eslint-plugin-sdl-2 1.0.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +5316 -0
- package/LICENSE +21 -0
- package/README.md +133 -0
- package/dist/_internal/ast-utils.d.ts +17 -0
- package/dist/_internal/ast-utils.d.ts.map +1 -0
- package/dist/_internal/ast-utils.js +93 -0
- package/dist/_internal/ast-utils.js.map +1 -0
- package/dist/_internal/config-references.d.ts +5 -0
- package/dist/_internal/config-references.d.ts.map +1 -0
- package/dist/_internal/config-references.js +13 -0
- package/dist/_internal/config-references.js.map +1 -0
- package/dist/_internal/create-rule.d.ts +9 -0
- package/dist/_internal/create-rule.d.ts.map +1 -0
- package/dist/_internal/create-rule.js +6 -0
- package/dist/_internal/create-rule.js.map +1 -0
- package/dist/_internal/domparser.d.ts +19 -0
- package/dist/_internal/domparser.d.ts.map +1 -0
- package/dist/_internal/domparser.js +45 -0
- package/dist/_internal/domparser.js.map +1 -0
- package/dist/_internal/electron-web-preferences.d.ts +14 -0
- package/dist/_internal/electron-web-preferences.d.ts.map +1 -0
- package/dist/_internal/electron-web-preferences.js +63 -0
- package/dist/_internal/electron-web-preferences.js.map +1 -0
- package/dist/_internal/estree-utils.d.ts +51 -0
- package/dist/_internal/estree-utils.d.ts.map +1 -0
- package/dist/_internal/estree-utils.js +112 -0
- package/dist/_internal/estree-utils.js.map +1 -0
- package/dist/_internal/node-tls-config.d.ts +44 -0
- package/dist/_internal/node-tls-config.d.ts.map +1 -0
- package/dist/_internal/node-tls-config.js +101 -0
- package/dist/_internal/node-tls-config.js.map +1 -0
- package/dist/_internal/rules-registry.d.ts +10 -0
- package/dist/_internal/rules-registry.d.ts.map +1 -0
- package/dist/_internal/rules-registry.js +148 -0
- package/dist/_internal/rules-registry.js.map +1 -0
- package/dist/_internal/script-element.d.ts +7 -0
- package/dist/_internal/script-element.d.ts.map +1 -0
- package/dist/_internal/script-element.js +46 -0
- package/dist/_internal/script-element.js.map +1 -0
- package/dist/_internal/worker-code-loading.d.ts +69 -0
- package/dist/_internal/worker-code-loading.d.ts.map +1 -0
- package/dist/_internal/worker-code-loading.js +134 -0
- package/dist/_internal/worker-code-loading.js.map +1 -0
- package/dist/plugin.cjs +6036 -0
- package/dist/plugin.cjs.map +7 -0
- package/dist/plugin.d.cts +11 -0
- package/dist/plugin.d.ts +11 -0
- package/dist/plugin.d.ts.map +1 -0
- package/dist/plugin.js +235 -0
- package/dist/plugin.js.map +1 -0
- package/dist/rules/no-angular-bypass-sanitizer.d.ts +5 -0
- package/dist/rules/no-angular-bypass-sanitizer.d.ts.map +1 -0
- package/dist/rules/no-angular-bypass-sanitizer.js +32 -0
- package/dist/rules/no-angular-bypass-sanitizer.js.map +1 -0
- package/dist/rules/no-angular-bypass-security-trust-html.d.ts +5 -0
- package/dist/rules/no-angular-bypass-security-trust-html.d.ts.map +1 -0
- package/dist/rules/no-angular-bypass-security-trust-html.js +51 -0
- package/dist/rules/no-angular-bypass-security-trust-html.js.map +1 -0
- package/dist/rules/no-angular-innerhtml-binding.d.ts +5 -0
- package/dist/rules/no-angular-innerhtml-binding.d.ts.map +1 -0
- package/dist/rules/no-angular-innerhtml-binding.js +57 -0
- package/dist/rules/no-angular-innerhtml-binding.js.map +1 -0
- package/dist/rules/no-angular-sanitization-trusted-urls.d.ts +5 -0
- package/dist/rules/no-angular-sanitization-trusted-urls.d.ts.map +1 -0
- package/dist/rules/no-angular-sanitization-trusted-urls.js +32 -0
- package/dist/rules/no-angular-sanitization-trusted-urls.js.map +1 -0
- package/dist/rules/no-angularjs-bypass-sce.d.ts +5 -0
- package/dist/rules/no-angularjs-bypass-sce.d.ts.map +1 -0
- package/dist/rules/no-angularjs-bypass-sce.js +80 -0
- package/dist/rules/no-angularjs-bypass-sce.js.map +1 -0
- package/dist/rules/no-angularjs-enable-svg.d.ts +5 -0
- package/dist/rules/no-angularjs-enable-svg.d.ts.map +1 -0
- package/dist/rules/no-angularjs-enable-svg.js +48 -0
- package/dist/rules/no-angularjs-enable-svg.js.map +1 -0
- package/dist/rules/no-angularjs-ng-bind-html-without-sanitize.d.ts +5 -0
- package/dist/rules/no-angularjs-ng-bind-html-without-sanitize.d.ts.map +1 -0
- package/dist/rules/no-angularjs-ng-bind-html-without-sanitize.js +64 -0
- package/dist/rules/no-angularjs-ng-bind-html-without-sanitize.js.map +1 -0
- package/dist/rules/no-angularjs-sanitization-whitelist.d.ts +5 -0
- package/dist/rules/no-angularjs-sanitization-whitelist.d.ts.map +1 -0
- package/dist/rules/no-angularjs-sanitization-whitelist.js +32 -0
- package/dist/rules/no-angularjs-sanitization-whitelist.js.map +1 -0
- package/dist/rules/no-angularjs-sce-resource-url-wildcard.d.ts +5 -0
- package/dist/rules/no-angularjs-sce-resource-url-wildcard.d.ts.map +1 -0
- package/dist/rules/no-angularjs-sce-resource-url-wildcard.js +69 -0
- package/dist/rules/no-angularjs-sce-resource-url-wildcard.js.map +1 -0
- package/dist/rules/no-child-process-exec.d.ts +5 -0
- package/dist/rules/no-child-process-exec.d.ts.map +1 -0
- package/dist/rules/no-child-process-exec.js +141 -0
- package/dist/rules/no-child-process-exec.js.map +1 -0
- package/dist/rules/no-child-process-shell-true.d.ts +5 -0
- package/dist/rules/no-child-process-shell-true.d.ts.map +1 -0
- package/dist/rules/no-child-process-shell-true.js +89 -0
- package/dist/rules/no-child-process-shell-true.js.map +1 -0
- package/dist/rules/no-cookies.d.ts +5 -0
- package/dist/rules/no-cookies.d.ts.map +1 -0
- package/dist/rules/no-cookies.js +38 -0
- package/dist/rules/no-cookies.js.map +1 -0
- package/dist/rules/no-document-domain.d.ts +5 -0
- package/dist/rules/no-document-domain.d.ts.map +1 -0
- package/dist/rules/no-document-domain.js +41 -0
- package/dist/rules/no-document-domain.js.map +1 -0
- package/dist/rules/no-document-execcommand-insert-html.d.ts +5 -0
- package/dist/rules/no-document-execcommand-insert-html.d.ts.map +1 -0
- package/dist/rules/no-document-execcommand-insert-html.js +57 -0
- package/dist/rules/no-document-execcommand-insert-html.js.map +1 -0
- package/dist/rules/no-document-parse-html-unsafe.d.ts +5 -0
- package/dist/rules/no-document-parse-html-unsafe.d.ts.map +1 -0
- package/dist/rules/no-document-parse-html-unsafe.js +67 -0
- package/dist/rules/no-document-parse-html-unsafe.js.map +1 -0
- package/dist/rules/no-document-write.d.ts +5 -0
- package/dist/rules/no-document-write.d.ts.map +1 -0
- package/dist/rules/no-document-write.js +40 -0
- package/dist/rules/no-document-write.js.map +1 -0
- package/dist/rules/no-domparser-html-without-sanitization.d.ts +5 -0
- package/dist/rules/no-domparser-html-without-sanitization.d.ts.map +1 -0
- package/dist/rules/no-domparser-html-without-sanitization.js +56 -0
- package/dist/rules/no-domparser-html-without-sanitization.js.map +1 -0
- package/dist/rules/no-domparser-svg-without-sanitization.d.ts +5 -0
- package/dist/rules/no-domparser-svg-without-sanitization.d.ts.map +1 -0
- package/dist/rules/no-domparser-svg-without-sanitization.js +56 -0
- package/dist/rules/no-domparser-svg-without-sanitization.js.map +1 -0
- package/dist/rules/no-dynamic-import-unsafe-url.d.ts +5 -0
- package/dist/rules/no-dynamic-import-unsafe-url.d.ts.map +1 -0
- package/dist/rules/no-dynamic-import-unsafe-url.js +47 -0
- package/dist/rules/no-dynamic-import-unsafe-url.js.map +1 -0
- package/dist/rules/no-electron-allow-running-insecure-content.d.ts +5 -0
- package/dist/rules/no-electron-allow-running-insecure-content.d.ts.map +1 -0
- package/dist/rules/no-electron-allow-running-insecure-content.js +30 -0
- package/dist/rules/no-electron-allow-running-insecure-content.js.map +1 -0
- package/dist/rules/no-electron-dangerous-blink-features.d.ts +5 -0
- package/dist/rules/no-electron-dangerous-blink-features.d.ts.map +1 -0
- package/dist/rules/no-electron-dangerous-blink-features.js +89 -0
- package/dist/rules/no-electron-dangerous-blink-features.js.map +1 -0
- package/dist/rules/no-electron-disable-context-isolation.d.ts +5 -0
- package/dist/rules/no-electron-disable-context-isolation.d.ts.map +1 -0
- package/dist/rules/no-electron-disable-context-isolation.js +30 -0
- package/dist/rules/no-electron-disable-context-isolation.js.map +1 -0
- package/dist/rules/no-electron-disable-sandbox.d.ts +5 -0
- package/dist/rules/no-electron-disable-sandbox.d.ts.map +1 -0
- package/dist/rules/no-electron-disable-sandbox.js +30 -0
- package/dist/rules/no-electron-disable-sandbox.js.map +1 -0
- package/dist/rules/no-electron-disable-web-security.d.ts +5 -0
- package/dist/rules/no-electron-disable-web-security.d.ts.map +1 -0
- package/dist/rules/no-electron-disable-web-security.js +30 -0
- package/dist/rules/no-electron-disable-web-security.js.map +1 -0
- package/dist/rules/no-electron-enable-remote-module.d.ts +5 -0
- package/dist/rules/no-electron-enable-remote-module.d.ts.map +1 -0
- package/dist/rules/no-electron-enable-remote-module.js +30 -0
- package/dist/rules/no-electron-enable-remote-module.js.map +1 -0
- package/dist/rules/no-electron-enable-webview-tag.d.ts +5 -0
- package/dist/rules/no-electron-enable-webview-tag.d.ts.map +1 -0
- package/dist/rules/no-electron-enable-webview-tag.js +30 -0
- package/dist/rules/no-electron-enable-webview-tag.js.map +1 -0
- package/dist/rules/no-electron-experimental-features.d.ts +5 -0
- package/dist/rules/no-electron-experimental-features.d.ts.map +1 -0
- package/dist/rules/no-electron-experimental-features.js +30 -0
- package/dist/rules/no-electron-experimental-features.js.map +1 -0
- package/dist/rules/no-electron-expose-raw-ipc-renderer.d.ts +5 -0
- package/dist/rules/no-electron-expose-raw-ipc-renderer.d.ts.map +1 -0
- package/dist/rules/no-electron-expose-raw-ipc-renderer.js +108 -0
- package/dist/rules/no-electron-expose-raw-ipc-renderer.js.map +1 -0
- package/dist/rules/no-electron-insecure-certificate-error-handler.d.ts +5 -0
- package/dist/rules/no-electron-insecure-certificate-error-handler.d.ts.map +1 -0
- package/dist/rules/no-electron-insecure-certificate-error-handler.js +91 -0
- package/dist/rules/no-electron-insecure-certificate-error-handler.js.map +1 -0
- package/dist/rules/no-electron-insecure-certificate-verify-proc.d.ts +5 -0
- package/dist/rules/no-electron-insecure-certificate-verify-proc.d.ts.map +1 -0
- package/dist/rules/no-electron-insecure-certificate-verify-proc.js +75 -0
- package/dist/rules/no-electron-insecure-certificate-verify-proc.js.map +1 -0
- package/dist/rules/no-electron-insecure-permission-request-handler.d.ts +5 -0
- package/dist/rules/no-electron-insecure-permission-request-handler.d.ts.map +1 -0
- package/dist/rules/no-electron-insecure-permission-request-handler.js +75 -0
- package/dist/rules/no-electron-insecure-permission-request-handler.js.map +1 -0
- package/dist/rules/no-electron-node-integration.d.ts +5 -0
- package/dist/rules/no-electron-node-integration.d.ts.map +1 -0
- package/dist/rules/no-electron-node-integration.js +52 -0
- package/dist/rules/no-electron-node-integration.js.map +1 -0
- package/dist/rules/no-electron-permission-check-handler-allow-all.d.ts +5 -0
- package/dist/rules/no-electron-permission-check-handler-allow-all.d.ts.map +1 -0
- package/dist/rules/no-electron-permission-check-handler-allow-all.js +63 -0
- package/dist/rules/no-electron-permission-check-handler-allow-all.js.map +1 -0
- package/dist/rules/no-electron-unchecked-ipc-sender.d.ts +5 -0
- package/dist/rules/no-electron-unchecked-ipc-sender.d.ts.map +1 -0
- package/dist/rules/no-electron-unchecked-ipc-sender.js +90 -0
- package/dist/rules/no-electron-unchecked-ipc-sender.js.map +1 -0
- package/dist/rules/no-electron-unrestricted-navigation.d.ts +5 -0
- package/dist/rules/no-electron-unrestricted-navigation.d.ts.map +1 -0
- package/dist/rules/no-electron-unrestricted-navigation.js +100 -0
- package/dist/rules/no-electron-unrestricted-navigation.js.map +1 -0
- package/dist/rules/no-electron-untrusted-open-external.d.ts +5 -0
- package/dist/rules/no-electron-untrusted-open-external.d.ts.map +1 -0
- package/dist/rules/no-electron-untrusted-open-external.js +92 -0
- package/dist/rules/no-electron-untrusted-open-external.js.map +1 -0
- package/dist/rules/no-electron-webview-allowpopups.d.ts +5 -0
- package/dist/rules/no-electron-webview-allowpopups.d.ts.map +1 -0
- package/dist/rules/no-electron-webview-allowpopups.js +85 -0
- package/dist/rules/no-electron-webview-allowpopups.js.map +1 -0
- package/dist/rules/no-electron-webview-insecure-webpreferences.d.ts +5 -0
- package/dist/rules/no-electron-webview-insecure-webpreferences.d.ts.map +1 -0
- package/dist/rules/no-electron-webview-insecure-webpreferences.js +88 -0
- package/dist/rules/no-electron-webview-insecure-webpreferences.js.map +1 -0
- package/dist/rules/no-electron-webview-node-integration.d.ts +5 -0
- package/dist/rules/no-electron-webview-node-integration.d.ts.map +1 -0
- package/dist/rules/no-electron-webview-node-integration.js +107 -0
- package/dist/rules/no-electron-webview-node-integration.js.map +1 -0
- package/dist/rules/no-html-method.d.ts +5 -0
- package/dist/rules/no-html-method.d.ts.map +1 -0
- package/dist/rules/no-html-method.js +42 -0
- package/dist/rules/no-html-method.js.map +1 -0
- package/dist/rules/no-http-request-to-insecure-protocol.d.ts +5 -0
- package/dist/rules/no-http-request-to-insecure-protocol.d.ts.map +1 -0
- package/dist/rules/no-http-request-to-insecure-protocol.js +94 -0
- package/dist/rules/no-http-request-to-insecure-protocol.js.map +1 -0
- package/dist/rules/no-iframe-srcdoc.d.ts +5 -0
- package/dist/rules/no-iframe-srcdoc.d.ts.map +1 -0
- package/dist/rules/no-iframe-srcdoc.js +144 -0
- package/dist/rules/no-iframe-srcdoc.js.map +1 -0
- package/dist/rules/no-inner-html.d.ts +5 -0
- package/dist/rules/no-inner-html.d.ts.map +1 -0
- package/dist/rules/no-inner-html.js +67 -0
- package/dist/rules/no-inner-html.js.map +1 -0
- package/dist/rules/no-insecure-random.d.ts +5 -0
- package/dist/rules/no-insecure-random.d.ts.map +1 -0
- package/dist/rules/no-insecure-random.js +95 -0
- package/dist/rules/no-insecure-random.js.map +1 -0
- package/dist/rules/no-insecure-tls-agent-options.d.ts +5 -0
- package/dist/rules/no-insecure-tls-agent-options.d.ts.map +1 -0
- package/dist/rules/no-insecure-tls-agent-options.js +73 -0
- package/dist/rules/no-insecure-tls-agent-options.js.map +1 -0
- package/dist/rules/no-insecure-url.d.ts +12 -0
- package/dist/rules/no-insecure-url.d.ts.map +1 -0
- package/dist/rules/no-insecure-url.js +142 -0
- package/dist/rules/no-insecure-url.js.map +1 -0
- package/dist/rules/no-location-javascript-url.d.ts +5 -0
- package/dist/rules/no-location-javascript-url.d.ts.map +1 -0
- package/dist/rules/no-location-javascript-url.js +98 -0
- package/dist/rules/no-location-javascript-url.js.map +1 -0
- package/dist/rules/no-message-event-without-origin-check.d.ts +5 -0
- package/dist/rules/no-message-event-without-origin-check.d.ts.map +1 -0
- package/dist/rules/no-message-event-without-origin-check.js +183 -0
- package/dist/rules/no-message-event-without-origin-check.js.map +1 -0
- package/dist/rules/no-msapp-exec-unsafe.d.ts +5 -0
- package/dist/rules/no-msapp-exec-unsafe.d.ts.map +1 -0
- package/dist/rules/no-msapp-exec-unsafe.js +32 -0
- package/dist/rules/no-msapp-exec-unsafe.js.map +1 -0
- package/dist/rules/no-node-tls-check-server-identity-bypass.d.ts +5 -0
- package/dist/rules/no-node-tls-check-server-identity-bypass.d.ts.map +1 -0
- package/dist/rules/no-node-tls-check-server-identity-bypass.js +95 -0
- package/dist/rules/no-node-tls-check-server-identity-bypass.js.map +1 -0
- package/dist/rules/no-node-tls-legacy-protocol.d.ts +5 -0
- package/dist/rules/no-node-tls-legacy-protocol.d.ts.map +1 -0
- package/dist/rules/no-node-tls-legacy-protocol.js +106 -0
- package/dist/rules/no-node-tls-legacy-protocol.js.map +1 -0
- package/dist/rules/no-node-tls-reject-unauthorized-zero.d.ts +5 -0
- package/dist/rules/no-node-tls-reject-unauthorized-zero.d.ts.map +1 -0
- package/dist/rules/no-node-tls-reject-unauthorized-zero.js +93 -0
- package/dist/rules/no-node-tls-reject-unauthorized-zero.js.map +1 -0
- package/dist/rules/no-node-tls-security-level-zero.d.ts +5 -0
- package/dist/rules/no-node-tls-security-level-zero.d.ts.map +1 -0
- package/dist/rules/no-node-tls-security-level-zero.js +80 -0
- package/dist/rules/no-node-tls-security-level-zero.js.map +1 -0
- package/dist/rules/no-node-vm-run-in-context.d.ts +5 -0
- package/dist/rules/no-node-vm-run-in-context.d.ts.map +1 -0
- package/dist/rules/no-node-vm-run-in-context.js +186 -0
- package/dist/rules/no-node-vm-run-in-context.js.map +1 -0
- package/dist/rules/no-node-vm-source-text-module.d.ts +5 -0
- package/dist/rules/no-node-vm-source-text-module.d.ts.map +1 -0
- package/dist/rules/no-node-vm-source-text-module.js +126 -0
- package/dist/rules/no-node-vm-source-text-module.js.map +1 -0
- package/dist/rules/no-node-worker-threads-eval.d.ts +5 -0
- package/dist/rules/no-node-worker-threads-eval.d.ts.map +1 -0
- package/dist/rules/no-node-worker-threads-eval.js +151 -0
- package/dist/rules/no-node-worker-threads-eval.js.map +1 -0
- package/dist/rules/no-nonnull-assertion-on-security-input.d.ts +5 -0
- package/dist/rules/no-nonnull-assertion-on-security-input.d.ts.map +1 -0
- package/dist/rules/no-nonnull-assertion-on-security-input.js +48 -0
- package/dist/rules/no-nonnull-assertion-on-security-input.js.map +1 -0
- package/dist/rules/no-postmessage-star-origin.d.ts +5 -0
- package/dist/rules/no-postmessage-star-origin.d.ts.map +1 -0
- package/dist/rules/no-postmessage-star-origin.js +58 -0
- package/dist/rules/no-postmessage-star-origin.js.map +1 -0
- package/dist/rules/no-postmessage-without-origin-allowlist.d.ts +5 -0
- package/dist/rules/no-postmessage-without-origin-allowlist.d.ts.map +1 -0
- package/dist/rules/no-postmessage-without-origin-allowlist.js +80 -0
- package/dist/rules/no-postmessage-without-origin-allowlist.js.map +1 -0
- package/dist/rules/no-range-create-contextual-fragment.d.ts +5 -0
- package/dist/rules/no-range-create-contextual-fragment.d.ts.map +1 -0
- package/dist/rules/no-range-create-contextual-fragment.js +64 -0
- package/dist/rules/no-range-create-contextual-fragment.js.map +1 -0
- package/dist/rules/no-script-src-data-url.d.ts +5 -0
- package/dist/rules/no-script-src-data-url.d.ts.map +1 -0
- package/dist/rules/no-script-src-data-url.js +108 -0
- package/dist/rules/no-script-src-data-url.js.map +1 -0
- package/dist/rules/no-script-text.d.ts +5 -0
- package/dist/rules/no-script-text.d.ts.map +1 -0
- package/dist/rules/no-script-text.js +52 -0
- package/dist/rules/no-script-text.js.map +1 -0
- package/dist/rules/no-service-worker-unsafe-script-url.d.ts +5 -0
- package/dist/rules/no-service-worker-unsafe-script-url.d.ts.map +1 -0
- package/dist/rules/no-service-worker-unsafe-script-url.js +52 -0
- package/dist/rules/no-service-worker-unsafe-script-url.js.map +1 -0
- package/dist/rules/no-set-html-unsafe.d.ts +5 -0
- package/dist/rules/no-set-html-unsafe.d.ts.map +1 -0
- package/dist/rules/no-set-html-unsafe.js +48 -0
- package/dist/rules/no-set-html-unsafe.js.map +1 -0
- package/dist/rules/no-trusted-types-policy-pass-through.d.ts +5 -0
- package/dist/rules/no-trusted-types-policy-pass-through.d.ts.map +1 -0
- package/dist/rules/no-trusted-types-policy-pass-through.js +115 -0
- package/dist/rules/no-trusted-types-policy-pass-through.js.map +1 -0
- package/dist/rules/no-unsafe-alloc.d.ts +5 -0
- package/dist/rules/no-unsafe-alloc.d.ts.map +1 -0
- package/dist/rules/no-unsafe-alloc.js +51 -0
- package/dist/rules/no-unsafe-alloc.js.map +1 -0
- package/dist/rules/no-unsafe-cast-to-trusted-types.d.ts +5 -0
- package/dist/rules/no-unsafe-cast-to-trusted-types.d.ts.map +1 -0
- package/dist/rules/no-unsafe-cast-to-trusted-types.js +89 -0
- package/dist/rules/no-unsafe-cast-to-trusted-types.js.map +1 -0
- package/dist/rules/no-window-open-without-noopener.d.ts +5 -0
- package/dist/rules/no-window-open-without-noopener.d.ts.map +1 -0
- package/dist/rules/no-window-open-without-noopener.js +84 -0
- package/dist/rules/no-window-open-without-noopener.js.map +1 -0
- package/dist/rules/no-winjs-html-unsafe.d.ts +5 -0
- package/dist/rules/no-winjs-html-unsafe.d.ts.map +1 -0
- package/dist/rules/no-winjs-html-unsafe.js +32 -0
- package/dist/rules/no-winjs-html-unsafe.js.map +1 -0
- package/dist/rules/no-worker-blob-url.d.ts +5 -0
- package/dist/rules/no-worker-blob-url.d.ts.map +1 -0
- package/dist/rules/no-worker-blob-url.js +64 -0
- package/dist/rules/no-worker-blob-url.js.map +1 -0
- package/dist/rules/no-worker-data-url.d.ts +5 -0
- package/dist/rules/no-worker-data-url.d.ts.map +1 -0
- package/dist/rules/no-worker-data-url.js +67 -0
- package/dist/rules/no-worker-data-url.js.map +1 -0
- package/docs/rules/getting-started.md +70 -0
- package/docs/rules/no-angular-bypass-sanitizer.md +69 -0
- package/docs/rules/no-angular-bypass-security-trust-html.md +59 -0
- package/docs/rules/no-angular-innerhtml-binding.md +59 -0
- package/docs/rules/no-angular-sanitization-trusted-urls.md +64 -0
- package/docs/rules/no-angularjs-bypass-sce.md +64 -0
- package/docs/rules/no-angularjs-enable-svg.md +59 -0
- package/docs/rules/no-angularjs-ng-bind-html-without-sanitize.md +59 -0
- package/docs/rules/no-angularjs-sanitization-whitelist.md +63 -0
- package/docs/rules/no-angularjs-sce-resource-url-wildcard.md +62 -0
- package/docs/rules/no-child-process-exec.md +101 -0
- package/docs/rules/no-child-process-shell-true.md +59 -0
- package/docs/rules/no-cookies.md +61 -0
- package/docs/rules/no-document-domain.md +59 -0
- package/docs/rules/no-document-execcommand-insert-html.md +69 -0
- package/docs/rules/no-document-parse-html-unsafe.md +72 -0
- package/docs/rules/no-document-write.md +64 -0
- package/docs/rules/no-domparser-html-without-sanitization.md +59 -0
- package/docs/rules/no-domparser-svg-without-sanitization.md +71 -0
- package/docs/rules/no-dynamic-import-unsafe-url.md +81 -0
- package/docs/rules/no-electron-allow-running-insecure-content.md +69 -0
- package/docs/rules/no-electron-dangerous-blink-features.md +77 -0
- package/docs/rules/no-electron-disable-context-isolation.md +69 -0
- package/docs/rules/no-electron-disable-sandbox.md +69 -0
- package/docs/rules/no-electron-disable-web-security.md +69 -0
- package/docs/rules/no-electron-enable-remote-module.md +69 -0
- package/docs/rules/no-electron-enable-webview-tag.md +77 -0
- package/docs/rules/no-electron-experimental-features.md +77 -0
- package/docs/rules/no-electron-expose-raw-ipc-renderer.md +79 -0
- package/docs/rules/no-electron-insecure-certificate-error-handler.md +72 -0
- package/docs/rules/no-electron-insecure-certificate-verify-proc.md +63 -0
- package/docs/rules/no-electron-insecure-permission-request-handler.md +67 -0
- package/docs/rules/no-electron-node-integration.md +70 -0
- package/docs/rules/no-electron-permission-check-handler-allow-all.md +66 -0
- package/docs/rules/no-electron-unchecked-ipc-sender.md +62 -0
- package/docs/rules/no-electron-unrestricted-navigation.md +64 -0
- package/docs/rules/no-electron-untrusted-open-external.md +65 -0
- package/docs/rules/no-electron-webview-allowpopups.md +59 -0
- package/docs/rules/no-electron-webview-insecure-webpreferences.md +84 -0
- package/docs/rules/no-electron-webview-node-integration.md +59 -0
- package/docs/rules/no-html-method.md +58 -0
- package/docs/rules/no-http-request-to-insecure-protocol.md +59 -0
- package/docs/rules/no-iframe-srcdoc.md +76 -0
- package/docs/rules/no-inner-html.md +65 -0
- package/docs/rules/no-insecure-random.md +66 -0
- package/docs/rules/no-insecure-tls-agent-options.md +59 -0
- package/docs/rules/no-insecure-url.md +72 -0
- package/docs/rules/no-location-javascript-url.md +59 -0
- package/docs/rules/no-message-event-without-origin-check.md +82 -0
- package/docs/rules/no-msapp-exec-unsafe.md +59 -0
- package/docs/rules/no-node-tls-check-server-identity-bypass.md +88 -0
- package/docs/rules/no-node-tls-legacy-protocol.md +80 -0
- package/docs/rules/no-node-tls-reject-unauthorized-zero.md +61 -0
- package/docs/rules/no-node-tls-security-level-zero.md +77 -0
- package/docs/rules/no-node-vm-run-in-context.md +89 -0
- package/docs/rules/no-node-vm-source-text-module.md +79 -0
- package/docs/rules/no-node-worker-threads-eval.md +82 -0
- package/docs/rules/no-nonnull-assertion-on-security-input.md +59 -0
- package/docs/rules/no-postmessage-star-origin.md +59 -0
- package/docs/rules/no-postmessage-without-origin-allowlist.md +59 -0
- package/docs/rules/no-range-create-contextual-fragment.md +64 -0
- package/docs/rules/no-script-src-data-url.md +83 -0
- package/docs/rules/no-script-text.md +80 -0
- package/docs/rules/no-service-worker-unsafe-script-url.md +85 -0
- package/docs/rules/no-set-html-unsafe.md +64 -0
- package/docs/rules/no-trusted-types-policy-pass-through.md +68 -0
- package/docs/rules/no-unsafe-alloc.md +62 -0
- package/docs/rules/no-unsafe-cast-to-trusted-types.md +59 -0
- package/docs/rules/no-window-open-without-noopener.md +63 -0
- package/docs/rules/no-winjs-html-unsafe.md +60 -0
- package/docs/rules/no-worker-blob-url.md +86 -0
- package/docs/rules/no-worker-data-url.md +85 -0
- package/docs/rules/overview.md +111 -0
- package/docs/rules/presets/angular.md +35 -0
- package/docs/rules/presets/angularjs.md +36 -0
- package/docs/rules/presets/common.md +59 -0
- package/docs/rules/presets/electron.md +51 -0
- package/docs/rules/presets/index.md +26 -0
- package/docs/rules/presets/node.md +43 -0
- package/docs/rules/presets/react.md +33 -0
- package/docs/rules/presets/recommended.md +104 -0
- package/docs/rules/presets/required.md +99 -0
- package/docs/rules/presets/typescript.md +34 -0
- package/package.json +583 -0
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
import type { ESLint, Linter } from "eslint";
|
|
2
|
+
import type { SdlConfigName } from "./_internal/config-references.js";
|
|
3
|
+
type SdlConfig = Readonly<Linter.Config>;
|
|
4
|
+
type SdlConfigArray = readonly SdlConfig[];
|
|
5
|
+
type SdlPluginWithConfigs = ESLint.Plugin & {
|
|
6
|
+
readonly configs: Readonly<Record<SdlConfigName, SdlConfigArray>>;
|
|
7
|
+
};
|
|
8
|
+
/** ESLint plugin entrypoint with SDL rule set and flat-config presets. */
|
|
9
|
+
declare const sdlPlugin: SdlPluginWithConfigs;
|
|
10
|
+
export default sdlPlugin;
|
|
11
|
+
//# sourceMappingURL=plugin.d.ts.map
|
package/dist/plugin.d.ts
ADDED
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
import type { ESLint, Linter } from "eslint";
|
|
2
|
+
import type { SdlConfigName } from "./_internal/config-references.js";
|
|
3
|
+
type SdlConfig = Readonly<Linter.Config>;
|
|
4
|
+
type SdlConfigArray = readonly SdlConfig[];
|
|
5
|
+
type SdlPluginWithConfigs = ESLint.Plugin & {
|
|
6
|
+
readonly configs: Readonly<Record<SdlConfigName, SdlConfigArray>>;
|
|
7
|
+
};
|
|
8
|
+
/** ESLint plugin entrypoint with SDL rule set and flat-config presets. */
|
|
9
|
+
declare const sdlPlugin: SdlPluginWithConfigs;
|
|
10
|
+
export default sdlPlugin;
|
|
11
|
+
//# sourceMappingURL=plugin.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAO7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAKtE,KAAK,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACzC,KAAK,cAAc,GAAG,SAAS,SAAS,EAAE,CAAC;AAG3C,KAAK,oBAAoB,GAAG,MAAM,CAAC,MAAM,GAAG;IACxC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;CACrE,CAAC;AAmPF,0EAA0E;AAC1E,QAAA,MAAM,SAAS,EAAE,oBAIhB,CAAC;AAEF,eAAe,SAAS,CAAC"}
|
package/dist/plugin.js
ADDED
|
@@ -0,0 +1,235 @@
|
|
|
1
|
+
import typeScriptPlugin from "@typescript-eslint/eslint-plugin";
|
|
2
|
+
import typeScriptParser from "@typescript-eslint/parser";
|
|
3
|
+
import nodePlugin from "eslint-plugin-n";
|
|
4
|
+
import securityPlugin from "eslint-plugin-security";
|
|
5
|
+
import packageJson from "../package.json" with { type: "json" };
|
|
6
|
+
import sdlRules from "./_internal/rules-registry.js";
|
|
7
|
+
const typeScriptEslintPlugin = typeScriptPlugin;
|
|
8
|
+
const nodeEslintPlugin = nodePlugin;
|
|
9
|
+
const securityEslintPlugin = securityPlugin;
|
|
10
|
+
const typeScriptFiles = ["**/*.{ts,tsx,mts,cts}"];
|
|
11
|
+
const createAngularConfig = (plugin) => [
|
|
12
|
+
{
|
|
13
|
+
plugins: {
|
|
14
|
+
sdl: plugin,
|
|
15
|
+
},
|
|
16
|
+
rules: {
|
|
17
|
+
"sdl/no-angular-bypass-sanitizer": "error",
|
|
18
|
+
"sdl/no-angular-bypass-security-trust-html": "error",
|
|
19
|
+
"sdl/no-angular-innerhtml-binding": "error",
|
|
20
|
+
"sdl/no-angular-sanitization-trusted-urls": "error",
|
|
21
|
+
},
|
|
22
|
+
},
|
|
23
|
+
];
|
|
24
|
+
const createAngularJsConfig = (plugin) => [
|
|
25
|
+
{
|
|
26
|
+
plugins: {
|
|
27
|
+
sdl: plugin,
|
|
28
|
+
},
|
|
29
|
+
rules: {
|
|
30
|
+
"sdl/no-angularjs-bypass-sce": "error",
|
|
31
|
+
"sdl/no-angularjs-enable-svg": "error",
|
|
32
|
+
"sdl/no-angularjs-ng-bind-html-without-sanitize": "error",
|
|
33
|
+
"sdl/no-angularjs-sanitization-whitelist": "error",
|
|
34
|
+
"sdl/no-angularjs-sce-resource-url-wildcard": "error",
|
|
35
|
+
},
|
|
36
|
+
},
|
|
37
|
+
];
|
|
38
|
+
const createCommonConfig = (plugin) => [
|
|
39
|
+
{
|
|
40
|
+
plugins: {
|
|
41
|
+
sdl: plugin,
|
|
42
|
+
},
|
|
43
|
+
rules: {
|
|
44
|
+
"no-caller": "error",
|
|
45
|
+
"no-delete-var": "error",
|
|
46
|
+
"no-eval": "error",
|
|
47
|
+
"no-implied-eval": "error",
|
|
48
|
+
"no-new-func": "error",
|
|
49
|
+
"sdl/no-cookies": "error",
|
|
50
|
+
"sdl/no-document-domain": "error",
|
|
51
|
+
"sdl/no-document-execcommand-insert-html": "error",
|
|
52
|
+
"sdl/no-document-parse-html-unsafe": "error",
|
|
53
|
+
"sdl/no-document-write": "error",
|
|
54
|
+
"sdl/no-domparser-html-without-sanitization": "error",
|
|
55
|
+
"sdl/no-domparser-svg-without-sanitization": "error",
|
|
56
|
+
"sdl/no-dynamic-import-unsafe-url": "error",
|
|
57
|
+
"sdl/no-html-method": "error",
|
|
58
|
+
"sdl/no-iframe-srcdoc": "error",
|
|
59
|
+
"sdl/no-inner-html": "error",
|
|
60
|
+
"sdl/no-insecure-random": "error",
|
|
61
|
+
"sdl/no-insecure-url": "error",
|
|
62
|
+
"sdl/no-location-javascript-url": "error",
|
|
63
|
+
"sdl/no-message-event-without-origin-check": "error",
|
|
64
|
+
"sdl/no-msapp-exec-unsafe": "error",
|
|
65
|
+
"sdl/no-postmessage-star-origin": "error",
|
|
66
|
+
"sdl/no-postmessage-without-origin-allowlist": "error",
|
|
67
|
+
"sdl/no-range-create-contextual-fragment": "error",
|
|
68
|
+
"sdl/no-script-src-data-url": "error",
|
|
69
|
+
"sdl/no-script-text": "error",
|
|
70
|
+
"sdl/no-service-worker-unsafe-script-url": "error",
|
|
71
|
+
"sdl/no-set-html-unsafe": "error",
|
|
72
|
+
"sdl/no-window-open-without-noopener": "error",
|
|
73
|
+
"sdl/no-winjs-html-unsafe": "error",
|
|
74
|
+
"sdl/no-worker-blob-url": "error",
|
|
75
|
+
"sdl/no-worker-data-url": "error",
|
|
76
|
+
},
|
|
77
|
+
},
|
|
78
|
+
];
|
|
79
|
+
const createElectronConfig = (plugin) => [
|
|
80
|
+
{
|
|
81
|
+
plugins: {
|
|
82
|
+
sdl: plugin,
|
|
83
|
+
},
|
|
84
|
+
rules: {
|
|
85
|
+
"sdl/no-electron-allow-running-insecure-content": "error",
|
|
86
|
+
"sdl/no-electron-dangerous-blink-features": "error",
|
|
87
|
+
"sdl/no-electron-disable-context-isolation": "error",
|
|
88
|
+
"sdl/no-electron-disable-sandbox": "error",
|
|
89
|
+
"sdl/no-electron-disable-web-security": "error",
|
|
90
|
+
"sdl/no-electron-enable-remote-module": "error",
|
|
91
|
+
"sdl/no-electron-enable-webview-tag": "error",
|
|
92
|
+
"sdl/no-electron-experimental-features": "error",
|
|
93
|
+
"sdl/no-electron-expose-raw-ipc-renderer": "error",
|
|
94
|
+
"sdl/no-electron-insecure-certificate-error-handler": "error",
|
|
95
|
+
"sdl/no-electron-insecure-certificate-verify-proc": "error",
|
|
96
|
+
"sdl/no-electron-insecure-permission-request-handler": "error",
|
|
97
|
+
"sdl/no-electron-node-integration": "error",
|
|
98
|
+
"sdl/no-electron-permission-check-handler-allow-all": "error",
|
|
99
|
+
"sdl/no-electron-unchecked-ipc-sender": "error",
|
|
100
|
+
"sdl/no-electron-unrestricted-navigation": "error",
|
|
101
|
+
"sdl/no-electron-untrusted-open-external": "error",
|
|
102
|
+
"sdl/no-electron-webview-allowpopups": "error",
|
|
103
|
+
"sdl/no-electron-webview-insecure-webpreferences": "error",
|
|
104
|
+
"sdl/no-electron-webview-node-integration": "error",
|
|
105
|
+
},
|
|
106
|
+
},
|
|
107
|
+
];
|
|
108
|
+
const createNodeConfig = (plugin) => [
|
|
109
|
+
{
|
|
110
|
+
plugins: {
|
|
111
|
+
n: nodeEslintPlugin,
|
|
112
|
+
},
|
|
113
|
+
rules: {
|
|
114
|
+
"n/no-deprecated-api": "error",
|
|
115
|
+
},
|
|
116
|
+
},
|
|
117
|
+
{
|
|
118
|
+
plugins: {
|
|
119
|
+
sdl: plugin,
|
|
120
|
+
},
|
|
121
|
+
rules: {
|
|
122
|
+
"sdl/no-child-process-exec": "error",
|
|
123
|
+
"sdl/no-child-process-shell-true": "error",
|
|
124
|
+
"sdl/no-http-request-to-insecure-protocol": "error",
|
|
125
|
+
"sdl/no-insecure-tls-agent-options": "error",
|
|
126
|
+
"sdl/no-node-tls-check-server-identity-bypass": "error",
|
|
127
|
+
"sdl/no-node-tls-legacy-protocol": "error",
|
|
128
|
+
"sdl/no-node-tls-reject-unauthorized-zero": "error",
|
|
129
|
+
"sdl/no-node-tls-security-level-zero": "error",
|
|
130
|
+
"sdl/no-node-vm-run-in-context": "error",
|
|
131
|
+
"sdl/no-node-vm-source-text-module": "error",
|
|
132
|
+
"sdl/no-node-worker-threads-eval": "error",
|
|
133
|
+
"sdl/no-unsafe-alloc": "error",
|
|
134
|
+
},
|
|
135
|
+
},
|
|
136
|
+
];
|
|
137
|
+
const createReactConfig = (plugin) => [
|
|
138
|
+
{
|
|
139
|
+
languageOptions: {
|
|
140
|
+
parserOptions: {
|
|
141
|
+
ecmaFeatures: {
|
|
142
|
+
jsx: true,
|
|
143
|
+
},
|
|
144
|
+
},
|
|
145
|
+
},
|
|
146
|
+
},
|
|
147
|
+
{
|
|
148
|
+
plugins: {
|
|
149
|
+
sdl: plugin,
|
|
150
|
+
},
|
|
151
|
+
},
|
|
152
|
+
];
|
|
153
|
+
const createTypeScriptConfig = (plugin) => [
|
|
154
|
+
{
|
|
155
|
+
languageOptions: {
|
|
156
|
+
parserOptions: {
|
|
157
|
+
ecmaVersion: "latest",
|
|
158
|
+
sourceType: "module",
|
|
159
|
+
},
|
|
160
|
+
},
|
|
161
|
+
},
|
|
162
|
+
{
|
|
163
|
+
files: [...typeScriptFiles],
|
|
164
|
+
languageOptions: {
|
|
165
|
+
parser: typeScriptParser,
|
|
166
|
+
parserOptions: {
|
|
167
|
+
ecmaFeatures: {
|
|
168
|
+
jsx: true,
|
|
169
|
+
},
|
|
170
|
+
ecmaVersion: "latest",
|
|
171
|
+
sourceType: "module",
|
|
172
|
+
},
|
|
173
|
+
},
|
|
174
|
+
plugins: {
|
|
175
|
+
"@typescript-eslint": typeScriptEslintPlugin,
|
|
176
|
+
sdl: plugin,
|
|
177
|
+
},
|
|
178
|
+
rules: {
|
|
179
|
+
"@typescript-eslint/no-implied-eval": "error",
|
|
180
|
+
"no-implied-eval": "off",
|
|
181
|
+
"sdl/no-nonnull-assertion-on-security-input": "error",
|
|
182
|
+
"sdl/no-trusted-types-policy-pass-through": "error",
|
|
183
|
+
"sdl/no-unsafe-cast-to-trusted-types": "error",
|
|
184
|
+
},
|
|
185
|
+
},
|
|
186
|
+
];
|
|
187
|
+
const createRequiredConfig = (configs) => [
|
|
188
|
+
...configs.angular,
|
|
189
|
+
...configs.angularjs,
|
|
190
|
+
...configs.common,
|
|
191
|
+
...configs.electron,
|
|
192
|
+
...configs.node,
|
|
193
|
+
...configs.react,
|
|
194
|
+
];
|
|
195
|
+
const createRecommendedConfig = (configs) => [
|
|
196
|
+
...configs.required,
|
|
197
|
+
...configs.typescript,
|
|
198
|
+
{
|
|
199
|
+
plugins: {
|
|
200
|
+
security: securityEslintPlugin,
|
|
201
|
+
},
|
|
202
|
+
},
|
|
203
|
+
];
|
|
204
|
+
const packageJsonVersion = typeof packageJson.version === "string" && packageJson.version.length > 0
|
|
205
|
+
? packageJson.version
|
|
206
|
+
: "0.0.0";
|
|
207
|
+
const pluginCore = {
|
|
208
|
+
meta: {
|
|
209
|
+
name: "eslint-plugin-sdl-2",
|
|
210
|
+
namespace: "sdl",
|
|
211
|
+
version: packageJsonVersion,
|
|
212
|
+
},
|
|
213
|
+
rules: sdlRules,
|
|
214
|
+
};
|
|
215
|
+
const configs = {
|
|
216
|
+
angular: createAngularConfig(pluginCore),
|
|
217
|
+
angularjs: createAngularJsConfig(pluginCore),
|
|
218
|
+
common: createCommonConfig(pluginCore),
|
|
219
|
+
electron: createElectronConfig(pluginCore),
|
|
220
|
+
node: createNodeConfig(pluginCore),
|
|
221
|
+
react: createReactConfig(pluginCore),
|
|
222
|
+
recommended: [],
|
|
223
|
+
required: [],
|
|
224
|
+
typescript: createTypeScriptConfig(pluginCore),
|
|
225
|
+
};
|
|
226
|
+
configs.required = createRequiredConfig(configs);
|
|
227
|
+
configs.recommended = createRecommendedConfig(configs);
|
|
228
|
+
/** ESLint plugin entrypoint with SDL rule set and flat-config presets. */
|
|
229
|
+
const sdlPlugin = {
|
|
230
|
+
...pluginCore,
|
|
231
|
+
configs,
|
|
232
|
+
rules: sdlRules,
|
|
233
|
+
};
|
|
234
|
+
export default sdlPlugin;
|
|
235
|
+
//# sourceMappingURL=plugin.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,gBAAgB,MAAM,kCAAkC,CAAC;AAChE,OAAO,gBAAgB,MAAM,2BAA2B,CAAC;AACzD,OAAO,UAAU,MAAM,iBAAiB,CAAC;AACzC,OAAO,cAAc,MAAM,wBAAwB,CAAC;AAIpD,OAAO,WAAW,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAChE,OAAO,QAAQ,MAAM,+BAA+B,CAAC;AAUrD,MAAM,sBAAsB,GAAG,gBAA4C,CAAC;AAC5E,MAAM,gBAAgB,GAAG,UAAsC,CAAC;AAChE,MAAM,oBAAoB,GAAG,cAA0C,CAAC;AAExE,MAAM,eAAe,GAAG,CAAC,uBAAuB,CAAC,CAAC;AAElD,MAAM,mBAAmB,GAAG,CAAC,MAAiB,EAAkB,EAAE,CAAC;IAC/D;QACI,OAAO,EAAE;YACL,GAAG,EAAE,MAAM;SACd;QACD,KAAK,EAAE;YACH,iCAAiC,EAAE,OAAO;YAC1C,2CAA2C,EAAE,OAAO;YACpD,kCAAkC,EAAE,OAAO;YAC3C,0CAA0C,EAAE,OAAO;SACtD;KACJ;CACJ,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAAC,MAAiB,EAAkB,EAAE,CAAC;IACjE;QACI,OAAO,EAAE;YACL,GAAG,EAAE,MAAM;SACd;QACD,KAAK,EAAE;YACH,6BAA6B,EAAE,OAAO;YACtC,6BAA6B,EAAE,OAAO;YACtC,gDAAgD,EAAE,OAAO;YACzD,yCAAyC,EAAE,OAAO;YAClD,4CAA4C,EAAE,OAAO;SACxD;KACJ;CACJ,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,MAAiB,EAAkB,EAAE,CAAC;IAC9D;QACI,OAAO,EAAE;YACL,GAAG,EAAE,MAAM;SACd;QACD,KAAK,EAAE;YACH,WAAW,EAAE,OAAO;YACpB,eAAe,EAAE,OAAO;YACxB,SAAS,EAAE,OAAO;YAClB,iBAAiB,EAAE,OAAO;YAC1B,aAAa,EAAE,OAAO;YACtB,gBAAgB,EAAE,OAAO;YACzB,wBAAwB,EAAE,OAAO;YACjC,yCAAyC,EAAE,OAAO;YAClD,mCAAmC,EAAE,OAAO;YAC5C,uBAAuB,EAAE,OAAO;YAChC,4CAA4C,EAAE,OAAO;YACrD,2CAA2C,EAAE,OAAO;YACpD,kCAAkC,EAAE,OAAO;YAC3C,oBAAoB,EAAE,OAAO;YAC7B,sBAAsB,EAAE,OAAO;YAC/B,mBAAmB,EAAE,OAAO;YAC5B,wBAAwB,EAAE,OAAO;YACjC,qBAAqB,EAAE,OAAO;YAC9B,gCAAgC,EAAE,OAAO;YACzC,2CAA2C,EAAE,OAAO;YACpD,0BAA0B,EAAE,OAAO;YACnC,gCAAgC,EAAE,OAAO;YACzC,6CAA6C,EAAE,OAAO;YACtD,yCAAyC,EAAE,OAAO;YAClD,4BAA4B,EAAE,OAAO;YACrC,oBAAoB,EAAE,OAAO;YAC7B,yCAAyC,EAAE,OAAO;YAClD,wBAAwB,EAAE,OAAO;YACjC,qCAAqC,EAAE,OAAO;YAC9C,0BAA0B,EAAE,OAAO;YACnC,wBAAwB,EAAE,OAAO;YACjC,wBAAwB,EAAE,OAAO;SACpC;KACJ;CACJ,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAAC,MAAiB,EAAkB,EAAE,CAAC;IAChE;QACI,OAAO,EAAE;YACL,GAAG,EAAE,MAAM;SACd;QACD,KAAK,EAAE;YACH,gDAAgD,EAAE,OAAO;YACzD,0CAA0C,EAAE,OAAO;YACnD,2CAA2C,EAAE,OAAO;YACpD,iCAAiC,EAAE,OAAO;YAC1C,sCAAsC,EAAE,OAAO;YAC/C,sCAAsC,EAAE,OAAO;YAC/C,oCAAoC,EAAE,OAAO;YAC7C,uCAAuC,EAAE,OAAO;YAChD,yCAAyC,EAAE,OAAO;YAClD,oDAAoD,EAAE,OAAO;YAC7D,kDAAkD,EAAE,OAAO;YAC3D,qDAAqD,EAAE,OAAO;YAC9D,kCAAkC,EAAE,OAAO;YAC3C,oDAAoD,EAAE,OAAO;YAC7D,sCAAsC,EAAE,OAAO;YAC/C,yCAAyC,EAAE,OAAO;YAClD,yCAAyC,EAAE,OAAO;YAClD,qCAAqC,EAAE,OAAO;YAC9C,iDAAiD,EAAE,OAAO;YAC1D,0CAA0C,EAAE,OAAO;SACtD;KACJ;CACJ,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,MAAiB,EAAkB,EAAE,CAAC;IAC5D;QACI,OAAO,EAAE;YACL,CAAC,EAAE,gBAAgB;SACtB;QACD,KAAK,EAAE;YACH,qBAAqB,EAAE,OAAO;SACjC;KACJ;IACD;QACI,OAAO,EAAE;YACL,GAAG,EAAE,MAAM;SACd;QACD,KAAK,EAAE;YACH,2BAA2B,EAAE,OAAO;YACpC,iCAAiC,EAAE,OAAO;YAC1C,0CAA0C,EAAE,OAAO;YACnD,mCAAmC,EAAE,OAAO;YAC5C,8CAA8C,EAAE,OAAO;YACvD,iCAAiC,EAAE,OAAO;YAC1C,0CAA0C,EAAE,OAAO;YACnD,qCAAqC,EAAE,OAAO;YAC9C,+BAA+B,EAAE,OAAO;YACxC,mCAAmC,EAAE,OAAO;YAC5C,iCAAiC,EAAE,OAAO;YAC1C,qBAAqB,EAAE,OAAO;SACjC;KACJ;CACJ,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,MAAiB,EAAkB,EAAE,CAAC;IAC7D;QACI,eAAe,EAAE;YACb,aAAa,EAAE;gBACX,YAAY,EAAE;oBACV,GAAG,EAAE,IAAI;iBACZ;aACJ;SACJ;KACJ;IACD;QACI,OAAO,EAAE;YACL,GAAG,EAAE,MAAM;SACd;KACJ;CACJ,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAAC,MAAiB,EAAkB,EAAE,CAAC;IAClE;QACI,eAAe,EAAE;YACb,aAAa,EAAE;gBACX,WAAW,EAAE,QAAQ;gBACrB,UAAU,EAAE,QAAQ;aACvB;SACJ;KACJ;IACD;QACI,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC;QAC3B,eAAe,EAAE;YACb,MAAM,EAAE,gBAAgB;YACxB,aAAa,EAAE;gBACX,YAAY,EAAE;oBACV,GAAG,EAAE,IAAI;iBACZ;gBACD,WAAW,EAAE,QAAQ;gBACrB,UAAU,EAAE,QAAQ;aACvB;SACJ;QACD,OAAO,EAAE;YACL,oBAAoB,EAAE,sBAAsB;YAC5C,GAAG,EAAE,MAAM;SACd;QACD,KAAK,EAAE;YACH,oCAAoC,EAAE,OAAO;YAC7C,iBAAiB,EAAE,KAAK;YACxB,4CAA4C,EAAE,OAAO;YACrD,0CAA0C,EAAE,OAAO;YACnD,qCAAqC,EAAE,OAAO;SACjD;KACJ;CACJ,CAAC;AAEF,MAAM,oBAAoB,GAAG,CACzB,OAA+B,EACjB,EAAE,CAAC;IACjB,GAAG,OAAO,CAAC,OAAO;IAClB,GAAG,OAAO,CAAC,SAAS;IACpB,GAAG,OAAO,CAAC,MAAM;IACjB,GAAG,OAAO,CAAC,QAAQ;IACnB,GAAG,OAAO,CAAC,IAAI;IACf,GAAG,OAAO,CAAC,KAAK;CACnB,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAC5B,OAA+B,EACjB,EAAE,CAAC;IACjB,GAAG,OAAO,CAAC,QAAQ;IACnB,GAAG,OAAO,CAAC,UAAU;IACrB;QACI,OAAO,EAAE;YACL,QAAQ,EAAE,oBAAoB;SACjC;KACJ;CACJ,CAAC;AAEF,MAAM,kBAAkB,GACpB,OAAO,WAAW,CAAC,OAAO,KAAK,QAAQ,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;IACrE,CAAC,CAAC,WAAW,CAAC,OAAO;IACrB,CAAC,CAAC,OAAO,CAAC;AAElB,MAAM,UAAU,GAAc;IAC1B,IAAI,EAAE;QACF,IAAI,EAAE,qBAAqB;QAC3B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,kBAAkB;KAC9B;IACD,KAAK,EAAE,QAA0D;CACpE,CAAC;AAEF,MAAM,OAAO,GAAiB;IAC1B,OAAO,EAAE,mBAAmB,CAAC,UAAU,CAAC;IACxC,SAAS,EAAE,qBAAqB,CAAC,UAAU,CAAC;IAC5C,MAAM,EAAE,kBAAkB,CAAC,UAAU,CAAC;IACtC,QAAQ,EAAE,oBAAoB,CAAC,UAAU,CAAC;IAC1C,IAAI,EAAE,gBAAgB,CAAC,UAAU,CAAC;IAClC,KAAK,EAAE,iBAAiB,CAAC,UAAU,CAAC;IACpC,WAAW,EAAE,EAAE;IACf,QAAQ,EAAE,EAAE;IACZ,UAAU,EAAE,sBAAsB,CAAC,UAAU,CAAC;CACjD,CAAC;AAEF,OAAO,CAAC,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;AACjD,OAAO,CAAC,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;AAEvD,0EAA0E;AAC1E,MAAM,SAAS,GAAyB;IACpC,GAAG,UAAU;IACb,OAAO;IACP,KAAK,EAAE,QAA0D;CACpE,CAAC;AAEF,eAAe,SAAS,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"no-angular-bypass-sanitizer.d.ts","sourceRoot":"","sources":["../../src/rules/no-angular-bypass-sanitizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,2BAA2B;AAC3B,QAAA,MAAM,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CA8BtC,CAAC;AAEH,eAAe,IAAI,CAAC"}
|
|
@@ -0,0 +1,32 @@
|
|
|
1
|
+
import { createRule } from "../_internal/create-rule.js";
|
|
2
|
+
/** Rule implementation. */
|
|
3
|
+
const rule = createRule({
|
|
4
|
+
create(context) {
|
|
5
|
+
return {
|
|
6
|
+
"CallExpression[arguments.length>0][callee.property.name=/^bypassSecurityTrust(?:html|resourceurl|script|style|url)$/i]"(node) {
|
|
7
|
+
context.report({
|
|
8
|
+
messageId: "noBypass",
|
|
9
|
+
node,
|
|
10
|
+
});
|
|
11
|
+
},
|
|
12
|
+
};
|
|
13
|
+
},
|
|
14
|
+
defaultOptions: [],
|
|
15
|
+
meta: {
|
|
16
|
+
deprecated: false,
|
|
17
|
+
docs: {
|
|
18
|
+
description: "disallow bypassing Angular DomSanitizer trust APIs such as bypassSecurityTrustHtml.",
|
|
19
|
+
frozen: false,
|
|
20
|
+
recommended: false,
|
|
21
|
+
url: "https://nick2bad4u.github.io/eslint-plugin-SDL-2/docs/rules/no-angular-bypass-sanitizer",
|
|
22
|
+
},
|
|
23
|
+
messages: {
|
|
24
|
+
noBypass: "Do not bypass Angular's built-in sanitizer.",
|
|
25
|
+
},
|
|
26
|
+
schema: [],
|
|
27
|
+
type: "problem",
|
|
28
|
+
},
|
|
29
|
+
name: "no-angular-bypass-sanitizer",
|
|
30
|
+
});
|
|
31
|
+
export default rule;
|
|
32
|
+
//# sourceMappingURL=no-angular-bypass-sanitizer.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"no-angular-bypass-sanitizer.js","sourceRoot":"","sources":["../../src/rules/no-angular-bypass-sanitizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,2BAA2B;AAC3B,MAAM,IAAI,GAAkC,UAAU,CAAC;IACnD,MAAM,CAAC,OAAO;QACV,OAAO;YACH,wHAAwH,CACpH,IAAI;gBAEJ,OAAO,CAAC,MAAM,CAAC;oBACX,SAAS,EAAE,UAAU;oBACrB,IAAI;iBACP,CAAC,CAAC;YACP,CAAC;SACJ,CAAC;IACN,CAAC;IACD,cAAc,EAAE,EAAE;IAClB,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,WAAW,EACP,qFAAqF;YACzF,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,KAAK;YAClB,GAAG,EAAE,yFAAyF;SACjG;QACD,QAAQ,EAAE;YACN,QAAQ,EAAE,6CAA6C;SAC1D;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KAClB;IACD,IAAI,EAAE,6BAA6B;CACtC,CAAC,CAAC;AAEH,eAAe,IAAI,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"no-angular-bypass-security-trust-html.d.ts","sourceRoot":"","sources":["../../src/rules/no-angular-bypass-security-trust-html.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAwBzD,2BAA2B;AAC3B,QAAA,MAAM,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CAwCtC,CAAC;AAEH,eAAe,IAAI,CAAC"}
|
|
@@ -0,0 +1,51 @@
|
|
|
1
|
+
import { createRule } from "../_internal/create-rule.js";
|
|
2
|
+
const getMemberPropertyName = (memberExpression) => {
|
|
3
|
+
if (!memberExpression.computed &&
|
|
4
|
+
memberExpression.property.type === "Identifier") {
|
|
5
|
+
return memberExpression.property.name;
|
|
6
|
+
}
|
|
7
|
+
if (memberExpression.property.type === "Literal" &&
|
|
8
|
+
typeof memberExpression.property.value === "string") {
|
|
9
|
+
return memberExpression.property.value;
|
|
10
|
+
}
|
|
11
|
+
return undefined;
|
|
12
|
+
};
|
|
13
|
+
/** Rule implementation. */
|
|
14
|
+
const rule = createRule({
|
|
15
|
+
create(context) {
|
|
16
|
+
return {
|
|
17
|
+
CallExpression(node) {
|
|
18
|
+
if (node.callee.type !== "MemberExpression") {
|
|
19
|
+
return;
|
|
20
|
+
}
|
|
21
|
+
if (getMemberPropertyName(node.callee) !==
|
|
22
|
+
"bypassSecurityTrustHtml") {
|
|
23
|
+
return;
|
|
24
|
+
}
|
|
25
|
+
context.report({
|
|
26
|
+
messageId: "default",
|
|
27
|
+
node,
|
|
28
|
+
});
|
|
29
|
+
},
|
|
30
|
+
};
|
|
31
|
+
},
|
|
32
|
+
defaultOptions: [],
|
|
33
|
+
meta: {
|
|
34
|
+
deprecated: false,
|
|
35
|
+
docs: {
|
|
36
|
+
description: "disallow Angular bypassSecurityTrustHtml usage in application code.",
|
|
37
|
+
frozen: false,
|
|
38
|
+
recommended: false,
|
|
39
|
+
url: "https://nick2bad4u.github.io/eslint-plugin-SDL-2/docs/rules/no-angular-bypass-security-trust-html",
|
|
40
|
+
},
|
|
41
|
+
messages: {
|
|
42
|
+
default: "Avoid bypassSecurityTrustHtml; use validated/sanitized HTML flows instead.",
|
|
43
|
+
},
|
|
44
|
+
schema: [],
|
|
45
|
+
type: "problem",
|
|
46
|
+
},
|
|
47
|
+
name: "no-angular-bypass-security-trust-html",
|
|
48
|
+
});
|
|
49
|
+
export default rule;
|
|
50
|
+
/* eslint-enable @typescript-eslint/prefer-readonly-parameter-types -- Restore linting after rule implementation declarations. */
|
|
51
|
+
//# sourceMappingURL=no-angular-bypass-security-trust-html.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"no-angular-bypass-security-trust-html.js","sourceRoot":"","sources":["../../src/rules/no-angular-bypass-security-trust-html.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAIzD,MAAM,qBAAqB,GAAG,CAC1B,gBAA2C,EACzB,EAAE;IACpB,IACI,CAAC,gBAAgB,CAAC,QAAQ;QAC1B,gBAAgB,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,EACjD,CAAC;QACC,OAAO,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC1C,CAAC;IAED,IACI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS;QAC5C,OAAO,gBAAgB,CAAC,QAAQ,CAAC,KAAK,KAAK,QAAQ,EACrD,CAAC;QACC,OAAO,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC;IAC3C,CAAC;IAED,OAAO,SAAS,CAAC;AACrB,CAAC,CAAC;AAEF,2BAA2B;AAC3B,MAAM,IAAI,GAAkC,UAAU,CAAwB;IAC1E,MAAM,CAAC,OAAO;QACV,OAAO;YACH,cAAc,CAAC,IAA6B;gBACxC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;oBAC1C,OAAO;gBACX,CAAC;gBAED,IACI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC;oBAClC,yBAAyB,EAC3B,CAAC;oBACC,OAAO;gBACX,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACX,SAAS,EAAE,SAAS;oBACpB,IAAI;iBACP,CAAC,CAAC;YACP,CAAC;SACJ,CAAC;IACN,CAAC;IACD,cAAc,EAAE,EAAE;IAClB,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,WAAW,EACP,qEAAqE;YACzE,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,KAAK;YAClB,GAAG,EAAE,mGAAmG;SAC3G;QACD,QAAQ,EAAE;YACN,OAAO,EACH,4EAA4E;SACnF;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KAClB;IACD,IAAI,EAAE,uCAAuC;CAChD,CAAC,CAAC;AAEH,eAAe,IAAI,CAAC;AACpB,iIAAiI"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"no-angular-innerhtml-binding.d.ts","sourceRoot":"","sources":["../../src/rules/no-angular-innerhtml-binding.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAOzD,2BAA2B;AAC3B,QAAA,MAAM,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CAyDtC,CAAC;AAEH,eAAe,IAAI,CAAC"}
|
|
@@ -0,0 +1,57 @@
|
|
|
1
|
+
import { arrayFirst } from "ts-extras";
|
|
2
|
+
import { createRule } from "../_internal/create-rule.js";
|
|
3
|
+
const hasInnerHtmlBindingPattern = (text) => /\[\s*innerhtml\s*\]\s*=/iu.test(text);
|
|
4
|
+
/** Rule implementation. */
|
|
5
|
+
const rule = createRule({
|
|
6
|
+
create(context) {
|
|
7
|
+
return {
|
|
8
|
+
Literal(node) {
|
|
9
|
+
if (typeof node.value !== "string") {
|
|
10
|
+
return;
|
|
11
|
+
}
|
|
12
|
+
if (!hasInnerHtmlBindingPattern(node.value)) {
|
|
13
|
+
return;
|
|
14
|
+
}
|
|
15
|
+
context.report({
|
|
16
|
+
messageId: "default",
|
|
17
|
+
node,
|
|
18
|
+
});
|
|
19
|
+
},
|
|
20
|
+
TemplateLiteral(node) {
|
|
21
|
+
if (node.expressions.length > 0) {
|
|
22
|
+
return;
|
|
23
|
+
}
|
|
24
|
+
const templateValue = arrayFirst(node.quasis)?.value.cooked;
|
|
25
|
+
if (typeof templateValue !== "string") {
|
|
26
|
+
return;
|
|
27
|
+
}
|
|
28
|
+
if (!hasInnerHtmlBindingPattern(templateValue)) {
|
|
29
|
+
return;
|
|
30
|
+
}
|
|
31
|
+
context.report({
|
|
32
|
+
messageId: "default",
|
|
33
|
+
node,
|
|
34
|
+
});
|
|
35
|
+
},
|
|
36
|
+
};
|
|
37
|
+
},
|
|
38
|
+
defaultOptions: [],
|
|
39
|
+
meta: {
|
|
40
|
+
deprecated: false,
|
|
41
|
+
docs: {
|
|
42
|
+
description: "disallow Angular [innerHTML] template bindings without a reviewed sanitization/trusted-types strategy.",
|
|
43
|
+
frozen: false,
|
|
44
|
+
recommended: false,
|
|
45
|
+
url: "https://nick2bad4u.github.io/eslint-plugin-SDL-2/docs/rules/no-angular-innerhtml-binding",
|
|
46
|
+
},
|
|
47
|
+
messages: {
|
|
48
|
+
default: "Avoid raw [innerHTML] bindings unless input is strictly sanitized by a reviewed policy.",
|
|
49
|
+
},
|
|
50
|
+
schema: [],
|
|
51
|
+
type: "problem",
|
|
52
|
+
},
|
|
53
|
+
name: "no-angular-innerhtml-binding",
|
|
54
|
+
});
|
|
55
|
+
export default rule;
|
|
56
|
+
/* eslint-enable @typescript-eslint/prefer-readonly-parameter-types -- Restore linting after rule implementation declarations. */
|
|
57
|
+
//# sourceMappingURL=no-angular-innerhtml-binding.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"no-angular-innerhtml-binding.js","sourceRoot":"","sources":["../../src/rules/no-angular-innerhtml-binding.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAIzD,MAAM,0BAA0B,GAAG,CAAC,IAAY,EAAW,EAAE,CACzD,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAE3C,2BAA2B;AAC3B,MAAM,IAAI,GAAkC,UAAU,CAAwB;IAC1E,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO,CAAC,IAAsB;gBAC1B,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACjC,OAAO;gBACX,CAAC;gBAED,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1C,OAAO;gBACX,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACX,SAAS,EAAE,SAAS;oBACpB,IAAI;iBACP,CAAC,CAAC;YACP,CAAC;YACD,eAAe,CAAC,IAA8B;gBAC1C,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC9B,OAAO;gBACX,CAAC;gBAED,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC;gBAE5D,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;oBACpC,OAAO;gBACX,CAAC;gBAED,IAAI,CAAC,0BAA0B,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC7C,OAAO;gBACX,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC;oBACX,SAAS,EAAE,SAAS;oBACpB,IAAI;iBACP,CAAC,CAAC;YACP,CAAC;SACJ,CAAC;IACN,CAAC;IACD,cAAc,EAAE,EAAE;IAClB,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,WAAW,EACP,wGAAwG;YAC5G,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,KAAK;YAClB,GAAG,EAAE,0FAA0F;SAClG;QACD,QAAQ,EAAE;YACN,OAAO,EACH,yFAAyF;SAChG;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KAClB;IACD,IAAI,EAAE,8BAA8B;CACvC,CAAC,CAAC;AAEH,eAAe,IAAI,CAAC;AACpB,iIAAiI"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"no-angular-sanitization-trusted-urls.d.ts","sourceRoot":"","sources":["../../src/rules/no-angular-sanitization-trusted-urls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,2BAA2B;AAC3B,QAAA,MAAM,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CA+BtC,CAAC;AAEH,eAAe,IAAI,CAAC"}
|
|
@@ -0,0 +1,32 @@
|
|
|
1
|
+
import { createRule } from "../_internal/create-rule.js";
|
|
2
|
+
/** Rule implementation. */
|
|
3
|
+
const rule = createRule({
|
|
4
|
+
create(context) {
|
|
5
|
+
return {
|
|
6
|
+
"CallExpression[arguments.length>0][callee.object.name='$compileProvider'][callee.property.name=/^(?:aHref|imgSrc)SanitizationTrustedUrlList$/]"(node) {
|
|
7
|
+
context.report({
|
|
8
|
+
messageId: "noSanitizationTrustedUrls",
|
|
9
|
+
node,
|
|
10
|
+
});
|
|
11
|
+
},
|
|
12
|
+
};
|
|
13
|
+
},
|
|
14
|
+
defaultOptions: [],
|
|
15
|
+
meta: {
|
|
16
|
+
deprecated: false,
|
|
17
|
+
docs: {
|
|
18
|
+
description: "disallow AngularJS trusted URL list mutations via $compileProvider.*SanitizationTrustedUrlList.",
|
|
19
|
+
frozen: false,
|
|
20
|
+
recommended: false,
|
|
21
|
+
url: "https://nick2bad4u.github.io/eslint-plugin-SDL-2/docs/rules/no-angular-sanitization-trusted-urls",
|
|
22
|
+
},
|
|
23
|
+
messages: {
|
|
24
|
+
noSanitizationTrustedUrls: "Do not modify AngularJS sanitization trusted URL lists.",
|
|
25
|
+
},
|
|
26
|
+
schema: [],
|
|
27
|
+
type: "problem",
|
|
28
|
+
},
|
|
29
|
+
name: "no-angular-sanitization-trusted-urls",
|
|
30
|
+
});
|
|
31
|
+
export default rule;
|
|
32
|
+
//# sourceMappingURL=no-angular-sanitization-trusted-urls.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"no-angular-sanitization-trusted-urls.js","sourceRoot":"","sources":["../../src/rules/no-angular-sanitization-trusted-urls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,2BAA2B;AAC3B,MAAM,IAAI,GAAkC,UAAU,CAAC;IACnD,MAAM,CAAC,OAAO;QACV,OAAO;YACH,gJAAgJ,CAC5I,IAAI;gBAEJ,OAAO,CAAC,MAAM,CAAC;oBACX,SAAS,EAAE,2BAA2B;oBACtC,IAAI;iBACP,CAAC,CAAC;YACP,CAAC;SACJ,CAAC;IACN,CAAC;IACD,cAAc,EAAE,EAAE;IAClB,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,WAAW,EACP,iGAAiG;YACrG,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,KAAK;YAClB,GAAG,EAAE,kGAAkG;SAC1G;QACD,QAAQ,EAAE;YACN,yBAAyB,EACrB,yDAAyD;SAChE;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KAClB;IACD,IAAI,EAAE,sCAAsC;CAC/C,CAAC,CAAC;AAEH,eAAe,IAAI,CAAC"}
|
|
@@ -0,0 +1,5 @@
|
|
|
1
|
+
import { createRule } from "../_internal/create-rule.js";
|
|
2
|
+
/** Rule implementation for no-angularjs-bypass-sce. */
|
|
3
|
+
export declare const noAngularjsBypassSceRule: ReturnType<typeof createRule>;
|
|
4
|
+
export default noAngularjsBypassSceRule;
|
|
5
|
+
//# sourceMappingURL=no-angularjs-bypass-sce.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"no-angularjs-bypass-sce.d.ts","sourceRoot":"","sources":["../../src/rules/no-angularjs-bypass-sce.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAgCzD,uDAAuD;AACvD,eAAO,MAAM,wBAAwB,EAAE,UAAU,CAAC,OAAO,UAAU,CAiF7D,CAAC;AAEP,eAAe,wBAAwB,CAAC"}
|
|
@@ -0,0 +1,80 @@
|
|
|
1
|
+
import { arrayFirst, arrayIncludes } from "ts-extras";
|
|
2
|
+
import { createRule } from "../_internal/create-rule.js";
|
|
3
|
+
const isEmptyLiteral = (argument) => argument?.type === "Literal" && argument.value === "";
|
|
4
|
+
const isSceProviderEnabledSafeLiteral = (argument) => argument?.type === "Literal" &&
|
|
5
|
+
arrayIncludes([
|
|
6
|
+
1,
|
|
7
|
+
"1",
|
|
8
|
+
true,
|
|
9
|
+
"true",
|
|
10
|
+
], argument.value);
|
|
11
|
+
const isBypassSceMethod = (methodName) => arrayIncludes([
|
|
12
|
+
"trustAs",
|
|
13
|
+
"trustAsCss",
|
|
14
|
+
"trustAsHtml",
|
|
15
|
+
"trustAsJs",
|
|
16
|
+
"trustAsResourceUrl",
|
|
17
|
+
"trustAsUrl",
|
|
18
|
+
], methodName);
|
|
19
|
+
/** Rule implementation for no-angularjs-bypass-sce. */
|
|
20
|
+
export const noAngularjsBypassSceRule = createRule({
|
|
21
|
+
create(context) {
|
|
22
|
+
const report = (node) => {
|
|
23
|
+
context.report({
|
|
24
|
+
messageId: "doNotBypass",
|
|
25
|
+
node,
|
|
26
|
+
});
|
|
27
|
+
};
|
|
28
|
+
return {
|
|
29
|
+
"CallExpression[callee.type='MemberExpression'][callee.object.type='Identifier'][callee.object.name='$sce'][callee.property.type='Identifier']"(node) {
|
|
30
|
+
if (node.callee.type !== "MemberExpression" ||
|
|
31
|
+
node.callee.property.type !== "Identifier") {
|
|
32
|
+
return;
|
|
33
|
+
}
|
|
34
|
+
if (!isBypassSceMethod(node.callee.property.name)) {
|
|
35
|
+
return;
|
|
36
|
+
}
|
|
37
|
+
const firstArgument = arrayFirst(node.arguments);
|
|
38
|
+
if (node.arguments.length === 1 &&
|
|
39
|
+
isEmptyLiteral(firstArgument)) {
|
|
40
|
+
return;
|
|
41
|
+
}
|
|
42
|
+
report(node);
|
|
43
|
+
},
|
|
44
|
+
"CallExpression[callee.type='MemberExpression'][callee.object.type='Identifier'][callee.object.name='$sceProvider'][callee.property.type='Identifier'][callee.property.name='enabled']"(node) {
|
|
45
|
+
const firstArgument = arrayFirst(node.arguments);
|
|
46
|
+
if (isSceProviderEnabledSafeLiteral(firstArgument)) {
|
|
47
|
+
return;
|
|
48
|
+
}
|
|
49
|
+
report(node);
|
|
50
|
+
},
|
|
51
|
+
"CallExpression[callee.type='MemberExpression'][callee.property.type='Identifier'][callee.property.name='trustAs']"(node) {
|
|
52
|
+
const firstArgument = arrayFirst(node.arguments);
|
|
53
|
+
if (node.arguments.length === 1 &&
|
|
54
|
+
isEmptyLiteral(firstArgument)) {
|
|
55
|
+
return;
|
|
56
|
+
}
|
|
57
|
+
report(node);
|
|
58
|
+
},
|
|
59
|
+
};
|
|
60
|
+
},
|
|
61
|
+
defaultOptions: [],
|
|
62
|
+
meta: {
|
|
63
|
+
deprecated: false,
|
|
64
|
+
docs: {
|
|
65
|
+
description: "disallow AngularJS SCE bypass APIs that trust unvalidated values.",
|
|
66
|
+
frozen: false,
|
|
67
|
+
recommended: false,
|
|
68
|
+
url: "https://github.com/Nick2bad4u/eslint-plugin-SDL-2/blob/main/docs/rules/no-angularjs-bypass-sce.md",
|
|
69
|
+
},
|
|
70
|
+
messages: {
|
|
71
|
+
doNotBypass: "Do not bypass AngularJS SCE with untrusted values. Validate and sanitize content before marking it trusted.",
|
|
72
|
+
},
|
|
73
|
+
schema: [],
|
|
74
|
+
type: "problem",
|
|
75
|
+
},
|
|
76
|
+
name: "no-angularjs-bypass-sce",
|
|
77
|
+
});
|
|
78
|
+
export default noAngularjsBypassSceRule;
|
|
79
|
+
/* eslint-enable @typescript-eslint/prefer-readonly-parameter-types -- Restore linting after rule implementation declarations. */
|
|
80
|
+
//# sourceMappingURL=no-angularjs-bypass-sce.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"no-angularjs-bypass-sce.js","sourceRoot":"","sources":["../../src/rules/no-angularjs-bypass-sce.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,MAAM,cAAc,GAAG,CAAC,QAAmC,EAAW,EAAE,CACpE,QAAQ,EAAE,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;AAE1D,MAAM,+BAA+B,GAAG,CACpC,QAAmC,EAC5B,EAAE,CACT,QAAQ,EAAE,IAAI,KAAK,SAAS;IAC5B,aAAa,CACT;QACI,CAAC;QACD,GAAG;QACH,IAAI;QACJ,MAAM;KACT,EACD,QAAQ,CAAC,KAAK,CACjB,CAAC;AAEN,MAAM,iBAAiB,GAAG,CAAC,UAAkB,EAAW,EAAE,CACtD,aAAa,CACT;IACI,SAAS;IACT,YAAY;IACZ,aAAa;IACb,WAAW;IACX,oBAAoB;IACpB,YAAY;CACf,EACD,UAAU,CACb,CAAC;AAEN,uDAAuD;AACvD,MAAM,CAAC,MAAM,wBAAwB,GACjC,UAAU,CAAC;IACP,MAAM,CAAC,OAAO;QACV,MAAM,MAAM,GAAG,CAAC,IAA6B,EAAQ,EAAE;YACnD,OAAO,CAAC,MAAM,CAAC;gBACX,SAAS,EAAE,aAAa;gBACxB,IAAI;aACP,CAAC,CAAC;QACP,CAAC,CAAC;QAEF,OAAO;YACH,+IAA+I,CAC3I,IAA6B;gBAE7B,IACI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;oBACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY,EAC5C,CAAC;oBACC,OAAO;gBACX,CAAC;gBAED,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChD,OAAO;gBACX,CAAC;gBAED,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAEjD,IACI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;oBAC3B,cAAc,CAAC,aAAa,CAAC,EAC/B,CAAC;oBACC,OAAO;gBACX,CAAC;gBAED,MAAM,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;YACD,uLAAuL,CACnL,IAA6B;gBAE7B,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAEjD,IAAI,+BAA+B,CAAC,aAAa,CAAC,EAAE,CAAC;oBACjD,OAAO;gBACX,CAAC;gBAED,MAAM,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;YACD,mHAAmH,CAC/G,IAA6B;gBAE7B,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAEjD,IACI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;oBAC3B,cAAc,CAAC,aAAa,CAAC,EAC/B,CAAC;oBACC,OAAO;gBACX,CAAC;gBAED,MAAM,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;SACJ,CAAC;IACN,CAAC;IACD,cAAc,EAAE,EAAW;IAC3B,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,WAAW,EACP,mEAAmE;YACvE,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,KAAK;YAClB,GAAG,EAAE,mGAAmG;SAC3G;QACD,QAAQ,EAAE;YACN,WAAW,EACP,6GAA6G;SACpH;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,SAAS;KAClB;IACD,IAAI,EAAE,yBAAyB;CAClC,CAAC,CAAC;AAEP,eAAe,wBAAwB,CAAC;AACxC,iIAAiI"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"no-angularjs-enable-svg.d.ts","sourceRoot":"","sources":["../../src/rules/no-angularjs-enable-svg.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAgBzD,2BAA2B;AAC3B,QAAA,MAAM,IAAI,EAAE,UAAU,CAAC,OAAO,UAAU,CAwCtC,CAAC;AAEH,eAAe,IAAI,CAAC"}
|