no-cookies.js 1.3 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243
  1. // Copyright (c) Microsoft Corporation.
  2. // Licensed under the MIT License.
  3. /**
  4. * @fileoverview Rule to disallow usage of HTTP cookies
  5. * @author Antonios Katopodis
  6. */
  7. "use strict";
  8. const astUtils = require("../ast-utils");
  9. //------------------------------------------------------------------------------
  10. // Rule Definition
  11. //------------------------------------------------------------------------------
  12. module.exports = {
  13. meta: {
  14. type: "suggestion",
  15. fixable: "code",
  16. schema: [],
  17. docs: {
  18. category: "Security",
  19. description: "HTTP cookies are an old client-side storage mechanism with inherent risks and limitations. Use Web Storage, IndexedDB or other more modern methods instead.",
  20. url: "https://github.com/microsoft/eslint-plugin-sdl/blob/master/docs/rules/no-cookies.md"
  21. },
  22. messages: {
  23. doNotUseCookies: "Do not use HTTP cookies in modern applications"
  24. }
  25. },
  26. create: function (context) {
  27. const fullTypeChecker = astUtils.getFullTypeChecker(context);
  28. return {
  29. "MemberExpression[property.name='cookie']"(node) {
  30. if (astUtils.isDocumentObject(node.object, context, fullTypeChecker)) {
  31. context.report({
  32. node: node,
  33. messageId: "doNotUseCookies"
  34. });
  35. }
  36. }
  37. };
  38. }
  39. };