-
-
Notifications
You must be signed in to change notification settings - Fork 82
Open
Description
Describe the feature
Harden tools/src/main/js/linter/checks/enum-value-formatting.check.js so meta:enum handling is deterministic and lint output is accurate/noise-free (especially for edge-case inputs).
Use-cases
- Schemas that correctly use
meta:enumshould not trigger false positives (e.g., “missing description” when the key exists). - Schemas with malformed
meta:enum(wrong type, inherited properties) should produce a clear error instead of silent/incorrect behavior. - Reports should point to the correct location (
meta:enumpaths), and duplicate enum literals should not generate duplicate issues.
Scope / Out of scope
- Scope: this single check file only.
- Out of scope: changing the public API/config of the linter; adding new dependencies.
Possible solutions
Proposed changes (all within the check):
-
Use own-property detection for
meta:enumon the parent:- Replace
'meta:enum' in parentwithObject.prototype.hasOwnProperty.call(parent, 'meta:enum')
to avoid consulting the prototype chain (hardens the check against prototype-chain manipulation,
including prototype-pollution scenarios).
- Replace
-
Validate
meta:enumtype before using it:- Require a plain object (non-null object, not array, prototype is
Object.prototypeornull). - If present but invalid, emit one ERROR:
- Message:
meta:enum must be a plain object mapping enum values to descriptions. - Context:
actualType(arrayortypeof).
- Message:
- Require a plain object (non-null object, not array, prototype is
-
Fix coverage logic:
- Replace
!metaEnum[value]with!Object.prototype.hasOwnProperty.call(metaEnum, value)to test key presence only. - Avoid counting inherited keys as “present”.
- Replace
-
Fix path reporting:
- Avoid literal
"undefined"/"null"paths by using a safe fallback for paths. - Derive a single
metaEnumBasePathby replacing trailing.enumwith.meta:enum(and handle root / fallback cases). - Report “missing description” at the
meta:enumlocation, not the enum array.
- Avoid literal
-
De-duplicate enum-value checks:
- Iterate over unique string values (Set) so duplicate enum literals don't emit duplicate issues.
Additional context
- File:
tools/src/main/js/linter/checks/enum-value-formatting.check.js - Current implementation: https://github.com/CycloneDX/specification/blob/2.0-dev/tools/src/main/js/linter/checks/enum-value-formatting.check.js
Reactions are currently unavailable