search

mozilla / eslint-plugin-no-unsanitized

Custom ESLint rule to disallows unsafe innerHTML, outerHTML, insertAdjacentHTML and alike
Mozilla Public License 2.0
222 stars 33 forks source link

Chasing method names in assignment should take operator into account #210

Open mozfreddyb opened 1 year ago

mozfreddyb commented 1 year ago

This is a follow-up from #207 and #206. The patch fixed working with function calls in code like (a = b)(foo), but did not take the assignment operator into account.

A simple equal sign will ensure that only b will ever be called, as it is assigned into a. However, operators like ||= will not.

mozfreddyb commented 1 year ago

Turns out this will require a bit of a refactor. Currently, this comes up in normalizeMethodName() which is supposed to return one method name as the normalized name. However, in case of a call like a ||= b)(foo) the function that's called is either a or b, so we need to check both..