"use strict";
/**
 * React/JSX Framework Security Model
 *
 * React auto-escapes JSX expressions by default, preventing XSS.
 * dangerouslySetInnerHTML and ref.innerHTML bypass this protection.
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.reactModel = void 0;
const JSX_EXPRESSION_RE = /\{[^}]+\}/;
const DANGEROUS_INNER_HTML_RE = /dangerouslySetInnerHTML/;
const REF_INNER_HTML_RE = /\.current\.innerHTML\s*=/;
const CREATE_ELEMENT_RE = /React\.createElement\s*\(/;
exports.reactModel = {
    framework: 'react',
    safePatterns: [
        {
            id: 'react_jsx_auto_escape',
            suppressesCategory: ['xss', 'dangerous_function'],
            detect: (line, filePath, _fileContent) => {
                // Only applies to JSX files
                if (!/\.(jsx|tsx)$/.test(filePath))
                    return false;
                // Require JSX context: a JSX tag or return with JSX on the line
                const hasJSXContext = /<[A-Za-z][\w.]*/.test(line) || /return\s*\(?\s*</.test(line);
                if (!hasJSXContext)
                    return false;
                // JSX expression interpolation auto-escapes
                if (!JSX_EXPRESSION_RE.test(line))
                    return false;
                // Unless it's dangerouslySetInnerHTML
                if (DANGEROUS_INNER_HTML_RE.test(line))
                    return false;
                return true;
            },
            reason: 'React JSX auto-escapes interpolated expressions — not an XSS vector',
        },
        {
            id: 'react_create_element_safe',
            suppressesCategory: ['xss'],
            detect: (line, _filePath, _fileContent) => {
                // React.createElement with string children is auto-escaped
                if (!CREATE_ELEMENT_RE.test(line))
                    return false;
                if (DANGEROUS_INNER_HTML_RE.test(line))
                    return false;
                return true;
            },
            reason: 'React.createElement auto-escapes string children',
        },
    ],
    unsafePatterns: [
        {
            id: 'react_dangerous_inner_html',
            boostsCategory: ['xss'],
            detect: (line, _filePath, _fileContent) => DANGEROUS_INNER_HTML_RE.test(line),
            reason: 'dangerouslySetInnerHTML bypasses React auto-escaping — XSS risk if input is unsanitised',
        },
        {
            id: 'react_ref_inner_html',
            boostsCategory: ['xss'],
            detect: (line, _filePath, _fileContent) => REF_INNER_HTML_RE.test(line),
            reason: 'Direct ref.innerHTML assignment bypasses React virtual DOM escaping',
        },
    ],
};
//# sourceMappingURL=react.js.map