ericcornelissen/js-regex-security-scanner

Provide a guide to migrate from this scanner to adopting `eslint-plugin-regexp`

Closed this issue · 0 comments

Summary

Given this scanner just runs ESLint with a specific configuration, and many Node.js based projects use ESLint anyway, it would make sense to guide users to adopt eslint-plugin-regexp within their project instead of using this scanner. Using the plugin directly would be easier as well as (probably) provide quicker and more frequent feedback on regular expressions in their project.

To clarify, I still believe this scanner has value as it has its own use cases, e.g.:

  • By project owners of contributors while there are still problematic regular expressions that need to be addressed and so errors by ESLint are not yet as useful.
  • By a third-party to scan a project without having to change the configuration of the project they're looking at.