Open jcoyne opened 1 month ago
Hi there! 👋🏻
It looks like the AllowedScriptType
rule only allows text/javascript
by default. You can easily customize the rule in your configuration file:
---
linters:
AllowedScriptType:
enabled: true
allowed_types:
- 'application/json'
- 'text/javascript'
- 'text/html'
- 'application/ld+json' # ⬅️ here
- 'module' # ⬅️ and here
allow_blank: false
disallow_inline_scripts: false
(More details in the link I shared above.)
(This PR in BetterHtml seems to be related by the way: Add module as a type of .)
Does it make sense to add these to the default acceptable values?
@jcoyne Reading the documentation, I don't think application/ld+json
should be added to the defaults:
It is common practice for web developers to use
<script>
tags with non-executable type attributes, such asapplication/json
ortext/html
to pass arbitrary data into an html page. Despite not being executable, these tags are subject to the same parsing quirks as executable script tags, and it is therefore more difficult to prevent security issues from creeping in. Consider for instance an application where it is possible to inject the string</script><script>
unescaped into atext/html
tag, the application would be vulnerable to XSS.
If you want to allow application/ld+json
, you should add it to your own configuration.
About the module
type however, I'm a little less sure and, to be honest am not familiar enough with the matter to answer categorically.
Meanwhile, you can allow these in your ERB Lint configuration file.
I don't understand why erb_lint is surfacing this:
This is valid HTML: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Modules#applying_the_module_to_your_html
Similarly "application/ld+json" should be an acceptable value. https://docs.parse.ly/metadata-jsonld/