npmpackage.info

Gathering detailed insights and metrics for eslint-plugin-risxss

Other packages similar to eslint-plugin-risxss

eslint-plugin-risxss-flat

2.2.0

Various XSS-hunter ESLint rules

Gathering detailed insights and metrics for eslint-plugin-risxss

eslint-plugin-risxss - 2.1.0 | npmpackage.info

eslint-plugin-risxss

RisXSS

2.1.0

127

MIT

JavaScript

24.04 kB

3.5

Installations

npm install eslint-plugin-risxss

Developer Guide

BETA

Typescript

No

Module System

N/A

Min. Node Version

>=6

Node Version

14.16.0

NPM Version

6.14.11 Pull Requests

Open

7

Total

44

Closed

6

Merged

31

Issues

Open

2

Total

3

Closed

1

Releases

2.1.0

v2.1.0

Updated on Mar 22, 2021

2.0.0

v2.0.0

Updated on Feb 09, 2021

1.3.0

v1.3.0

Updated on Jan 14, 2021

1.2.0

v1.2.0

Updated on Jan 12, 2021

View All 4 releases

Languages

JavaScript

JavaScript (100%)

Developer

theodo

Download Statistics

Total Downloads

Last Day

Last Week

Last Month

Last Year

GitHub Statistics

MIT License

127 Stars

133 Commits

3 Forks

17 Watchers

14 Branches

11 Contributors

Updated on May 20, 2025

Maintainers

View All 11 Contributors

Package Meta Information

Latest Version

2.1.0

Package Id

eslint-plugin-risxss@2.1.0

Unpacked Size

24.04 kB

Size

5.46 kB

File Count

NPM Version

6.14.11

Node Version

14.16.0

Total Downloads

Cumulative downloads

Total Downloads

NaN

Last Day

NaN

Compared to previous day

Last Week

NaN

Compared to previous week

Last Month

NaN

Compared to previous month

Last Year

NaN

Compared to previous year

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

import-modules lodash.clonedeep lodash.get lodash.union

Dev Dependencies

@babel/core @babel/eslint-parser @babel/plugin-proposal-class-properties @babel/plugin-proposal-decorators ava eslint eslint-ava-rule-tester eslint-plugin-eslint-plugin esm nyc vue-eslint-parser xo

🛡RisXSS

Eradicate all XSS flaws of your React or Vue application using a single ESLint rule.

Example

How to install RisXSS ?

First, use your favorite package manager to add eslint-plugin-risxss in your devDependencies, for example with yarn :

yarn add eslint-plugin-risxss --dev

Then, you just have to add the tailored rule for your projet (React or Vue) :
- risxss/catch-potential-xss-react for React project
- risxss/catch-potential-xss-vue for Vue project

To do so, add these lines in your eslint config, for instance if you use .eslintrc.js config file :

If your project uses React/Javascript :

1module.exports = {
2    env: {
3        browser: true,
4        es6: true
5    },
6    extends: 'eslint:recommended',
7    parserOptions: {
8        ecmaFeatures: {
9            jsx: true
10        },
11        ecmaVersion: 2018,
12        sourceType: 'module'
13    },
14    plugins: ['react', 'risxss'],      //  <<< add risxss in plugins
15    rules: {
16        'risxss/catch-potential-xss-react': 'error'  //  <<< add this in rules
17    }
18};

If your project uses React/TypeScript :

1module.exports = {
2    env: {
3        browser: true,
4        es6: true
5    },
6    parser: '@typescript-eslint/parser',
7    extends: 'eslint:recommended',
8    parserOptions: {
9        project: './tsconfig.json',
10        ecmaFeatures: {
11            jsx: true
12        },
13        ecmaVersion: 2018,
14        sourceType: 'module'
15    },
16    plugins: ['risxss'],   //  <<< add risxss in plugins
17    rules: {
18        'risxss/catch-potential-xss-react': 'error'   //  <<< add this in rules
19    }
20};

If your project uses Vue.js

1module.exports = {
2    env: {
3        browser: true
4    },
5    extends: ['plugin:vue/essential'],
6    parserOptions: {
7        parser: 'babel-eslint'
8    },
9    plugins: ['vue', 'risxss'],   //  <<< add risxss in plugins
10    rules: {
11        'risxss/catch-potential-xss-vue': 'error'   //  <<< add this in rules
12    }
13};

Rules

catch-potential-xss-react - Enforce the use of dompurify when using dangerouslySetInnerHtml
catch-potential-xss-vue - Enforce the use of dompurify when using v-html

Configuring the rules

Sometimes you have your own rules to prevent XSS and you don't use DOMPurify.sanitize on your inputs. You can add your own function name to the RisXSS whitelist by passing them as options.

:warning: We still recommend using DOMPurify to sanitize your inputs :warning:

1module.exports = {
2    env: {
3        browser: true
4    },
5    extends: ['plugin:vue/essential'],
6    parserOptions: {
7        parser: 'babel-eslint'
8    },
9    plugins: ['vue', 'risxss'],   //  <<< add risxss in plugins
10    rules: {
11        'risxss/catch-potential-xss-vue': ['error', {
12            trustedLibraries: ['xss'] //  <<< define your anti XSS function here.
13        }]
14    }
15};

1// in your file
2import { sanitize } from 'xss';
3
4export const DesktopPostCard = ({ post }) => (
5  <div dangerouslySetInnerHTML={{ __html: sanitize(post.content) }} />
6);

License

MIT

No vulnerabilities found.

10

Security-Policy

Determines if the project has published a security policy.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

License

Determines if the project has defined a license.

3

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

2

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

0

Maintained

Determines if the project is "actively maintained".

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Fuzzing

Determines if the project uses fuzzing.

0

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

0

SAST

Determines if the project uses static code analysis.

0

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

Score

3.5

/10

Last Scanned on 2025-07-07

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More