@fabriziosalmi/slopless 1.17.1 → 1.17.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fabriziosalmi/slopless",
-  "version": "1.17.1",
+  "version": "1.17.2",
   "description": "",
   "main": "dist/engine/api.js",
   "types": "dist/engine/api.d.ts",

package/rules/VBC-901.yaml

@@ -12,8 +12,31 @@ match:
   # Nothing starting with 255 is a host: 240.0.0.0/4 is reserved, so a dotted
   # quad there is a netmask or a broadcast address — `isInNet(host, "172.16.0.0",
   # "255.240.0.0")` names a mask, not a machine.
+  #
+  # The same reasoning covers the IANA special-purpose ranges that are not
+  # globally reachable (#43). They are what SSRF and egress blocklists list, so
+  # reporting them made a project's most defensive file its noisiest:
+  #   0.0.0.0/8        "this network", all of it, not only 0.0.0.0 (RFC 6890)
+  #   192.0.0.0/24     IETF protocol assignments (RFC 6890)
+  #   192.88.99.0/24   deprecated 6to4 relay anycast (RFC 7526)
+  #   100.64.0.0/10    shared address space, carrier-grade NAT (RFC 6598)
+  #   198.18.0.0/15    benchmarking (RFC 2544)
+  # The fire list keeps their neighbours, so the exclusion cannot widen quietly.
+  #
+  # RFC 1918 private ranges are deliberately still reported: 192.168.1.50 in
+  # code is exactly one environment. 169.254.0.0/16 is too, for the opposite
+  # reason from the above: a literal link-local address is almost always the
+  # cloud metadata service being called, not being blocked.
+  #
+  # Well-known public resolvers are not reported, by exact address and never by
+  # subnet: Google, Cloudflare (1.1.1.2 and 1.1.1.3 are its filtered variants),
+  # Quad9, OpenDNS and AdGuard. The message says an address pins code to one
+  # environment, and an anycast resolver reachable from everywhere does not —
+  # it is a documented choice that outlives the project, which is the call
+  # l0-git#29 made too. Decided in #43. The fire list keeps each one's
+  # neighbour, so a typo'd or unknown address beside them is still reported.
   regex: >-
-    \b(?!127\.|0\.0\.0\.0\b|255\.|192\.0\.2\.|198\.51\.100\.|203\.0\.113\.)(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\b
+    \b(?!127\.|0\.|255\.|192\.0\.2\.|198\.51\.100\.|203\.0\.113\.|192\.0\.0\.|192\.88\.99\.|100\.(?:6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\.|198\.1[89]\.|(?:8\.8\.8\.8|8\.8\.4\.4|1\.1\.1\.1|1\.0\.0\.1|1\.1\.1\.2|1\.0\.0\.2|1\.1\.1\.3|1\.0\.0\.3|9\.9\.9\.9|149\.112\.112\.112|9\.9\.9\.10|149\.112\.112\.10|9\.9\.9\.11|149\.112\.112\.11|208\.67\.222\.222|208\.67\.220\.220|208\.67\.222\.220|208\.67\.220\.222|208\.67\.222\.123|208\.67\.220\.123|94\.140\.14\.14|94\.140\.15\.15|94\.140\.14\.15|94\.140\.15\.16|94\.140\.14\.140|94\.140\.14\.141)\b)(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\b
   scan: strings
   file_types:
     - js
@@ -52,7 +75,15 @@ message: >-
 tests:
   fire:
     - const host = '192.168.1.50';
-    - const dns = "8.8.8.8";
+    # Beside a known resolver is not a known resolver.
+    - const dns = "8.8.8.9";
+    - const near = "1.1.1.4";
+    # One step outside each special-purpose range: still a host.
+    - const near = "192.0.1.1";
+    - const relay = "192.88.100.1";
+    - const below = "100.63.255.255";
+    - const above = "100.128.0.1";
+    - const bench = "198.20.0.1";
   quiet:
     - const host = process.env.DB_HOST;
     - const version = '1.2';
@@ -66,3 +97,15 @@ tests:
     # "255.240.0.0")` still reports — on the 172.16.0.0, which is an address.)
     - const netmask = "255.240.0.0";
     - const mask = '255.255.255.0';
+    # IANA special-purpose, not globally reachable (#43).
+    - '"192.0.0.0/24",'
+    - '"192.88.99.0/24",'
+    - const thisNet = "0.1.2.3";
+    - const cgnat = "100.64.0.1";
+    - const cgnatTop = "100.127.255.254";
+    - const benchmark = "198.18.0.1";
+    - const benchmarkTop = "198.19.255.1";
+    # Public anycast resolvers, a choice rather than an environment (#43).
+    - const dns = "8.8.8.8";
+    - const cloudflare = '1.1.1.3';
+    - 'upstream = ["9.9.9.9", "94.140.14.14"]'

package/rules/VBC-920.yaml

@@ -2,11 +2,22 @@ id: VBC-920
 name: relative-link-format
 severity: warning
 category: docs
+# Off unless the config names it (#43). In CommonMark [x](guide.md) and
+# [x](./guide.md) resolve identically, and the message's "tool compatibility"
+# names no tool, so this is a house style rather than a defect. Preferences
+# nobody agreed to ship disabled; a project that wants the style can ask for it.
+opt_in: true
 tags:
   - documentation
   - maintenance
 match:
-  regex: \]\((?![a-z]+:|/|\.)
+  # `#` is excluded along with schemes, absolute paths and ./ ../: an in-page
+  # anchor points at a heading in this document, not at a relative file.
+  regex: \]\((?![a-z]+:|/|\.|#)
+  # Link syntax inside `code` or a fenced block is an example of a link, not a
+  # link, and CommonMark renders neither. The CHANGELOG line that describes how
+  # Jekyll writes links was the one reported (#43).
+  exclude_markdown_code: true
   file_types:
     - md
 message: >-
@@ -15,6 +26,22 @@ message: >-
 tests:
   fire:
     - See [the guide](guide.md).
+    # A real link after the code in the same line is still a real link.
+    - 'Run `make docs`, then read [the guide](guide.md).'
   quiet:
     - See [the guide](./guide.md).
     - See [the site](https://example.com).
+    # In-page anchor.
+    - See [the setup](#setup).
+    # Inside a code span.
+    - 'Inline code: `[CLI](cli-reference.html)` is how Jekyll links.'
+    - 'Double backticks: ``[a](b.md) with a ` inside`` still code.'
+    # Inside a fenced block, both fence characters.
+    - |
+      ```markdown
+      [guide](guide.md)
+      ```
+    - |
+      ~~~
+      [guide](guide.md)
+      ~~~