Rules Hub
Coding Rules Library
Rule priority, scope & exceptions
Use this to align rules with the senior-level structure (P0/P1/P2, scope, exceptions/tradeoffs).
Keep security-sensitive code identical across test and prod
Do not branch a security-sensitive serializer/escaper for test vs production. Keep the shared filter byte-for-byte identical in both, and apply any test-only readability transform (e.g. pretty-printing) in the test layer so what you assert on is the same code that ships.
Bad example
| 1 | export const safeJsonLd = isTest |
| 2 | ? (o) => prettyFormat(escape(JSON.stringify(o))) |
| 3 | : (o) => escape(JSON.stringify(o)); |
| 4 | // the escaping path now differs between test and prod |
Explanation (EN)
Branching the shared filter means tests exercise a different code path than production, so a regression in the escaping logic can pass tests while shipping a vulnerability.
Objašnjenje (HR)
Grananje zajednickog filtra znaci da testovi izvrsavaju drugaciji put koda nego produkcija, pa regresija u logici escapeanja moze proci testove dok se ranjivost objavi.
Good example
| 1 | export const safeJsonLd = (o) => escape(JSON.stringify(o)); |
| 2 |
|
| 3 | // in the snapshot test only: |
| 4 | expect(prettyPrintJsonLd(safeJsonLd(node))).toMatchSnapshot(); |
Explanation (EN)
The shipped filter is the only escaper; the test formats its output purely for readable diffs without altering the path under test.
Objašnjenje (HR)
Objavljeni filtar je jedini escaper; test formatira njegov izlaz samo radi citljivih diffova bez mijenjanja puta koji se testira.