@lipemat/eslint-config 5.0.0-beta.4 → 5.0.0-beta.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/package.json +1 -1
  2. package/plugins/security/utils/shared.js +4 -1
  3. package/types/plugins/security/utils/shared.d.ts +1 -1
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@lipemat/eslint-config",
3
- "version": "5.0.0-beta.4",
3
+ "version": "5.0.0-beta.5",
4
4
  "license": "MIT",
5
5
  "description": "Eslint configuration for all @lipemat packages",
6
6
  "engines": {
package/plugins/security/utils/shared.js CHANGED
@@ -63,11 +63,14 @@ export function isLiteralString(node) {
63
63
  }
64
64
  /**
65
65
  * Check if a node is a literal string that is safe to use in an HTML context.
66
- * - Must be a literal string.
66
+ * - Must be a literal string. Or a conditional expression where both branches are safe literal strings.
67
67
  * - Must not contain `<script`.
68
68
  * - Must not start with a dangerous protocol (javascript:, data:, vbscript:, about:, livescript:).
69
69
  */
70
70
  export function isSafeLiteralString(node) {
71
+ if (AST_NODE_TYPES.ConditionalExpression === node.type) {
72
+ return isSafeLiteralString(node.consequent) && isSafeLiteralString(node.alternate);
73
+ }
71
74
  if (!isLiteralString(node)) {
72
75
  return false;
73
76
  }
package/types/plugins/security/utils/shared.d.ts CHANGED
@@ -32,7 +32,7 @@ export declare function isSanitized(node: TSESTree.Property['value'] | TSESTree.
32
32
  export declare function isLiteralString(node: TSESTree.Property['value'] | TSESTree.CallExpressionArgument): node is TSESTree.StringLiteral;
33
33
  /**
34
34
  * Check if a node is a literal string that is safe to use in an HTML context.
35
- * - Must be a literal string.
35
+ * - Must be a literal string. Or a conditional expression where both branches are safe literal strings.
36
36
  * - Must not contain `<script`.
37
37
  * - Must not start with a dangerous protocol (javascript:, data:, vbscript:, about:, livescript:).
38
38
  */