让开源，少一点语言距离。
npm包中文文档

@devexpress/eslint-plugin-dx-security

中文文档
0.2.11发布于 2026/11/02MITES Module近 30 天下载 1.9万

An ESLint® plugin that detects and mitigates security-related issues for DevExpress projects.

原始使用文档
中文原文
文档目录9 节
  1. Prerequisites / Dependencies
  2. Installation
  3. Key Features
  4. Built-in Rules
  5. Microsoft Security Development Lifecycle Rules
  6. React Rules
  7. ASPX Directive Stripping
  8. Usage Examples
  9. Related Packages

ESLint® Plugin for Security-Related Issue Detection/Mitigation for DevExpress Projects

An ESLint® plugin that detects and mitigates security-related issues for DevExpress projects.

⚠️ Important: This package is intended for internal use only. It may contain limitations and should not be used in mission-critical software applications.

Prerequisites / Dependencies

ESLint v9+.

Installation

npm install --save-dev @devexpress/eslint-plugin-dx-security

Key Features

  • Security-focused rule set
  • JSX parsing support for *.jsx and *.tsx files
  • ASPX directive stripping processor for *.js files
  • Optional violation filter for third-party rules

Built-in Rules

RuleSeverity
no-callererror
no-evalerror
no-implied-evalerror
no-new-funcerror

Microsoft Security Development Lifecycle Rules

RuleSeverity
@microsoft/sdl/no-angular-bypass-sanitizererror
@microsoft/sdl/no-angularjs-bypass-sceerror
@microsoft/sdl/no-angularjs-enable-svgerror
@microsoft/sdl/no-angularjs-sanitization-whitelisterror
@microsoft/sdl/no-document-domainerror
@microsoft/sdl/no-electron-node-integrationerror
@microsoft/sdl/no-msapp-exec-unsafeerror
@microsoft/sdl/no-postmessage-star-originerror
@microsoft/sdl/no-unsafe-allocerror
@microsoft/sdl/no-winjs-html-unsafeerror

React Rules

RuleSeverity
react/iframe-missing-sandboxerror
react/no-dangererror

redos rules

RuleSeverity
redos/no-vulnerableerror (exponential)

security rules

RuleSeverity
security/detect-buffer-noasserterror
security/detect-child-processerror
security/detect-disable-mustache-escapeerror
security/detect-new-buffererror
security/detect-no-csrf-before-method-overrideerror

ASPX Directive Stripping

The strip-aspx-directives processor automatically removes ASP.NET server-side directives before ESLint parses a *.js file. This action prevents syntax errors in JavaScript files that embed server-rendered values.

Substitution rules:

InputOutputDescription
'<% … %>'''Clears directive content enclosed in single quotes.
"<% … %>"""Clears directive content enclosed in double quotes.
<% … %>""Replaces unenclosed directive with an empty double-quoted string.

Usage Examples

Use one of the following configs to activate the plugin:

  • required

    Add this config to eslint.config.mjs to enforce security rules across all files:

    import dxSecurity from '@devexpress/eslint-plugin-dx-security';

export default [
  ...dxSecurity.configs.required,
];

  • required-exclusive

    This config suppresses ESLint rules defined by other plugins (including eslint-disable comments). Use it to disable rules that may interfere with security checks.

    import dxSecurity from '@devexpress/eslint-plugin-dx-security';

export default [
  ...dxSecurity.configs['required-exclusive'],
];

版本与发布记录

@devexpress/eslint-plugin-dx-security 共发布 7 个版本，首次发布于 2026/03/11；过去 12 个月发布了 7 个版本。

版本发布日期距今
0.2.11latest2026/11/029 天前
0.2.102026/09/112 个月前
0.2.92026/09/042 个月前
0.2.82026/08/103 个月前
0.2.72026/07/313 个月前
0.2.62026/03/118 个月前

关于 @devexpress/eslint-plugin-dx-security 的常见问题

@devexpress/eslint-plugin-dx-security 是什么？

An ESLint® plugin that detects and mitigates security-related issues for DevExpress projects.

如何安装 @devexpress/eslint-plugin-dx-security？

在项目目录运行 npm install @devexpress/eslint-plugin-dx-security，或使用 pnpm add / yarn add / bun add。它还需要宿主项目提供 peer 依赖：eslint（^8 || ^9.7 || ^10）。npm 7 及以上与 pnpm 8 及以上默认会自动安装必需的 peer 依赖，Yarn 需要手动安装。

@devexpress/eslint-plugin-dx-security 支持 TypeScript 吗？

该包的 package.json 没有声明类型入口。需要类型提示时，可以在 npm 上查找社区维护的 @types/devexpress__eslint-plugin-dx-security 是否存在。

@devexpress/eslint-plugin-dx-security 支持 ESM 还是 CommonJS？

以 ES Module 形式发布，推荐使用 import 引入。在 CommonJS 项目中，Node.js 20.19+ / 22.12+ 可以直接 require() 不含顶层 await 的 ES Module，更早的版本需要改用动态 import()。

@devexpress/eslint-plugin-dx-security 可以商用吗？

@devexpress/eslint-plugin-dx-security 使用 MIT 许可。宽松许可：允许商业使用、修改和再分发，通常只需在分发时保留原版权与许可声明。以上为概括，不构成法律意见，请以许可原文为准。

@devexpress/eslint-plugin-dx-security 的下载量有多少？

根据 npm 官方下载统计，@devexpress/eslint-plugin-dx-security 在 2026/10/12 – 2026/11/10 这 30 天内被下载 18,551 次，日均约 618 次。下载量会把 CI 构建、镜像同步和作为其他包依赖的安装一并计入，适合横向比较热度，不能直接等同于使用人数。

@devexpress/eslint-plugin-dx-security 还在维护吗？

最新版本 0.2.11 发布于 2026/11/02（9 天前）；至今共发布 7 个版本，其中过去 12 个月发布了 7 个；首次发布于 2026/03/11。发布频率只是参考信号：功能稳定的工具可能很少需要更新，建议结合源码仓库的 issue 和提交记录判断。