chore: adopt Oxlint for JS/TS semantics; keep Biome for format/non-JS (#321) #371
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| --- | ||
| "@open-slide/core": patch | ||
| --- | ||
|
|
||
| Fix lint findings uncovered by Oxlint (floating promises, hook deps, a11y labels). | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,49 @@ | ||
| { | ||
| "$schema": "./node_modules/oxlint/configuration_schema.json", | ||
| "plugins": ["typescript", "unicorn", "react", "import", "vitest", "jsx-a11y"], | ||
| "categories": { | ||
| "correctness": "error" | ||
| }, | ||
| "env": { | ||
| "builtin": true | ||
| }, | ||
| "settings": { | ||
| "react": { | ||
| "version": "19.2.7" | ||
| } | ||
| }, | ||
| "ignorePatterns": [ | ||
| "**/dist/**", | ||
| "**/node_modules/**", | ||
| "**/*.tsbuildinfo", | ||
| "packages/core/src/app/components/ui/**", | ||
| "packages/cli/template/**" | ||
| ], | ||
| "rules": { | ||
| "import/no-cycle": "error", | ||
| "typescript/no-floating-promises": "error", | ||
| "jsx-a11y/prefer-tag-over-role": "off", | ||
| "vitest/expect-expect": [ | ||
| "error", | ||
| { | ||
| "assertFunctionNames": [ | ||
| "expect", | ||
| "expectTypeOf", | ||
| "assert", | ||
| "expectTagged", | ||
| "expectTaggedTransform" | ||
| ] | ||
| } | ||
| ] | ||
| }, | ||
| "overrides": [ | ||
| { | ||
| "files": ["**/slides/**", "apps/web/components/landing/**"], | ||
| "rules": { | ||
| "jsx-a11y/no-static-element-interactions": "off", | ||
| "jsx-a11y/no-noninteractive-element-interactions": "off", | ||
| "jsx-a11y/prefer-tag-over-role": "off" | ||
| } | ||
|
Comment on lines
+41
to
+46
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== oxlintrc context =="
if [ -f .oxlintrc.json ]; then
nl -ba .oxlintrc.json | sed -n '1,120p'
fi
echo
echo "== matching files count =="
# Use git ls-files to inspect tracked matching paths, not filesystem only.
git ls-files | awk '
/\/slides\// {a++}
/^apps\/web\/components\/landing\// {b++}
END {print "slides_tree:", a+0; print "landing_tree:", b+0}
'
echo
echo "== specific rule occurrences in matching tracked files =="
python3 - <<'PY'
import subprocess
import pathlib,textwrap
files = subprocess.check_output(["git","ls-files"], text=True).splitlines()
slides=[]
landing=[]
for f in files:
if "/slides/" in f:
slides.append(f)
elif f.startswith("apps/web/components/landing/"):
landing.append(f)
patterns=[
'setAsDropZones',
'dropZone',
'isDropZone',
'asset',
'files',
'onDrop',
'onDragOver',
'onDragEnter',
'onClick',
'interactions',
]
for p in patterns:
hits=[]
for f in slides+landing:
try:
data=pathlib.Path(f).read_text(encoding="utf-8", errors="ignore")
except Exception:
continue
if p in data:
hits.append(f"{f}:{data.count(p)}")
if hits:
print(f"\n[{p}] count={len(hits)}")
for h in hits[:50]:
print(" " + h)
if len(hits)>50:
print(f" ... and {len(hits)-50} more")
PY
echo
echo "== direct usages outside matching trees =="
python3 - <<'PY'
import subprocess,pathlib
files = subprocess.check_output(["git","ls-files"], text=True).splitlines()
terms=['setAsDropZones','dropZone','isDropZone']
for term in terms:
hits=[]
for f in files:
if pathlib.PurePath(f).is_absolute():
continue
try:
data=pathlib.Path(f).read_text(encoding="utf-8", errors="ignore")
except Exception:
continue
if term in data:
hits.append(f)
print(f"{term}: {len(hits)}")
for h in hits[:80]:
print(" ", h)
if len(hits)>80:
print(f" ... and {len(hits)-80} more")
PYRepository: 1weiho/open-slide Length of output: 218 🏁 Script executed: #!/bin/bash
set -u
echo "== oxlintrc context =="
if [ -f .oxlintrc.json ]; then
awk '{printf "%6d %s\n", NR, $0}' .oxlintrc.json | sed -n '1,120p'
fi
echo
echo "== matching tracked files count =="
git ls-files | awk '
/\/slides\// {a++}
/^apps\/web\/components\/landing\// {b++}
END {print "slides_tree:", a+0; print "landing_tree:", b+0}
'
echo
echo "== relevant symbol occurrences in matching tracked files =="
python3 - <<'PY'
import subprocess, pathlib
files = subprocess.check_output(["git","ls-files"], text=True).splitlines()
slides=[f for f in files if "/slides/" in f]
landing=[f for f in files if f.startswith("apps/web/components/landing/")]
patterns=[
'setAsDropZones',
'dropZone',
'isDropZone',
'drop z',
'onDrop',
'onDragOver',
'onDragEnter',
'setDropZones',
]
for p in patterns:
hits=[]
for f in slides+landing:
try:
data=pathlib.Path(f).read_text(encoding="utf-8", errors="ignore")
except Exception:
continue
if p in data:
hits.append((f, data.count(p)))
hits.sort(key=lambda x:x[1], reverse=True)
if hits:
print(f"\n[{p}] count={len(hits)}")
for f, n in hits[:40]:
print(f" {f}: {n}")
if len(hits)>40:
print(f" ... and {len(hits)-40} more")
PY
echo
echo "== targeted drop-zone symbol occurrences outside matching trees =="
python3 - <<'PY'
import subprocess, pathlib
files = subprocess.check_output(["git","ls-files"], text=True).splitlines()
terms=['setAsDropZones','dropZone','isDropZone','setDropZones']
matcher=lambda f: "/slides/" in f or f.startswith("apps/web/components/landing/")
for term in terms:
in_tree=[]
out_tree=[]
for f in files:
try:
data=pathlib.Path(f).read_text(encoding="utf-8", errors="ignore")
except Exception:
continue
if term in data:
(out_tree if not matcher(f) else in_tree).append(f)
print(f"{term}: in_tree={len(in_tree)}, out_tree={len(out_tree)}")
for f in out_tree[:80]:
print(" ", f)
PY
echo
echo "== rule occurrences outside .oxlintrc.json =="
if command -v rg >/dev/null 2>&1; then
rg -n 'no-static-element-interactions|no-noninteractive-element-interactions|prefer-tag-over-role|files.*slides|components/landing' -g '!node_modules' . | sed -n '1,160p'
else
grep -RInE 'no-static-element-interactions|no-noninteractive-element-interactions|prefer-tag-over-role|slide|landing' . | sed -n '1,160p'
fiRepository: 1weiho/open-slide Length of output: 7228 Narrow the accessibility override to the actual drop-zone files. These tree-level overrides affect every tracked file under both patterns ( 🤖 Prompt for AI Agents |
||
| } | ||
| ] | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -28,30 +28,9 @@ | |
| }, | ||
| "overrides": [ | ||
| { | ||
| "includes": ["**/*.{js,jsx,ts,tsx,mjs,cjs,mts,cts}", "**/*.d.ts"], | ||
| "linter": { | ||
| "enabled": false | ||
|
Comment on lines
+31
to
+33
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf 'Files matching biome/oxlint/config scripts:\n'
git ls-files | rg '(^|/)(biome\.json|oxlint|oxlint\.json|eslint\.config|package\.json|pnpm-lock\.yaml|biome\.jsonc|\.oxlintrc)' || true
printf '\nbiome.json (if present):\n'
if [ -f biome.json ]; then
nl -ba biome.json | sed -n '1,220p'
fi
printf '\nOxlint/config related files content snippets:\n'
for f in $(git ls-files | rg '(^|/)(oxlint|\.oxlintrc|eslint\.config|package\.json)$'); do
printf '\n--- %s ---\n' "$f"
nl -ba "$f" | sed -n '1,220p'
done
printf '\nSearch security/relevant rule names:\n'
rg -n "noDangerouslySetInnerHtml|noDangerouslySetInnerHtmlWithChildren|noGlobalEval|dangerouslySetInnerHTML|global.*eval|no.*eval|dangerous|oxlint|lint" -S . --glob '!node_modules' --glob '!dist' --glob '!build' | sed -n '1,240p'Repository: 1weiho/open-slide Length of output: 524 🌐 Web query:
💡 Result: Biome provides several security-focused lint rules designed to prevent vulnerabilities related to arbitrary code execution and Cross-Site Scripting (XSS), including the following: noDangerouslySetInnerHtml: This rule (lint/security/noDangerouslySetInnerHtml) prevents the use of the dangerouslySetInnerHTML prop in React, which can expose users to XSS attacks by injecting unescaped HTML [1][2]. It is enabled by default and set to error severity [1]. noGlobalEval: This rule (lint/security/noGlobalEval) prohibits the use of global eval, which evaluates strings as JavaScript code [3]. This is considered a security risk because it allows for arbitrary code execution if the input is untrusted, and it also negatively impacts performance by preventing JavaScript engine optimizations [3]. Additional related security rules include: - noDangerouslySetInnerHtmlWithChildren: Reports when an element uses both children and dangerouslySetInnerHTML simultaneously [4][5]. - noScriptUrl: Disallows the use of javascript: URLs in HTML (e.g., in href attributes), as they act as a form of eval and can lead to XSS [6]. - noImpliedEval: A nursery rule (currently unstable) that flags eval-like methods such as using setTimeout, setInterval, or the Function constructor with string arguments [7]. These rules are part of Biome's focus on identifying patterns that lead to security vulnerabilities and performance issues, favoring safer alternatives like direct function references or standard JSX rendering [1][3][7]. Citations:
🏁 Script executed: #!/bin/bash
set -euo pipefail
printf 'biome.json excerpt:\n'
awk '{printf "%6d\t%s\n", NR, $0}' biome.json | sed -n '1,120p'
printf '\n.oxlintrc.json:\n'
awk '{printf "%6d\t%s\n", NR, $0}' .oxlintrc.json | sed -n '1,220p'
printf '\nRelevant rule/config mentions:\n'
for f in biometxt=".biome.json" || true; do
true
done
rg -n "noDangerouslySetInnerHtml|noDangerouslySetInnerHtmlWithChildren|noGlobalEval|noUndocumentedGlobals|dangerouslySetInnerHTML|dangerous|eval|allowComments|noScriptUrl|noImpliedEval|noDangerous|dangerous" -S .biome.json biome.json .oxlintrc.json package.json 2>/dev/null || true
printf '\nPackage scripts:\n'
python3 - <<'PY'
import json, pathlib
for p in ["package.json", ".oxlintrc.json", "biome.json"]:
if pathlib.Path(p).exists():
print(f"\n--- {p} ---")
data=json.loads(pathlib.Path(p).read_text())
if p=="package.json":
print(json.dumps({"scripts": data.get("scripts", {})}, indent=2)[:2000])
else:
print(json.dumps(data, indent=2)[:3000])
PYRepository: 1weiho/open-slide Length of output: 3299 Preserve Biome’s JS/TS security checks or add equivalent Oxlint rules. The JS/TS override disables Biome security rules such as 🤖 Prompt for AI Agents |
||
| } | ||
| } | ||
| ], | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.