mirror of
https://github.com/elastic/kibana.git
synced 2025-04-24 17:59:23 -04:00
74d88580a5
## Summary This PR has breadth, but not depth. This adds 3 new `eslint` rules. The first two protect against the use of code generated from strings (`eval` and friends), which will not work client-side due to our CSP, and is not something we wish to support server-side. The last rule aims to prevent a subtle class of bugs, and to defend against a subset of prototype pollution exploits: - `no-new-func` to be compliant with our CSP, and to prevent code execution from strings server-side: https://eslint.org/docs/latest/rules/no-new-func - `no-implied-eval` to be compliant with our CSP, and to prevent code execution from strings server-side: https://eslint.org/docs/latest/rules/no-implied-eval. Note that this function implies that it prevents no-new-func, but I don't see [test cases](https://github.com/eslint/eslint/blob/main/tests/lib/rules/no-implied-eval.js) covering this behavior, so I think we should play it safe and enable both rules. - `no-prototype-builtins` to prevent accessing shadowed properties: https://eslint.org/docs/latest/rules/no-prototype-builtins In order to be compliant with `no-prototype-builtins`, I've migrated all usages and variants of `Object.hasOwnProperty` to use the newer [`Object.hasOwn`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/hasOwn). |
||
|---|---|---|
| .. | ||
| annotation_service | ||
| bucket_span_estimator | ||
| calculate_model_memory_limit | ||
| calendar | ||
| data_frame_analytics | ||
| data_recognizer | ||
| data_visualizer | ||
| fields_service | ||
| filter | ||
| job_audit_messages | ||
| job_service | ||
| job_validation | ||
| model_management | ||
| notifications_service | ||
| results_service | ||