Registry / testing / eslint-plugin-risxss

eslint-plugin-risxss

library2.1.0jsnpmunverified

An ESLint plugin that detects potential XSS vulnerabilities in React (dangerouslySetInnerHTML) and Vue (v-html) applications. Current stable version is 2.1.0, with irregular releases. It enforces the use of a sanitization function (like DOMPurify) on all dynamic HTML content. Compared to generic XSS scanners, RisXSS integrates directly into the linting pipeline, providing instant feedback during development. It supports both React and Vue, and allows configuration of trusted sanitization libraries.

testing

npm install eslint-plugin-risxss

github ↗package ↗

INSTALL

IMPORT

SIG · ESLINT-PLUGIN-RISX

eslint-plugin-risxss

testingjavascriptv2.1.0

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

catch-potential-xss-react

✓ rules: { 'risxss/catch-potential-xss-react': 'error' }

✗ rules: { 'risxss/catch-potential-xss-react': 2 }

Rule is configured via ESLint rules object; severity can be 'error', 'warn', or 2.

catch-potential-xss-vue

✓ rules: { 'risxss/catch-potential-xss-vue': ['error', { trustedLibraries: ['xss'] }] }

✗ rules: { 'risxss/catch-potential-xss-vue': 'error' } without options when needed

Options object with trustedLibraries array is optional.

Demonstrates installing the plugin, configuring the React XSS rule, and a component that triggers the lint error with the fix using DOMPurify.sanitize.

// Install plugin yarn add eslint-plugin-risxss --dev // .eslintrc.js module.exports = { env: { browser: true, es6: true }, extends: 'eslint:recommended', parserOptions: { ecmaFeatures: { jsx: true }, ecmaVersion: 2018, sourceType: 'module' }, plugins: ['react', 'risxss'], rules: { 'risxss/catch-potential-xss-react': 'error' } }; // Component with potential XSS import React from 'react'; import DOMPurify from 'dompurify'; const MyComponent = ({ html }) => { // This will trigger the rule because DOMPurify is not used return <div dangerouslySetInnerHTML={{ __html: html }} />; }; // To fix, sanitize the input: const SafeComponent = ({ html }) => { return <div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(html) }} />; };

Debug

Known issues

breakingv2.0.0 removed the old `trustedCalls` option; use `trustedLibraries` instead.

fix

Replace any usage of `trustedCalls` option with `trustedLibraries` array of function names.

affects: >=2.0.0

deprecatedDefault trusted library is assumed to be `DOMPurify.sanitize`. If you do not use DOMPurify, you must specify your own trusted library via the `trustedLibraries` option.

fix

Add `trustedLibraries: ['yourSanitizer']` to the rule options.

affects: all

gotchaThe plugin only lints static code; dynamic or indirect calls to `dangerouslySetInnerHTML` may not be caught.

fix

Define any dynamic HTML generation in a function that uses a trusted sanitizer and is called with known arguments.

affects: all

gotchaThe plugin does not check the content of the HTML passed to `dangerouslySetInnerHTML`; it only ensures a sanitization function is used in the same expression.

fix

Always wrap the HTML in a call to a trusted sanitizer like `DOMPurify.sanitize`.

affects: all

gotchaFor Vue projects, the rule only applies to `v-html`; it does not cover other potential XSS vectors like `:innerHTML` or dynamic component rendering.

fix

Consider using additional linting rules or manual reviews for other XSS vectors.

affects: all

Errors

Common errors & fixes

Definition for rule 'risxss/catch-potential-xss-react' was not found.

The plugin is not installed or not added to the plugins array in ESLint configuration.

fix

Run `yarn add eslint-plugin-risxss --dev` and add `'risxss'` to the `plugins` array in your ESLint config.

ESLint couldn't find the plugin "eslint-plugin-risxss".

The plugin is not installed in the project's node_modules.

fix

Install the plugin: `npm install eslint-plugin-risxss --save-dev` or `yarn add eslint-plugin-risxss --dev`.

Argument to HTML string interpolation must be sanitized.

Detected use of `dangerouslySetInnerHTML` or `v-html` without a call to a trusted sanitization function.

fix

Wrap the value in `DOMPurify.sanitize()` or a custom function listed in `trustedLibraries`.

Upgrade

Version history

2.1.0latest on npm

Audit

Dependencies

eslintrequiredpeer dependency required for plugin consumption

Agent activity

4 hits · last 30 days

node

Resources

githubhttps://github.com/theodo/RisXSS ↗

packagehttps://www.npmjs.com/package/eslint-plugin-risxss ↗