1 | /**
|
---|
2 | * @fileoverview Rule to flag use of implied eval via setTimeout and setInterval
|
---|
3 | * @author James Allardice
|
---|
4 | */
|
---|
5 |
|
---|
6 | "use strict";
|
---|
7 |
|
---|
8 | //------------------------------------------------------------------------------
|
---|
9 | // Requirements
|
---|
10 | //------------------------------------------------------------------------------
|
---|
11 |
|
---|
12 | const astUtils = require("./utils/ast-utils");
|
---|
13 | const { getStaticValue } = require("@eslint-community/eslint-utils");
|
---|
14 |
|
---|
15 | //------------------------------------------------------------------------------
|
---|
16 | // Rule Definition
|
---|
17 | //------------------------------------------------------------------------------
|
---|
18 |
|
---|
19 | /** @type {import('../shared/types').Rule} */
|
---|
20 | module.exports = {
|
---|
21 | meta: {
|
---|
22 | type: "suggestion",
|
---|
23 |
|
---|
24 | docs: {
|
---|
25 | description: "Disallow the use of `eval()`-like methods",
|
---|
26 | recommended: false,
|
---|
27 | url: "https://eslint.org/docs/latest/rules/no-implied-eval"
|
---|
28 | },
|
---|
29 |
|
---|
30 | schema: [],
|
---|
31 |
|
---|
32 | messages: {
|
---|
33 | impliedEval: "Implied eval. Consider passing a function instead of a string."
|
---|
34 | }
|
---|
35 | },
|
---|
36 |
|
---|
37 | create(context) {
|
---|
38 | const GLOBAL_CANDIDATES = Object.freeze(["global", "window", "globalThis"]);
|
---|
39 | const EVAL_LIKE_FUNC_PATTERN = /^(?:set(?:Interval|Timeout)|execScript)$/u;
|
---|
40 | const sourceCode = context.sourceCode;
|
---|
41 |
|
---|
42 | /**
|
---|
43 | * Checks whether a node is evaluated as a string or not.
|
---|
44 | * @param {ASTNode} node A node to check.
|
---|
45 | * @returns {boolean} True if the node is evaluated as a string.
|
---|
46 | */
|
---|
47 | function isEvaluatedString(node) {
|
---|
48 | if (
|
---|
49 | (node.type === "Literal" && typeof node.value === "string") ||
|
---|
50 | node.type === "TemplateLiteral"
|
---|
51 | ) {
|
---|
52 | return true;
|
---|
53 | }
|
---|
54 | if (node.type === "BinaryExpression" && node.operator === "+") {
|
---|
55 | return isEvaluatedString(node.left) || isEvaluatedString(node.right);
|
---|
56 | }
|
---|
57 | return false;
|
---|
58 | }
|
---|
59 |
|
---|
60 | /**
|
---|
61 | * Reports if the `CallExpression` node has evaluated argument.
|
---|
62 | * @param {ASTNode} node A CallExpression to check.
|
---|
63 | * @returns {void}
|
---|
64 | */
|
---|
65 | function reportImpliedEvalCallExpression(node) {
|
---|
66 | const [firstArgument] = node.arguments;
|
---|
67 |
|
---|
68 | if (firstArgument) {
|
---|
69 |
|
---|
70 | const staticValue = getStaticValue(firstArgument, sourceCode.getScope(node));
|
---|
71 | const isStaticString = staticValue && typeof staticValue.value === "string";
|
---|
72 | const isString = isStaticString || isEvaluatedString(firstArgument);
|
---|
73 |
|
---|
74 | if (isString) {
|
---|
75 | context.report({
|
---|
76 | node,
|
---|
77 | messageId: "impliedEval"
|
---|
78 | });
|
---|
79 | }
|
---|
80 | }
|
---|
81 |
|
---|
82 | }
|
---|
83 |
|
---|
84 | /**
|
---|
85 | * Reports calls of `implied eval` via the global references.
|
---|
86 | * @param {Variable} globalVar A global variable to check.
|
---|
87 | * @returns {void}
|
---|
88 | */
|
---|
89 | function reportImpliedEvalViaGlobal(globalVar) {
|
---|
90 | const { references, name } = globalVar;
|
---|
91 |
|
---|
92 | references.forEach(ref => {
|
---|
93 | const identifier = ref.identifier;
|
---|
94 | let node = identifier.parent;
|
---|
95 |
|
---|
96 | while (astUtils.isSpecificMemberAccess(node, null, name)) {
|
---|
97 | node = node.parent;
|
---|
98 | }
|
---|
99 |
|
---|
100 | if (astUtils.isSpecificMemberAccess(node, null, EVAL_LIKE_FUNC_PATTERN)) {
|
---|
101 | const calleeNode = node.parent.type === "ChainExpression" ? node.parent : node;
|
---|
102 | const parent = calleeNode.parent;
|
---|
103 |
|
---|
104 | if (parent.type === "CallExpression" && parent.callee === calleeNode) {
|
---|
105 | reportImpliedEvalCallExpression(parent);
|
---|
106 | }
|
---|
107 | }
|
---|
108 | });
|
---|
109 | }
|
---|
110 |
|
---|
111 | //--------------------------------------------------------------------------
|
---|
112 | // Public
|
---|
113 | //--------------------------------------------------------------------------
|
---|
114 |
|
---|
115 | return {
|
---|
116 | CallExpression(node) {
|
---|
117 | if (astUtils.isSpecificId(node.callee, EVAL_LIKE_FUNC_PATTERN)) {
|
---|
118 | reportImpliedEvalCallExpression(node);
|
---|
119 | }
|
---|
120 | },
|
---|
121 | "Program:exit"(node) {
|
---|
122 | const globalScope = sourceCode.getScope(node);
|
---|
123 |
|
---|
124 | GLOBAL_CANDIDATES
|
---|
125 | .map(candidate => astUtils.getVariableByName(globalScope, candidate))
|
---|
126 | .filter(globalVar => !!globalVar && globalVar.defs.length === 0)
|
---|
127 | .forEach(reportImpliedEvalViaGlobal);
|
---|
128 | }
|
---|
129 | };
|
---|
130 |
|
---|
131 | }
|
---|
132 | };
|
---|