[BUG] Danger taking comments as modified files about danger-js

[orta]

Wow, that's a pretty strange one - I wonder if the npm module parse-diff is struggling with this specific PR shape. We pass the diff from GitHub to that library to generate the list of files:

https://github.com/danger/danger-js/blob/main/source/platforms/git/diffToGitJSONDSL.ts#L1-L25C2

Maybe try use yarn resolves to see if a later version of the dependency fixes it?

[orta]

It is a special sequence in a diff: https://patch-diff.githubusercontent.com/raw/reactjs/react.dev/pull/6120.diff

So, yep, parse-diff is really where you want to be looking here IMO

diff --git a/src/components/Layout/Footer.tsx b/src/components/Layout/Footer.tsx
index 4d0b066461f..cd0cf25793c 100644
--- a/src/components/Layout/Footer.tsx
+++ b/src/components/Layout/Footer.tsx

[fbartho]

@eppisapiafsl I could be wrong, but I’m pretty sure eslint-disable-next-line doesn’t support explanation comments.

/* eslint-disable-next-line no-restricted-imports */
import { useStore } from "react-redux";

Does this still exhibit your issue?

[fbartho]

I think it treats your comment as an eslint rule or plug-in that it needs to dynamically load or something.

possibly that’s even a security hole in eslint!

[eppisapiafsl]

@orta tried with latest Danger version, same issue

@fbartho Sorry, forgot to mention in the environment section. I'm using https://github.com/mysticatea/eslint-plugin-eslint-comments to force comments when disable a lint rule.

The error only happen when the file is modified, If I create a new file it works as expected

danger.git.created_files doesn't take the comment as a new file
danger.git.modified_files take the comment as a new file

[fbartho]

I'm using https://github.com/mysticatea/eslint-plugin-eslint-comments to force comments when disable a lint rule.

@eppisapiafsl That’s interesting! — I wish they could push their changes upstream to eslint. That eslint-plugin hasn’t seen any releases at all since 2019!! — Knowing what we do about the JS ecosystem, I would be shocked if that plugin didn’t have a ton of dependencies that need to be updated, and deprecated eslint APIs to change, and potentially its own security holes.

---

re: the npm-parse-diff created-vs-modified issue, your comment included the double-hyphen -- I think this is often a special sequence when passed to CLI/Shell commands (I know yarn did stuff with it) — I’m wondering if that sequence is being consumed in an improperly escaped call to a sub-shell. — @orta does that sound plausible or helpful? (Feel free to ignore if I’m trying to feed a red herring to a wild goose)