no-script-url.js 1.7 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061
  1. /**
  2. * @fileoverview Rule to flag when using javascript: urls
  3. * @author Ilya Volodin
  4. */
  5. /* eslint no-script-url: 0 -- Code is checking to report such URLs */
  6. "use strict";
  7. const astUtils = require("./utils/ast-utils");
  8. //------------------------------------------------------------------------------
  9. // Rule Definition
  10. //------------------------------------------------------------------------------
  11. /** @type {import('../shared/types').Rule} */
  12. module.exports = {
  13. meta: {
  14. type: "suggestion",
  15. docs: {
  16. description: "Disallow `javascript:` urls",
  17. recommended: false,
  18. url: "https://eslint.org/docs/rules/no-script-url"
  19. },
  20. schema: [],
  21. messages: {
  22. unexpectedScriptURL: "Script URL is a form of eval."
  23. }
  24. },
  25. create(context) {
  26. /**
  27. * Check whether a node's static value starts with "javascript:" or not.
  28. * And report an error for unexpected script URL.
  29. * @param {ASTNode} node node to check
  30. * @returns {void}
  31. */
  32. function check(node) {
  33. const value = astUtils.getStaticStringValue(node);
  34. if (typeof value === "string" && value.toLowerCase().indexOf("javascript:") === 0) {
  35. context.report({ node, messageId: "unexpectedScriptURL" });
  36. }
  37. }
  38. return {
  39. Literal(node) {
  40. if (node.value && typeof node.value === "string") {
  41. check(node);
  42. }
  43. },
  44. TemplateLiteral(node) {
  45. if (!(node.parent && node.parent.type === "TaggedTemplateExpression")) {
  46. check(node);
  47. }
  48. }
  49. };
  50. }
  51. };