|
6 | 6 | hints: [ |
7 | 7 | { |
8 | 8 | present: String.raw`exec \(`, |
9 | | - text: "The `exec` function is vulnerable to command injection. Replace it with `execFile` to improve security." |
| 9 | + text: "The `exec` function is vulnerable to command injection. Replace it with `execFile` to improve security.", |
10 | 10 | }, |
11 | 11 | { |
12 | 12 | absent: String.raw`^[\n\r]*\s*execFile\s*\(`, |
13 | | - text: "Use the `execFile` function instead of `exec` to avoid shell interpretation. Your line should start with `execFile(`." |
| 13 | + text: "Use the `execFile` function instead of `exec` to avoid shell interpretation. Your line should start with `execFile(`.", |
14 | 14 | }, |
15 | 15 | { |
16 | 16 | absent: String.raw`execFile\s*\(\s*['"${BACKQUOTE}]git['"${BACKQUOTE}]\s*,`, |
17 | | - text: "Separate the command and its arguments. The first argument to `execFile` should be the command 'git' without any of the command arguments." |
| 17 | + text: "Separate the command and its arguments. The first argument to `execFile` should be the command 'git' without any of the command arguments.", |
18 | 18 | }, |
19 | 19 | { |
20 | 20 | present: String.raw`['"${BACKQUOTE}]git\x20blame['"${BACKQUOTE}]`, |
21 | | - text: "Separate the command and its arguments. The first argument to `execFile` should be the command 'git', followed by an array with parameters, like this: `execFile('git', ['blame', ...])`." |
| 21 | + text: "Separate the command and its arguments. The first argument to `execFile` should be the command 'git', followed by an array with parameters, like this: `execFile('git', ['blame', ...])`.", |
22 | 22 | }, |
23 | 23 | { |
24 | 24 | absent: String.raw`\[ ['"${BACKQUOTE}]blame`, |
25 | | - text: "Pass the arguments as an array, like this: `execFile('git', ['blame', ...])`." |
| 25 | + text: "Pass the arguments as an array, like this: `execFile('git', ['blame', ...])`.", |
26 | 26 | }, |
27 | 27 | { |
28 | 28 | present: "--", |
29 | 29 | absent: String.raw`['"${BACKQUOTE}]--['"${BACKQUOTE}]`, |
30 | | - text: "To pass `--` you need to pass it as a literal string. Typically this is notated as `'--'` or `\"--\"`." |
| 30 | + text: "To pass `--` you need to pass it as a literal string. Typically this is notated as `'--'` or `\"--\"`.", |
31 | 31 | }, |
32 | 32 | { |
33 | 33 | absent: String.raw`\[ ['"${BACKQUOTE}]blame['"${BACKQUOTE}] , ['"${BACKQUOTE}]--['"${BACKQUOTE}] ,`, |
34 | | - text: "Pass the arguments as an array. Include '--' before the file path to prevent argument injection. Your array should look like `['blame', '--', ...`." |
| 34 | + text: "Pass the arguments as an array. Include '--' before the file path to prevent argument injection. Your array should look like `['blame', '--', ...`.", |
35 | 35 | }, |
36 | 36 | { |
37 | 37 | present: String.raw`['"${BACKQUOTE}]filePath['"${BACKQUOTE}]`, |
38 | | - text: "`filePath` is a variable, use it directly without using quote marks." |
| 38 | + text: "`filePath` is a variable, use it directly without using quote marks.", |
39 | 39 | }, |
40 | 40 | { |
41 | 41 | present: String.raw`['"]\$\{filePath\}['"]`, |
42 | | - text: "`filePath` is a variable, use it directly without using quote marks." |
| 42 | + text: "`filePath` is a variable, use it directly without using quote marks.", |
43 | 43 | }, |
44 | 44 | { |
45 | 45 | present: String.raw`${BACKQUOTE}\$\{filePath\}${BACKQUOTE}`, |
46 | | - text: "Strictly speaking, using a backquoted template with a single reference to a variable name works. In this case, it's being done to `filePath`. However, this is unnecessarily complicated. When you want to simply refer to a variable's value, use the variable name." |
| 46 | + text: "Strictly speaking, using a backquoted template with a single reference to a variable name works. In this case, it's being done to `filePath`. However, this is unnecessarily complicated. When you want to simply refer to a variable's value, use the variable name.", |
47 | 47 | }, |
48 | 48 | { |
49 | 49 | absent: String.raw`\[ ['"${BACKQUOTE}]blame['"${BACKQUOTE}] , ['"${BACKQUOTE}]--['"${BACKQUOTE}] , filePath \]`, |
50 | | - text: "Pass the arguments as an array. Include '--' before the file path to prevent argument injection. Your array should look like `['blame', '--', filePath]`." |
| 50 | + text: "Pass the arguments as an array. Include '--' before the file path to prevent argument injection. Your array should look like `['blame', '--', filePath]`.", |
51 | 51 | }, |
52 | 52 | { |
53 | 53 | present: "shell = [fF]alse", |
54 | | - text: "When passing options to execFile, you need an option with the options, and those use `:` not `=`. So you should say something like: `{shell: false}`." |
| 54 | + text: "When passing options to execFile, you need an option with the options, and those use `:` not `=`. So you should say something like: `{shell: false}`.", |
55 | 55 | }, |
56 | 56 | { |
57 | 57 | present: "[F]alse", |
58 | | - text: "JavaScript is case-sensitive. The false value is spelled as `false` and not `False`." |
| 58 | + text: "JavaScript is case-sensitive. The false value is spelled as `false` and not `False`.", |
59 | 59 | }, |
60 | 60 | { |
61 | 61 | absent: String.raw`\{ shell : false \}`, |
62 | 62 | present: "shell : false", |
63 | | - text: "When passing options to execFile, you must provide those options as a JavaScript object. That means you must surround them with `{...}` like this: `{shell: false}`." |
| 63 | + text: "When passing options to execFile, you must provide those options as a JavaScript object. That means you must surround them with `{...}` like this: `{shell: false}`.", |
64 | 64 | }, |
65 | 65 | { |
66 | 66 | absent: String.raw`\{ shell : false \}`, |
67 | | - text: "We encourage you to explicitly set `shell: false` in the options object to prevent shell interpretation. That is something like this: `execFile('git', ['blame', '--', filePath], { shell: false }, ...`" |
| 67 | + text: "We encourage you to explicitly set `shell: false` in the options object to prevent shell interpretation. That is something like this: `execFile('git', ['blame', '--', filePath], { shell: false }, ...`", |
68 | 68 | }, |
69 | 69 | { |
70 | 70 | absent: String.raw`\(\s*[a-zA-Z_$][a-zA-Z0-9_$]*\s*,\s*[a-zA-Z_$][a-zA-Z0-9_$]*\s*,\s*[a-zA-Z_$][a-zA-Z0-9_$]*\s*\)\s*=>`, |
71 | | - text: "Maintain the callback function structure with three parameters (typically named error, stdout, and stderr, but any valid variable names are acceptable)." |
| 71 | + text: "Maintain the callback function structure with three parameters (typically named error, stdout, and stderr, but any valid variable names are acceptable).", |
72 | 72 | }, |
73 | 73 | { |
74 | 74 | present: String.raw`\) \) =>`, |
75 | | - text: "The `exec` function should be closed in later lines, not here." |
| 75 | + text: "The `exec` function should be closed in later lines, not here.", |
76 | 76 | }, |
77 | 77 | ], |
78 | 78 | expected: [ |
|
0 commit comments