File tree Expand file tree Collapse file tree 6 files changed +94
-0
lines changed Expand file tree Collapse file tree 6 files changed +94
-0
lines changed Original file line number Diff line number Diff line change @@ -50,6 +50,7 @@ The available configs are:
50
50
- [ No Blur] ( ./docs/rules/no-blur.md )
51
51
- [ No D None] ( ./docs/rules/no-d-none.md )
52
52
- [ No Dataset] ( ./docs/rules/no-dataset.md )
53
+ - [ No Dynamic Script Tag] ( ./docs/rules/no-dynamic-script-tag.md )
53
54
- [ No Implicit Buggy Globals] ( ./docs/rules/no-implicit-buggy-globals.md )
54
55
- [ No Inner HTML] ( ./docs/rules/no-inner-html.md )
55
56
- [ No InnerText] ( ./docs/rules/no-innerText.md )
Original file line number Diff line number Diff line change
1
+ # No Dynamic Script Tag
2
+
3
+ ## Rule Details
4
+
5
+ Creating dynamic script tags bypasses a lot of security measures - like SRIs - and pose a potential threat to your application.
6
+ Instead of creating a ` script ` tag in the client, provide all necessary ` script ` tags in the page's HTML.
7
+
8
+ 👎 Examples of ** incorrect** code for this rule:
9
+
10
+ ``` js
11
+ document .createElement (' script' )
12
+ document .getElementById (' some-id' ).type = ' text/javascript'
13
+ ```
14
+
15
+ 👍 Examples of ** correct** code for this rule:
16
+
17
+ ``` html
18
+ <!-- index.html -->
19
+ <script src =" /index.js" type =" text/javascript" >
20
+ ` ` `
21
+
22
+ ## Version
23
+
24
+ 4.3.2
Original file line number Diff line number Diff line change @@ -23,6 +23,7 @@ module.exports = {
23
23
'github/array-foreach' : 'error' ,
24
24
'github/no-implicit-buggy-globals' : 'error' ,
25
25
'github/no-then' : 'error' ,
26
+ 'github/no-dynamic-script-tag' : 'error' ,
26
27
'i18n-text/no-en' : [ 'error' ] ,
27
28
'import/default' : 'error' ,
28
29
'import/export' : 'error' ,
Original file line number Diff line number Diff line change @@ -12,6 +12,7 @@ module.exports = {
12
12
'no-implicit-buggy-globals' : require ( './rules/no-implicit-buggy-globals' ) ,
13
13
'no-inner-html' : require ( './rules/no-inner-html' ) ,
14
14
'no-innerText' : require ( './rules/no-innerText' ) ,
15
+ 'no-dynamic-script-tag' : require ( './rules/no-dynamic-script-tag' ) ,
15
16
'no-then' : require ( './rules/no-then' ) ,
16
17
'no-useless-passive' : require ( './rules/no-useless-passive' ) ,
17
18
'prefer-observers' : require ( './rules/prefer-observers' ) ,
Original file line number Diff line number Diff line change
1
+ module . exports = {
2
+ meta : {
3
+ type : 'suggestion' ,
4
+ docs : {
5
+ description : 'disallow creating dynamic script tags' ,
6
+ url : require ( '../url' ) ( module )
7
+ } ,
8
+ schema : [ ]
9
+ } ,
10
+
11
+ create ( context ) {
12
+ return {
13
+ 'CallExpression[callee.property.name="createElement"][arguments.length > 0]' : function ( node ) {
14
+ if ( node . arguments [ 0 ] . value !== 'script' ) return
15
+
16
+ context . report ( {
17
+ node : node . arguments [ 0 ] ,
18
+ message : "Don't create dynamic script tags, add them in the server template instead."
19
+ } )
20
+ } ,
21
+ 'AssignmentExpression[left.property.name="type"][right.value="text/javascript"]' : function ( node ) {
22
+ context . report ( {
23
+ node : node . right ,
24
+ message : "Don't create dynamic script tags, add them in the server template instead."
25
+ } )
26
+ }
27
+ }
28
+ }
29
+ }
Original file line number Diff line number Diff line change
1
+ const rule = require ( '../lib/rules/no-dynamic-script-tag' )
2
+ const RuleTester = require ( 'eslint' ) . RuleTester
3
+
4
+ const ruleTester = new RuleTester ( )
5
+
6
+ ruleTester . run ( 'no-dynamic-script-tag' , rule , {
7
+ valid : [
8
+ {
9
+ code : 'document.createElement("div")'
10
+ } ,
11
+ {
12
+ code : 'document.createElement("span")'
13
+ } ,
14
+ {
15
+ code : 'document.createElement("span").type = "foo"'
16
+ }
17
+ ] ,
18
+ invalid : [
19
+ {
20
+ code : 'document.createElement("script")' ,
21
+ errors : [
22
+ {
23
+ message : "Don't create dynamic script tags, add them in the server template instead." ,
24
+ type : 'Literal'
25
+ }
26
+ ]
27
+ } ,
28
+ {
29
+ code : 'document.createElement("span").type = "text/javascript"' ,
30
+ errors : [
31
+ {
32
+ message : "Don't create dynamic script tags, add them in the server template instead." ,
33
+ type : 'Literal'
34
+ }
35
+ ]
36
+ }
37
+ ]
38
+ } )
You can’t perform that action at this time.
0 commit comments