Bug: security/detect-eval-with-expression - "TypeError: Cannot read properties of undefined (reading: 'type')

[bestickley]

Bug: security/detect-eval-with-expression - "TypeError: Cannot read properties of undefined (reading: 'type')

[nzakas]

Great, thanks, I'll take a look.

[nzakas]

when I paste eval("some nefarious code"); into my editor I don't see an error in ESLint Output like you said. It's only when I type it out and ESLint then fails when I type eval().

Ah okay. So what's happening here is that VS Code is running ESLint on incomplete code, meaning that it appears eval() doesn't have any arguments and that's why you're seeing the error.

eval("some nefarious code") does not trigger the detect-eval-with-expression rule because the argument is a literal. The rule specifically warns against expressions in eval().

If you want to enforce not using eval in general, then you should enable the core no-eval rule.

[nzakas]

Can you try with the default ESLint parser? typescript-eslint produces a different AST and sometimes there are differences that can cause errors.

[bestickley]

@nzakas, yes. I tried and it resulted in the same error:

[Info  - 9:32:49 AM] ESLint server is starting.
[Info  - 9:32:50 AM] ESLint server running in node v18.17.1
[Info  - 9:32:50 AM] ESLint server is running.
[Info  - 9:32:59 AM] ESLint library loaded from: /Users/stickb/Code/dos/lighthouse/node_modules/.pnpm/[email protected]/node_modules/eslint/lib/unsupported-api.js
Pages directory cannot be found at /Users/stickb/Code/dos/lighthouse/pages or /Users/stickb/Code/dos/lighthouse/src/pages. If using a custom path, please configure with the `no-html-link-for-pages` rule in your eslint config file.
[Error - 11:15:40 AM] An unexpected error occurred:
[Error - 11:15:40 AM] TypeError: Cannot read properties of undefined (reading 'type')
Occurred while linting /Users/stickb/Code/dos/lighthouse/core/src/index.server.ts:11
Rule: "security/detect-eval-with-expression"
    at CallExpression (/Users/stickb/Code/dos/lighthouse/node_modules/.pnpm/[email protected]/node_modules/eslint-plugin-security/rules/detect-eval-with-expression.js:25:62)
    at ruleErrorHandler (/Users/stickb/Code/dos/lighthouse/node_modules/.pnpm/[email protected]/node_modules/eslint/lib/linter/linter.js:1076:28)
    at /Users/stickb/Code/dos/lighthouse/node_modules/.pnpm/[email protected]/node_modules/eslint/lib/linter/safe-emitter.js:45:58
    at Array.forEach (<anonymous>)
    at Object.emit (/Users/stickb/Code/dos/lighthouse/node_modules/.pnpm/[email protected]/node_modules/eslint/lib/linter/safe-emitter.js:45:38)
    at NodeEventGenerator.applySelector (/Users/stickb/Code/dos/lighthouse/node_modules/.pnpm/[email protected]/node_modules/eslint/lib/linter/node-event-generator.js:297:26)
    at NodeEventGenerator.applySelectors (/Users/stickb/Code/dos/lighthouse/node_modules/.pnpm/[email protected]/node_modules/eslint/lib/linter/node-event-generator.js:326:22)
    at NodeEventGenerator.enterNode (/Users/stickb/Code/dos/lighthouse/node_modules/.pnpm/[email protected]/node_modules/eslint/lib/linter/node-event-generator.js:340:14)
    at CodePathAnalyzer.enterNode (/Users/stickb/Code/dos/lighthouse/node_modules/.pnpm/[email protected]/node_modules/eslint/lib/linter/code-path-analysis/code-path-analyzer.js:803:23)
    at /Users/stickb/Code/dos/lighthouse/node_modules/.pnpm/[email protected]/node_modules/eslint/lib/linter/linter.js:1111:32
[Error - 11:17:40 AM] An unexpected error occurred:
[Error - 11:17:40 AM] TypeError: Cannot read properties of undefined (reading 'type')
Occurred while linting /Users/stickb/Code/dos/lighthouse/core/src/test.js:1
Rule: "security/detect-eval-with-expression"
    at CallExpression (/Users/stickb/Code/dos/lighthouse/node_modules/.pnpm/[email protected]/node_modules/eslint-plugin-security/rules/detect-eval-with-expression.js:25:62)
    at ruleErrorHandler (/Users/stickb/Code/dos/lighthouse/node_modules/.pnpm/[email protected]/node_modules/eslint/lib/linter/linter.js:1076:28)
    at /Users/stickb/Code/dos/lighthouse/node_modules/.pnpm/[email protected]/node_modules/eslint/lib/linter/safe-emitter.js:45:58
    at Array.forEach (<anonymous>)
    at Object.emit (/Users/stickb/Code/dos/lighthouse/node_modules/.pnpm/[email protected]/node_modules/eslint/lib/linter/safe-emitter.js:45:38)
    at NodeEventGenerator.applySelector (/Users/stickb/Code/dos/lighthouse/node_modules/.pnpm/[email protected]/node_modules/eslint/lib/linter/node-event-generator.js:297:26)
    at NodeEventGenerator.applySelectors (/Users/stickb/Code/dos/lighthouse/node_modules/.pnpm/[email protected]/node_modules/eslint/lib/linter/node-event-generator.js:326:22)
    at NodeEventGenerator.enterNode (/Users/stickb/Code/dos/lighthouse/node_modules/.pnpm/[email protected]/node_modules/eslint/lib/linter/node-event-generator.js:340:14)
    at CodePathAnalyzer.enterNode (/Users/stickb/Code/dos/lighthouse/node_modules/.pnpm/[email protected]/node_modules/eslint/lib/linter/code-path-analysis/code-path-analyzer.js:803:23)
    at /Users/stickb/Code/dos/lighthouse/node_modules/.pnpm/[email protected]/node_modules/eslint/lib/linter/linter.js:1111:32

Notice above, I first tried with a TS file, it failed, then I tried with a JS file (commented out TS parser in eslint.config.js) but it still failed.

[nzakas]

Okay, so the only way I've been able to reproduce this error is by linting eval() (no arguments). The example you gave works just fine in all of the configurations I tried. It shouldn't crash in this case, for sure, but it makes me curious what is going on with your case.

Would it be possible for you to create a Stackblitz to reproduce the problem? I'd like to see it in action if possible.

[bestickley]

@nzakas, when I paste eval("some nefarious code"); into my editor I don't see an error in ESLint Output like you said. It's only when I type it out and ESLint then fails when I type eval().

But, when I paste eval("some nefarious code"); into VS Code, I don't see any ESLint warning/error saying that I shouldn't use eval in my code which is what I'd expect. See screenshot below how ESLint is correctly linting for rule, no-compare-neg-zero, but it's not working for detect-eval-with-expression.

In your testing, was the linting rule correctly working? (besides just not erroring out)