1786290 - Use microsoft/sdl/no-insecure-url instead of github:mozfreddyb/eslint-plugin-sdl...

Status: RESOLVED FIXED

(Core :: DOM: Security, task, P3)

Description

[Tomer Yavor]

In package.json we should use microsoft/sdl/no-insecure-url.
For that reason we need to complete the PR to microsoft/sdl/rules:
https://github.com/microsoft/eslint-plugin-sdl/pull/39#issuecomment-1214966408

Comment 1

[Frederik Braun [:freddy]]

Believe it or not, upstream took our changes and we can switch from my fork and use the real deal.
Malte, is this something you would be willing to explore?

The idea is to look at the patch from https://bugzilla.mozilla.org/show_bug.cgi?id=1709150 and switch from the mozfreddyb-fork of the repo to the official Microsoft version.

Comment 2

[Mark Banner (:standard8)]

(In reply to Frederik Braun [:freddy] from comment #1)

The idea is to look at the patch from https://bugzilla.mozilla.org/show_bug.cgi?id=1709150 and switch from the mozfreddyb-fork of the repo to the official Microsoft version.

It looks like that hasn't been released yet, should we ask them for a new minor release so we can switch back to a specific version?

Comment 3

[Frederik Braun [:freddy]]

Done. https://github.com/microsoft/eslint-plugin-sdl/issues/47

Comment 4

[Malte Jürgens [:maltejur]]

(In reply to Frederik Braun [:freddy] from comment #1)

Malte, is this something you would be willing to explore?

Sure, I'll do as soon as they release a new version. We could also already switch to using their master branch directly, however I am not sure if that brings any benefit over what we are currently doing.

Comment 5

[Frederik Braun [:freddy]]

Using their unversioned development branch seems a bit risky (even though they don't appear to be making a lot of changes right now :)).
I think we need to wait further, I somehow forgot that them merging the code still doesn't mean we can use it. Let's continue when they have published a release..

Comment 6

[Malte Jürgens [:maltejur]]

You could probably lock it at a certain commit like it is already done currently, but I would also just say we wait a bit until they create a new release.

Comment 7

[Malte Jürgens [:maltejur]]

It seems v0.2.2 is out now, and includes the relevant changes. I'll create a patch updating to that version.

Comment 8

[Malte Jürgens [:maltejur]]

Attachment: Bug 1786290 - Update @microsoft/eslint-plugin-sdl to version 0.2.2 r=freddyb,standard8

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/86da25fdbc81
Update @microsoft/eslint-plugin-sdl to version 0.2.2 r=freddyb,Standard8

Comment 10

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/86da25fdbc81