Skip to content

Enhancement: no-base-to-string -- close the String constructor loophole #6956

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
4 tasks done
pmcelhaney opened this issue Apr 25, 2023 · 1 comment
Closed
4 tasks done
Labels
duplicate This issue or pull request already exists package: eslint-plugin Issues related to @typescript-eslint/eslint-plugin

Comments

@pmcelhaney
Copy link

Before You File a Proposal Please Confirm You Have Done The Following...

My proposal is suitable for this project

  • I believe my proposal would be useful to the broader TypeScript community (meaning it is not a niche proposal).

Link to the rule's documentation

https://eslint.org/docs/latest/rules/no-restricted-syntax

Description

I've noticed folks getting around the no-base-to-string rule by using the String constructor.

Fail

// Passing an object or class instance to string concatenation:
'' + String({});

class MyClass {}
const value = new MyClass();
String(value) + '';

// Interpolation and manual .toString() calls too:
`Value: ${String(value)}`;
(String({}).toString());

Pass

// These types all have useful .toString()s
'Text' + true;
`Value: ${123}`;
`Arrays too: ${[1, 2, 3]}`;
(() => {}).toString();

// Defining a custom .toString class is considered acceptable
class CustomToString {
  toString() {
    return 'Hello, world!';
  }
}
`Value: ${new CustomToString()}`;

const literalWithToString = {
  toString: () => 'Hello, world!',
};

`Value: ${literalWithToString}`;

Additional Info

Banning the String constructor could probably be achieved through no-restricted-syntax, but I can't think of a reason anyone would use it in the first place except to get around this rule. And no-restricted-syntax doesn't mesh well with shared configs.

The built-in no-implicit-coercion rule actually encourages the use of String. It's a blunt instrument that makes sense in JavaScript, where static analysis in most cases can't guarantee that .toString() won't throw a runtime error.

The Number constructor is similarly (ab)used. I have an idea of what to do about that, but one thing at a time.

@pmcelhaney pmcelhaney added enhancement: plugin rule option New rule option for an existing eslint-plugin rule package: eslint-plugin Issues related to @typescript-eslint/eslint-plugin triage Waiting for team members to take a look labels Apr 25, 2023
@Josh-Cena
Copy link
Member

Duplicate of #4314

@Josh-Cena Josh-Cena closed this as not planned Won't fix, can't repro, duplicate, stale Apr 25, 2023
@Josh-Cena Josh-Cena added duplicate This issue or pull request already exists and removed triage Waiting for team members to take a look enhancement: plugin rule option New rule option for an existing eslint-plugin rule labels Apr 25, 2023
@github-actions github-actions bot locked as resolved and limited conversation to collaborators May 3, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
duplicate This issue or pull request already exists package: eslint-plugin Issues related to @typescript-eslint/eslint-plugin
Projects
None yet
Development

No branches or pull requests

2 participants