/*
 * Copyright (c) 2018, 2026, Oracle and/or its affiliates.
 * Licensed under The Universal Permissive License (UPL), Version 1.0
 * as shown at https://oss.oracle.com/licenses/upl/
 */
const RULE_NAME="csp-html-unsafe-expr";const LONG_DESCRIPT="Attribute contains an expression that violates the Content Security Policy, and is not supported. Execution of the attribute's expression will be blocked.";const SHORT_DESCRIPT="Expressions of this format are unsupported if the content_security_policy does not have an exception for unsafe eval";function Rule(){};Rule.prototype.getName=function(){return RULE_NAME};Rule.prototype.getShortDescription=function(){return SHORT_DESCRIPT};Rule.prototype.getDescription=function(){return LONG_DESCRIPT};Rule.prototype.register=function(regCtx){if(regCtx.runMode==="api"&&regCtx.VsCodeExtHint){if(this._exprEval){regCtx.decache(this._exprEval)}}this._exprEval=require("../../libext/expparser");this._exprEval=new this._exprEval;return{"attrexpr":this._onAttrExpr}};Rule.prototype._onAttrExpr=function(ruleCtx,attrName,attrValue){var p,issue,msg;attrValue=attrValue.trim();if(attrName.charAt(0)===":"){attrName=attrName.substring(1)}attrValue=attrValue.substring(2,attrValue.length-2);try{p=this._exprEval.parse(attrValue)}catch(e){msg=_cleanUp(e.message);issue=new ruleCtx.Issue(`Attribute '${attrName}' contains an expression that may not be compatible with all Content Security policies: ${msg}`);ruleCtx.reporter.addIssue(issue,ruleCtx)}};function _cleanUp(msg){msg=msg.replace("character","attribute value position");return msg}module.exports=Rule;