Enable the eslint-plugin-no-unsanitized ESLint plugin to disallow unsafe usage of e.g. innerHTML
#10925
Conversation
…nsafe usage of e.g. `innerHTML` See https://github.com/mozilla/eslint-plugin-no-unsanitized Since we've generally never allowed e.g. `innerHTML`, which is enforced during review, there's only one linting failure with this patch. (Which is white-listed, according to the existing comment and the fact that it's test-only code.)
Snuffleupagus
force-pushed
the
eslint_no-unsanitized
branch
from
89f308e
to
5bb5e77
Compare
|
/botio lint |
From: Bot.io (Windows)ReceivedCommand cmd_lint from @Snuffleupagus received. Current queue size: 0 Live output at: http://54.215.176.217:8877/1d8d2ec703f53fe/output.txt |
From: Bot.io (Linux m4)ReceivedCommand cmd_lint from @Snuffleupagus received. Current queue size: 0 Live output at: http://54.67.70.0:8877/794fd1e231ce517/output.txt |
From: Bot.io (Linux m4)SuccessFull output at http://54.67.70.0:8877/794fd1e231ce517/output.txt Total script time: 0.99 mins
|
From: Bot.io (Windows)SuccessFull output at http://54.215.176.217:8877/1d8d2ec703f53fe/output.txt Total script time: 2.83 mins
|
|
The four lines that failed the Travis CI build before are of the form It looks like something we should report upstream, but it would be even better if we could find a way to write those four lines differently. They are certainly confusing to me and apparently also to the plugin... Edit: Apparently it is used to give the correct |
There was a problem hiding this comment.
I have been thinking about this some more and I don't yet see an easy fix for the operator list file. Let's merge this because I do see advantages from the additional linting for all files except for one; removing the ignore in the operator list file can always be done at a later time. Thanks!
See https://github.com/mozilla/eslint-plugin-no-unsanitized
Since we've generally never allowed e.g.
innerHTML, which is enforced during review, there's only one linting failure with this patch. (Which is white-listed, according to the existing comment and the fact that it's test-only code.)