feat(compiler): SYN009 — warn on XMLHttpRequest() calls that bypass the net capability model (?bs 0.7+)#150

Open

marcelofarias wants to merge 23 commits into

mainfrom

botkowski/syn009-xhr-bypass

Commits on Jun 13, 2026

feat(compiler): SYN009 — warn on XMLHttpRequest() calls that bypass the net capability model (?bs 0.7+)

authored and
Marcelo Farias
committed
fix(compiler): address Copilot review feedback on SYN009

Marcelo Farias
authored and
Marcelo Farias
committed
fix(compiler): address remaining Copilot review on SYN009 — fix false positive and update comment examples

Marcelo Farias
authored and
Marcelo Farias
committed
fix(syn009): handle new XMLHttpRequest<T> without parens, fix depth underflow, improve message

authored and
Marcelo Farias
committed
fix(compiler): address SYN009 Copilot review feedback

authored and
Marcelo Farias
committed
fix(syn009): clarify warning message — switch to http.get/post as primary fix

authored and
Marcelo Farias
committed
fix(syn009): remove SYN007/SYN008 code references in explanation text

authored and
Marcelo Farias
committed
fix(compiler): SYN009 — exclude method shorthands and TS method signatures named XMLHttpRequest

authored and
Marcelo Farias
committed
fix(compiler): SYN009 — guard ternary `:` from suppressing XMLHttpRequest detection

authored and
Marcelo Farias
committed
refactor(compiler): SYN009 — fold XMLHttpRequest detection into single dispatch loop

authored and
Marcelo Farias
committed

Commits on Jun 15, 2026

fix(compiler): SYN009 — exclude fn/function declarations, fix anchor test offset

Marcelo Farias
authored and
Marcelo Farias
committed
fix(syn009): distinguish 'constructs new' vs 'calls' in diagnostic message

Marcelo Farias
authored and
Marcelo Farias
committed
fix(syn009): correct diagnostic message form for optional-call and bare-new XHR

authored and
Marcelo Farias
committed
fix(syn009): use async fn in ternary-await test fixtures

authored and
Marcelo Farias
committed

Commits on Jun 17, 2026

fix(syn009): extend diagnostic end to opening paren, matching SYN007/SYN008/SYN011 convention

Marcelo Farias
authored and
Marcelo Farias
committed
Merge origin/main into syn009-xhr-bypass

authored and
Marcelo Farias
committed
fix(compiler): SYN009 exclude TS method signatures with omitted return type

authored and
Marcelo Farias
committed
fix(compiler): SYN009 fix generic guard, no-parens form, empty-parens type-literal

authored and
Marcelo Farias
committed
fix(compiler): correct SYN009 description — XHR construction doesn't open a connection

authored and
Marcelo Farias
committed
fix(compiler): SYN009 — bail on unterminated generic; update header comment and rule text

authored and
Marcelo Farias
committed

Commits on Jun 18, 2026

test(syn009): add optional-call test; fix unterminated-generic test source

authored and
Marcelo Farias
committed
fix(syn009): exclude function* XMLHttpRequest() generator declarations

authored and
Marcelo Farias
committed

Commits on Jun 19, 2026

test(compiler): address Copilot SYN009 review — add class method exclusion test

authored and
Marcelo Farias
committed