
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
eslint-plugin-moxio
Advanced tools
Custom rules for ESLint, as used at Moxio.
This library can be installed from the NPM package registry. You'll first need to install ESLint:
npm install --save-dev eslint
Next, install eslint-plugin-moxio
:
npm install --save-dev eslint-plugin-moxio
You can also use Yarn; replace npm install --save-dev
by yarn add --dev
in that case.
Note: If you installed ESLint globally (using the -g
flag) then you must also install
eslint-plugin-moxio
globally.
This plugin is meant to be used with ESLint. Add moxio
to the plugins
section of your .eslintrc
configuration file.
You can omit the eslint-plugin-
prefix:
{
"plugins": [
"moxio"
]
}
Then configure the rules you want to use under the rules
-key. See the next section for available
rules and their options.
{
"rules": {
"moxio/rule1": "error",
"moxio/rule2": [ "warning", {
"configProp": "value"
} ]
}
}
Rule that restricts certain CSS classes so that they may only be referenced from a given set of allowed files. This includes:
<div className={"$"} />
const x = [ $ ];
css_classes.push($);
const obj = {$: true};
const obj = { "class": $ };
These rules are also applied to template strings.
The cssClasses
configuration property is an object with the restricted CSS classes as keys, and
an array of file path patterns (regular expressions) in which that CSS class may be used as the
values. Windows file paths will automatically be normalized to use /
directory separators before
matching them against the patterns, so those can be configured using only /
as a directory separator.
As an example, the following rule enforces that the foo
CSS class may only be used in any javascript
file, or in the dir/Foo.tsx
file.
{
"rules": {
"moxio/restrict-css-class-usage-to-files": [
"error",
{
"cssClasses": {
"foo": [
"/(.*)\\.js$",
"/dir/Foo\\.tsx$"
]
}
}
]
}
}
This plugin is mainly useful to enforce the use of standardized components in a design system.
For example, if you have a button in your design system with CSS class acme-button
and a standardized
implementation of that button as a React or Vue component, you probably don't want people to make their
own custom implementations of acme-button
. For such cases you could limit usage of the acme-button
CSS class to only e.g. /components/Button.tsx
or /components/Button.vue
. Of course, this only
works if your CSS classes are specific enough.
Rule that warns if React.createRef() is used in a function component, instead of the preferred useRef hook.
{
"rules": {
"moxio/prefer-useref-function-components": "warn",
}
}
This plugin is mainly useful when switching from class components to function components.
Rule that can restrict importing certain identifiers from a source.
For example, you could warn if somebody tries to import Difference
from the js-struct-compare
package.
{
"rules": {
"moxio/restrict-import-from-source": [
"warn",
{
"sources": {
"js-struct-compare": {
"identifiers": [
"Difference"
],
"message": "{{ identifier }} on {{ source }} has been restricted"
}
}
}
]
}
}
We use this plugin ourselves when we use a library but want to prevent certain imports from it that have unexpected side effects.
Rule that restricts using dom-retrieval methods ("querySelector", "querySelectorAll", "getElementsByTagName", "getElementsByTagNameNS", "getElementsByClassName", "getElementById") from document.
{
"rules": {
"moxio/restrict-dome-node-retrieval": "warn"
}
}
We use this rule ourselves to prevent direct dom manipulation in our React projects: https://react.dev/learn/manipulating-the-dom-with-refs
This project adheres to Semantic Versioning.
Contributions to this project are more than welcome.
This project is released under the MIT license.
Made with love, coffee and fun by the Moxio team from Delft, The Netherlands. Interested in joining our awesome team? Check out our vacancies (in Dutch).
FAQs
Custom rules for ESLint as used at Moxio
We found that eslint-plugin-moxio demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.