mozilla / eslint-plugin-no-unsanitized

Custom ESLint rule to disallows unsafe innerHTML, outerHTML, insertAdjacentHTML and alike
Mozilla Public License 2.0
228 stars 37 forks source link

Error when a non-initialized variable is used in a template string #188

Closed willdurand closed 2 years ago

willdurand commented 2 years ago

This is the currently failing test case:

diff --git a/tests/rules/property.js b/tests/rules/property.js
index 5db2a96..38d7fd5 100644
--- a/tests/rules/property.js
+++ b/tests/rules/property.js
@@ -92,6 +92,10 @@ eslintTester.run("property", rule, {
             code: "i.outerHTML += Sanitizer.unwrapSafeHTML(htmlSnippet)",
             parserOptions: { ecmaVersion: 6 }
         },
+        {
+            code: "let c; a.innerHTML = `${c}`;",
+            parserOptions: { ecmaVersion: 6 }
+        },

         // (binary) expressions
         {

Expected

No error.

Actual

[...]
  166 passing (515ms)
  1 failing

  1) property
       valid
         let c; a.innerHTML = `${c}`;:
     TypeError: Cannot read property 'type' of null
Occurred while linting <input>:1
Rule: "property"
      at RuleHelper.allowedExpression (lib/ruleHelper.js:31:53)
      at RuleHelper.isAllowedIdentifier (lib/ruleHelper.js:64:92)
      at RuleHelper.allowedExpression (lib/ruleHelper.js:38:372)
      at /Users/william/projects/mozilla/eslint-plugin-no-unsanitized/lib/ruleHelper.js:39:244
      at Array.every (<anonymous>)
      at RuleHelper.allowedExpression (lib/ruleHelper.js:39:173)
      at RuleHelper.allowedExpression (lib/ruleHelper.js:37:14)
      at RuleHelper.checkProperty (lib/ruleHelper.js:126:354)
      at AssignmentExpression (lib/rules/property.js:24:421)
      at ruleErrorHandler (node_modules/eslint/lib/linter/linter.js:966:28)
      at /Users/william/projects/mozilla/eslint-plugin-no-unsanitized/node_modules/eslint/lib/linter/safe-emitter.js:45:58
      at Array.forEach (<anonymous>)
      at Object.emit (node_modules/eslint/lib/linter/safe-emitter.js:45:38)
      at NodeEventGenerator.applySelector (node_modules/eslint/lib/linter/node-event-generator.js:297:26)
      at NodeEventGenerator.applySelectors (node_modules/eslint/lib/linter/node-event-generator.js:326:22)
      at NodeEventGenerator.enterNode (node_modules/eslint/lib/linter/node-event-generator.js:340:14)
      at CodePathAnalyzer.enterNode (node_modules/eslint/lib/linter/code-path-analysis/code-path-analyzer.js:790:23)
      at /Users/william/projects/mozilla/eslint-plugin-no-unsanitized/node_modules/eslint/lib/linter/linter.js:997:32
      at Array.forEach (<anonymous>)
      at runRules (node_modules/eslint/lib/linter/linter.js:992:15)
      at Linter._verifyWithoutProcessors (node_modules/eslint/lib/linter/linter.js:1219:31)
      at Linter.verify (node_modules/eslint/lib/linter/linter.js:1289:21)
      at runRuleForItem (node_modules/eslint/lib/rule-tester/rule-tester.js:641:35)
      at testValidTemplate (node_modules/eslint/lib/rule-tester/rule-tester.js:694:28)
      at Context.<anonymous> (node_modules/eslint/lib/rule-tester/rule-tester.js:972:29)
      at processImmediate (internal/timers.js:464:21)