Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow the any type to bind to security sensitive properties #276

Merged
merged 4 commits into from
Sep 15, 2022
Merged

Allow the any type to bind to security sensitive properties #276

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a30c2a1
Remove a `.only` call in the 'security-system' rule tests.
bicknellr Sep 14, 2022
1d5eed5
Remove incorrect `</script>` closing tags.
bicknellr Sep 14, 2022
283267d
Allow the `any` type to bind to security sensitive properties
bicknellr Sep 14, 2022
684db57
Fix `const` redeclarations in tests.
bicknellr Sep 15, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions packages/lit-analyzer/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 4 additions & 0 deletions packages/lit-analyzer/src/lib/rules/util/type/is-assignable-binding-under-security-system.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,10 @@ function checkClosureSecurityAssignability(typeB: SimpleType, htmlAttr: HtmlNode
if (overriddenTypes === undefined) {
return undefined;
}
// `any` is allowed to bind to anything.
if (typeB.kind === "ANY") {
return undefined;
}
// Directives are responsible for their own security.
if (isLitDirective(typeB)) {
return undefined;
Expand Down
94 changes: 70 additions & 24 deletions packages/lit-analyzer/src/test/rules/security-system.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,8 @@ const preface = `
const trustedResourceUrl = new TrustedResourceUrl();
const safeUrl = new SafeUrl();
const safeStyle = new SafeStyle();

const anyValue: any = {};
`;

tsTest("May bind string to script src with default config", t => {
Expand Down Expand Up @@ -39,7 +41,7 @@ tsTest(testName, t => {
});

testName = "May not pass a TrustedResourceUrl to script .src with default config";
tsTest.only(testName, t => {
tsTest(testName, t => {
const { diagnostics } = getDiagnostics(preface + "html`<script .src=${trustedResourceUrl}></script>`");
hasDiagnostic(t, diagnostics, "no-incompatible-type-binding");
});
Expand Down Expand Up @@ -68,36 +70,68 @@ tsTest(testName, t => {
hasDiagnostic(t, diagnostics, "no-incompatible-type-binding");
});

testName = "May pass either a SafeUrl or a TrustedResourceUrl or a string to img src with ClosureSafeTypes config";
testName = "May pass `any` to script src with ClosureSafeTypes config";
tsTest(testName, t => {
const { diagnostics } = getDiagnostics(preface + "html`<img src=${safeUrl}></script>`", { securitySystem: "ClosureSafeTypes" });
const { diagnostics } = getDiagnostics(preface + "html`<script src=${anyValue}></script>`", { securitySystem: "ClosureSafeTypes" });
hasNoDiagnostics(t, diagnostics);

const { diagnostics: moreDiagnostics } = getDiagnostics(preface + "html`<img src=${trustedResourceUrl}></script>`", {
securitySystem: "ClosureSafeTypes"
});
hasNoDiagnostics(t, moreDiagnostics);

const { diagnostics: evenMoreDiagnostics } = getDiagnostics(preface + "html`<img src=${'/img.webp'}></script>`", {
securitySystem: "ClosureSafeTypes"
});
hasNoDiagnostics(t, evenMoreDiagnostics);
});

testName = "May pass either a SafeUrl or a TrustedResourceUrl or a string to img .src with ClosureSafeTypes config";
testName = "May pass `any` to script .src with ClosureSafeTypes config";
tsTest(testName, t => {
const { diagnostics } = getDiagnostics(preface + "html`<img .src=${safeUrl}></script>`", { securitySystem: "ClosureSafeTypes" });
const { diagnostics } = getDiagnostics(preface + "html`<script .src=${anyValue}></script>`", { securitySystem: "ClosureSafeTypes" });
hasNoDiagnostics(t, diagnostics);
});

const { diagnostics: moreDiagnostics } = getDiagnostics(preface + "html`<img .src=${trustedResourceUrl}></script>`", {
securitySystem: "ClosureSafeTypes"
});
hasNoDiagnostics(t, moreDiagnostics);

const { diagnostics: evenMoreDiagnostics } = getDiagnostics(preface + "html`<img .src=${'/img.webp'}></script>`", {
securitySystem: "ClosureSafeTypes"
});
hasNoDiagnostics(t, evenMoreDiagnostics);
testName = "May pass either a SafeUrl, a TrustedResourceUrl, a string, or `any` to img src with ClosureSafeTypes config";
tsTest(testName, t => {
hasNoDiagnostics(t, getDiagnostics(preface + "html`<img src=${safeUrl}>`", { securitySystem: "ClosureSafeTypes" }).diagnostics);

hasNoDiagnostics(
t,
getDiagnostics(preface + "html`<img src=${trustedResourceUrl}>`", {
securitySystem: "ClosureSafeTypes"
}).diagnostics
);

hasNoDiagnostics(
t,
getDiagnostics(preface + "html`<img src=${'/img.webp'}>`", {
securitySystem: "ClosureSafeTypes"
}).diagnostics
);

hasNoDiagnostics(
t,
getDiagnostics(preface + "html`<img src=${anyValue}>`", {
securitySystem: "ClosureSafeTypes"
}).diagnostics
);
});

testName = "May pass either a SafeUrl, a TrustedResourceUrl, a string, or `any` to img .src with ClosureSafeTypes config";
tsTest(testName, t => {
hasNoDiagnostics(t, getDiagnostics(preface + "html`<img .src=${safeUrl}>`", { securitySystem: "ClosureSafeTypes" }).diagnostics);

hasNoDiagnostics(
t,
getDiagnostics(preface + "html`<img .src=${trustedResourceUrl}>`", {
securitySystem: "ClosureSafeTypes"
}).diagnostics
);

hasNoDiagnostics(
t,
getDiagnostics(preface + "html`<img .src=${'/img.webp'}>`", {
securitySystem: "ClosureSafeTypes"
}).diagnostics
);

hasNoDiagnostics(
t,
getDiagnostics(preface + "html`<img .src=${anyValue}>`", {
securitySystem: "ClosureSafeTypes"
}).diagnostics
);
});

testName = "May pass a string to style with ClosureSafeTypes config";
Expand All @@ -123,3 +157,15 @@ tsTest(testName, t => {
const { diagnostics } = getDiagnostics(preface + "html`<div .style=${safeStyle}></div>`", { securitySystem: "ClosureSafeTypes" });
hasNoDiagnostics(t, diagnostics);
});

testName = "May pass a `any` to style with ClosureSafeTypes config";
tsTest(testName, t => {
const { diagnostics } = getDiagnostics(preface + "html`<div style=${anyValue}></div>`", { securitySystem: "ClosureSafeTypes" });
hasNoDiagnostics(t, diagnostics);
});

testName = "May pass a `any` to .style with ClosureSafeTypes config";
tsTest(testName, t => {
const { diagnostics } = getDiagnostics(preface + "html`<div .style=${anyValue}></div>`", { securitySystem: "ClosureSafeTypes" });
hasNoDiagnostics(t, diagnostics);
});
6 changes: 3 additions & 3 deletions packages/vscode-lit-plugin/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.