sourceverity 1.0.1 → 1.0.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/analysis/controlFlow.d.ts +5 -0
- package/dist/analysis/controlFlow.d.ts.map +1 -1
- package/dist/analysis/controlFlow.js +2388 -74
- package/dist/analysis/controlFlow.js.map +1 -1
- package/dist/analysis/frameworks.d.ts.map +1 -1
- package/dist/analysis/frameworks.js +136 -12
- package/dist/analysis/frameworks.js.map +1 -1
- package/dist/analysis/functions.d.ts.map +1 -1
- package/dist/analysis/functions.js +95 -19
- package/dist/analysis/functions.js.map +1 -1
- package/dist/analysis/promiseFlow.d.ts.map +1 -1
- package/dist/analysis/promiseFlow.js +85 -11
- package/dist/analysis/promiseFlow.js.map +1 -1
- package/dist/baseline/manager.js +1 -1
- package/dist/baseline/manager.js.map +1 -1
- package/dist/baseline/types.d.ts +1 -1
- package/dist/baseline/types.d.ts.map +1 -1
- package/dist/cli/main.d.ts.map +1 -1
- package/dist/cli/main.js +4 -2
- package/dist/cli/main.js.map +1 -1
- package/dist/core/paths.d.ts +0 -4
- package/dist/core/paths.d.ts.map +1 -1
- package/dist/core/paths.js +0 -6
- package/dist/core/paths.js.map +1 -1
- package/dist/core/version.d.ts +9 -0
- package/dist/core/version.d.ts.map +1 -0
- package/dist/core/version.js +51 -0
- package/dist/core/version.js.map +1 -0
- package/dist/engine/runner.d.ts +6 -1
- package/dist/engine/runner.d.ts.map +1 -1
- package/dist/engine/runner.js +37 -20
- package/dist/engine/runner.js.map +1 -1
- package/dist/engine/symbols.d.ts +17 -4
- package/dist/engine/symbols.d.ts.map +1 -1
- package/dist/engine/symbols.js +267 -34
- package/dist/engine/symbols.js.map +1 -1
- package/dist/index.d.ts +1 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -0
- package/dist/index.js.map +1 -1
- package/dist/reporters/agent.d.ts +1 -1
- package/dist/reporters/agent.d.ts.map +1 -1
- package/dist/reporters/agent.js +2 -1
- package/dist/reporters/agent.js.map +1 -1
- package/dist/reporters/sarif.d.ts +2 -0
- package/dist/reporters/sarif.d.ts.map +1 -1
- package/dist/reporters/sarif.js +38 -8
- package/dist/reporters/sarif.js.map +1 -1
- package/dist/reporters/terminal.d.ts.map +1 -1
- package/dist/reporters/terminal.js +2 -1
- package/dist/reporters/terminal.js.map +1 -1
- package/dist/rules/async/floatingPromise.d.ts.map +1 -1
- package/dist/rules/async/floatingPromise.js +4 -2
- package/dist/rules/async/floatingPromise.js.map +1 -1
- package/dist/rules/browser/eventListenerCleanup.d.ts.map +1 -1
- package/dist/rules/browser/eventListenerCleanup.js +2 -9
- package/dist/rules/browser/eventListenerCleanup.js.map +1 -1
- package/dist/rules/browser/observerCleanup.d.ts.map +1 -1
- package/dist/rules/browser/observerCleanup.js +2 -9
- package/dist/rules/browser/observerCleanup.js.map +1 -1
- package/dist/rules/browser/timerCleanup.d.ts.map +1 -1
- package/dist/rules/browser/timerCleanup.js +194 -27
- package/dist/rules/browser/timerCleanup.js.map +1 -1
- package/dist/rules/network/fetchStatusUnchecked.d.ts.map +1 -1
- package/dist/rules/network/fetchStatusUnchecked.js +245 -46
- package/dist/rules/network/fetchStatusUnchecked.js.map +1 -1
- package/dist/rules/react/asyncEffectCallback.d.ts.map +1 -1
- package/dist/rules/react/asyncEffectCallback.js +2 -9
- package/dist/rules/react/asyncEffectCallback.js.map +1 -1
- package/dist/rules/react/derivedStateEffect.d.ts.map +1 -1
- package/dist/rules/react/derivedStateEffect.js +2 -9
- package/dist/rules/react/derivedStateEffect.js.map +1 -1
- package/dist/rules/react/missingEffectCleanup.d.ts.map +1 -1
- package/dist/rules/react/missingEffectCleanup.js +102 -10
- package/dist/rules/react/missingEffectCleanup.js.map +1 -1
- package/dist/rules/typescript/uncheckedIndexAccess.d.ts.map +1 -1
- package/dist/rules/typescript/uncheckedIndexAccess.js +55 -0
- package/dist/rules/typescript/uncheckedIndexAccess.js.map +1 -1
- package/dist/rules/typescript/unsafeUnvalidatedAssertion.d.ts.map +1 -1
- package/dist/rules/typescript/unsafeUnvalidatedAssertion.js +58 -21
- package/dist/rules/typescript/unsafeUnvalidatedAssertion.js.map +1 -1
- package/package.json +1 -1
|
@@ -1,4 +1,55 @@
|
|
|
1
1
|
import { getNodeSourceRange } from "../../engine/symbols.js";
|
|
2
|
+
function getLiteralIntegerIndex(expr, ts) {
|
|
3
|
+
let unwrapped = expr;
|
|
4
|
+
while (ts.isParenthesizedExpression(unwrapped)) {
|
|
5
|
+
unwrapped = unwrapped.expression;
|
|
6
|
+
}
|
|
7
|
+
if (ts.isNumericLiteral(unwrapped)) {
|
|
8
|
+
const val = Number(unwrapped.text);
|
|
9
|
+
if (Number.isInteger(val) && val >= 0) {
|
|
10
|
+
return val;
|
|
11
|
+
}
|
|
12
|
+
}
|
|
13
|
+
if (ts.isStringLiteral(unwrapped)) {
|
|
14
|
+
if (/^\d+$/.test(unwrapped.text)) {
|
|
15
|
+
const val = Number(unwrapped.text);
|
|
16
|
+
if (Number.isInteger(val) && val >= 0) {
|
|
17
|
+
return val;
|
|
18
|
+
}
|
|
19
|
+
}
|
|
20
|
+
}
|
|
21
|
+
return undefined;
|
|
22
|
+
}
|
|
23
|
+
function isStaticallySafeTupleAccess(index, type, checker, ts) {
|
|
24
|
+
if (type.isUnion()) {
|
|
25
|
+
return type.types.every((t) => isStaticallySafeTupleAccess(index, t, checker, ts));
|
|
26
|
+
}
|
|
27
|
+
if (!checker.isTupleType(type)) {
|
|
28
|
+
return false;
|
|
29
|
+
}
|
|
30
|
+
// In TypeScript TypeChecker, TupleType target stores elementFlags
|
|
31
|
+
// sourceverity-disable-next-line typescript/non-null-assertion-risk -- compiler internal property access guarded by isTupleType
|
|
32
|
+
const target = type.target ?? type;
|
|
33
|
+
const elementFlags = target.elementFlags;
|
|
34
|
+
if (!elementFlags || index < 0 || index >= elementFlags.length) {
|
|
35
|
+
return false;
|
|
36
|
+
}
|
|
37
|
+
const flag = elementFlags[index];
|
|
38
|
+
if (flag === undefined) {
|
|
39
|
+
return false;
|
|
40
|
+
}
|
|
41
|
+
// ts.ElementFlags: Required = 1, Optional = 2, Rest = 4, Variadic = 8
|
|
42
|
+
const isRequired = (flag & 1) !== 0;
|
|
43
|
+
const isOptionalOrRest = (flag & (2 | 4 | 8)) !== 0;
|
|
44
|
+
return isRequired && !isOptionalOrRest;
|
|
45
|
+
}
|
|
46
|
+
function isStaticallySafeIndexAccess(argExpr, containerType, checker, ts) {
|
|
47
|
+
const index = getLiteralIntegerIndex(argExpr, ts);
|
|
48
|
+
if (index === undefined) {
|
|
49
|
+
return false;
|
|
50
|
+
}
|
|
51
|
+
return isStaticallySafeTupleAccess(index, containerType, checker, ts);
|
|
52
|
+
}
|
|
2
53
|
export const uncheckedIndexAccessRule = {
|
|
3
54
|
meta: {
|
|
4
55
|
id: "typescript/unchecked-index-access",
|
|
@@ -42,6 +93,10 @@ export const uncheckedIndexAccessRule = {
|
|
|
42
93
|
if (isDereferenced) {
|
|
43
94
|
try {
|
|
44
95
|
const containerType = checker.getTypeAtLocation(node.expression);
|
|
96
|
+
// If the element access is proven statically safe (e.g. required fixed tuple index), do not report
|
|
97
|
+
if (isStaticallySafeIndexAccess(node.argumentExpression, containerType, checker, ts)) {
|
|
98
|
+
return;
|
|
99
|
+
}
|
|
45
100
|
// Check if container type is an Array, Tuple, or Record
|
|
46
101
|
const isArrayOrRecord = checker.isArrayType(containerType) ||
|
|
47
102
|
checker.isTupleType(containerType) ||
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"uncheckedIndexAccess.js","sourceRoot":"","sources":["../../../src/rules/typescript/uncheckedIndexAccess.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAG7D,MAAM,CAAC,MAAM,wBAAwB,GAAS;IAC5C,IAAI,EAAE;QACJ,EAAE,EAAE,mCAAmC;QACvC,QAAQ,EAAE,YAAY;QACtB,eAAe,EAAE,SAAS;QAC1B,iBAAiB,EAAE,QAAQ;QAC3B,WAAW,EAAE,uGAAuG;QACpH,uBAAuB,EAAE,IAAI;KAC9B;IAED,OAAO,CAAC,OAAoB;QAC1B,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC;QACrD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE;YAAE,OAAO;QAExC,MAAM,YAAY,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAClD,gEAAgE;QAChE,IAAI,YAAY,CAAC,wBAAwB,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,UAAU,CAAC,CAAC,IAAiB,EAAE,EAAE;YACvC,oCAAoC;YACpC,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC;gBAAE,OAAO;YAEhD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC3B,IAAI,CAAC,MAAM;gBAAE,OAAO;YAEpB,sDAAsD;YACtD,IAAI,cAAc,GAAG,KAAK,CAAC;YAE3B,4EAA4E;YAC5E,IAAI,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxE,4CAA4C;gBAC5C,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;oBAC7B,cAAc,GAAG,IAAI,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,+DAA+D;YAC/D,IAAI,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBAC9D,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;oBAC7B,cAAc,GAAG,IAAI,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,IAAI,cAAc,EAAE,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"uncheckedIndexAccess.js","sourceRoot":"","sources":["../../../src/rules/typescript/uncheckedIndexAccess.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAG7D,SAAS,sBAAsB,CAAC,IAAuB,EAAE,EAAiB;IACxE,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC;IACnC,CAAC;IACD,IAAI,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IACD,IAAI,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACtC,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,2BAA2B,CAClC,KAAa,EACb,IAAiB,EACjB,OAA2B,EAC3B,EAAiB;IAEjB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,2BAA2B,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,kEAAkE;IAClE,gIAAgI;IAChI,MAAM,MAAM,GAAI,IAA0D,CAAC,MAAM,IAAK,IAA6C,CAAC;IACpI,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IACzC,IAAI,CAAC,YAAY,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,sEAAsE;IACtE,MAAM,UAAU,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,gBAAgB,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAEpD,OAAO,UAAU,IAAI,CAAC,gBAAgB,CAAC;AACzC,CAAC;AAED,SAAS,2BAA2B,CAClC,OAA0B,EAC1B,aAA0B,EAC1B,OAA2B,EAC3B,EAAiB;IAEjB,MAAM,KAAK,GAAG,sBAAsB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,2BAA2B,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAS;IAC5C,IAAI,EAAE;QACJ,EAAE,EAAE,mCAAmC;QACvC,QAAQ,EAAE,YAAY;QACtB,eAAe,EAAE,SAAS;QAC1B,iBAAiB,EAAE,QAAQ;QAC3B,WAAW,EAAE,uGAAuG;QACpH,uBAAuB,EAAE,IAAI;KAC9B;IAED,OAAO,CAAC,OAAoB;QAC1B,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC;QACrD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE;YAAE,OAAO;QAExC,MAAM,YAAY,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAClD,gEAAgE;QAChE,IAAI,YAAY,CAAC,wBAAwB,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,UAAU,CAAC,CAAC,IAAiB,EAAE,EAAE;YACvC,oCAAoC;YACpC,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC;gBAAE,OAAO;YAEhD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC3B,IAAI,CAAC,MAAM;gBAAE,OAAO;YAEpB,sDAAsD;YACtD,IAAI,cAAc,GAAG,KAAK,CAAC;YAE3B,4EAA4E;YAC5E,IAAI,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxE,4CAA4C;gBAC5C,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;oBAC7B,cAAc,GAAG,IAAI,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,+DAA+D;YAC/D,IAAI,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBAC9D,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;oBAC7B,cAAc,GAAG,IAAI,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,IAAI,cAAc,EAAE,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAEjE,mGAAmG;oBACnG,IAAI,2BAA2B,CAAC,IAAI,CAAC,kBAAkB,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;wBACrF,OAAO;oBACT,CAAC;oBAED,wDAAwD;oBACxD,MAAM,eAAe,GACnB,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC;wBAClC,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC;wBAClC,aAAa,CAAC,kBAAkB,EAAE,KAAK,SAAS;wBAChD,aAAa,CAAC,kBAAkB,EAAE,KAAK,SAAS,CAAC;oBAEnD,IAAI,eAAe,EAAE,CAAC;wBACpB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;wBACnD,OAAO,CAAC,MAAM,CAAC;4BACb,MAAM,EAAE,mCAAmC;4BAC3C,QAAQ,EAAE,YAAY;4BACtB,QAAQ,EAAE,SAAS;4BACnB,UAAU,EAAE,QAAQ;4BACpB,OAAO,EAAE,mEAAmE;4BAC5E,IAAI,EAAE,UAAU,CAAC,QAAQ;4BACzB,KAAK;4BACL,QAAQ,EAAE;gCACR;oCACE,OAAO,EAAE,gIAAgI;oCACzI,KAAK;iCACN;6BACF;4BACD,eAAe,EAAE,4EAA4E;4BAC7F,gBAAgB,EAAE,KAAK;4BACvB,kBAAkB,EAAE,IAAI;yBACzB,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,4BAA4B;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"unsafeUnvalidatedAssertion.d.ts","sourceRoot":"","sources":["../../../src/rules/typescript/unsafeUnvalidatedAssertion.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAe,MAAM,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"unsafeUnvalidatedAssertion.d.ts","sourceRoot":"","sources":["../../../src/rules/typescript/unsafeUnvalidatedAssertion.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAe,MAAM,qBAAqB,CAAC;AAiB7D,eAAO,MAAM,8BAA8B,EAAE,IAiI5C,CAAC"}
|
|
@@ -1,7 +1,12 @@
|
|
|
1
|
-
import { getNodeSourceRange } from "../../engine/symbols.js";
|
|
1
|
+
import { getNodeSourceRange, isFetchResponseMethod } from "../../engine/symbols.js";
|
|
2
2
|
function unwrapExpression(expr, ts) {
|
|
3
3
|
let current = expr;
|
|
4
|
-
while (ts.isParenthesizedExpression(current) ||
|
|
4
|
+
while (ts.isParenthesizedExpression(current) ||
|
|
5
|
+
ts.isAwaitExpression(current) ||
|
|
6
|
+
(ts.isAsExpression(current) &&
|
|
7
|
+
(current.type.kind === ts.SyntaxKind.UnknownKeyword || current.type.kind === ts.SyntaxKind.AnyKeyword)) ||
|
|
8
|
+
(ts.isTypeAssertionExpression(current) &&
|
|
9
|
+
(current.type.kind === ts.SyntaxKind.UnknownKeyword || current.type.kind === ts.SyntaxKind.AnyKeyword))) {
|
|
5
10
|
current = current.expression;
|
|
6
11
|
}
|
|
7
12
|
return current;
|
|
@@ -16,7 +21,7 @@ export const unsafeUnvalidatedAssertionRule = {
|
|
|
16
21
|
requiresTypeInformation: false,
|
|
17
22
|
},
|
|
18
23
|
analyze(context) {
|
|
19
|
-
const { sourceFile, ts } = context;
|
|
24
|
+
const { sourceFile, checker, ts } = context;
|
|
20
25
|
if (!ts)
|
|
21
26
|
return;
|
|
22
27
|
context.visitNodes((node) => {
|
|
@@ -54,7 +59,7 @@ export const unsafeUnvalidatedAssertionRule = {
|
|
|
54
59
|
isRuntimeBoundary = true;
|
|
55
60
|
boundaryName = "JSON.parse()";
|
|
56
61
|
}
|
|
57
|
-
else if (callTarget.name.text === "json") {
|
|
62
|
+
else if (callTarget.name.text === "json" && isFetchResponseMethod(callTarget, checker, ts)) {
|
|
58
63
|
// 2. response.json()
|
|
59
64
|
isRuntimeBoundary = true;
|
|
60
65
|
boundaryName = "response.json()";
|
|
@@ -69,24 +74,56 @@ export const unsafeUnvalidatedAssertionRule = {
|
|
|
69
74
|
}
|
|
70
75
|
}
|
|
71
76
|
if (isRuntimeBoundary) {
|
|
77
|
+
let isInsideTryCatch = false;
|
|
78
|
+
let curr = node;
|
|
79
|
+
while (curr.parent && !ts.isSourceFile(curr.parent)) {
|
|
80
|
+
if (ts.isTryStatement(curr.parent) && curr.parent.tryBlock === curr) {
|
|
81
|
+
if (curr.parent.catchClause) {
|
|
82
|
+
isInsideTryCatch = true;
|
|
83
|
+
break;
|
|
84
|
+
}
|
|
85
|
+
}
|
|
86
|
+
curr = curr.parent;
|
|
87
|
+
}
|
|
72
88
|
const range = getNodeSourceRange(node, sourceFile);
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
89
|
+
if (isInsideTryCatch) {
|
|
90
|
+
context.report({
|
|
91
|
+
ruleId: "typescript/unsafe-unvalidated-assertion",
|
|
92
|
+
category: "typescript",
|
|
93
|
+
severity: "warning",
|
|
94
|
+
confidence: "medium",
|
|
95
|
+
message: `Runtime boundary data from ${boundaryName} is asserted to type without runtime validation (exceptions caught by local try/catch).`,
|
|
96
|
+
file: sourceFile.fileName,
|
|
97
|
+
range,
|
|
98
|
+
evidence: [
|
|
99
|
+
{
|
|
100
|
+
message: "Type assertions bypass compiler checking. While the surrounding try/catch prevents uncaught runtime crashes, untyped runtime structures may silently degrade domain state.",
|
|
101
|
+
range,
|
|
102
|
+
},
|
|
103
|
+
],
|
|
104
|
+
suggestedAction: "Validate payload with a runtime schema validator or type guard before asserting.",
|
|
105
|
+
safeAutomaticFix: false,
|
|
106
|
+
});
|
|
107
|
+
}
|
|
108
|
+
else {
|
|
109
|
+
context.report({
|
|
110
|
+
ruleId: "typescript/unsafe-unvalidated-assertion",
|
|
111
|
+
category: "typescript",
|
|
112
|
+
severity: "error",
|
|
113
|
+
confidence: "high",
|
|
114
|
+
message: `Runtime boundary data from ${boundaryName} is asserted to type without runtime validation.`,
|
|
115
|
+
file: sourceFile.fileName,
|
|
116
|
+
range,
|
|
117
|
+
evidence: [
|
|
118
|
+
{
|
|
119
|
+
message: "Type assertions bypass compiler checking without verifying that runtime structure satisfies the target type.",
|
|
120
|
+
range,
|
|
121
|
+
},
|
|
122
|
+
],
|
|
123
|
+
suggestedAction: "Validate payload with a runtime schema validator before asserting or casting.",
|
|
124
|
+
safeAutomaticFix: false,
|
|
125
|
+
});
|
|
126
|
+
}
|
|
90
127
|
}
|
|
91
128
|
});
|
|
92
129
|
},
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"unsafeUnvalidatedAssertion.js","sourceRoot":"","sources":["../../../src/rules/typescript/unsafeUnvalidatedAssertion.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;
|
|
1
|
+
{"version":3,"file":"unsafeUnvalidatedAssertion.js","sourceRoot":"","sources":["../../../src/rules/typescript/unsafeUnvalidatedAssertion.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAGpF,SAAS,gBAAgB,CAAC,IAAuB,EAAE,EAAiB;IAClE,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,OACE,EAAE,CAAC,yBAAyB,CAAC,OAAO,CAAC;QACrC,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC;QAC7B,CAAC,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC;YACzB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACzG,CAAC,EAAE,CAAC,yBAAyB,CAAC,OAAO,CAAC;YACpC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EACzG,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;IAC/B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAS;IAClD,IAAI,EAAE;QACJ,EAAE,EAAE,yCAAyC;QAC7C,QAAQ,EAAE,YAAY;QACtB,eAAe,EAAE,OAAO;QACxB,iBAAiB,EAAE,MAAM;QACzB,WAAW,EAAE,qFAAqF;QAClG,uBAAuB,EAAE,KAAK;KAC/B;IAED,OAAO,CAAC,OAAoB;QAC1B,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC;QAC5C,IAAI,CAAC,EAAE;YAAE,OAAO;QAEhB,OAAO,CAAC,UAAU,CAAC,CAAC,IAAiB,EAAE,EAAE;YACvC,IAAI,IAAmC,CAAC;YACxC,IAAI,QAAqC,CAAC;YAE1C,IAAI,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;gBACvB,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,CAAC;iBAAM,IAAI,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9C,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;gBACvB,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,CAAC;YAED,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAE/B,gFAAgF;YAChF,IACE,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,UAAU;gBAC1C,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,cAAc;gBAC9C,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa;gBAC7C,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa;gBAC7C,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,cAAc,EAC9C,CAAC;gBACD,OAAO;YACT,CAAC;YAED,2DAA2D;YAC3D,IAAI,iBAAiB,GAAG,KAAK,CAAC;YAC9B,IAAI,YAAY,GAAG,EAAE,CAAC;YAEtB,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAE9C,IAAI,EAAE,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpC,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;gBAEzC,qBAAqB;gBACrB,IAAI,EAAE,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC9C,IACE,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC;wBACtC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,MAAM;wBACrC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,EAChC,CAAC;wBACD,iBAAiB,GAAG,IAAI,CAAC;wBACzB,YAAY,GAAG,cAAc,CAAC;oBAChC,CAAC;yBAAM,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,qBAAqB,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;wBAC7F,qBAAqB;wBACrB,iBAAiB,GAAG,IAAI,CAAC;wBACzB,YAAY,GAAG,iBAAiB,CAAC;oBACnC,CAAC;yBAAM,IACL,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;wBAClC,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC;wBACtC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAClG,CAAC;wBACD,+BAA+B;wBAC/B,iBAAiB,GAAG,IAAI,CAAC;wBACzB,YAAY,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,YAAY,CAAC;oBAC3D,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,iBAAiB,EAAE,CAAC;gBACtB,IAAI,gBAAgB,GAAG,KAAK,CAAC;gBAC7B,IAAI,IAAI,GAAgB,IAAI,CAAC;gBAC7B,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBACpD,IAAI,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;wBACpE,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;4BAC5B,gBAAgB,GAAG,IAAI,CAAC;4BACxB,MAAM;wBACR,CAAC;oBACH,CAAC;oBACD,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;gBACrB,CAAC;gBAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBACnD,IAAI,gBAAgB,EAAE,CAAC;oBACrB,OAAO,CAAC,MAAM,CAAC;wBACb,MAAM,EAAE,yCAAyC;wBACjD,QAAQ,EAAE,YAAY;wBACtB,QAAQ,EAAE,SAAS;wBACnB,UAAU,EAAE,QAAQ;wBACpB,OAAO,EAAE,8BAA8B,YAAY,yFAAyF;wBAC5I,IAAI,EAAE,UAAU,CAAC,QAAQ;wBACzB,KAAK;wBACL,QAAQ,EAAE;4BACR;gCACE,OAAO,EACL,4KAA4K;gCAC9K,KAAK;6BACN;yBACF;wBACD,eAAe,EAAE,kFAAkF;wBACnG,gBAAgB,EAAE,KAAK;qBACxB,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,MAAM,CAAC;wBACb,MAAM,EAAE,yCAAyC;wBACjD,QAAQ,EAAE,YAAY;wBACtB,QAAQ,EAAE,OAAO;wBACjB,UAAU,EAAE,MAAM;wBAClB,OAAO,EAAE,8BAA8B,YAAY,kDAAkD;wBACrG,IAAI,EAAE,UAAU,CAAC,QAAQ;wBACzB,KAAK;wBACL,QAAQ,EAAE;4BACR;gCACE,OAAO,EACL,8GAA8G;gCAChH,KAAK;6BACN;yBACF;wBACD,eAAe,EAAE,+EAA+E;wBAChG,gBAAgB,EAAE,KAAK;qBACxB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}
|