eslint-plugin-sonarjs/cjs/S1523/rule.js

SonarJS rules for ESLint

"use strict";
/*
 * SonarQube JavaScript Plugin
 * Copyright (C) SonarSource Sàrl
 * mailto:info AT sonarsource DOT com
 *
 * You can redistribute and/or modify this program under the terms of
 * the Sonar Source-Available License Version 1, as published by SonarSource Sàrl.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 * See the Sonar Source-Available License for more details.
 *
 * You should have received a copy of the Sonar Source-Available License
 * along with this program; if not, see https://sonarsource.com/license/ssal/
 */
// https://sonarsource.github.io/rspec/#/rspec/S1523/javascript
// SQ key 'eval'
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    var desc = Object.getOwnPropertyDescriptor(m, k);
    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
      desc = { enumerable: true, get: function() { return m[k]; } };
    }
    Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
    Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
    o["default"] = v;
});
var __importStar = (this && this.__importStar) || (function () {
    var ownKeys = function(o) {
        ownKeys = Object.getOwnPropertyNames || function (o) {
            var ar = [];
            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
            return ar;
        };
        return ownKeys(o);
    };
    return function (mod) {
        if (mod && mod.__esModule) return mod;
        var result = {};
        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
        __setModuleDefault(result, mod);
        return result;
    };
})();
Object.defineProperty(exports, "__esModule", { value: true });
exports.rule = void 0;
const generate_meta_js_1 = require("../helpers/generate-meta.js");
const module_js_1 = require("../helpers/module.js");
const meta = __importStar(require("./generated-meta.js"));
const EVAL_LIKE_FUNCTIONS = new Set([
    'eval',
    'Function',
    'vm.Script',
    'vm.SourceTextModule',
    'vm.runInContext',
    'vm.runInNewContext',
    'vm.runInThisContext',
]);
exports.rule = {
    meta: (0, generate_meta_js_1.generateMeta)(meta, {
        messages: {
            safeCode: 'Make sure that this dynamic injection or execution of code is safe.',
            unexpectedScriptURL: "Make sure that 'javascript:' code is safe as it is a form of eval().",
        },
    }),
    create(context) {
        return {
            CallExpression: (node) => checkCallExpression(node, context),
            NewExpression: (node) => checkCallExpression(node, context),
            TemplateLiteral: (node) => {
                if (node.expressions.length > 0 && /^javascript:/i.exec(node.quasis[0].value.raw)) {
                    context.report({ messageId: 'unexpectedScriptURL', node });
                }
            },
            BinaryExpression: (node) => {
                const parent = node.parent;
                if (!isConcatenation(parent) &&
                    isConcatenation(node) &&
                    isVariableConcat(node) &&
                    /^javascript:/i.exec(getLeftmostStringValue(node) ?? '')) {
                    context.report({ messageId: 'unexpectedScriptURL', node });
                }
            },
        };
    },
};
function checkCallExpression(node, context) {
    if (['Identifier', 'MemberExpression'].includes(node.callee.type)) {
        const name = (0, module_js_1.getFullyQualifiedName)(context, node) || '';
        if (EVAL_LIKE_FUNCTIONS.has(name) && hasAtLeastOneVariableArgument(node.arguments)) {
            context.report({
                messageId: 'safeCode',
                node: node.callee,
            });
        }
    }
}
function hasAtLeastOneVariableArgument(args) {
    return args.some(arg => !isLiteral(arg));
}
function isLiteral(node) {
    if (node.type === 'Literal') {
        return true;
    }
    if (node.type === 'TemplateLiteral') {
        return node.expressions.length === 0;
    }
    return false;
}
function isConcatenation(node) {
    return node.type === 'BinaryExpression' && node.operator === '+';
}
function isVariableConcat(node) {
    const { left, right } = node;
    if (!isLiteral(right)) {
        return true;
    }
    if (isConcatenation(left)) {
        return isVariableConcat(left);
    }
    return !isLiteral(left);
}
function getLeftmostStringValue(node) {
    const { left } = node;
    if (isConcatenation(left)) {
        return getLeftmostStringValue(left);
    }
    if (left.type === 'Literal' && typeof left.value === 'string') {
        return left.value;
    }
    if (left.type === 'TemplateLiteral' && left.expressions.length === 0) {
        return left.quasis[0].value.raw;
    }
    return undefined;
}