Registry / testing / eslint-plugin-no-unsafe-regex

eslint-plugin-no-unsafe-regex

library1.0.0jsnpmunverified

ESLint plugin that disallows potentially unsafe regular expressions. Version 1.0.0, stable. Uses the `safe-regex` library to detect regex patterns vulnerable to ReDoS attacks, such as nested quantifiers. Integrates as an ESLint plugin with a single rule `no-unsafe-regex/no-unsafe-regex`. Differentiates from other regex linting by focusing solely on security/performance, not style. Only validates regex literals and RegExp constructor with literal arguments. Regular maintenance, no known issues.

testing

npm install eslint-plugin-no-unsafe-regex

github ↗package ↗

INSTALL

IMPORT

SIG · ESLINT-PLUGIN-NO-U

eslint-plugin-no-unsafe-regex

testingjavascriptv1.0.0

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

plugin

✓ const plugin = require('eslint-plugin-no-unsafe-regex');

CommonJS require; package has no default export for ESM.

no-unsafe-regex rule

✓ // in .eslintrc: { rules: { 'no-unsafe-regex/no-unsafe-regex': 'error' } }

✗ rules: { 'no-unsafe-regex': 'error' }

Rule must be prefixed with the plugin name when using ESLint plugins.

Plugin reference

✓ // in .eslintrc: { plugins: ['no-unsafe-regex'] }

✗ plugins: ['eslint-plugin-no-unsafe-regex']

ESLint automatically resolves the 'eslint-plugin-' prefix; just use the short name.

Configures ESLint to use the no-unsafe-regex plugin and enable its rule as an error.

module.exports = { plugins: ['no-unsafe-regex'], rules: { 'no-unsafe-regex/no-unsafe-regex': 'error' } };

Debug

Known issues

gotchaThe plugin only validates regex literals (e.g., /pattern/) and RegExp constructor with literal string arguments. It does not validate regex created from variables or dynamic strings.

fix

Ensure that unsafe patterns are not built dynamically or manually review dynamic regex.

affects: >=0

gotchaThe rule may produce false positives for complex but safe regex patterns, as the underlying safe-regex library uses a heuristic.

fix

If a false positive is encountered, consider disabling the rule for that specific line using an ESLint comment.

affects: >=0

deprecatedThis plugin has not been updated since 2015 and may not be compatible with newer ESLint versions.

fix

Consider using eslint-plugin-security instead which also covers unsafe regex.

affects: >=0

Errors

Common errors & fixes

Error: Cannot find module 'safe-regex'

Missing dependency safe-regex.

fix

Run 'npm install safe-regex' or check node_modules.

Configuration for rule "no-unsafe-regex" is invalid: Definition for rule 'no-unsafe-regex' was not found.

Rule used without plugin prefix or plugin not registered.

fix

Use 'no-unsafe-regex/no-unsafe-regex' and add 'no-unsafe-regex' to plugins.

ESLint couldn't find the plugin "eslint-plugin-no-unsafe-regex".

Plugin not installed or wrong name in plugins array.

fix

Install via npm and use short name 'no-unsafe-regex' in plugins.

Upgrade

Version history

1.0.0latest on npm

Audit

Dependencies

safe-regexrequiredruntime dependency used to detect unsafe regex patterns

Agent activity

2 hits · last 30 days

node

Resources

githubhttps://github.com/kgryte/eslint-plugin-no-unsafe-regex ↗

packagehttps://www.npmjs.com/package/eslint-plugin-no-unsafe-regex ↗