;
 		parentNode = currentNode.parent;
 	}
-	if (!isNodeOfType(parentNode, "ReturnStatement") || parentNode.argument !== currentNode) return false;
-	const effectCallback = findEnclosingFunction$1(parentNode);
+	const effectCallback = isNodeOfType(parentNode, "ReturnStatement") && parentNode.argument === currentNode ? findEnclosingFunction$1(parentNode) : isNodeOfType(parentNode, "ArrowFunctionExpression") && parentNode.body === currentNode ? parentNode : null;
 	const effectCall = effectCallback?.parent;
 	return Boolean(effectCallback && isNodeOfType(effectCall, "CallExpression") && isHookCall$2(effectCall, CLEANUP_EFFECT_HOOK_NAMES));
 };
@@ -15105,6 +15245,11 @@ const doesResourceResultEscape = (resourceNode, allowReturnedResourceEscape, all
 			parentNode = currentNode.parent;
 			continue;
 		}
+		if (isNodeOfType(parentNode, "ConditionalExpression") && (parentNode.consequent === currentNode || parentNode.alternate === currentNode) || isNodeOfType(parentNode, "LogicalExpression") && (parentNode.right === currentNode || parentNode.left === currentNode && parentNode.operator !== "&&")) {
+			currentNode = parentNode;
+			parentNode = currentNode.parent;
+			continue;
+		}
 		if (isNodeOfType(parentNode, "VariableDeclarator") && parentNode.init === currentNode && isNodeOfType(parentNode.id, "Identifier") && isNodeOfType(parentNode.parent, "VariableDeclaration") && parentNode.parent.kind === "const") {
 			const ownerFunction = findEnclosingFunction$1(resourceNode);
 			const resourceSymbol = context.scopes.symbolFor(parentNode.id);
@@ -34171,6 +34316,7 @@ const noChainStateUpdates = defineRule({
 	id: "no-chain-state-updates",
 	title: "State updates chained through effects",
 	severity: "warn",
+	disabledWhen: ["react:18"],
 	tags: ["test-noise"],
 	recommendation: "Set all the related state together in the event handler that starts it, instead of having one useEffect react to a state change and set more state. See https://react.dev/learn/you-might-not-need-an-effect#chains-of-computations",
 	create: (context) => ({ CallExpression(node) {
@@ -53124,12 +53270,6 @@ const isInsideEs6Component$1 = (methodDefinition) => {
 	if (!owningClass) return false;
 	return isPreactOrReactComponentClass(owningClass);
 };
-const stripThisParameter = (params) => {
-	const first = params[0];
-	if (!first) return params;
-	if (isNodeOfType(first, "Identifier") && first.name === "this") return params.slice(1);
-	return params;
-};
 const preactNoRenderArguments = defineRule({
 	id: "preact-no-render-arguments",
 	title: "render() reads props from arguments",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oxlint-plugin-react-doctor",
-  "version": "0.7.9-dev.b392093",
+  "version": "0.7.9-dev.b51022f",
   "description": "React Doctor rules for oxlint.",
   "keywords": [
     "accessibility",