JS-2207: Implement S9135: Avoid mutating nested properties of shallow clones

[nathsou]

Summary

• Implement S9135 for direct nested mutations of uniquely bound Lodash, Lodash-es, and Underscore.js clone results.
• Report the mutation as primary and the shallow clone call as a secondary location.
• Provide structuredClone() and intentional-shared-state NOSONAR suggestions, with library-specific messages for Lodash and Underscore.js.
• Add focused unit and custom ruling coverage.

Links

• Jira: https://sonarsource.atlassian.net/browse/JS-2207
• RSPEC: https://github.com/SonarSource/rspec/pull/7677

[hashicorp-vault-sonar-prod]

JS-2207

[github-actions]

Ruling Report

New issues flagged (2 issues)

S9135

custom-jsts/S9135.js:25

    23 | 
    24 | const lodashCopy = lodash.clone(user);
>   25 | lodashCopy.address.city = 'Geneva';
    26 | 
    27 | const underscoreCopy = underscore.clone(user);

custom-jsts/S9135.js:28

    26 | 
    27 | const underscoreCopy = underscore.clone(user);
>   28 | underscoreCopy.address.city = 'Geneva';
    29 | 
    30 | const deepCopy = structuredClone(user);

---

Ruling passed with these expected-result updates already present in the branch. No fix PR was needed.

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
93.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[gitar-bot]

Code Review ✅ Approved 2 resolved / 2 findings

Implements rule S9135 to detect nested property mutations on shallow clones from Lodash and Underscore.js, addressing the stray copyright header and hardcoded diagnostic message findings.

✅ 2 resolved

✅ Quality: Stray Closure Library copyright header in test fixture

📄 its/sources/custom/jsts/S9135.js:1-15
Line 1 adds // Copyright 2026 The Closure Library Authors. All Rights Reserved. directly above the SonarSource SSAL license block. This is a copy-paste artifact that wrongly attributes a SonarSource file to the Closure Library Authors and contradicts the license header directly below it. Remove line 1 so only the standard SonarSource header remains.

✅ Quality: Diagnostic message hardcodes '_.clone()' for all import forms

📄 packages/analysis/src/jsts/rules/S9135/rule.ts:28-31
Both messages read "Mutating a nested property of this _.clone()...", but the rule also fires on default/named imports where the call is written as clone(user) (e.g. import clone from 'lodash/clone', tested at unit.test.ts:118-147). In those cases the _. prefix does not match the user's code and can be mildly confusing. Consider wording that does not assume the _. namespace (e.g. "this shallow clone") while still recommending structuredClone()/cloneDeep().

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}