@nodesecure/js-x-ray/dist/probes/isUnsafeCallee.js

JavaScript AST XRay analysis

import { getCallExpressionIdentifier } from "@nodesecure/estree-ast-utils";
// Import Internal Dependencies
import { generateWarning } from "../warnings.js";
/**
 * @description Detect unsafe statement
 * @example
 * eval("this");
 * Function("return this")();
 */
function validateNode(node) {
    return isUnsafeCallee(node);
}
function main(node, ctx) {
    const { sourceFile, data: calleeName, signals } = ctx;
    if (!calleeName) {
        return signals.Skip;
    }
    if (calleeName === "Function" &&
        node.callee.arguments.length > 0 &&
        node.callee.arguments[0].value === "return this") {
        return signals.Skip;
    }
    const warning = generateWarning("unsafe-stmt", {
        value: calleeName,
        location: node.loc
    });
    sourceFile.warnings.push(warning);
    return signals.Skip;
}
function isEvalCallee(node) {
    const identifier = getCallExpressionIdentifier(node, {
        resolveCallExpression: false
    });
    return identifier === "eval";
}
function isFunctionCallee(node) {
    const identifier = getCallExpressionIdentifier(node);
    return identifier === "Function" && node.callee.type === "CallExpression";
}
export function isUnsafeCallee(node) {
    if (node.type !== "CallExpression") {
        return [false, null];
    }
    if (isEvalCallee(node)) {
        return [true, "eval"];
    }
    if (isFunctionCallee(node)) {
        return [true, "Function"];
    }
    return [false, null];
}
export default {
    name: "isUnsafeCallee",
    validateNode,
    main,
    breakOnMatch: false
};
//# sourceMappingURL=isUnsafeCallee.js.map