noStackInResponse: detect a stack returned from a RESTlet

Open
  • Is something wrong?
#40 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
55/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
typescript
Domain
tooling

Research direction

Read src/rules/noStackInResponse.ts and the script type inference helpers in src/lib/script-side.ts, then inspect the rule tests in test/rules.test.ts and test/rules-extra.test.ts. Add coverage for RESTlet entry points returning an object containing .stack, and verify existing response.write and writeLine cases still behave as described. The issue leaves detection reliability and whether to update the opt-in reason open; check scripts/rule-sources.ts and ADR 0005 before deciding whether generated README updates are needed.

Written by the indexing model from the issue text.

Description

enhancement good first issue help wanted

Problem

noStackInResponse (src/rules/noStackInResponse.ts) only reports a .stack read inside the arguments of response.write or writeLine. A RESTlet returns its response body from the entry point, so return { error: e.stack } is not detected. The OWASP agent skill warns against returning stack traces in error responses generally.

Idea

For files whose inferred script type is a RESTlet, also report .stack reads inside a return of a RESTlet entry point (get, post, put, delete). Keep the rule opt-in (in no preset) unless the detection can be made reliable.

Where

  • Rule: src/rules/noStackInResponse.ts; helpers in src/lib/script-side.ts
  • Tests: test/rules.test.ts, test/rules-extra.test.ts
  • Opt-in reason and sources: scripts/rule-sources.ts (update it if the limitation goes away, then run npm run build and npm run readme)
  • Why it is opt-in: ADR 0005
Dominant language
TypeScript
Stars
1
Forks
0
Avg merge
2h 8m
Merged PRs (30d)
64

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from nemchik/biome-plugin-suitescript

All issues in nemchik/biome-plugin-suitescript

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.