<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Mark Banner schrieb am 19.10.2018 um
10:12:<br>
</div>
<blockquote type="cite"
cite="mid:46dcb6b0-55f2-459b-2342-78d4e03b6e83@mozilla.com">
<p>On 12/10/2018 09:26, Óvári wrote:<br>
</p>
<blockquote type="cite"
cite="mid:1611f648-b76c-affb-884d-cad2742cd959@zoho.com">"Since
Coverity is C/C++ only, this obviously wouldn't be necessary"
[1]; however, "Projects on Coverity Scan" [2] languages: Java,
C/C++, C#, JavaScript, PHP/Python/Ruby. <br>
<br>
Isn't JavaScript [3] used in Thunderbird add-ons? <br>
</blockquote>
Yes it is, but it wasn't clear from the site that it covers
Javascript.<br>
<blockquote type="cite"
cite="mid:1611f648-b76c-affb-884d-cad2742cd959@zoho.com">Does
this mean that "Coverity Scan" could help with Thunderbird
add-ons? <br>
</blockquote>
<p>That's very unclear. There's no detailed list that I can see of
what Javascript specific defects are caught. There is a list of
general defects but they are mainly things I'd associate with
c++ or similar compiled languages.</p>
</blockquote>
<br>
Yes, there are few general language issues. Buffer overllows in JS,
for example. Just a few dangerous idioms, like code in a string
etc..<br>
<br>
Our real danger are things that are very Mozilla specific, e.g. take
stuff from network, but make it part of a URL, run the URL as
chrome, bam.<br>
<br>
<blockquote type="cite"
cite="mid:46dcb6b0-55f2-459b-2342-78d4e03b6e83@mozilla.com">
<p>Without more information on the specifics, I'd suggest that
promoting <a href="https://eslint.org/" moz-do-not-send="true">ESLint</a>
to add-on authors is more likely to be useful - there's <a
href="https://eslint.org/docs/rules/" moz-do-not-send="true">lots
of rules</a> highlighting various issues that can be
selectively enabled. For legacy/hybrid add-ons, there's <a
href="https://www.npmjs.com/package/eslint-plugin-mozilla"
moz-do-not-send="true">eslint-plugin-mozilla</a> which has the
mozilla-central configuration, and useful rules specific to
gecko.</p>
</blockquote>
<br>
I think that's a very good idea, as long as it's not enforced (by
scripts or by addon reviewers), but used merely as a hint for
developers of things to look at. It should be a service offered to
addon authors.<br>
<br>
</body>
</html>