@odg/eslint-config 1.15.0 → 1.15.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +119 -75
- package/package.json +1 -1
- package/rules/javascript/js-documentation.js +165 -153
package/README.md
CHANGED
|
@@ -240,7 +240,7 @@
|
|
|
240
240
|
- [No Amd](#no-amd)
|
|
241
241
|
- [Prefer Default Export](#prefer-default-export)
|
|
242
242
|
- [Max Imports](#max-imports)
|
|
243
|
-
- [No CommanJs Export](#no-
|
|
243
|
+
- [No CommanJs Export](#no-commanjs-export)
|
|
244
244
|
- [No Useless Path Import](#no-useless-path-import)
|
|
245
245
|
- [No Extraneous Dependencies](#no-extraneous-dependencies)
|
|
246
246
|
- [Import Order](#import-order)
|
|
@@ -259,7 +259,7 @@
|
|
|
259
259
|
- [Validate Param](#validate-param)
|
|
260
260
|
- [Validate Syntax](#validate-syntax)
|
|
261
261
|
- [Validate Tag Name](#validate-tag-name)
|
|
262
|
-
- [Validate Types](#validate-
|
|
262
|
+
- [Validate Types](#validate-types)
|
|
263
263
|
- [Validate Values](#validate-values)
|
|
264
264
|
- [Empty Tags](#empty-tags)
|
|
265
265
|
- [Validate Block](#validate-block)
|
|
@@ -279,11 +279,11 @@
|
|
|
279
279
|
- [No Lazy Ends](#no-lazy-ends)
|
|
280
280
|
- [No Misleading Unicode Character](#no-misleading-unicode-character)
|
|
281
281
|
- [No Optional Assertion](#no-optional-assertion)
|
|
282
|
-
- [No Potentially Useless
|
|
282
|
+
- [No Potentially Useless Back Reference](#no-potentially-useless-back-reference)
|
|
283
283
|
- [No Useless Assertions](#no-useless-assertions)
|
|
284
|
-
- [No Useless
|
|
284
|
+
- [No Useless Back Reference](#no-useless-back-reference)
|
|
285
285
|
- [No Useless Dollar Replacements](#no-useless-dollar-replacements)
|
|
286
|
-
- [
|
|
286
|
+
- [Strict Regex](#strict-regex)
|
|
287
287
|
- [Confusing Quantifier](#confusing-quantifier)
|
|
288
288
|
- [Control Character Escape](#control-character-escape)
|
|
289
289
|
- [Negation](#negation)
|
|
@@ -337,7 +337,7 @@
|
|
|
337
337
|
- [Prevent Literal Code](#prevent-literal-code)
|
|
338
338
|
- [No Import Dynamic](#no-import-dynamic)
|
|
339
339
|
- [Security SSL](#security-ssl)
|
|
340
|
-
- [Security Encrypt
|
|
340
|
+
- [Security Encrypt Access](#security-encrypt-access)
|
|
341
341
|
- [Certificate Transparency](#certificate-transparency)
|
|
342
342
|
- [No Log confidential information](#no-log-confidential-information)
|
|
343
343
|
- [Content Length](#content-length)
|
|
@@ -453,7 +453,6 @@
|
|
|
453
453
|
- [Getter Return](#getter-return)
|
|
454
454
|
- [No Class Assign](#no-class-assign)
|
|
455
455
|
- [No Compare Neg Zero](#no-compare-neg-zero)
|
|
456
|
-
- [No Setter Return](#no-setter-return)
|
|
457
456
|
- [Useless Loop](#useless-loop)
|
|
458
457
|
- [No Loss Of Precision](#no-loss-of-precision)
|
|
459
458
|
- [No Unsafe Argument](#no-unsafe-argument)
|
|
@@ -639,7 +638,6 @@ class Foo {
|
|
|
639
638
|
bar = 1
|
|
640
639
|
}
|
|
641
640
|
|
|
642
|
-
|
|
643
641
|
foo()
|
|
644
642
|
;[1, 2, 3].forEach(bar)
|
|
645
643
|
|
|
@@ -3479,7 +3477,8 @@ function togglePropertyToCalculatedValue(property: string) {
|
|
|
3479
3477
|
👎 Examples of incorrect code
|
|
3480
3478
|
|
|
3481
3479
|
```typescript
|
|
3482
|
-
|
|
3480
|
+
// Noncompliant, default value for 'countZero' should be defined
|
|
3481
|
+
function countPositiveNumbers(arr: number[], countZero?: boolean) {
|
|
3483
3482
|
// ...
|
|
3484
3483
|
}
|
|
3485
3484
|
|
|
@@ -3865,12 +3864,12 @@ const mappedArray = arr.map((t) => t.id);
|
|
|
3865
3864
|
|
|
3866
3865
|
----------
|
|
3867
3866
|
|
|
3868
|
-
Use .flat() to flatten an array of arrays. This rule currently recognizes two patterns and can replace them with a
|
|
3867
|
+
Use .flat() to flatten an array of arrays. This rule currently recognizes two patterns and can replace them with a
|
|
3868
|
+
.flat() call:
|
|
3869
3869
|
|
|
3870
3870
|
<https://github.com/freaktechnik/eslint-plugin-array-func#prefer-flat>
|
|
3871
3871
|
<https://github.com/sindresorhus/eslint-plugin-unicorn/blob/main/docs/rules/prefer-array-flat.md>
|
|
3872
3872
|
|
|
3873
|
-
|
|
3874
3873
|
👍 Examples of correct code
|
|
3875
3874
|
|
|
3876
3875
|
```typescript
|
|
@@ -4810,7 +4809,9 @@ var quux = "\0\8";
|
|
|
4810
4809
|
|
|
4811
4810
|
----------
|
|
4812
4811
|
|
|
4813
|
-
Node.js allows the import of modules using an absolute path such as /home/xyz/file.js.
|
|
4812
|
+
Node.js allows the import of modules using an absolute path such as /home/xyz/file.js.
|
|
4813
|
+
That is a bad practice as it ties the code using it to your computer,
|
|
4814
|
+
and therefore makes it unusable in packages distributed on npm for instance.
|
|
4814
4815
|
|
|
4815
4816
|
<https://github.com/import-js/eslint-plugin-import/blob/HEAD/docs/rules/no-absolute-path.md>
|
|
4816
4817
|
|
|
@@ -5001,7 +5002,8 @@ typeof bar !== "fucntion"
|
|
|
5001
5002
|
----------
|
|
5002
5003
|
|
|
5003
5004
|
Requires the use of === and !== instead of == and !=.
|
|
5004
|
-
It is considered good practice to use the type-safe equality operators === and !== instead
|
|
5005
|
+
It is considered good practice to use the type-safe equality operators === and !== instead
|
|
5006
|
+
of their regular counterparts == and !=.
|
|
5005
5007
|
|
|
5006
5008
|
<https://eslint.org/docs/rules/eqeqeq#eqeqeq>
|
|
5007
5009
|
|
|
@@ -5038,7 +5040,8 @@ foo == null
|
|
|
5038
5040
|
----------
|
|
5039
5041
|
|
|
5040
5042
|
- Disallows unnecessary labels.
|
|
5041
|
-
- Labeled statements in JavaScript are used in conjunction with break and continue
|
|
5043
|
+
- Labeled statements in JavaScript are used in conjunction with break and continue
|
|
5044
|
+
to control flow around multiple loops. For example:
|
|
5042
5045
|
|
|
5043
5046
|
<https://eslint.org/docs/rules/no-extra-label#no-extra-label>
|
|
5044
5047
|
<https://eslint.org/docs/rules/no-labels#no-labels>
|
|
@@ -5182,7 +5185,9 @@ var x = Function("a", "b", "return a + b");
|
|
|
5182
5185
|
var x = Function.call(null, "a", "b", "return a + b");
|
|
5183
5186
|
var x = Function.apply(null, ["a", "b", "return a + b"]);
|
|
5184
5187
|
var x = Function.bind(null, "a", "b", "return a + b")();
|
|
5185
|
-
|
|
5188
|
+
|
|
5189
|
+
// assuming that the result of Function.bind(...) will be eventually called.
|
|
5190
|
+
var f = Function.bind(null, "a", "b", "return a + b");
|
|
5186
5191
|
```
|
|
5187
5192
|
|
|
5188
5193
|
## No Redeclare
|
|
@@ -5375,7 +5380,8 @@ Disallows "Yoda" conditions.
|
|
|
5375
5380
|
|
|
5376
5381
|
<https://eslint.org/docs/rules/yoda#yoda>
|
|
5377
5382
|
|
|
5378
|
-
> Yoda conditions are so named because the literal value of the condition comes first while the variable comes second.
|
|
5383
|
+
> Yoda conditions are so named because the literal value of the condition comes first while the variable comes second.
|
|
5384
|
+
> For example, the following is a Yoda condition:
|
|
5379
5385
|
|
|
5380
5386
|
👍 Examples of correct code
|
|
5381
5387
|
|
|
@@ -6123,7 +6129,6 @@ var o = {
|
|
|
6123
6129
|
}
|
|
6124
6130
|
};
|
|
6125
6131
|
|
|
6126
|
-
|
|
6127
6132
|
var myObject = { d: 1 };
|
|
6128
6133
|
Object.defineProperty(myObject, 'c', {
|
|
6129
6134
|
set: function(value) {
|
|
@@ -6306,16 +6311,14 @@ function bar(arg: string) {
|
|
|
6306
6311
|
|
|
6307
6312
|
```typescript
|
|
6308
6313
|
function foo<T>(items: T[]) {
|
|
6309
|
-
|
|
6310
|
-
|
|
6311
|
-
|
|
6314
|
+
// \r\n
|
|
6315
|
+
// \r\n
|
|
6312
6316
|
}
|
|
6313
|
-
|
|
6314
|
-
|
|
6317
|
+
// \n
|
|
6318
|
+
// \n
|
|
6315
6319
|
function bar(arg: string) {
|
|
6316
|
-
|
|
6317
|
-
|
|
6318
|
-
|
|
6320
|
+
// \n
|
|
6321
|
+
// \n
|
|
6319
6322
|
}
|
|
6320
6323
|
```
|
|
6321
6324
|
|
|
@@ -6662,7 +6665,9 @@ function QuuzUnknown<T extends unknown>() {}
|
|
|
6662
6665
|
|
|
6663
6666
|
----------
|
|
6664
6667
|
|
|
6665
|
-
The use of `arguments.caller` and `arguments.callee` make several code optimizations impossible.
|
|
6668
|
+
The use of `arguments.caller` and `arguments.callee` make several code optimizations impossible.
|
|
6669
|
+
They have been deprecated in future versions of JavaScript and their use
|
|
6670
|
+
is forbidden in ECMAScript 5 while in strict mode.
|
|
6666
6671
|
|
|
6667
6672
|
<https://eslint.org/docs/rules/no-caller>
|
|
6668
6673
|
|
|
@@ -8566,7 +8571,8 @@ new Promise.all([p1, p2])
|
|
|
8566
8571
|
|
|
8567
8572
|
----------
|
|
8568
8573
|
|
|
8569
|
-
Ensure that inside a then() or a catch() we always return or throw a raw value instead of wrapping in
|
|
8574
|
+
Ensure that inside a then() or a catch() we always return or throw a raw value instead of wrapping in
|
|
8575
|
+
Promise.resolve or Promise.reject
|
|
8570
8576
|
|
|
8571
8577
|
<https://github.com/xjamundx/eslint-plugin-promise/blob/development/docs/rules/no-new-statics.md>
|
|
8572
8578
|
|
|
@@ -8596,7 +8602,8 @@ myPromise.then(function (val) {
|
|
|
8596
8602
|
|
|
8597
8603
|
----------
|
|
8598
8604
|
|
|
8599
|
-
Ensure that inside a then() or a catch() we always return or throw a raw value instead of wrapping in
|
|
8605
|
+
Ensure that inside a then() or a catch() we always return or throw a raw value instead of wrapping in
|
|
8606
|
+
Promise.resolve or Promise.reject
|
|
8600
8607
|
|
|
8601
8608
|
<https://github.com/xjamundx/eslint-plugin-promise/blob/development/docs/rules/param-names.md>
|
|
8602
8609
|
|
|
@@ -8620,7 +8627,8 @@ new Promise(function (_, reject) { ... }) // a simple underscore is not allowed
|
|
|
8620
8627
|
|
|
8621
8628
|
----------
|
|
8622
8629
|
|
|
8623
|
-
Ensure that inside a then() or a catch() we always return or throw a raw value instead of wrapping in
|
|
8630
|
+
Ensure that inside a then() or a catch() we always return or throw a raw value instead of wrapping in
|
|
8631
|
+
Promise.resolve or Promise.reject
|
|
8624
8632
|
|
|
8625
8633
|
<https://github.com/xjamundx/eslint-plugin-promise/blob/development/docs/rules/always-return.md>
|
|
8626
8634
|
|
|
@@ -8918,7 +8926,6 @@ export function multiply(six, nine) {
|
|
|
8918
8926
|
return 42
|
|
8919
8927
|
}
|
|
8920
8928
|
|
|
8921
|
-
|
|
8922
8929
|
import { multiply } from './answer';
|
|
8923
8930
|
```
|
|
8924
8931
|
|
|
@@ -9409,7 +9416,6 @@ The primary goal of these rules is to make the comments easier to read and impro
|
|
|
9409
9416
|
* This is a comment with a whitespace at the beginning
|
|
9410
9417
|
*/
|
|
9411
9418
|
|
|
9412
|
-
|
|
9413
9419
|
/**
|
|
9414
9420
|
* valid
|
|
9415
9421
|
*/
|
|
@@ -9618,7 +9624,7 @@ Check is valid tag docblock
|
|
|
9618
9624
|
*/
|
|
9619
9625
|
```
|
|
9620
9626
|
|
|
9621
|
-
### Validate
|
|
9627
|
+
### Validate Types
|
|
9622
9628
|
|
|
9623
9629
|
----------
|
|
9624
9630
|
|
|
@@ -9758,7 +9764,8 @@ function quux(foo) {
|
|
|
9758
9764
|
|
|
9759
9765
|
----------
|
|
9760
9766
|
|
|
9761
|
-
This rule reports elements that contradict an assertion.
|
|
9767
|
+
This rule reports elements that contradict an assertion.
|
|
9768
|
+
All elements reported by this rule fall into one of two categories:
|
|
9762
9769
|
|
|
9763
9770
|
<https://ota-meshi.github.io/eslint-plugin-regexp/rules/no-contradiction-with-assertion.html>
|
|
9764
9771
|
|
|
@@ -9951,11 +9958,11 @@ var foo = /(?:|)/;
|
|
|
9951
9958
|
|
|
9952
9959
|
This rule reports empty lookahead assertion or empty lookbehind assertion.
|
|
9953
9960
|
|
|
9954
|
-
> What are empty
|
|
9961
|
+
> What are empty look around?
|
|
9955
9962
|
|
|
9956
|
-
An empty
|
|
9963
|
+
An empty look around is a look around for which at least one path in the look around expression
|
|
9957
9964
|
contains only elements that do not consume characters and do not assert characters.
|
|
9958
|
-
This means that the
|
|
9965
|
+
This means that the look around expression will trivially accept any input string.
|
|
9959
9966
|
|
|
9960
9967
|
<https://ota-meshi.github.io/eslint-plugin-regexp/rules/no-empty-lookarounds-assertion.html>
|
|
9961
9968
|
|
|
@@ -10105,13 +10112,13 @@ var foo = /(?:^)?\w+/; // warns about `^`
|
|
|
10105
10112
|
var foo = /\w+(?::|$)?/; // warns about `$`
|
|
10106
10113
|
```
|
|
10107
10114
|
|
|
10108
|
-
### No Potentially Useless
|
|
10115
|
+
### No Potentially Useless Back Reference
|
|
10109
10116
|
|
|
10110
10117
|
----------
|
|
10111
10118
|
|
|
10112
|
-
If the referenced group of a backreference is not matched because some other path leads to the
|
|
10113
|
-
the
|
|
10114
|
-
The same will happen if the captured text of the referenced group was reset before reaching the
|
|
10119
|
+
If the referenced group of a backreference is not matched because some other path leads to the back-reference,
|
|
10120
|
+
the back-reference will trivially accept (e.g. /(?:(a)|b)\1/).
|
|
10121
|
+
The same will happen if the captured text of the referenced group was reset before reaching the back-reference.
|
|
10115
10122
|
|
|
10116
10123
|
<https://ota-meshi.github.io/eslint-plugin-regexp/rules/no-potentially-useless-backreference.html>
|
|
10117
10124
|
<https://eslint.org/docs/latest/rules/no-useless-backreference>
|
|
@@ -10154,13 +10161,13 @@ var foo = /$foo/; // $ will always reject
|
|
|
10154
10161
|
var foo = /(?=\w)\d+/; // (?=\w) will always accept
|
|
10155
10162
|
```
|
|
10156
10163
|
|
|
10157
|
-
### No Useless
|
|
10164
|
+
### No Useless Back Reference
|
|
10158
10165
|
|
|
10159
10166
|
----------
|
|
10160
10167
|
|
|
10161
|
-
|
|
10168
|
+
Back references that will always trivially accept serve no function and can be removed.
|
|
10162
10169
|
|
|
10163
|
-
This rule is a based on the ESLint core no-useless-
|
|
10170
|
+
This rule is a based on the ESLint core no-useless-back-reference rule.
|
|
10164
10171
|
It reports all the ESLint core rule reports and some more.
|
|
10165
10172
|
|
|
10166
10173
|
<https://ota-meshi.github.io/eslint-plugin-regexp/rules/no-useless-backreference.html>
|
|
@@ -10218,7 +10225,7 @@ var newStr = str.replace(/(\w+)\s(\w+)/, '$<last>, $<first>');
|
|
|
10218
10225
|
// newStr = "$<last>, $<first>"
|
|
10219
10226
|
```
|
|
10220
10227
|
|
|
10221
|
-
### Strict
|
|
10228
|
+
### Strict Regex
|
|
10222
10229
|
|
|
10223
10230
|
----------
|
|
10224
10231
|
|
|
@@ -10385,10 +10392,30 @@ var foo = / /; // SPACE (`U+0020`)
|
|
|
10385
10392
|
👎 Examples of incorrect code
|
|
10386
10393
|
|
|
10387
10394
|
```typescript
|
|
10388
|
-
|
|
10389
|
-
|
|
10390
|
-
|
|
10391
|
-
|
|
10395
|
+
// \u000B - Line Tabulation (\v) - <VT>
|
|
10396
|
+
// \u000C - Form Feed (\f) - <FF>
|
|
10397
|
+
// \u00A0 - No-Break Space - <NBSP>
|
|
10398
|
+
// \u0085 - Next Line
|
|
10399
|
+
// \u1680 - Ogham Space Mark
|
|
10400
|
+
// \u180E - Mongolian Vowel Separator - <MVS>
|
|
10401
|
+
// \ufeff - Zero Width No-Break Space - <BOM>
|
|
10402
|
+
// \u2000 - En Quad
|
|
10403
|
+
// \u2001 - Em Quad
|
|
10404
|
+
// \u2002 - En Space - <ENSP>
|
|
10405
|
+
// \u2003 - Em Space - <EMSP>
|
|
10406
|
+
// \u2004 - Three-Per-Em
|
|
10407
|
+
// \u2005 - Four-Per-Em
|
|
10408
|
+
// \u2006 - Six-Per-Em
|
|
10409
|
+
// \u2007 - Figure Space
|
|
10410
|
+
// \u2008 - Punctuation Space - <PUNCSP>
|
|
10411
|
+
// \u2009 - Thin Space
|
|
10412
|
+
// \u200A - Hair Space
|
|
10413
|
+
// \u200B - Zero Width Space - <ZWSP>
|
|
10414
|
+
// \u2028 - Line Separator
|
|
10415
|
+
// \u2029 - Paragraph Separator
|
|
10416
|
+
// \u202F - Narrow No-Break Space
|
|
10417
|
+
// \u205f - Medium Mathematical Space
|
|
10418
|
+
// \u3000 - Ideographic Space
|
|
10392
10419
|
```
|
|
10393
10420
|
|
|
10394
10421
|
### No Legacy Features
|
|
@@ -10577,7 +10604,7 @@ var foo = /^foo$/m;
|
|
|
10577
10604
|
var foo = /a.*?b/s;
|
|
10578
10605
|
|
|
10579
10606
|
const regex1 = /foo/y;
|
|
10580
|
-
const str = 'table football,
|
|
10607
|
+
const str = 'table football, football';
|
|
10581
10608
|
regex1.lastIndex = 6
|
|
10582
10609
|
var array = regex1.exec(str)
|
|
10583
10610
|
```
|
|
@@ -11357,7 +11384,8 @@ var expression = /^([a-zA-Z0-9_\.\-])+\@(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]{2,4})+
|
|
|
11357
11384
|
|
|
11358
11385
|
Detect calls to buffer with noAssert flag set.
|
|
11359
11386
|
|
|
11360
|
-
From the Node.js API docs: "Setting noAssert to true skips validation of the offset.
|
|
11387
|
+
From the Node.js API docs: "Setting noAssert to true skips validation of the offset.
|
|
11388
|
+
This allows the offset to be beyond the end of the Buffer."
|
|
11361
11389
|
|
|
11362
11390
|
<https://github.com/nodesecurity/eslint-plugin-security#detect-buffer-noassert>
|
|
11363
11391
|
|
|
@@ -11593,7 +11621,7 @@ const s3 = require('aws-cdk-lib/aws-s3');
|
|
|
11593
11621
|
const bucket = new s3.Bucket(this, 'example'); // Sensitive
|
|
11594
11622
|
```
|
|
11595
11623
|
|
|
11596
|
-
### Security Encrypt
|
|
11624
|
+
### Security Encrypt Access
|
|
11597
11625
|
|
|
11598
11626
|
----------
|
|
11599
11627
|
|
|
@@ -11617,7 +11645,6 @@ new s3.Bucket(this, 'id', {
|
|
|
11617
11645
|
blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL
|
|
11618
11646
|
});
|
|
11619
11647
|
|
|
11620
|
-
|
|
11621
11648
|
new s3.Bucket(this, 'id', {
|
|
11622
11649
|
blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
|
|
11623
11650
|
encryption: s3.BucketEncryption.KMS_MANAGED
|
|
@@ -11698,7 +11725,8 @@ web application in case of malicious activities.
|
|
|
11698
11725
|
const { Signale } = require('signale');
|
|
11699
11726
|
|
|
11700
11727
|
const CREDIT_CARD_NUMBERS = fetchFromWebForm()
|
|
11701
|
-
// here we suppose the credit card numbers are retrieved somewhere and CREDIT_CARD_NUMBERS looks like
|
|
11728
|
+
// here we suppose the credit card numbers are retrieved somewhere and CREDIT_CARD_NUMBERS looks like
|
|
11729
|
+
// ["1234-5678-0000-9999", "1234-5678-0000-8888"]; for instance
|
|
11702
11730
|
|
|
11703
11731
|
const options = {
|
|
11704
11732
|
secrets: ["([0-9]{4}-?)+"]
|
|
@@ -11717,7 +11745,8 @@ CREDIT_CARD_NUMBERS.forEach(function(CREDIT_CARD_NUMBER) {
|
|
|
11717
11745
|
const { Signale } = require('signale');
|
|
11718
11746
|
|
|
11719
11747
|
const CREDIT_CARD_NUMBERS = fetchFromWebForm()
|
|
11720
|
-
// here we suppose the credit card numbers are retrieved somewhere and CREDIT_CARD_NUMBERS looks like
|
|
11748
|
+
// here we suppose the credit card numbers are retrieved somewhere and CREDIT_CARD_NUMBERS looks like
|
|
11749
|
+
// ["1234-5678-0000-9999", "1234-5678-0000-8888"]; for instance
|
|
11721
11750
|
|
|
11722
11751
|
const options = {
|
|
11723
11752
|
secrets: [] // empty list of secrets
|
|
@@ -11785,7 +11814,8 @@ let urlencodedParser = bodyParser.urlencoded({ extended: false, limit: "4mb" });
|
|
|
11785
11814
|
----------
|
|
11786
11815
|
|
|
11787
11816
|
The trick is to use Unicode control characters to reorder tokens in source code at the encoding level.
|
|
11788
|
-
These visually reordered tokens can be used to display logic that, while semantically correct,
|
|
11817
|
+
These visually reordered tokens can be used to display logic that, while semantically correct,
|
|
11818
|
+
diverges from the logic presented by the logical ordering of source code tokens.
|
|
11789
11819
|
|
|
11790
11820
|
<https://trojansource.codes/>
|
|
11791
11821
|
<https://github.com/lirantal/eslint-plugin-anti-trojan-source>
|
|
@@ -12210,8 +12240,13 @@ by default using operating system commands like ls.
|
|
|
12210
12240
|
```typescript
|
|
12211
12241
|
let serveStatic = require("serve-static");
|
|
12212
12242
|
let app = express();
|
|
12213
|
-
|
|
12214
|
-
let
|
|
12243
|
+
// Compliant: ignore or deny are recommended values
|
|
12244
|
+
let serveStaticMiddleware = serveStatic('public', { 'index': false, 'dotfiles': 'ignore'});
|
|
12245
|
+
|
|
12246
|
+
// Compliant: by default, "dotfiles" (file or directory that begins with a dot) are not served
|
|
12247
|
+
// (with the exception that files within a directory that begins with a dot are not ignored),
|
|
12248
|
+
// see serve-static module documentation
|
|
12249
|
+
let serveStaticDefault = serveStatic('public', { 'index': false});
|
|
12215
12250
|
app.use(serveStaticMiddleware);
|
|
12216
12251
|
```
|
|
12217
12252
|
|
|
@@ -12826,9 +12861,11 @@ jwt.verify(token, key, { expiresIn: 360000 * 5, algorithms: ['HS256'] }, callbac
|
|
|
12826
12861
|
```typescript
|
|
12827
12862
|
const jwt = require('jsonwebtoken');
|
|
12828
12863
|
|
|
12829
|
-
|
|
12864
|
+
// Noncompliant: 'none' cipher doesn't sign the JWT (no signature will be included)
|
|
12865
|
+
let token = jwt.sign({ foo: 'bar' }, key, { algorithm: 'none' });
|
|
12830
12866
|
|
|
12831
|
-
|
|
12867
|
+
// Noncompliant: 'none' cipher should not be used when verifying JWT signature
|
|
12868
|
+
jwt.verify(token, key, { expiresIn: 360000 * 5, algorithms: ['RS256', 'none'] }, callbackcheck);
|
|
12832
12869
|
```
|
|
12833
12870
|
|
|
12834
12871
|
### No Hardcoded Credentials
|
|
@@ -13199,7 +13236,8 @@ const net = require('net');
|
|
|
13199
13236
|
var socket = new net.Socket(); // Sensitive
|
|
13200
13237
|
socket.connect(80, 'google.com');
|
|
13201
13238
|
|
|
13202
|
-
// net.createConnection creates a new net.Socket, initiates connection with socket.connect(),
|
|
13239
|
+
// net.createConnection creates a new net.Socket, initiates connection with socket.connect(),
|
|
13240
|
+
// then returns the net.Socket that starts the connection
|
|
13203
13241
|
net.createConnection({ port: port }, () => {}); // Sensitive
|
|
13204
13242
|
|
|
13205
13243
|
// net.connect is an alias to net.createConnection
|
|
@@ -13211,7 +13249,7 @@ net.connect({ port: port }, () => {}); // Sensitive
|
|
|
13211
13249
|
----------
|
|
13212
13250
|
|
|
13213
13251
|
MIME confusion attacks occur when an attacker successfully tricks a web-browser to interpret a resource as a different
|
|
13214
|
-
type than the one expected. To correctly interpret a resource (script, image, stylesheet
|
|
13252
|
+
type than the one expected. To correctly interpret a resource (script, image, stylesheet ...) web browsers look for the
|
|
13215
13253
|
Content-Type header defined in the HTTP response received from the server, but often this header is not set or is
|
|
13216
13254
|
set with an incorrect value. To avoid content-type mismatch and to provide the best user experience, web browsers try
|
|
13217
13255
|
to deduce the right content-type, generally by inspecting the content of the resources (the first bytes).
|
|
@@ -13260,11 +13298,11 @@ Each certificate in the chain is not expired.
|
|
|
13260
13298
|
|
|
13261
13299
|
```typescript
|
|
13262
13300
|
let options = {
|
|
13263
|
-
|
|
13264
|
-
|
|
13265
|
-
|
|
13266
|
-
|
|
13267
|
-
|
|
13301
|
+
hostname: "www.example.com",
|
|
13302
|
+
port: 443,
|
|
13303
|
+
path: "/",
|
|
13304
|
+
method: "GET",
|
|
13305
|
+
secureProtocol: "TLSv1_2_method",
|
|
13268
13306
|
};
|
|
13269
13307
|
|
|
13270
13308
|
let req = https.request(options, (res) => {
|
|
@@ -15662,7 +15700,8 @@ const isEqualsNum = 1 + foo.num! == 2;
|
|
|
15662
15700
|
|
|
15663
15701
|
----------
|
|
15664
15702
|
|
|
15665
|
-
The ! non-null assertion operator in TypeScript is used to assert that a value's
|
|
15703
|
+
The ! non-null assertion operator in TypeScript is used to assert that a value's
|
|
15704
|
+
type does not include null or undefined.
|
|
15666
15705
|
|
|
15667
15706
|
<https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/docs/rules/no-extra-non-null-assertion.md>
|
|
15668
15707
|
|
|
@@ -17222,7 +17261,8 @@ import baz from './baz' // no default export found in ./baz
|
|
|
17222
17261
|
|
|
17223
17262
|
----------
|
|
17224
17263
|
|
|
17225
|
-
Ensures an imported module can be resolved to a module on the local filesystem,
|
|
17264
|
+
Ensures an imported module can be resolved to a module on the local filesystem,
|
|
17265
|
+
as defined by standard Node require.resolve behavior.
|
|
17226
17266
|
|
|
17227
17267
|
<https://github.com/import-js/eslint-plugin-import/blob/HEAD/docs/rules/no-unresolved.md>
|
|
17228
17268
|
|
|
@@ -17640,7 +17680,6 @@ var a = { ['x']: 0 };
|
|
|
17640
17680
|
var a = { ['x']() {} };
|
|
17641
17681
|
```
|
|
17642
17682
|
|
|
17643
|
-
|
|
17644
17683
|
### Useless Call Code
|
|
17645
17684
|
|
|
17646
17685
|
----------
|
|
@@ -18128,7 +18167,8 @@ str.toUpperCase(); // Noncompliant
|
|
|
18128
18167
|
----------
|
|
18129
18168
|
|
|
18130
18169
|
There are situations where super() must be invoked and situations where super() cannot be invoked.
|
|
18131
|
-
The basic rule is: a constructor in a non-derived class cannot invoke super();
|
|
18170
|
+
The basic rule is: a constructor in a non-derived class cannot invoke super();
|
|
18171
|
+
a constructor in a derived class must invoke super().
|
|
18132
18172
|
|
|
18133
18173
|
Furthermore:
|
|
18134
18174
|
super() must be invoked before the this and super keywords can be used.
|
|
@@ -18163,7 +18203,6 @@ class Dog extends Animal {
|
|
|
18163
18203
|
}
|
|
18164
18204
|
```
|
|
18165
18205
|
|
|
18166
|
-
|
|
18167
18206
|
### No Useless Intersection
|
|
18168
18207
|
|
|
18169
18208
|
----------
|
|
@@ -18237,7 +18276,8 @@ datePattern.test('2020-08-06');
|
|
|
18237
18276
|
datePattern.test('2019-10-10'); // Noncompliant: the regex will return "false" despite the date being well-formed
|
|
18238
18277
|
|
|
18239
18278
|
const str = 'foodie fooled football';
|
|
18240
|
-
|
|
18279
|
+
// Noncompliant: a regex is defined at each iteration causing an infinite loop
|
|
18280
|
+
while ((result = /foo*/g.exec(str)) !== null) {
|
|
18241
18281
|
/* ... */
|
|
18242
18282
|
}
|
|
18243
18283
|
|
|
@@ -19386,8 +19426,9 @@ import 'some-other-module';
|
|
|
19386
19426
|
|
|
19387
19427
|
JavaScript will call toString() on an object when it is converted to a string,
|
|
19388
19428
|
such as when + adding to a string or in ${} template literals. The default Object .toString() returns "[object Object]",
|
|
19389
|
-
|
|
19390
|
-
|
|
19429
|
+
which is often not what was intended.
|
|
19430
|
+
This rule reports on values used in a template literal string that aren't strings.
|
|
19431
|
+
primitives and don't define a more useful .toString() method.
|
|
19391
19432
|
|
|
19392
19433
|
<https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/docs/rules/restrict-template-expressions.md>
|
|
19393
19434
|
|
|
@@ -19607,7 +19648,10 @@ switch (day) {
|
|
|
19607
19648
|
|
|
19608
19649
|
----------
|
|
19609
19650
|
|
|
19610
|
-
Most checks against an indexOf call against an array compare it with -1 because 0 is a valid index.
|
|
19651
|
+
Most checks against an indexOf call against an array compare it with -1 because 0 is a valid index.
|
|
19652
|
+
Any checks which look for values >0 ignore the first element, which is likely a bug.
|
|
19653
|
+
If you’re merely checking the presence of the element, consider using includes instead.
|
|
19654
|
+
Before using includes method make sure that your browser version is supporting it.
|
|
19611
19655
|
|
|
19612
19656
|
<https://sonarsource.github.io/rspec/#/rspec/S2692/javascript>
|
|
19613
19657
|
|
package/package.json
CHANGED
|
@@ -21,7 +21,10 @@ module.exports = {
|
|
|
21
21
|
"jsdoc/empty-tags": [ "error" ], // Não devem existir tags vazias
|
|
22
22
|
"jsdoc/implements-on-classes": [ "error" ],
|
|
23
23
|
"jsdoc/multiline-blocks": [ "error" ], // Valida mútilos blocos
|
|
24
|
-
"jsdoc/
|
|
24
|
+
"jsdoc/tag-lines": [ "error", "any", {
|
|
25
|
+
startLines: 1,
|
|
26
|
+
endLines: 0,
|
|
27
|
+
} ], // Requer linha em branco apos a descrição
|
|
25
28
|
"jsdoc/no-bad-blocks": [ "error" ], // DockBlock deve ter apenas 2 asteriscos
|
|
26
29
|
"jsdoc/no-multi-asterisks": [
|
|
27
30
|
"error",
|
|
@@ -50,158 +53,167 @@ module.exports = {
|
|
|
50
53
|
"error",
|
|
51
54
|
{
|
|
52
55
|
"tagSequence": [
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
143
|
-
|
|
144
|
-
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
|
|
150
|
-
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
|
|
162
|
-
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
|
|
169
|
-
|
|
170
|
-
|
|
171
|
-
|
|
172
|
-
|
|
173
|
-
|
|
174
|
-
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
180
|
-
|
|
181
|
-
|
|
182
|
-
|
|
183
|
-
|
|
184
|
-
|
|
185
|
-
|
|
186
|
-
|
|
187
|
-
|
|
188
|
-
|
|
189
|
-
|
|
190
|
-
|
|
191
|
-
|
|
192
|
-
|
|
193
|
-
|
|
194
|
-
|
|
195
|
-
|
|
196
|
-
|
|
197
|
-
|
|
198
|
-
|
|
199
|
-
|
|
200
|
-
|
|
201
|
-
|
|
202
|
-
|
|
203
|
-
|
|
204
|
-
|
|
56
|
+
{
|
|
57
|
+
"tags": [
|
|
58
|
+
"author",
|
|
59
|
+
"message",
|
|
60
|
+
"task",
|
|
61
|
+
"example",
|
|
62
|
+
],
|
|
63
|
+
},
|
|
64
|
+
|
|
65
|
+
{
|
|
66
|
+
"tags": [
|
|
67
|
+
"ignore",
|
|
68
|
+
"version",
|
|
69
|
+
"variation",
|
|
70
|
+
"since",
|
|
71
|
+
"deprecated",
|
|
72
|
+
"todo",
|
|
73
|
+
|
|
74
|
+
"summary",
|
|
75
|
+
"typeSummary",
|
|
76
|
+
|
|
77
|
+
// Module/file-level
|
|
78
|
+
"module",
|
|
79
|
+
"exports",
|
|
80
|
+
"file",
|
|
81
|
+
"fileoverview",
|
|
82
|
+
"overview",
|
|
83
|
+
|
|
84
|
+
// Identifying (name, type)
|
|
85
|
+
"typedef",
|
|
86
|
+
"interface",
|
|
87
|
+
"record",
|
|
88
|
+
"template",
|
|
89
|
+
"name",
|
|
90
|
+
"kind",
|
|
91
|
+
"type",
|
|
92
|
+
"alias",
|
|
93
|
+
"external",
|
|
94
|
+
"host",
|
|
95
|
+
"callback",
|
|
96
|
+
"func",
|
|
97
|
+
"function",
|
|
98
|
+
"method",
|
|
99
|
+
"class",
|
|
100
|
+
"constructor",
|
|
101
|
+
|
|
102
|
+
// Relationships
|
|
103
|
+
"modifies",
|
|
104
|
+
"mixes",
|
|
105
|
+
"mixin",
|
|
106
|
+
"mixinClass",
|
|
107
|
+
"mixinFunction",
|
|
108
|
+
"namespace",
|
|
109
|
+
"borrows",
|
|
110
|
+
"constructs",
|
|
111
|
+
"lends",
|
|
112
|
+
"implements",
|
|
113
|
+
"requires",
|
|
114
|
+
|
|
115
|
+
// Long descriptions
|
|
116
|
+
"desc",
|
|
117
|
+
"description",
|
|
118
|
+
"classdesc",
|
|
119
|
+
"tutorial",
|
|
120
|
+
"copyright",
|
|
121
|
+
"license",
|
|
122
|
+
|
|
123
|
+
// Simple annotations
|
|
124
|
+
"const",
|
|
125
|
+
"constant",
|
|
126
|
+
"final",
|
|
127
|
+
"global",
|
|
128
|
+
"readonly",
|
|
129
|
+
"abstract",
|
|
130
|
+
"virtual",
|
|
131
|
+
"var",
|
|
132
|
+
"member",
|
|
133
|
+
"memberof",
|
|
134
|
+
"memberof!",
|
|
135
|
+
"inner",
|
|
136
|
+
"instance",
|
|
137
|
+
"inheritdoc",
|
|
138
|
+
"inheritDoc",
|
|
139
|
+
"override",
|
|
140
|
+
"hideconstructor",
|
|
141
|
+
|
|
142
|
+
// Important behavior details
|
|
143
|
+
"async",
|
|
144
|
+
"generator",
|
|
145
|
+
"default",
|
|
146
|
+
"defaultvalue",
|
|
147
|
+
"enum",
|
|
148
|
+
"augments",
|
|
149
|
+
"extends",
|
|
150
|
+
"exception",
|
|
151
|
+
"yield",
|
|
152
|
+
"yields",
|
|
153
|
+
"event",
|
|
154
|
+
"fires",
|
|
155
|
+
"emits",
|
|
156
|
+
"listens",
|
|
157
|
+
"this",
|
|
158
|
+
|
|
159
|
+
// Access
|
|
160
|
+
"static",
|
|
161
|
+
"public",
|
|
162
|
+
"protected",
|
|
163
|
+
"private",
|
|
164
|
+
"access",
|
|
165
|
+
"package",
|
|
166
|
+
|
|
167
|
+
"-other",
|
|
168
|
+
|
|
169
|
+
// Supplementary descriptions
|
|
170
|
+
"see",
|
|
171
|
+
|
|
172
|
+
// METADATA
|
|
173
|
+
|
|
174
|
+
// Other Closure (undocumented) metadata
|
|
175
|
+
"closurePrimitive",
|
|
176
|
+
"customElement",
|
|
177
|
+
"expose",
|
|
178
|
+
"hidden",
|
|
179
|
+
"idGenerator",
|
|
180
|
+
"meaning",
|
|
181
|
+
"ngInject",
|
|
182
|
+
"owner",
|
|
183
|
+
"wizaction",
|
|
184
|
+
|
|
185
|
+
// Other Closure (documented) metadata
|
|
186
|
+
"define",
|
|
187
|
+
"dict",
|
|
188
|
+
"export",
|
|
189
|
+
"externs",
|
|
190
|
+
"implicitCast",
|
|
191
|
+
"noalias",
|
|
192
|
+
"nocollapse",
|
|
193
|
+
"nocompile",
|
|
194
|
+
"noinline",
|
|
195
|
+
"nosideeffects",
|
|
196
|
+
"polymer",
|
|
197
|
+
"polymerBehavior",
|
|
198
|
+
"preserve",
|
|
199
|
+
"struct",
|
|
200
|
+
"suppress",
|
|
201
|
+
"unrestricted",
|
|
202
|
+
|
|
203
|
+
// @homer0/prettier-plugin-jsdoc metadata
|
|
204
|
+
"category",
|
|
205
|
+
|
|
206
|
+
// Core function/object info
|
|
207
|
+
"arg",
|
|
208
|
+
"argument",
|
|
209
|
+
"prop",
|
|
210
|
+
"property",
|
|
211
|
+
"param",
|
|
212
|
+
"throws",
|
|
213
|
+
"return",
|
|
214
|
+
"returns",
|
|
215
|
+
],
|
|
216
|
+
},
|
|
205
217
|
],
|
|
206
218
|
},
|
|
207
219
|
], // Ordem dos params da docblock
|