sourceverity 1.0.2 → 1.0.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +91 -3
- package/dist/analysis/arrayBounds.d.ts +4 -0
- package/dist/analysis/arrayBounds.d.ts.map +1 -0
- package/dist/analysis/arrayBounds.js +4 -0
- package/dist/analysis/arrayBounds.js.map +1 -0
- package/dist/analysis/arrayBoundsCore.d.ts +69 -0
- package/dist/analysis/arrayBoundsCore.d.ts.map +1 -0
- package/dist/analysis/arrayBoundsCore.js +863 -0
- package/dist/analysis/arrayBoundsCore.js.map +1 -0
- package/dist/analysis/arrayConstructionBounds.d.ts +14 -0
- package/dist/analysis/arrayConstructionBounds.d.ts.map +1 -0
- package/dist/analysis/arrayConstructionBounds.js +445 -0
- package/dist/analysis/arrayConstructionBounds.js.map +1 -0
- package/dist/analysis/arrayIterationBounds.d.ts +12 -0
- package/dist/analysis/arrayIterationBounds.d.ts.map +1 -0
- package/dist/analysis/arrayIterationBounds.js +578 -0
- package/dist/analysis/arrayIterationBounds.js.map +1 -0
- package/dist/analysis/controlFlowGuards.d.ts +7 -0
- package/dist/analysis/controlFlowGuards.d.ts.map +1 -0
- package/dist/analysis/controlFlowGuards.js +119 -0
- package/dist/analysis/controlFlowGuards.js.map +1 -0
- package/dist/analysis/controlFlowTypes.d.ts +5 -0
- package/dist/analysis/controlFlowTypes.d.ts.map +1 -0
- package/dist/analysis/controlFlowTypes.js +2 -0
- package/dist/analysis/controlFlowTypes.js.map +1 -0
- package/dist/analysis/frameworks.d.ts.map +1 -1
- package/dist/analysis/frameworks.js +95 -35
- package/dist/analysis/frameworks.js.map +1 -1
- package/dist/analysis/functions.d.ts.map +1 -1
- package/dist/analysis/functions.js +120 -36
- package/dist/analysis/functions.js.map +1 -1
- package/dist/analysis/{controlFlow.d.ts → nonNullGuards.d.ts} +2 -5
- package/dist/analysis/nonNullGuards.d.ts.map +1 -0
- package/dist/analysis/nonNullGuards.js +340 -0
- package/dist/analysis/nonNullGuards.js.map +1 -0
- package/dist/analysis/promiseFlow.d.ts.map +1 -1
- package/dist/analysis/promiseFlow.js +85 -11
- package/dist/analysis/promiseFlow.js.map +1 -1
- package/dist/analysis/reactStateBounds.d.ts +8 -0
- package/dist/analysis/reactStateBounds.d.ts.map +1 -0
- package/dist/analysis/reactStateBounds.js +390 -0
- package/dist/analysis/reactStateBounds.js.map +1 -0
- package/dist/baseline/manager.js +1 -1
- package/dist/baseline/manager.js.map +1 -1
- package/dist/baseline/types.d.ts +1 -1
- package/dist/baseline/types.d.ts.map +1 -1
- package/dist/cli/help.js +1 -1
- package/dist/cli/main.d.ts.map +1 -1
- package/dist/cli/main.js +24 -2
- package/dist/cli/main.js.map +1 -1
- package/dist/core/config.d.ts +7 -0
- package/dist/core/config.d.ts.map +1 -0
- package/dist/core/config.js +42 -0
- package/dist/core/config.js.map +1 -0
- package/dist/core/paths.d.ts +0 -4
- package/dist/core/paths.d.ts.map +1 -1
- package/dist/core/paths.js +0 -6
- package/dist/core/paths.js.map +1 -1
- package/dist/engine/runner.d.ts +6 -1
- package/dist/engine/runner.d.ts.map +1 -1
- package/dist/engine/runner.js +38 -21
- package/dist/engine/runner.js.map +1 -1
- package/dist/engine/symbols.d.ts +17 -5
- package/dist/engine/symbols.d.ts.map +1 -1
- package/dist/engine/symbols.js +269 -46
- package/dist/engine/symbols.js.map +1 -1
- package/dist/reporters/sarif.d.ts +2 -0
- package/dist/reporters/sarif.d.ts.map +1 -1
- package/dist/reporters/sarif.js +36 -7
- package/dist/reporters/sarif.js.map +1 -1
- package/dist/repository/detector.d.ts.map +1 -1
- package/dist/repository/detector.js +31 -11
- package/dist/repository/detector.js.map +1 -1
- package/dist/rules/async/floatingPromise.d.ts.map +1 -1
- package/dist/rules/async/floatingPromise.js +24 -2
- package/dist/rules/async/floatingPromise.js.map +1 -1
- package/dist/rules/browser/eventListenerCleanup.d.ts.map +1 -1
- package/dist/rules/browser/eventListenerCleanup.js +2 -9
- package/dist/rules/browser/eventListenerCleanup.js.map +1 -1
- package/dist/rules/browser/observerCleanup.d.ts.map +1 -1
- package/dist/rules/browser/observerCleanup.js +2 -9
- package/dist/rules/browser/observerCleanup.js.map +1 -1
- package/dist/rules/browser/timerCleanup.d.ts.map +1 -1
- package/dist/rules/browser/timerCleanup.js +2 -9
- package/dist/rules/browser/timerCleanup.js.map +1 -1
- package/dist/rules/network/fetchStatusUnchecked.d.ts.map +1 -1
- package/dist/rules/network/fetchStatusUnchecked.js +245 -46
- package/dist/rules/network/fetchStatusUnchecked.js.map +1 -1
- package/dist/rules/react/asyncEffectCallback.d.ts.map +1 -1
- package/dist/rules/react/asyncEffectCallback.js +2 -9
- package/dist/rules/react/asyncEffectCallback.js.map +1 -1
- package/dist/rules/react/derivedStateEffect.d.ts.map +1 -1
- package/dist/rules/react/derivedStateEffect.js +61 -13
- package/dist/rules/react/derivedStateEffect.js.map +1 -1
- package/dist/rules/react/missingEffectCleanup.d.ts.map +1 -1
- package/dist/rules/react/missingEffectCleanup.js +102 -10
- package/dist/rules/react/missingEffectCleanup.js.map +1 -1
- package/dist/rules/typescript/nonNullAssertionRisk.js +1 -1
- package/dist/rules/typescript/nonNullAssertionRisk.js.map +1 -1
- package/dist/rules/typescript/uncheckedIndexAccess.d.ts.map +1 -1
- package/dist/rules/typescript/uncheckedIndexAccess.js +55 -0
- package/dist/rules/typescript/uncheckedIndexAccess.js.map +1 -1
- package/dist/rules/typescript/unsafeUnvalidatedAssertion.d.ts.map +1 -1
- package/dist/rules/typescript/unsafeUnvalidatedAssertion.js +9 -4
- package/dist/rules/typescript/unsafeUnvalidatedAssertion.js.map +1 -1
- package/package.json +1 -1
- package/dist/analysis/controlFlow.d.ts.map +0 -1
- package/dist/analysis/controlFlow.js +0 -2136
- package/dist/analysis/controlFlow.js.map +0 -1
|
@@ -1,4 +1,94 @@
|
|
|
1
|
-
import { getNodeSourceRange,
|
|
1
|
+
import { getNodeSourceRange, isReactLifecycleHookCall } from "../../engine/symbols.js";
|
|
2
|
+
function unwrapParentheses(expr, ts) {
|
|
3
|
+
let cur = expr;
|
|
4
|
+
while (ts.isParenthesizedExpression(cur)) {
|
|
5
|
+
cur = cur.expression;
|
|
6
|
+
}
|
|
7
|
+
return cur;
|
|
8
|
+
}
|
|
9
|
+
/**
|
|
10
|
+
* Determines whether a returned expression is a valid, callable cleanup callback.
|
|
11
|
+
* Arbitrary primitives, objects, or non-callable values do not satisfy cleanup.
|
|
12
|
+
*/
|
|
13
|
+
function isCallableCleanupExpression(rawExpr, ts, checker, scopeNode) {
|
|
14
|
+
const expr = unwrapParentheses(rawExpr, ts);
|
|
15
|
+
if (ts.isArrowFunction(expr) || ts.isFunctionExpression(expr)) {
|
|
16
|
+
return true;
|
|
17
|
+
}
|
|
18
|
+
if (ts.isConditionalExpression(expr)) {
|
|
19
|
+
return (isCallableCleanupExpression(expr.whenTrue, ts, checker, scopeNode) ||
|
|
20
|
+
isCallableCleanupExpression(expr.whenFalse, ts, checker, scopeNode));
|
|
21
|
+
}
|
|
22
|
+
if (checker) {
|
|
23
|
+
const type = checker.getTypeAtLocation(expr);
|
|
24
|
+
if (type) {
|
|
25
|
+
if (type.getCallSignatures().length > 0) {
|
|
26
|
+
return true;
|
|
27
|
+
}
|
|
28
|
+
if (type.isUnion() && type.types.some((t) => t.getCallSignatures().length > 0)) {
|
|
29
|
+
return true;
|
|
30
|
+
}
|
|
31
|
+
}
|
|
32
|
+
const symbol = checker.getSymbolAtLocation(expr);
|
|
33
|
+
if (symbol) {
|
|
34
|
+
let resolvedSym = symbol;
|
|
35
|
+
if ((resolvedSym.flags & ts.SymbolFlags.Alias) !== 0) {
|
|
36
|
+
try {
|
|
37
|
+
resolvedSym = checker.getAliasedSymbol(resolvedSym);
|
|
38
|
+
}
|
|
39
|
+
catch {
|
|
40
|
+
// ignore
|
|
41
|
+
}
|
|
42
|
+
}
|
|
43
|
+
const decls = resolvedSym.getDeclarations();
|
|
44
|
+
if (decls) {
|
|
45
|
+
for (const decl of decls) {
|
|
46
|
+
if (ts.isFunctionDeclaration(decl) || ts.isFunctionExpression(decl) || ts.isArrowFunction(decl)) {
|
|
47
|
+
return true;
|
|
48
|
+
}
|
|
49
|
+
if (ts.isVariableDeclaration(decl) && decl.initializer) {
|
|
50
|
+
const init = unwrapParentheses(decl.initializer, ts);
|
|
51
|
+
if (ts.isArrowFunction(init) || ts.isFunctionExpression(init)) {
|
|
52
|
+
return true;
|
|
53
|
+
}
|
|
54
|
+
const initType = checker.getTypeAtLocation(init);
|
|
55
|
+
if (initType && initType.getCallSignatures().length > 0) {
|
|
56
|
+
return true;
|
|
57
|
+
}
|
|
58
|
+
}
|
|
59
|
+
}
|
|
60
|
+
}
|
|
61
|
+
}
|
|
62
|
+
}
|
|
63
|
+
// AST-based fallback within the effect scope when checker is unavailable or symbol is local
|
|
64
|
+
if (ts.isIdentifier(expr) && scopeNode) {
|
|
65
|
+
const targetName = expr.text;
|
|
66
|
+
let foundCallable = false;
|
|
67
|
+
function checkScope(node) {
|
|
68
|
+
if (foundCallable)
|
|
69
|
+
return;
|
|
70
|
+
if (ts.isFunctionDeclaration(node) && node.name && node.name.text === targetName) {
|
|
71
|
+
foundCallable = true;
|
|
72
|
+
return;
|
|
73
|
+
}
|
|
74
|
+
if (ts.isVariableDeclaration(node) &&
|
|
75
|
+
ts.isIdentifier(node.name) &&
|
|
76
|
+
node.name.text === targetName &&
|
|
77
|
+
node.initializer) {
|
|
78
|
+
const init = unwrapParentheses(node.initializer, ts);
|
|
79
|
+
if (ts.isArrowFunction(init) || ts.isFunctionExpression(init)) {
|
|
80
|
+
foundCallable = true;
|
|
81
|
+
return;
|
|
82
|
+
}
|
|
83
|
+
}
|
|
84
|
+
node.forEachChild(checkScope);
|
|
85
|
+
}
|
|
86
|
+
checkScope(scopeNode);
|
|
87
|
+
if (foundCallable)
|
|
88
|
+
return true;
|
|
89
|
+
}
|
|
90
|
+
return false;
|
|
91
|
+
}
|
|
2
92
|
export const missingEffectCleanupRule = {
|
|
3
93
|
meta: {
|
|
4
94
|
id: "react/missing-effect-cleanup",
|
|
@@ -15,14 +105,7 @@ export const missingEffectCleanupRule = {
|
|
|
15
105
|
context.visitNodes((node) => {
|
|
16
106
|
if (!ts.isCallExpression(node))
|
|
17
107
|
return;
|
|
18
|
-
|
|
19
|
-
if (checker && (resolveReactHook(node, checker, "useEffect") || resolveReactHook(node, checker, "useLayoutEffect"))) {
|
|
20
|
-
isEffectHook = true;
|
|
21
|
-
}
|
|
22
|
-
else if (ts.isIdentifier(node.expression) && (node.expression.text === "useEffect" || node.expression.text === "useLayoutEffect")) {
|
|
23
|
-
isEffectHook = true;
|
|
24
|
-
}
|
|
25
|
-
if (!isEffectHook)
|
|
108
|
+
if (!isReactLifecycleHookCall(node, ts, checker))
|
|
26
109
|
return;
|
|
27
110
|
const args = node.arguments;
|
|
28
111
|
if (!args || args.length === 0)
|
|
@@ -31,8 +114,15 @@ export const missingEffectCleanupRule = {
|
|
|
31
114
|
if (!callback || (!ts.isArrowFunction(callback) && !ts.isFunctionExpression(callback))) {
|
|
32
115
|
return;
|
|
33
116
|
}
|
|
117
|
+
const callbackBody = callback.body;
|
|
34
118
|
const subscriptions = [];
|
|
35
119
|
let hasCleanupReturn = false;
|
|
120
|
+
// Check concise arrow body: useEffect(() => () => socket.close(), [])
|
|
121
|
+
if (!ts.isBlock(callbackBody)) {
|
|
122
|
+
if (isCallableCleanupExpression(callbackBody, ts, checker, callbackBody)) {
|
|
123
|
+
hasCleanupReturn = true;
|
|
124
|
+
}
|
|
125
|
+
}
|
|
36
126
|
function inspectEffectBody(n) {
|
|
37
127
|
// Look for: new WebSocket(...), new EventSource(...), new BroadcastChannel(...)
|
|
38
128
|
if (ts && ts.isNewExpression(n) && ts.isIdentifier(n.expression)) {
|
|
@@ -50,7 +140,9 @@ export const missingEffectCleanupRule = {
|
|
|
50
140
|
}
|
|
51
141
|
// Check for return statement
|
|
52
142
|
if (ts && ts.isReturnStatement(n) && n.expression) {
|
|
53
|
-
|
|
143
|
+
if (isCallableCleanupExpression(n.expression, ts, checker, callbackBody)) {
|
|
144
|
+
hasCleanupReturn = true;
|
|
145
|
+
}
|
|
54
146
|
}
|
|
55
147
|
if (ts && n !== callback && (ts.isFunctionDeclaration(n) || ts.isArrowFunction(n) || ts.isFunctionExpression(n))) {
|
|
56
148
|
return;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"missingEffectCleanup.js","sourceRoot":"","sources":["../../../src/rules/react/missingEffectCleanup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,
|
|
1
|
+
{"version":3,"file":"missingEffectCleanup.js","sourceRoot":"","sources":["../../../src/rules/react/missingEffectCleanup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAGvF,SAAS,iBAAiB,CAAC,IAAuB,EAAE,EAAiB;IACnE,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,OAAO,EAAE,CAAC,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,2BAA2B,CAClC,OAA0B,EAC1B,EAAiB,EACjB,OAAwC,EACxC,SAAmC;IAEnC,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAE5C,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,OAAO,CACL,2BAA2B,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC;YAClE,2BAA2B,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CACpE,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC/E,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,WAAW,GAAG,MAAM,CAAC;YACzB,IAAI,CAAC,WAAW,CAAC,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrD,IAAI,CAAC;oBACH,WAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;gBACtD,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;YACH,CAAC;YACD,MAAM,KAAK,GAAG,WAAW,CAAC,eAAe,EAAE,CAAC;YAC5C,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;wBAChG,OAAO,IAAI,CAAC;oBACd,CAAC;oBACD,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;wBACvD,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;wBACrD,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;4BAC9D,OAAO,IAAI,CAAC;wBACd,CAAC;wBACD,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;wBACjD,IAAI,QAAQ,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BACxD,OAAO,IAAI,CAAC;wBACd,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,4FAA4F;IAC5F,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC;QAC7B,IAAI,aAAa,GAAG,KAAK,CAAC;QAE1B,SAAS,UAAU,CAAC,IAAiB;YACnC,IAAI,aAAa;gBAAE,OAAO;YAC1B,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBACjF,aAAa,GAAG,IAAI,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,IACE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC;gBAC9B,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU;gBAC7B,IAAI,CAAC,WAAW,EAChB,CAAC;gBACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;gBACrD,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9D,aAAa,GAAG,IAAI,CAAC;oBACrB,OAAO;gBACT,CAAC;YACH,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAChC,CAAC;QAED,UAAU,CAAC,SAAS,CAAC,CAAC;QACtB,IAAI,aAAa;YAAE,OAAO,IAAI,CAAC;IACjC,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAS;IAC5C,IAAI,EAAE;QACJ,EAAE,EAAE,8BAA8B;QAClC,QAAQ,EAAE,OAAO;QACjB,eAAe,EAAE,SAAS;QAC1B,iBAAiB,EAAE,MAAM;QACzB,WAAW,EAAE,+EAA+E;QAC5F,uBAAuB,EAAE,KAAK;KAC/B;IAED,OAAO,CAAC,OAAoB;QAC1B,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC;QAC5C,IAAI,CAAC,EAAE;YAAE,OAAO;QAEhB,OAAO,CAAC,UAAU,CAAC,CAAC,IAAiB,EAAE,EAAE;YACvC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;gBAAE,OAAO;YAEvC,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC;gBAAE,OAAO;YAEzD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACvF,OAAO;YACT,CAAC;YAED,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC;YACnC,MAAM,aAAa,GAA+C,EAAE,CAAC;YACrE,IAAI,gBAAgB,GAAG,KAAK,CAAC;YAE7B,sEAAsE;YACtE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC9B,IAAI,2BAA2B,CAAC,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;oBACzE,gBAAgB,GAAG,IAAI,CAAC;gBAC1B,CAAC;YACH,CAAC;YAED,SAAS,iBAAiB,CAAC,CAAc;gBACvC,gFAAgF;gBAChF,IAAI,EAAE,IAAI,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;oBACjE,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;oBACpC,IAAI,SAAS,KAAK,WAAW,IAAI,SAAS,KAAK,aAAa,IAAI,SAAS,KAAK,kBAAkB,EAAE,CAAC;wBACjG,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;oBACnD,CAAC;gBACH,CAAC;gBAED,kCAAkC;gBAClC,IACE,EAAE;oBACF,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;oBACtB,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC,UAAU,CAAC;oBAC3C,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,EACtC,CAAC;oBACD,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;gBACxD,CAAC;gBAED,6BAA6B;gBAC7B,IAAI,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;oBAClD,IAAI,2BAA2B,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;wBACzE,gBAAgB,GAAG,IAAI,CAAC;oBAC1B,CAAC;gBACH,CAAC;gBAED,IAAI,EAAE,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjH,OAAO;gBACT,CAAC;gBAED,CAAC,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC;YACpC,CAAC;YAED,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAEjC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAClD,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;oBAChC,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;oBACvD,OAAO,CAAC,MAAM,CAAC;wBACb,MAAM,EAAE,8BAA8B;wBACtC,QAAQ,EAAE,OAAO;wBACjB,QAAQ,EAAE,SAAS;wBACnB,UAAU,EAAE,MAAM;wBAClB,OAAO,EAAE,0BAA0B,GAAG,CAAC,IAAI,8DAA8D;wBACzG,IAAI,EAAE,UAAU,CAAC,QAAQ;wBACzB,KAAK;wBACL,QAAQ,EAAE;4BACR;gCACE,OAAO,EAAE,wFAAwF;gCACjG,KAAK;6BACN;yBACF;wBACD,eAAe,EAAE,oFAAoF;wBACrG,gBAAgB,EAAE,KAAK;qBACxB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { getNodeSourceRange } from "../../engine/symbols.js";
|
|
2
|
-
import { isGuardedNonNullAssertion } from "../../analysis/
|
|
2
|
+
import { isGuardedNonNullAssertion } from "../../analysis/nonNullGuards.js";
|
|
3
3
|
/**
|
|
4
4
|
* Checks if a type contains null or undefined in its flags or union members.
|
|
5
5
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"nonNullAssertionRisk.js","sourceRoot":"","sources":["../../../src/rules/typescript/nonNullAssertionRisk.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM
|
|
1
|
+
{"version":3,"file":"nonNullAssertionRisk.js","sourceRoot":"","sources":["../../../src/rules/typescript/nonNullAssertionRisk.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAG5E;;GAEG;AACH,SAAS,cAAc,CAAC,IAAiB,EAAE,EAAiB;IAC1D,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAS;IAC5C,IAAI,EAAE;QACJ,EAAE,EAAE,oCAAoC;QACxC,QAAQ,EAAE,YAAY;QACtB,eAAe,EAAE,SAAS;QAC1B,iBAAiB,EAAE,MAAM;QACzB,WAAW,EAAE,sEAAsE;QACnF,uBAAuB,EAAE,IAAI;KAC9B;IAED,OAAO,CAAC,OAAoB;QAC1B,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC;QAC5C,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE;YAAE,OAAO;QAE5B,OAAO,CAAC,UAAU,CAAC,CAAC,IAAiB,EAAE,EAAE;YACvC,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC;gBAAE,OAAO;YAE1C,8CAA8C;YAC9C,MAAM,UAAU,GAAG,yBAAyB,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;YAChE,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;gBACzB,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC7D,IAAI,cAAc,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;oBAClC,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;oBACnD,OAAO,CAAC,MAAM,CAAC;wBACb,MAAM,EAAE,oCAAoC;wBAC5C,QAAQ,EAAE,YAAY;wBACtB,QAAQ,EAAE,SAAS;wBACnB,UAAU,EAAE,MAAM;wBAClB,OAAO,EAAE,wEAAwE;wBACjF,IAAI,EAAE,UAAU,CAAC,QAAQ;wBACzB,KAAK;wBACL,QAAQ,EAAE;4BACR;gCACE,OAAO,EAAE,+DAA+D;gCACxE,KAAK;6BACN;yBACF;wBACD,eAAe,EAAE,qFAAqF;wBACtG,gBAAgB,EAAE,KAAK;qBACxB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,kCAAkC;YACpC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"uncheckedIndexAccess.d.ts","sourceRoot":"","sources":["../../../src/rules/typescript/uncheckedIndexAccess.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAe,MAAM,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"uncheckedIndexAccess.d.ts","sourceRoot":"","sources":["../../../src/rules/typescript/uncheckedIndexAccess.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAe,MAAM,qBAAqB,CAAC;AAuE7D,eAAO,MAAM,wBAAwB,EAAE,IAwFtC,CAAC"}
|
|
@@ -1,4 +1,55 @@
|
|
|
1
1
|
import { getNodeSourceRange } from "../../engine/symbols.js";
|
|
2
|
+
function getLiteralIntegerIndex(expr, ts) {
|
|
3
|
+
let unwrapped = expr;
|
|
4
|
+
while (ts.isParenthesizedExpression(unwrapped)) {
|
|
5
|
+
unwrapped = unwrapped.expression;
|
|
6
|
+
}
|
|
7
|
+
if (ts.isNumericLiteral(unwrapped)) {
|
|
8
|
+
const val = Number(unwrapped.text);
|
|
9
|
+
if (Number.isInteger(val) && val >= 0) {
|
|
10
|
+
return val;
|
|
11
|
+
}
|
|
12
|
+
}
|
|
13
|
+
if (ts.isStringLiteral(unwrapped)) {
|
|
14
|
+
if (/^\d+$/.test(unwrapped.text)) {
|
|
15
|
+
const val = Number(unwrapped.text);
|
|
16
|
+
if (Number.isInteger(val) && val >= 0) {
|
|
17
|
+
return val;
|
|
18
|
+
}
|
|
19
|
+
}
|
|
20
|
+
}
|
|
21
|
+
return undefined;
|
|
22
|
+
}
|
|
23
|
+
function isStaticallySafeTupleAccess(index, type, checker, ts) {
|
|
24
|
+
if (type.isUnion()) {
|
|
25
|
+
return type.types.every((t) => isStaticallySafeTupleAccess(index, t, checker, ts));
|
|
26
|
+
}
|
|
27
|
+
if (!checker.isTupleType(type)) {
|
|
28
|
+
return false;
|
|
29
|
+
}
|
|
30
|
+
// In TypeScript TypeChecker, TupleType target stores elementFlags
|
|
31
|
+
// sourceverity-disable-next-line typescript/non-null-assertion-risk -- compiler internal property access guarded by isTupleType
|
|
32
|
+
const target = type.target ?? type;
|
|
33
|
+
const elementFlags = target.elementFlags;
|
|
34
|
+
if (!elementFlags || index < 0 || index >= elementFlags.length) {
|
|
35
|
+
return false;
|
|
36
|
+
}
|
|
37
|
+
const flag = elementFlags[index];
|
|
38
|
+
if (flag === undefined) {
|
|
39
|
+
return false;
|
|
40
|
+
}
|
|
41
|
+
// ts.ElementFlags: Required = 1, Optional = 2, Rest = 4, Variadic = 8
|
|
42
|
+
const isRequired = (flag & 1) !== 0;
|
|
43
|
+
const isOptionalOrRest = (flag & (2 | 4 | 8)) !== 0;
|
|
44
|
+
return isRequired && !isOptionalOrRest;
|
|
45
|
+
}
|
|
46
|
+
function isStaticallySafeIndexAccess(argExpr, containerType, checker, ts) {
|
|
47
|
+
const index = getLiteralIntegerIndex(argExpr, ts);
|
|
48
|
+
if (index === undefined) {
|
|
49
|
+
return false;
|
|
50
|
+
}
|
|
51
|
+
return isStaticallySafeTupleAccess(index, containerType, checker, ts);
|
|
52
|
+
}
|
|
2
53
|
export const uncheckedIndexAccessRule = {
|
|
3
54
|
meta: {
|
|
4
55
|
id: "typescript/unchecked-index-access",
|
|
@@ -42,6 +93,10 @@ export const uncheckedIndexAccessRule = {
|
|
|
42
93
|
if (isDereferenced) {
|
|
43
94
|
try {
|
|
44
95
|
const containerType = checker.getTypeAtLocation(node.expression);
|
|
96
|
+
// If the element access is proven statically safe (e.g. required fixed tuple index), do not report
|
|
97
|
+
if (isStaticallySafeIndexAccess(node.argumentExpression, containerType, checker, ts)) {
|
|
98
|
+
return;
|
|
99
|
+
}
|
|
45
100
|
// Check if container type is an Array, Tuple, or Record
|
|
46
101
|
const isArrayOrRecord = checker.isArrayType(containerType) ||
|
|
47
102
|
checker.isTupleType(containerType) ||
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"uncheckedIndexAccess.js","sourceRoot":"","sources":["../../../src/rules/typescript/uncheckedIndexAccess.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAG7D,MAAM,CAAC,MAAM,wBAAwB,GAAS;IAC5C,IAAI,EAAE;QACJ,EAAE,EAAE,mCAAmC;QACvC,QAAQ,EAAE,YAAY;QACtB,eAAe,EAAE,SAAS;QAC1B,iBAAiB,EAAE,QAAQ;QAC3B,WAAW,EAAE,uGAAuG;QACpH,uBAAuB,EAAE,IAAI;KAC9B;IAED,OAAO,CAAC,OAAoB;QAC1B,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC;QACrD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE;YAAE,OAAO;QAExC,MAAM,YAAY,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAClD,gEAAgE;QAChE,IAAI,YAAY,CAAC,wBAAwB,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,UAAU,CAAC,CAAC,IAAiB,EAAE,EAAE;YACvC,oCAAoC;YACpC,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC;gBAAE,OAAO;YAEhD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC3B,IAAI,CAAC,MAAM;gBAAE,OAAO;YAEpB,sDAAsD;YACtD,IAAI,cAAc,GAAG,KAAK,CAAC;YAE3B,4EAA4E;YAC5E,IAAI,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxE,4CAA4C;gBAC5C,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;oBAC7B,cAAc,GAAG,IAAI,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,+DAA+D;YAC/D,IAAI,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBAC9D,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;oBAC7B,cAAc,GAAG,IAAI,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,IAAI,cAAc,EAAE,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"uncheckedIndexAccess.js","sourceRoot":"","sources":["../../../src/rules/typescript/uncheckedIndexAccess.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAG7D,SAAS,sBAAsB,CAAC,IAAuB,EAAE,EAAiB;IACxE,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,SAAS,GAAG,SAAS,CAAC,UAAU,CAAC;IACnC,CAAC;IACD,IAAI,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IACD,IAAI,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;gBACtC,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,2BAA2B,CAClC,KAAa,EACb,IAAiB,EACjB,OAA2B,EAC3B,EAAiB;IAEjB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,2BAA2B,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,kEAAkE;IAClE,gIAAgI;IAChI,MAAM,MAAM,GAAI,IAA0D,CAAC,MAAM,IAAK,IAA6C,CAAC;IACpI,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IACzC,IAAI,CAAC,YAAY,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,sEAAsE;IACtE,MAAM,UAAU,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,gBAAgB,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAEpD,OAAO,UAAU,IAAI,CAAC,gBAAgB,CAAC;AACzC,CAAC;AAED,SAAS,2BAA2B,CAClC,OAA0B,EAC1B,aAA0B,EAC1B,OAA2B,EAC3B,EAAiB;IAEjB,MAAM,KAAK,GAAG,sBAAsB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,2BAA2B,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAS;IAC5C,IAAI,EAAE;QACJ,EAAE,EAAE,mCAAmC;QACvC,QAAQ,EAAE,YAAY;QACtB,eAAe,EAAE,SAAS;QAC1B,iBAAiB,EAAE,QAAQ;QAC3B,WAAW,EAAE,uGAAuG;QACpH,uBAAuB,EAAE,IAAI;KAC9B;IAED,OAAO,CAAC,OAAoB;QAC1B,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC;QACrD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE;YAAE,OAAO;QAExC,MAAM,YAAY,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAClD,gEAAgE;QAChE,IAAI,YAAY,CAAC,wBAAwB,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,UAAU,CAAC,CAAC,IAAiB,EAAE,EAAE;YACvC,oCAAoC;YACpC,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC;gBAAE,OAAO;YAEhD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC3B,IAAI,CAAC,MAAM;gBAAE,OAAO;YAEpB,sDAAsD;YACtD,IAAI,cAAc,GAAG,KAAK,CAAC;YAE3B,4EAA4E;YAC5E,IAAI,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxE,4CAA4C;gBAC5C,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;oBAC7B,cAAc,GAAG,IAAI,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,+DAA+D;YAC/D,IAAI,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBAC9D,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;oBAC7B,cAAc,GAAG,IAAI,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,IAAI,cAAc,EAAE,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;oBAEjE,mGAAmG;oBACnG,IAAI,2BAA2B,CAAC,IAAI,CAAC,kBAAkB,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;wBACrF,OAAO;oBACT,CAAC;oBAED,wDAAwD;oBACxD,MAAM,eAAe,GACnB,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC;wBAClC,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC;wBAClC,aAAa,CAAC,kBAAkB,EAAE,KAAK,SAAS;wBAChD,aAAa,CAAC,kBAAkB,EAAE,KAAK,SAAS,CAAC;oBAEnD,IAAI,eAAe,EAAE,CAAC;wBACpB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;wBACnD,OAAO,CAAC,MAAM,CAAC;4BACb,MAAM,EAAE,mCAAmC;4BAC3C,QAAQ,EAAE,YAAY;4BACtB,QAAQ,EAAE,SAAS;4BACnB,UAAU,EAAE,QAAQ;4BACpB,OAAO,EAAE,mEAAmE;4BAC5E,IAAI,EAAE,UAAU,CAAC,QAAQ;4BACzB,KAAK;4BACL,QAAQ,EAAE;gCACR;oCACE,OAAO,EAAE,gIAAgI;oCACzI,KAAK;iCACN;6BACF;4BACD,eAAe,EAAE,4EAA4E;4BAC7F,gBAAgB,EAAE,KAAK;4BACvB,kBAAkB,EAAE,IAAI;yBACzB,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,4BAA4B;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"unsafeUnvalidatedAssertion.d.ts","sourceRoot":"","sources":["../../../src/rules/typescript/unsafeUnvalidatedAssertion.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAe,MAAM,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"unsafeUnvalidatedAssertion.d.ts","sourceRoot":"","sources":["../../../src/rules/typescript/unsafeUnvalidatedAssertion.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAe,MAAM,qBAAqB,CAAC;AAiB7D,eAAO,MAAM,8BAA8B,EAAE,IAiI5C,CAAC"}
|
|
@@ -1,7 +1,12 @@
|
|
|
1
|
-
import { getNodeSourceRange } from "../../engine/symbols.js";
|
|
1
|
+
import { getNodeSourceRange, isFetchResponseMethod } from "../../engine/symbols.js";
|
|
2
2
|
function unwrapExpression(expr, ts) {
|
|
3
3
|
let current = expr;
|
|
4
|
-
while (ts.isParenthesizedExpression(current) ||
|
|
4
|
+
while (ts.isParenthesizedExpression(current) ||
|
|
5
|
+
ts.isAwaitExpression(current) ||
|
|
6
|
+
(ts.isAsExpression(current) &&
|
|
7
|
+
(current.type.kind === ts.SyntaxKind.UnknownKeyword || current.type.kind === ts.SyntaxKind.AnyKeyword)) ||
|
|
8
|
+
(ts.isTypeAssertionExpression(current) &&
|
|
9
|
+
(current.type.kind === ts.SyntaxKind.UnknownKeyword || current.type.kind === ts.SyntaxKind.AnyKeyword))) {
|
|
5
10
|
current = current.expression;
|
|
6
11
|
}
|
|
7
12
|
return current;
|
|
@@ -16,7 +21,7 @@ export const unsafeUnvalidatedAssertionRule = {
|
|
|
16
21
|
requiresTypeInformation: false,
|
|
17
22
|
},
|
|
18
23
|
analyze(context) {
|
|
19
|
-
const { sourceFile, ts } = context;
|
|
24
|
+
const { sourceFile, checker, ts } = context;
|
|
20
25
|
if (!ts)
|
|
21
26
|
return;
|
|
22
27
|
context.visitNodes((node) => {
|
|
@@ -54,7 +59,7 @@ export const unsafeUnvalidatedAssertionRule = {
|
|
|
54
59
|
isRuntimeBoundary = true;
|
|
55
60
|
boundaryName = "JSON.parse()";
|
|
56
61
|
}
|
|
57
|
-
else if (callTarget.name.text === "json") {
|
|
62
|
+
else if (callTarget.name.text === "json" && isFetchResponseMethod(callTarget, checker, ts)) {
|
|
58
63
|
// 2. response.json()
|
|
59
64
|
isRuntimeBoundary = true;
|
|
60
65
|
boundaryName = "response.json()";
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"unsafeUnvalidatedAssertion.js","sourceRoot":"","sources":["../../../src/rules/typescript/unsafeUnvalidatedAssertion.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;
|
|
1
|
+
{"version":3,"file":"unsafeUnvalidatedAssertion.js","sourceRoot":"","sources":["../../../src/rules/typescript/unsafeUnvalidatedAssertion.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAGpF,SAAS,gBAAgB,CAAC,IAAuB,EAAE,EAAiB;IAClE,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,OACE,EAAE,CAAC,yBAAyB,CAAC,OAAO,CAAC;QACrC,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC;QAC7B,CAAC,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC;YACzB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACzG,CAAC,EAAE,CAAC,yBAAyB,CAAC,OAAO,CAAC;YACpC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EACzG,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;IAC/B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAS;IAClD,IAAI,EAAE;QACJ,EAAE,EAAE,yCAAyC;QAC7C,QAAQ,EAAE,YAAY;QACtB,eAAe,EAAE,OAAO;QACxB,iBAAiB,EAAE,MAAM;QACzB,WAAW,EAAE,qFAAqF;QAClG,uBAAuB,EAAE,KAAK;KAC/B;IAED,OAAO,CAAC,OAAoB;QAC1B,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC;QAC5C,IAAI,CAAC,EAAE;YAAE,OAAO;QAEhB,OAAO,CAAC,UAAU,CAAC,CAAC,IAAiB,EAAE,EAAE;YACvC,IAAI,IAAmC,CAAC;YACxC,IAAI,QAAqC,CAAC;YAE1C,IAAI,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;gBACvB,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,CAAC;iBAAM,IAAI,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9C,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC;gBACvB,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,CAAC;YAED,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAE/B,gFAAgF;YAChF,IACE,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,UAAU;gBAC1C,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,cAAc;gBAC9C,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa;gBAC7C,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa;gBAC7C,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,cAAc,EAC9C,CAAC;gBACD,OAAO;YACT,CAAC;YAED,2DAA2D;YAC3D,IAAI,iBAAiB,GAAG,KAAK,CAAC;YAC9B,IAAI,YAAY,GAAG,EAAE,CAAC;YAEtB,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAE9C,IAAI,EAAE,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpC,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC;gBAEzC,qBAAqB;gBACrB,IAAI,EAAE,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC9C,IACE,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC;wBACtC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,MAAM;wBACrC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,EAChC,CAAC;wBACD,iBAAiB,GAAG,IAAI,CAAC;wBACzB,YAAY,GAAG,cAAc,CAAC;oBAChC,CAAC;yBAAM,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,qBAAqB,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;wBAC7F,qBAAqB;wBACrB,iBAAiB,GAAG,IAAI,CAAC;wBACzB,YAAY,GAAG,iBAAiB,CAAC;oBACnC,CAAC;yBAAM,IACL,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;wBAClC,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC;wBACtC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAClG,CAAC;wBACD,+BAA+B;wBAC/B,iBAAiB,GAAG,IAAI,CAAC;wBACzB,YAAY,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,YAAY,CAAC;oBAC3D,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,iBAAiB,EAAE,CAAC;gBACtB,IAAI,gBAAgB,GAAG,KAAK,CAAC;gBAC7B,IAAI,IAAI,GAAgB,IAAI,CAAC;gBAC7B,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBACpD,IAAI,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;wBACpE,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;4BAC5B,gBAAgB,GAAG,IAAI,CAAC;4BACxB,MAAM;wBACR,CAAC;oBACH,CAAC;oBACD,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;gBACrB,CAAC;gBAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBACnD,IAAI,gBAAgB,EAAE,CAAC;oBACrB,OAAO,CAAC,MAAM,CAAC;wBACb,MAAM,EAAE,yCAAyC;wBACjD,QAAQ,EAAE,YAAY;wBACtB,QAAQ,EAAE,SAAS;wBACnB,UAAU,EAAE,QAAQ;wBACpB,OAAO,EAAE,8BAA8B,YAAY,yFAAyF;wBAC5I,IAAI,EAAE,UAAU,CAAC,QAAQ;wBACzB,KAAK;wBACL,QAAQ,EAAE;4BACR;gCACE,OAAO,EACL,4KAA4K;gCAC9K,KAAK;6BACN;yBACF;wBACD,eAAe,EAAE,kFAAkF;wBACnG,gBAAgB,EAAE,KAAK;qBACxB,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,MAAM,CAAC;wBACb,MAAM,EAAE,yCAAyC;wBACjD,QAAQ,EAAE,YAAY;wBACtB,QAAQ,EAAE,OAAO;wBACjB,UAAU,EAAE,MAAM;wBAClB,OAAO,EAAE,8BAA8B,YAAY,kDAAkD;wBACrG,IAAI,EAAE,UAAU,CAAC,QAAQ;wBACzB,KAAK;wBACL,QAAQ,EAAE;4BACR;gCACE,OAAO,EACL,8GAA8G;gCAChH,KAAK;6BACN;yBACF;wBACD,eAAe,EAAE,+EAA+E;wBAChG,gBAAgB,EAAE,KAAK;qBACxB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}
|
package/package.json
CHANGED
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"controlFlow.d.ts","sourceRoot":"","sources":["../../src/analysis/controlFlow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,MAAM,YAAY,CAAC;AAG1C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAixED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,CAAC,iBAAiB,EAC9B,EAAE,EAAE,OAAO,MAAM,EACjB,OAAO,CAAC,EAAE,MAAM,CAAC,WAAW,GAAG,SAAS,GACvC,gBAAgB,CAqKlB"}
|