Skip to content

Draft: Speed up eslint.detect-object-injection

What does this MR do?

Speeds up eslint.detect-object-injection.

This rule included matches for all lines following any variable assignment, which would match basically all code in most files. In addition, the metavariable regex for numeric literals was broken, causing Semgrep to ignore any metavariable regex for "$V".

Here I instead leverage constant propagation and metavariable typing to exclude numeric literal indexing.

** NOTE **: This MR will not pass tests until the Semgrep version is upgraded from 0.39 to 0.51.

This reduced run time on a test project from 8 minutes to 40 seconds.

What are the relevant issue numbers?

Does this MR meet the acceptance criteria?

Edited by Nathan Brahms

Merge request reports