
Security News
New Python Packaging Proposal Aims to Solve Phantom Dependency Problem with SBOMs
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
eslint-config-sonar
Advanced tools
eslint configuration to ensure SonarJS rules are met, following the 'Sonar way' preset.
npm install eslint-config-sonar --save-dev
Then add the following to your .eslintrc:
{
"extends": [
"sonar",
]
}
This package is in development. The intention is for it to eventually include:
PRs are welcomed and I'd also encourage @SonarSource to take over ownership of this.
Initially I am only aiming to include those listed in the Sonar way preset, rather than every rule supported by SonarJS, purely because this is the preset I'm currently using.
Where I have found an equivalent in eslint, it has been listed here and included in the config.
Where no equivalent is listed, it is listed in the next section and has not yet been implemented in the eslint config.
no-delete-var
eslint throws a parsing error in strict mode.
use-isnan
constructor-super
no-this-before-super
no-new-symbol
no-with
eslint throws a parsing error in strict mode.
eslint throws a parsing error:
Parsing error: yield is a reserved word (Fatal)
for-direction
sonarjs/no-all-duplicated-branches
no-const-assign
no-bitwise
array-callback-return
sonarjs/no-element-overwrite
Partially covered by no-sequences
.
no-empty-pattern
no-dupe-args
eslint throws a parsing error in strict mode.
Parsing error: Argument name clash in strict mode (Fatal)
sonarjs/no-extra-arguments
require-yield
Partially covered by no-self-compare
.
sonarjs/no-identical-expressions
no-unreachable
no-unsafe-finally
Partially covered by no-unreachable
.
no-unused-expressions
space-unary-ops
space-infix-ops
no-dupe-keys
sonarjs/no-identical-conditions
no-unsafe-negation
eslint throws a parsing error in strict mode:
Parsing error: eval is a reserved word in strict mode (Fatal)
sonarjs/no-use-of-empty-return-value
no-self-assign
sonarjs/no-useless-catch
All of these are picked up as parsing errors when in strict mode.
sonarjs/no-small-switch
no-restricted-syntax
no-labels
sonarjs/max-switch-cases
sonarjs/prefer-while
sonarjs/no-inverted-boolean-check
Partial coverage from no-constant-condition
no-sequences
no-unused-vars
filenames/match-exported
no-extra-semi
no-unexpected-multiline
Partial coverage with new-cap
.
no-loop-func
Partial coverage with no-continue
.
no-restricted-syntax
no-labels
no-multi-str
no-empty
eslint will throw a parsing error (Invalid number)
sonarjs/prefer-single-boolean-return
no-fallthrough
sonarjs/no-duplicated-branches
no-unused-vars
no-redeclare
no-undef
no-new-wrappers
no-alert
no-wildcard-postmessage
from eslint-plugin-no-wildcard-postmessage
no-debugger
Please open an issue if you know of an equivalent eslint rule.
FAQs
eslint configuration to ensure SonarJS rules are met
The npm package eslint-config-sonar receives a total of 50 weekly downloads. As such, eslint-config-sonar popularity was classified as not popular.
We found that eslint-config-sonar demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Security News
Socket CEO Feross Aboukhadijeh discusses open source security challenges, including zero-day attacks and supply chain risks, on the Cyber Security Council podcast.
Security News
Research
Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.