Rename Tagged library to Sanitizer
This commit is contained in:
Родитель
6b5fb215dc
Коммит
8f8432ce6d
|
@ -1,6 +1,6 @@
|
|||
# Disallow unsafe HTML templating (no-unsafe-innerhtml)
|
||||
|
||||
This function disallows unsafe coding practices that may result into security vulnerabilities. We will disallow assignments to innerHTML as well as calls to insertAdjacentHTML without the use of a pre-defined escaping function. The escaping functions must be called with a template string. The function names are hardcoded as `Tagged.escapeHTML` and `escapeHTML`.
|
||||
This function disallows unsafe coding practices that may result into security vulnerabilities. We will disallow assignments to innerHTML as well as calls to insertAdjacentHTML without the use of a pre-defined escaping function. The escaping functions must be called with a template string. The function names are hardcoded as `Sanitizer.escapeHTML` and `escapeHTML`.
|
||||
|
||||
## Rule Details
|
||||
|
||||
|
|
|
@ -15,8 +15,8 @@ module.exports = function (context) {
|
|||
var OPERATORS = ["=", "+="];
|
||||
|
||||
// names of escaping functions that we acknowledge
|
||||
var VALID_ESCAPERS = ["Tagged.escapeHTML", "escapeHTML"];
|
||||
var VALID_UNWRAPPERS = ["Tagged.unwrapSafeHTML", "unwrapSafeHTML"];
|
||||
var VALID_ESCAPERS = ["Sanitizer.escapeHTML", "escapeHTML"];
|
||||
var VALID_UNWRAPPERS = ["Sanitizer.unwrapSafeHTML", "unwrapSafeHTML"];
|
||||
|
||||
function allowedExpression(expression, parent) {
|
||||
/*
|
||||
|
|
|
@ -33,15 +33,15 @@ eslintTester.addRuleTest("lib/rules/no-unsafe-innerhtml", {
|
|||
ecmaFeatures: { templateStrings: true }
|
||||
},
|
||||
{
|
||||
code: "g.innerHTML = Tagged.escapeHTML``;",
|
||||
code: "g.innerHTML = Sanitizer.escapeHTML``;",
|
||||
ecmaFeatures: { templateStrings: true }
|
||||
},
|
||||
{
|
||||
code: "h.innerHTML = Tagged.escapeHTML`foo`;",
|
||||
code: "h.innerHTML = Sanitizer.escapeHTML`foo`;",
|
||||
ecmaFeatures: { templateStrings: true }
|
||||
},
|
||||
{
|
||||
code: "i.innerHTML = Tagged.escapeHTML`foo${bar}baz`;",
|
||||
code: "i.innerHTML = Sanitizer.escapeHTML`foo${bar}baz`;",
|
||||
ecmaFeatures: { templateStrings: true }
|
||||
},
|
||||
// tests for innerHTML update (+= operator)
|
||||
|
@ -58,19 +58,19 @@ eslintTester.addRuleTest("lib/rules/no-unsafe-innerhtml", {
|
|||
ecmaFeatures: { templateStrings: true }
|
||||
},
|
||||
{
|
||||
code: "g.innerHTML += Tagged.escapeHTML``;",
|
||||
code: "g.innerHTML += Sanitizer.escapeHTML``;",
|
||||
ecmaFeatures: { templateStrings: true }
|
||||
},
|
||||
{
|
||||
code: "h.innerHTML += Tagged.escapeHTML`foo`;",
|
||||
code: "h.innerHTML += Sanitizer.escapeHTML`foo`;",
|
||||
ecmaFeatures: { templateStrings: true }
|
||||
},
|
||||
{
|
||||
code: "i.innerHTML += Tagged.escapeHTML`foo${bar}baz`;",
|
||||
code: "i.innerHTML += Sanitizer.escapeHTML`foo${bar}baz`;",
|
||||
ecmaFeatures: { templateStrings: true }
|
||||
},
|
||||
{
|
||||
code: "i.innerHTML += Tagged.unwrapSafeHTML(htmlSnippet)",
|
||||
code: "i.innerHTML += Sanitizer.unwrapSafeHTML(htmlSnippet)",
|
||||
ecmaFeatures: { templateStrings: true }
|
||||
},
|
||||
// tests for insertAdjacentHTML calls
|
||||
|
@ -83,7 +83,7 @@ eslintTester.addRuleTest("lib/rules/no-unsafe-innerhtml", {
|
|||
ecmaFeatures: { templateStrings: true }
|
||||
},
|
||||
{
|
||||
code: "n.insertAdjacentHTML('afterend', Tagged.escapeHTML`${title}`);",
|
||||
code: "n.insertAdjacentHTML('afterend', Sanitizer.escapeHTML`${title}`);",
|
||||
ecmaFeatures: { templateStrings: true }
|
||||
},
|
||||
// override for manual review and legacy code
|
||||
|
|
Загрузка…
Ссылка в новой задаче