no-angular-sanitization-trusted-urls.js 1.5 KB

123456789101112131415161718192021222324252627282930313233343536373839
  1. // Copyright (c) Microsoft Corporation.
  2. // Licensed under the MIT License.
  3. /**
  4. * @fileoverview Rule to disallow modifying sanitization allowed url list in AngularJS. Update fron the deprecate SanitizationWhitelist
  5. * @author Vivien Flouirac
  6. */
  7. "use strict";
  8. //------------------------------------------------------------------------------
  9. // Rule Definition
  10. //------------------------------------------------------------------------------
  11. module.exports = {
  12. meta: {
  13. type: "suggestion",
  14. fixable: "code",
  15. schema: [],
  16. docs: {
  17. category: "Security",
  18. description: "Calls to [`$compileProvider.aHrefSanitizationTrustedUrlList`](https://docs.angularjs.org/api/ng/provider/$compileProvider#aHrefSanitizationTrustedUrlList) configure allowed Url list in AngularJS sanitizer and need to be reviewed.",
  19. url: "https://github.com/microsoft/eslint-plugin-sdl/blob/master/docs/rules/no-angular-sanitization-trusted-urls.md"
  20. },
  21. messages: {
  22. noSanitizationTrustedUrls: "Do not modify the trusted Urls list in AngularJS"
  23. }
  24. },
  25. create: function(context) {
  26. return {
  27. "CallExpression[arguments!=''][callee.object.name='$compileProvider'][callee.property.name=/(aHref|imgSrc)SanitizationTrustedUrlList/]"(node) {
  28. context.report(
  29. {
  30. node: node,
  31. messageId: "noSanitizationTrustedUrls"
  32. });
  33. }
  34. };
  35. }
  36. };