envs in overrides was not applied

Tell us about your environment

• ESLint Version: v5.16.0
• Node Version: v10.15.3
• npm Version: 6.9.0

What parser (default, Babel-ESLint, etc.) are you using?

Please show your full configuration:

Configuration

  "eslintConfig": {
    "extends": [
      "eslint:recommended"
    ],
    "overrides": [
      {
        "files": [
          "./lib/*.js"
        ],
        "env": {
          "browser": true
        }
      }
    ]
  },

What did you do? Please include the actual source code causing the issue, as well as the command that you used to run ESLint.

'use strict';

window.console.log('hello');

What did you expect to happen? not error reported, since it has setting env "browser": true

What actually happened? Please include the actual, raw output from ESLint.

/Users/weiran/repo/work/eslint-issue/lib/index.js
  3:1  error  'window' is not defined  no-unde

Are you willing to submit a pull request to fix this bug? yes

[jonschlinkert]

Minimatch’s spec that replaces \ by / on Windows.

TLDR; fwiw the reason that micromatch doesn’t replace \ is that it’s unsafe. Occasionally users will create issues about it, but it’s easy to resolve and results in educating a user. Zero issues would be best, but we’d rather have issues about implementation problems than vulnerabilities and ReDoS.

---

If you’re interested in a little more info about why it’s unsafe to convert backslashes…

Since globs are converted to regular expressions, when backslashes are converted to forward slashes it can change the intent of the glob and match things that shouldn’t be matched, or create a malicious regular expression that can lead to DoS. I’ve seen many naive and clever attempts at guessing when backslashes should be converted, but there are so many different edge cases that it’s just not worth the risk and headache - especially since globs are often joined to path parts before passing them to a matcher, which further complicates the guesswork of determining whether or not 1) slashes can be safely converted, and that 2) converting slashes will not change the intent of the glob pattern (and ultimately the regex).

Also fwiw, in case you’re concerned about breaking people’s configs and getting a bunch of issues. Micromatch has something like 2.5m dependents, and believe me, we were cringing when we made the decision to enforce this with users. But I have to say it wasn’t nearly as bad as we anticipated. We’ll get an issue about it every now and then… maybe 4-6 a year. But I don’t recall seeing any issues about this in months, and we even have a tool that “watches” issues on every repository on GitHub so that we can be notified in near real-time when something needs to be triaged.

(Please don’t take my comment as an attempt to persuade you to use Micromatch. I don’t expect that and wouldn’t judge you for not switching. I just figured I’d drop by and share some things we’ve learned.)

[kaicataldo]

I would argue that this is unexpected/unintended behavior and is a bug.