csp-html-linter

library1.0.13jsnpmunverified

A tool to lint HTML files for potential Content Security Policy (CSP) violations, targeting inline styles, inline JavaScript, style tags without nonce, and script tags without nonce. Current stable version is 1.0.13. It is designed to be used as a build step to catch violations early. Differentiators: simple CLI and programmatic API, zero dependencies, returns violations as array or detailed objects with location info. Offers a narrow but focused set of checks, suitable for integration into CI pipelines.

testing auth-security devops

npm install csp-html-linter

github ↗package ↗

INSTALL

IMPORT

SIG · CSP-HTML-LINTER

csp-html-linter

testingjavascriptv1.0.13

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

cspHtmlLinter

✓ const cspHtmlLinter = require('csp-html-linter');

✗ import cspHtmlLinter from 'csp-html-linter';

Package exposes a CommonJS module. ES module imports are not supported; only require() works. TypeScript types are shipped but usage requires @types/node or similar.

parse

✓ cspHtmlLinter.parse(code, options);

✗ cspHtmlLinter.default.parse(code, options);

The main export is an object with a parse method. No default export. Always use require() and call parse directly on the required object.

csp-html-linter CLI

✓ csp-html-linter --include "src/**/*.html" --verbose

✗ npx csp-html-linter src/**/*.html

The CLI requires the --include argument as a glob string. It does not accept file paths directly. Use --include with quotes around the glob.

Shows programmatic usage with parse() and options, including location info.

// Install: npm install csp-html-linter --save-dev const cspHtmlLinter = require('csp-html-linter'); const htmlCode = ` <div style="color:red;">Text</div> <script>alert('xss')</script> <a href="javascript:void(0)">click</a> `; const violations = cspHtmlLinter.parse(htmlCode, { includeLocationInfo: true }); console.log('Violations:', violations); // Example output: // Violations: [ // { message: 'Inline styles are not allowed', location: { startLine: 2, startCol: 5, ... } }, // { message: 'Script tags without nonce are not allowed', location: { startLine: 3, startCol: 1, ... } }, // { message: 'Inline JavaScript is not allowed', location: { startLine: 4, startCol: 9, ... } } // ]

csp-html-linter --version

Debug

Known issues

gotchaESM imports are not supported; only CommonJS require() works. Using import will result in a runtime error.

fix

Use const cspHtmlLinter = require('csp-html-linter'); or use dynamic import() if your environment supports it.

affects: >=1.0.0

gotchaCLI requires --include argument with a glob string; passing a file path directly does nothing.

fix

Always use --include with a glob, e.g., --include "src/**/*.html".

affects: >=1.0.0

gotchaThe parse() method returns an array of strings by default, but when includeLocationInfo is true, it returns an array of objects with message and location. Mixing these return types can break downstream code expecting strings.

fix

Check the options.includeLocationInfo value or use a type guard to handle both cases.

affects: >=1.0.0

gotchaAll options default to false; if you intend to allow something, you must explicitly set it to true. This can lead to unexpected violations if options are omitted.

fix

Always explicitly set all options you care about to avoid false positives.

affects: >=1.0.0

Errors

Common errors & fixes

TypeError: cspHtmlLinter.parse is not a function

Using default import with ESM syntax instead of require().

fix

Change import to require: const cspHtmlLinter = require('csp-html-linter');

Mismatched quotes or missing glob pattern

CLI --include argument is missing or not properly quoted.

fix

Use --include with double quotes around the glob, e.g., --include "src/**/*.html"

TypeError: Cannot read property 'message' of undefined

Assuming includeLocationInfo returns object with message property without checking if location info is enabled.

fix

When includeLocationInfo is false, each violation is a string, not an object. Check your options or handle both types.

Upgrade

Version history

1.0.13latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

16 hits · last 30 days

node

Amazon

OpenAI (training)

Resources

githubhttps://github.com/mdownes/csp-html-linter ↗

packagehttps://www.npmjs.com/package/csp-html-linter ↗