Detect unsafe regexes.
This plugin is not intended for use with your typical eslint runs. It uses the eslint framework to identify the files you care about and to have easy access to an AST from which to extract regexes.
It does work with as part of a regular eslint configuration. However, it will be slow the first few times eslint is triggered until the local cache warms up.
So, how should you use it?
I suggest adding this line to the
scripts section of your
"test:regex": "eslint --plugin vuln-regex-detector --rule '\"vuln-regex-detector/no-vuln-regex\": 2' FILES_YOU_CARE_ABOUT",
Then when you run
npm run test:regex, you'll run your existing eslint rules plus identify vulnerable regexes in your code.
This is appropriate for use in your CI.
You should re-use your existing eslint invocation (see the
lint line in your
You might want to restrict the files you care about, since e.g. vulnerable regexes in
test/ are probably not an issue.
The vuln-regex-detector module lets users specify the server hostname and port, as well as the local cache.
Invoke eslint with
Invoke eslint with
From an AWS micro instance, it takes about 30 seconds to scan a project with 100 regexes.
This plugin relies on vuln-regex-detector which queries a remote server about regexes. Once the server gives a firm response (it might say "unknown" for a few minutes), it gets cached locally in the FS. So after a few uses on the same machine, the plugin's performance will improve. The improvement will be significant if you have many regexes.
You'll first need to install ESLint:
$ npm i eslint --save-dev
$ npm install eslint-plugin-vuln-regex-detector --save-dev
Note: If you installed ESLint globally (using the
-g flag) then you must also install
If you want to use it in every eslint run, update your
.eslintrc configuration file as follows:
- Update plugins.
- Update rules.
no-vuln-regex: Identify vulnerable regexes in your code.