feat(linter): implement jsx-no-script-url
#6995
Conversation
Your org has enabled the Graphite merge queue for merging into mainAdd the label “0-merge” to the PR and Graphite will automatically add it to the merge queue when it’s ready to merge. Or use the label “hotfix” to add to the merge queue as a hot fix. You must have a Graphite account and log in to Graphite in order to use the merge queue. Sign up using this link. |
CodSpeed Performance ReportMerging #6995 will not alter performanceComparing Summary
|
|
|
||
| fn jsx_no_script_url_diagnostic(span: Span) -> OxcDiagnostic { | ||
| // See <https://oxc.rs/docs/contribute/linter/adding-rules.html#diagnostics> for details | ||
| OxcDiagnostic::warn("A future version of React will block javascript: URLs as a security precaution. Use event handlers instead if you can. If you need to generate unsafe HTML, try using dangerouslySetInnerHTML instead.") |
There was a problem hiding this comment.
Move all sentences but the first to a help message
| /// | ||
| /// ### Why is this bad? | ||
| /// | ||
| /// In React 16.9 any URLs starting with javascript: scheme log a warning. React considers the pattern as a dangerous attack surface, see details. In a future major release, React will throw an error if it encounters a javascript: URL. |
There was a problem hiding this comment.
Copy paste issue, will change
| return; | ||
| }; | ||
| if prop_value.as_string_literal().is_some_and(|val| { | ||
| let re = Regex::new(IS_JAVA_SCRIPT_PROTOCOL).unwrap(); |
There was a problem hiding this comment.
you should use lazy_static to wrap it to make sure it is only initialized once. ref
oxc/crates/oxc_linter/src/rules/eslint/no_nonoctal_decimal_escape.rs
Lines 87 to 90 in a786dc2
There was a problem hiding this comment.
here is the reason, https://github.com/rust-lang/regex?tab=readme-ov-file#usage-avoid-compiling-the-same-regex-in-a-loop, I recommended using lazy_static since it is widely used in linter crate
radu2147
force-pushed
the
feat/no-jsx-script-url
branch
2 times, most recently
from
3e32476
to
a0ddd86
Compare
radu2147
force-pushed
the
feat/no-jsx-script-url
branch
from
a0ddd86
to
6775cf7
Compare
| ), | ||
| ), | ||
| ( | ||
| r#"<Foo other="javascript:"></Foo>"#, |
There was a problem hiding this comment.
FYI, I added an extra test to pass, as it checks for the link attributes not to have the javascript: value.(It seems that the original implementation of the rule does that, it just doesn't have a test case for it). I can remove it though if deemed as not necessary.
#1022