no-script-url.js
1.71 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
/**
* @fileoverview Rule to flag when using javascript: urls
* @author Ilya Volodin
*/
/* eslint no-script-url: 0 -- Code is checking to report such URLs */
"use strict";
const astUtils = require("./utils/ast-utils");
//------------------------------------------------------------------------------
// Rule Definition
//------------------------------------------------------------------------------
/** @type {import('../shared/types').Rule} */
module.exports = {
meta: {
type: "suggestion",
docs: {
description: "Disallow `javascript:` urls",
recommended: false,
url: "https://eslint.org/docs/rules/no-script-url"
},
schema: [],
messages: {
unexpectedScriptURL: "Script URL is a form of eval."
}
},
create(context) {
/**
* Check whether a node's static value starts with "javascript:" or not.
* And report an error for unexpected script URL.
* @param {ASTNode} node node to check
* @returns {void}
*/
function check(node) {
const value = astUtils.getStaticStringValue(node);
if (typeof value === "string" && value.toLowerCase().indexOf("javascript:") === 0) {
context.report({ node, messageId: "unexpectedScriptURL" });
}
}
return {
Literal(node) {
if (node.value && typeof node.value === "string") {
check(node);
}
},
TemplateLiteral(node) {
if (!(node.parent && node.parent.type === "TaggedTemplateExpression")) {
check(node);
}
}
};
}
};