[d565449] | 1 | /**
|
---|
| 2 | * @fileoverview Prevent usage of dangerous JSX props
|
---|
| 3 | * @author Scott Andrews
|
---|
| 4 | */
|
---|
| 5 |
|
---|
| 6 | 'use strict';
|
---|
| 7 |
|
---|
| 8 | const has = require('hasown');
|
---|
| 9 | const fromEntries = require('object.fromentries/polyfill')();
|
---|
| 10 | const minimatch = require('minimatch');
|
---|
| 11 |
|
---|
| 12 | const docsUrl = require('../util/docsUrl');
|
---|
| 13 | const jsxUtil = require('../util/jsx');
|
---|
| 14 | const report = require('../util/report');
|
---|
| 15 |
|
---|
| 16 | // ------------------------------------------------------------------------------
|
---|
| 17 | // Constants
|
---|
| 18 | // ------------------------------------------------------------------------------
|
---|
| 19 |
|
---|
| 20 | const DANGEROUS_PROPERTY_NAMES = [
|
---|
| 21 | 'dangerouslySetInnerHTML',
|
---|
| 22 | ];
|
---|
| 23 |
|
---|
| 24 | const DANGEROUS_PROPERTIES = fromEntries(DANGEROUS_PROPERTY_NAMES.map((prop) => [prop, prop]));
|
---|
| 25 |
|
---|
| 26 | // ------------------------------------------------------------------------------
|
---|
| 27 | // Helpers
|
---|
| 28 | // ------------------------------------------------------------------------------
|
---|
| 29 |
|
---|
| 30 | /**
|
---|
| 31 | * Checks if a JSX attribute is dangerous.
|
---|
| 32 | * @param {String} name - Name of the attribute to check.
|
---|
| 33 | * @returns {boolean} Whether or not the attribute is dangerous.
|
---|
| 34 | */
|
---|
| 35 | function isDangerous(name) {
|
---|
| 36 | return has(DANGEROUS_PROPERTIES, name);
|
---|
| 37 | }
|
---|
| 38 |
|
---|
| 39 | // ------------------------------------------------------------------------------
|
---|
| 40 | // Rule Definition
|
---|
| 41 | // ------------------------------------------------------------------------------
|
---|
| 42 |
|
---|
| 43 | const messages = {
|
---|
| 44 | dangerousProp: 'Dangerous property \'{{name}}\' found',
|
---|
| 45 | };
|
---|
| 46 |
|
---|
| 47 | /** @type {import('eslint').Rule.RuleModule} */
|
---|
| 48 | module.exports = {
|
---|
| 49 | meta: {
|
---|
| 50 | docs: {
|
---|
| 51 | description: 'Disallow usage of dangerous JSX properties',
|
---|
| 52 | category: 'Best Practices',
|
---|
| 53 | recommended: false,
|
---|
| 54 | url: docsUrl('no-danger'),
|
---|
| 55 | },
|
---|
| 56 |
|
---|
| 57 | messages,
|
---|
| 58 |
|
---|
| 59 | schema: [{
|
---|
| 60 | type: 'object',
|
---|
| 61 | properties: {
|
---|
| 62 | customComponentNames: {
|
---|
| 63 | items: {
|
---|
| 64 | type: 'string',
|
---|
| 65 | },
|
---|
| 66 | minItems: 0,
|
---|
| 67 | type: 'array',
|
---|
| 68 | uniqueItems: true,
|
---|
| 69 | },
|
---|
| 70 | },
|
---|
| 71 | }],
|
---|
| 72 | },
|
---|
| 73 |
|
---|
| 74 | create(context) {
|
---|
| 75 | const configuration = context.options[0] || {};
|
---|
| 76 | const customComponentNames = configuration.customComponentNames || [];
|
---|
| 77 |
|
---|
| 78 | return {
|
---|
| 79 | JSXAttribute(node) {
|
---|
| 80 | const functionName = node.parent.name.name;
|
---|
| 81 |
|
---|
| 82 | const enableCheckingCustomComponent = customComponentNames.some((name) => minimatch(functionName, name));
|
---|
| 83 |
|
---|
| 84 | if ((enableCheckingCustomComponent || jsxUtil.isDOMComponent(node.parent)) && isDangerous(node.name.name)) {
|
---|
| 85 | report(context, messages.dangerousProp, 'dangerousProp', {
|
---|
| 86 | node,
|
---|
| 87 | data: {
|
---|
| 88 | name: node.name.name,
|
---|
| 89 | },
|
---|
| 90 | });
|
---|
| 91 | }
|
---|
| 92 | },
|
---|
| 93 | };
|
---|
| 94 | },
|
---|
| 95 | };
|
---|