Skip to content

Latest commit

 

History

History
62 lines (53 loc) · 1.9 KB

no-append-html.md

File metadata and controls

62 lines (53 loc) · 1.9 KB

no-append-html

Disallows using .append/.prepend/.before/.after/.replaceWith/.add/.appendTo/.prependTo/.insertBefore/.insertAfter to inject HTML, in order to prevent possible XSS bugs.

Rule details

❌ Examples of incorrect code:

$div.append( '<xss>' );
$div.append( 'unescaped html' );
$div.prepend( '<xss>' );
$div.before( '<xss>' );
$div.after( '<xss>' );
$div.replaceWith( '<xss>' );
$els.add( '<xss>' );
$els.appendTo( '<xss>' );
$els.prependTo( '<xss>' );
$div.append( code + '<xss>' );
$div.append( test ? $el : '<xss>' );
$div.append( $el, '<xss>' );
$div.append( this.$el.someProp );
$div.append( userInput );
$div.append( getSomething() );

✔️ Examples of correct code:

$div.append( $el );
$div.prepend( $el );
$div.before( $el );
$div.after( $el );
$div.replaceWith( $el );
$div.add( $el );
$div.appendTo( $el );
$div.prependTo( $el );
$div.append( this.$el );
$div.append( this.foo.$el );
$div.append( $el1, $el2 );
$div.append( $el1, ' ', $el2 );
$div.append( $el1, ' \n\t ', $el2 );
$div.append( $el.parent() );
$div.append( test ? $el1 : $el2 );
$div.append( test ? $el1 : null );
$div.append( test ? $el1 : undefined );
$div.append( test ? $el1 : '' );

$el = getSomething();
$div.append( $el );

$div.add( '.foo' );
$div.appendTo( '.foo' );
$div.prependTo( '.foo' );
$div.insertBefore( '.foo' );
$div.insertAfter( '.foo' );

Resources