sourceverity 1.0.2 → 1.0.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (67) hide show
  1. package/dist/analysis/controlFlow.d.ts +5 -0
  2. package/dist/analysis/controlFlow.d.ts.map +1 -1
  3. package/dist/analysis/controlFlow.js +501 -45
  4. package/dist/analysis/controlFlow.js.map +1 -1
  5. package/dist/analysis/frameworks.d.ts.map +1 -1
  6. package/dist/analysis/frameworks.js +84 -12
  7. package/dist/analysis/frameworks.js.map +1 -1
  8. package/dist/analysis/functions.d.ts.map +1 -1
  9. package/dist/analysis/functions.js +52 -8
  10. package/dist/analysis/functions.js.map +1 -1
  11. package/dist/analysis/promiseFlow.d.ts.map +1 -1
  12. package/dist/analysis/promiseFlow.js +85 -11
  13. package/dist/analysis/promiseFlow.js.map +1 -1
  14. package/dist/baseline/manager.js +1 -1
  15. package/dist/baseline/manager.js.map +1 -1
  16. package/dist/baseline/types.d.ts +1 -1
  17. package/dist/baseline/types.d.ts.map +1 -1
  18. package/dist/cli/main.d.ts.map +1 -1
  19. package/dist/cli/main.js +2 -1
  20. package/dist/cli/main.js.map +1 -1
  21. package/dist/core/paths.d.ts +0 -4
  22. package/dist/core/paths.d.ts.map +1 -1
  23. package/dist/core/paths.js +0 -6
  24. package/dist/core/paths.js.map +1 -1
  25. package/dist/engine/runner.d.ts +6 -1
  26. package/dist/engine/runner.d.ts.map +1 -1
  27. package/dist/engine/runner.js +37 -20
  28. package/dist/engine/runner.js.map +1 -1
  29. package/dist/engine/symbols.d.ts +17 -4
  30. package/dist/engine/symbols.d.ts.map +1 -1
  31. package/dist/engine/symbols.js +267 -34
  32. package/dist/engine/symbols.js.map +1 -1
  33. package/dist/reporters/sarif.d.ts +2 -0
  34. package/dist/reporters/sarif.d.ts.map +1 -1
  35. package/dist/reporters/sarif.js +36 -7
  36. package/dist/reporters/sarif.js.map +1 -1
  37. package/dist/rules/async/floatingPromise.d.ts.map +1 -1
  38. package/dist/rules/async/floatingPromise.js +4 -2
  39. package/dist/rules/async/floatingPromise.js.map +1 -1
  40. package/dist/rules/browser/eventListenerCleanup.d.ts.map +1 -1
  41. package/dist/rules/browser/eventListenerCleanup.js +2 -9
  42. package/dist/rules/browser/eventListenerCleanup.js.map +1 -1
  43. package/dist/rules/browser/observerCleanup.d.ts.map +1 -1
  44. package/dist/rules/browser/observerCleanup.js +2 -9
  45. package/dist/rules/browser/observerCleanup.js.map +1 -1
  46. package/dist/rules/browser/timerCleanup.d.ts.map +1 -1
  47. package/dist/rules/browser/timerCleanup.js +2 -9
  48. package/dist/rules/browser/timerCleanup.js.map +1 -1
  49. package/dist/rules/network/fetchStatusUnchecked.d.ts.map +1 -1
  50. package/dist/rules/network/fetchStatusUnchecked.js +245 -46
  51. package/dist/rules/network/fetchStatusUnchecked.js.map +1 -1
  52. package/dist/rules/react/asyncEffectCallback.d.ts.map +1 -1
  53. package/dist/rules/react/asyncEffectCallback.js +2 -9
  54. package/dist/rules/react/asyncEffectCallback.js.map +1 -1
  55. package/dist/rules/react/derivedStateEffect.d.ts.map +1 -1
  56. package/dist/rules/react/derivedStateEffect.js +2 -9
  57. package/dist/rules/react/derivedStateEffect.js.map +1 -1
  58. package/dist/rules/react/missingEffectCleanup.d.ts.map +1 -1
  59. package/dist/rules/react/missingEffectCleanup.js +102 -10
  60. package/dist/rules/react/missingEffectCleanup.js.map +1 -1
  61. package/dist/rules/typescript/uncheckedIndexAccess.d.ts.map +1 -1
  62. package/dist/rules/typescript/uncheckedIndexAccess.js +55 -0
  63. package/dist/rules/typescript/uncheckedIndexAccess.js.map +1 -1
  64. package/dist/rules/typescript/unsafeUnvalidatedAssertion.d.ts.map +1 -1
  65. package/dist/rules/typescript/unsafeUnvalidatedAssertion.js +9 -4
  66. package/dist/rules/typescript/unsafeUnvalidatedAssertion.js.map +1 -1
  67. package/package.json +1 -1
@@ -1,4 +1,55 @@
1
1
  import { getNodeSourceRange } from "../../engine/symbols.js";
2
+ function getLiteralIntegerIndex(expr, ts) {
3
+ let unwrapped = expr;
4
+ while (ts.isParenthesizedExpression(unwrapped)) {
5
+ unwrapped = unwrapped.expression;
6
+ }
7
+ if (ts.isNumericLiteral(unwrapped)) {
8
+ const val = Number(unwrapped.text);
9
+ if (Number.isInteger(val) && val >= 0) {
10
+ return val;
11
+ }
12
+ }
13
+ if (ts.isStringLiteral(unwrapped)) {
14
+ if (/^\d+$/.test(unwrapped.text)) {
15
+ const val = Number(unwrapped.text);
16
+ if (Number.isInteger(val) && val >= 0) {
17
+ return val;
18
+ }
19
+ }
20
+ }
21
+ return undefined;
22
+ }
23
+ function isStaticallySafeTupleAccess(index, type, checker, ts) {
24
+ if (type.isUnion()) {
25
+ return type.types.every((t) => isStaticallySafeTupleAccess(index, t, checker, ts));
26
+ }
27
+ if (!checker.isTupleType(type)) {
28
+ return false;
29
+ }
30
+ // In TypeScript TypeChecker, TupleType target stores elementFlags
31
+ // sourceverity-disable-next-line typescript/non-null-assertion-risk -- compiler internal property access guarded by isTupleType
32
+ const target = type.target ?? type;
33
+ const elementFlags = target.elementFlags;
34
+ if (!elementFlags || index < 0 || index >= elementFlags.length) {
35
+ return false;
36
+ }
37
+ const flag = elementFlags[index];
38
+ if (flag === undefined) {
39
+ return false;
40
+ }
41
+ // ts.ElementFlags: Required = 1, Optional = 2, Rest = 4, Variadic = 8
42
+ const isRequired = (flag & 1) !== 0;
43
+ const isOptionalOrRest = (flag & (2 | 4 | 8)) !== 0;
44
+ return isRequired && !isOptionalOrRest;
45
+ }
46
+ function isStaticallySafeIndexAccess(argExpr, containerType, checker, ts) {
47
+ const index = getLiteralIntegerIndex(argExpr, ts);
48
+ if (index === undefined) {
49
+ return false;
50
+ }
51
+ return isStaticallySafeTupleAccess(index, containerType, checker, ts);
52
+ }
2
53
  export const uncheckedIndexAccessRule = {
3
54
  meta: {
4
55
  id: "typescript/unchecked-index-access",
@@ -42,6 +93,10 @@ export const uncheckedIndexAccessRule = {
42
93
  if (isDereferenced) {
43
94
  try {
44
95
  const containerType = checker.getTypeAtLocation(node.expression);
96
+ // If the element access is proven statically safe (e.g. required fixed tuple index), do not report
97
+ if (isStaticallySafeIndexAccess(node.argumentExpression, containerType, checker, ts)) {
98
+ return;
99
+ }
45
100
  // Check if container type is an Array, Tuple, or Record
46
101
  const isArrayOrRecord = checker.isArrayType(containerType) ||
47
102
  checker.isTupleType(containerType) ||
@@ -1 +1 @@
1
- {"version":3,"file":"uncheckedIndexAccess.js","sourceRoot":"","sources":["../../../src/rules/typescript/uncheckedIndexAccess.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAG7D,MAAM,CAAC,MAAM,wBAAwB,GAAS;IAC5C,IAAI,EAAE;QACJ,EAAE,EAAE,mCAAmC;QACvC,QAAQ,EAAE,YAAY;QACtB,eAAe,EAAE,SAAS;QAC1B,iBAAiB,EAAE,QAAQ;QAC3B,WAAW,EAAE,uGAAuG;QACpH,uBAAuB,EAAE,IAAI;KAC9B;IAED,OAAO,CAAC,OAAoB;QAC1B,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC;QACrD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE;YAAE,OAAO;QAExC,MAAM,YAAY,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAClD,gEAAgE;QAChE,IAAI,YAAY,CAAC,wBAAwB,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,UAAU,CAAC,CAAC,IAAiB,EAAE,EAAE;YACvC,oCAAoC;YACpC,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC;gBAAE,OAAO;YAEhD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC3B,IAAI,CAAC,MAAM;gBAAE,OAAO;YAEpB,sDAAsD;YACtD,IAAI,cAAc,GAAG,KAAK,CAAC;YAE3B,4EAA4E;YAC5E,IAAI,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxE,4CAA4C;gBAC5C,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;oBAC7B,cAAc,GAAG,IAAI,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,+DAA+D;YAC/D,IAAI,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBAC9D,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;oBAC7B,cAAc,GAAG,IAAI,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,IAAI,cAAc,EAAE,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBACjE,wDAAwD;oBACxD,MAAM,eAAe,GACnB,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC;wBAClC,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC;wBAClC,aAAa,CAAC,kBAAkB,EAAE,KAAK,SAAS;wBAChD,aAAa,CAAC,kBAAkB,EAAE,KAAK,SAAS,CAAC;oBAEnD,IAAI,eAAe,EAAE,CAAC;wBACpB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;wBACnD,OAAO,CAAC,MAAM,CAAC;4BACb,MAAM,EAAE,mCAAmC;4BAC3C,QAAQ,EAAE,YAAY;4BACtB,QAAQ,EAAE,SAAS;4BACnB,UAAU,EAAE,QAAQ;4BACpB,OAAO,EAAE,mEAAmE;4BAC5E,IAAI,EAAE,UAAU,CAAC,QAAQ;4BACzB,KAAK;4BACL,QAAQ,EAAE;gCACR;oCACE,OAAO,EAAE,gIAAgI;oCACzI,KAAK;iCACN;6BACF;4BACD,eAAe,EAAE,4EAA4E;4BAC7F,gBAAgB,EAAE,KAAK;4BACvB,kBAAkB,EAAE,IAAI;yBACzB,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,4BAA4B;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}
1
+ {"version":3,"file":"uncheckedIndexAccess.js","sourceRoot":"","sources":["../../../src/rules/typescript/uncheckedIndexAccess.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAG7D,SAAS,sBAAsB,CAAC,IAAuB,EAAE,EAAiB;IACxE,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC;IACnC,CAAC;IACD,IAAI,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IACD,IAAI,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACtC,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,2BAA2B,CAClC,KAAa,EACb,IAAiB,EACjB,OAA2B,EAC3B,EAAiB;IAEjB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,2BAA2B,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,kEAAkE;IAClE,gIAAgI;IAChI,MAAM,MAAM,GAAI,IAA0D,CAAC,MAAM,IAAK,IAA6C,CAAC;IACpI,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IACzC,IAAI,CAAC,YAAY,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,sEAAsE;IACtE,MAAM,UAAU,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,gBAAgB,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAEpD,OAAO,UAAU,IAAI,CAAC,gBAAgB,CAAC;AACzC,CAAC;AAED,SAAS,2BAA2B,CAClC,OAA0B,EAC1B,aAA0B,EAC1B,OAA2B,EAC3B,EAAiB;IAEjB,MAAM,KAAK,GAAG,sBAAsB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,2BAA2B,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAS;IAC5C,IAAI,EAAE;QACJ,EAAE,EAAE,mCAAmC;QACvC,QAAQ,EAAE,YAAY;QACtB,eAAe,EAAE,SAAS;QAC1B,iBAAiB,EAAE,QAAQ;QAC3B,WAAW,EAAE,uGAAuG;QACpH,uBAAuB,EAAE,IAAI;KAC9B;IAED,OAAO,CAAC,OAAoB;QAC1B,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC;QACrD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE;YAAE,OAAO;QAExC,MAAM,YAAY,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAClD,gEAAgE;QAChE,IAAI,YAAY,CAAC,wBAAwB,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,UAAU,CAAC,CAAC,IAAiB,EAAE,EAAE;YACvC,oCAAoC;YACpC,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC;gBAAE,OAAO;YAEhD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC3B,IAAI,CAAC,MAAM;gBAAE,OAAO;YAEpB,sDAAsD;YACtD,IAAI,cAAc,GAAG,KAAK,CAAC;YAE3B,4EAA4E;YAC5E,IAAI,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxE,4CAA4C;gBAC5C,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;oBAC7B,cAAc,GAAG,IAAI,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,+DAA+D;YAC/D,IAAI,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBAC9D,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;oBAC7B,cAAc,GAAG,IAAI,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,IAAI,cAAc,EAAE,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAEjE,mGAAmG;oBACnG,IAAI,2BAA2B,CAAC,IAAI,CAAC,kBAAkB,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;wBACrF,OAAO;oBACT,CAAC;oBAED,wDAAwD;oBACxD,MAAM,eAAe,GACnB,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC;wBAClC,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC;wBAClC,aAAa,CAAC,kBAAkB,EAAE,KAAK,SAAS;wBAChD,aAAa,CAAC,kBAAkB,EAAE,KAAK,SAAS,CAAC;oBAEnD,IAAI,eAAe,EAAE,CAAC;wBACpB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;wBACnD,OAAO,CAAC,MAAM,CAAC;4BACb,MAAM,EAAE,mCAAmC;4BAC3C,QAAQ,EAAE,YAAY;4BACtB,QAAQ,EAAE,SAAS;4BACnB,UAAU,EAAE,QAAQ;4BACpB,OAAO,EAAE,mEAAmE;4BAC5E,IAAI,EAAE,UAAU,CAAC,QAAQ;4BACzB,KAAK;4BACL,QAAQ,EAAE;gCACR;oCACE,OAAO,EAAE,gIAAgI;oCACzI,KAAK;iCACN;6BACF;4BACD,eAAe,EAAE,4EAA4E;4BAC7F,gBAAgB,EAAE,KAAK;4BACvB,kBAAkB,EAAE,IAAI;yBACzB,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,4BAA4B;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}
@@ -1 +1 @@
1
- {"version":3,"file":"unsafeUnvalidatedAssertion.d.ts","sourceRoot":"","sources":["../../../src/rules/typescript/unsafeUnvalidatedAssertion.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAe,MAAM,qBAAqB,CAAC;AAU7D,eAAO,MAAM,8BAA8B,EAAE,IAiI5C,CAAC"}
1
+ {"version":3,"file":"unsafeUnvalidatedAssertion.d.ts","sourceRoot":"","sources":["../../../src/rules/typescript/unsafeUnvalidatedAssertion.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAe,MAAM,qBAAqB,CAAC;AAiB7D,eAAO,MAAM,8BAA8B,EAAE,IAiI5C,CAAC"}
@@ -1,7 +1,12 @@
1
- import { getNodeSourceRange } from "../../engine/symbols.js";
1
+ import { getNodeSourceRange, isFetchResponseMethod } from "../../engine/symbols.js";
2
2
  function unwrapExpression(expr, ts) {
3
3
  let current = expr;
4
- while (ts.isParenthesizedExpression(current) || ts.isAwaitExpression(current)) {
4
+ while (ts.isParenthesizedExpression(current) ||
5
+ ts.isAwaitExpression(current) ||
6
+ (ts.isAsExpression(current) &&
7
+ (current.type.kind === ts.SyntaxKind.UnknownKeyword || current.type.kind === ts.SyntaxKind.AnyKeyword)) ||
8
+ (ts.isTypeAssertionExpression(current) &&
9
+ (current.type.kind === ts.SyntaxKind.UnknownKeyword || current.type.kind === ts.SyntaxKind.AnyKeyword))) {
5
10
  current = current.expression;
6
11
  }
7
12
  return current;
@@ -16,7 +21,7 @@ export const unsafeUnvalidatedAssertionRule = {
16
21
  requiresTypeInformation: false,
17
22
  },
18
23
  analyze(context) {
19
- const { sourceFile, ts } = context;
24
+ const { sourceFile, checker, ts } = context;
20
25
  if (!ts)
21
26
  return;
22
27
  context.visitNodes((node) => {
@@ -54,7 +59,7 @@ export const unsafeUnvalidatedAssertionRule = {
54
59
  isRuntimeBoundary = true;
55
60
  boundaryName = "JSON.parse()";
56
61
  }
57
- else if (callTarget.name.text === "json") {
62
+ else if (callTarget.name.text === "json" && isFetchResponseMethod(callTarget, checker, ts)) {
58
63
  // 2. response.json()
59
64
  isRuntimeBoundary = true;
60
65
  boundaryName = "response.json()";
@@ -1 +1 @@
1
- {"version":3,"file":"unsafeUnvalidatedAssertion.js","sourceRoot":"","sources":["../../../src/rules/typescript/unsafeUnvalidatedAssertion.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAG7D,SAAS,gBAAgB,CAAC,IAAuB,EAAE,EAAiB;IAClE,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,OAAO,EAAE,CAAC,yBAAyB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;IAC/B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAS;IAClD,IAAI,EAAE;QACJ,EAAE,EAAE,yCAAyC;QAC7C,QAAQ,EAAE,YAAY;QACtB,eAAe,EAAE,OAAO;QACxB,iBAAiB,EAAE,MAAM;QACzB,WAAW,EAAE,qFAAqF;QAClG,uBAAuB,EAAE,KAAK;KAC/B;IAED,OAAO,CAAC,OAAoB;QAC1B,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC;QACnC,IAAI,CAAC,EAAE;YAAE,OAAO;QAEhB,OAAO,CAAC,UAAU,CAAC,CAAC,IAAiB,EAAE,EAAE;YACvC,IAAI,IAAmC,CAAC;YACxC,IAAI,QAAqC,CAAC;YAE1C,IAAI,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;gBACvB,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,CAAC;iBAAM,IAAI,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9C,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;gBACvB,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,CAAC;YAED,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAE/B,gFAAgF;YAChF,IACE,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,UAAU;gBAC1C,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,cAAc;gBAC9C,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa;gBAC7C,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa;gBAC7C,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,cAAc,EAC9C,CAAC;gBACD,OAAO;YACT,CAAC;YAED,2DAA2D;YAC3D,IAAI,iBAAiB,GAAG,KAAK,CAAC;YAC9B,IAAI,YAAY,GAAG,EAAE,CAAC;YAEtB,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAE9C,IAAI,EAAE,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpC,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;gBAEzC,qBAAqB;gBACrB,IAAI,EAAE,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC9C,IACE,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC;wBACtC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,MAAM;wBACrC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,EAChC,CAAC;wBACD,iBAAiB,GAAG,IAAI,CAAC;wBACzB,YAAY,GAAG,cAAc,CAAC;oBAChC,CAAC;yBAAM,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;wBAC3C,qBAAqB;wBACrB,iBAAiB,GAAG,IAAI,CAAC;wBACzB,YAAY,GAAG,iBAAiB,CAAC;oBACnC,CAAC;yBAAM,IACL,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;wBAClC,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC;wBACtC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAClG,CAAC;wBACD,+BAA+B;wBAC/B,iBAAiB,GAAG,IAAI,CAAC;wBACzB,YAAY,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,YAAY,CAAC;oBAC3D,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,iBAAiB,EAAE,CAAC;gBACtB,IAAI,gBAAgB,GAAG,KAAK,CAAC;gBAC7B,IAAI,IAAI,GAAgB,IAAI,CAAC;gBAC7B,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBACpD,IAAI,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;wBACpE,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;4BAC5B,gBAAgB,GAAG,IAAI,CAAC;4BACxB,MAAM;wBACR,CAAC;oBACH,CAAC;oBACD,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;gBACrB,CAAC;gBAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBACnD,IAAI,gBAAgB,EAAE,CAAC;oBACrB,OAAO,CAAC,MAAM,CAAC;wBACb,MAAM,EAAE,yCAAyC;wBACjD,QAAQ,EAAE,YAAY;wBACtB,QAAQ,EAAE,SAAS;wBACnB,UAAU,EAAE,QAAQ;wBACpB,OAAO,EAAE,8BAA8B,YAAY,yFAAyF;wBAC5I,IAAI,EAAE,UAAU,CAAC,QAAQ;wBACzB,KAAK;wBACL,QAAQ,EAAE;4BACR;gCACE,OAAO,EACL,4KAA4K;gCAC9K,KAAK;6BACN;yBACF;wBACD,eAAe,EAAE,kFAAkF;wBACnG,gBAAgB,EAAE,KAAK;qBACxB,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,MAAM,CAAC;wBACb,MAAM,EAAE,yCAAyC;wBACjD,QAAQ,EAAE,YAAY;wBACtB,QAAQ,EAAE,OAAO;wBACjB,UAAU,EAAE,MAAM;wBAClB,OAAO,EAAE,8BAA8B,YAAY,kDAAkD;wBACrG,IAAI,EAAE,UAAU,CAAC,QAAQ;wBACzB,KAAK;wBACL,QAAQ,EAAE;4BACR;gCACE,OAAO,EACL,8GAA8G;gCAChH,KAAK;6BACN;yBACF;wBACD,eAAe,EAAE,+EAA+E;wBAChG,gBAAgB,EAAE,KAAK;qBACxB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}
1
+ {"version":3,"file":"unsafeUnvalidatedAssertion.js","sourceRoot":"","sources":["../../../src/rules/typescript/unsafeUnvalidatedAssertion.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAGpF,SAAS,gBAAgB,CAAC,IAAuB,EAAE,EAAiB;IAClE,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,OACE,EAAE,CAAC,yBAAyB,CAAC,OAAO,CAAC;QACrC,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC;QAC7B,CAAC,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC;YACzB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACzG,CAAC,EAAE,CAAC,yBAAyB,CAAC,OAAO,CAAC;YACpC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EACzG,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;IAC/B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAS;IAClD,IAAI,EAAE;QACJ,EAAE,EAAE,yCAAyC;QAC7C,QAAQ,EAAE,YAAY;QACtB,eAAe,EAAE,OAAO;QACxB,iBAAiB,EAAE,MAAM;QACzB,WAAW,EAAE,qFAAqF;QAClG,uBAAuB,EAAE,KAAK;KAC/B;IAED,OAAO,CAAC,OAAoB;QAC1B,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC;QAC5C,IAAI,CAAC,EAAE;YAAE,OAAO;QAEhB,OAAO,CAAC,UAAU,CAAC,CAAC,IAAiB,EAAE,EAAE;YACvC,IAAI,IAAmC,CAAC;YACxC,IAAI,QAAqC,CAAC;YAE1C,IAAI,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;gBACvB,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,CAAC;iBAAM,IAAI,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9C,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;gBACvB,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,CAAC;YAED,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAE/B,gFAAgF;YAChF,IACE,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,UAAU;gBAC1C,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,cAAc;gBAC9C,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa;gBAC7C,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa;gBAC7C,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,cAAc,EAC9C,CAAC;gBACD,OAAO;YACT,CAAC;YAED,2DAA2D;YAC3D,IAAI,iBAAiB,GAAG,KAAK,CAAC;YAC9B,IAAI,YAAY,GAAG,EAAE,CAAC;YAEtB,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAE9C,IAAI,EAAE,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpC,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;gBAEzC,qBAAqB;gBACrB,IAAI,EAAE,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC9C,IACE,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC;wBACtC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,MAAM;wBACrC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,EAChC,CAAC;wBACD,iBAAiB,GAAG,IAAI,CAAC;wBACzB,YAAY,GAAG,cAAc,CAAC;oBAChC,CAAC;yBAAM,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,qBAAqB,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;wBAC7F,qBAAqB;wBACrB,iBAAiB,GAAG,IAAI,CAAC;wBACzB,YAAY,GAAG,iBAAiB,CAAC;oBACnC,CAAC;yBAAM,IACL,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;wBAClC,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC;wBACtC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAClG,CAAC;wBACD,+BAA+B;wBAC/B,iBAAiB,GAAG,IAAI,CAAC;wBACzB,YAAY,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,YAAY,CAAC;oBAC3D,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,iBAAiB,EAAE,CAAC;gBACtB,IAAI,gBAAgB,GAAG,KAAK,CAAC;gBAC7B,IAAI,IAAI,GAAgB,IAAI,CAAC;gBAC7B,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBACpD,IAAI,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;wBACpE,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;4BAC5B,gBAAgB,GAAG,IAAI,CAAC;4BACxB,MAAM;wBACR,CAAC;oBACH,CAAC;oBACD,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;gBACrB,CAAC;gBAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBACnD,IAAI,gBAAgB,EAAE,CAAC;oBACrB,OAAO,CAAC,MAAM,CAAC;wBACb,MAAM,EAAE,yCAAyC;wBACjD,QAAQ,EAAE,YAAY;wBACtB,QAAQ,EAAE,SAAS;wBACnB,UAAU,EAAE,QAAQ;wBACpB,OAAO,EAAE,8BAA8B,YAAY,yFAAyF;wBAC5I,IAAI,EAAE,UAAU,CAAC,QAAQ;wBACzB,KAAK;wBACL,QAAQ,EAAE;4BACR;gCACE,OAAO,EACL,4KAA4K;gCAC9K,KAAK;6BACN;yBACF;wBACD,eAAe,EAAE,kFAAkF;wBACnG,gBAAgB,EAAE,KAAK;qBACxB,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,MAAM,CAAC;wBACb,MAAM,EAAE,yCAAyC;wBACjD,QAAQ,EAAE,YAAY;wBACtB,QAAQ,EAAE,OAAO;wBACjB,UAAU,EAAE,MAAM;wBAClB,OAAO,EAAE,8BAA8B,YAAY,kDAAkD;wBACrG,IAAI,EAAE,UAAU,CAAC,QAAQ;wBACzB,KAAK;wBACL,QAAQ,EAAE;4BACR;gCACE,OAAO,EACL,8GAA8G;gCAChH,KAAK;6BACN;yBACF;wBACD,eAAe,EAAE,+EAA+E;wBAChG,gBAAgB,EAAE,KAAK;qBACxB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "sourceverity",
3
- "version": "1.0.2",
3
+ "version": "1.0.3",
4
4
  "description": "Repository-aware frontend correctness and quality auditor",
5
5
  "type": "module",
6
6
  "main": "./dist/index.js",