enable eslint security rules

Composer/.eslintrc.js

@@ -1,51 +1,78 @@
 module.exports = {
-  extends: ['eslint:recommended', 'plugin:prettier/recommended'],
-  plugins: ['import', 'notice'],
+  extends: [
+    'eslint:recommended',
+    'plugin:prettier/recommended',
+    'plugin:@typescript-eslint/recommended',
+    'plugin:@typescript-eslint/recommended-requiring-type-checking',
+    'plugin:@typescript-eslint/eslint-recommended',
+    'prettier/@typescript-eslint',
+  ],
+  plugins: ['import', 'notice', 'security'],
   env: {
     browser: true,
     es6: true,
     node: true,
   },
   rules: {
+    '@typescript-eslint/ban-ts-ignore': 'warn',
+    '@typescript-eslint/explicit-function-return-type': 'off',
+    '@typescript-eslint/interface-name-prefix': 'off',
+    '@typescript-eslint/no-use-before-define': 'warn',
+
     // eslint rules
     'no-dupe-class-members': 'off',
-    'no-undef': 'off', // ts compiler catches this
     'prefer-const': 'error',
     'no-var': 'error',
     'no-console': 'warn',
     'dot-notation': 'error',
     yoda: 'error',
-    eqeqeq: 'warn',
+    // eqeqeq: 'error',
 
     // plugin: import
     'import/first': 'error',
     'import/order': ['error', { 'newlines-between': 'always' }],
+
+    // security
+    'security/detect-buffer-noassert': 'error',
+    'security/detect-child-process': 'error',
+    'security/detect-disable-mustache-escape': 'error',
+    'security/detect-eval-with-expression': 'error',
+    'security/detect-new-buffer': 'error',
+    'security/detect-no-csrf-before-method-override': 'error',
+    'security/detect-non-literal-fs-filename': 'error',
+    'security/detect-non-literal-regexp': 'error',
+    'security/detect-non-literal-require': 'error',
+    'security/detect-object-injection': 'off',
+    'security/detect-possible-timing-attacks': 'error',
+    'security/detect-pseudoRandomBytes': 'error',
+    'security/detect-unsafe-regex': 'error',
+  },
+  parserOptions: {
+    // temp fix for https://github.com/typescript-eslint/typescript-eslint/issues/864
+    createDefaultProgram: true,
   },
   overrides: [
-    {
-      files: ['**/*.+(ts|tsx)'],
-      parser: '@typescript-eslint/parser',
-      plugins: ['@typescript-eslint', 'prettier'],
-      rules: {
-        '@typescript-eslint/interface-name-prefix': 'off',
-        '@typescript-eslint/explicit-function-return-type': 'off',
-        '@typescript-eslint/no-unused-vars': ['error', { argsIgnorePattern: '^_' }],
-        '@typescript-eslint/no-explicit-any': ['warn'],
-      },
-    },
-    {
-      files: ['**/*.+(js|jsx)'],
-      parser: 'babel-eslint',
-    },
     {
       files: ['**/*.+(test|spec).+(js|jsx|ts|tsx)'],
       env: {
         jest: true,
       },
       rules: {
-        'typescript/class-name-casing': 'off',
-        'typescript/no-explicit-any': 'off',
         '@typescript-eslint/no-object-literal-type-assertion': 'off',
+
+        'security/detect-buffer-noassert': 'off',
+        'security/detect-child-process': 'off',
+        'security/detect-disable-mustache-escape': 'off',
+        'security/detect-eval-with-expression': 'off',
+        'security/detect-new-buffer': 'off',
+        'security/detect-no-csrf-before-method-override': 'off',
+        'security/detect-non-literal-fs-filename': 'off',
+        'security/detect-non-literal-regexp': 'off',
+        'security/detect-non-literal-require': 'off',
+        'security/detect-object-injection': 'off',
+        'security/detect-possible-timing-attacks': 'off',
+        'security/detect-pseudoRandomBytes': 'off',
+        'security/detect-unsafe-regex': 'off',
       },
     },
   ],

Composer/.eslintrc.react.js

@@ -3,7 +3,7 @@ module.exports = {
   plugins: ['react-hooks', 'format-message'],
   settings: {
     react: {
-      version: 'detect',
+      version: '16.9.0',
     },
   },
   parserOptions: {
@@ -14,16 +14,17 @@ module.exports = {
     },
   },
   rules: {
-    'react/no-deprecated': 'warn',
-    'react/display-name': 'off',
-    'react-hooks/rules-of-hooks': 'error',
-    'react-hooks/exhaustive-deps': 'off',
-
-    'react/prop-types': 'warn',
-
     'format-message/literal-pattern': 'error',
     'format-message/no-invalid-pattern': 'error',
     'format-message/no-missing-params': ['error', { allowNonLiteral: false }],
+
+    'react-hooks/exhaustive-deps': 'off',
+    'react-hooks/rules-of-hooks': 'error',
+
+    'react/display-name': 'off',
+    'react/no-danger': 'error',
+    'react/no-deprecated': 'warn',
+    'react/prop-types': 'warn',
   },
   overrides: [
     {
@@ -37,6 +38,7 @@ module.exports = {
       rules: {
         'react/display-name': 'off',
         'react/prop-types': 'off',
+        'react/no-danger': 'off',
       },
     },
   ],

Composer/Dockerfile

@@ -13,7 +13,6 @@ COPY packages/lib/code-editor/package.json ./packages/lib/code-editor/
 COPY packages/lib/shared/package.json ./packages/lib/shared/
 COPY packages/extensions/package.json ./packages/extensions/
 COPY packages/extensions/obiformeditor/package.json ./packages/extensions/obiformeditor/
-COPY packages/extensions/sample-json-editor/package.json ./packages/extensions/sample-json-editor/
 COPY packages/extensions/visual-designer/package.json ./packages/extensions/visual-designer/
 
 # run yarn install as a distinct layer

Composer/jest.config.js

@@ -40,7 +40,6 @@ module.exports = {
     '<rootDir>/packages/server',
     '<rootDir>/packages/extensions/obiformeditor',
     '<rootDir>/packages/extensions/visual-designer',
-    '<rootDir>/packages/extensions/sample-json-editor',
     '<rootDir>/packages/lib/code-editor',
     '<rootDir>/packages/lib/component-scaffold',
     '<rootDir>/packages/lib/shared',

Composer/package.json

@@ -58,11 +58,24 @@
     "@babel/preset-env": "7.3.0",
     "@babel/preset-react": "^7.0.0",
     "@babel/preset-typescript": "^7.3.3",
+    "@typescript-eslint/eslint-plugin": "2.3.3",
+    "@typescript-eslint/parser": "2.3.3",
     "babel-jest": "24.0.0",
     "concurrently": "^4.1.0",
     "cypress": "3.4.0",
-    "cypress-testing-library": "^3.0.1",
     "cypress-plugin-tab": "^1.0.1",
+    "cypress-testing-library": "^3.0.1",
+    "eslint": "^5.15.1",
+    "eslint-config-prettier": "^4.1.0",
+    "eslint-plugin-format-message": "^6.2.3",
+    "eslint-plugin-import": "^2.16.0",
+    "eslint-plugin-jsx-a11y": "6.1.2",
+    "eslint-plugin-notice": "^0.7.8",
+    "eslint-plugin-prettier": "^3.0.1",
+    "eslint-plugin-react": "7.12.4",
+    "eslint-plugin-react-hooks": "^1.6.0",
+    "eslint-plugin-security": "^1.4.0",
+    "eslint-plugin-typescript": "^0.14.0",
     "husky": "^1.3.1",
     "jest": "24.0.0",
     "jest-dom": "^3.1.3",
@@ -75,6 +88,7 @@
     "react-testing-library": "^6.0.2",
     "rimraf": "^2.6.3",
     "start-server-and-test": "^1.9.0",
+    "typescript": "3.6.4",
     "wsrun": "^3.6.4"
   }
-}
+}

Composer/packages/client/.eslintrc.js

@@ -1,3 +1,7 @@
 module.exports = {
   extends: '../../.eslintrc.react.js',
+  parserOptions: {
+    project: './tsconfig.json',
+    tsconfigRootDir: __dirname,
+  },
 };

Composer/packages/client/package.json

@@ -22,13 +22,8 @@
     "css-loader": "1.0.0",
     "dotenv": "6.0.0",
     "dotenv-expand": "4.2.0",
-    "eslint": "5.12.0",
     "eslint-config-react-app": "^3.0.7",
     "eslint-loader": "2.1.1",
-    "eslint-plugin-flowtype": "2.50.1",
-    "eslint-plugin-import": "2.14.0",
-    "eslint-plugin-jsx-a11y": "6.1.2",
-    "eslint-plugin-react": "7.12.4",
     "file-loader": "2.0.0",
     "fork-ts-checker-webpack-plugin-alt": "0.4.14",
     "format-message": "^6.2.1",
@@ -102,21 +97,10 @@
     "@types/reach__router": "^1.2.4",
     "@types/react": "16.9.0",
     "@types/react-dom": "16.9.0",
-    "@typescript-eslint/eslint-plugin": "^1.13.0",
-    "@typescript-eslint/parser": "^1.13.0",
     "babel-jest": "24.0.0",
     "babel-plugin-emotion": "^10.0.7",
-    "eslint": "^5.15.1",
-    "eslint-config-prettier": "^4.1.0",
-    "eslint-plugin-format-message": "^6.2.3",
-    "eslint-plugin-import": "^2.16.0",
-    "eslint-plugin-notice": "^0.7.8",
-    "eslint-plugin-prettier": "^3.0.1",
-    "eslint-plugin-react-hooks": "^1.6.0",
-    "eslint-plugin-typescript": "^0.14.0",
     "jest": "24.0.0",
     "jest-dom": "^3.2.2",
-    "react-testing-library": "^6.0.1",
-    "typescript": "^3.5.1"
+    "react-testing-library": "^6.0.1"
   }
 }

Composer/packages/client/src/ShellApi.ts

@@ -38,7 +38,7 @@ const FORM_EDITOR = 'FormEditor';
 
 const isEventSourceValid = event => {
   const sourceWindowName = event.source.name;
-  return [VISUAL_EDITOR, FORM_EDITOR].indexOf(sourceWindowName) !== -1;
+  return [VISUAL_EDITOR, FORM_EDITOR].includes(sourceWindowName);
 };
 
 const useDebouncedFunc = (fn, delay = 750) => useRef(debounce(fn, delay)).current;

Composer/packages/client/src/components/ErrorBoundary/index.tsx

@@ -1,3 +1,4 @@
+/* eslint-disable @typescript-eslint/unbound-method */
 /* eslint-disable no-console */
 import React, { Component } from 'react';
 import formatMessage from 'format-message';

Composer/packages/client/src/components/ProjectTree/index.tsx

@@ -60,7 +60,7 @@ export function createGroup(
   let position = 0;
   const result = dialogs
     .filter(dialog => {
-      return dialog.displayName.toLowerCase().indexOf(filter.toLowerCase()) > -1;
+      return dialog.displayName.toLowerCase().includes(filter.toLowerCase());
     })
     .reduce(
       (result: { items: any[]; groups: IGroup[] }, dialog) => {
@@ -124,7 +124,7 @@ export const ProjectTree: React.FC<IProjectTreeProps> = props => {
       <TreeItem
         link={item}
         depth={nestingDepth}
-        isActive={createSelectedPath(item!.index) === selected}
+        isActive={createSelectedPath(item.index) === selected}
         onSelect={() => onSelect(dialogId, createSelectedPath(item.index))}
         onDelete={() => onDeleteTrigger(dialogId, item.index)}
       />

Composer/packages/client/src/components/RequireAuth/index.tsx

@@ -4,11 +4,12 @@ import formatMessage from 'format-message';
 import once from 'lodash.once';
 
 import { StoreContext } from '../../store';
+import { BoundAction } from '../../store/types';
 
 import { loading, dialog, consoleStyle } from './styles';
 
 // only attempt to login once
-const loginOnce = once((login: () => void) => {
+const loginOnce = once((login: BoundAction) => {
   if (process.env.COMPOSER_REQUIRE_AUTH) {
     login();
   }

Composer/packages/client/src/messenger/ApiClient.ts

@@ -42,10 +42,12 @@ class ApiClient {
   };
 
   public connect = (target: Window = window) => {
+    // eslint-disable-next-line @typescript-eslint/no-misused-promises
     target.addEventListener('message', messenger.receiveMessage, false);
   };
 
   public disconnect = (target: Window = window) => {
+    // eslint-disable-next-line @typescript-eslint/no-misused-promises
     target.removeEventListener('message', messenger.receiveMessage, false);
   };
 }

Composer/packages/client/src/pages/design/index.tsx

@@ -101,7 +101,7 @@ function getAllRef(targetId, dialogs) {
 const getTabFromFragment = () => {
   const tab = window.location.hash.substring(1);
 
-  if (Object.values(PromptTab).includes(tab)) {
+  if (Object.values<string>(PromptTab).includes(tab)) {
     return tab;
   }
 };

Composer/packages/client/src/pages/home/index.js

@@ -41,11 +41,11 @@ export const Home = () => {
     navigate(BASEPATH);
   };
 
-  const onClickNewBotProject = async () => {
+  const onClickNewBotProject = () => {
     setCreationFlowStatus(CreationFlowStatus.NEW_FROM_SCRATCH);
   };
 
-  const onClickTemplate = async id => {
+  const onClickTemplate = id => {
     saveTemplateId(id);
     setCreationFlowStatus(CreationFlowStatus.NEW_FROM_TEMPLATE);
   };

Composer/packages/client/src/pages/language-understanding/publish-luis-modal.js

@@ -48,7 +48,7 @@ const validateForm = data => {
 
   dataKeys.forEach(key => {
     const value = data[key];
-    if (validationProperties.indexOf(key) > -1 && (!value || !nameRegex.test(value))) {
+    if (validationProperties.includes(key) && (!value || !nameRegex.test(value))) {
       result.errors[key] = formatMessage(
         'Spaces and special characters are not allowed. Use letters, numbers, -, or _., numbers, -, and _'
       );

Composer/packages/client/src/store/action/bot.ts

@@ -42,7 +42,7 @@ export const reloadBot: ActionCreator = async ({ dispatch, getState }, settings)
   }
 };
 
-export const startBot: ActionCreator = async ({ dispatch }, toStartBot) => {
+export const startBot: ActionCreator = ({ dispatch }, toStartBot) => {
   dispatch({
     type: ActionTypes.TO_START_BOT,
     payload: {

Composer/packages/client/src/store/action/setting.ts

@@ -7,7 +7,7 @@ import { SensitiveProperties } from '../../constants';
 
 import { BASEURL, ActionTypes } from './../../constants/index';
 
-const post = debounce(axios.post, 1000);
+const post = debounce(axios.post.bind(axios), 1000);
 export const setSettings: ActionCreator = async ({ dispatch }, botName: string, settings: DialogSetting) => {
   try {
     // set value to store

Composer/packages/client/src/store/middlewares/undo/history.ts

@@ -12,8 +12,8 @@ interface History {
 class UndoHistory {
   private stacks: { [key: string]: UndoStack } = {};
   private history: History[] = [];
-  private pointer: number = -1;
-  private _limit: number = 5;
+  private pointer = -1;
+  private _limit = 5;
 
   public createStack(undo: ActionCreator, redo: ActionCreator) {
     const stack = new UndoStack(undo, redo);

Composer/packages/client/src/store/middlewares/undo/stack.ts

@@ -6,7 +6,7 @@ const PREFIX = 'undoStack';
 
 export default class UndoStack {
   private history: any[] = [];
-  private pointer: number = -1;
+  private pointer = -1;
   private _id: string;
   private _undo: ActionCreator;
   private _redo: ActionCreator;

Composer/packages/client/src/store/reducer/index.ts

@@ -112,7 +112,7 @@ const getStorageFileSuccess: ReducerFunc = (state, { response }) => {
     } else {
       const path = file.path;
       const extension = getExtension(path);
-      if (projectFiles.indexOf(extension) >= 0) {
+      if (projectFiles.includes(extension)) {
         files.push(file);
       }
     }

Composer/packages/client/src/store/types.ts

@@ -15,7 +15,7 @@ export interface Store {
 
 export type ActionCreator<T extends any[] = any[]> = (store: Store, ...args: T) => Promise<void> | void;
 export type ActionHandlers = { [action: string]: ActionCreator };
-export type BoundAction = (...args: any[]) => void;
+export type BoundAction = (...args: any[]) => void | Promise<void>;
 export type BoundActionHandlers = { [action: string]: BoundAction };
 
 interface StateError {