feat(compiler): SYN015 — warn on localStorage/sessionStorage access that bypasses the storage capability model (?bs 0.7+)#162

Open

marcelofarias wants to merge 18 commits into

mainfrom

botkowski/syn015-localstorage-bypass

Commits on Jun 14, 2026

feat(compiler): SYN015 — warn on localStorage/sessionStorage access that bypasses the storage capability model (?bs 0.7+)

authored and
Marcelo Farias
committed
fix(syn015): clarify sessionStorage is per-tab, not cross-session persistent

authored and
Marcelo Farias
committed
fix(syn015): address Copilot review — block comment accuracy, diagnostic message example

authored and
Marcelo Farias
committed
fix(syn015): address Copilot review — use generic method(...) in diagnostic message hint

authored and
Marcelo Farias
committed
fix(compiler): SYN015 — extend range to include access operator, use concrete getItem example

authored and
Marcelo Farias
committed

Commits on Jun 15, 2026

fix(syn015): exclude local bindings named localStorage/sessionStorage

authored and
Marcelo Farias
committed
fix(syn015): include actual member name in diagnostic range and message

Marcelo Farias
authored and
Marcelo Farias
committed
fix(syn015): correct unsafe example for property accesses and indexedDB generator exclusion

authored and
Marcelo Farias
committed
fix(syn015): exclude generator declarations; fix optional-chain separator and isCall detection

authored and
Marcelo Farias
committed

Commits on Jun 16, 2026

fix(syn015): lazy localBindings scan; replace duplicate test; document local-binding exclusion

authored and
Marcelo Farias
committed

Commits on Jun 17, 2026

fix(compiler): SYN015 — handle computed member access localStorage?.[key]

authored and
Marcelo Farias
committed
Merge origin/main into syn015-localstorage-bypass

authored and
Marcelo Farias
committed
fix(compiler): SYN015 detect localStorage[key] non-optional computed access

authored and
Marcelo Farias
committed
fix(compiler): document computed member access in SYN015 detection descriptions

authored and
Marcelo Farias
committed
fix(compiler): SYN015 — reorder member-access check before localBindings; scope to top-level bindings

authored and
Marcelo Farias
committed

Commits on Jun 18, 2026

fix(syn015): track var bindings in nested blocks (var is fn-scoped)

authored and
Marcelo Farias
committed
fix(syn015): simplify local-binding suppression to param-names only

authored and
Marcelo Farias
committed
docs(syn015): align doc comments with implementation — only parameter shadows are suppressed

authored and
Marcelo Farias
committed