Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Add wildcard pattern support for core modules#3200

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Open
andymai wants to merge6 commits intoimport-js:main
base:main
Choose a base branch
Loading
fromandymai:andy/wildcard-core-modules

Conversation

andymai
Copy link

@andymaiandymai commentedJul 18, 2025
edited
Loading

Summary

Addresses:#1281

  • Add support for wildcard patterns inimport/core-modules setting
  • Allow* to match multiple modules like@my-monorepo/* or@my-*/*
  • Update documentation with examples of wildcard usage

Changes

  • Modifiedsrc/core/importType.js to support wildcard pattern matching
  • Added comprehensive test cases for wildcard patterns
  • Updated README.md with wildcard pattern examples

Test plan

  • All existing tests pass
  • Added tests for basic wildcard patterns (@my-monorepo/*)
  • Added tests for multiple wildcard patterns (@my-*/*)
  • Added tests for mixed exact matches and wildcards
  • Added tests for resources inside wildcard core modules
  • Updated no-extraneous-dependencies rule tests

Add support for wildcard patterns in import/core-modules setting, allowing* to match multiple modules like @my-monorepo/* or@My-*/*.🤖 Generated with [Claude Code](https://claude.ai/code)Co-Authored-By: Claude <noreply@anthropic.com>
@andymaiandymai marked this pull request as draftJuly 18, 2025 19:45
Prevent '*' pattern from matching all modules, which would disabledependency analysis and create security vulnerabilities.- Add safety check for bare wildcard patterns- Add comprehensive test coverage for security edge cases- Ensure valid wildcard patterns still work correctly
Enhance security validation to catch a broader range of dangerouswildcard patterns that could disable dependency analysis:- Block double wildcards (**)- Block overly broad patterns (*/*)- Block regex-style wildcards (.*)- Block patterns that are too short and broad (a*, *a)- Block multiple wildcards except for valid @namespace/* patterns- Add comprehensive test coverage for all dangerous patterns- Maintain support for legitimate use casesThis prevents accidental or malicious disabling of ESLint'sdependency analysis while preserving intended functionality.
Allow legitimate multi-wildcard patterns like@My-*/* while stillblocking dangerous patterns:- Allow @namespace/* patterns (including@My-*/* style patterns)- Block dangerous patterns like *foo*, foo*bar*, */*/*- Fix regex escaping issue- Update comprehensive test coverage- All 2996 tests now pass
@codecovCodecov
Copy link

codecovbot commentedJul 18, 2025
edited
Loading

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 95.63%. Comparing base(01c9eb0) to head(425f040).

Additional details and impacted files
@@             Coverage Diff             @@##             main    #3200       +/-   ##===========================================+ Coverage   82.25%   95.63%   +13.38%===========================================  Files          94       83       -11       Lines        4283     3689      -594       Branches     1478     1332      -146     ===========================================+ Hits         3523     3528        +5+ Misses        760      161      -599

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report?Share it here.

🚀 New features to boost your workflow:
  • ❄️Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@andymaiandymai marked this pull request as ready for reviewJuly 18, 2025 21:24
Comment on lines +32 to +33
if(pattern.startsWith('.*')){returntrue;}// Regex wildcards
if(pattern.endsWith('.*')){returntrue;}// Regex wildcards
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

what about[\s\S]*? we shouldn't be adding a dynamic regex patternanywhere - it's a CVE magnet. To add this support, we should be using globs, and micromatch/minimatch/etc (whichever one we're already using)

andymai reacted with eyes emoji
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Good call! Lookin into it. 🙏🏼

- Replace dangerous [\s\S]*? regex patterns with minimatch glob matching- Eliminate all dynamic regex construction in wildcard pattern matching- Use safe string operations instead of regex for wildcard counting- Maintain same functionality while preventing ReDoS vulnerabilitiesAddresses PR feedback about CVE security risks from dynamic regex patterns.🤖 Generated with [Claude Code](https://claude.ai/code)Co-Authored-By: Claude <noreply@anthropic.com>
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Reviewers

@ljharbljharbljharb requested changes

Requested changes must be addressed to merge this pull request.

Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

2 participants
@andymai@ljharb

[8]ページ先頭

©2009-2025 Movatter.jp