
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
eslint-traverser
Advanced tools
A utility that helps traverse code the way ESLint does. This allows you to test any utilities you write for ESLint rules.
npm install eslint-traverser
The module exposes a function that gets code and an optional config
object, and gets a traverser, with a get
function.
The get
function calls the callback for every node
of the type, with node
and context
parameters,
which are the same as the ones in ESLint itself.
const traverse = require('eslint-traverser')
traverse('var y = f(x)')
.get('CallExpression', (node, context) => {
console.log(node.callee.name) //logs `f`
sourceCode = context.getSourceCode()
//...
})
You can define a configuration to run your traversal (globals, settings, etc) in an additional parameter in the call to traverser
.
You may not use the rules
key in this configuration.
const traverse = require('eslint-traverser')
traverse('import foo from "bar"', {parserOptions: {sourceType: module}})
.get('Program:exit', (node, context) => {
console.log('Modules!')
})
As a shortcut, you can pass only the parserOptions object, and if your config only contains parserOptions keys, it will work normally.
const traverse = require('eslint-traverser')
traverse('import foo from "bar"', {sourceType: module})
.get('Program:exit', (node, context) => {
console.log('Modules!')
})
You can also filter results using a selector, which can be a function or any of the iteratees supplied by Lodash
const traverse = require('eslint-traverser')
traverse('f(); g(x)')
.get('CallExpression', node => node.arguments.length, (node, context) => {
console.log(node.callee.name) //logs `g`
//...
})
traverse('f(); g(x)')
.get('CallExpression', 'arguments.length', node => {
console.log(node.callee.name) //logs `g`
//...
})
traverse('f(); g(x)')
.get('CallExpression', ['arguments.length', 0], node => {
console.log(node.callee.name) //logs `f`
//...
})
traverse('f(); g(x)')
.get('CallExpression', {callee: {name: 'g'}}, node => {
console.log(node.callee.name) //logs `g`
//...
})
first
methodThe first
method is the same as the get
method, except it only calls the callback on the first result, while get
calls it on all the results
const traverse = require('eslint-traverser')
traverse('f(); g()')
.get('CallExpression', node => {
console.log(node.callee.name)
})
// f
// g
traverse('f(); g()')
.first('CallExpression', node => {
console.log(node.callee.name)
})
// f
visitAll
methodThe visitAll
method gets two arguments: first, an optional visitors
object in the same structure as an ESLint rule visitor object.
The second is a callback, that gets called at the end of the code traversal with two arguments: the Program
node and the context.
const traverse = require('eslint-traverser')
traverse('var y = f(x)')
.visitAll((node, context) => {
console.log(node.type) //Program
})
traverse('var y = f(x)')
.visitAll({
CallExpression(node) { console.log('Call expression!')}
}, () => { console.log('finished!')})
// Call expression!
// finished!
runRuleCode
methodThe runRuleCode
method gets one argument: the rule. This runs an ESLint rule (a function that gets a context and returns a visitors object) on the specified code.
const traverse = require('eslint-traverser')
traverse('var y = f(x)')
.runRuleCode(context => ({
CallExpression(node) { console.log('Call expression!')}
}))
// Call expression!
FAQs
A utility that helps traverse code the way ESLint does
The npm package eslint-traverser receives a total of 763 weekly downloads. As such, eslint-traverser popularity was classified as not popular.
We found that eslint-traverser demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.