test: security scan

- 'npm run test:redos' now scans for REDOS issues
- added a Travis stage for 'security scan'

Fixes: #1201 (a step towards it, anyway)

Author: davisjam

.travis.yml

@@ -13,6 +13,10 @@ jobs:
     - node_js: lts/*
     - node_js: node
 
+    - stage: security scan
+      script: npm run test:redos
+      node_js: lts/*
+
     - stage: lint ✨
       script: npm run test:lint
       node_js: lts/*

package-lock.json

@@ -29,6 +29,7 @@
     "eslint-plugin-node": "^5.2.1",
     "eslint-plugin-promise": "^3.6.0",
     "eslint-plugin-standard": "^3.0.1",
+    "eslint-plugin-vuln-regex-detector": "^1.0.4",
     "front-matter": "^2.3.0",
     "glob-to-regexp": "0.3.0",
     "html-differ": "^1.3.4",
@@ -47,6 +48,7 @@
     "test:gfm": "npm test -- test/specs/gfm/**/*-spec.js",
     "test:old": "node test",
     "test:lint": "eslint bin/marked .",
+    "test:redos": "eslint --plugin vuln-regex-detector --rule '\"vuln-regex-detector/no-vuln-regex\": 2' lib/marked.js",
     "bench": "node test --bench",
     "lint": "eslint --fix bin/marked .",
     "build": "uglifyjs lib/marked.js -cm  --comments /Copyright/ -o marked.min.js",