eslint-plugin-sdl-2 1.0.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (418) hide show
  1. package/CHANGELOG.md +5316 -0
  2. package/LICENSE +21 -0
  3. package/README.md +133 -0
  4. package/dist/_internal/ast-utils.d.ts +17 -0
  5. package/dist/_internal/ast-utils.d.ts.map +1 -0
  6. package/dist/_internal/ast-utils.js +93 -0
  7. package/dist/_internal/ast-utils.js.map +1 -0
  8. package/dist/_internal/config-references.d.ts +5 -0
  9. package/dist/_internal/config-references.d.ts.map +1 -0
  10. package/dist/_internal/config-references.js +13 -0
  11. package/dist/_internal/config-references.js.map +1 -0
  12. package/dist/_internal/create-rule.d.ts +9 -0
  13. package/dist/_internal/create-rule.d.ts.map +1 -0
  14. package/dist/_internal/create-rule.js +6 -0
  15. package/dist/_internal/create-rule.js.map +1 -0
  16. package/dist/_internal/domparser.d.ts +19 -0
  17. package/dist/_internal/domparser.d.ts.map +1 -0
  18. package/dist/_internal/domparser.js +45 -0
  19. package/dist/_internal/domparser.js.map +1 -0
  20. package/dist/_internal/electron-web-preferences.d.ts +14 -0
  21. package/dist/_internal/electron-web-preferences.d.ts.map +1 -0
  22. package/dist/_internal/electron-web-preferences.js +63 -0
  23. package/dist/_internal/electron-web-preferences.js.map +1 -0
  24. package/dist/_internal/estree-utils.d.ts +51 -0
  25. package/dist/_internal/estree-utils.d.ts.map +1 -0
  26. package/dist/_internal/estree-utils.js +112 -0
  27. package/dist/_internal/estree-utils.js.map +1 -0
  28. package/dist/_internal/node-tls-config.d.ts +44 -0
  29. package/dist/_internal/node-tls-config.d.ts.map +1 -0
  30. package/dist/_internal/node-tls-config.js +101 -0
  31. package/dist/_internal/node-tls-config.js.map +1 -0
  32. package/dist/_internal/rules-registry.d.ts +10 -0
  33. package/dist/_internal/rules-registry.d.ts.map +1 -0
  34. package/dist/_internal/rules-registry.js +148 -0
  35. package/dist/_internal/rules-registry.js.map +1 -0
  36. package/dist/_internal/script-element.d.ts +7 -0
  37. package/dist/_internal/script-element.d.ts.map +1 -0
  38. package/dist/_internal/script-element.js +46 -0
  39. package/dist/_internal/script-element.js.map +1 -0
  40. package/dist/_internal/worker-code-loading.d.ts +69 -0
  41. package/dist/_internal/worker-code-loading.d.ts.map +1 -0
  42. package/dist/_internal/worker-code-loading.js +134 -0
  43. package/dist/_internal/worker-code-loading.js.map +1 -0
  44. package/dist/plugin.cjs +6036 -0
  45. package/dist/plugin.cjs.map +7 -0
  46. package/dist/plugin.d.cts +11 -0
  47. package/dist/plugin.d.ts +11 -0
  48. package/dist/plugin.d.ts.map +1 -0
  49. package/dist/plugin.js +235 -0
  50. package/dist/plugin.js.map +1 -0
  51. package/dist/rules/no-angular-bypass-sanitizer.d.ts +5 -0
  52. package/dist/rules/no-angular-bypass-sanitizer.d.ts.map +1 -0
  53. package/dist/rules/no-angular-bypass-sanitizer.js +32 -0
  54. package/dist/rules/no-angular-bypass-sanitizer.js.map +1 -0
  55. package/dist/rules/no-angular-bypass-security-trust-html.d.ts +5 -0
  56. package/dist/rules/no-angular-bypass-security-trust-html.d.ts.map +1 -0
  57. package/dist/rules/no-angular-bypass-security-trust-html.js +51 -0
  58. package/dist/rules/no-angular-bypass-security-trust-html.js.map +1 -0
  59. package/dist/rules/no-angular-innerhtml-binding.d.ts +5 -0
  60. package/dist/rules/no-angular-innerhtml-binding.d.ts.map +1 -0
  61. package/dist/rules/no-angular-innerhtml-binding.js +57 -0
  62. package/dist/rules/no-angular-innerhtml-binding.js.map +1 -0
  63. package/dist/rules/no-angular-sanitization-trusted-urls.d.ts +5 -0
  64. package/dist/rules/no-angular-sanitization-trusted-urls.d.ts.map +1 -0
  65. package/dist/rules/no-angular-sanitization-trusted-urls.js +32 -0
  66. package/dist/rules/no-angular-sanitization-trusted-urls.js.map +1 -0
  67. package/dist/rules/no-angularjs-bypass-sce.d.ts +5 -0
  68. package/dist/rules/no-angularjs-bypass-sce.d.ts.map +1 -0
  69. package/dist/rules/no-angularjs-bypass-sce.js +80 -0
  70. package/dist/rules/no-angularjs-bypass-sce.js.map +1 -0
  71. package/dist/rules/no-angularjs-enable-svg.d.ts +5 -0
  72. package/dist/rules/no-angularjs-enable-svg.d.ts.map +1 -0
  73. package/dist/rules/no-angularjs-enable-svg.js +48 -0
  74. package/dist/rules/no-angularjs-enable-svg.js.map +1 -0
  75. package/dist/rules/no-angularjs-ng-bind-html-without-sanitize.d.ts +5 -0
  76. package/dist/rules/no-angularjs-ng-bind-html-without-sanitize.d.ts.map +1 -0
  77. package/dist/rules/no-angularjs-ng-bind-html-without-sanitize.js +64 -0
  78. package/dist/rules/no-angularjs-ng-bind-html-without-sanitize.js.map +1 -0
  79. package/dist/rules/no-angularjs-sanitization-whitelist.d.ts +5 -0
  80. package/dist/rules/no-angularjs-sanitization-whitelist.d.ts.map +1 -0
  81. package/dist/rules/no-angularjs-sanitization-whitelist.js +32 -0
  82. package/dist/rules/no-angularjs-sanitization-whitelist.js.map +1 -0
  83. package/dist/rules/no-angularjs-sce-resource-url-wildcard.d.ts +5 -0
  84. package/dist/rules/no-angularjs-sce-resource-url-wildcard.d.ts.map +1 -0
  85. package/dist/rules/no-angularjs-sce-resource-url-wildcard.js +69 -0
  86. package/dist/rules/no-angularjs-sce-resource-url-wildcard.js.map +1 -0
  87. package/dist/rules/no-child-process-exec.d.ts +5 -0
  88. package/dist/rules/no-child-process-exec.d.ts.map +1 -0
  89. package/dist/rules/no-child-process-exec.js +141 -0
  90. package/dist/rules/no-child-process-exec.js.map +1 -0
  91. package/dist/rules/no-child-process-shell-true.d.ts +5 -0
  92. package/dist/rules/no-child-process-shell-true.d.ts.map +1 -0
  93. package/dist/rules/no-child-process-shell-true.js +89 -0
  94. package/dist/rules/no-child-process-shell-true.js.map +1 -0
  95. package/dist/rules/no-cookies.d.ts +5 -0
  96. package/dist/rules/no-cookies.d.ts.map +1 -0
  97. package/dist/rules/no-cookies.js +38 -0
  98. package/dist/rules/no-cookies.js.map +1 -0
  99. package/dist/rules/no-document-domain.d.ts +5 -0
  100. package/dist/rules/no-document-domain.d.ts.map +1 -0
  101. package/dist/rules/no-document-domain.js +41 -0
  102. package/dist/rules/no-document-domain.js.map +1 -0
  103. package/dist/rules/no-document-execcommand-insert-html.d.ts +5 -0
  104. package/dist/rules/no-document-execcommand-insert-html.d.ts.map +1 -0
  105. package/dist/rules/no-document-execcommand-insert-html.js +57 -0
  106. package/dist/rules/no-document-execcommand-insert-html.js.map +1 -0
  107. package/dist/rules/no-document-parse-html-unsafe.d.ts +5 -0
  108. package/dist/rules/no-document-parse-html-unsafe.d.ts.map +1 -0
  109. package/dist/rules/no-document-parse-html-unsafe.js +67 -0
  110. package/dist/rules/no-document-parse-html-unsafe.js.map +1 -0
  111. package/dist/rules/no-document-write.d.ts +5 -0
  112. package/dist/rules/no-document-write.d.ts.map +1 -0
  113. package/dist/rules/no-document-write.js +40 -0
  114. package/dist/rules/no-document-write.js.map +1 -0
  115. package/dist/rules/no-domparser-html-without-sanitization.d.ts +5 -0
  116. package/dist/rules/no-domparser-html-without-sanitization.d.ts.map +1 -0
  117. package/dist/rules/no-domparser-html-without-sanitization.js +56 -0
  118. package/dist/rules/no-domparser-html-without-sanitization.js.map +1 -0
  119. package/dist/rules/no-domparser-svg-without-sanitization.d.ts +5 -0
  120. package/dist/rules/no-domparser-svg-without-sanitization.d.ts.map +1 -0
  121. package/dist/rules/no-domparser-svg-without-sanitization.js +56 -0
  122. package/dist/rules/no-domparser-svg-without-sanitization.js.map +1 -0
  123. package/dist/rules/no-dynamic-import-unsafe-url.d.ts +5 -0
  124. package/dist/rules/no-dynamic-import-unsafe-url.d.ts.map +1 -0
  125. package/dist/rules/no-dynamic-import-unsafe-url.js +47 -0
  126. package/dist/rules/no-dynamic-import-unsafe-url.js.map +1 -0
  127. package/dist/rules/no-electron-allow-running-insecure-content.d.ts +5 -0
  128. package/dist/rules/no-electron-allow-running-insecure-content.d.ts.map +1 -0
  129. package/dist/rules/no-electron-allow-running-insecure-content.js +30 -0
  130. package/dist/rules/no-electron-allow-running-insecure-content.js.map +1 -0
  131. package/dist/rules/no-electron-dangerous-blink-features.d.ts +5 -0
  132. package/dist/rules/no-electron-dangerous-blink-features.d.ts.map +1 -0
  133. package/dist/rules/no-electron-dangerous-blink-features.js +89 -0
  134. package/dist/rules/no-electron-dangerous-blink-features.js.map +1 -0
  135. package/dist/rules/no-electron-disable-context-isolation.d.ts +5 -0
  136. package/dist/rules/no-electron-disable-context-isolation.d.ts.map +1 -0
  137. package/dist/rules/no-electron-disable-context-isolation.js +30 -0
  138. package/dist/rules/no-electron-disable-context-isolation.js.map +1 -0
  139. package/dist/rules/no-electron-disable-sandbox.d.ts +5 -0
  140. package/dist/rules/no-electron-disable-sandbox.d.ts.map +1 -0
  141. package/dist/rules/no-electron-disable-sandbox.js +30 -0
  142. package/dist/rules/no-electron-disable-sandbox.js.map +1 -0
  143. package/dist/rules/no-electron-disable-web-security.d.ts +5 -0
  144. package/dist/rules/no-electron-disable-web-security.d.ts.map +1 -0
  145. package/dist/rules/no-electron-disable-web-security.js +30 -0
  146. package/dist/rules/no-electron-disable-web-security.js.map +1 -0
  147. package/dist/rules/no-electron-enable-remote-module.d.ts +5 -0
  148. package/dist/rules/no-electron-enable-remote-module.d.ts.map +1 -0
  149. package/dist/rules/no-electron-enable-remote-module.js +30 -0
  150. package/dist/rules/no-electron-enable-remote-module.js.map +1 -0
  151. package/dist/rules/no-electron-enable-webview-tag.d.ts +5 -0
  152. package/dist/rules/no-electron-enable-webview-tag.d.ts.map +1 -0
  153. package/dist/rules/no-electron-enable-webview-tag.js +30 -0
  154. package/dist/rules/no-electron-enable-webview-tag.js.map +1 -0
  155. package/dist/rules/no-electron-experimental-features.d.ts +5 -0
  156. package/dist/rules/no-electron-experimental-features.d.ts.map +1 -0
  157. package/dist/rules/no-electron-experimental-features.js +30 -0
  158. package/dist/rules/no-electron-experimental-features.js.map +1 -0
  159. package/dist/rules/no-electron-expose-raw-ipc-renderer.d.ts +5 -0
  160. package/dist/rules/no-electron-expose-raw-ipc-renderer.d.ts.map +1 -0
  161. package/dist/rules/no-electron-expose-raw-ipc-renderer.js +108 -0
  162. package/dist/rules/no-electron-expose-raw-ipc-renderer.js.map +1 -0
  163. package/dist/rules/no-electron-insecure-certificate-error-handler.d.ts +5 -0
  164. package/dist/rules/no-electron-insecure-certificate-error-handler.d.ts.map +1 -0
  165. package/dist/rules/no-electron-insecure-certificate-error-handler.js +91 -0
  166. package/dist/rules/no-electron-insecure-certificate-error-handler.js.map +1 -0
  167. package/dist/rules/no-electron-insecure-certificate-verify-proc.d.ts +5 -0
  168. package/dist/rules/no-electron-insecure-certificate-verify-proc.d.ts.map +1 -0
  169. package/dist/rules/no-electron-insecure-certificate-verify-proc.js +75 -0
  170. package/dist/rules/no-electron-insecure-certificate-verify-proc.js.map +1 -0
  171. package/dist/rules/no-electron-insecure-permission-request-handler.d.ts +5 -0
  172. package/dist/rules/no-electron-insecure-permission-request-handler.d.ts.map +1 -0
  173. package/dist/rules/no-electron-insecure-permission-request-handler.js +75 -0
  174. package/dist/rules/no-electron-insecure-permission-request-handler.js.map +1 -0
  175. package/dist/rules/no-electron-node-integration.d.ts +5 -0
  176. package/dist/rules/no-electron-node-integration.d.ts.map +1 -0
  177. package/dist/rules/no-electron-node-integration.js +52 -0
  178. package/dist/rules/no-electron-node-integration.js.map +1 -0
  179. package/dist/rules/no-electron-permission-check-handler-allow-all.d.ts +5 -0
  180. package/dist/rules/no-electron-permission-check-handler-allow-all.d.ts.map +1 -0
  181. package/dist/rules/no-electron-permission-check-handler-allow-all.js +63 -0
  182. package/dist/rules/no-electron-permission-check-handler-allow-all.js.map +1 -0
  183. package/dist/rules/no-electron-unchecked-ipc-sender.d.ts +5 -0
  184. package/dist/rules/no-electron-unchecked-ipc-sender.d.ts.map +1 -0
  185. package/dist/rules/no-electron-unchecked-ipc-sender.js +90 -0
  186. package/dist/rules/no-electron-unchecked-ipc-sender.js.map +1 -0
  187. package/dist/rules/no-electron-unrestricted-navigation.d.ts +5 -0
  188. package/dist/rules/no-electron-unrestricted-navigation.d.ts.map +1 -0
  189. package/dist/rules/no-electron-unrestricted-navigation.js +100 -0
  190. package/dist/rules/no-electron-unrestricted-navigation.js.map +1 -0
  191. package/dist/rules/no-electron-untrusted-open-external.d.ts +5 -0
  192. package/dist/rules/no-electron-untrusted-open-external.d.ts.map +1 -0
  193. package/dist/rules/no-electron-untrusted-open-external.js +92 -0
  194. package/dist/rules/no-electron-untrusted-open-external.js.map +1 -0
  195. package/dist/rules/no-electron-webview-allowpopups.d.ts +5 -0
  196. package/dist/rules/no-electron-webview-allowpopups.d.ts.map +1 -0
  197. package/dist/rules/no-electron-webview-allowpopups.js +85 -0
  198. package/dist/rules/no-electron-webview-allowpopups.js.map +1 -0
  199. package/dist/rules/no-electron-webview-insecure-webpreferences.d.ts +5 -0
  200. package/dist/rules/no-electron-webview-insecure-webpreferences.d.ts.map +1 -0
  201. package/dist/rules/no-electron-webview-insecure-webpreferences.js +88 -0
  202. package/dist/rules/no-electron-webview-insecure-webpreferences.js.map +1 -0
  203. package/dist/rules/no-electron-webview-node-integration.d.ts +5 -0
  204. package/dist/rules/no-electron-webview-node-integration.d.ts.map +1 -0
  205. package/dist/rules/no-electron-webview-node-integration.js +107 -0
  206. package/dist/rules/no-electron-webview-node-integration.js.map +1 -0
  207. package/dist/rules/no-html-method.d.ts +5 -0
  208. package/dist/rules/no-html-method.d.ts.map +1 -0
  209. package/dist/rules/no-html-method.js +42 -0
  210. package/dist/rules/no-html-method.js.map +1 -0
  211. package/dist/rules/no-http-request-to-insecure-protocol.d.ts +5 -0
  212. package/dist/rules/no-http-request-to-insecure-protocol.d.ts.map +1 -0
  213. package/dist/rules/no-http-request-to-insecure-protocol.js +94 -0
  214. package/dist/rules/no-http-request-to-insecure-protocol.js.map +1 -0
  215. package/dist/rules/no-iframe-srcdoc.d.ts +5 -0
  216. package/dist/rules/no-iframe-srcdoc.d.ts.map +1 -0
  217. package/dist/rules/no-iframe-srcdoc.js +144 -0
  218. package/dist/rules/no-iframe-srcdoc.js.map +1 -0
  219. package/dist/rules/no-inner-html.d.ts +5 -0
  220. package/dist/rules/no-inner-html.d.ts.map +1 -0
  221. package/dist/rules/no-inner-html.js +67 -0
  222. package/dist/rules/no-inner-html.js.map +1 -0
  223. package/dist/rules/no-insecure-random.d.ts +5 -0
  224. package/dist/rules/no-insecure-random.d.ts.map +1 -0
  225. package/dist/rules/no-insecure-random.js +95 -0
  226. package/dist/rules/no-insecure-random.js.map +1 -0
  227. package/dist/rules/no-insecure-tls-agent-options.d.ts +5 -0
  228. package/dist/rules/no-insecure-tls-agent-options.d.ts.map +1 -0
  229. package/dist/rules/no-insecure-tls-agent-options.js +73 -0
  230. package/dist/rules/no-insecure-tls-agent-options.js.map +1 -0
  231. package/dist/rules/no-insecure-url.d.ts +12 -0
  232. package/dist/rules/no-insecure-url.d.ts.map +1 -0
  233. package/dist/rules/no-insecure-url.js +142 -0
  234. package/dist/rules/no-insecure-url.js.map +1 -0
  235. package/dist/rules/no-location-javascript-url.d.ts +5 -0
  236. package/dist/rules/no-location-javascript-url.d.ts.map +1 -0
  237. package/dist/rules/no-location-javascript-url.js +98 -0
  238. package/dist/rules/no-location-javascript-url.js.map +1 -0
  239. package/dist/rules/no-message-event-without-origin-check.d.ts +5 -0
  240. package/dist/rules/no-message-event-without-origin-check.d.ts.map +1 -0
  241. package/dist/rules/no-message-event-without-origin-check.js +183 -0
  242. package/dist/rules/no-message-event-without-origin-check.js.map +1 -0
  243. package/dist/rules/no-msapp-exec-unsafe.d.ts +5 -0
  244. package/dist/rules/no-msapp-exec-unsafe.d.ts.map +1 -0
  245. package/dist/rules/no-msapp-exec-unsafe.js +32 -0
  246. package/dist/rules/no-msapp-exec-unsafe.js.map +1 -0
  247. package/dist/rules/no-node-tls-check-server-identity-bypass.d.ts +5 -0
  248. package/dist/rules/no-node-tls-check-server-identity-bypass.d.ts.map +1 -0
  249. package/dist/rules/no-node-tls-check-server-identity-bypass.js +95 -0
  250. package/dist/rules/no-node-tls-check-server-identity-bypass.js.map +1 -0
  251. package/dist/rules/no-node-tls-legacy-protocol.d.ts +5 -0
  252. package/dist/rules/no-node-tls-legacy-protocol.d.ts.map +1 -0
  253. package/dist/rules/no-node-tls-legacy-protocol.js +106 -0
  254. package/dist/rules/no-node-tls-legacy-protocol.js.map +1 -0
  255. package/dist/rules/no-node-tls-reject-unauthorized-zero.d.ts +5 -0
  256. package/dist/rules/no-node-tls-reject-unauthorized-zero.d.ts.map +1 -0
  257. package/dist/rules/no-node-tls-reject-unauthorized-zero.js +93 -0
  258. package/dist/rules/no-node-tls-reject-unauthorized-zero.js.map +1 -0
  259. package/dist/rules/no-node-tls-security-level-zero.d.ts +5 -0
  260. package/dist/rules/no-node-tls-security-level-zero.d.ts.map +1 -0
  261. package/dist/rules/no-node-tls-security-level-zero.js +80 -0
  262. package/dist/rules/no-node-tls-security-level-zero.js.map +1 -0
  263. package/dist/rules/no-node-vm-run-in-context.d.ts +5 -0
  264. package/dist/rules/no-node-vm-run-in-context.d.ts.map +1 -0
  265. package/dist/rules/no-node-vm-run-in-context.js +186 -0
  266. package/dist/rules/no-node-vm-run-in-context.js.map +1 -0
  267. package/dist/rules/no-node-vm-source-text-module.d.ts +5 -0
  268. package/dist/rules/no-node-vm-source-text-module.d.ts.map +1 -0
  269. package/dist/rules/no-node-vm-source-text-module.js +126 -0
  270. package/dist/rules/no-node-vm-source-text-module.js.map +1 -0
  271. package/dist/rules/no-node-worker-threads-eval.d.ts +5 -0
  272. package/dist/rules/no-node-worker-threads-eval.d.ts.map +1 -0
  273. package/dist/rules/no-node-worker-threads-eval.js +151 -0
  274. package/dist/rules/no-node-worker-threads-eval.js.map +1 -0
  275. package/dist/rules/no-nonnull-assertion-on-security-input.d.ts +5 -0
  276. package/dist/rules/no-nonnull-assertion-on-security-input.d.ts.map +1 -0
  277. package/dist/rules/no-nonnull-assertion-on-security-input.js +48 -0
  278. package/dist/rules/no-nonnull-assertion-on-security-input.js.map +1 -0
  279. package/dist/rules/no-postmessage-star-origin.d.ts +5 -0
  280. package/dist/rules/no-postmessage-star-origin.d.ts.map +1 -0
  281. package/dist/rules/no-postmessage-star-origin.js +58 -0
  282. package/dist/rules/no-postmessage-star-origin.js.map +1 -0
  283. package/dist/rules/no-postmessage-without-origin-allowlist.d.ts +5 -0
  284. package/dist/rules/no-postmessage-without-origin-allowlist.d.ts.map +1 -0
  285. package/dist/rules/no-postmessage-without-origin-allowlist.js +80 -0
  286. package/dist/rules/no-postmessage-without-origin-allowlist.js.map +1 -0
  287. package/dist/rules/no-range-create-contextual-fragment.d.ts +5 -0
  288. package/dist/rules/no-range-create-contextual-fragment.d.ts.map +1 -0
  289. package/dist/rules/no-range-create-contextual-fragment.js +64 -0
  290. package/dist/rules/no-range-create-contextual-fragment.js.map +1 -0
  291. package/dist/rules/no-script-src-data-url.d.ts +5 -0
  292. package/dist/rules/no-script-src-data-url.d.ts.map +1 -0
  293. package/dist/rules/no-script-src-data-url.js +108 -0
  294. package/dist/rules/no-script-src-data-url.js.map +1 -0
  295. package/dist/rules/no-script-text.d.ts +5 -0
  296. package/dist/rules/no-script-text.d.ts.map +1 -0
  297. package/dist/rules/no-script-text.js +52 -0
  298. package/dist/rules/no-script-text.js.map +1 -0
  299. package/dist/rules/no-service-worker-unsafe-script-url.d.ts +5 -0
  300. package/dist/rules/no-service-worker-unsafe-script-url.d.ts.map +1 -0
  301. package/dist/rules/no-service-worker-unsafe-script-url.js +52 -0
  302. package/dist/rules/no-service-worker-unsafe-script-url.js.map +1 -0
  303. package/dist/rules/no-set-html-unsafe.d.ts +5 -0
  304. package/dist/rules/no-set-html-unsafe.d.ts.map +1 -0
  305. package/dist/rules/no-set-html-unsafe.js +48 -0
  306. package/dist/rules/no-set-html-unsafe.js.map +1 -0
  307. package/dist/rules/no-trusted-types-policy-pass-through.d.ts +5 -0
  308. package/dist/rules/no-trusted-types-policy-pass-through.d.ts.map +1 -0
  309. package/dist/rules/no-trusted-types-policy-pass-through.js +115 -0
  310. package/dist/rules/no-trusted-types-policy-pass-through.js.map +1 -0
  311. package/dist/rules/no-unsafe-alloc.d.ts +5 -0
  312. package/dist/rules/no-unsafe-alloc.d.ts.map +1 -0
  313. package/dist/rules/no-unsafe-alloc.js +51 -0
  314. package/dist/rules/no-unsafe-alloc.js.map +1 -0
  315. package/dist/rules/no-unsafe-cast-to-trusted-types.d.ts +5 -0
  316. package/dist/rules/no-unsafe-cast-to-trusted-types.d.ts.map +1 -0
  317. package/dist/rules/no-unsafe-cast-to-trusted-types.js +89 -0
  318. package/dist/rules/no-unsafe-cast-to-trusted-types.js.map +1 -0
  319. package/dist/rules/no-window-open-without-noopener.d.ts +5 -0
  320. package/dist/rules/no-window-open-without-noopener.d.ts.map +1 -0
  321. package/dist/rules/no-window-open-without-noopener.js +84 -0
  322. package/dist/rules/no-window-open-without-noopener.js.map +1 -0
  323. package/dist/rules/no-winjs-html-unsafe.d.ts +5 -0
  324. package/dist/rules/no-winjs-html-unsafe.d.ts.map +1 -0
  325. package/dist/rules/no-winjs-html-unsafe.js +32 -0
  326. package/dist/rules/no-winjs-html-unsafe.js.map +1 -0
  327. package/dist/rules/no-worker-blob-url.d.ts +5 -0
  328. package/dist/rules/no-worker-blob-url.d.ts.map +1 -0
  329. package/dist/rules/no-worker-blob-url.js +64 -0
  330. package/dist/rules/no-worker-blob-url.js.map +1 -0
  331. package/dist/rules/no-worker-data-url.d.ts +5 -0
  332. package/dist/rules/no-worker-data-url.d.ts.map +1 -0
  333. package/dist/rules/no-worker-data-url.js +67 -0
  334. package/dist/rules/no-worker-data-url.js.map +1 -0
  335. package/docs/rules/getting-started.md +70 -0
  336. package/docs/rules/no-angular-bypass-sanitizer.md +69 -0
  337. package/docs/rules/no-angular-bypass-security-trust-html.md +59 -0
  338. package/docs/rules/no-angular-innerhtml-binding.md +59 -0
  339. package/docs/rules/no-angular-sanitization-trusted-urls.md +64 -0
  340. package/docs/rules/no-angularjs-bypass-sce.md +64 -0
  341. package/docs/rules/no-angularjs-enable-svg.md +59 -0
  342. package/docs/rules/no-angularjs-ng-bind-html-without-sanitize.md +59 -0
  343. package/docs/rules/no-angularjs-sanitization-whitelist.md +63 -0
  344. package/docs/rules/no-angularjs-sce-resource-url-wildcard.md +62 -0
  345. package/docs/rules/no-child-process-exec.md +101 -0
  346. package/docs/rules/no-child-process-shell-true.md +59 -0
  347. package/docs/rules/no-cookies.md +61 -0
  348. package/docs/rules/no-document-domain.md +59 -0
  349. package/docs/rules/no-document-execcommand-insert-html.md +69 -0
  350. package/docs/rules/no-document-parse-html-unsafe.md +72 -0
  351. package/docs/rules/no-document-write.md +64 -0
  352. package/docs/rules/no-domparser-html-without-sanitization.md +59 -0
  353. package/docs/rules/no-domparser-svg-without-sanitization.md +71 -0
  354. package/docs/rules/no-dynamic-import-unsafe-url.md +81 -0
  355. package/docs/rules/no-electron-allow-running-insecure-content.md +69 -0
  356. package/docs/rules/no-electron-dangerous-blink-features.md +77 -0
  357. package/docs/rules/no-electron-disable-context-isolation.md +69 -0
  358. package/docs/rules/no-electron-disable-sandbox.md +69 -0
  359. package/docs/rules/no-electron-disable-web-security.md +69 -0
  360. package/docs/rules/no-electron-enable-remote-module.md +69 -0
  361. package/docs/rules/no-electron-enable-webview-tag.md +77 -0
  362. package/docs/rules/no-electron-experimental-features.md +77 -0
  363. package/docs/rules/no-electron-expose-raw-ipc-renderer.md +79 -0
  364. package/docs/rules/no-electron-insecure-certificate-error-handler.md +72 -0
  365. package/docs/rules/no-electron-insecure-certificate-verify-proc.md +63 -0
  366. package/docs/rules/no-electron-insecure-permission-request-handler.md +67 -0
  367. package/docs/rules/no-electron-node-integration.md +70 -0
  368. package/docs/rules/no-electron-permission-check-handler-allow-all.md +66 -0
  369. package/docs/rules/no-electron-unchecked-ipc-sender.md +62 -0
  370. package/docs/rules/no-electron-unrestricted-navigation.md +64 -0
  371. package/docs/rules/no-electron-untrusted-open-external.md +65 -0
  372. package/docs/rules/no-electron-webview-allowpopups.md +59 -0
  373. package/docs/rules/no-electron-webview-insecure-webpreferences.md +84 -0
  374. package/docs/rules/no-electron-webview-node-integration.md +59 -0
  375. package/docs/rules/no-html-method.md +58 -0
  376. package/docs/rules/no-http-request-to-insecure-protocol.md +59 -0
  377. package/docs/rules/no-iframe-srcdoc.md +76 -0
  378. package/docs/rules/no-inner-html.md +65 -0
  379. package/docs/rules/no-insecure-random.md +66 -0
  380. package/docs/rules/no-insecure-tls-agent-options.md +59 -0
  381. package/docs/rules/no-insecure-url.md +72 -0
  382. package/docs/rules/no-location-javascript-url.md +59 -0
  383. package/docs/rules/no-message-event-without-origin-check.md +82 -0
  384. package/docs/rules/no-msapp-exec-unsafe.md +59 -0
  385. package/docs/rules/no-node-tls-check-server-identity-bypass.md +88 -0
  386. package/docs/rules/no-node-tls-legacy-protocol.md +80 -0
  387. package/docs/rules/no-node-tls-reject-unauthorized-zero.md +61 -0
  388. package/docs/rules/no-node-tls-security-level-zero.md +77 -0
  389. package/docs/rules/no-node-vm-run-in-context.md +89 -0
  390. package/docs/rules/no-node-vm-source-text-module.md +79 -0
  391. package/docs/rules/no-node-worker-threads-eval.md +82 -0
  392. package/docs/rules/no-nonnull-assertion-on-security-input.md +59 -0
  393. package/docs/rules/no-postmessage-star-origin.md +59 -0
  394. package/docs/rules/no-postmessage-without-origin-allowlist.md +59 -0
  395. package/docs/rules/no-range-create-contextual-fragment.md +64 -0
  396. package/docs/rules/no-script-src-data-url.md +83 -0
  397. package/docs/rules/no-script-text.md +80 -0
  398. package/docs/rules/no-service-worker-unsafe-script-url.md +85 -0
  399. package/docs/rules/no-set-html-unsafe.md +64 -0
  400. package/docs/rules/no-trusted-types-policy-pass-through.md +68 -0
  401. package/docs/rules/no-unsafe-alloc.md +62 -0
  402. package/docs/rules/no-unsafe-cast-to-trusted-types.md +59 -0
  403. package/docs/rules/no-window-open-without-noopener.md +63 -0
  404. package/docs/rules/no-winjs-html-unsafe.md +60 -0
  405. package/docs/rules/no-worker-blob-url.md +86 -0
  406. package/docs/rules/no-worker-data-url.md +85 -0
  407. package/docs/rules/overview.md +111 -0
  408. package/docs/rules/presets/angular.md +35 -0
  409. package/docs/rules/presets/angularjs.md +36 -0
  410. package/docs/rules/presets/common.md +59 -0
  411. package/docs/rules/presets/electron.md +51 -0
  412. package/docs/rules/presets/index.md +26 -0
  413. package/docs/rules/presets/node.md +43 -0
  414. package/docs/rules/presets/react.md +33 -0
  415. package/docs/rules/presets/recommended.md +104 -0
  416. package/docs/rules/presets/required.md +99 -0
  417. package/docs/rules/presets/typescript.md +34 -0
  418. package/package.json +583 -0
@@ -0,0 +1,11 @@
1
+ import type { ESLint, Linter } from "eslint";
2
+ import type { SdlConfigName } from "./_internal/config-references.js";
3
+ type SdlConfig = Readonly<Linter.Config>;
4
+ type SdlConfigArray = readonly SdlConfig[];
5
+ type SdlPluginWithConfigs = ESLint.Plugin & {
6
+ readonly configs: Readonly<Record<SdlConfigName, SdlConfigArray>>;
7
+ };
8
+ /** ESLint plugin entrypoint with SDL rule set and flat-config presets. */
9
+ declare const sdlPlugin: SdlPluginWithConfigs;
10
+ export default sdlPlugin;
11
+ //# sourceMappingURL=plugin.d.ts.map
@@ -0,0 +1,11 @@
1
+ import type { ESLint, Linter } from "eslint";
2
+ import type { SdlConfigName } from "./_internal/config-references.js";
3
+ type SdlConfig = Readonly<Linter.Config>;
4
+ type SdlConfigArray = readonly SdlConfig[];
5
+ type SdlPluginWithConfigs = ESLint.Plugin & {
6
+ readonly configs: Readonly<Record<SdlConfigName, SdlConfigArray>>;
7
+ };
8
+ /** ESLint plugin entrypoint with SDL rule set and flat-config presets. */
9
+ declare const sdlPlugin: SdlPluginWithConfigs;
10
+ export default sdlPlugin;
11
+ //# sourceMappingURL=plugin.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAO7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAKtE,KAAK,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACzC,KAAK,cAAc,GAAG,SAAS,SAAS,EAAE,CAAC;AAG3C,KAAK,oBAAoB,GAAG,MAAM,CAAC,MAAM,GAAG;IACxC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;CACrE,CAAC;AAmPF,0EAA0E;AAC1E,QAAA,MAAM,SAAS,EAAE,oBAIhB,CAAC;AAEF,eAAe,SAAS,CAAC"}
package/dist/plugin.js ADDED
@@ -0,0 +1,235 @@
1
+ import typeScriptPlugin from "@typescript-eslint/eslint-plugin";
2
+ import typeScriptParser from "@typescript-eslint/parser";
3
+ import nodePlugin from "eslint-plugin-n";
4
+ import securityPlugin from "eslint-plugin-security";
5
+ import packageJson from "../package.json" with { type: "json" };
6
+ import sdlRules from "./_internal/rules-registry.js";
7
+ const typeScriptEslintPlugin = typeScriptPlugin;
8
+ const nodeEslintPlugin = nodePlugin;
9
+ const securityEslintPlugin = securityPlugin;
10
+ const typeScriptFiles = ["**/*.{ts,tsx,mts,cts}"];
11
+ const createAngularConfig = (plugin) => [
12
+ {
13
+ plugins: {
14
+ sdl: plugin,
15
+ },
16
+ rules: {
17
+ "sdl/no-angular-bypass-sanitizer": "error",
18
+ "sdl/no-angular-bypass-security-trust-html": "error",
19
+ "sdl/no-angular-innerhtml-binding": "error",
20
+ "sdl/no-angular-sanitization-trusted-urls": "error",
21
+ },
22
+ },
23
+ ];
24
+ const createAngularJsConfig = (plugin) => [
25
+ {
26
+ plugins: {
27
+ sdl: plugin,
28
+ },
29
+ rules: {
30
+ "sdl/no-angularjs-bypass-sce": "error",
31
+ "sdl/no-angularjs-enable-svg": "error",
32
+ "sdl/no-angularjs-ng-bind-html-without-sanitize": "error",
33
+ "sdl/no-angularjs-sanitization-whitelist": "error",
34
+ "sdl/no-angularjs-sce-resource-url-wildcard": "error",
35
+ },
36
+ },
37
+ ];
38
+ const createCommonConfig = (plugin) => [
39
+ {
40
+ plugins: {
41
+ sdl: plugin,
42
+ },
43
+ rules: {
44
+ "no-caller": "error",
45
+ "no-delete-var": "error",
46
+ "no-eval": "error",
47
+ "no-implied-eval": "error",
48
+ "no-new-func": "error",
49
+ "sdl/no-cookies": "error",
50
+ "sdl/no-document-domain": "error",
51
+ "sdl/no-document-execcommand-insert-html": "error",
52
+ "sdl/no-document-parse-html-unsafe": "error",
53
+ "sdl/no-document-write": "error",
54
+ "sdl/no-domparser-html-without-sanitization": "error",
55
+ "sdl/no-domparser-svg-without-sanitization": "error",
56
+ "sdl/no-dynamic-import-unsafe-url": "error",
57
+ "sdl/no-html-method": "error",
58
+ "sdl/no-iframe-srcdoc": "error",
59
+ "sdl/no-inner-html": "error",
60
+ "sdl/no-insecure-random": "error",
61
+ "sdl/no-insecure-url": "error",
62
+ "sdl/no-location-javascript-url": "error",
63
+ "sdl/no-message-event-without-origin-check": "error",
64
+ "sdl/no-msapp-exec-unsafe": "error",
65
+ "sdl/no-postmessage-star-origin": "error",
66
+ "sdl/no-postmessage-without-origin-allowlist": "error",
67
+ "sdl/no-range-create-contextual-fragment": "error",
68
+ "sdl/no-script-src-data-url": "error",
69
+ "sdl/no-script-text": "error",
70
+ "sdl/no-service-worker-unsafe-script-url": "error",
71
+ "sdl/no-set-html-unsafe": "error",
72
+ "sdl/no-window-open-without-noopener": "error",
73
+ "sdl/no-winjs-html-unsafe": "error",
74
+ "sdl/no-worker-blob-url": "error",
75
+ "sdl/no-worker-data-url": "error",
76
+ },
77
+ },
78
+ ];
79
+ const createElectronConfig = (plugin) => [
80
+ {
81
+ plugins: {
82
+ sdl: plugin,
83
+ },
84
+ rules: {
85
+ "sdl/no-electron-allow-running-insecure-content": "error",
86
+ "sdl/no-electron-dangerous-blink-features": "error",
87
+ "sdl/no-electron-disable-context-isolation": "error",
88
+ "sdl/no-electron-disable-sandbox": "error",
89
+ "sdl/no-electron-disable-web-security": "error",
90
+ "sdl/no-electron-enable-remote-module": "error",
91
+ "sdl/no-electron-enable-webview-tag": "error",
92
+ "sdl/no-electron-experimental-features": "error",
93
+ "sdl/no-electron-expose-raw-ipc-renderer": "error",
94
+ "sdl/no-electron-insecure-certificate-error-handler": "error",
95
+ "sdl/no-electron-insecure-certificate-verify-proc": "error",
96
+ "sdl/no-electron-insecure-permission-request-handler": "error",
97
+ "sdl/no-electron-node-integration": "error",
98
+ "sdl/no-electron-permission-check-handler-allow-all": "error",
99
+ "sdl/no-electron-unchecked-ipc-sender": "error",
100
+ "sdl/no-electron-unrestricted-navigation": "error",
101
+ "sdl/no-electron-untrusted-open-external": "error",
102
+ "sdl/no-electron-webview-allowpopups": "error",
103
+ "sdl/no-electron-webview-insecure-webpreferences": "error",
104
+ "sdl/no-electron-webview-node-integration": "error",
105
+ },
106
+ },
107
+ ];
108
+ const createNodeConfig = (plugin) => [
109
+ {
110
+ plugins: {
111
+ n: nodeEslintPlugin,
112
+ },
113
+ rules: {
114
+ "n/no-deprecated-api": "error",
115
+ },
116
+ },
117
+ {
118
+ plugins: {
119
+ sdl: plugin,
120
+ },
121
+ rules: {
122
+ "sdl/no-child-process-exec": "error",
123
+ "sdl/no-child-process-shell-true": "error",
124
+ "sdl/no-http-request-to-insecure-protocol": "error",
125
+ "sdl/no-insecure-tls-agent-options": "error",
126
+ "sdl/no-node-tls-check-server-identity-bypass": "error",
127
+ "sdl/no-node-tls-legacy-protocol": "error",
128
+ "sdl/no-node-tls-reject-unauthorized-zero": "error",
129
+ "sdl/no-node-tls-security-level-zero": "error",
130
+ "sdl/no-node-vm-run-in-context": "error",
131
+ "sdl/no-node-vm-source-text-module": "error",
132
+ "sdl/no-node-worker-threads-eval": "error",
133
+ "sdl/no-unsafe-alloc": "error",
134
+ },
135
+ },
136
+ ];
137
+ const createReactConfig = (plugin) => [
138
+ {
139
+ languageOptions: {
140
+ parserOptions: {
141
+ ecmaFeatures: {
142
+ jsx: true,
143
+ },
144
+ },
145
+ },
146
+ },
147
+ {
148
+ plugins: {
149
+ sdl: plugin,
150
+ },
151
+ },
152
+ ];
153
+ const createTypeScriptConfig = (plugin) => [
154
+ {
155
+ languageOptions: {
156
+ parserOptions: {
157
+ ecmaVersion: "latest",
158
+ sourceType: "module",
159
+ },
160
+ },
161
+ },
162
+ {
163
+ files: [...typeScriptFiles],
164
+ languageOptions: {
165
+ parser: typeScriptParser,
166
+ parserOptions: {
167
+ ecmaFeatures: {
168
+ jsx: true,
169
+ },
170
+ ecmaVersion: "latest",
171
+ sourceType: "module",
172
+ },
173
+ },
174
+ plugins: {
175
+ "@typescript-eslint": typeScriptEslintPlugin,
176
+ sdl: plugin,
177
+ },
178
+ rules: {
179
+ "@typescript-eslint/no-implied-eval": "error",
180
+ "no-implied-eval": "off",
181
+ "sdl/no-nonnull-assertion-on-security-input": "error",
182
+ "sdl/no-trusted-types-policy-pass-through": "error",
183
+ "sdl/no-unsafe-cast-to-trusted-types": "error",
184
+ },
185
+ },
186
+ ];
187
+ const createRequiredConfig = (configs) => [
188
+ ...configs.angular,
189
+ ...configs.angularjs,
190
+ ...configs.common,
191
+ ...configs.electron,
192
+ ...configs.node,
193
+ ...configs.react,
194
+ ];
195
+ const createRecommendedConfig = (configs) => [
196
+ ...configs.required,
197
+ ...configs.typescript,
198
+ {
199
+ plugins: {
200
+ security: securityEslintPlugin,
201
+ },
202
+ },
203
+ ];
204
+ const packageJsonVersion = typeof packageJson.version === "string" && packageJson.version.length > 0
205
+ ? packageJson.version
206
+ : "0.0.0";
207
+ const pluginCore = {
208
+ meta: {
209
+ name: "eslint-plugin-sdl-2",
210
+ namespace: "sdl",
211
+ version: packageJsonVersion,
212
+ },
213
+ rules: sdlRules,
214
+ };
215
+ const configs = {
216
+ angular: createAngularConfig(pluginCore),
217
+ angularjs: createAngularJsConfig(pluginCore),
218
+ common: createCommonConfig(pluginCore),
219
+ electron: createElectronConfig(pluginCore),
220
+ node: createNodeConfig(pluginCore),
221
+ react: createReactConfig(pluginCore),
222
+ recommended: [],
223
+ required: [],
224
+ typescript: createTypeScriptConfig(pluginCore),
225
+ };
226
+ configs.required = createRequiredConfig(configs);
227
+ configs.recommended = createRecommendedConfig(configs);
228
+ /** ESLint plugin entrypoint with SDL rule set and flat-config presets. */
229
+ const sdlPlugin = {
230
+ ...pluginCore,
231
+ configs,
232
+ rules: sdlRules,
233
+ };
234
+ export default sdlPlugin;
235
+ //# sourceMappingURL=plugin.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,gBAAgB,MAAM,kCAAkC,CAAC;AAChE,OAAO,gBAAgB,MAAM,2BAA2B,CAAC;AACzD,OAAO,UAAU,MAAM,iBAAiB,CAAC;AACzC,OAAO,cAAc,MAAM,wBAAwB,CAAC;AAIpD,OAAO,WAAW,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAChE,OAAO,QAAQ,MAAM,+BAA+B,CAAC;AAUrD,MAAM,sBAAsB,GAAG,gBAA4C,CAAC;AAC5E,MAAM,gBAAgB,GAAG,UAAsC,CAAC;AAChE,MAAM,oBAAoB,GAAG,cAA0C,CAAC;AAExE,MAAM,eAAe,GAAG,CAAC,uBAAuB,CAAC,CAAC;AAElD,MAAM,mBAAmB,GAAG,CAAC,MAAiB,EAAkB,EAAE,CAAC;IAC/D;QACI,OAAO,EAAE;YACL,GAAG,EAAE,MAAM;SACd;QACD,KAAK,EAAE;YACH,iCAAiC,EAAE,OAAO;YAC1C,2CAA2C,EAAE,OAAO;YACpD,kCAAkC,EAAE,OAAO;YAC3C,0CAA0C,EAAE,OAAO;SACtD;KACJ;CACJ,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAAC,MAAiB,EAAkB,EAAE,CAAC;IACjE;QACI,OAAO,EAAE;YACL,GAAG,EAAE,MAAM;SACd;QACD,KAAK,EAAE;YACH,6BAA6B,EAAE,OAAO;YACtC,6BAA6B,EAAE,OAAO;YACtC,gDAAgD,EAAE,OAAO;YACzD,yCAAyC,EAAE,OAAO;YAClD,4CAA4C,EAAE,OAAO;SACxD;KACJ;CACJ,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,MAAiB,EAAkB,EAAE,CAAC;IAC9D;QACI,OAAO,EAAE;YACL,GAAG,EAAE,MAAM;SACd;QACD,KAAK,EAAE;YACH,WAAW,EAAE,OAAO;YACpB,eAAe,EAAE,OAAO;YACxB,SAAS,EAAE,OAAO;YAClB,iBAAiB,EAAE,OAAO;YAC1B,aAAa,EAAE,OAAO;YACtB,gBAAgB,EAAE,OAAO;YACzB,wBAAwB,EAAE,OAAO;YACjC,yCAAyC,EAAE,OAAO;YAClD,mCAAmC,EAAE,OAAO;YAC5C,uBAAuB,EAAE,OAAO;YAChC,4CAA4C,EAAE,OAAO;YACrD,2CAA2C,EAAE,OAAO;YACpD,kCAAkC,EAAE,OAAO;YAC3C,oBAAoB,EAAE,OAAO;YAC7B,sBAAsB,EAAE,OAAO;YAC/B,mBAAmB,EAAE,OAAO;YAC5B,wBAAwB,EAAE,OAAO;YACjC,qBAAqB,EAAE,OAAO;YAC9B,gCAAgC,EAAE,OAAO;YACzC,2CAA2C,EAAE,OAAO;YACpD,0BAA0B,EAAE,OAAO;YACnC,gCAAgC,EAAE,OAAO;YACzC,6CAA6C,EAAE,OAAO;YACtD,yCAAyC,EAAE,OAAO;YAClD,4BAA4B,EAAE,OAAO;YACrC,oBAAoB,EAAE,OAAO;YAC7B,yCAAyC,EAAE,OAAO;YAClD,wBAAwB,EAAE,OAAO;YACjC,qCAAqC,EAAE,OAAO;YAC9C,0BAA0B,EAAE,OAAO;YACnC,wBAAwB,EAAE,OAAO;YACjC,wBAAwB,EAAE,OAAO;SACpC;KACJ;CACJ,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAAC,MAAiB,EAAkB,EAAE,CAAC;IAChE;QACI,OAAO,EAAE;YACL,GAAG,EAAE,MAAM;SACd;QACD,KAAK,EAAE;YACH,gDAAgD,EAAE,OAAO;YACzD,0CAA0C,EAAE,OAAO;YACnD,2CAA2C,EAAE,OAAO;YACpD,iCAAiC,EAAE,OAAO;YAC1C,sCAAsC,EAAE,OAAO;YAC/C,sCAAsC,EAAE,OAAO;YAC/C,oCAAoC,EAAE,OAAO;YAC7C,uCAAuC,EAAE,OAAO;YAChD,yCAAyC,EAAE,OAAO;YAClD,oDAAoD,EAAE,OAAO;YAC7D,kDAAkD,EAAE,OAAO;YAC3D,qDAAqD,EAAE,OAAO;YAC9D,kCAAkC,EAAE,OAAO;YAC3C,oDAAoD,EAAE,OAAO;YAC7D,sCAAsC,EAAE,OAAO;YAC/C,yCAAyC,EAAE,OAAO;YAClD,yCAAyC,EAAE,OAAO;YAClD,qCAAqC,EAAE,OAAO;YAC9C,iDAAiD,EAAE,OAAO;YAC1D,0CAA0C,EAAE,OAAO;SACtD;KACJ;CACJ,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,MAAiB,EAAkB,EAAE,CAAC;IAC5D;QACI,OAAO,EAAE;YACL,CAAC,EAAE,gBAAgB;SACtB;QACD,KAAK,EAAE;YACH,qBAAqB,EAAE,OAAO;SACjC;KACJ;IACD;QACI,OAAO,EAAE;YACL,GAAG,EAAE,MAAM;SACd;QACD,KAAK,EAAE;YACH,2BAA2B,EAAE,OAAO;YACpC,iCAAiC,EAAE,OAAO;YAC1C,0CAA0C,EAAE,OAAO;YACnD,mCAAmC,EAAE,OAAO;YAC5C,8CAA8C,EAAE,OAAO;YACvD,iCAAiC,EAAE,OAAO;YAC1C,0CAA0C,EAAE,OAAO;YACnD,qCAAqC,EAAE,OAAO;YAC9C,+BAA+B,EAAE,OAAO;YACxC,mCAAmC,EAAE,OAAO;YAC5C,iCAAiC,EAAE,OAAO;YAC1C,qBAAqB,EAAE,OAAO;SACjC;KACJ;CACJ,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,MAAiB,EAAkB,EAAE,CAAC;IAC7D;QACI,eAAe,EAAE;YACb,aAAa,EAAE;gBACX,YAAY,EAAE;oBACV,GAAG,EAAE,IAAI;iBACZ;aACJ;SACJ;KACJ;IACD;QACI,OAAO,EAAE;YACL,GAAG,EAAE,MAAM;SACd;KACJ;CACJ,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAAC,MAAiB,EAAkB,EAAE,CAAC;IAClE;QACI,eAAe,EAAE;YACb,aAAa,EAAE;gBACX,WAAW,EAAE,QAAQ;gBACrB,UAAU,EAAE,QAAQ;aACvB;SACJ;KACJ;IACD;QACI,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC;QAC3B,eAAe,EAAE;YACb,MAAM,EAAE,gBAAgB;YACxB,aAAa,EAAE;gBACX,YAAY,EAAE;oBACV,GAAG,EAAE,IAAI;iBACZ;gBACD,WAAW,EAAE,QAAQ;gBACrB,UAAU,EAAE,QAAQ;aACvB;SACJ;QACD,OAAO,EAAE;YACL,oBAAoB,EAAE,sBAAsB;YAC5C,GAAG,EAAE,MAAM;SACd;QACD,KAAK,EAAE;YACH,oCAAoC,EAAE,OAAO;YAC7C,iBAAiB,EAAE,KAAK;YACxB,4CAA4C,EAAE,OAAO;YACrD,0CAA0C,EAAE,OAAO;YACnD,qCAAqC,EAAE,OAAO;SACjD;KACJ;CACJ,CAAC;AAEF,MAAM,oBAAoB,GAAG,CACzB,OAA+B,EACjB,EAAE,CAAC;IACjB,GAAG,OAAO,CAAC,OAAO;IAClB,GAAG,OAAO,CAAC,SAAS;IACpB,GAAG,OAAO,CAAC,MAAM;IACjB,GAAG,OAAO,CAAC,QAAQ;IACnB,GAAG,OAAO,CAAC,IAAI;IACf,GAAG,OAAO,CAAC,KAAK;CACnB,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAC5B,OAA+B,EACjB,EAAE,CAAC;IACjB,GAAG,OAAO,CAAC,QAAQ;IACnB,GAAG,OAAO,CAAC,UAAU;IACrB;QACI,OAAO,EAAE;YACL,QAAQ,EAAE,oBAAoB;SACjC;KACJ;CACJ,CAAC;AAEF,MAAM,kBAAkB,GACpB,OAAO,WAAW,CAAC,OAAO,KAAK,QAAQ,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;IACrE,CAAC,CAAC,WAAW,CAAC,OAAO;IACrB,CAAC,CAAC,OAAO,CAAC;AAElB,MAAM,UAAU,GAAc;IAC1B,IAAI,EAAE;QACF,IAAI,EAAE,qBAAqB;QAC3B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,kBAAkB;KAC9B;IACD,KAAK,EAAE,QAA0D;CACpE,CAAC;AAEF,MAAM,OAAO,GAAiB;IAC1B,OAAO,EAAE,mBAAmB,CAAC,UAAU,CAAC;IACxC,SAAS,EAAE,qBAAqB,CAAC,UAAU,CAAC;IAC5C,MAAM,EAAE,kBAAkB,CAAC,UAAU,CAAC;IACtC,QAAQ,EAAE,oBAAoB,CAAC,UAAU,CAAC;IAC1C,IAAI,EAAE,gBAAgB,CAAC,UAAU,CAAC;IAClC,KAAK,EAAE,iBAAiB,CAAC,UAAU,CAAC;IACpC,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,EAAE;IACZ,UAAU,EAAE,sBAAsB,CAAC,UAAU,CAAC;CACjD,CAAC;AAEF,OAAO,CAAC,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;AACjD,OAAO,CAAC,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;AAEvD,0EAA0E;AAC1E,MAAM,SAAS,GAAyB;IACpC,GAAG,UAAU;IACb,OAAO;IACP,KAAK,EAAE,QAA0D;CACpE,CAAC;AAEF,eAAe,SAAS,CAAC"}
@@ -0,0 +1,5 @@
1
+ import { createRule } from "../_internal/create-rule.js";
2
+ /** Rule implementation. */
3
+ declare const rule: ReturnType<typeof createRule>;
4
+ export default rule;
5
+ //# sourceMappingURL=no-angular-bypass-sanitizer.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"no-angular-bypass-sanitizer.d.ts","sourceRoot":"","sources":["../../src/rules/no-angular-bypass-sanitizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,2BAA2B;AAC3B,QAAA,MAAM,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CA8BtC,CAAC;AAEH,eAAe,IAAI,CAAC"}
@@ -0,0 +1,32 @@
1
+ import { createRule } from "../_internal/create-rule.js";
2
+ /** Rule implementation. */
3
+ const rule = createRule({
4
+ create(context) {
5
+ return {
6
+ "CallExpression[arguments.length>0][callee.property.name=/^bypassSecurityTrust(?:html|resourceurl|script|style|url)$/i]"(node) {
7
+ context.report({
8
+ messageId: "noBypass",
9
+ node,
10
+ });
11
+ },
12
+ };
13
+ },
14
+ defaultOptions: [],
15
+ meta: {
16
+ deprecated: false,
17
+ docs: {
18
+ description: "disallow bypassing Angular DomSanitizer trust APIs such as bypassSecurityTrustHtml.",
19
+ frozen: false,
20
+ recommended: false,
21
+ url: "https://nick2bad4u.github.io/eslint-plugin-SDL-2/docs/rules/no-angular-bypass-sanitizer",
22
+ },
23
+ messages: {
24
+ noBypass: "Do not bypass Angular's built-in sanitizer.",
25
+ },
26
+ schema: [],
27
+ type: "problem",
28
+ },
29
+ name: "no-angular-bypass-sanitizer",
30
+ });
31
+ export default rule;
32
+ //# sourceMappingURL=no-angular-bypass-sanitizer.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"no-angular-bypass-sanitizer.js","sourceRoot":"","sources":["../../src/rules/no-angular-bypass-sanitizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,2BAA2B;AAC3B,MAAM,IAAI,GAAkC,UAAU,CAAC;IACnD,MAAM,CAAC,OAAO;QACV,OAAO;YACH,wHAAwH,CACpH,IAAI;gBAEJ,OAAO,CAAC,MAAM,CAAC;oBACX,SAAS,EAAE,UAAU;oBACrB,IAAI;iBACP,CAAC,CAAC;YACP,CAAC;SACJ,CAAC;IACN,CAAC;IACD,cAAc,EAAE,EAAE;IAClB,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,WAAW,EACP,qFAAqF;YACzF,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,KAAK;YAClB,GAAG,EAAE,yFAAyF;SACjG;QACD,QAAQ,EAAE;YACN,QAAQ,EAAE,6CAA6C;SAC1D;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KAClB;IACD,IAAI,EAAE,6BAA6B;CACtC,CAAC,CAAC;AAEH,eAAe,IAAI,CAAC"}
@@ -0,0 +1,5 @@
1
+ import { createRule } from "../_internal/create-rule.js";
2
+ /** Rule implementation. */
3
+ declare const rule: ReturnType<typeof createRule>;
4
+ export default rule;
5
+ //# sourceMappingURL=no-angular-bypass-security-trust-html.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"no-angular-bypass-security-trust-html.d.ts","sourceRoot":"","sources":["../../src/rules/no-angular-bypass-security-trust-html.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAwBzD,2BAA2B;AAC3B,QAAA,MAAM,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CAwCtC,CAAC;AAEH,eAAe,IAAI,CAAC"}
@@ -0,0 +1,51 @@
1
+ import { createRule } from "../_internal/create-rule.js";
2
+ const getMemberPropertyName = (memberExpression) => {
3
+ if (!memberExpression.computed &&
4
+ memberExpression.property.type === "Identifier") {
5
+ return memberExpression.property.name;
6
+ }
7
+ if (memberExpression.property.type === "Literal" &&
8
+ typeof memberExpression.property.value === "string") {
9
+ return memberExpression.property.value;
10
+ }
11
+ return undefined;
12
+ };
13
+ /** Rule implementation. */
14
+ const rule = createRule({
15
+ create(context) {
16
+ return {
17
+ CallExpression(node) {
18
+ if (node.callee.type !== "MemberExpression") {
19
+ return;
20
+ }
21
+ if (getMemberPropertyName(node.callee) !==
22
+ "bypassSecurityTrustHtml") {
23
+ return;
24
+ }
25
+ context.report({
26
+ messageId: "default",
27
+ node,
28
+ });
29
+ },
30
+ };
31
+ },
32
+ defaultOptions: [],
33
+ meta: {
34
+ deprecated: false,
35
+ docs: {
36
+ description: "disallow Angular bypassSecurityTrustHtml usage in application code.",
37
+ frozen: false,
38
+ recommended: false,
39
+ url: "https://nick2bad4u.github.io/eslint-plugin-SDL-2/docs/rules/no-angular-bypass-security-trust-html",
40
+ },
41
+ messages: {
42
+ default: "Avoid bypassSecurityTrustHtml; use validated/sanitized HTML flows instead.",
43
+ },
44
+ schema: [],
45
+ type: "problem",
46
+ },
47
+ name: "no-angular-bypass-security-trust-html",
48
+ });
49
+ export default rule;
50
+ /* eslint-enable @typescript-eslint/prefer-readonly-parameter-types -- Restore linting after rule implementation declarations. */
51
+ //# sourceMappingURL=no-angular-bypass-security-trust-html.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"no-angular-bypass-security-trust-html.js","sourceRoot":"","sources":["../../src/rules/no-angular-bypass-security-trust-html.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAIzD,MAAM,qBAAqB,GAAG,CAC1B,gBAA2C,EACzB,EAAE;IACpB,IACI,CAAC,gBAAgB,CAAC,QAAQ;QAC1B,gBAAgB,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,EACjD,CAAC;QACC,OAAO,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC1C,CAAC;IAED,IACI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS;QAC5C,OAAO,gBAAgB,CAAC,QAAQ,CAAC,KAAK,KAAK,QAAQ,EACrD,CAAC;QACC,OAAO,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC;IAC3C,CAAC;IAED,OAAO,SAAS,CAAC;AACrB,CAAC,CAAC;AAEF,2BAA2B;AAC3B,MAAM,IAAI,GAAkC,UAAU,CAAwB;IAC1E,MAAM,CAAC,OAAO;QACV,OAAO;YACH,cAAc,CAAC,IAA6B;gBACxC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;oBAC1C,OAAO;gBACX,CAAC;gBAED,IACI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC;oBAClC,yBAAyB,EAC3B,CAAC;oBACC,OAAO;gBACX,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACX,SAAS,EAAE,SAAS;oBACpB,IAAI;iBACP,CAAC,CAAC;YACP,CAAC;SACJ,CAAC;IACN,CAAC;IACD,cAAc,EAAE,EAAE;IAClB,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,WAAW,EACP,qEAAqE;YACzE,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,KAAK;YAClB,GAAG,EAAE,mGAAmG;SAC3G;QACD,QAAQ,EAAE;YACN,OAAO,EACH,4EAA4E;SACnF;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KAClB;IACD,IAAI,EAAE,uCAAuC;CAChD,CAAC,CAAC;AAEH,eAAe,IAAI,CAAC;AACpB,iIAAiI"}
@@ -0,0 +1,5 @@
1
+ import { createRule } from "../_internal/create-rule.js";
2
+ /** Rule implementation. */
3
+ declare const rule: ReturnType<typeof createRule>;
4
+ export default rule;
5
+ //# sourceMappingURL=no-angular-innerhtml-binding.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"no-angular-innerhtml-binding.d.ts","sourceRoot":"","sources":["../../src/rules/no-angular-innerhtml-binding.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAOzD,2BAA2B;AAC3B,QAAA,MAAM,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CAyDtC,CAAC;AAEH,eAAe,IAAI,CAAC"}
@@ -0,0 +1,57 @@
1
+ import { arrayFirst } from "ts-extras";
2
+ import { createRule } from "../_internal/create-rule.js";
3
+ const hasInnerHtmlBindingPattern = (text) => /\[\s*innerhtml\s*\]\s*=/iu.test(text);
4
+ /** Rule implementation. */
5
+ const rule = createRule({
6
+ create(context) {
7
+ return {
8
+ Literal(node) {
9
+ if (typeof node.value !== "string") {
10
+ return;
11
+ }
12
+ if (!hasInnerHtmlBindingPattern(node.value)) {
13
+ return;
14
+ }
15
+ context.report({
16
+ messageId: "default",
17
+ node,
18
+ });
19
+ },
20
+ TemplateLiteral(node) {
21
+ if (node.expressions.length > 0) {
22
+ return;
23
+ }
24
+ const templateValue = arrayFirst(node.quasis)?.value.cooked;
25
+ if (typeof templateValue !== "string") {
26
+ return;
27
+ }
28
+ if (!hasInnerHtmlBindingPattern(templateValue)) {
29
+ return;
30
+ }
31
+ context.report({
32
+ messageId: "default",
33
+ node,
34
+ });
35
+ },
36
+ };
37
+ },
38
+ defaultOptions: [],
39
+ meta: {
40
+ deprecated: false,
41
+ docs: {
42
+ description: "disallow Angular [innerHTML] template bindings without a reviewed sanitization/trusted-types strategy.",
43
+ frozen: false,
44
+ recommended: false,
45
+ url: "https://nick2bad4u.github.io/eslint-plugin-SDL-2/docs/rules/no-angular-innerhtml-binding",
46
+ },
47
+ messages: {
48
+ default: "Avoid raw [innerHTML] bindings unless input is strictly sanitized by a reviewed policy.",
49
+ },
50
+ schema: [],
51
+ type: "problem",
52
+ },
53
+ name: "no-angular-innerhtml-binding",
54
+ });
55
+ export default rule;
56
+ /* eslint-enable @typescript-eslint/prefer-readonly-parameter-types -- Restore linting after rule implementation declarations. */
57
+ //# sourceMappingURL=no-angular-innerhtml-binding.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"no-angular-innerhtml-binding.js","sourceRoot":"","sources":["../../src/rules/no-angular-innerhtml-binding.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAIzD,MAAM,0BAA0B,GAAG,CAAC,IAAY,EAAW,EAAE,CACzD,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAE3C,2BAA2B;AAC3B,MAAM,IAAI,GAAkC,UAAU,CAAwB;IAC1E,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO,CAAC,IAAsB;gBAC1B,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACjC,OAAO;gBACX,CAAC;gBAED,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1C,OAAO;gBACX,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACX,SAAS,EAAE,SAAS;oBACpB,IAAI;iBACP,CAAC,CAAC;YACP,CAAC;YACD,eAAe,CAAC,IAA8B;gBAC1C,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC9B,OAAO;gBACX,CAAC;gBAED,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC;gBAE5D,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;oBACpC,OAAO;gBACX,CAAC;gBAED,IAAI,CAAC,0BAA0B,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC7C,OAAO;gBACX,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACX,SAAS,EAAE,SAAS;oBACpB,IAAI;iBACP,CAAC,CAAC;YACP,CAAC;SACJ,CAAC;IACN,CAAC;IACD,cAAc,EAAE,EAAE;IAClB,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,WAAW,EACP,wGAAwG;YAC5G,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,KAAK;YAClB,GAAG,EAAE,0FAA0F;SAClG;QACD,QAAQ,EAAE;YACN,OAAO,EACH,yFAAyF;SAChG;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KAClB;IACD,IAAI,EAAE,8BAA8B;CACvC,CAAC,CAAC;AAEH,eAAe,IAAI,CAAC;AACpB,iIAAiI"}
@@ -0,0 +1,5 @@
1
+ import { createRule } from "../_internal/create-rule.js";
2
+ /** Rule implementation. */
3
+ declare const rule: ReturnType<typeof createRule>;
4
+ export default rule;
5
+ //# sourceMappingURL=no-angular-sanitization-trusted-urls.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"no-angular-sanitization-trusted-urls.d.ts","sourceRoot":"","sources":["../../src/rules/no-angular-sanitization-trusted-urls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,2BAA2B;AAC3B,QAAA,MAAM,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CA+BtC,CAAC;AAEH,eAAe,IAAI,CAAC"}
@@ -0,0 +1,32 @@
1
+ import { createRule } from "../_internal/create-rule.js";
2
+ /** Rule implementation. */
3
+ const rule = createRule({
4
+ create(context) {
5
+ return {
6
+ "CallExpression[arguments.length>0][callee.object.name='$compileProvider'][callee.property.name=/^(?:aHref|imgSrc)SanitizationTrustedUrlList$/]"(node) {
7
+ context.report({
8
+ messageId: "noSanitizationTrustedUrls",
9
+ node,
10
+ });
11
+ },
12
+ };
13
+ },
14
+ defaultOptions: [],
15
+ meta: {
16
+ deprecated: false,
17
+ docs: {
18
+ description: "disallow AngularJS trusted URL list mutations via $compileProvider.*SanitizationTrustedUrlList.",
19
+ frozen: false,
20
+ recommended: false,
21
+ url: "https://nick2bad4u.github.io/eslint-plugin-SDL-2/docs/rules/no-angular-sanitization-trusted-urls",
22
+ },
23
+ messages: {
24
+ noSanitizationTrustedUrls: "Do not modify AngularJS sanitization trusted URL lists.",
25
+ },
26
+ schema: [],
27
+ type: "problem",
28
+ },
29
+ name: "no-angular-sanitization-trusted-urls",
30
+ });
31
+ export default rule;
32
+ //# sourceMappingURL=no-angular-sanitization-trusted-urls.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"no-angular-sanitization-trusted-urls.js","sourceRoot":"","sources":["../../src/rules/no-angular-sanitization-trusted-urls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,2BAA2B;AAC3B,MAAM,IAAI,GAAkC,UAAU,CAAC;IACnD,MAAM,CAAC,OAAO;QACV,OAAO;YACH,gJAAgJ,CAC5I,IAAI;gBAEJ,OAAO,CAAC,MAAM,CAAC;oBACX,SAAS,EAAE,2BAA2B;oBACtC,IAAI;iBACP,CAAC,CAAC;YACP,CAAC;SACJ,CAAC;IACN,CAAC;IACD,cAAc,EAAE,EAAE;IAClB,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,WAAW,EACP,iGAAiG;YACrG,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,KAAK;YAClB,GAAG,EAAE,kGAAkG;SAC1G;QACD,QAAQ,EAAE;YACN,yBAAyB,EACrB,yDAAyD;SAChE;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KAClB;IACD,IAAI,EAAE,sCAAsC;CAC/C,CAAC,CAAC;AAEH,eAAe,IAAI,CAAC"}
@@ -0,0 +1,5 @@
1
+ import { createRule } from "../_internal/create-rule.js";
2
+ /** Rule implementation for no-angularjs-bypass-sce. */
3
+ export declare const noAngularjsBypassSceRule: ReturnType<typeof createRule>;
4
+ export default noAngularjsBypassSceRule;
5
+ //# sourceMappingURL=no-angularjs-bypass-sce.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"no-angularjs-bypass-sce.d.ts","sourceRoot":"","sources":["../../src/rules/no-angularjs-bypass-sce.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAgCzD,uDAAuD;AACvD,eAAO,MAAM,wBAAwB,EAAE,UAAU,CAAC,OAAO,UAAU,CAiF7D,CAAC;AAEP,eAAe,wBAAwB,CAAC"}
@@ -0,0 +1,80 @@
1
+ import { arrayFirst, arrayIncludes } from "ts-extras";
2
+ import { createRule } from "../_internal/create-rule.js";
3
+ const isEmptyLiteral = (argument) => argument?.type === "Literal" && argument.value === "";
4
+ const isSceProviderEnabledSafeLiteral = (argument) => argument?.type === "Literal" &&
5
+ arrayIncludes([
6
+ 1,
7
+ "1",
8
+ true,
9
+ "true",
10
+ ], argument.value);
11
+ const isBypassSceMethod = (methodName) => arrayIncludes([
12
+ "trustAs",
13
+ "trustAsCss",
14
+ "trustAsHtml",
15
+ "trustAsJs",
16
+ "trustAsResourceUrl",
17
+ "trustAsUrl",
18
+ ], methodName);
19
+ /** Rule implementation for no-angularjs-bypass-sce. */
20
+ export const noAngularjsBypassSceRule = createRule({
21
+ create(context) {
22
+ const report = (node) => {
23
+ context.report({
24
+ messageId: "doNotBypass",
25
+ node,
26
+ });
27
+ };
28
+ return {
29
+ "CallExpression[callee.type='MemberExpression'][callee.object.type='Identifier'][callee.object.name='$sce'][callee.property.type='Identifier']"(node) {
30
+ if (node.callee.type !== "MemberExpression" ||
31
+ node.callee.property.type !== "Identifier") {
32
+ return;
33
+ }
34
+ if (!isBypassSceMethod(node.callee.property.name)) {
35
+ return;
36
+ }
37
+ const firstArgument = arrayFirst(node.arguments);
38
+ if (node.arguments.length === 1 &&
39
+ isEmptyLiteral(firstArgument)) {
40
+ return;
41
+ }
42
+ report(node);
43
+ },
44
+ "CallExpression[callee.type='MemberExpression'][callee.object.type='Identifier'][callee.object.name='$sceProvider'][callee.property.type='Identifier'][callee.property.name='enabled']"(node) {
45
+ const firstArgument = arrayFirst(node.arguments);
46
+ if (isSceProviderEnabledSafeLiteral(firstArgument)) {
47
+ return;
48
+ }
49
+ report(node);
50
+ },
51
+ "CallExpression[callee.type='MemberExpression'][callee.property.type='Identifier'][callee.property.name='trustAs']"(node) {
52
+ const firstArgument = arrayFirst(node.arguments);
53
+ if (node.arguments.length === 1 &&
54
+ isEmptyLiteral(firstArgument)) {
55
+ return;
56
+ }
57
+ report(node);
58
+ },
59
+ };
60
+ },
61
+ defaultOptions: [],
62
+ meta: {
63
+ deprecated: false,
64
+ docs: {
65
+ description: "disallow AngularJS SCE bypass APIs that trust unvalidated values.",
66
+ frozen: false,
67
+ recommended: false,
68
+ url: "https://github.com/Nick2bad4u/eslint-plugin-SDL-2/blob/main/docs/rules/no-angularjs-bypass-sce.md",
69
+ },
70
+ messages: {
71
+ doNotBypass: "Do not bypass AngularJS SCE with untrusted values. Validate and sanitize content before marking it trusted.",
72
+ },
73
+ schema: [],
74
+ type: "problem",
75
+ },
76
+ name: "no-angularjs-bypass-sce",
77
+ });
78
+ export default noAngularjsBypassSceRule;
79
+ /* eslint-enable @typescript-eslint/prefer-readonly-parameter-types -- Restore linting after rule implementation declarations. */
80
+ //# sourceMappingURL=no-angularjs-bypass-sce.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"no-angularjs-bypass-sce.js","sourceRoot":"","sources":["../../src/rules/no-angularjs-bypass-sce.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,MAAM,cAAc,GAAG,CAAC,QAAmC,EAAW,EAAE,CACpE,QAAQ,EAAE,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;AAE1D,MAAM,+BAA+B,GAAG,CACpC,QAAmC,EAC5B,EAAE,CACT,QAAQ,EAAE,IAAI,KAAK,SAAS;IAC5B,aAAa,CACT;QACI,CAAC;QACD,GAAG;QACH,IAAI;QACJ,MAAM;KACT,EACD,QAAQ,CAAC,KAAK,CACjB,CAAC;AAEN,MAAM,iBAAiB,GAAG,CAAC,UAAkB,EAAW,EAAE,CACtD,aAAa,CACT;IACI,SAAS;IACT,YAAY;IACZ,aAAa;IACb,WAAW;IACX,oBAAoB;IACpB,YAAY;CACf,EACD,UAAU,CACb,CAAC;AAEN,uDAAuD;AACvD,MAAM,CAAC,MAAM,wBAAwB,GACjC,UAAU,CAAC;IACP,MAAM,CAAC,OAAO;QACV,MAAM,MAAM,GAAG,CAAC,IAA6B,EAAQ,EAAE;YACnD,OAAO,CAAC,MAAM,CAAC;gBACX,SAAS,EAAE,aAAa;gBACxB,IAAI;aACP,CAAC,CAAC;QACP,CAAC,CAAC;QAEF,OAAO;YACH,+IAA+I,CAC3I,IAA6B;gBAE7B,IACI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;oBACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,EAC5C,CAAC;oBACC,OAAO;gBACX,CAAC;gBAED,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChD,OAAO;gBACX,CAAC;gBAED,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAEjD,IACI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;oBAC3B,cAAc,CAAC,aAAa,CAAC,EAC/B,CAAC;oBACC,OAAO;gBACX,CAAC;gBAED,MAAM,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;YACD,uLAAuL,CACnL,IAA6B;gBAE7B,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAEjD,IAAI,+BAA+B,CAAC,aAAa,CAAC,EAAE,CAAC;oBACjD,OAAO;gBACX,CAAC;gBAED,MAAM,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;YACD,mHAAmH,CAC/G,IAA6B;gBAE7B,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAEjD,IACI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;oBAC3B,cAAc,CAAC,aAAa,CAAC,EAC/B,CAAC;oBACC,OAAO;gBACX,CAAC;gBAED,MAAM,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;SACJ,CAAC;IACN,CAAC;IACD,cAAc,EAAE,EAAW;IAC3B,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,WAAW,EACP,mEAAmE;YACvE,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,KAAK;YAClB,GAAG,EAAE,mGAAmG;SAC3G;QACD,QAAQ,EAAE;YACN,WAAW,EACP,6GAA6G;SACpH;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KAClB;IACD,IAAI,EAAE,yBAAyB;CAClC,CAAC,CAAC;AAEP,eAAe,wBAAwB,CAAC;AACxC,iIAAiI"}
@@ -0,0 +1,5 @@
1
+ import { createRule } from "../_internal/create-rule.js";
2
+ /** Rule implementation. */
3
+ declare const rule: ReturnType<typeof createRule>;
4
+ export default rule;
5
+ //# sourceMappingURL=no-angularjs-enable-svg.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"no-angularjs-enable-svg.d.ts","sourceRoot":"","sources":["../../src/rules/no-angularjs-enable-svg.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAgBzD,2BAA2B;AAC3B,QAAA,MAAM,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CAwCtC,CAAC;AAEH,eAAe,IAAI,CAAC"}