{"action":"created","issue":{"url":"https://api.github.com/repos/codeclimate/codeclimate-eslint/issues/86","repository_url":"https://api.github.com/repos/codeclimate/codeclimate-eslint","labels_url":"https://api.github.com/repos/codeclimate/codeclimate-eslint/issues/86/labels{/name}","comments_url":"https://api.github.com/repos/codeclimate/codeclimate-eslint/issues/86/comments","events_url":"https://api.github.com/repos/codeclimate/codeclimate-eslint/issues/86/events","html_url":"https://github.com/codeclimate/codeclimate-eslint/issues/86","id":144054249,"number":86,"title":"Support external ESLint configs","user":{"login":"caiges","id":7320,"avatar_url":"https://avatars1.githubusercontent.com/u/7320?v=3","gravatar_id":"","url":"https://api.github.com/users/caiges","html_url":"https://github.com/caiges","followers_url":"https://api.github.com/users/caiges/followers","following_url":"https://api.github.com/users/caiges/following{/other_user}","gists_url":"https://api.github.com/users/caiges/gists{/gist_id}","starred_url":"https://api.github.com/users/caiges/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/caiges/subscriptions","organizations_url":"https://api.github.com/users/caiges/orgs","repos_url":"https://api.github.com/users/caiges/repos","events_url":"https://api.github.com/users/caiges/events{/privacy}","received_events_url":"https://api.github.com/users/caiges/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":13,"created_at":"2016-03-28T19:03:12Z","updated_at":"2017-03-13T18:53:20Z","closed_at":"2016-08-23T15:54:39Z","body":"For my organization's projects and my own I use an external npm package that houses my eslint config. It would be nice to support this workflow as eslint configs change slowly so sharing via npm package or similar means is a fairly common practice. This workflow is described in ESLint's [shareable configs](http://eslint.org/docs/developer-guide/shareable-configs) documentation.\n"},"comment":{"url":"https://api.github.com/repos/codeclimate/codeclimate-eslint/issues/comments/286207367","html_url":"https://github.com/codeclimate/codeclimate-eslint/issues/86#issuecomment-286207367","issue_url":"https://api.github.com/repos/codeclimate/codeclimate-eslint/issues/86","id":286207367,"user":{"login":"pbrisbin","id":50812,"avatar_url":"https://avatars0.githubusercontent.com/u/50812?v=3","gravatar_id":"","url":"https://api.github.com/users/pbrisbin","html_url":"https://github.com/pbrisbin","followers_url":"https://api.github.com/users/pbrisbin/followers","following_url":"https://api.github.com/users/pbrisbin/following{/other_user}","gists_url":"https://api.github.com/users/pbrisbin/gists{/gist_id}","starred_url":"https://api.github.com/users/pbrisbin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pbrisbin/subscriptions","organizations_url":"https://api.github.com/users/pbrisbin/orgs","repos_url":"https://api.github.com/users/pbrisbin/repos","events_url":"https://api.github.com/users/pbrisbin/events{/privacy}","received_events_url":"https://api.github.com/users/pbrisbin/received_events","type":"User","site_admin":false},"created_at":"2017-03-13T18:53:20Z","updated_at":"2017-03-13T18:53:20Z","body":"Hi @aaroncraig10e, sorry this is causing you headaches.\r\n\r\n> The assertion that by refusing to run eslint plugins that you haven't vetted somehow protects an ignorant developer from having their source code stolen is dubious at best as it assumes that the developer in question isn't running eslint checks on their own local machine, where the evil plugin could do all the damage it wanted well before hitting your service.\r\n\r\nNo one's made this assertion and what you describe is not at all our motivation.\r\n\r\n> It's not that we specifically want to prevent npm package installs, we want to prevent a malicious **engine** from `tar`ing your project onto an attacker's server. We prevent this today by restricting networking; **preventing npm package installs is an unfortunate side-effect**.\r\n\r\nOur stance is that there is security risk with allowing engines to make network calls. Running a shared plugin that's not pre-installed requires a network call to install it. Therefore, we cannot run plugins that are not pre-installed in the engine image.\r\n\r\nWe do not \"vet\" the plugins. We just limit what we pre-install to those with reasonable adoption. This is just a trade off between the value of having the plugin there (dependent on how many users would use it) and impact of having a larger image to operate (which can impact run and deploy time for everyone).\r\n\r\nNow, the `import-resolver`-class plugins actually have their own, completely separate issue. Unfortunately, these plugins are incompatible with the way Code Climate Engines are run because they make assumptions about the file system which are not true when run as an Engine. We at one point [added](https://github.com/codeclimate/codeclimate-eslint/pull/145) just that plugin, but had to [remove](https://github.com/codeclimate/codeclimate-eslint/pull/148) it later.\r\n\r\n> I currently have to go through and manually mark 100s of resolver errors as invalid.\r\n\r\nHave you considered ignoring those check(s) via `.codeclimate.yml`?\r\n\r\nI hope this reply helped clarify some things."}}
{"actor":{"display_login":"pbrisbin"}}