eslint-plugin-sonarjs
Version:
SonarJS rules for ESLint
107 lines (106 loc) • 4.86 kB
JavaScript
;
/*
* SonarQube JavaScript Plugin
* Copyright (C) 2011-2025 SonarSource SA
* mailto:info AT sonarsource DOT com
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
* See the Sonar Source-Available License for more details.
*
* You should have received a copy of the Sonar Source-Available License
* along with this program; if not, see https://sonarsource.com/license/ssal/
*/
// https://sonarsource.github.io/rspec/#/rspec/S5247/javascript
Object.defineProperty(exports, "__esModule", { value: true });
exports.rule = void 0;
const index_js_1 = require("../helpers/index.js");
const meta_js_1 = require("./meta.js");
const MESSAGE = 'Make sure disabling auto-escaping feature is safe here.';
exports.rule = {
meta: (0, index_js_1.generateMeta)(meta_js_1.meta, undefined, true),
create(context) {
const services = context.sourceCode.parserServices;
function isEmptySanitizerFunction(sanitizerFunction) {
if (sanitizerFunction.params.length !== 1) {
return false;
}
const firstParam = sanitizerFunction.params[0];
if (firstParam.type !== 'Identifier') {
return false;
}
const firstParamName = firstParam.name;
if (sanitizerFunction.body.type !== 'BlockStatement') {
return (sanitizerFunction.body.type === 'Identifier' &&
sanitizerFunction.body.name === firstParamName);
}
const { body } = sanitizerFunction.body;
if (body.length !== 1) {
return false;
}
const onlyStatement = body[0];
if (onlyStatement.type === 'ReturnStatement' &&
onlyStatement.argument &&
(0, index_js_1.isIdentifier)(onlyStatement.argument, firstParamName)) {
return true;
}
return false;
}
function isInvalidSanitizerFunction(node) {
let assignedFunction = (0, index_js_1.getValueOfExpression)(context, node, 'FunctionExpression') ??
(0, index_js_1.getValueOfExpression)(context, node, 'ArrowFunctionExpression');
if (!assignedFunction && node.type === 'Identifier' && (0, index_js_1.isRequiredParserServices)(services)) {
assignedFunction = (0, index_js_1.resolveFromFunctionReference)(context, node);
}
if (!!assignedFunction) {
return isEmptySanitizerFunction(assignedFunction);
}
return false;
}
return {
CallExpression: (node) => {
const callExpression = node;
const fqn = (0, index_js_1.getFullyQualifiedName)(context, callExpression);
if (fqn === 'handlebars.compile') {
(0, index_js_1.checkSensitiveCall)(context, callExpression, 1, 'noEscape', true, MESSAGE);
}
if (fqn === 'marked.setOptions') {
(0, index_js_1.checkSensitiveCall)(context, callExpression, 0, 'sanitize', false, MESSAGE);
}
if (fqn === 'markdown-it') {
(0, index_js_1.checkSensitiveCall)(context, callExpression, 0, 'html', true, MESSAGE);
}
},
NewExpression: (node) => {
const newExpression = node;
if ((0, index_js_1.getFullyQualifiedName)(context, newExpression) === 'kramed.Renderer') {
(0, index_js_1.checkSensitiveCall)(context, newExpression, 0, 'sanitize', false, MESSAGE);
}
},
AssignmentExpression: (node) => {
const assignmentExpression = node;
const { left, right } = assignmentExpression;
if (left.type !== 'MemberExpression') {
return;
}
if (!((0, index_js_1.getFullyQualifiedName)(context, left) === 'mustache.escape' ||
(isMustacheIdentifier(left.object) && (0, index_js_1.isIdentifier)(left.property, 'escape')))) {
return;
}
if (isInvalidSanitizerFunction(right)) {
(0, index_js_1.report)(context, {
node: left,
message: MESSAGE,
});
}
},
};
},
};
function isMustacheIdentifier(node) {
return (0, index_js_1.isIdentifier)(node, 'Mustache');
}