@fabriziosalmi/slopless 1.4.3 → 1.4.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fabriziosalmi/slopless",
-  "version": "1.4.3",
+  "version": "1.4.5",
   "description": "",
   "main": "dist/index.js",
   "bin": {

package/rules/VBC-010.yaml

@@ -6,7 +6,7 @@ tags:
   - accessibility
   - html
 match:
-  regex: <div[^>]*\s(onclick|onClick)=
+  regex: <div[^>]*\s(onclick|onClick)=(?!\{?\s*\(?\s*(?:e|ev|evt|event|_e)\s*\)?\s*=>\s*\{?\s*(?:e|ev|evt|event|_e)\.(?:stopPropagation|preventDefault)\(\)\s*\}?\s*\})
   file_types:
     - html
     - js
@@ -22,3 +22,5 @@ tests:
     - <div onClick={handleClick}>Save</div>
   quiet:
     - <button onClick={handleClick}>Save</button>
+    - <div className="row" onClick={(e) => e.stopPropagation()}>
+    - <div onClick={e => e.preventDefault()}>

package/rules/VBC-034.yaml

@@ -6,7 +6,7 @@ tags:
   - security
 match:
   regex: >-
-    http://(?!localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\]|test\b|example\.(?:com|org)|www\.w3\.org|schemas?\.|json-schema\.org|purl\.org|ns\.adobe|www\.apache\.org)
+    (?<!new URL\([^)]{0,200})http://(?!localhost|127\.|0\.0\.0\.0|169\.254\.|\[::1\]|test\b|example\.(?:com|org)|www\.w3\.org|schemas?\.|json-schema\.org|purl\.org|ns\.adobe|www\.apache\.org)
   scan: strings
   file_types:
     - js
@@ -38,4 +38,7 @@ tests:
   quiet:
     - const api = 'https://api.example.com/v1';
     - const dev = 'http://localhost:3000';
+    - const dev2 = 'http://127.0.0.1:8000';
+    - "refuse http://169.254.169.254 (cloud metadata) before connecting"
+    - const parsed = new URL(req.url, `http://${req.headers.host}`);
     - const svg = 'http://www.w3.org/2000/svg';

package/rules/VBC-070.yaml

@@ -5,7 +5,8 @@ category: core
 tags:
   - security
 match:
-  regex: \.innerHTML\s*=(?!=)
+  regex: >-
+    \.innerHTML\s*=(?!=)(?!\s*(['"])(?:(?!\1)[^\\])*\1\s*[;\n])
   file_types:
     - js
     - ts
@@ -14,6 +15,10 @@ message: >-
 tests:
   fire:
     - el.innerHTML = markup;
+    - el.innerHTML = "<b>" + name + "</b>";
+    - el.innerHTML = `<b>${name}</b>`;
   quiet:
     - el.textContent = text;
+    - alert.innerHTML = '<i class="fa-check"></i> <span id="t"></span>';
+    - el.innerHTML = "";
     - if (el.innerHTML === "") { init(); }

package/rules/VBC-077.yaml

@@ -18,6 +18,13 @@ tests:
         this.cache.set(id, 1);
         return id;
       }
+    - |
+      class E {
+        getLevel() {
+          if (!this.buf) { this.hits = this.hits + 1; }
+          return this.buf;
+        }
+      }
   quiet:
     - |
       function getUser(id) {
@@ -27,6 +34,22 @@ tests:
       function getOffset(node) {
         return node.dataset.offset;
       }
+    - |
+      class E {
+        getMasterLevel() {
+          if (!this.buf || this.buf.length !== this.analyser.fftSize) {
+            this.buf = new Float32Array(this.analyser.fftSize);
+          }
+          return rms(this.buf);
+        }
+      }
+    - |
+      class R {
+        async fetchFromRemote(url) {
+          this.fetched = true;
+          return fetch(url);
+        }
+      }
     - |
       function getAll() {
         const out = [];

package/rules/VBC-913.yaml

@@ -9,6 +9,22 @@ match:
   regex: >-
     outline:\s*(?:none|0)\b(?![\s\S]{0,400}?:focus-visible[\s\S]{0,140}?outline\s*:\s*(?!none|0|\s*;))
   multiline: true
+  # An outline only ever appears on focus, so removing one matters only where
+  # focus can land. `.card { outline: none }` on a div nobody can tab to removes
+  # nothing; the same line under `:focus-visible` removes the only thing telling
+  # a keyboard user where they are.
+  require_selectors:
+    - ':focus'
+    - ':active'
+    - a
+    - button
+    - input
+    - select
+    - textarea
+    - summary
+    - details
+    - '[tabindex]'
+    - '[contenteditable]'
   file_types:
     - css
     - scss
@@ -19,8 +35,12 @@ message: >-
 tests:
   fire:
     - 'a:focus { outline: none; }'
+    - 'input[type="range"]:focus-visible { outline: none; }'
+    - '.editor:focus-visible { outline: none !important; }'
   quiet:
     - 'a:focus { outline: 2px solid currentColor; }'
+    - '.card { cursor: default; outline: none; overflow: hidden; }'
+    - '.ProseMirror { outline: none; min-height: 100vh; }'
     - |
       *:focus {
         outline: none;