Showing the changes to scripts (2 of 25 files). Show all
Unified · Split
| @@ -18,6 +18,7 @@ import noPromiseReject from "./oxlint-plugin-executor/rules/no-promise-reject.js · 17 unmodified lines | ||
| 18 | 18 | import noRawDurableObjectId from "./oxlint-plugin-executor/rules/no-raw-durable-object-id.js"; |
| 19 | 19 | import noRawFetch from "./oxlint-plugin-executor/rules/no-raw-fetch.js"; |
| 20 | 20 | import noRawErrorThrow from "./oxlint-plugin-executor/rules/no-raw-error-throw.js"; |
| 21 | +import noRedactedUnwrap from "./oxlint-plugin-executor/rules/no-redacted-unwrap.js"; | |
| 21 | 22 | import noRedundantPrimitiveCast from "./oxlint-plugin-executor/rules/no-redundant-primitive-cast.js"; |
| 22 | 23 | import noRedundantErrorFactory from "./oxlint-plugin-executor/rules/no-redundant-error-factory.js"; |
| 23 | 24 | import noSchemaClass from "./oxlint-plugin-executor/rules/no-schema-class.js"; |
| @@ -62,6 +63,7 @@ export default { · 38 unmodified lines | ||
| 62 | 63 | "no-raw-durable-object-id": noRawDurableObjectId, |
| 63 | 64 | "no-raw-fetch": noRawFetch, |
| 64 | 65 | "no-raw-error-throw": noRawErrorThrow, |
| 66 | + "no-redacted-unwrap": noRedactedUnwrap, | |
| 65 | 67 | "no-redundant-primitive-cast": noRedundantPrimitiveCast, |
| 66 | 68 | "no-redundant-error-factory": noRedundantErrorFactory, |
| 67 | 69 | "no-schema-class": noSchemaClass, |
| @@ -0,0 +1,39 @@ | ||
| 1 | +import { | |
| 2 | + getPropertyName, | |
| 3 | + isDeclarationFile, | |
| 4 | + isIdentifier, | |
| 5 | + isTestLike, | |
| 6 | + unwrapExpression, | |
| 7 | +} from "../utils.js"; | |
| 8 | + | |
| 9 | +const message = | |
| 10 | + 'Unwrapping a credential is a boundary decision, not a convenience. Keep the value `Redacted` and let the wire/persistence line unwrap it; if this IS that line, mark it: `// oxlint-disable-next-line executor/no-redacted-unwrap -- boundary: <why the plaintext has to cross here>`. A missed unwrap on a write path does not throw — `Redacted`\'s toJSON renders the literal "<redacted>" and it is persisted instead.'; | |
| 11 | + | |
| 12 | +// Matches the reference too, not just the call: `.map(Redacted.value)` and | |
| 13 | +// `SchemaGetter.transform(Redacted.value<string>)` unwrap exactly as much as an | |
| 14 | +// applied call does. | |
| 15 | +const isRedactedUnwrap = (node) => | |
| 16 | + isIdentifier(unwrapExpression(node.object), "Redacted") && | |
| 17 | + getPropertyName(node.property) === "value"; | |
| 18 | + | |
| 19 | +export default { | |
| 20 | + meta: { | |
| 21 | + type: "problem", | |
| 22 | + docs: { | |
| 23 | + description: "Disallow Redacted.value outside allowlisted credential boundaries.", | |
| 24 | + }, | |
| 25 | + }, | |
| 26 | + create(context) { | |
| 27 | + // Tests unwrap to assert the bytes that actually reach a backend — the | |
| 28 | + // assertion that catches a missed unwrap in the first place. | |
| 29 | + if (isTestLike(context.filename) || isDeclarationFile(context.filename)) return {}; | |
| 30 | + | |
| 31 | + return { | |
| 32 | + MemberExpression(node) { | |
| 33 | + if (isRedactedUnwrap(node)) { | |
| 34 | + context.report({ node, message }); | |
| 35 | + } | |
| 36 | + }, | |
| 37 | + }; | |
| 38 | + }, | |
| 39 | +}; | |