fix(css): bound JSX candidates and handle valid attribute names

Author: Coding-Dev-Tools

src/deadcode/_typescript.py

@@ -25,7 +25,8 @@ class _Token:
 
 
 _WORD = re.compile(r"[\w$]+", re.UNICODE)
-_JSX_OPENING = re.compile(r"<(?:[^\W\d]|\$)[\w$:.-]*(?=[\s/><])(?!\s*(?:=|extends\b))")
+_JSX_OPENING = re.compile(r"<(?:[^\W\d]|\$)[\w$:.-]*(?=[\s/><])(?!\s*=)")
+_JSX_EXTENDS = re.compile(r"\s+extends\s+(?![=>])")
 _JSX_CLOSING = re.compile(r"</(?:[\w$][\w$:.-]*\s*)?>")
 _CLASS_VALUE_OPERATORS = {":", "=", "+=", "-=", "*=", "/=", "%=", "**=", "&=", "|=", "^=", "&&=", "||=", "??="}
 _PREFIX = {"keyof", "readonly", "unique", "typeof", "asserts", "abstract", "new"}
@@ -153,6 +154,20 @@ def _regex_context(tokens: list[_Token]) -> bool:
     return previous in _REGEX_PREFIX
 
 
+def _jsx_type_parameter_head(source: str, index: int) -> bool:
+    opening = _JSX_OPENING.match(source, index)
+    if not opening or not _JSX_EXTENDS.match(source, opening.end()):
+        return False
+    view = _RuntimeView(source[index : index + 8192], jsx=False)
+    end = view.angle_end(0)
+    if end is None or view.value(end) != "(" or end not in view.pairs:
+        return False
+    body = view.pairs[end] + 1
+    if view.value(body) == ":":
+        body = view.type_end(body + 1)
+    return body is not None and view.value(body) in {"=>", "{"}
+
+
 def _jsx_element(source: str, index: int, depth: int) -> _Token | None:
     """Read one complete element, exposing only its JavaScript expressions."""
     if depth > 80:
@@ -171,7 +186,7 @@ def _jsx_element(source: str, index: int, depth: int) -> _Token | None:
         name = source[index + 1 : opening.end()]
         index = opening.end()
         if index < len(source) and source[index] == "<":
-            arguments = _RuntimeView(source[index:], jsx=False)
+            arguments = _RuntimeView(source[index : index + 8192], jsx=False)
             end = arguments.angle_end(0)
             if end is None:
                 return None
@@ -255,9 +270,11 @@ def _lex(
         if char.isspace():
             index += 1
             continue
+        type_parameter_head = jsx and char == "<" and _jsx_type_parameter_head(source, index)
         if (
             jsx
             and char == "<"
+            and not type_parameter_head
             and _regex_context(tokens)
             and (_JSX_OPENING.match(source, index) or source.startswith("<>", index))
         ):
@@ -280,7 +297,7 @@ def _lex(
             continue
         if interpolation and char == "}" and not braces:
             return tokens, index, uncertain
-        if jsx and char == "<" and (opening := _JSX_OPENING.match(source, index)):
+        if jsx and char == "<" and not type_parameter_head and (opening := _JSX_OPENING.match(source, index)):
             jsx_tags.append((braces, opening.end()))
         elif char == ">" and jsx_tags and jsx_tags[-1][0] == braces:
             jsx_tags.pop()

src/deadcode/scanner.py

@@ -268,21 +268,22 @@ def _module_css_definitions(content: str, rel_path: str):
 # delimiter parsing separate from strings inside JavaScript expressions.
 _JS_LITERAL_PATTERN = re.compile(r"""'(?:\\[\s\S]|[^'\\\r\n])*'|"(?:\\[\s\S]|[^"\\\r\n])*"|`(?:\\[\s\S]|[^`\\])*`""")
 _JS_COMMENT_PATTERN = re.compile(r"//[^\r\n]*|/\*[\s\S]*?\*/")
-_JSX_TAG_PATTERN = re.compile(r"<(?:[^\W\d]|\$)[\w$:.-]*")
-_JSX_ATTRIBUTE_PATTERN = re.compile(r"[a-zA-Z_:][\w:.-]*")
+_JSX_TAG_PATTERN = re.compile(r"<(?:[^\W\d]|\$)[\w$:.-]*(?=[\s/>])")
+_JSX_ATTRIBUTE_PATTERN = re.compile(r"(?:[^\W\d]|[$:])[\w$:.-]*")
 _CLASS_PROPERTY_PATTERN = re.compile(r"""(?<![\w$])(?:className|class|['"]className['"]|['"]class['"])\s*:\s*""")
 _CLASSNAMES_CALL_PATTERN = re.compile(r"(?<![\w$])(?:classNames|clsx)\s*(?=\()")
 _JSX_ENTITY_PATTERN = re.compile(r"&(?:#[xX][0-9a-fA-F]+|#[0-9]+|[a-zA-Z][a-zA-Z0-9]*);")
 _HTML_CLASS_SPACE_PATTERN = re.compile(r"[ \t\r\n\f]+")
 
 
-def _js_delimited_end(content: str, start: int) -> int | None:
+def _js_delimited_end(content: str, start: int, *, limit: int | None = None) -> int | None:
     """Find a closing JS delimiter without treating quoted braces as syntax."""
     closing = {"{": "}", "[": "]", "(": ")"}
     stack = [closing[content[start]]]
     index = start + 1
-    while index < len(content):
-        skipped = _JS_LITERAL_PATTERN.match(content, index) or _JS_COMMENT_PATTERN.match(content, index)
+    limit = len(content) if limit is None else limit
+    while index < limit:
+        skipped = _JS_LITERAL_PATTERN.match(content, index, limit) or _JS_COMMENT_PATTERN.match(content, index, limit)
         if skipped:
             index = skipped.end()
             continue
@@ -356,42 +357,42 @@ def _jsx_class_attributes(content: str, attribute_positions: set[int] | None = N
     """
     for tag in _JSX_TAG_PATTERN.finditer(content):
         index = tag.end()
-        while index < len(content):
+        limit = min(len(content), tag.start() + 8192)
+        while index < limit:
             if content[index].isspace() or content[index] == "/":
                 index += 1
                 continue
             if content[index] == ">":
                 break
             if content[index] == "{":
-                end = _js_delimited_end(content, index)
+                end = _js_delimited_end(content, index, limit=limit)
                 if end is None:
                     yield False, None
                     break
                 if content[index + 1 : end - 1].lstrip().startswith("..."):
                     yield False, None  # Spread props may supply any global class.
                 index = end
                 continue
-            name = _JSX_ATTRIBUTE_PATTERN.match(content, index)
+            name = _JSX_ATTRIBUTE_PATTERN.match(content, index, limit)
             if name is None:
-                index += 1
-                continue
+                break  # Not an attribute: do not walk the remaining file per candidate.
             wanted = name.group() in {"className", "class"}
             if wanted and attribute_positions is not None:
                 attribute_positions.add(name.start())
             index = name.end()
-            while index < len(content) and content[index].isspace():
+            while index < limit and content[index].isspace():
                 index += 1
-            if index >= len(content) or content[index] != "=":
+            if index >= limit or content[index] != "=":
                 continue
             index += 1
-            while index < len(content) and content[index].isspace():
+            while index < limit and content[index].isspace():
                 index += 1
-            if index == len(content):
+            if index == limit:
                 if wanted:
                     yield False, None
                 break
             if content[index] in "'\"":
-                end = content.find(content[index], index + 1)
+                end = content.find(content[index], index + 1, limit)
                 if end < 0:
                     if wanted:
                         yield False, None
@@ -400,7 +401,7 @@ def _jsx_class_attributes(content: str, attribute_positions: set[int] | None = N
                     yield True, content[index + 1 : end]
                 index = end + 1
             elif content[index] == "{":
-                end = _js_delimited_end(content, index)
+                end = _js_delimited_end(content, index, limit=limit)
                 if wanted:
                     yield False, content[index + 1 : end - 1] if end is not None else None
                 if end is None:
@@ -410,6 +411,8 @@ def _jsx_class_attributes(content: str, attribute_positions: set[int] | None = N
                 if wanted:
                     yield False, None
                 index += 1
+        if index >= limit and limit < len(content):
+            yield False, None  # An oversized header leaves possible global uses uncertain.
 
 
 # tsconfig paths for path aliases

tests/test_jsx_attribute_boundaries.py

@@ -0,0 +1,56 @@
+"""Valid attribute identifiers and rejected candidates must preserve live CSS."""
+
+import time
+
+import pytest
+from click.testing import CliRunner
+
+from deadcode.cli import cli
+from deadcode.scanner import DeadCodeScanner, _jsx_class_attributes
+
+
+@pytest.mark.parametrize("extension", ["tsx", "jsx"])
+@pytest.mark.parametrize("attributes", [r'extends="C:\"', r'extends data-path="C:\"'])
+def test_extends_attributes_preserve_module_rules(tmp_path, monkeypatch, extension, attributes):
+    monkeypatch.setattr(time, "sleep", lambda _: None)
+    (tmp_path / "Card.module.css").write_text(".live {}\n.unused {}\n", encoding="utf-8")
+    (tmp_path / f"consumer.{extension}").write_text(
+        "import styles from './Card.module.css';\n"
+        f"const view = <Component {attributes} className={{styles.live}} />;\n",
+        encoding="utf-8",
+    )
+    assert {finding.name for finding in DeadCodeScanner(tmp_path).scan().orphaned_css} == {"unused"}
+    result = CliRunner().invoke(cli, ["-p", str(tmp_path), "remove", "-c", "orphaned_css"])
+    assert result.exit_code == 0, result.output
+    assert (tmp_path / "Card.module.css").read_text() == ".live {}\n"
+
+
+@pytest.mark.parametrize("attribute", ["é", "λ", "字段", "$value"])
+def test_unicode_attribute_names_do_not_expose_quoted_tag_delimiters(tmp_path, attribute):
+    (tmp_path / "styles.css").write_text(".live {}\n.unused {}\n", encoding="utf-8")
+    (tmp_path / "consumer.tsx").write_text(
+        f'const view = <div {attribute}=">" className="live" />;\n', encoding="utf-8"
+    )
+    assert {finding.name for finding in DeadCodeScanner(tmp_path).scan().orphaned_css} == {"unused"}
+
+
+def test_rejected_tag_candidates_have_linear_character_work():
+    class CountedText(str):
+        reads = 0
+
+        def __getitem__(self, key):
+            self.reads += 1
+            return super().__getitem__(key)
+
+    content = CountedText(('const lesser=a<b;\nconst text="<name attr";\n') * 500)
+    assert list(_jsx_class_attributes(content)) == []
+    assert content.reads < 30 * len(content)
+
+
+def test_oversized_header_keeps_global_class_use_uncertain(tmp_path):
+    (tmp_path / "styles.css").write_text(".live {}\n.unused {}\n", encoding="utf-8")
+    (tmp_path / "consumer.tsx").write_text(
+        "const view = <div " + "enabled " * 1500 + 'className="live" />;\n', encoding="utf-8"
+    )
+    findings = DeadCodeScanner(tmp_path).scan().orphaned_css
+    assert findings and all(not finding.removable for finding in findings)