Skip to content

eslint security spike #31887

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 6 commits into
base: 25_2
Choose a base branch
from
Open

eslint security spike #31887

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
4b71625
eslint security spike
zabelin-vladimir Nov 28, 2025
2534e31
change runner to devextreme-shr2
zabelin-vladimir Dec 1, 2025
67d3cc9
move powershell to bash
zabelin-vladimir Dec 1, 2025
ca20b5a
fix teargets
zabelin-vladimir Dec 1, 2025
ca06a1d
fix bash command
zabelin-vladimir Dec 1, 2025
647d3fc
try to move to default github runner
zabelin-vladimir Dec 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/eslint/.npmrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
@devexpress:registry=https://npm.pkg.github.com
//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}
always-auth=true
Empty file added .github/eslint/ignore-security.txt
View file
Open in desktop
Empty file.
32 changes: 32 additions & 0 deletions .github/eslint/only-problems-html.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
export default function(results, _context) {
const esc = (s) => String(s).replace(/[&<>"']/g, m => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[m]));
Comment on lines +1 to +2
Copy link

Copilot AI Dec 1, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The HTML escape function doesn't handle all potential XSS vectors. While basic HTML entities are escaped, consider using a well-tested library or ensuring all user-controlled data (file paths, messages, rule IDs) are properly escaped. The current implementation is adequate for the basic cases but could be more robust.

Suggested change
export default function(results, _context) {
const esc = (s) => String(s).replace(/[&<>"']/g, m => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[m]));
import escapeHtml from 'escape-html';
export default function(results, _context) {
const esc = escapeHtml;

Copilot uses AI. Check for mistakes.
const rel = (p) => p.replace(process.cwd().replace(/\\/g,'/'), '').replace(/^[/\\]/, '').replace(/\\/g,'/');

const bad = results.filter(r => r.errorCount || r.warningCount);
const totalErrors = bad.reduce((a, r) => a + r.errorCount, 0);
const totalWarnings = bad.reduce((a, r) => a + r.warningCount, 0);

const sections = bad.map(r => {
const file = rel(r.filePath);
const items = r.messages.map(m => {
const sev = m.severity === 2 ? 'error' : 'warning';
const pos = `${m.line ?? 0}:${m.column ?? 0}`;
return `<li class="${sev}"><span class="sev">${sev}</span> <code>${esc(m.ruleId ?? 'parser')}</code> — ${esc(m.message)} <span class="pos">(${esc(file)}:${pos})</span></li>`;
}).join('');
return `<section><h3>${esc(file)} — ${r.errorCount} error(s), ${r.warningCount} warning(s)</h3><ul>${items}</ul></section>`;
}).join('');

const html = `<!doctype html><meta charset="utf-8"><title>ESLint report</title>
<style>
body{font:14px/1.45 system-ui,Segoe UI,Arial,sans-serif;margin:24px;max-width:1200px}
h1{margin:0 0 12px}h3{margin:16px 0 8px}
code{background:#f6f6f6;padding:0 4px;border-radius:4px}
section{padding:12px 14px;border:1px solid #eee;border-radius:10px;margin:12px 0;border-radius:10px}
ul{margin:0 0 0 18px} li{margin:4px 0} .sev{display:inline-block;min-width:60px}
.error .sev{color:#b00020;font-weight:600} .warning .sev{color:#aa7a00;font-weight:600} .pos{opacity:.7}
</style>
<h1>ESLint report</h1>
<p>Files with issues: <b>${bad.length}</b> | Errors: <b>${totalErrors}</b> | Warnings: <b>${totalWarnings}</b></p>
${bad.length ? sections : '<p>No problems found.</p>'}`;
return html;
}
Loading
Loading