sindresorhus/eslint-plugin-unicorn
Rule proposal: `.replace` or `.replaceAll` with non-literal replacement
Geschlossen
#2.309 geöffnet am 05.04.2024
help wantednew rule
Repository-Metriken
- Stars
- (5.022 Sterne)
- PR-Merge-Metriken
- (Durchschn. Merge 1T 16h) (399 gemergte PRs in 30 T)
Beschreibung
Description
One might think that a function like this generates safe HTML because the argument is HTML-escaped.
function imageLink(url) {
const IMAGE_TEMPLATE = '<img src="{url}">';
return IMAGE_TEMPLATE.replace('{url}', htmlEscape(url));
}
But in fact there’s a very obscure cross-site scripting vulnerability here, abusing the $` replacement sequence interpreted by String.prototype.replace and .replaceAll!
imageLink("$` onerror=alert(1) ")
//=> '<img src="<img src=" onerror=alert(1) ">'
To protect against this mistake, it would be nice to have an ESLint rule that forbids use of .replace and .replaceAll where the second argument isn’t a string literal or a function.
Fail
IMAGE_TEMPLATE.replace('{url}', htmlEscape(url))
Pass
IMAGE_TEMPLATE.replace('{url}', () => htmlEscape(url))
IMAGE_TEMPLATE.replace('{url}', "https://example.com")
Additional Info
No response