trailofbits/tubertc

View on GitHub
public/js/shell-quote.js

Summary

Maintainability
C
1 day
Test Coverage

Function parse has 108 lines of code (exceeds 25 allowed). Consider refactoring.
Open

function parse(s, env) {
    var chunker = new RegExp([
        '(' + CONTROL + ')', // control chars
        '(' + BAREWORD + '|' + SINGLE_QUOTE + '|' + DOUBLE_QUOTE + ')*'
    ].join('|'), 'g');
Severity: Major
Found in public/js/shell-quote.js - About 4 hrs to fix

    Function has a complexity of 20.
    Open

        return map(match, function(s) {
    Severity: Minor
    Found in public/js/shell-quote.js by eslint

    Limit Cyclomatic Complexity (complexity)

    Cyclomatic complexity measures the number of linearly independent paths through a program's source code. This rule allows setting a cyclomatic complexity threshold.

    function a(x) {
        if (true) {
            return x; // 1st path
        } else if (false) {
            return x+1; // 2nd path
        } else {
            return 4; // 3rd path
        }
    }

    Rule Details

    This rule is aimed at reducing code complexity by capping the amount of cyclomatic complexity allowed in a program. As such, it will warn when the cyclomatic complexity crosses the configured threshold (default is 20).

    Examples of incorrect code for a maximum of 2:

    /*eslint complexity: ["error", 2]*/
    
    function a(x) {
        if (true) {
            return x;
        } else if (false) {
            return x+1;
        } else {
            return 4; // 3rd path
        }
    }

    Examples of correct code for a maximum of 2:

    /*eslint complexity: ["error", 2]*/
    
    function a(x) {
        if (true) {
            return x;
        } else {
            return 4;
        }
    }

    Options

    Optionally, you may specify a max object property:

    "complexity": ["error", 2]

    is equivalent to

    "complexity": ["error", { "max": 2 }]

    Deprecated: the object property maximum is deprecated. Please use the property max instead.

    When Not To Use It

    If you can't determine an appropriate complexity limit for your code, then it's best to disable this rule.

    Further Reading

    Related Rules

    • [max-depth](max-depth.md)
    • [max-len](max-len.md)
    • [max-nested-callbacks](max-nested-callbacks.md)
    • [max-params](max-params.md)
    • [max-statements](max-statements.md) Source: http://eslint.org/docs/rules/

    Function parseEnvVar has 28 lines of code (exceeds 25 allowed). Consider refactoring.
    Open

            function parseEnvVar() {
                i += 1;
                var varend;
                var varname;
    
    
    Severity: Minor
    Found in public/js/shell-quote.js - About 1 hr to fix

      Function parse has a Cognitive Complexity of 9 (exceeds 5 allowed). Consider refactoring.
      Open

      function parse(s, env) {
          var chunker = new RegExp([
              '(' + CONTROL + ')', // control chars
              '(' + BAREWORD + '|' + SINGLE_QUOTE + '|' + DOUBLE_QUOTE + ')*'
          ].join('|'), 'g');
      Severity: Minor
      Found in public/js/shell-quote.js - About 55 mins to fix

      Cognitive Complexity

      Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

      A method's cognitive complexity is based on a few simple rules:

      • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
      • Code is considered more complex for each "break in the linear flow of the code"
      • Code is considered more complex when "flow breaking structures are nested"

      Further reading

      Avoid deeply nested control flow statements.
      Open

                          } else if (c === DS) {
                              out += parseEnvVar();
                          } else {
                              out += c;
                          }
      Severity: Major
      Found in public/js/shell-quote.js - About 45 mins to fix

        Avoid deeply nested control flow statements.
        Open

                                if (c === DQ || c === BS || c === DS) {
                                    out += c;
                                } else {
                                    out += BS + c;
                                }
        Severity: Major
        Found in public/js/shell-quote.js - About 45 mins to fix

          Function quote has a Cognitive Complexity of 7 (exceeds 5 allowed). Consider refactoring.
          Open

          ShellQuote.quote = function(xs) {
              return map(xs, function(s) {
                  if (s && typeof s === 'object') {
                      return s.op.replace(/(.)/g, '\\$1');
                  } else if (/["\s]/.test(s) && !/'/.test(s)) {
          Severity: Minor
          Found in public/js/shell-quote.js - About 35 mins to fix

          Cognitive Complexity

          Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

          A method's cognitive complexity is based on a few simple rules:

          • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
          • Code is considered more complex for each "break in the linear flow of the code"
          • Code is considered more complex when "flow breaking structures are nested"

          Further reading

          'parseEnvVar' was used before it was defined.
          Open

                                  out += parseEnvVar();
          Severity: Minor
          Found in public/js/shell-quote.js by eslint

          Disallow Early Use (no-use-before-define)

          In JavaScript, prior to ES6, variable and function declarations are hoisted to the top of a scope, so it's possible to use identifiers before their formal declarations in code. This can be confusing and some believe it is best to always declare variables and functions before using them.

          In ES6, block-level bindings (let and const) introduce a "temporal dead zone" where a ReferenceError will be thrown with any attempt to access the variable before its declaration.

          Rule Details

          This rule will warn when it encounters a reference to an identifier that has not yet been declared.

          Examples of incorrect code for this rule:

          /*eslint no-use-before-define: "error"*/
          /*eslint-env es6*/
          
          alert(a);
          var a = 10;
          
          f();
          function f() {}
          
          function g() {
              return b;
          }
          var b = 1;
          
          // With blockBindings: true
          {
              alert(c);
              let c = 1;
          }

          Examples of correct code for this rule:

          /*eslint no-use-before-define: "error"*/
          /*eslint-env es6*/
          
          var a;
          a = 10;
          alert(a);
          
          function f() {}
          f(1);
          
          var b = 1;
          function g() {
              return b;
          }
          
          // With blockBindings: true
          {
              let C;
              c++;
          }

          Options

          {
              "no-use-before-define": ["error", { "functions": true, "classes": true }]
          }
          • functions (boolean) - The flag which shows whether or not this rule checks function declarations. If this is true, this rule warns every reference to a function before the function declaration. Otherwise, ignores those references. Function declarations are hoisted, so it's safe. Default is true.
          • classes (boolean) - The flag which shows whether or not this rule checks class declarations of upper scopes. If this is true, this rule warns every reference to a class before the class declaration. Otherwise, ignores those references if the declaration is in upper function scopes. Class declarations are not hoisted, so it might be danger. Default is true.
          • variables (boolean) - This flag determines whether or not the rule checks variable declarations in upper scopes. If this is true, the rule warns every reference to a variable before the variable declaration. Otherwise, the rule ignores a reference if the declaration is in an upper scope, while still reporting the reference if it's in the same scope as the declaration. Default is true.

          This rule accepts "nofunc" string as an option. "nofunc" is the same as { "functions": false, "classes": true }.

          functions

          Examples of correct code for the { "functions": false } option:

          /*eslint no-use-before-define: ["error", { "functions": false }]*/
          
          f();
          function f() {}

          classes

          Examples of incorrect code for the { "classes": false } option:

          /*eslint no-use-before-define: ["error", { "classes": false }]*/
          /*eslint-env es6*/
          
          new A();
          class A {
          }

          Examples of correct code for the { "classes": false } option:

          /*eslint no-use-before-define: ["error", { "classes": false }]*/
          /*eslint-env es6*/
          
          function foo() {
              return new A();
          }
          
          class A {
          }

          variables

          Examples of incorrect code for the { "variables": false } option:

          /*eslint no-use-before-define: ["error", { "variables": false }]*/
          
          console.log(foo);
          var foo = 1;

          Examples of correct code for the { "variables": false } option:

          /*eslint no-use-before-define: ["error", { "variables": false }]*/
          
          function baz() {
              console.log(foo);
          }
          
          var foo = 1;

          Source: http://eslint.org/docs/rules/

          'parseEnvVar' was used before it was defined.
          Open

                          out += parseEnvVar();
          Severity: Minor
          Found in public/js/shell-quote.js by eslint

          Disallow Early Use (no-use-before-define)

          In JavaScript, prior to ES6, variable and function declarations are hoisted to the top of a scope, so it's possible to use identifiers before their formal declarations in code. This can be confusing and some believe it is best to always declare variables and functions before using them.

          In ES6, block-level bindings (let and const) introduce a "temporal dead zone" where a ReferenceError will be thrown with any attempt to access the variable before its declaration.

          Rule Details

          This rule will warn when it encounters a reference to an identifier that has not yet been declared.

          Examples of incorrect code for this rule:

          /*eslint no-use-before-define: "error"*/
          /*eslint-env es6*/
          
          alert(a);
          var a = 10;
          
          f();
          function f() {}
          
          function g() {
              return b;
          }
          var b = 1;
          
          // With blockBindings: true
          {
              alert(c);
              let c = 1;
          }

          Examples of correct code for this rule:

          /*eslint no-use-before-define: "error"*/
          /*eslint-env es6*/
          
          var a;
          a = 10;
          alert(a);
          
          function f() {}
          f(1);
          
          var b = 1;
          function g() {
              return b;
          }
          
          // With blockBindings: true
          {
              let C;
              c++;
          }

          Options

          {
              "no-use-before-define": ["error", { "functions": true, "classes": true }]
          }
          • functions (boolean) - The flag which shows whether or not this rule checks function declarations. If this is true, this rule warns every reference to a function before the function declaration. Otherwise, ignores those references. Function declarations are hoisted, so it's safe. Default is true.
          • classes (boolean) - The flag which shows whether or not this rule checks class declarations of upper scopes. If this is true, this rule warns every reference to a class before the class declaration. Otherwise, ignores those references if the declaration is in upper function scopes. Class declarations are not hoisted, so it might be danger. Default is true.
          • variables (boolean) - This flag determines whether or not the rule checks variable declarations in upper scopes. If this is true, the rule warns every reference to a variable before the variable declaration. Otherwise, the rule ignores a reference if the declaration is in an upper scope, while still reporting the reference if it's in the same scope as the declaration. Default is true.

          This rule accepts "nofunc" string as an option. "nofunc" is the same as { "functions": false, "classes": true }.

          functions

          Examples of correct code for the { "functions": false } option:

          /*eslint no-use-before-define: ["error", { "functions": false }]*/
          
          f();
          function f() {}

          classes

          Examples of incorrect code for the { "classes": false } option:

          /*eslint no-use-before-define: ["error", { "classes": false }]*/
          /*eslint-env es6*/
          
          new A();
          class A {
          }

          Examples of correct code for the { "classes": false } option:

          /*eslint no-use-before-define: ["error", { "classes": false }]*/
          /*eslint-env es6*/
          
          function foo() {
              return new A();
          }
          
          class A {
          }

          variables

          Examples of incorrect code for the { "variables": false } option:

          /*eslint no-use-before-define: ["error", { "variables": false }]*/
          
          console.log(foo);
          var foo = 1;

          Examples of correct code for the { "variables": false } option:

          /*eslint no-use-before-define: ["error", { "variables": false }]*/
          
          function baz() {
              console.log(foo);
          }
          
          var foo = 1;

          Source: http://eslint.org/docs/rules/

          'varname' is assigned a value but never used.
          Open

                  var varname = false;
          Severity: Minor
          Found in public/js/shell-quote.js by eslint

          Disallow Unused Variables (no-unused-vars)

          Variables that are declared and not used anywhere in the code are most likely an error due to incomplete refactoring. Such variables take up space in the code and can lead to confusion by readers.

          Rule Details

          This rule is aimed at eliminating unused variables, functions, and parameters of functions.

          A variable is considered to be used if any of the following are true:

          • It represents a function that is called (doSomething())
          • It is read (var y = x)
          • It is passed into a function as an argument (doSomething(x))
          • It is read inside of a function that is passed to another function (doSomething(function() { foo(); }))

          A variable is not considered to be used if it is only ever assigned to (var x = 5) or declared.

          Examples of incorrect code for this rule:

          /*eslint no-unused-vars: "error"*/
          /*global some_unused_var*/
          
          // It checks variables you have defined as global
          some_unused_var = 42;
          
          var x;
          
          // Write-only variables are not considered as used.
          var y = 10;
          y = 5;
          
          // A read for a modification of itself is not considered as used.
          var z = 0;
          z = z + 1;
          
          // By default, unused arguments cause warnings.
          (function(foo) {
              return 5;
          })();
          
          // Unused recursive functions also cause warnings.
          function fact(n) {
              if (n < 2) return 1;
              return n * fact(n - 1);
          }
          
          // When a function definition destructures an array, unused entries from the array also cause warnings.
          function getY([x, y]) {
              return y;
          }

          Examples of correct code for this rule:

          /*eslint no-unused-vars: "error"*/
          
          var x = 10;
          alert(x);
          
          // foo is considered used here
          myFunc(function foo() {
              // ...
          }.bind(this));
          
          (function(foo) {
              return foo;
          })();
          
          var myFunc;
          myFunc = setTimeout(function() {
              // myFunc is considered used
              myFunc();
          }, 50);
          
          // Only the second argument from the descructured array is used.
          function getY([, y]) {
              return y;
          }

          exported

          In environments outside of CommonJS or ECMAScript modules, you may use var to create a global variable that may be used by other scripts. You can use the /* exported variableName */ comment block to indicate that this variable is being exported and therefore should not be considered unused.

          Note that /* exported */ has no effect for any of the following:

          • when the environment is node or commonjs
          • when parserOptions.sourceType is module
          • when ecmaFeatures.globalReturn is true

          The line comment // exported variableName will not work as exported is not line-specific.

          Examples of correct code for /* exported variableName */ operation:

          /* exported global_var */
          
          var global_var = 42;

          Options

          This rule takes one argument which can be a string or an object. The string settings are the same as those of the vars property (explained below).

          By default this rule is enabled with all option for variables and after-used for arguments.

          {
              "rules": {
                  "no-unused-vars": ["error", { "vars": "all", "args": "after-used", "ignoreRestSiblings": false }]
              }
          }

          vars

          The vars option has two settings:

          • all checks all variables for usage, including those in the global scope. This is the default setting.
          • local checks only that locally-declared variables are used but will allow global variables to be unused.

          vars: local

          Examples of correct code for the { "vars": "local" } option:

          /*eslint no-unused-vars: ["error", { "vars": "local" }]*/
          /*global some_unused_var */
          
          some_unused_var = 42;

          varsIgnorePattern

          The varsIgnorePattern option specifies exceptions not to check for usage: variables whose names match a regexp pattern. For example, variables whose names contain ignored or Ignored.

          Examples of correct code for the { "varsIgnorePattern": "[iI]gnored" } option:

          /*eslint no-unused-vars: ["error", { "varsIgnorePattern": "[iI]gnored" }]*/
          
          var firstVarIgnored = 1;
          var secondVar = 2;
          console.log(secondVar);

          args

          The args option has three settings:

          • after-used - only the last argument must be used. This allows you, for instance, to have two named parameters to a function and as long as you use the second argument, ESLint will not warn you about the first. This is the default setting.
          • all - all named arguments must be used.
          • none - do not check arguments.

          args: after-used

          Examples of incorrect code for the default { "args": "after-used" } option:

          /*eslint no-unused-vars: ["error", { "args": "after-used" }]*/
          
          // 1 error
          // "baz" is defined but never used
          (function(foo, bar, baz) {
              return bar;
          })();

          Examples of correct code for the default { "args": "after-used" } option:

          /*eslint no-unused-vars: ["error", {"args": "after-used"}]*/
          
          (function(foo, bar, baz) {
              return baz;
          })();

          args: all

          Examples of incorrect code for the { "args": "all" } option:

          /*eslint no-unused-vars: ["error", { "args": "all" }]*/
          
          // 2 errors
          // "foo" is defined but never used
          // "baz" is defined but never used
          (function(foo, bar, baz) {
              return bar;
          })();

          args: none

          Examples of correct code for the { "args": "none" } option:

          /*eslint no-unused-vars: ["error", { "args": "none" }]*/
          
          (function(foo, bar, baz) {
              return bar;
          })();

          ignoreRestSiblings

          The ignoreRestSiblings option is a boolean (default: false). Using a Rest Property it is possible to "omit" properties from an object, but by default the sibling properties are marked as "unused". With this option enabled the rest property's siblings are ignored.

          Examples of correct code for the { "ignoreRestSiblings": true } option:

          /*eslint no-unused-vars: ["error", { "ignoreRestSiblings": true }]*/
          // 'type' is ignored because it has a rest property sibling.
          var { type, ...coords } = data;

          argsIgnorePattern

          The argsIgnorePattern option specifies exceptions not to check for usage: arguments whose names match a regexp pattern. For example, variables whose names begin with an underscore.

          Examples of correct code for the { "argsIgnorePattern": "^_" } option:

          /*eslint no-unused-vars: ["error", { "argsIgnorePattern": "^_" }]*/
          
          function foo(x, _y) {
              return x + 1;
          }
          foo();

          caughtErrors

          The caughtErrors option is used for catch block arguments validation.

          It has two settings:

          • none - do not check error objects. This is the default setting.
          • all - all named arguments must be used.

          caughtErrors: none

          Not specifying this rule is equivalent of assigning it to none.

          Examples of correct code for the { "caughtErrors": "none" } option:

          /*eslint no-unused-vars: ["error", { "caughtErrors": "none" }]*/
          
          try {
              //...
          } catch (err) {
              console.error("errors");
          }

          caughtErrors: all

          Examples of incorrect code for the { "caughtErrors": "all" } option:

          /*eslint no-unused-vars: ["error", { "caughtErrors": "all" }]*/
          
          // 1 error
          // "err" is defined but never used
          try {
              //...
          } catch (err) {
              console.error("errors");
          }

          caughtErrorsIgnorePattern

          The caughtErrorsIgnorePattern option specifies exceptions not to check for usage: catch arguments whose names match a regexp pattern. For example, variables whose names begin with a string 'ignore'.

          Examples of correct code for the { "caughtErrorsIgnorePattern": "^ignore" } option:

          /*eslint no-unused-vars: ["error", { "caughtErrorsIgnorePattern": "^ignore" }]*/
          
          try {
              //...
          } catch (ignoreErr) {
              console.error("errors");
          }

          When Not To Use It

          If you don't want to be notified about unused variables or function arguments, you can safely turn this rule off. Source: http://eslint.org/docs/rules/

          There are no issues that match your filters.

          Category
          Status