ESLint® Plugin for Security-Related Issue Detection/Mitigation for DevExpress Projects

An ESLint® plugin that detects and mitigates security-related issues for DevExpress projects.

⚠️ Important: This package is intended for internal use only. It may contain limitations and should not be used in mission-critical software applications.

Prerequisites / Dependencies

ESLint v9+.

Installation

npm install --save-dev @devexpress/eslint-plugin-dx-security

Key Features

• Security-focused rule set
• JSX parsing support for *.jsx and *.tsx files
• ASPX directive stripping processor for *.js files
• Optional violation filter for third-party rules

Built-in Rules

| Rule | Severity | |------|----------| | no-caller | error | | no-eval | error | | no-implied-eval | error | | no-new-func | error |

Microsoft Security Development Lifecycle Rules

| Rule | Severity | |------|----------| | @microsoft/sdl/no-angular-bypass-sanitizer | error | | @microsoft/sdl/no-angularjs-bypass-sce | error | | @microsoft/sdl/no-angularjs-enable-svg | error | | @microsoft/sdl/no-angularjs-sanitization-whitelist | error | | @microsoft/sdl/no-document-domain | error | | @microsoft/sdl/no-electron-node-integration | error | | @microsoft/sdl/no-msapp-exec-unsafe | error | | @microsoft/sdl/no-postmessage-star-origin | error | | @microsoft/sdl/no-unsafe-alloc | error | | @microsoft/sdl/no-winjs-html-unsafe | error |

React Rules

| Rule | Severity | |------|----------| | react/iframe-missing-sandbox | error | | react/no-danger | error |

redos rules

| Rule | Severity | |------|----------| | redos/no-vulnerable | error (exponential) |

security rules

| Rule | Severity | |------|----------| | security/detect-buffer-noassert | error | | security/detect-child-process | error | | security/detect-disable-mustache-escape | error | | security/detect-new-buffer | error | | security/detect-no-csrf-before-method-override | error |

ASPX Directive Stripping

The strip-aspx-directives processor automatically removes ASP.NET server-side directives before ESLint parses a *.js file. This action prevents syntax errors in JavaScript files that embed server-rendered values.

Substitution rules:

| Input | Output | Description | |-------|--------|-----------| | '<% … %>' | '' | Clears directive content enclosed in single quotes. | | "<% … %>" | "" | Clears directive content enclosed in double quotes.| | <% … %> | "" | Replaces unenclosed directive with an empty double-quoted string. |

Usage Examples

Use one of the following configs to activate the plugin:

• required

  Add this config to eslint.config.mjs to enforce security rules across all files:

  import dxSecurity from '@devexpress/eslint-plugin-dx-security';
    
  export default [
    ...dxSecurity.configs.required,
  ];

• required-exclusive

  This config suppresses ESLint rules defined by other plugins (including eslint-disable comments). Use it to disable rules that may interfere with security checks.

  import dxSecurity from '@devexpress/eslint-plugin-dx-security';
  
  export default [
    ...dxSecurity.configs['required-exclusive'],
  ];

Related Packages

• eslint
• @microsoft/eslint-plugin-sdl
• eslint-plugin-react
• eslint-plugin-redos
• eslint-plugin-security