зеркало из
1
0
Форкнуть 0

adding call to unwrapper to allowed right-hand side

This commit is contained in:
Frederik Braun 2015-06-05 12:00:59 +02:00
Родитель 623a9c19fb
Коммит b12c5317e6
3 изменённых файлов: 13 добавлений и 3 удалений

Просмотреть файл

@ -1,5 +1,5 @@
module.exports = {
rules: {
'no-unsafe-innerhtml': require('./lib/rules/no-unsafe-innerhtml'),
'no-unsafe-innerhtml': require('./lib/rules/no-unsafe-innerhtml')
}
};

Просмотреть файл

@ -16,6 +16,7 @@ module.exports = function (context) {
// names of escaping functions that we acknowledge
var VALID_ESCAPERS = ["Tagged.escapeHTML", "escapeHTML"];
var VALID_UNWRAPPERS = ["Tagged.unwrapSafeHTML", "unwrapSafeHTML"];
function allowedExpression(expression, parent) {
/*
@ -50,6 +51,11 @@ module.exports = function (context) {
} else {
allowed = false;
}
} else if (expression.type === "CallExpression") {
var funcName = expression.callee.property.name;
if (VALID_UNWRAPPERS.indexOf(funcName) !== -1) {
allowed = true;
}
} else {
// everything that doesn't match is unsafe:
allowed = false;

Просмотреть файл

@ -9,14 +9,14 @@
// Requirements
//------------------------------------------------------------------------------
var eslint = require("../../../lib/eslint"),
var eslint = require("eslint"),
ESLintTester = require("eslint-tester");
//------------------------------------------------------------------------------
// Tests
//------------------------------------------------------------------------------
var eslintTester = new ESLintTester(eslint);
var eslintTester = new ESLintTester(eslint.linter);
eslintTester.addRuleTest("lib/rules/no-unsafe-innerhtml", {
// Examples of code that should not trigger the rule
@ -69,6 +69,10 @@ eslintTester.addRuleTest("lib/rules/no-unsafe-innerhtml", {
code: "i.innerHTML += Tagged.escapeHTML`foo${bar}baz`;",
ecmaFeatures: { templateStrings: true }
},
{
code: "i.innerHTML += Tagged.unwrapSafeHTML(htmlSnippet)",
ecmaFeatures: { templateStrings: true }
},
// tests for insertAdjacentHTML calls
{
code: "n.insertAdjacentHTML('afterend', 'meh');",