/*
 * Copyright (c) 2018, 2026, Oracle and/or its affiliates.
 * Licensed under The Universal Permissive License (UPL), Version 1.0
 * as shown at https://oss.oracle.com/licenses/upl/
 */
const RULE_NAME="csp-json-unsafe-expr";const LONG_DESCRIPT="A JSON member value contains an expression that violates the Content Security Policy, "+"and is not supported. Execution of the expression will be blocked.";const SHORT_DESCRIPT=LONG_DESCRIPT;const CHARACTER="character";const VB_ASSET_TOKEN_MATCHER=/\@{2}(?<tokenRef>[A-Z\d\-\$]*)@{2}/gmi;function Rule(){};Rule.prototype.getName=function(){return RULE_NAME};Rule.prototype.getShortDescription=function(){return SHORT_DESCRIPT};Rule.prototype.getDescription=function(){return LONG_DESCRIPT};Rule.prototype.register=function(regCtx){if(regCtx.runMode==="api"&&regCtx.VsCodeExtHint){if(this._exprEval){regCtx.decache(this._exprEval)}}this._exprEval=require("../../libext/expparser");this._exprEval=new this._exprEval;return{"json":this._onJson}};Rule.prototype._onJson=function(ruleCtx,ast){if(!ast){_onSyntaxError(ruleCtx);return false}this._walk(ruleCtx,ast)};Rule.prototype._walk=function(ruleCtx,ast,members){if(members=members||ast.members){members.forEach(member=>{let val,subMems;if(val=member.value){if(val?.type==="string"&&_isExpr(val?.value)){this._checkExpr(ruleCtx,member)}else if(val?.type==="array"){this._checkArrayExpr(ruleCtx,ast,member)}if(val?.members){if(subMems=val.members){this._walk(ruleCtx,ast,subMems)};}}})}};Rule.prototype._checkArrayExpr=function(ruleCtx,ast,member){var arrayMems,mem,i;if(arrayMems=member.value.members){for(i=0;i<arrayMems.length;i++){if(mem=arrayMems[i]){if(mem.type==="Object"&&mem.members){this._walk(ruleCtx,ast,mem.members)}}}}};Rule.prototype._checkExpr=function(ruleCtx,member){var value,issue,p;value=member.value.value.trim();value=value.substring(2,value.length-2).trimEnd();value=value.replace(VB_ASSET_TOKEN_MATCHER,"$<tokenRef>");try{p=this._exprEval.parse(value)}catch(e){let o=_cleanUp(e.message,member);issue=new ruleCtx.Issue(`Member '${member.name}' contains an expression that may not be compatible with all Content Security policies: ${o.msg}. The expression is:\n\"${value}\"`);if(o.pos>=0){let pos=member.value.pos;issue.setPosition(pos.line,pos.col+o.pos+3,pos.start+o.pos+3,pos.end+o.pos+3)}else{issue.setPosition(member.value.pos)}ruleCtx.reporter.addIssue(issue,ruleCtx)}};function _cleanUp(msg,member){var pos=-1,x;if((x=msg.indexOf(CHARACTER))>=0){let posChars=msg.substring(x+CHARACTER.length+1);pos=parseInt(posChars);if(!isNaN(pos)){msg=msg.replace(CHARACTER,"expression position");msg=msg+` ~[${member.value.pos.row}, ${pos+member.value.pos.col+3}]`}}return{msg:msg,pos:pos}};function _onSyntaxError(ruleCtx){if(ruleCtx.suppData){if(!ruleCtx.rulePack.isRuleEnabled("oj-json-syntax","JET")){let issue=new ruleCtx.Issue(ruleCtx.suppData.msg);issue.setPosition(ruleCtx.suppData.line,ruleCtx.suppData.col,ruleCtx.suppData.position,ruleCtx.suppData.position+3);issue.setMsgKey(RULE_NAME+"_1");issue.setSeverity("critical");ruleCtx.reporter.addIssue(issue,ruleCtx)}}};function _isExpr(s){s=s.trimStart();return s.startsWith("[[")||s.startsWith("{{")};module.exports=Rule;