|
3 | 3 | hints: [ |
4 | 4 | { |
5 | 5 | present: String.raw`exec \(`, |
6 | | - text: "The `exec` function is vulnerable to command injection. Replace it with `execFile` to improve security." |
| 6 | + text: "The `exec` function is vulnerable to command injection. Replace it with `execFile` to improve security.", |
7 | 7 | }, |
8 | 8 | { |
9 | 9 | absent: String.raw`^[\n\r]*\s*execFile\s*\(`, |
10 | | - text: "Use the `execFile` function instead of `exec` to avoid shell interpretation. Your line should start with `execFile(`." |
| 10 | + text: "Use the `execFile` function instead of `exec` to avoid shell interpretation. Your line should start with `execFile(`.", |
11 | 11 | }, |
12 | 12 | { |
13 | 13 | absent: String.raw`execFile\s*\(\s*['"${BACKQUOTE}]git['"${BACKQUOTE}]\s*,`, |
14 | | - text: "Separate the command and its arguments. The first argument to `execFile` should be the command 'git' without any of the command arguments." |
| 14 | + text: "Separate the command and its arguments. The first argument to `execFile` should be the command 'git' without any of the command arguments.", |
15 | 15 | }, |
16 | 16 | { |
17 | 17 | present: String.raw`['"${BACKQUOTE}]git\x20blame['"${BACKQUOTE}]`, |
18 | | - text: "Separate the command and its arguments. The first argument to `execFile` should be the command 'git', followed by an array with parameters, like this: `execFile('git', ['blame', ...])`." |
| 18 | + text: "Separate the command and its arguments. The first argument to `execFile` should be the command 'git', followed by an array with parameters, like this: `execFile('git', ['blame', ...])`.", |
19 | 19 | }, |
20 | 20 | { |
21 | 21 | absent: String.raw`\[ ['"${BACKQUOTE}]blame`, |
22 | | - text: "Pass the arguments as an array, like this: `execFile('git', ['blame', ...])`." |
| 22 | + text: "Pass the arguments as an array, like this: `execFile('git', ['blame', ...])`.", |
23 | 23 | }, |
24 | 24 | { |
25 | 25 | present: "--", |
26 | 26 | absent: String.raw`['"${BACKQUOTE}]--['"${BACKQUOTE}]`, |
27 | | - text: "To pass `--` you need to pass it as a literal string. Typically this is notated as `'--'` or `\"--\"`." |
| 27 | + text: "To pass `--` you need to pass it as a literal string. Typically this is notated as `'--'` or `\"--\"`.", |
28 | 28 | }, |
29 | 29 | { |
30 | 30 | absent: String.raw`\[ ['"${BACKQUOTE}]blame['"${BACKQUOTE}] , ['"${BACKQUOTE}]--['"${BACKQUOTE}] ,`, |
31 | | - text: "Pass the arguments as an array. Include '--' before the file path to prevent argument injection. Your array should look like `['blame', '--', ...`." |
| 31 | + text: "Pass the arguments as an array. Include '--' before the file path to prevent argument injection. Your array should look like `['blame', '--', ...`.", |
32 | 32 | }, |
33 | 33 | { |
34 | 34 | present: String.raw`['"${BACKQUOTE}]filePath['"${BACKQUOTE}]`, |
35 | | - text: "`filePath` is a variable, use it directly without using quote marks." |
| 35 | + text: "`filePath` is a variable, use it directly without using quote marks.", |
36 | 36 | }, |
37 | 37 | { |
38 | 38 | present: String.raw`['"]\$\{filePath\}['"]`, |
39 | | - text: "`filePath` is a variable, use it directly without using quote marks." |
| 39 | + text: "`filePath` is a variable, use it directly without using quote marks.", |
40 | 40 | }, |
41 | 41 | { |
42 | 42 | present: String.raw`${BACKQUOTE}\$\{filePath\}${BACKQUOTE}`, |
43 | | - text: "Strictly speaking, using a backquoted template with a single reference to a variable name works. In this case, it's being done to `filePath`. However, this is unnecessarily complicated. When you want to simply refer to a variable's value, use the variable name." |
| 43 | + text: "Strictly speaking, using a backquoted template with a single reference to a variable name works. In this case, it's being done to `filePath`. However, this is unnecessarily complicated. When you want to simply refer to a variable's value, use the variable name.", |
44 | 44 | }, |
45 | 45 | { |
46 | 46 | absent: String.raw`\[ ['"${BACKQUOTE}]blame['"${BACKQUOTE}] , ['"${BACKQUOTE}]--['"${BACKQUOTE}] , filePath \]`, |
47 | | - text: "Pass the arguments as an array. Include '--' before the file path to prevent argument injection. Your array should look like `['blame', '--', filePath]`." |
| 47 | + text: "Pass the arguments as an array. Include '--' before the file path to prevent argument injection. Your array should look like `['blame', '--', filePath]`.", |
48 | 48 | }, |
49 | 49 | { |
50 | 50 | present: "shell = [fF]alse", |
51 | | - text: "When passing options to execFile, you need an option with the options, and those use `:` not `=`. So you should say something like: `{shell: false}`." |
| 51 | + text: "When passing options to execFile, you need an option with the options, and those use `:` not `=`. So you should say something like: `{shell: false}`.", |
52 | 52 | }, |
53 | 53 | { |
54 | 54 | present: "[F]alse", |
55 | | - text: "JavaScript is case-sensitive. The false value is spelled as `false` and not `False`." |
| 55 | + text: "JavaScript is case-sensitive. The false value is spelled as `false` and not `False`.", |
56 | 56 | }, |
57 | 57 | { |
58 | 58 | absent: String.raw`\{ shell : false \}`, |
59 | 59 | present: "shell : false", |
60 | | - text: "When passing options to execFile, you must provide those options as a JavaScript object. That means you must surround them with `{...}` like this: `{shell: false}`." |
| 60 | + text: "When passing options to execFile, you must provide those options as a JavaScript object. That means you must surround them with `{...}` like this: `{shell: false}`.", |
61 | 61 | }, |
62 | 62 | { |
63 | 63 | absent: String.raw`\{ shell : false \}`, |
64 | | - text: "We encourage you to explicitly set `shell: false` in the options object to prevent shell interpretation. That is something like this: `execFile('git', ['blame', '--', filePath], { shell: false }, ...`" |
| 64 | + text: "We encourage you to explicitly set `shell: false` in the options object to prevent shell interpretation. That is something like this: `execFile('git', ['blame', '--', filePath], { shell: false }, ...`", |
65 | 65 | }, |
66 | 66 | { |
67 | 67 | absent: String.raw`\(\s*[a-zA-Z_$][a-zA-Z0-9_$]*\s*,\s*[a-zA-Z_$][a-zA-Z0-9_$]*\s*,\s*[a-zA-Z_$][a-zA-Z0-9_$]*\s*\)\s*=>`, |
68 | | - text: "Maintain the callback function structure with three parameters (typically named error, stdout, and stderr, but any valid variable names are acceptable)." |
| 68 | + text: "Maintain the callback function structure with three parameters (typically named error, stdout, and stderr, but any valid variable names are acceptable).", |
69 | 69 | }, |
70 | 70 | { |
71 | 71 | present: String.raw`\) \) =>`, |
72 | | - text: "The `exec` function should be closed in later lines, not here." |
| 72 | + text: "The `exec` function should be closed in later lines, not here.", |
73 | 73 | }, |
74 | 74 | ], |
75 | 75 | expected: [ |
|
0 commit comments