Skip to content

Commit

Permalink
Move include to new rule names and describe setup in README. Fixes #49 (
Browse files Browse the repository at this point in the history
  • Loading branch information
jonathanKingston authored and mozfreddyb committed Apr 19, 2017
1 parent 5e3e09b commit 570ea4d
Show file tree
Hide file tree
Showing 2 changed files with 18 additions and 2 deletions.
17 changes: 16 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[![Build Status](https://travis-ci.org/mozilla/eslint-plugin-no-unsanitized.svg?branch=master)](https://travis-ci.org/mozilla/eslint-plugin-no-unsanitized)
# Disallow unsanitized DOM access (no-unsanitized)

This function disallows unsafe coding practices that may result into security vulnerabilities. We will disallow assignments to innerHTML as well as calls to insertAdjacentHTML without the use of a pre-defined escaping function. The escaping functions must be called with a template string. The function names are hardcoded as `Sanitizer.escapeHTML` and `escapeHTML`.
These rules disallow unsafe coding practices that may result into security vulnerabilities. We will disallow assignments to innerHTML as well as calls to insertAdjacentHTML without the use of a pre-defined escaping function. The escaping functions must be called with a template string. The function names are hardcoded as `Sanitizer.escapeHTML` and `escapeHTML`.

## Rule Details

Expand All @@ -25,3 +25,18 @@ bar.innerHTML = escapeHTML`<a href='${url}'>About</a>`;


This rule is being used within Mozilla to maintain and improve the security of our products and services.


## Usage

In your eslint.json file enable this rule with the following:

```
{
"plugins": ["no-unsanitized"],
"env": {
"no-unsanitized/method": "error",
"no-unsanitized/property": "error"
}
}
```
3 changes: 2 additions & 1 deletion index.js
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
/* global module, require */
module.exports = {
rules: {
"no-unsanitized": require("./lib/rules/no-unsanitized")
"property": require("./lib/rules/property"),
"method": require("./lib/rules/method")
}
};

0 comments on commit 570ea4d

Please sign in to comment.