Skip to content

Commit 6cc4edb

Browse files
fix semgrep
1 parent fdb231b commit 6cc4edb

File tree

4 files changed

+25
-40
lines changed

4 files changed

+25
-40
lines changed

.coderabbit.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
reviews:
2-
path_filters: ["**/*.yml","**/*.yaml"]
2+
path_filters: ["**/*","*"]

example.py

Lines changed: 0 additions & 32 deletions
This file was deleted.

sampleReact.jsx

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
function TestComponent() {
2+
// ruleid:react-dangerouslysetinnerhtml
3+
return <div dangerouslySetInnerHTML={createMarkup()} />;
4+
}
5+
6+
function OkComponent() {
7+
// OK
8+
const discordClientKey = '8dyfuiRyq=vVc3RRr_edRk-fK__JItpZ';
9+
return {__html: 'Первый &middot; Второй'};
10+
}
11+

semgrep.yml

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,14 @@
11
rules:
2-
- id: hardcoded-password
3-
pattern: password = "$SECRET"
4-
message: "Avoid hardcoded passwords"
5-
severity: ERROR
6-
languages: [python]
7-
metadata:
8-
category: security
2+
- id: docs-react-dangerouslysetinnerhtml
3+
languages:
4+
- typescript
5+
- javascript
6+
message: >
7+
Setting HTML from code is risky because it’s easy to inadvertently expose
8+
your users to a cross-site scripting (XSS) attack.
9+
pattern-either:
10+
- pattern: |
11+
<$X dangerouslySetInnerHTML=... />
12+
- pattern: |
13+
{dangerouslySetInnerHTML: ...}
14+
severity: WARNING

0 commit comments

Comments
 (0)