From a95166a18bac7db93fab432a0c09fcdafab7c37d Mon Sep 17 00:00:00 2001 From: Antonis Lilis Date: Mon, 5 Oct 2026 14:51:51 +0200 Subject: [PATCH] chore(core): Re-enable sdk/no-regexp-constructor lint rule MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The rule was disabled with a TODO to re-enable once oxlint supported inline disable for jsPlugin rules. oxlint 1.57 supports it (verified: a `new RegExp` line errors, the same line with `// oxlint-disable-next-line sdk/no-regexp-constructor` is suppressed), so re-enable it (`off` -> `error`). The rule guards against `RegExp` construction from unsafe/user input (ReDoS). Both pre-existing uses are constant patterns, not user input: - debugsymbolicator.ts: refactored the static `new RegExp([...].join('|'))` to an equivalent regex literal (same source and flags, verified) — no suppression needed. - sentryMetroSerializer.ts: kept `new RegExp` with a justified inline disable; it builds the matcher from the shared DEBUG_ID_PLACE_HOLDER constant (DRY), and `replaceAll` isn't available under this file's `lib: es7`. Co-Authored-By: Claude Opus 4.8 --- packages/core/.oxlintrc.json | 4 +--- packages/core/src/js/integrations/debugsymbolicator.ts | 2 +- packages/core/src/js/tools/sentryMetroSerializer.ts | 2 ++ 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/packages/core/.oxlintrc.json b/packages/core/.oxlintrc.json index 69e1772967..1b405221e9 100644 --- a/packages/core/.oxlintrc.json +++ b/packages/core/.oxlintrc.json @@ -131,9 +131,7 @@ "no-restricted-globals": ["error", "window", "document", "location", "navigator"], // Bundle size isn't a concern for React Native "sdk/no-class-field-initializers": "off", - // TODO: Re-enable once oxlint supports inline disable for jsPlugin rules - // Only 2 intentional uses exist (debugsymbolicator.ts, sentryMetroSerializer.ts) - "sdk/no-regexp-constructor": "off" + "sdk/no-regexp-constructor": "error" } } ], diff --git a/packages/core/src/js/integrations/debugsymbolicator.ts b/packages/core/src/js/integrations/debugsymbolicator.ts index 4daf3cfd76..2265b82355 100644 --- a/packages/core/src/js/integrations/debugsymbolicator.ts +++ b/packages/core/src/js/integrations/debugsymbolicator.ts @@ -10,7 +10,7 @@ import { fetchSourceContext, parseErrorStack, symbolicateStackTrace } from './de const INTEGRATION_NAME = 'DebugSymbolicator'; -const INTERNAL_CALLSITES_REGEX = new RegExp(['ReactNativeRenderer-dev\\.js$', 'MessageQueue\\.js$'].join('|')); +const INTERNAL_CALLSITES_REGEX = /ReactNativeRenderer-dev\.js$|MessageQueue\.js$/; /** * React Native Error diff --git a/packages/core/src/js/tools/sentryMetroSerializer.ts b/packages/core/src/js/tools/sentryMetroSerializer.ts index 70e3949815..424ff2d8de 100644 --- a/packages/core/src/js/tools/sentryMetroSerializer.ts +++ b/packages/core/src/js/tools/sentryMetroSerializer.ts @@ -185,5 +185,7 @@ function calculateDebugId(bundleCode: string, modules?: Array<[id: number, code: } function injectDebugId(code: string, debugId: string): string { + // Built from the shared DEBUG_ID_PLACE_HOLDER constant (so it can't drift), not user input. + // oxlint-disable-next-line sdk/no-regexp-constructor return code.replace(new RegExp(DEBUG_ID_PLACE_HOLDER, 'g'), debugId); }