spikerj/spikersoft-issues
1
0
Fork 0
Code Issues 196 Pull Requests Actions Packages Projects Releases Wiki Activity

Sonar: exclude vendored interpreter.js (JS-Interpreter) from analysis #730

New Issue
Closed
opened 2026-07-20 03:46:39 +00:00 by spikerj · 1 comment
spikerj commented 2026-07-20 03:46:39 +00:00
Owner
Copy Link
Copy Source

Summary

projects/spikersoft/src/assets/scripts/interpreter.js is a vendored third-party library — Neil Fraser's JS-Interpreter (Apache-2.0, © 2013), used for sandboxed JS execution. It is not our code, yet it is analyzed by SonarQube and generates 11 reliability findings that are all intrinsic to that engine:

  • 9× javascript:S2137 (re-declares Function/Object/Array/String/Boolean/Number/Date/RegExp/Error to build the sandbox global environment) — lines 645, 816, 1075, 1581, 1832, 1856, 1941, 2019, 2156
  • 1× javascript:S3403 (=== on differing types) — line 3796
  • 1× javascript:S905 (expression statement) — line 3655

Its sibling parser acorn.js in the same assets/scripts/ directory is already in sonar.exclusions — interpreter.js was simply missed when that list was written (see existing exclusion note referencing #250).

Fix

Add **/assets/scripts/interpreter.js to sonar.exclusions in sonar-project.properties, matching the existing vendored-code exclusion pattern. This clears the 11 findings at the source and prevents regeneration. No runtime/app-build impact (Sonar-analysis scope only).

SonarQube

Project learn.spikersoft.com — https://sonarqube.spikersoft.com/dashboard?id=learn.spikersoft.com
The 11 findings were marked accept (vendored, not our code) pending this exclusion.

Filed from the SonarQube reliability-backlog triage loop.

### Summary `projects/spikersoft/src/assets/scripts/interpreter.js` is a **vendored third-party** library — Neil Fraser's [JS-Interpreter](https://github.com/NeilFraser/JS-Interpreter) (Apache-2.0, © 2013), used for sandboxed JS execution. It is not our code, yet it is analyzed by SonarQube and generates 11 reliability findings that are all intrinsic to that engine: - 9× `javascript:S2137` (re-declares `Function`/`Object`/`Array`/`String`/`Boolean`/`Number`/`Date`/`RegExp`/`Error` to build the sandbox global environment) — lines 645, 816, 1075, 1581, 1832, 1856, 1941, 2019, 2156 - 1× `javascript:S3403` (`===` on differing types) — line 3796 - 1× `javascript:S905` (expression statement) — line 3655 Its sibling parser **`acorn.js` in the same `assets/scripts/` directory is already in `sonar.exclusions`** — `interpreter.js` was simply missed when that list was written (see existing exclusion note referencing #250). ### Fix Add `**/assets/scripts/interpreter.js` to `sonar.exclusions` in `sonar-project.properties`, matching the existing vendored-code exclusion pattern. This clears the 11 findings at the source and prevents regeneration. No runtime/app-build impact (Sonar-analysis scope only). ### SonarQube Project `learn.spikersoft.com` — https://sonarqube.spikersoft.com/dashboard?id=learn.spikersoft.com The 11 findings were marked **accept** (vendored, not our code) pending this exclusion. _Filed from the SonarQube reliability-backlog triage loop._
spikerj commented 2026-07-21 19:38:41 +00:00
Author
Owner
Copy Link
Copy Source

Resolved in spikersoft-angular PR #455 (merged): interpreter.js + serialize.js added to sonar.exclusions alongside acorn.js — clears the ~561 vendored findings on next scan. Closing.

Resolved in spikersoft-angular PR #455 (merged): interpreter.js + serialize.js added to sonar.exclusions alongside acorn.js — clears the ~561 vendored findings on next scan. Closing.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
agentic
Actionable surfaced by the agentic architecture & security review
 bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 sonarqube
Code quality issue surfaced by SonarQube (bug / code smell)
 wontfix
This won't be fixed
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
spikerj (Joseph Spiker)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: spikerj/spikersoft-issues#730