search

mozilla / eslint-plugin-no-unsanitized

Custom ESLint rule to disallows unsafe innerHTML, outerHTML, insertAdjacentHTML and alike
Mozilla Public License 2.0
228 stars 37 forks source link

Please include documentation on how to install/use #48

Closed lutostag closed 7 years ago

lutostag commented 7 years ago

If there were documentation on how to call it, that would be helpful. I can't get no-unsanitized to warn when it should, even when I intentionally do not escape. Any idea what I am doing wrong?

As an aside, here is a first stab at some documentation you might include in the README:

Install

With yarn or npm:

$ yarn add -D git+https://github.com/mozilla/eslint-plugin-no-unsanitized.git
$ npm install --save-dev git+https://github.com/mozilla/eslint-plugin-no-unsanitized.git

Usage

With eslint -- enable the plugin in eslint.rc file by adding it to the plugins section:

plugins: ["no-unsanitized"]

(Or any other method in eslint's docs)

With standard:

standard --plugin no-unsanitized

(Or any other method in standardjs' docs)

A sanitizer you might find useful: https://www.npmjs.com/package/escape-html-template-tag

mozfreddyb commented 7 years ago

This repo's master is currently unstable. You can use a previously released version from NPM in the meantime: https://www.npmjs.com/package/eslint-plugin-no-unsafe-innerhtml

(https://www.npmjs.com/package/escape-html-template-tag looks neat! Thanks!)

jonathanKingston commented 7 years ago

I added some of this to my latest pr for the version bump. I don't know if standard provides ways to customise rules or even use defaults/configs. Testing needed.

By default you need to enable both method and property rule for this to work.

However we will provide defaults so you can do:

{
  plugins: ["no-unsanitized"],
  extends: ["plugin:no-unsanitized/DOM"]
}
mozfreddyb commented 7 years ago

@lutostag Your bug should be fixed when you pull the latest changes. Can you confirm?