fix: prevent ASI hazard in no-unused-labels autofix (#21173)

* fix: prevent ASI hazard in `no-unused-labels` autofix

When removing an unused label whose body starts with `(`, `[`, `` ` ``,
`/`, `+`, or `-`, the autofix could silently change program semantics by
merging the body with the preceding statement via ASI.

e.g. `foo()\nLABEL: [1,2,3].forEach(x => x)` was incorrectly fixed to
`foo()\n[1,2,3].forEach(x => x)`, which parses as `foo()[1,2,3].forEach(...)`.

The fix skips autofixing in those cases when the token before the
LabeledStatement is not a safe ASI boundary (`;`, `{`, `}`, `:`).

* fix: remove } from safe ASI boundary tokens in no-unused-labels

} is not always a safe ASI boundary — e.g. a function expression ending with } can still be continued by [ on the next line:

  const foo = function() {}
  LABEL: [1, 2, 3].forEach(x => x)

Removing LABEL: here would produce `function() {}[1, 2, 3]` which is a member access, not two separate statements.

* Apply suggestion from @mdjermanovic

getFirstToken(node.body) always returns a token.

Co-authored-by: Milos Djermanovic <milos.djermanovic@gmail.com>

* Update tests/lib/rules/no-unused-labels.js

This test was already being caught by the isStaticTemplateLiteral check above

Co-authored-by: Milos Djermanovic <milos.djermanovic@gmail.com>

* Update tests/lib/rules/no-unused-labels.js

Co-authored-by: Milos Djermanovic <milos.djermanovic@gmail.com>

---------

Co-authored-by: Milos Djermanovic <milos.djermanovic@gmail.com>

Author: dong7812

lib/rules/no-unused-labels.js

@@ -97,6 +97,25 @@ module.exports = {
 					return false; // potential directive
 				}
 			}
+
+			/*
+			 * Do not fix if removing the label would create an ASI hazard.
+			 * e.g. `foo()\nLABEL: [1].forEach(x => x)` → `foo()\n[1].forEach(x => x)`
+			 * would be parsed as `foo()[1].forEach(x => x)`.
+			 */
+			const SAFE_TOKENS_BEFORE = /^[:;{]$/u;
+			const UNSAFE_FIRST_CHARS = /^[([\-+/`]/u;
+			const tokenBefore = sourceCode.getTokenBefore(node);
+			const firstBodyToken = sourceCode.getFirstToken(node.body);
+
+			if (
+				tokenBefore &&
+				!SAFE_TOKENS_BEFORE.test(tokenBefore.value) &&
+				UNSAFE_FIRST_CHARS.test(firstBodyToken.value)
+			) {
+				return false;
+			}
+
 			return true;
 		}
 

tests/lib/rules/no-unused-labels.js

@@ -146,6 +146,58 @@ ruleTester.run("no-unused-labels", rule, {
 			errors: [{ messageId: "unused", data: { name: "A" } }],
 		},
 
+		// Should not autofix if removing the label would create an ASI hazard
+		{
+			code: "foo()\nA: [1, 2, 3].forEach(x => x)",
+			output: null,
+			errors: [{ messageId: "unused", data: { name: "A" } }],
+		},
+		{
+			code: "foo()\nA: (function() {})()",
+			output: null,
+			errors: [{ messageId: "unused", data: { name: "A" } }],
+		},
+		{
+			code: "foo()\nA: /regex/.test(x)",
+			output: null,
+			errors: [{ messageId: "unused", data: { name: "A" } }],
+		},
+		{
+			code: "foo()\nA: +x",
+			output: null,
+			errors: [{ messageId: "unused", data: { name: "A" } }],
+		},
+		{
+			code: "foo()\nA: -x",
+			output: null,
+			errors: [{ messageId: "unused", data: { name: "A" } }],
+		},
+		{
+			code: "foo()\nA: `template` + bar",
+			output: null,
+			languageOptions: { ecmaVersion: 6 },
+			errors: [{ messageId: "unused", data: { name: "A" } }],
+		},
+
+		// Should not autofix if previous token is } (not always safe, e.g. function expression)
+		{
+			code: "const foo = function() {}\nA: [1, 2, 3].forEach(x => x)",
+			output: null,
+			errors: [{ messageId: "unused", data: { name: "A" } }],
+		},
+
+		// Should autofix if previous statement ends safely (;, {, :)
+		{
+			code: "foo();\nA: [1, 2, 3].forEach(x => x)",
+			output: "foo();\n[1, 2, 3].forEach(x => x)",
+			errors: [{ messageId: "unused", data: { name: "A" } }],
+		},
+		{
+			code: "OUTER: while (true) { A: [1, 2, 3].forEach(x => x); break OUTER; }",
+			output: "OUTER: while (true) { [1, 2, 3].forEach(x => x); break OUTER; }",
+			errors: [{ messageId: "unused", data: { name: "A" } }],
+		},
+
 		/*
 		 * Below is fatal errors.
 		 * "A: break B",