search

mozilla / eslint-plugin-no-unsanitized

Custom ESLint rule to disallows unsafe innerHTML, outerHTML, insertAdjacentHTML and alike
Mozilla Public License 2.0
224 stars 34 forks source link

Consider renaming based upon extending functionality #17

Closed jonathanKingston closed 7 years ago

jonathanKingston commented 7 years ago

I cyber-squated on eslint-plugin-no-unescaped for the reason I wanted customisation for methods, assignment, string assignment and potentially other checks too.

If the customisation and the separate rule for checking for key assignment were rolled in here then it could be worth renaming the extension all together.

I know this somewhat defeats the point of rolling the code in here (I have no desire to maintain this longterm anyway and ideally would push to have it under a Mozilla GitHub really) to prevent stranded users of this npm however I am pretty convinced we will need to do a breaking change anyway.

Anyway just thought I would raise the discussion point :).

jonathanKingston commented 7 years ago

Maybe we make a new parent like the ScanJS rules you have also... https://github.com/mozfreddyb/eslint-config-scanjs/blob/master/.eslintrc

That probably could do with an audit also to ensure it's up to date and remove some of the fxos stuff that is no longer used.

mozfreddyb commented 7 years ago

For uses in firefox (or other bigger projects), I'd prefer single-purpose rules that we can enable/disable selectively. The more checks we do in one rule, the more security checks we lose when someone has to disable it for a file or a folder.

Makes sense?

mozfreddyb commented 7 years ago

That probably could do with an audit also to ensure it's up to date and remove some of the fxos stuff that is no longer used. Filed two issues