test: security scan

- 'npm run test:redos' now scans for REDOS issues - added a Travis stage for 'security scan'
markedjs · Apr 15, 2018 · 34c45bf · 34c45bf
1 parent 3130e62
commit 34c45bf
Show file tree

Hide file tree

Showing 3 changed files with 217 additions and 0 deletions.
diff --git a/.travis.yml b/.travis.yml
@@ -13,6 +13,10 @@ jobs:
     - node_js: lts/*
     - node_js: node
 
+    - stage: security scan
+      script: npm run test:redos
+      node_js: lts/*
+
     - stage: lint ✨
       script: npm run test:lint
       node_js: lts/*

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -29,6 +29,7 @@
     "eslint-plugin-node": "^5.2.1",
     "eslint-plugin-promise": "^3.6.0",
     "eslint-plugin-standard": "^3.0.1",
+    "eslint-plugin-vuln-regex-detector": "^1.0.4",
     "front-matter": "^2.3.0",
     "glob-to-regexp": "0.3.0",
     "html-differ": "^1.3.4",
@@ -47,6 +48,7 @@
     "test:gfm": "npm test -- test/specs/gfm/**/*-spec.js",
     "test:old": "node test",
     "test:lint": "eslint bin/marked .",
+    "test:redos": "eslint --plugin vuln-regex-detector --rule '\"vuln-regex-detector/no-vuln-regex\": 2' lib/marked.js",
     "bench": "node test --bench",
     "lint": "eslint --fix bin/marked .",
     "build": "uglifyjs lib/marked.js -cm  --comments /Copyright/ -o marked.min.js",