search

mozilla / eslint-plugin-no-unsanitized

Custom ESLint rule to disallows unsafe innerHTML, outerHTML, insertAdjacentHTML and alike
Mozilla Public License 2.0
222 stars 33 forks source link

tracing variables back through definitions and references to reduce false positives #167

Closed mozfreddyb closed 2 years ago

mozfreddyb commented 3 years ago

ESLint provides a scope interface that allows tracing variables back to their definitions and other references.

This can be used to see if the variable foo in el.innerHTML = foo traces back to a hardcoded string and is therefore secure.

For this to work, one needs to ensure that backtracing can not be fooled into believing an early variable declaration that is - at some point- overwritten.

I'll implement this incrementally with some trade-offs and omissions that will be filed as follow-ups. This will probably make us miss some variables that could be traced back, but at least it won't cause a security issue.