openedx / openedx/openedx-platform
Script to print xsslint violations is missing
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.2k
- Forks
- 4.4k
- Avg merge
- 6d 18h
- Merged PRs (30d)
- 42
Description
This was discovered as an existing issue while working on https://github.com/openedx/edx-platform/pull/35159
When xsslint detects a violation beyond the forgiven thresholds, rather than printing anything helpful, it fails with:
python scripts/xsslint/xss_linter.py \
--rule-totals \
--config=scripts.xsslint_config \
--thresholds=scripts/xsslint_thresholds.json
xsslint
FAILURE: XSSLinter Failed.
Too many violations total (65).
The limit is 64.
Too many python-concat-html violations (1).
The python-concat-html limit is 0.
run the following command to hone in on the problem:
./scripts/xss-commit-linter.sh -h
make: *** [Makefile:176: xsslint] Error 1
The script it tells you to run, ./scripts/xss-commit-linter.sh -h, does not exist.
We should provide the dev some way of seeing violations. Or, maybe we just print the violations every single time, like eslint does.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with scripts/xsslint/xss_linter.py and the xsslint target in Makefile, then reproduce the failure using the command shown in the issue. Check how the missing scripts/xss-commit-linter.sh is referenced and verify that the completed change exposes the XSSLint violations when thresholds are exceeded.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python, shell
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100