Switch to per-line eslint rule for v-html
Context
We have been using eslint rule to avoid v-html
, as you know v-html
can lead to XSS issues.
For existing v-html
usages, we turned off eslint rule per-file instead of per-line to avoid adding noise in the templates and code quality reasons discussed at !39800 (merged).
We have had around 210 v-html
usages in 129 files, which now have been reduced to 90 usages in 68 files. See &4273 (closed).
What does this MR do?
This MR moves the eslint-disable
rules from per-file to per-line to balance security and code quality together. This is due to the fact that with per-file exception, especially with longer files, v-html
might slip through easier, which may introduce XSS vulnerabilities. This MR tries to improve the line of defense for that by adding
-
eslint-disable-next-line
rule for single line elements -
eslint-disable/enable
eslint-disable-line
rule for multi-line elements or inline elements (to avoid extra whitespaces)
Does this MR meet the acceptance criteria?
Conformity
-
I have included a changelog entry, or it's not needed. (Does this MR need a changelog?) -
I have added/updated documentation, or it's not needed. (Is documentation required?) -
I have properly separated EE content from FOSS, or this MR is FOSS only. (Where should EE code go?) -
I have added information for database reviewers in the MR description, or it's not needed. (Does this MR have database related changes?) -
I have self-reviewed this MR per code review guidelines. -
This MR does not harm performance, or I have asked a reviewer to help assess the performance impact. (Merge request performance guidelines) -
I have followed the style guides. -
This change is backwards compatible across updates, or this does not apply.
Availability and Testing
-
I have added/updated tests following the Testing Guide, or it's not needed. (Consider all test levels. See the Test Planning Process.) -
I have tested this MR in all supported browsers, or it's not needed. -
I have informed the Infrastructure department of a default or new setting change per definition of done, or it's not needed.
Security
Does this MR contain changes to processing or storing of credentials or tokens, authorization and authentication methods or other items described in the security review guidelines? If not, then delete this Security section.
-
Label as security and @ mention @gitlab-com/gl-security/appsec
-
The MR includes necessary changes to maintain consistency between UI, API, email, or other methods -
Security reports checked/validated by a reviewer from the AppSec team