/*
 * Copyright (c) 2018, 2026, Oracle and/or its affiliates.
 * Licensed under The Universal Permissive License (UPL), Version 1.0
 * as shown at https://oss.oracle.com/licenses/upl/
 */
const RULE_NAME="csp-ts-script-unsafe-eval";const LONG_DESCRIPT="CSP-1000:<br>Dynamically evaluated code is a security risk. "+"<b>eval()</b> executes the code it is passed with the privileges of the caller. If you run eval() with a string "+"that could be compromised by a malicious party, you may end up running malicious code on a user machine "+"with the permissions of your webpage/extension.<p>"+"CSP-1001:<br>A dynamically evaluated \"Function\" poses a security risk by allowing arbitrary JS execution "+"that can contain untrusted data.  Strings passed to Function() may be constructed from user-provided or compromised "+"data. The data could thus contain arbitrary code supplied by an attacker, and used to inject content into the DOM.<p>"+"CSP-1002:<br>Using a string as the first argument to functions such as <b>setTimeout/setInterval</b> poses a security risk "+"by allowing arbitrary JS execution of untrusted data. Variants of the API that take a function as the first argument are permitted. "+"Where possible, remove the argument's delimiting quotes in calls such as<p>"+" &nbsp; &nbsp; <b>setTimeout(STRING, delay)</b><p>"+"and wrap the content in a function e.g.<p>"+" &nbsp; &nbsp; <b>(setTimeout(function() { CODE }, delay) )</b><p>"+"When this is not possible, the code can be wrapped in a function and served in a .js file.";const SHORT_DESCRIPT=LONG_DESCRIPT;const FUNC_EXPR="FunctionExpression";const ARROW_FUNC_EXPR="ArrowFunctionExpression";const IDENTIFIER="Identifier";const LITERAL="Literal";const BLOCK_STMT="BlockStatement";const CALL_EXPR="CallExpression";var _scopes;function getName(){return RULE_NAME};function getShortDescription(){return SHORT_DESCRIPT};function getDescription(){return LONG_DESCRIPT};function register(){return{CallExpression:_fn,NewExpression:_fn,endfile:_onEndFile}};function _fn(ruleCtx,node){_checkEval(ruleCtx,node);_checkFunction(ruleCtx,node);_checkTimer(ruleCtx,node)};function _checkEval(ruleCtx,node){var callee,obj,issue;if(node.callee){callee=node.callee;obj=callee.property?callee.property:callee;if(obj.name==="eval"){if(!callee.object){issue=new ruleCtx.Issue("eval() found - CSP violation");issue.setMsgKey(ruleCtx.ruleName+"_1");ruleCtx.reporter.addIssue(issue,ruleCtx)}}}};function _checkFunction(ruleCtx,node){var obj,issue;if(node.callee){obj=node.callee.property?node.callee.property:node.callee;if(obj.type===IDENTIFIER&&obj.name==="Function"){issue=new ruleCtx.Issue("Use of Function() - CSP violation");issue.setPosition(null,null,obj.range[0],obj.range[1]);issue.setMsgKey(ruleCtx.ruleName+"_2");ruleCtx.reporter.addIssue(issue,ruleCtx)}}};function _checkTimer(ruleCtx,node){var obj,funcName,issue;if(node.callee){obj=node.callee.property?node.callee.property:node.callee;funcName=obj.name;if(funcName==="setTimeout"||funcName==="setInterval"){issue=_checkTimerFuncs(ruleCtx,node,funcName);if(issue){issue.setMsgKey(ruleCtx.ruleName+"_3");ruleCtx.reporter.addIssue(issue,ruleCtx)}}}};function _onEndFile(){_scopes=null};function _checkTimerFuncs(ruleCtx,node,funcName){var obj,callee,args,arg,issue;callee=node.callee;obj=callee.property?callee.property:callee;if(obj.type===IDENTIFIER){if(node.arguments){args=node.arguments;if(args.length>=1){arg=args[0];if(arg.type!==FUNC_EXPR&&arg.type!==ARROW_FUNC_EXPR){if(arg.type!==CALL_EXPR&&arg.type!="NewExpression"){if(arg.type===IDENTIFIER){if(!this._scopes){_scopes=ruleCtx.utils.AstUtils.getScopes()}if(_scopes.getVarType(arg)==="TSStringType"){issue=true}}else if(arg.type===LITERAL||_isIdentAString(node,arg.name)){issue=true}if(issue){issue=new ruleCtx.Issue("function "+funcName+"() - first argument CSP violation")}}}}}}return issue};function _isIdentAString(node,ident){var n,decls,decl,i,j,s,isFunc=false;node=node.parent;while(node){if(!node){break}if(node.type!==BLOCK_STMT){if(node.type!=="Program"){node=node.parent;continue}for(i=0;i<node.body.length;i++){n=node.body[i];if(n.type==="FunctionDeclaration"){if(n.id&&n.id.type===IDENTIFIER&&n.id.name===ident){return false}}}}if(node.body){for(i=0;i<node.body.length;i++){n=node.body[i];if(n.type==="VariableDeclaration"){decls=n.declarations;if(decls&&decls.length){for(j=0;j<decls.length;j++){decl=decls[j];if(decl.type==="VariableDeclarator"){if(decl.id&&decl.id.type===IDENTIFIER&&decl.id.name===ident){if(decl.init){if(decl.init.type===LITERAL){s=decl.init.raw.charAt(0);if(s==="\""||s==="'"){return true}}}return false}}}}}}}node=node.parent}return false};module.exports={getName,getDescription,getShortDescription,register};