зеркало из
1
0
Форкнуть 0

Rename Tagged library to Sanitizer

This commit is contained in:
Kevin Grandon 2015-06-08 21:20:57 -07:00
Родитель 6b5fb215dc
Коммит 8f8432ce6d
3 изменённых файлов: 11 добавлений и 11 удалений

Просмотреть файл

@ -1,6 +1,6 @@
# Disallow unsafe HTML templating (no-unsafe-innerhtml)
This function disallows unsafe coding practices that may result into security vulnerabilities. We will disallow assignments to innerHTML as well as calls to insertAdjacentHTML without the use of a pre-defined escaping function. The escaping functions must be called with a template string. The function names are hardcoded as `Tagged.escapeHTML` and `escapeHTML`.
This function disallows unsafe coding practices that may result into security vulnerabilities. We will disallow assignments to innerHTML as well as calls to insertAdjacentHTML without the use of a pre-defined escaping function. The escaping functions must be called with a template string. The function names are hardcoded as `Sanitizer.escapeHTML` and `escapeHTML`.
## Rule Details

Просмотреть файл

@ -15,8 +15,8 @@ module.exports = function (context) {
var OPERATORS = ["=", "+="];
// names of escaping functions that we acknowledge
var VALID_ESCAPERS = ["Tagged.escapeHTML", "escapeHTML"];
var VALID_UNWRAPPERS = ["Tagged.unwrapSafeHTML", "unwrapSafeHTML"];
var VALID_ESCAPERS = ["Sanitizer.escapeHTML", "escapeHTML"];
var VALID_UNWRAPPERS = ["Sanitizer.unwrapSafeHTML", "unwrapSafeHTML"];
function allowedExpression(expression, parent) {
/*

Просмотреть файл

@ -33,15 +33,15 @@ eslintTester.addRuleTest("lib/rules/no-unsafe-innerhtml", {
ecmaFeatures: { templateStrings: true }
},
{
code: "g.innerHTML = Tagged.escapeHTML``;",
code: "g.innerHTML = Sanitizer.escapeHTML``;",
ecmaFeatures: { templateStrings: true }
},
{
code: "h.innerHTML = Tagged.escapeHTML`foo`;",
code: "h.innerHTML = Sanitizer.escapeHTML`foo`;",
ecmaFeatures: { templateStrings: true }
},
{
code: "i.innerHTML = Tagged.escapeHTML`foo${bar}baz`;",
code: "i.innerHTML = Sanitizer.escapeHTML`foo${bar}baz`;",
ecmaFeatures: { templateStrings: true }
},
// tests for innerHTML update (+= operator)
@ -58,19 +58,19 @@ eslintTester.addRuleTest("lib/rules/no-unsafe-innerhtml", {
ecmaFeatures: { templateStrings: true }
},
{
code: "g.innerHTML += Tagged.escapeHTML``;",
code: "g.innerHTML += Sanitizer.escapeHTML``;",
ecmaFeatures: { templateStrings: true }
},
{
code: "h.innerHTML += Tagged.escapeHTML`foo`;",
code: "h.innerHTML += Sanitizer.escapeHTML`foo`;",
ecmaFeatures: { templateStrings: true }
},
{
code: "i.innerHTML += Tagged.escapeHTML`foo${bar}baz`;",
code: "i.innerHTML += Sanitizer.escapeHTML`foo${bar}baz`;",
ecmaFeatures: { templateStrings: true }
},
{
code: "i.innerHTML += Tagged.unwrapSafeHTML(htmlSnippet)",
code: "i.innerHTML += Sanitizer.unwrapSafeHTML(htmlSnippet)",
ecmaFeatures: { templateStrings: true }
},
// tests for insertAdjacentHTML calls
@ -83,7 +83,7 @@ eslintTester.addRuleTest("lib/rules/no-unsafe-innerhtml", {
ecmaFeatures: { templateStrings: true }
},
{
code: "n.insertAdjacentHTML('afterend', Tagged.escapeHTML`${title}`);",
code: "n.insertAdjacentHTML('afterend', Sanitizer.escapeHTML`${title}`);",
ecmaFeatures: { templateStrings: true }
},
// override for manual review and legacy code