Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Node.js? #67

Open
jedwards1211 opened this issue Oct 17, 2019 · 3 comments
Open

Node.js? #67

jedwards1211 opened this issue Oct 17, 2019 · 3 comments

Comments

@jedwards1211
Copy link

I saw in your fork of safe-regex that you recommend this project instead. But is it designed to work on Node regular expressions? And in any case, maybe we should make a Node.js version to use with tools like ESLint?

@lirantal
Copy link

Yes, JavaScript regular expressions are supported too.

@jedwards1211
Copy link
Author

I see, how much does the file scanning support JS? I don't see anything in the readme about how it would scan JS files for regexes or what the limitations would be on dynamically constructed regexes like new RegExp(foo + bar) where foo and bar are just constants initialized to string literals

@davisjam
Copy link
Owner

Regex extraction and regex analysis are separate problems.

Regex extraction

The extraction relies on simple static analysis. It only finds regexes declared /like this/ or as constant strings in the constructor, like new Regexp("foo"). See section 5.A."Extraction through static analysis" of this paper.

PRs to improve the static extraction are welcome. I'm not sure if the static analysis framework I used for JS handles dataflow analysis.

Regex analysis

The super-linear regex detection ensemble exposed by this project is much more powerful than safe-regex's heuristic.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants