no-v-html.js 914 B

123456789101112131415161718192021222324252627282930313233
  1. /**
  2. * @fileoverview Restrict or warn use of v-html to prevent XSS attack
  3. * @author Nathan Zeplowitz
  4. */
  5. 'use strict'
  6. const utils = require('../utils')
  7. // ------------------------------------------------------------------------------
  8. // Rule Definitionutilu
  9. // ------------------------------------------------------------------------------
  10. module.exports = {
  11. meta: {
  12. docs: {
  13. description: 'disallow use of v-html to prevent XSS attack',
  14. category: undefined,
  15. url: 'https://github.com/vuejs/eslint-plugin-vue/blob/v4.7.1/docs/rules/no-v-html.md'
  16. },
  17. fixable: null,
  18. schema: []
  19. },
  20. create (context) {
  21. return utils.defineTemplateBodyVisitor(context, {
  22. "VAttribute[directive=true][key.name='html']" (node) {
  23. context.report({
  24. node,
  25. loc: node.loc,
  26. message: "'v-html' directive can lead to XSS attack."
  27. })
  28. }
  29. })
  30. }
  31. }