Skip to content

Commit 36a1dd0

Browse files
authored
Merge pull request #223 from github/no-script-tag-building
We should never allow building `script` tags in our applications since they side-step some security measures.
2 parents d882a8e + 97d7f2b commit 36a1dd0

File tree

6 files changed

+94
-0
lines changed

6 files changed

+94
-0
lines changed

README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ The available configs are:
5050
- [No Blur](./docs/rules/no-blur.md)
5151
- [No D None](./docs/rules/no-d-none.md)
5252
- [No Dataset](./docs/rules/no-dataset.md)
53+
- [No Dynamic Script Tag](./docs/rules/no-dynamic-script-tag.md)
5354
- [No Implicit Buggy Globals](./docs/rules/no-implicit-buggy-globals.md)
5455
- [No Inner HTML](./docs/rules/no-inner-html.md)
5556
- [No InnerText](./docs/rules/no-innerText.md)

docs/rules/no-dynamic-script-tag.md

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# No Dynamic Script Tag
2+
3+
## Rule Details
4+
5+
Creating dynamic script tags bypasses a lot of security measures - like SRIs - and pose a potential threat to your application.
6+
Instead of creating a `script` tag in the client, provide all necessary `script` tags in the page's HTML.
7+
8+
👎 Examples of **incorrect** code for this rule:
9+
10+
```js
11+
document.createElement('script')
12+
document.getElementById('some-id').type = 'text/javascript'
13+
```
14+
15+
👍 Examples of **correct** code for this rule:
16+
17+
```html
18+
<!-- index.html -->
19+
<script src="/index.js" type="text/javascript">
20+
```
21+
22+
## Version
23+
24+
4.3.2

lib/configs/recommended.js

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ module.exports = {
2323
'github/array-foreach': 'error',
2424
'github/no-implicit-buggy-globals': 'error',
2525
'github/no-then': 'error',
26+
'github/no-dynamic-script-tag': 'error',
2627
'i18n-text/no-en': ['error'],
2728
'import/default': 'error',
2829
'import/export': 'error',

lib/index.js

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ module.exports = {
1212
'no-implicit-buggy-globals': require('./rules/no-implicit-buggy-globals'),
1313
'no-inner-html': require('./rules/no-inner-html'),
1414
'no-innerText': require('./rules/no-innerText'),
15+
'no-dynamic-script-tag': require('./rules/no-dynamic-script-tag'),
1516
'no-then': require('./rules/no-then'),
1617
'no-useless-passive': require('./rules/no-useless-passive'),
1718
'prefer-observers': require('./rules/prefer-observers'),

lib/rules/no-dynamic-script-tag.js

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
module.exports = {
2+
meta: {
3+
type: 'suggestion',
4+
docs: {
5+
description: 'disallow creating dynamic script tags',
6+
url: require('../url')(module)
7+
},
8+
schema: []
9+
},
10+
11+
create(context) {
12+
return {
13+
'CallExpression[callee.property.name="createElement"][arguments.length > 0]': function (node) {
14+
if (node.arguments[0].value !== 'script') return
15+
16+
context.report({
17+
node: node.arguments[0],
18+
message: "Don't create dynamic script tags, add them in the server template instead."
19+
})
20+
},
21+
'AssignmentExpression[left.property.name="type"][right.value="text/javascript"]': function (node) {
22+
context.report({
23+
node: node.right,
24+
message: "Don't create dynamic script tags, add them in the server template instead."
25+
})
26+
}
27+
}
28+
}
29+
}

tests/no-dynamic-script-tag.js

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
const rule = require('../lib/rules/no-dynamic-script-tag')
2+
const RuleTester = require('eslint').RuleTester
3+
4+
const ruleTester = new RuleTester()
5+
6+
ruleTester.run('no-dynamic-script-tag', rule, {
7+
valid: [
8+
{
9+
code: 'document.createElement("div")'
10+
},
11+
{
12+
code: 'document.createElement("span")'
13+
},
14+
{
15+
code: 'document.createElement("span").type = "foo"'
16+
}
17+
],
18+
invalid: [
19+
{
20+
code: 'document.createElement("script")',
21+
errors: [
22+
{
23+
message: "Don't create dynamic script tags, add them in the server template instead.",
24+
type: 'Literal'
25+
}
26+
]
27+
},
28+
{
29+
code: 'document.createElement("span").type = "text/javascript"',
30+
errors: [
31+
{
32+
message: "Don't create dynamic script tags, add them in the server template instead.",
33+
type: 'Literal'
34+
}
35+
]
36+
}
37+
]
38+
})

0 commit comments

Comments
 (0)