eslint security spike #31887

zabelin-vladimir · 2025-11-28T16:04:02Z

No description provided.

Copilot

Pull request overview

This PR introduces a new GitHub Actions workflow to run ESLint security scanning on the DevExtreme monorepo. The workflow is designed to scan JavaScript and TypeScript files for security vulnerabilities using a custom ESLint security configuration (@devexpress/eslint-security-config). The scan runs on pull requests and can be manually triggered, generating an HTML report as an artifact.

Key changes:

New workflow file that runs security-focused ESLint rules
Isolated ESLint configuration in .github/eslint/ with its own dependencies
Custom HTML formatter for security scan results
Configuration to use private package registry for @devexpress/eslint-security-config

Reviewed changes

Copilot reviewed 6 out of 8 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
`.github/workflows/eslint-security.yml`	Main workflow definition that triggers on PR changes to JS/TS files; runs ESLint with security rules and uploads HTML report
`.github/eslint/security.config.mjs`	ESLint configuration that applies security rules, disables inline config in CI, and loads ignore patterns
`.github/eslint/package.json`	Isolated npm package with ESLint 9.x, TypeScript-ESLint 8.x, and custom security config as dependencies
`.github/eslint/package-lock.json`	Lockfile for the isolated ESLint environment ensuring reproducible builds
`.github/eslint/only-problems-html.mjs`	Custom ESLint formatter that generates an HTML report showing only files with security issues
`.github/eslint/targets.txt`	Specifies which files/directories to scan (currently set to `**` - all files)
`.github/eslint/ignore-security.txt`	Empty file for defining paths to exclude from security scanning
`.github/eslint/.npmrc`	Configuration for authenticating with GitHub Packages to access private security config

Copilot · 2025-11-28T16:14:36Z

.github/eslint/security.config.mjs

+	ignores: [
+		'**/node_modules/**',
+		...extraIgnores,
+	],  


Trailing whitespace detected after the closing brace on line 26. This should be removed for consistency and to avoid linting issues.

Suggested change

],

],

Copilot · 2025-11-28T16:14:36Z

.github/workflows/eslint-security.yml

+  workflow_dispatch:
+  pull_request:
+    paths:
+      - '.github/eslint/**'      


Trailing whitespace detected after .github/eslint/**. This should be removed for consistency.

Suggested change

- '.github/eslint/**'

- '.github/eslint/**'

Copilot · 2025-11-28T16:14:36Z

.github/workflows/eslint-security.yml

+      - '.github/eslint/**'      
+      - '**/*.ts'
+      - '**/*.js'
+


The workflow is missing the concurrency configuration that is present in other workflows like lint.yml. Without this, multiple runs of this security scan could execute simultaneously on the same PR, wasting resources. Consider adding:

concurrency: group: wf-${{github.event.pull_request.number || github.sha}}-${{github.workflow}} cancel-in-progress: true

Suggested change

concurrency:

group: wf-${{github.event.pull_request.number || github.sha}}-${{github.workflow}}

cancel-in-progress: true

Copilot · 2025-11-28T16:14:37Z

.github/workflows/eslint-security.yml

+          cache: npm
+          cache-dependency-path: .github/eslint/package-lock.json


Using cache: npm when the repository uses pnpm is incorrect. Other workflows in this repository use pnpm with proper caching setup (see lint.yml). This should use pnpm's action-setup and cache the pnpm store directory instead:

- uses: pnpm/action-setup@v4 with: run_install: false - name: Get pnpm store directory shell: bash run: | echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV - uses: actions/cache@v4 name: Setup pnpm cache with: path: ${{ env.STORE_PATH }} key: ${{ runner.os }}-pnpm-store-${{ hashFiles('.github/eslint/package-lock.json') }}

Copilot · 2025-11-28T16:14:37Z

.github/workflows/eslint-security.yml

+      VM_MEMORY: 18144
+      VM_CPU: 16
+      SECURITY_LINT: "1"
+    runs-on: farm


Using runs-on: farm is inconsistent with other workflows in this repository which use devextreme-shr2 as the runner. This should be aligned with the repository's standard runner configuration for consistency and to ensure the appropriate environment is used.

Suggested change

runs-on: farm

runs-on: devextreme-shr2

Copilot · 2025-11-28T16:14:37Z

.github/eslint/targets.txt

@@ -0,0 +1 @@
+**


Targeting ** will scan the entire repository including node_modules, build artifacts, test files, and other directories that shouldn't be security linted. This will cause extremely long execution times and produce irrelevant results. You should specify only the source code directories that need security scanning, such as:

packages/*/js/** packages/*/src/** apps/*/src/**

Additionally, consider excluding test files and build artifacts explicitly.

Suggested change

**

# Include only relevant source code directories for linting/scanning

packages/*/js/**

packages/*/src/**

apps/*/src/**

# Exclude test files and build artifacts

!**/test*/**

!**/tests/**

!**/testing/**

!**/build/**

!**/artifacts/**

!**/dist/**

!**/node_modules/**

Copilot · 2025-11-28T16:14:38Z

.github/eslint/security.config.mjs

+	ignores: [
+		'**/node_modules/**',
+		...extraIgnores,
+	],  


Inconsistent indentation: lines 23-26 use tabs while the rest of the file uses spaces. This should be consistent throughout the file.

Suggested change

ignores: [

'**/node_modules/**',

...extraIgnores,

],

ignores: [

'**/node_modules/**',

...extraIgnores,

],

Copilot · 2025-11-28T16:14:38Z

.github/eslint/package.json

+  "private": true,
+  "type": "module",
+  "devDependencies": {
+	"@devexpress/eslint-security-config": "^0.1.0",


Inconsistent indentation: line 6 uses tabs while lines 7-10 use spaces. This should be consistent throughout the file.

Suggested change

"@devexpress/eslint-security-config": "^0.1.0",

"@devexpress/eslint-security-config": "^0.1.0",

Copilot

Pull request overview

Copilot reviewed 6 out of 8 changed files in this pull request and generated 3 comments.

Copilot · 2025-12-01T13:50:27Z

.github/workflows/eslint-security.yml

+          mapfile -t TARGETS < <(
+            sed 's/^[[:space:]]*//;s/[[:space:]]*$//' .github/eslint/targets.txt \
+            | grep -vE '^\s*#' \
+            | sed '/^\s*$/d'
+          )


The mapfile command is Bash 4+ specific and may not be available on all systems. Consider adding a shebang #!/usr/bin/env bash at the start of the script or using a more portable approach with while read loop for better compatibility.

Copilot · 2025-12-01T13:50:28Z

.github/eslint/only-problems-html.mjs

+export default function(results, _context) {
+  const esc = (s) => String(s).replace(/[&<>"']/g, m => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[m]));


The HTML escape function doesn't handle all potential XSS vectors. While basic HTML entities are escaped, consider using a well-tested library or ensuring all user-controlled data (file paths, messages, rule IDs) are properly escaped. The current implementation is adequate for the basic cases but could be more robust.

Suggested change

export default function(results, _context) {

const esc = (s) => String(s).replace(/[&<>"']/g, m => ({'&':'&','<':'<','>':'>','"':'"',"'":'''}[m]));

import escapeHtml from 'escape-html';

export default function(results, _context) {

const esc = escapeHtml;

Copilot · 2025-12-01T13:50:28Z

.github/workflows/eslint-security.yml

+          cache: npm
+          cache-dependency-path: .github/eslint/package-lock.json
+
+      - name: Install security lint dependencies
+        working-directory: .github/eslint
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          npm ci


The cache strategy should use pnpm instead of npm to match the repository's package manager. According to the repository guidelines, DevExtreme uses pnpm 9.15.4 as its package manager.

Suggested change

cache: npm

cache-dependency-path: .github/eslint/package-lock.json

- name: Install security lint dependencies

working-directory: .github/eslint

env:

NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

run: |

npm ci

cache: pnpm

cache-dependency-path: pnpm-lock.yaml

- name: Install security lint dependencies

working-directory: .github/eslint

env:

NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

run: |

pnpm install --frozen-lockfile

Copilot

Pull request overview

Copilot reviewed 6 out of 8 changed files in this pull request and generated 1 comment.

Copilot · 2025-12-01T14:21:40Z

.github/workflows/eslint-security.yml

+          code=$?
+          set -e
+
+          code=$?


Redundant variable assignment. Line 60 captures the exit code after set +e, but line 63 reassigns code=$? after set -e, which will always be 0 (the exit code of the successful set -e command itself). Remove line 63 to preserve the ESLint exit code.

Suggested change

code=$?

eslint security spike

4b71625

zabelin-vladimir requested a review from a team as a code owner November 28, 2025 16:04

Copilot AI review requested due to automatic review settings November 28, 2025 16:04

Copilot started reviewing on behalf of zabelin-vladimir November 28, 2025 16:04 View session

Copilot finished reviewing on behalf of zabelin-vladimir November 28, 2025 16:06

Copilot AI reviewed Nov 28, 2025

View reviewed changes

zabelin-vladimir added 2 commits December 1, 2025 17:22

change runner to devextreme-shr2

2534e31

move powershell to bash

67d3cc9

Copilot AI review requested due to automatic review settings December 1, 2025 13:40

Copilot started reviewing on behalf of zabelin-vladimir December 1, 2025 13:40 View session

Copilot finished reviewing on behalf of zabelin-vladimir December 1, 2025 13:41

Copilot AI reviewed Dec 1, 2025

View reviewed changes

zabelin-vladimir added 2 commits December 1, 2025 17:58

fix teargets

ca20b5a

fix bash command

ca06a1d

Copilot AI review requested due to automatic review settings December 1, 2025 14:11

Copilot started reviewing on behalf of zabelin-vladimir December 1, 2025 14:12 View session

Copilot finished reviewing on behalf of zabelin-vladimir December 1, 2025 14:12

Copilot AI reviewed Dec 1, 2025

View reviewed changes

try to move to default github runner

647d3fc

+concurrency:
+  group: wf-${{github.event.pull_request.number || github.sha}}-${{github.workflow}}
+  cancel-in-progress: true

		cache: npm
		cache-dependency-path: .github/eslint/package-lock.json

-**
+# Include only relevant source code directories for linting/scanning
+packages/*/js/**
+packages/*/src/**
+apps/*/src/**
+# Exclude test files and build artifacts
+!**/test*/**
+!**/tests/**
+!**/testing/**
+!**/build/**
+!**/artifacts/**
+!**/dist/**
+!**/node_modules/**

	"@devexpress/eslint-security-config": "^0.1.0",
	"@devexpress/eslint-security-config": "^0.1.0",

		export default function(results, _context) {
		const esc = (s) => String(s).replace(/[&<>"']/g, m => ({'&':'&','<':'<','>':'>','"':'"',"'":'''}[m]));

+                        code=$?
+                        set -e
+                        code=$?

		@@ -0,0 +1 @@
		** No newline at end of file

eslint security spike #31887

Are you sure you want to change the base?

eslint security spike #31887

Conversation

zabelin-vladimir commented Nov 28, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Dec 1, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 1, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 1, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Dec 1, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant