🚀 Big News: Socket Acquires Coana to Bring Reachability Analysis to Every Appsec Team.Learn more →
Socket
Sign inDemoInstall
Socket
Sign inDemoInstall

eslint-plugin-no-wildcard-postmessage

Package Overview
Dependencies
Maintainers
1
Versions
4
Alerts
File Explorer

Advanced tools

License
Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

eslint-plugin-no-wildcard-postmessage - npm Package Compare versions

Comparing version

0.1.3
to
0.2.0

docs/rules/no-wildcard-postmessage.md

1

index.js

@@ -1,2 +0,1 @@

/* global module, require */
module.exports = {

@@ -3,0 +2,0 @@ rules: {

63

lib/rules/no-wildcard-postmessage.js

@@ -1,5 +0,6 @@

/* global module */
"use strict";
/**
* @fileoverview Rule to flag wildcard targets in postMessage
* @author Frederik Braun
* @author eslint-plugin-no-wildcard-postmessage contributors
* @copyright 2015 Mozilla Corporation. All rights reserved.

@@ -12,30 +13,42 @@ */

module.exports = function (context) {
"use strict";
return {
CallExpression: function (node) {
// postMessage and somewindow.postMessage
var funcName;
if (node.callee.name) {
funcName = node.callee.name;
} else if (node.callee.property && node.callee.property.name) {
funcName = node.callee.property.name;
} else {
// anonymous function
return;
}
if (funcName === "postMessage") {
if (node.arguments.length > 1) {
if ((node.arguments[1].type === "Literal") &&
(node.arguments[1].value === "*")) {
context.report(node, "Using postMessage() with" +
" wildcard targets is not allowed.");
}
module.exports = {
meta: {
docs: {
description: "Flag Wildcard Targets in `postmessage`",
recommended: true
},
fixable: null,
schema: [
// fill in your rschema
]
},
create(context) {
//----------------------------------------------------------------------
// Public
//----------------------------------------------------------------------
return {
CallExpression(node) {
// postMessage and somewindow.postMessage
let funcName;
if (node.callee.name) {
funcName = node.callee.name;
} else if (node.callee.property && node.callee.property.name) {
funcName = node.callee.property.name;
} else {
// anonymous function
return;
}
if (funcName === "postMessage") {
const [, originNode] = node.arguments;
if (originNode && originNode.type === "Literal" && originNode.value === "*") {
context.report(node, "Using postMessage() with wildcard targets is not allowed.");
}
}
}
}
};
};
}
};

21

package.json
{
"name": "eslint-plugin-no-wildcard-postmessage",
"description": "custom ESLint rule to disallows calling postMessage to wildcard targets",
"version": "0.1.3",
"author": {
"name": "Frederik Braun"
},
"version": "0.2.0",
"author": "eslint-plugin-no-wildcard-postmessage contributors",
"bugs": {

@@ -12,7 +10,7 @@ "url": "https://github.com/mozfreddyb/eslint-plugin-no-wildcard-postmessage/issues"

"devDependencies": {
"mocha": "^2.2.4"
"eslint": "^6.8.0",
"eslint-plugin-node": "^11.1.0",
"mocha": "^3.2.0"
},
"dependencies": {
"eslint": "^1.4.1"
},
"dependencies": {},
"homepage": "https://github.com/mozfreddyb/eslint-plugin-no-wildcard-postmessage/",

@@ -32,6 +30,9 @@ "keywords": [

},
"scripts":{
"test": "mocha tests/rules/",
"scripts": {
"test": "./node_modules/.bin/mocha tests/rules/",
"lint": "node_modules/.bin/eslint index.js lib/**/*.js tests/**/*.js"
},
"engines": {
"node": ">= 10"
}
}

44

tests/rules/no-wildcard-postmessage.js

@@ -1,5 +0,4 @@

/* global require */
/**
* @fileoverview Test for no-wildcard-postmessage.js rule
* @author Frederik Braun
* @author eslint-plugin-no-wildcard-postmessage contributors
* @copyright 2015 Mozilla Corporation. All rights reserved

@@ -12,4 +11,4 @@ */

var rule = require("../../lib/rules/no-wildcard-postmessage.js");
var RuleTester = require("eslint").RuleTester;
const rule = require("../../lib/rules/no-wildcard-postmessage.js");
const { RuleTester } = require("eslint");

@@ -20,27 +19,10 @@ //------------------------------------------------------------------------------

var eslintTester = new RuleTester();
const eslintTester = new RuleTester();
var features = { templateStrings: true, spread: true };
eslintTester.run("no-wildcard-postmessage", rule, {
valid: [
{
code: "postMessage(obj);",
ecmaFeatures: features
},
{
code: "frame.postMessage(obj, 'http://domain.tld');",
ecmaFeatures: features
},
{
code: "frame.postMessage(obj, 'http://domain.tld');",
ecmaFeatures: features
},
{ // iife
code: "(function() {})()",
ecmaFeatures: features
}
"postMessage(obj);",
"frame.postMessage(obj, 'http://domain.tld');",
"frame.postMessage(obj, 'http://domain.tld');",
"(function() {})()",
],

@@ -56,13 +38,4 @@

}],
ecmaFeatures: features
},
{
code: "postMessage(obj, '*');",
errors: [{
message: "Using postMessage() with wildcard targets is not allowed.",
type: "CallExpression"
}],
ecmaFeatures: features
},
{
code: "win.postMessage(obj, '*');",

@@ -73,5 +46,4 @@ errors: [{

}],
ecmaFeatures: features
}
]
});
.npmignore
.eslintrc

Sorry, the diff of this file is not supported yet

.travis.yml

Sorry, the diff of this file is not supported yet