Tries to detect XSS issues in codebase before they end up in production.
You'll first need to install ESLint:
$ npm install eslint --save-dev
Next, install eslint-plugin-xss
:
$ npm install eslint-plugin-xss --save-dev
Note: If you installed ESLint globally (using the -g
flag) then you must also install eslint-plugin-xss
globally.
Add xss
to the plugins section of your .eslintrc
configuration file. You can omit the eslint-plugin-
prefix:
{
"plugins": [
"xss"
]
}
Then configure the rules you want to use under the rules section.
{
"rules": {
"xss/rule-name": 2
}
}
Or:
Enable all rules by adding the following to your .eslintrc
configuration file
{
"extends": [
"plugin:xss/recommended"
]
}
- xss/no-mixed-html: Warn about possible XSS issues.
- xss/no-location-href-assign: Warn when trying to modify location.href.