ESLint plugin that disallows unsafe innerHTML, outerHTML, and similar DOM manipulation methods without proper sanitization.
eslint-plugin-no-unsanitized is a custom ESLint rule plugin that detects and prevents unsafe DOM manipulation methods like innerHTML, outerHTML, and insertAdjacentHTML without proper sanitization. It helps developers avoid cross-site scripting (XSS) vulnerabilities by enforcing secure coding practices through static analysis. The plugin supports predefined sanitization functions and the HTML Sanitizer API to ensure safe variable interpolation in template strings.
JavaScript developers, especially those working on web applications where DOM manipulation is common, and security teams looking to enforce XSS prevention through automated linting.
Developers choose this plugin because it provides a proactive, automated way to catch XSS vulnerabilities early in the development cycle, integrates seamlessly with ESLint workflows, and is backed by Mozilla's security expertise for reliable enforcement of sanitization best practices.
Custom ESLint rule to disallows unsafe innerHTML, outerHTML, insertAdjacentHTML and alike
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Backed by Mozilla's experience in web security, ensuring reliable and battle-tested enforcement against XSS vulnerabilities in production code.
Provides specific rules like 'method' and 'property' to disallow unsafe calls such as insertAdjacentHTML and assignments to innerHTML, as detailed in the rule documentation.
Supports the HTML Sanitizer API and allows .setHTML() calls by default, aligning with up-to-date web standards for secure DOM updates.
Requires escaping functions to be called with template strings, ensuring safe variable interpolation in dynamic content to prevent XSS, as emphasized in the examples.
Only recognizes hardcoded function names like escapeHTML and Sanitizer.escapeHTML, making it inflexible for projects using custom or third-party sanitization libraries.
Primarily targets vanilla JavaScript DOM APIs, so it may not effectively catch vulnerabilities in framework-specific patterns like React's dangerouslySetInnerHTML or Vue templates.
The README references external docs without detailed examples, which can hinder configuration and troubleshooting for complex use cases.