pi-lens 3.8.73 → 3.8.74

package/rules/ast-grep-rules/rules/no-javascript-url.yml

@@ -15,13 +15,49 @@ note: |
   `.only`/`.skip`/`.each` variants): a test asserting that a guard REJECTS a
   `javascript:` URL — e.g. `expect(openBrowser("javascript:...")).toBe(false)`
   — is the adversarial input the code is meant to reject, not a real sink.
+
+  Also excludes literals used as the needle in a defensive string check —
+  `url.startsWith("javascript:")`, `.endsWith(...)`, `.includes(...)`,
+  `.indexOf(...)`, `.search(...)`, `.match(...)` — or as one side of an
+  equality/inequality comparison (`url === "javascript:..."`). These are the
+  code detecting/rejecting a javascript: URL, not introducing one (refs
+  #533). Deliberately NOT excluded: `.replace(...)`/`.replaceAll(...)`,
+  since the literal there could be the replacement (second) argument —
+  i.e. the malicious payload being substituted IN — and excluding the
+  whole call would hide that true positive.
+
+  IMPORTANT: unlike the expect/it/test/describe exclusion above, these two
+  new exclusions deliberately do NOT use `stopBy: end`. `inside` without
+  `stopBy` only checks the immediate parent, so the literal must be a
+  DIRECT argument/operand of the defensive call/comparison — not merely
+  somewhere in its subtree. Without this constraint, a real sink smuggled
+  inside the call/comparison would go unflagged, e.g.
+  `candidates.includes(link.href = "javascript:alert(1)")` (assignment
+  nested in `.includes()`'s argument), `arr.includes((a.href =
+  "javascript:...", true))` (comma operator), or `(a.href =
+  "javascript:...") === expected` (assignment nested in a `===` operand) —
+  in all three the literal's immediate parent is the assignment
+  expression, not the `arguments`/`binary_expression` node, so it stays
+  flagged.
 rule:
   kind: string
   regex: '^"javascript:'
   not:
-    inside:
-      stopBy: end
-      kind: call_expression
-      has:
-        field: function
-        regex: "^(expect|it|test|describe)(\\.\\w+)?$"
+    any:
+      - inside:
+          stopBy: end
+          kind: call_expression
+          has:
+            field: function
+            regex: "^(expect|it|test|describe)(\\.\\w+)?$"
+      - inside:
+          kind: arguments
+          inside:
+            kind: call_expression
+            has:
+              field: function
+              regex: "\\.(startsWith|endsWith|includes|indexOf|search|match)$"
+      - inside:
+          kind: binary_expression
+          has:
+            regex: "^(===|!==|==|!=)$"

package/rules/ast-grep-rules/rules/strict-equality-js.yml

@@ -5,6 +5,19 @@ severity: warning
 note: |
   == performs type coercion which leads to unexpected comparisons.
   Use === for strict equality checks.
+  EXCEPT `$X == null` / `$X == undefined` (and the reversed operand order):
+  `== null` is the canonical JS/TS idiom for "is null or undefined" —
+  rewriting it to `===` changes behavior by dropping the other nullish
+  case, which is a real bug, not a style fix (#966).
 rule:
-  pattern: $X == $Y
+  all:
+    - pattern: $X == $Y
+    - not:
+        any:
+          - has:
+              field: right
+              regex: "^(null|undefined)$"
+          - has:
+              field: left
+              regex: "^(null|undefined)$"
 fix: $X === $Y

package/rules/ast-grep-rules/rules/strict-equality.yml

@@ -5,6 +5,19 @@ severity: warning
 note: |
   == performs type coercion which leads to unexpected comparisons.
   Use === for strict equality checks.
+  EXCEPT `$X == null` / `$X == undefined` (and the reversed operand order):
+  `== null` is the canonical JS/TS idiom for "is null or undefined" —
+  rewriting it to `===` changes behavior by dropping the other nullish
+  case, which is a real bug, not a style fix (#966).
 rule:
-  pattern: $X == $Y
+  all:
+    - pattern: $X == $Y
+    - not:
+        any:
+          - has:
+              field: right
+              regex: "^(null|undefined)$"
+          - has:
+              field: left
+              regex: "^(null|undefined)$"
 fix: $X === $Y

package/rules/ast-grep-rules/rules/strict-inequality-js.yml

@@ -5,6 +5,19 @@ severity: warning
 note: |
   != performs type coercion which leads to unexpected comparisons.
   Use !== for strict inequality checks.
+  EXCEPT `$X != null` / `$X != undefined` (and the reversed operand order):
+  `!= null` is the canonical JS/TS idiom for "is not null or undefined" —
+  rewriting it to `!==` changes behavior by dropping the other nullish
+  case, which is a real bug, not a style fix (#966).
 rule:
-  pattern: $X != $Y
+  all:
+    - pattern: $X != $Y
+    - not:
+        any:
+          - has:
+              field: right
+              regex: "^(null|undefined)$"
+          - has:
+              field: left
+              regex: "^(null|undefined)$"
 fix: $X !== $Y

package/rules/ast-grep-rules/rules/strict-inequality.yml

@@ -5,6 +5,19 @@ severity: warning
 note: |
   != performs type coercion which leads to unexpected comparisons.
   Use !== for strict inequality checks.
+  EXCEPT `$X != null` / `$X != undefined` (and the reversed operand order):
+  `!= null` is the canonical JS/TS idiom for "is not null or undefined" —
+  rewriting it to `!==` changes behavior by dropping the other nullish
+  case, which is a real bug, not a style fix (#966).
 rule:
-  pattern: $X != $Y
+  all:
+    - pattern: $X != $Y
+    - not:
+        any:
+          - has:
+              field: right
+              regex: "^(null|undefined)$"
+          - has:
+              field: left
+              regex: "^(null|undefined)$"
 fix: $X !== $Y

package/rules/tree-sitter-queries/cpp/no-memset-sensitive-data.yml

@@ -2,10 +2,10 @@
 # Detects memset used to clear sensitive data
 id: no-memset-sensitive-data
 name: memset Should Not Be Used to Delete Sensitive Data
-severity: error
+severity: warning
 category: security
 defect_class: security
-inline_tier: blocking
+inline_tier: warning
 language: cpp
 
 message: "memset should not be used to delete sensitive data — use SecureZeroMemory or explicit_bzero"
@@ -28,10 +28,16 @@ description: |
 query: |
   (call_expression
     function: (identifier) @FUNC (#eq? @FUNC "memset")
-    arguments: (argument_list) @ARGS)
+    arguments: (argument_list
+      (_) @DEST
+      (_) @VALUE
+      (_) @SIZE) @ARGS)
 
 metavars:
   - FUNC
+  - DEST
+  - VALUE
+  - SIZE
   - ARGS
 
 post_filter: memset_for_sensitive_data

package/rules/tree-sitter-queries/cpp/no-scoped-lock-without-args.yml

@@ -22,15 +22,15 @@ description: |
   ```
 
 query: |
-  (declaration
-    type: (template_type
-      name: (type_identifier) @TYPE (#eq? @TYPE "scoped_lock"))
-    declarator: (init_declarator
-      initializer: (argument_list) @ARGS))
+  ((declaration
+    type: (qualified_identifier
+      name: (type_identifier) @TYPE)
+    declarator: (identifier) @DECL)
+    (#eq? @TYPE "scoped_lock"))
 
 metavars:
   - TYPE
-  - ARGS
+  - DECL
 
 post_filter: scoped_lock_empty_args
 

package/rules/tree-sitter-queries/css/calc-spacing.yml

@@ -21,15 +21,17 @@ description: |
   ```
 
 query: |
-  (call_expression
-    function: (function_name) @FUNC (#eq? @FUNC "calc")
-    arguments: (arguments
-      (binary_expression
-        operator: ("+" | "-") @OP) @EXPR))
+  ((call_expression
+    (function_name) @FUNC
+    (arguments
+      (_) @LEFT
+      (_) @RIGHT) @EXPR)
+    (#eq? @FUNC "calc"))
 
 metavars:
   - FUNC
-  - OP
+  - LEFT
+  - RIGHT
   - EXPR
 
 post_filter: calc_missing_spaces

package/rules/tree-sitter-queries/go/go-mutex-copy.yml

@@ -6,33 +6,34 @@ defect_class: correctness
 inline_tier: blocking
 language: go
 
-message: "sync.Mutex copied by value — copy breaks the lock; use a pointer receiver or embed via pointer"
+message: "sync.Mutex parameter taken by value — the callee locks a copy; take *sync.Mutex instead"
 
 description: |
   A sync.Mutex must never be copied after first use. Copying a mutex copies
   its internal state, so both copies appear unlocked even if the original
   was locked — leading to data races and deadlocks.
 
-  This fires when a struct containing a Mutex is assigned by value or passed
-  by value to a function.
+  This fires on a parameter declared as a bare `sync.Mutex`/`sync.RWMutex`
+  value: the call copies the lock, so the callee locks its own copy. Copies
+  through a struct that embeds a mutex (a value receiver, or a struct-typed
+  parameter) are NOT detected — that needs the struct definition, which this
+  single-file query cannot resolve.
 
-  ✅ FIX: pass structs containing mutexes by pointer, or use *sync.Mutex.
+  ✅ FIX: take the mutex as *sync.Mutex, or reach it through a pointer receiver.
 
   ❌ NEVER:
-    type S struct { mu sync.Mutex }
-    func work(s S) { s.mu.Lock() }  // copies the mutex!
+    func work(mu sync.Mutex) { mu.Lock() }  // locks a copy!
 
   ✅ SAFE:
-    func work(s *S) { s.mu.Lock() }
+    func work(mu *sync.Mutex) { mu.Lock() }
 
 query: |
-  (short_var_declaration
-    right: (call_expression
-      function: (selector_expression
-        operand: (identifier) @PKG
-        field: (field_identifier) @FN)
-      (#eq? @PKG "sync")
-      (#match? @FN "^(Mutex|RWMutex)$"))) @DECL
+  (parameter_declaration
+    type: (qualified_type
+      package: (package_identifier) @PKG
+      name: (type_identifier) @FN)
+    (#eq? @PKG "sync")
+    (#match? @FN "^(Mutex|RWMutex)$")) @DECL
 
 metavars:
   - PKG
@@ -49,9 +50,11 @@ tags:
 
 examples:
   bad: |
-    mu := sync.Mutex{}   // value copy if passed to function
-    doWork(mu)           // race condition
+    func doWork(mu sync.Mutex) {   // BAD - mu is a copy
+        mu.Lock()
+    }
 
   good: |
-    mu := &sync.Mutex{}
-    doWork(mu)
+    func doWork(mu *sync.Mutex) {
+        mu.Lock()
+    }

package/rules/tree-sitter-queries/go/go-shared-map-write-goroutine.yml

@@ -17,12 +17,12 @@ description: |
 
 query: |
   (go_statement
-    expression: (call_expression
+    (call_expression
       function: (func_literal
         body: (block
           (assignment_statement
-            left: (index_expression) @MAPWRITE
-            right: (_) @VALUE)))
+            left: (expression_list (index_expression) @MAPWRITE)
+            right: (expression_list (_) @VALUE))))
       arguments: (argument_list) @ARGS))
 
 metavars:

package/rules/tree-sitter-queries/java/infinite-loop-java.yml

@@ -25,11 +25,11 @@ description: |
 
 query: |
   (while_statement
-    condition: (true) @COND
+    condition: (condition (true) @COND)
     body: (block) @BODY)
   (for_statement
-    condition: (null)
-    body: (block) @BODY)
+    !condition
+    (block) @BODY)
 
 metavars:
   - COND

package/rules/tree-sitter-queries/java/junit-call-super.yml

@@ -28,10 +28,12 @@ description: |
 query: |
   (method_declaration
     (modifiers
-      (annotation
-        name: (identifier) @OVERRIDE (#eq? @OVERRIDE "Override")))
-    name: (identifier) @METHOD (#match? @METHOD "^(setUp|tearDown|setUpBeforeClass|tearDownAfterClass)$")
-    body: (block) @BODY)
+      (marker_annotation
+        name: (identifier) @OVERRIDE))
+    name: (identifier) @METHOD
+    body: (block) @BODY
+    (#eq? @OVERRIDE "Override")
+    (#match? @METHOD "^(setUp|tearDown|setUpBeforeClass|tearDownAfterClass)$"))
 
 metavars:
   - OVERRIDE

package/rules/tree-sitter-queries/java/no-double-checked-locking.yml

@@ -28,18 +28,20 @@ description: |
 
 query: |
   (if_statement
-    condition: (binary_expression
-      left: (identifier) @FIELD
-      operator: ("==")
-      right: ("null"))
+    condition: (condition
+      (binary_expression
+        left: (identifier) @FIELD
+        "=="
+        (null_literal) @NULL))
     consequence: (block
       (synchronized_statement
         body: (block
           (if_statement
-            condition: (binary_expression
-              left: (identifier) @FIELD2
-              operator: ("==")
-              right: ("null")))))))
+            condition: (condition
+              (binary_expression
+                left: (identifier) @FIELD2
+                "=="
+                (null_literal) @NULL2)))))))
 
 metavars:
   - FIELD

package/rules/tree-sitter-queries/java/no-field-shadowing.yml

@@ -27,7 +27,7 @@ description: |
 
 query: |
   (class_declaration
-    (extends_clause
+    superclass: (superclass
       (type_identifier) @PARENT)
     body: (class_body
       (field_declaration

package/rules/tree-sitter-queries/java/prepared-statement-valid-indices.yml

@@ -26,15 +26,14 @@ query: |
   (method_invocation
     name: (identifier) @METHOD (#match? @METHOD "^(setString|setInt|setLong|setDouble|setBoolean|getString|getInt|getLong|getDouble|getBoolean)$")
     arguments: (argument_list
-      (decimal_integer_literal) @INDEX) @ARGS)
+      (decimal_integer_literal) @INDEX
+      (#match? @INDEX "^0+$")) @ARGS)
 
 metavars:
   - METHOD
   - INDEX
   - ARGS
 
-post_filter: invalid_statement_index
-
 tags:
   - reliability
   - java

package/rules/tree-sitter-queries/java/resources-closed.yml

@@ -2,10 +2,10 @@
 # Detects resources that should be closed (pre-Java 7 style)
 id: resources-closed
 name: Resources Should Be Closed
-severity: error
+severity: warning
 category: reliability
 defect_class: correctness
-inline_tier: blocking
+inline_tier: warning
 language: java
 
 message: "Resource '{{RESOURCE}}' should be closed in finally block"

package/rules/tree-sitter-queries/java/springboot-default-package.yml

@@ -30,9 +30,12 @@ description: |
 query: |
   (class_declaration
     (modifiers
-      (annotation
-        name: (identifier) @ANNOT (#match? @ANNOT "^(SpringBootApplication|ComponentScan)$")))
-    name: (_) @CLASS)
+      [(marker_annotation
+        name: (identifier) @ANNOT)
+       (annotation
+        name: (identifier) @ANNOT)])
+    name: (_) @CLASS
+    (#match? @ANNOT "^(SpringBootApplication|ComponentScan)$"))
 
 metavars:
   - ANNOT

package/rules/tree-sitter-queries/java/switch-fall-through.yml

@@ -29,11 +29,13 @@ description: |
   ```
 
 query: |
-  (switch_statement
+  (switch_expression
     body: (switch_block
-      (switch_label) @LABEL
-      (expression_statement)*
-      (switch_label) @NEXT_LABEL))
+      (switch_block_statement_group
+        (switch_label) @LABEL
+        (expression_statement)+)
+      (switch_block_statement_group
+        (switch_label) @NEXT_LABEL)))
 
 metavars:
   - LABEL

package/rules/tree-sitter-queries/java/switch-non-case-labels.yml

@@ -27,10 +27,11 @@ description: |
   ```
 
 query: |
-  (switch_statement
+  (switch_expression
     body: (switch_block
-      (labeled_statement
-        (identifier) @LABEL) @LABELED_STMT))
+      (switch_block_statement_group
+        (labeled_statement
+          (identifier) @LABEL) @LABELED_STMT)))
 
 metavars:
   - LABEL

package/rules/tree-sitter-queries/java/tests-include-assertions.yml

@@ -2,10 +2,10 @@
 # Detects JUnit tests without assertions
 id: tests-include-assertions
 name: Tests Should Include Assertions
-severity: error
+severity: warning
 category: maintainability
 defect_class: correctness
-inline_tier: blocking
+inline_tier: warning
 language: java
 
 message: "Test method should include at least one assertion"
@@ -26,10 +26,11 @@ description: |
 query: |
   (method_declaration
     (modifiers
-      (annotation
-        name: (identifier) @TEST (#match? @TEST "^(Test|ParameterizedTest|RepeatedTest)$")))
+      (marker_annotation
+        name: (identifier) @TEST))
     name: (identifier) @NAME
-    body: (block) @BODY)
+    body: (block) @BODY
+    (#match? @TEST "^(Test|ParameterizedTest|RepeatedTest)$"))
 
 metavars:
   - TEST

package/rules/tree-sitter-queries/javascript/switch-case-termination-js.yml

@@ -26,16 +26,13 @@ description: |
   ```
 
 query: |
-  (switch_statement
-    body: (switch_body
-      (switch_case
-        consequence: (statement_block
-          (expression_statement) @LAST))
-      (switch_case) @NEXT))
+  (switch_body
+    (switch_case) @CASE
+    .
+    [(switch_case) (switch_default)])
 
 metavars:
-  - LAST
-  - NEXT
+  - CASE
 
 post_filter: no_terminating_statement
 

package/rules/tree-sitter-queries/javascript/switch-non-case-labels.yml

@@ -19,8 +19,9 @@ description: |
 query: |
   (switch_statement
     body: (switch_body
-      (labeled_statement
-        (statement_identifier) @LABEL) @LABELED))
+      (switch_case
+        (labeled_statement
+          (statement_identifier) @LABEL) @LABELED)))
 
 metavars:
   - LABEL

package/rules/tree-sitter-queries/kotlin/prepared-statement-indices.yml

@@ -21,17 +21,21 @@ description: |
 
 query: |
   (call_expression
-    (simple_identifier) @METHOD (#match? @METHOD "^(setString|setInt|setLong|getString|getInt|getLong)$")
-    (value_arguments
-      (integer_literal) @INDEX) @ARGS)
+    (navigation_expression
+      (simple_identifier)
+      (navigation_suffix
+        (simple_identifier) @METHOD))
+    (call_suffix
+      (value_arguments
+        (value_argument (integer_literal) @INDEX) @ARGS))
+    (#match? @METHOD "^(setString|setInt|setLong|getString|getInt|getLong)$")
+    (#eq? @INDEX "0"))
 
 metavars:
   - METHOD
   - INDEX
   - ARGS
 
-post_filter: invalid_jdbc_index
-
 tags:
   - reliability
   - kotlin

package/rules/tree-sitter-queries/php/this-in-static-context.yml

@@ -33,15 +33,15 @@ description: |
 
 query: |
   (method_declaration
-    (modifiers
-      "static")
+    (static_modifier)
     body: (compound_statement
-      ((variable_name) @THIS
-        (#eq? @THIS "$this"))))
+      (return_statement
+        (member_access_expression
+          object: ((variable_name) @THIS
+            (#eq? @THIS "$this"))))) )
 
 metavars:
   - THIS
-  - VAR
 
 tags:
   - reliability

package/rules/tree-sitter-queries/python/exit-signature-check.yml

@@ -28,18 +28,11 @@ description: |
 query: |
   (function_definition
     name: (identifier) @NAME (#eq? @NAME "__exit__")
-    parameters: (parameters
-      (_) @SELF
-      . (_) @PARAM1?
-      . (_) @PARAM2?
-      . (_) @PARAM3?))
+    parameters: (parameters) @PARAMS)
 
 metavars:
   - NAME
-  - SELF
-  - PARAM1
-  - PARAM2
-  - PARAM3
+  - PARAMS
 
 post_filter: exit_params_insufficient
 

package/rules/tree-sitter-queries/python/in-operator-unsupported.yml

@@ -25,12 +25,11 @@ query: |
   (comparison_operator
     (identifier) @OBJ
     "in"
-    (identifier) @TARGET)
+    (_) @TARGET)
   (comparison_operator
     (identifier) @OBJ
-    "not"
-    "in"
-    (identifier) @TARGET)
+    "not in"
+    (_) @TARGET)
 
 metavars:
   - OBJ

package/rules/tree-sitter-queries/python/no-super-torchscript.yml

@@ -17,19 +17,15 @@ description: |
   ✅ FIX: Use composition or avoid TorchScript for this class
 
 query: |
-  (function_definition
-    (decorator
-      (call
-        function: (identifier) @DEC (#match? @DEC "^(torch\.jit\.script|jit\.script)$")))
-    body: (block
-      (call
-        function: (identifier) @FUNC (#eq? @FUNC "super")) @CALL))
+  (call
+    function: (identifier) @FUNC (#eq? @FUNC "super")) @CALL
 
 metavars:
-  - DEC
   - FUNC
   - CALL
 
+post_filter: torchscript_super_call
+
 tags:
   - reliability
   - python

package/rules/tree-sitter-queries/python/notimplemented-boolean-context.yml

@@ -28,13 +28,9 @@ query: |
     condition: (identifier) @COND (#eq? @COND "NotImplemented"))
   (while_statement
     condition: (identifier) @COND (#eq? @COND "NotImplemented"))
-  (binary_operator
-    (identifier) @COND (#eq? @COND "NotImplemented")
-    ("and" | "or"))
   (boolean_operator
     (identifier) @COND (#eq? @COND "NotImplemented"))
-  (unary_operator
-    operator: ("not")
+  (not_operator
     argument: (identifier) @COND (#eq? @COND "NotImplemented"))
 
 metavars: