Fix issues with xss linters
Improve accuracy of javascript-escape linter: Previously this would match on FOOescape() and FOO.escape calls, but neither are the global escape function we are worried about. The regex probably isn't 100% accurate; there may be still false positives (javascript allows a large range of characters in identifiers, some of which may not be covered by [\w.$]). The main thing is to avoid false negatives here though - this will definitely catch any use of `escape()` or `window.escape()`. Also remove javascript-interpolate lint - this was deemed unecessary. StringUtils.interpolate is not in fact safe (it does no html escaping), so the results of this lint are misleading.
This commit is contained in:
@@ -52,7 +52,7 @@
|
||||
|
||||
_.each(this.model.get('membership'), function(membership) {
|
||||
// eslint-disable-next-line no-undef
|
||||
dateJoined = interpolate( // xss-lint: disable=javascript-interpolate
|
||||
dateJoined = interpolate(
|
||||
/* Translators: 'date' is a placeholder for a fuzzy,
|
||||
* relative timestamp (see: https://github.com/rmm5t/jquery-timeago)
|
||||
*/
|
||||
@@ -62,7 +62,7 @@
|
||||
);
|
||||
|
||||
// eslint-disable-next-line no-undef
|
||||
lastActivity = interpolate( // xss-lint: disable=javascript-interpolate
|
||||
lastActivity = interpolate(
|
||||
/* Translators: 'date' is a placeholder for a fuzzy,
|
||||
* relative timestamp (see: https://github.com/rmm5t/jquery-timeago)
|
||||
*/
|
||||
|
||||
Reference in New Issue
Block a user