feat: add tests for duplicate toString detection and multi-return getters with disallowed identifiers

Author: frontegg-david

libs/ast/src/__tests__/rules.spec.ts

@@ -233,6 +233,33 @@ describe('Validation Rules', () => {
       expect(result.valid).toBe(true);
     });
 
+    it('should detect duplicate toString where last occurrence wins', async () => {
+      const rule = new DisallowedIdentifierRule({ disallowed: ['constructor'] });
+      const validator = new JSAstValidator([rule]);
+
+      const result = await validator.validate('obj[{toString: () => "safe", toString: () => "constructor"}]', {
+        rules: { 'disallowed-identifier': true },
+      });
+      expect(result.valid).toBe(false);
+      expect(result.issues[0].code).toBe('DISALLOWED_IDENTIFIER');
+      expect(result.issues[0].data?.['identifier']).toBe('constructor');
+    });
+
+    it('should detect multi-return getter with disallowed identifier in later return', async () => {
+      const rule = new DisallowedIdentifierRule({ disallowed: ['constructor'] });
+      const validator = new JSAstValidator([rule]);
+
+      const result = await validator.validate(
+        "obj[{get toString(){ if(true) return () => 'x'; return () => 'constructor' }}]",
+        {
+          rules: { 'disallowed-identifier': true },
+        },
+      );
+      expect(result.valid).toBe(false);
+      expect(result.issues[0].code).toBe('DISALLOWED_IDENTIFIER');
+      expect(result.issues[0].data?.['identifier']).toBe('constructor');
+    });
+
     it('should allow safe template literal', async () => {
       const rule = new DisallowedIdentifierRule({ disallowed: ['constructor'] });
       const validator = new JSAstValidator([rule]);

libs/ast/src/rules/coercion-utils.ts

@@ -89,7 +89,6 @@ function resolveCoercionProperty(prop: any): string | null {
               if (inner !== null) return inner;
             }
           }
-          break;
         }
       }
     }
@@ -133,9 +132,9 @@ export function tryGetObjectCoercedString(node: any): string | null {
       keyName = prop.key.value;
     }
 
-    if (keyName === 'toString' && !toStringProp) {
+    if (keyName === 'toString') {
       toStringProp = prop;
-    } else if (keyName === 'valueOf' && !valueOfProp) {
+    } else if (keyName === 'valueOf') {
       valueOfProp = prop;
     }
   }