no-winjs-html-unsafe.js 1.4 KB

1234567891011121314151617181920212223242526272829303132333435363738
  1. // Copyright (c) Microsoft Corporation.
  2. // Licensed under the MIT License.
  3. /**
  4. * @fileoverview Rule to disallow WinJS.Utilities.setInnerHTMLUnsafe or WinJS.Utilities.setOuterHTMLUnsafe method call
  5. * @author Antonios Katopodis
  6. */
  7. "use strict";
  8. //------------------------------------------------------------------------------
  9. // Rule Definition
  10. //------------------------------------------------------------------------------
  11. module.exports = {
  12. meta: {
  13. type: "suggestion",
  14. fixable: "code",
  15. schema: [],
  16. docs:{
  17. description: "Calls to [`WinJS.Utilities.setInnerHTMLUnsafe()`](https://docs.microsoft.com/en-us/previous-versions/windows/apps/br211696(v=win.10)) and similar methods do not perform any input validation and should be avoided. Use [`WinJS.Utilities.setInnerHTML()`](https://docs.microsoft.com/en-us/previous-versions/windows/apps/br211697(v=win.10)) instead.",
  18. url: "https://github.com/microsoft/eslint-plugin-sdl/blob/master/docs/rules/no-winjs-html-unsafe.md"
  19. },
  20. messages: {
  21. default: 'Do not set HTML using unsafe methods from WinJS.Utilities'
  22. }
  23. },
  24. create: function(context) {
  25. return {
  26. "CallExpression[callee.object.object.name='WinJS'][callee.object.property.name='Utilities'][callee.property.name=/(insertAdjacent|setInner|setOuter)HTMLUnsafe/]"(node) {
  27. context.report(
  28. {
  29. node: node,
  30. messageId: "default"
  31. });
  32. }
  33. };
  34. }
  35. };