fix: Respect src attribute

SAP · Apr 10, 2024 · f53aacd · f53aacd
1 parent 759efff
commit f53aacd
Show file tree

Hide file tree

Showing 9 changed files with 40 additions and 5 deletions.
diff --git a/src/linter/html/linter.ts b/src/linter/html/linter.ts
@@ -13,8 +13,12 @@ export async function lintHtml(resourceName: string, contentStream: ReadStream):
 
 	jsScriptTags.forEach((tag) => {
 		const scriptContent = tag.textNodes?.map((tNode) => tNode.value).join("").trim();
+		// Tags with src attribute do not parse and run inline code
+		const hasSrc = tag.attributes.some((attr) => {
+			return attr.name.value.toLowerCase() === "src";
+		});
 
-		if (scriptContent) {
+		if (!hasSrc && scriptContent) {
 			report.addMessage({
 				node: tag,
 				severity: LintMessageSeverity.Warning,

diff --git a/test/fixtures/linter/rules/CSPCompliance/NoInlineJS.html b/test/fixtures/linter/rules/CSPCompliance/NoInlineJS.html
@@ -43,6 +43,14 @@
 		});
 		sap.ui.xmlview({ viewContent: jQuery('#myXml').html() }).placeAt("content");
 	</script>
+
+	<script type="module">
+		import { log } from "utils";
+
+		log("Exporting dog names.");
+
+		export const names = ["Kayla", "Bentley", "Gilligan"];
+	</script>
 </body>
 
 </html>
diff --git a/test/fixtures/linter/rules/CSPCompliance/NoInlineJS_negative.html b/test/fixtures/linter/rules/CSPCompliance/NoInlineJS_negative.html
@@ -16,16 +16,30 @@
 		</mvc:View>
 	</script>
 
-	<script type="module">
+	<script src="">
+		sap.ui.controller("my.own.controller", {
+			doSomething: function () {
+				alert("Hello World!");
+			}
+		});
+	</script>
+
+	<script src>
+		console.log("this code won't run");
+	</script>
+
+	<script type="" src="./path/to/js.js">
+		 // should not be reported as it is not a CSP violation
+	</script>
+
+	<script type="module" src>
 		import { log } from "utils";
 
 		log("Exporting dog names.");
 
 		export const names = ["Kayla", "Bentley", "Gilligan"];
 	</script>
 
-	<script type="" src="./path/to/js.js"></script>
-
 	<script src="./another/path/to/js.js"></script>
 </body>
 

diff --git a/test/lib/detectors/transpilers/xml/snapshots/transpiler.ts.snap b/test/lib/detectors/transpilers/xml/snapshots/transpiler.ts.snap
diff --git a/test/lib/linter/rules/snapshots/CSPCompliance.ts.md b/test/lib/linter/rules/snapshots/CSPCompliance.ts.md
@@ -51,8 +51,17 @@ Generated by [AVA](https://avajs.dev).
             ruleId: 'ui5-linter-csp-unsafe-inline-script',
             severity: 1,
           },
+          {
+            column: 2,
+            fatal: undefined,
+            line: 47,
+            message: 'Use of unsafe inline script',
+            messageDetails: 'Content Security Policy (https://ui5.sap.com/1.120/#/topic/fe1a6dba940e479fb7c3bc753f92b28c)',
+            ruleId: 'ui5-linter-csp-unsafe-inline-script',
+            severity: 1,
+          },
         ],
-        warningCount: 4,
+        warningCount: 5,
       },
     ]
 

diff --git a/test/lib/linter/rules/snapshots/CSPCompliance.ts.snap b/test/lib/linter/rules/snapshots/CSPCompliance.ts.snap
diff --git a/test/lib/linter/rules/snapshots/NoDeprecatedApi.ts.snap b/test/lib/linter/rules/snapshots/NoDeprecatedApi.ts.snap
diff --git a/test/lib/linter/rules/snapshots/NoGlobals.ts.snap b/test/lib/linter/rules/snapshots/NoGlobals.ts.snap
diff --git a/test/lib/linter/snapshots/linter.ts.snap b/test/lib/linter/snapshots/linter.ts.snap