Skip to content

Switch to per-line eslint rule for v-html

Dheeraj Joshi requested to merge djadmin-v-html-line-based into master

Context

We have been using eslint rule to avoid v-html, as you know v-html can lead to XSS issues.

For existing v-html usages, we turned off eslint rule per-file instead of per-line to avoid adding noise in the templates and code quality reasons discussed at !39800 (merged).

We have had around 210 v-html usages in 129 files, which now have been reduced to 90 usages in 68 files. See &4273 (closed).

What does this MR do?

This MR moves the eslint-disable rules from per-file to per-line to balance security and code quality together. This is due to the fact that with per-file exception, especially with longer files, v-html might slip through easier, which may introduce XSS vulnerabilities. This MR tries to improve the line of defense for that by adding

  • eslint-disable-next-line rule for single line elements
  • eslint-disable/enable eslint-disable-line rule for multi-line elements or inline elements (to avoid extra whitespaces)

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

Does this MR contain changes to processing or storing of credentials or tokens, authorization and authentication methods or other items described in the security review guidelines? If not, then delete this Security section.

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team
Edited by Dheeraj Joshi

Merge request reports