Skip to content

Commit

Permalink
add a bunch of rules and fix some things
Browse files Browse the repository at this point in the history
  • Loading branch information
XanderG2 committed Feb 22, 2025
1 parent fe2f009 commit 2c830b0
Show file tree
Hide file tree
Showing 30 changed files with 71 additions and 21 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -62,3 +62,5 @@ exceptions:
- XSS
- YAML
- ZIP
- ESM
- AWS
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ level: suggestion
scope: heading
match: $sentence
indicators:
- ':'
- ":"
exceptions:
- Azure
- CLI
Expand All @@ -26,3 +26,7 @@ exceptions:
- Visual
- VS
- Windows
- PostGraphile
- Grafast
- Graphile
- EXPORTABLE
4 changes: 3 additions & 1 deletion .github/styles/Microsoft/Accessibility.yml
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
# doesnt seem relevant to these docs
extends: existence
message: "Don't use language (such as '%s') that defines people by their disability."
message:
"Don't use language (such as '%s') that defines people by their disability."
link: https://docs.microsoft.com/en-us/style-guide/a-z-word-list-term-collections/term-collections/accessibility-terms
level: suggestion
ignorecase: true
Expand Down
1 change: 1 addition & 0 deletions .github/styles/Microsoft/Acronyms.yml.disabled
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
# copied to graphile/acronyms
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
#disabled
extends: existence
message: "Remove '%s' if it's not important to the meaning of the statement."
link: https://docs.microsoft.com/en-us/style-guide/word-choice/use-simple-words-concise-sentences
Expand Down
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
#disabled
extends: substitution
message: "Use '%s' instead of '%s'."
link: https://docs.microsoft.com/en-us/style-guide/word-choice/use-contractions
Expand Down
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
#disabled
extends: existence
message: "Remove the spaces around '%s'."
link: https://docs.microsoft.com/en-us/style-guide/punctuation/dashes-hyphens/emes
Expand Down
Original file line number Diff line number Diff line change
@@ -1,8 +1,11 @@
#disabled
extends: existence
message: Use 'July 31, 2016' format, not '%s'.
link: https://docs.microsoft.com/en-us/style-guide/a-z-word-list-term-collections/term-collections/date-time-terms
ignorecase: true
level: error
nonword: true
tokens:
- '\d{1,2} (?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)|May|Jun(?:e)|Jul(?:y)|Aug(?:ust)|Sep(?:tember)?|Oct(?:ober)|Nov(?:ember)?|Dec(?:ember)?) \d{4}'
- '\d{1,2}
(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)|May|Jun(?:e)|Jul(?:y)|Aug(?:ust)|Sep(?:tember)?|Oct(?:ober)|Nov(?:ember)?|Dec(?:ember)?)
\d{4}'
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
#disabled
extends: existence
message: "In general, don't use an ellipsis."
link: https://docs.microsoft.com/en-us/style-guide/punctuation/ellipses
Expand Down
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
#disabled
extends: existence
message: "Use first person (such as '%s') sparingly."
link: https://docs.microsoft.com/en-us/style-guide/grammar/person
Expand Down
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
#disabled
extends: substitution
message: "Use '%s' instead of '%s'."
link: https://docs.microsoft.com/en-us/style-guide/word-choice/use-us-spelling-avoid-non-english-words
Expand Down
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
#disabled
extends: existence
message: "For a general audience, use 'address' rather than 'URL'."
link: https://docs.microsoft.com/en-us/style-guide/urls-web-addresses
Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
#disabled
extends: existence
message: "Avoid using acronyms in a title or heading."
link: https://docs.microsoft.com/en-us/style-guide/acronyms#be-careful-with-acronyms-in-titles-and-headings
level: warning
scope: heading
tokens:
- '[A-Z]{2,4}'
- "[A-Z]{2,4}"
1 change: 1 addition & 0 deletions .github/styles/Microsoft/Headings.yml.disabled
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
#copied to Graphile/Headings.yml
2 changes: 2 additions & 0 deletions .github/styles/Microsoft/Hyphens.yml
Original file line number Diff line number Diff line change
Expand Up @@ -12,3 +12,5 @@ action:
- " "
tokens:
- '\b[^\s-]+ly-\w+\b'
exceptions:
- strongly-typed
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
#disabled
extends: existence
message: "'%s' looks like passive voice."
ignorecase: true
Expand Down
2 changes: 1 addition & 1 deletion .github/styles/Microsoft/Quotes.yml
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
extends: existence
message: 'Punctuation should be inside the quotes.'
message: "Punctuation should be inside the quotes."
link: https://docs.microsoft.com/en-us/style-guide/punctuation/quotation-marks
level: error
nonword: true
Expand Down
Original file line number Diff line number Diff line change
@@ -1,8 +1,9 @@
#disabled
extends: existence
message: "Try to simplify this sentence."
link: https://docs.microsoft.com/en-us/style-guide/punctuation/semicolons
nonword: true
scope: sentence
level: suggestion
tokens:
- ';'
- ";"
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
#disabled
extends: occurrence
message: "Try to keep sentences short (< 30 words)."
scope: sentence
level: suggestion
max: 30
token: \b(\w+)\b

4 changes: 2 additions & 2 deletions .github/styles/Microsoft/Spacing.yml
Original file line number Diff line number Diff line change
Expand Up @@ -4,5 +4,5 @@ link: https://docs.microsoft.com/en-us/style-guide/punctuation/periods
level: error
nonword: true
tokens:
- '[a-z][.?!] {2,}[A-Z]'
- '[a-z][.?!][A-Z]'
- "[a-z][.?!] {2,}[A-Z]"
- "[a-z][.?!][A-Z]" #disabled as some headings use methods
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
#disabled
extends: existence
message: "Verify your use of '%s' with the A-Z word list."
link: 'https://docs.microsoft.com/en-us/style-guide'
link: "https://docs.microsoft.com/en-us/style-guide"
level: suggestion
ignorecase: true
tokens:
Expand Down
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
#disabled
extends: existence
message: "Try to avoid using first-person plural like '%s'."
link: https://docs.microsoft.com/en-us/style-guide/grammar/person#avoid-first-person-plural
Expand Down
21 changes: 21 additions & 0 deletions .github/styles/config/vocabularies/Graphile/accept.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
tamedevil
performant
substring
autofix
ESLint
[Gg]raphile
[Gg]rafast
PostGraphile
middleware
[Cc]onfig
Gra
[Ee]val
EXPORTABLEs
untrusted
PostGraphQL
subcommand
namespace
booleans
preprocessor
unformatted
autofixed
Empty file.
4 changes: 3 additions & 1 deletion .vale.ini
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
StylesPath = .github/styles

Vocab = Graphile

MinAlertLevel = suggestion

Packages = Microsoft, MDX
Expand All @@ -14,4 +16,4 @@ Packages = Microsoft, MDX
# Markdown and reStructuredText:
#
# [*.{md,rst}]
BasedOnStyles = Vale, Microsoft
BasedOnStyles = Vale, Microsoft, Graphile
6 changes: 3 additions & 3 deletions utils/website/graphile-config/preset.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ sidebar_position: 2
title: Preset
---

# GraphileConfig.Preset
# `GraphileConfig.Preset`

_Target Audience: all Graphile Config users ⚙️🔌📚_

Expand Down Expand Up @@ -208,7 +208,7 @@ following implications:

:::warning Order of composition is important

Consider a preset, APreset, that extends two other presets: Preset1 and Preset2,
Consider a preset, `APreset`, that extends two other presets: Preset1 and Preset2,
each of which `extends` the same preset, Preset0:

```ts
Expand All @@ -218,7 +218,7 @@ const Preset2 = { extends: [Preset0], myScope: { option2: true } };
const APreset = { extends: [Preset1, Preset2] };
```

Any overrides to the options set in Preset0 by Preset1 will be reset in APreset
Any overrides to the options set in Preset0 by Preset1 will be reset in `APreset`
since they will be overridden when Preset2 applies the Preset0 options again:

```ts
Expand Down
4 changes: 2 additions & 2 deletions utils/website/graphile-export/exportable.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ made in such a way that it can work with Graphile Export. This applies both to
the parts of the schema you write yourself, and the parts you may import from
external libraries.

Generally speaking there are 2 methods of acheiving this, used in unison:
Generally speaking there are 2 methods of achieving this, used in unison:

1. All non-pure functions and their non-trivial scope dependencies must be made
exportable by wrapping in an `EXPORTABLE()` call, or be made importable via
Expand Down Expand Up @@ -262,7 +262,7 @@ export const preset: GraphileConfig.Preset = {

## Troubleshooting

### undefined variable `EXPORTABLE`
### `undefined variable EXPORTABLE`

Our ESLint plugin isn't smart enough to actually `import` the `EXPORTABLE`
helper, so after running the autofix you might end up with "undefined variable
Expand Down
2 changes: 1 addition & 1 deletion utils/website/pg-sql2/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -69,4 +69,4 @@ This is a replacement for [@calebmer's pg-sql](https://www.npmjs.com/package/pg-
- Better development experience for people not using TypeScript (throws errors a lot earlier allowing you to catch issues at the source)
- Slightly more helpful error messages
- Uses a symbol-key on the query nodes to protect against an object accidentally being inserted verbatim and being treated as valid (because every Symbol is unique an attacker would need control of the code to get a reference to the Symbol in order to set it on an object (it cannot be serialised/deserialised via JSON or any other medium), and if the attacker has control of the code then you've already lost)
- Adds `sql.literal` which is similar to `sql.value` but when used with simple values can write the valid direct to the SQL statement. **USE WITH CAUTION**. The purpose for this is if you are using _trusted_ values (e.g. for the keys to [`json_build_object(...)`](https://www.postgresql.org/docs/9.6/static/functions-json.html)) then debugging your SQL becomes a lot easier because fewer placeholders are used.
- Adds `sql.literal` which is similar to `sql.value` but when used with simple values can write the valid direct to the SQL statement. **Use with caution**. The purpose for this is if you are using _trusted_ values (e.g. for the keys to [`json_build_object(...)`](https://www.postgresql.org/docs/9.6/static/functions-json.html)) then debugging your SQL becomes a lot easier because fewer placeholders are used.
4 changes: 2 additions & 2 deletions utils/website/tamedevil/api/te-safe-key-or-throw.md
Original file line number Diff line number Diff line change
Expand Up @@ -20,5 +20,5 @@ this is intended to be used with relatively straightforward strings
`const obj = { ${te.safeKeyOrThrow(untrustedKey)}: value }` you instead use
`const obj = Object.create(null);` and then set the properties on the resulting
object via `${obj}[${te.lit(untrustedKey)}] = value;` - this prevents attacks
such as **prototype polution** since properties like `__proto__` are not special
on null-prototype objects, whereas they can cause havok in regular `{}` objects.
such as **prototype pollution** since properties like `__proto__` are not special
on null-prototype objects, whereas they can cause havoc in regular `{}` objects.
4 changes: 2 additions & 2 deletions utils/website/tamedevil/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ title: tamedevil
**Eval is evil, this module helps tame it!**

It's generally recommended that you don't use `eval` or `new Function` when
writing JavaScript/TypeScript code. There's many many reasons for this, here are
writing JavaScript/TypeScript code. There's many reasons for this, here are
but a few:

- **code injection**: without sufficient caution, attackers could inject
Expand All @@ -23,7 +23,7 @@ but a few:
However, `eval` and `new Function` can be powerful tools for building performant
code - if you have a list of operations to perform, it may be much more
performant to build a dynamic function to evaluate those operations at native JS
speed rather than to build your own interpretter.
speed rather than to build your own interpreter.

`tamedevil` makes it much safer to build this kind of dynamic function, by
ensuring that every string and substring that is to be evaluated is either code
Expand Down

0 comments on commit 2c830b0

Please sign in to comment.