Swaps oxlint's mimalloc global allocator for one that counts allocations and bytes, and prints the totals to stderr on exit. Used to measure allocation impact of linter changes.
Apply counting-allocator.diff (against apps/oxlint/src/lib.rs and apps/oxlint/src/main.rs).
Branch: claude/perf-combined (04e717e8) — an octopus merge of the six
open perf PRs into main (9b078038):
| PR | Branch | Change |
|---|---|---|
| #3290 | claude/perf-locale-lookup |
Memoized I18n.locale_available? in Config.locale |
| #3294 | claude/perf-numerify |
Single-pass, per-digit-allocation-free Base.numerify |
| #3289 | claude/perf-fetch-parse |
Fast paths in Base.fetch/fetch_all/parse, Name.first_name |
This vulnerability was fixed by https://github.com/mruby/mruby/commit/5e8a65457dc8a3e06b1a17dd482a18be382ad3fc, it was not accepted as a security vulnerability in the context of the scope defined by the project's SECURITY.md (which is fair!), so I am publishing the report here for future reference.
At the least, this is a Denial of Service/process crashing vulnerability, but I've also managed to demonstrate arbitrary memory read (with some constraints, though fully arbitrary read seems like it is possible) from pure Ruby. An untrusted script can read the full contents of a heap object it holds no reference to, deterministically. It is also able to write unreferenced objects, though the severity of this aspect is thus far limited, as it is not full arbitrary write as far as I understand.
I have had Claude iterate over it and attempt to find a path to full arbitrary write / RCE after it proposed such a thing was plausible, but it hasn't managed to demonstrate those thus far. I am unsure whether that'd b
| #!/bin/bash | |
| # .claude/hooks/enforce-vp-config.sh | |
| # Block creation/editing of standalone oxlint/oxfmt config files. | |
| # NOTE: MAKE SURE TO USE `chmod +x` ON THIS FILE SO IT IS EXECUTABLE! | |
| INPUT=$(cat) | |
| FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty') | |
| BASENAME=$(basename "$FILE_PATH" 2>/dev/null) |
| #!/usr/bin/env node | |
| import fs from 'fs'; | |
| import path from 'path'; | |
| import { createESLintLinter, loadTargetPluginRules, getTypeScriptDisabledRules } from '../tasks/lint_rules/src/eslint-rules.mjs'; | |
| function findFiles(dir, pattern = /.rs$/) { | |
| const out = []; | |
| for (const entry of fs.readdirSync(dir, { withFileTypes: true })) { | |
| const full = path.join(dir, entry.name); | |
| if (entry.isDirectory()) out.push(...findFiles(full, pattern)); |
This guide is intended to help migrate projects from Prettier to oxfmt.
Note that oxfmt is in alpha, and may not be suitable for production use in complex setups.
The oxfmt alpha only supports formatting JavaScript and TypeScript files (including JSX syntax). If you need support for other languages like JSON, YAML, or Markdown, you may want to wait.
| #!/usr/bin/env node | |
| import { createESLintLinter, loadTargetPluginRules } from "./eslint-rules.mjs"; | |
| import { | |
| createRuleEntries, | |
| updateImplementedStatus, | |
| updateNotSupportedStatus, | |
| updatePendingFixStatus, | |
| overrideTypeScriptPluginStatusWithEslintPluginStatus, | |
| syncVitestPluginStatusWithJestPluginStatus, | |
| syncUnicornPluginStatusWithEslintPluginStatus, |
| [ | |
| { | |
| "scope": "eslint", | |
| "value": "array-callback-return", | |
| "category": "pedantic", | |
| "type_aware": false, | |
| "has_fix": false, | |
| "docs_url": "https://oxc.rs/docs/guide/usage/linter/rules/eslint/array-callback-return.html" | |
| }, | |
| { |
NOTE: This assumes you have oxc and mastodon cloned into the ~/code directory specifically, adjust the directions accordingly for whatever directory you store your git repositories.
Setup:
git clone https://github.com/mastodon/mastodongit clone https://github.com/oxc-project/oxcoxlint-dist/ to hold the built oxc files.
These QIDs were created from Steam games. The following are the QuickStatements batches for these items: