Struct rslint_core::groups::errors::NoPrototypeBuiltins

pub struct NoPrototypeBuiltins {}

Disallow direct use of Object.prototype builtins directly.

ES 5.1 added Object.create which allows creation of object with a custom prototype. This pattern is frequently used for objects used as Maps. However this pattern can lead to errors if something else relies on prototype properties/methods.

Moreover, the methods could be shadowed, this can lead to random bugs and denial of service vulnerabilities. For example, calling hasOwnProperty directly on parsed json could lead to vulnerabilities. Instead, you should use get the method directly from the object using Object.prototype.prop.call(item, args).

Invalid Code Examples

var bar = foo.hasOwnProperty("bar");

var bar = foo.isPrototypeOf(bar);

var bar = foo.propertyIsEnumerable("bar");

Correct Code Examples

var bar = Object.prototype.hasOwnProperty.call(foo, "bar");

var bar = Object.prototype.isPrototypeOf.call(foo, bar);

var bar = Object.propertyIsEnumerable.call(foo, "bar");

Implementations

impl NoPrototypeBuiltins

pub fn new() -> Self

Trait Implementations

impl Clone for NoPrototypeBuiltins

fn clone(&self) -> NoPrototypeBuiltins

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl CstRule for NoPrototypeBuiltins

fn check_node(&self, node: &SyntaxNode, ctx: &mut RuleCtx) -> Option<()>

Check an individual node in the syntax tree. You can use the match_ast macro to make matching a node to an ast node easier. The reason this uses nodes and not a visitor is because nodes are more flexible, converting them to an AST node has zero cost and you can easily traverse surrounding nodes. Defaults to doing nothing.

fn check_token(&self, token: &SyntaxToken, ctx: &mut RuleCtx) -> Option<()>

Check an individual token in the syntax tree. Defaults to doing nothing.

fn check_root(&self, root: &SyntaxNode, ctx: &mut RuleCtx) -> Option<()>

Check the root of the tree one time. This method is guaranteed to only be called once. The root's kind will be either SCRIPT or MODULE. Defaults to doing nothing.

impl Debug for NoPrototypeBuiltins

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for NoPrototypeBuiltins

fn default() -> NoPrototypeBuiltins

Returns the "default value" for a type.

impl<'de> Deserialize<'de> for NoPrototypeBuiltins

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error> where
    __D: Deserializer<'de>, 

Deserialize this value from the given Serde deserializer.

impl Rule for NoPrototypeBuiltins

fn name(&self) -> &'static str

A unique, kebab-case name for the rule.

fn group(&self) -> &'static str

The name of the group this rule belongs to.

fn docs(&self) -> &'static str

Optional docs for the rule, an empty string by default

impl Serialize for NoPrototypeBuiltins

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error> where
    __S: Serializer, 

Serialize this value into the given Serde serializer.