+++ /dev/null
-/**
- * @fileoverview Rule to flag use of eval() statement
- * @author Nicholas C. Zakas
- */
-
-"use strict";
-
-//------------------------------------------------------------------------------
-// Requirements
-//------------------------------------------------------------------------------
-
-const astUtils = require("./utils/ast-utils");
-
-//------------------------------------------------------------------------------
-// Helpers
-//------------------------------------------------------------------------------
-
-const candidatesOfGlobalObject = Object.freeze([
- "global",
- "window"
-]);
-
-/**
- * Checks a given node is a Identifier node of the specified name.
- * @param {ASTNode} node A node to check.
- * @param {string} name A name to check.
- * @returns {boolean} `true` if the node is a Identifier node of the name.
- */
-function isIdentifier(node, name) {
- return node.type === "Identifier" && node.name === name;
-}
-
-/**
- * Checks a given node is a Literal node of the specified string value.
- * @param {ASTNode} node A node to check.
- * @param {string} name A name to check.
- * @returns {boolean} `true` if the node is a Literal node of the name.
- */
-function isConstant(node, name) {
- switch (node.type) {
- case "Literal":
- return node.value === name;
-
- case "TemplateLiteral":
- return (
- node.expressions.length === 0 &&
- node.quasis[0].value.cooked === name
- );
-
- default:
- return false;
- }
-}
-
-/**
- * Checks a given node is a MemberExpression node which has the specified name's
- * property.
- * @param {ASTNode} node A node to check.
- * @param {string} name A name to check.
- * @returns {boolean} `true` if the node is a MemberExpression node which has
- * the specified name's property
- */
-function isMember(node, name) {
- return (
- node.type === "MemberExpression" &&
- (node.computed ? isConstant : isIdentifier)(node.property, name)
- );
-}
-
-//------------------------------------------------------------------------------
-// Rule Definition
-//------------------------------------------------------------------------------
-
-module.exports = {
- meta: {
- type: "suggestion",
-
- docs: {
- description: "disallow the use of `eval()`",
- category: "Best Practices",
- recommended: false,
- url: "https://eslint.org/docs/rules/no-eval"
- },
-
- schema: [
- {
- type: "object",
- properties: {
- allowIndirect: { type: "boolean", default: false }
- },
- additionalProperties: false
- }
- ],
-
- messages: {
- unexpected: "eval can be harmful."
- }
- },
-
- create(context) {
- const allowIndirect = Boolean(
- context.options[0] &&
- context.options[0].allowIndirect
- );
- const sourceCode = context.getSourceCode();
- let funcInfo = null;
-
- /**
- * Pushs a variable scope (Program or Function) information to the stack.
- *
- * This is used in order to check whether or not `this` binding is a
- * reference to the global object.
- * @param {ASTNode} node A node of the scope. This is one of Program,
- * FunctionDeclaration, FunctionExpression, and ArrowFunctionExpression.
- * @returns {void}
- */
- function enterVarScope(node) {
- const strict = context.getScope().isStrict;
-
- funcInfo = {
- upper: funcInfo,
- node,
- strict,
- defaultThis: false,
- initialized: strict
- };
- }
-
- /**
- * Pops a variable scope from the stack.
- * @returns {void}
- */
- function exitVarScope() {
- funcInfo = funcInfo.upper;
- }
-
- /**
- * Reports a given node.
- *
- * `node` is `Identifier` or `MemberExpression`.
- * The parent of `node` might be `CallExpression`.
- *
- * The location of the report is always `eval` `Identifier` (or possibly
- * `Literal`). The type of the report is `CallExpression` if the parent is
- * `CallExpression`. Otherwise, it's the given node type.
- * @param {ASTNode} node A node to report.
- * @returns {void}
- */
- function report(node) {
- const parent = node.parent;
- const locationNode = node.type === "MemberExpression"
- ? node.property
- : node;
-
- const reportNode = parent.type === "CallExpression" && parent.callee === node
- ? parent
- : node;
-
- context.report({
- node: reportNode,
- loc: locationNode.loc.start,
- messageId: "unexpected"
- });
- }
-
- /**
- * Reports accesses of `eval` via the global object.
- * @param {eslint-scope.Scope} globalScope The global scope.
- * @returns {void}
- */
- function reportAccessingEvalViaGlobalObject(globalScope) {
- for (let i = 0; i < candidatesOfGlobalObject.length; ++i) {
- const name = candidatesOfGlobalObject[i];
- const variable = astUtils.getVariableByName(globalScope, name);
-
- if (!variable) {
- continue;
- }
-
- const references = variable.references;
-
- for (let j = 0; j < references.length; ++j) {
- const identifier = references[j].identifier;
- let node = identifier.parent;
-
- // To detect code like `window.window.eval`.
- while (isMember(node, name)) {
- node = node.parent;
- }
-
- // Reports.
- if (isMember(node, "eval")) {
- report(node);
- }
- }
- }
- }
-
- /**
- * Reports all accesses of `eval` (excludes direct calls to eval).
- * @param {eslint-scope.Scope} globalScope The global scope.
- * @returns {void}
- */
- function reportAccessingEval(globalScope) {
- const variable = astUtils.getVariableByName(globalScope, "eval");
-
- if (!variable) {
- return;
- }
-
- const references = variable.references;
-
- for (let i = 0; i < references.length; ++i) {
- const reference = references[i];
- const id = reference.identifier;
-
- if (id.name === "eval" && !astUtils.isCallee(id)) {
-
- // Is accessing to eval (excludes direct calls to eval)
- report(id);
- }
- }
- }
-
- if (allowIndirect) {
-
- // Checks only direct calls to eval. It's simple!
- return {
- "CallExpression:exit"(node) {
- const callee = node.callee;
-
- if (isIdentifier(callee, "eval")) {
- report(callee);
- }
- }
- };
- }
-
- return {
- "CallExpression:exit"(node) {
- const callee = node.callee;
-
- if (isIdentifier(callee, "eval")) {
- report(callee);
- }
- },
-
- Program(node) {
- const scope = context.getScope(),
- features = context.parserOptions.ecmaFeatures || {},
- strict =
- scope.isStrict ||
- node.sourceType === "module" ||
- (features.globalReturn && scope.childScopes[0].isStrict);
-
- funcInfo = {
- upper: null,
- node,
- strict,
- defaultThis: true,
- initialized: true
- };
- },
-
- "Program:exit"() {
- const globalScope = context.getScope();
-
- exitVarScope();
- reportAccessingEval(globalScope);
- reportAccessingEvalViaGlobalObject(globalScope);
- },
-
- FunctionDeclaration: enterVarScope,
- "FunctionDeclaration:exit": exitVarScope,
- FunctionExpression: enterVarScope,
- "FunctionExpression:exit": exitVarScope,
- ArrowFunctionExpression: enterVarScope,
- "ArrowFunctionExpression:exit": exitVarScope,
-
- ThisExpression(node) {
- if (!isMember(node.parent, "eval")) {
- return;
- }
-
- /*
- * `this.eval` is found.
- * Checks whether or not the value of `this` is the global object.
- */
- if (!funcInfo.initialized) {
- funcInfo.initialized = true;
- funcInfo.defaultThis = astUtils.isDefaultThisBinding(
- funcInfo.node,
- sourceCode
- );
- }
-
- if (!funcInfo.strict && funcInfo.defaultThis) {
-
- // `this.eval` is possible built-in `eval`.
- report(node.parent);
- }
- }
- };
-
- }
-};
projects / dotfiles / .git / blobdiff