eslint-plugin-code-quality-rules/f2e-security.js

code-quality-rules

module.exports = {
  meta: {
    type: 'suggestion',

    docs: {
      description: 'enforce a maximum depth that blocks can be nested',
      category: 'Stylistic Issues',
      recommended: false,
      url: 'https://eslint.org/docs/rules/max-depth',
    },

    schema: [
      {
        oneOf: [
          {
            type: 'integer',
            minimum: 0,
          },
          {
            type: 'object',
            properties: {
              maximum: {
                type: 'integer',
                minimum: 0,
              },
              max: {
                type: 'integer',
                minimum: 0,
              },
            },
            additionalProperties: false,
          },
        ],
      },
    ],
    messages: {
      danger: 'There are potential risks, {{tips}} ',
    },
  },

  create(context) {
    const sourceCode = context.getSourceCode();
    const INNER_HTML = /\.innerHtml/;
    function hasInnerHtml(text) {
      return INNER_HTML.test(text);
    }

    function hasAttribute(node, elem, attr) {
      const { name, attributes } = node;
      if (elem === name.name && attributes && Array.isArray(attributes)) {
        let containes = false;
        attributes.forEach((att) => {
          if (att.name) {
            containes = att.name.name === attr;
          }
        });
        return containes;
      }
      return false;
    }

    function withoutSandbox(node) {
      const { name, attributes } = node;
      if (name.name === 'iframe' && attributes && Array.isArray(attributes)) {
        let containes = false;
        attributes.forEach((att) => {
          containes = att.name.name === 'sandbox';
        });
        return !containes;
      }
      return false;
    }

    return {
      AssignmentExpression(node) {
        const text = sourceCode.getText(node);
        if (hasInnerHtml(text)) {
          context.report({
            node,
            messageId: 'danger',
            data: {
              tips: 'no use \'innerHtml\'',
            },
          });
        }
      },
      JSXOpeningElement(node) {
        if (hasAttribute(node, 'div', 'dangerouslySetInnerHTML')) {
          context.report({
            node,
            messageId: 'danger',
            data: {
              tips: 'no use attribute \'dangerouslySetInnerHTML\'',
            },
          });
        } else if (withoutSandbox(node)) {
          context.report({
            node,
            messageId: 'danger',
            data: {
              tips: 'must use \'sandbox\' attribute in \'iframe\'',
            },
          });
        }
      },
      CallExpression(node) {
        const { callee } = node;
        const callText = sourceCode.getText(callee);
        if (callText.endsWith('postMessage') && node.arguments && Array.isArray(node.arguments)) {
          if (node.arguments.length >= 2 && node.arguments[1].value === '*') {
            // found
            context.report({
              node,
              messageId: 'danger',
              data: {
                tips: 'origin parameter can not empty',
              },
            });
          }
        }
      },
    };
  },
};