Summary
require-decodeuricomponent-try-catch's dynamic-argument check (isStaticStringExpression / isDynamicArg in eslint-factory/src/rules/require-decodeuricomponent-try-catch.ts:44-57) only recognizes an argument as compile-time-safe when it is a string Literal, a TemplateLiteral with no expressions, or a "+"-concatenation of such statics. Any other literal type — a numeric, boolean, or null literal — falls through to isDynamicArg returning true and gets flagged.
But decodeURIComponent(42), decodeURIComponent(true), and decodeURIComponent(null) can never throw: each is coerced to a fixed string ("42", "true", "null") containing no % characters, so there is nothing for decodeURIComponent/decodeURI to fail to decode. These are provably safe at the same "compile-time constant" level the rule already special-cases for string literals — the rule is just missing the other JS primitive literal types.
This mirrors a defect class the codebase has already fixed once for prefer-number-isnan (#43515 / #45064 — "autofix for provably-numeric args, drop misleading caveat"): a brand-new rule not yet special-casing an argument shape that is provably safe rather than actually dynamic.
Grounding
0 live occurrences today in actions/setup/js (all 5 non-test call sites pass genuinely dynamic string values: match[1], a destructured component variable, pair.slice(...) results, and raw.trim()). This is a latent/ungrounded gap, not an active false positive, but it's a cheap, well-scoped fix worth landing before any future call site hits it — and this is the rule's first review, so a design gap now is easiest to close before more callers accumulate.
Ask
- Extend
isStaticStringExpression (or add a small sibling check folded into isDynamicArg) to also treat Literal nodes whose value is a number, boolean, or null as provably safe and skip reporting.
- Add valid test cases:
decodeURIComponent(42), decodeURIComponent(true), decodeURIComponent(null).
- Keep this scoped to literal primitives only — do not attempt to resolve identifiers back to their initializers (e.g.
const SAFE = "abc"; decodeURIComponent(SAFE)) in this issue; that's a separate, broader identifier-resolution project that should only be taken on once it's grounded in a real call site.
Scope
eslint-factory/src/rules/require-decodeuricomponent-try-catch.ts (+ its .test.ts).
Generated by 🤖 ESLint Refiner · claude · agent · 223.2 AIC · ⌖ 7.75 AIC · ⊞ 5.8K · ◷
Summary
require-decodeuricomponent-try-catch's dynamic-argument check (isStaticStringExpression/isDynamicArgineslint-factory/src/rules/require-decodeuricomponent-try-catch.ts:44-57) only recognizes an argument as compile-time-safe when it is a stringLiteral, aTemplateLiteralwith no expressions, or a"+"-concatenation of such statics. Any other literal type — a numeric, boolean, ornullliteral — falls through toisDynamicArgreturningtrueand gets flagged.But
decodeURIComponent(42),decodeURIComponent(true), anddecodeURIComponent(null)can never throw: each is coerced to a fixed string ("42","true","null") containing no%characters, so there is nothing fordecodeURIComponent/decodeURIto fail to decode. These are provably safe at the same "compile-time constant" level the rule already special-cases for string literals — the rule is just missing the other JS primitive literal types.This mirrors a defect class the codebase has already fixed once for
prefer-number-isnan(#43515 / #45064 — "autofix for provably-numeric args, drop misleading caveat"): a brand-new rule not yet special-casing an argument shape that is provably safe rather than actually dynamic.Grounding
0 live occurrences today in
actions/setup/js(all 5 non-test call sites pass genuinely dynamic string values:match[1], a destructuredcomponentvariable,pair.slice(...)results, andraw.trim()). This is a latent/ungrounded gap, not an active false positive, but it's a cheap, well-scoped fix worth landing before any future call site hits it — and this is the rule's first review, so a design gap now is easiest to close before more callers accumulate.Ask
isStaticStringExpression(or add a small sibling check folded intoisDynamicArg) to also treatLiteralnodes whosevalueis anumber,boolean, ornullas provably safe and skip reporting.decodeURIComponent(42),decodeURIComponent(true),decodeURIComponent(null).const SAFE = "abc"; decodeURIComponent(SAFE)) in this issue; that's a separate, broader identifier-resolution project that should only be taken on once it's grounded in a real call site.Scope
eslint-factory/src/rules/require-decodeuricomponent-try-catch.ts(+ its.test.ts).