From 2b28e5fdeae125aca1cf839a253f28244767d5a7 Mon Sep 17 00:00:00 2001 From: Yavor Ivanov Date: Fri, 12 Apr 2024 13:07:00 +0300 Subject: [PATCH] fix: Respect src attribute for script tags and include module type for checks (#70) This change addresses the following comments: https://github.com/SAP/ui5-linter/pull/48#discussion_r1556875268 --- src/detectors/transpilers/html/parser.ts | 1 + src/linter/html/linter.ts | 7 ++++-- .../rules/CSPCompliance/NoInlineJS.html | 12 +++++++++++ .../CSPCompliance/NoInlineJS_negative.html | 18 +++++++++++++++- .../xml/snapshots/transpiler.ts.snap | Bin 5305 -> 5366 bytes .../rules/snapshots/CSPCompliance.ts.md | 20 +++++++++++++++++- .../rules/snapshots/CSPCompliance.ts.snap | Bin 748 -> 847 bytes .../rules/snapshots/NoDeprecatedApi.ts.snap | Bin 6292 -> 6697 bytes .../linter/rules/snapshots/NoGlobals.ts.snap | Bin 1505 -> 1596 bytes test/lib/linter/snapshots/linter.ts.snap | Bin 7662 -> 8091 bytes 10 files changed, 54 insertions(+), 4 deletions(-) diff --git a/src/detectors/transpilers/html/parser.ts b/src/detectors/transpilers/html/parser.ts index b63211bb2..0646ce6ca 100644 --- a/src/detectors/transpilers/html/parser.ts +++ b/src/detectors/transpilers/html/parser.ts @@ -61,6 +61,7 @@ export async function extractJSScriptTags(contentStream: ReadStream) { return attr.name.value !== "type" || (attr.name.value === "type" && ["", + "module", "text/javascript", "application/javascript", /* legacy */ ].includes(attr.value.value.toLowerCase())); diff --git a/src/linter/html/linter.ts b/src/linter/html/linter.ts index 6dd781aea..c402c301c 100644 --- a/src/linter/html/linter.ts +++ b/src/linter/html/linter.ts @@ -12,9 +12,12 @@ export async function lintHtml(resourceName: string, contentStream: ReadStream): const jsScriptTags = await extractJSScriptTags(contentStream); jsScriptTags.forEach((tag) => { - const scriptContent = tag.textNodes?.map((tNode) => tNode.value).join("").trim(); + // Tags with src attribute do not parse and run inline code + const hasSrc = tag.attributes.some((attr) => { + return attr.name.value.toLowerCase() === "src"; + }); - if (scriptContent) { + if (!hasSrc && tag.textNodes?.length > 0) { report.addMessage({ node: tag, severity: LintMessageSeverity.Warning, diff --git a/test/fixtures/linter/rules/CSPCompliance/NoInlineJS.html b/test/fixtures/linter/rules/CSPCompliance/NoInlineJS.html index 234152a16..5f76f49ff 100644 --- a/test/fixtures/linter/rules/CSPCompliance/NoInlineJS.html +++ b/test/fixtures/linter/rules/CSPCompliance/NoInlineJS.html @@ -43,6 +43,18 @@ }); sap.ui.xmlview({ viewContent: jQuery('#myXml').html() }).placeAt("content"); + + + + diff --git a/test/fixtures/linter/rules/CSPCompliance/NoInlineJS_negative.html b/test/fixtures/linter/rules/CSPCompliance/NoInlineJS_negative.html index 2433e0f52..fb6763c38 100644 --- a/test/fixtures/linter/rules/CSPCompliance/NoInlineJS_negative.html +++ b/test/fixtures/linter/rules/CSPCompliance/NoInlineJS_negative.html @@ -16,7 +16,23 @@ - + + + + + +