
Product
Secure Your AI-Generated Code with Socket MCP
Socket MCP brings real-time security checks to AI-generated code, helping developers catch risky dependencies before they enter the codebase.
Find potential XSS vulnerabilities in your jquery spaghetti beautiful
code, e.g.
$('h2').html("Hello <i>" + unsafeVar + "</i>")
By default, xsslint evaluates any jQuery function/method calls that accept
html content ($
, .html
, .append
, etc.) as well as any string
concatenation with html-y literals, but it can be easily customized to
suit your needs.
npm install xsslint
xsslint's API is simple; it accepts a filename and returns an array of warning objects for that file. To lint your whole codebase, you'll want a little bit of glue code like so:
var glob = require("glob");
var XSSLint = require("xsslint");
var files = glob.sync("path/to/files/**/*.js");
files.forEach(function(file) {
var warnings = XSSLint.run(file);
warnings.forEach(function(warning) {
console.error(file + ":" + warning.line + ": possibly XSS-able `" + warning.method + "` call");
});
});
This will print out a bunch of warnings like:
foo.js:123: possibly XSS-able `html()` call
Given a list of warnings, you'll want to evaluate each one, and then:
If it's an actual problem, fix it.
If it's a false positive, flag it as such, e.g.
Set your own global XSSLint.configure
to match your conventions.
For example, if you prefix jQuery object variables with a $
, and
you have an html-escaping function called htmlEscape
, you'd want:
XSSLint.configure({
"jqueryObject.identifier": [/^\$/],
"safeString.function": ["htmlEscape"]
});
Set your own file-specific config overrides via comment, e.g.
// xsslint jqueryObject.property jQ
// xsslint safeString.property /Html$/
See the default configuration to get an idea what kinds of things can be set, or check out this real world usage.
Running xsslint on canvas-lms with some custom configuration uncovered 8 cross-site scripting vulnerabilities. It also identified dozens of potentially problematic areas.
Copyright (c) 2015 Jon Jensen, released under the MIT license
FAQs
Find potential XSS vulnerabilities
The npm package xsslint receives a total of 345 weekly downloads. As such, xsslint popularity was classified as not popular.
We found that xsslint demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Product
Socket MCP brings real-time security checks to AI-generated code, helping developers catch risky dependencies before they enter the codebase.
Security News
As vulnerability data bottlenecks grow, the federal government is formally investigating NIST’s handling of the National Vulnerability Database.
Research
Security News
Socket’s Threat Research Team has uncovered 60 npm packages using post-install scripts to silently exfiltrate hostnames, IP addresses, DNS servers, and user directories to a Discord-controlled endpoint.