Add support for `Element.setHTMLUnsafe()`

mozilla / eslint-plugin-no-unsanitized

Custom ESLint rule to disallows unsafe innerHTML, outerHTML, insertAdjacentHTML and alike

Mozilla Public License 2.0

222 stars 33 forks source link

Closed mozfreddyb closed 5 months ago

mozfreddyb commented 7 months ago

When implemented, setHTMLUnsafe() can be used as another unsafe XSS sink, similar to assignments to innerHTML.

The linter should disallow it just as well. The function implemented and not included in the linter rules constitutes an XSS risk.