eslint-plugin-browser-security

v2.1.5

Published

4 days ago

ESLint plugin for browser security — detects DOM XSS, postMessage abuse, tokens in localStorage, insecure cookies, clickjacking, mixed content, and CSP gaps.

⭐ If this plugin caught a real bug for you, star the repo — it's the signal that keeps these rules maintained.

Description

This plugin provides Browser-specific security rules to prevent XSS and other client-side attacks.

Why — a linter nobody reads protects nothing. We would rather miss a finding than spend your attention on one that was never real.
How — evidence, not names. A rule fires on what the code does, resolved through the AST and ESLint's own scope analysis.
What — every finding carries its fix, in prose for a human and as structured JSON for an agent. Security rules add a CWE mapping and, where assigned, a CVSS score.

That trade costs recall, and we measure it: methodology · results · a false positive is a bug.

Getting Started

To check out the guide, visit eslint.interlace.tools. 📚

npm install eslint-plugin-browser-security --save-dev

⚙️ Configuration Presets

🤖 LLM-Optimized Messages

All rules include structured remediation guidance designed for AI assistants:

[browser-security/no-innerhtml] XSS vulnerability: Direct HTML assignment detected.

📋 CONTEXT:
  • Pattern: element.innerHTML = unsanitizedInput
  • Risk: Any script in unsanitizedInput will execute

🛠️ REMEDIATION:
  Option A (Preferred): Use textContent for plain text
    element.textContent = userInput;

  Option B: Sanitize before insertion
    element.innerHTML = DOMPurify.sanitize(userInput);

📚 References:
  • CWE-79: https://cwe.mitre.org/data/definitions/79.html
  • OWASP XSS Prevention: https://owasp.org/...

By providing this structured context (CWE, OWASP, Fix), we enable AI tools to reason about the security flaw rather than hallucinating. This allows Copilot/Cursor to suggest the exact correct fix immediately.

💡 What You Get

21 security rules targeting browser-specific vulnerabilities
XSS prevention via DOM manipulation and dynamic content detection
Storage security preventing sensitive data exposure in localStorage/sessionStorage/IndexedDB
Cross-origin protection with postMessage origin validation
LLM-optimized messages with CWE references and auto-fix suggestions
OWASP Top 10 coverage for browser security patterns

🎯 Why This Plugin?

Modern browser applications face unique security challenges across storage APIs, cross-origin communication, and dynamic content rendering. This plugin provides static analysis rules specifically designed for browser security patterns:

XSS Prevention: Detects dangerous DOM manipulation patterns
Storage Security: Prevents sensitive data exposure in localStorage/sessionStorage/IndexedDB
Cross-Origin Protection: Validates postMessage origin checks
Cookie Security: Identifies insecure cookie handling in JavaScript
LLM-Optimized: All rules include AI-friendly remediation guidance

🔍 Detection Examples

❌ Vulnerable Code

// XSS via innerHTML
element.innerHTML = userInput;

// Code injection via eval
eval(dynamicCode);

// JWT in localStorage (XSS can steal it)
localStorage.setItem('token', jwt);

// postMessage without origin check
window.addEventListener('message', (event) => {
  processData(event.data); // Anyone can send messages!
});

✅ Secure Code

// Safe text assignment
element.textContent = userInput;

// Or sanitize before HTML insertion
element.innerHTML = DOMPurify.sanitize(userInput);

// Use HttpOnly cookies for auth tokens (set by server)
// Server: Set-Cookie: token=xxx; HttpOnly; Secure; SameSite=Strict

// Origin validation
window.addEventListener('message', (event) => {
  if (event.origin !== 'https://trusted-domain.com') return;
  processData(event.data);
});

📦 Compatibility

| Package | Version | | :--- | :--- | | ESLint | ^8.40.0 \|\| ^9.0.0 \|\| ^10.0.0 | | Node.js | >=18.0.0 |

See the ESLint Version Support Policy — current ecosystem share data, the 20% gate, and the forward-looking exception that covers v10.

Rules

Legend

| Icon | Description | | :---: | :--- | | 💼 | Recommended: Included in the recommended preset. | | ⚠️ | Warns: Set to warn in recommended preset. | | 🔧 | Auto-fixable: Automatically fixable by the --fix CLI option. | | 💡 | Suggestions: Providing code suggestions in IDE. | | 🚫 | Deprecated: This rule is deprecated. | | 🟢 | Type-unaware: AST-only, runs in oxlint JS-plugin tier. | | 🟡 | Type-aware (refining): pure-AST primary path; types refine precision. | | 🟠 | Type-aware (graceful): requires TS program; silent without it. |

| Rule | CWE | OWASP | CVSS | Description | 🧠 | 💼 | ⚠️ | 🔧 | 💡 | 🚫 | | :--- | :---: | :---: | :---: | :--- | :---: | :---: | :---: | :---: | :---: | :---: | | detect-mixed-content | CWE-311 | | | Detects HTTP URLs in code that should use HTTPS, preventing mixed content vulnerabilities. | 🟢 | 💼 | | | | | | no-allow-arbitrary-loads | CWE-295 | | | Prevents disabling App Transport Security (ATS) by detecting NSAllowsArbitraryLoads: true in an Expo/React… | 🟢 | 💼 | | | | | | no-clickjacking | CWE-1021 | | | Detects clickjacking vulnerabilities and missing frame protections | 🟢 | | | | | | | no-client-side-auth-logic | | | | Prevent client-side authentication logic that can be bypassed. This rule is part of eslint-plugin-browser-s… | 🟢 | 💼 | | | | | | no-cookie-auth-tokens | CWE-1004 | A02:2021 | | Prevent storing authentication tokens in JavaScript-accessible cookies. | 🟢 | 💼 | | | | | | no-credentials-in-query-params | CWE-598 | | | CWE: CWE-598 | 🟢 | 💼 | | | | | | no-disabled-certificate-validation | CWE-295 | | | CWE: CWE-295 | 🟢 | 💼 | | | | | | no-dynamic-service-worker-url | CWE-829 | A08:2021 | | Prevent dynamic URLs in service worker registration. | 🟢 | 💼 | | | | | | no-eval | CWE-94 | | | Detects dangerous eval() and similar code execution patterns | 🟢 | 💼 | | | | | | no-filereader-innerhtml | CWE-693 | A03:2021 | | The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | 🟢 | 💼 | | | | | | no-http-urls | CWE-319 | | | CWE: CWE-319 | 🟢 | 💼 | | | | | | no-incomplete-url-sanitization | CWE-020 | A01:2021 | | Disallow URL substring tests and partial scheme denylists as security decisions | 🟢 | 💼 | | | | | | no-innerhtml | CWE-79 | | | Detects dangerous innerHTML/outerHTML assignments that can lead to Cross-Site Scripting (XSS) | 🟢 | 💼 | | | | | | no-insecure-redirects | CWE-601 | | | ESLint Rule: no-insecure-redirects | 🟢 | 💼 | | | | | | no-insecure-websocket | CWE-319 | | | CWE: CWE-319 | 🟢 | 💼 | | | | | | no-jwt-in-storage | CWE-311 | A02:2021 | | This rule prevents storing JWT tokens in browser storage (localStorage/sessionStorage) | 🟢 | 💼 | | | | | | no-missing-cors-check | CWE-346 | | | Detects missing CORS validation (wildcard CORS, missing origin check) that can allow unauthorized cross-ori… | 🟢 | | | | | | | no-missing-csrf-protection | CWE-352 | | | Detects missing CSRF token validation in POST/PUT/DELETE requests | 🟢 | | | | | | | no-missing-security-headers | CWE-693 | | | ESLint Rule: no-missing-security-headers | 🟢 | | | | | | | no-password-in-url | CWE-521 | | | This rule detects when URLs contain password-related query parameters or URL fragments | 🟢 | | | | | | | no-permissive-cors | CWE-942 | | | CWE: CWE-942 | 🟢 | | | | | | | no-postmessage-innerhtml | CWE-693 | A03:2021 | | The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | 🟢 | 💼 | | | | | | no-postmessage-wildcard-origin | CWE-693 | A01:2021 | | This rule prevents using \"\" as the targetOrigin parameter in postMessage() calls | 🟢 | 💼 | | | | | | no-sensitive-cookie-js | CWE-359 | A02:2021 | | The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | 🟢 | 💼 | | | | | | no-sensitive-data-in-analytics | CWE-359 | | | This rule detects when sensitive user data (email, SSN, credit card, password, phone, address) is passed to… | 🟢 | | | | | | | no-sensitive-data-in-cache | CWE-200 | | | CWE: CWE-200 | 🟢 | | | | | | | no-sensitive-indexeddb | CWE-922 | A02:2021 | | Prevent storing sensitive data in IndexedDB. | 🟢 | 💼 | | | | | | no-sensitive-localstorage | CWE-922 | | | Detects storage of sensitive data (tokens, passwords, PII) in localStorage | 🟢 | 💼 | | | | | | no-sensitive-sessionstorage | CWE-922 | A02:2021 | | Prevent storing sensitive data in sessionStorage. | 🟢 | 💼 | | | | | | no-tracking-without-consent | CWE-359 | | | CWE: CWE-359 | 🟢 | | | | | | | no-unencrypted-transmission | CWE-319 | | | Detects unencrypted data transmission (HTTP vs HTTPS, plain text protocols) | 🟢 | 💼 | | | | | | no-unescaped-url-parameter | CWE-79 | | | Detects unescaped URL parameters that can lead to Cross-Site Scripting (XSS) or open redirect vulnerabilities | 🟢 | | | | | | | no-unsafe-eval-csp | CWE-95 | A03:2021 | | Disallow 'unsafe-eval' in Content Security Policy directives. | 🟢 | 💼 | | | | | | no-unsafe-inline-csp | CWE-79 | A03:2021 | | Disallow 'unsafe-inline' in Content Security Policy directives. | 🟢 | 💼 | | | | | | no-unvalidated-deeplinks | CWE-939 | | | This rule detects when deep link URLs are opened without validation in React Native or mobile web apps | 🟢 | 💼 | | | | | | no-websocket-eval | CWE-319 | A03:2021 | | The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | 🟢 | 💼 | | | | | | no-websocket-innerhtml | CWE-319 | A03:2021 | | The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance: | 🟢 | 💼 | | | | | | no-worker-message-innerhtml | CWE-79 | A03:2021 | | Disallow using innerHTML with Web Worker message data. | 🟢 | 💼 | | | | | | require-blob-url-revocation | CWE-401 | A04:2021 | | Require revoking Blob URLs after use to prevent memory leaks. | 🟢 | | ⚠️ | | | | | require-cookie-secure-attrs | CWE-614 | A05:2021 | | Require Secure and SameSite attributes on cookies. | 🟢 | 💼 | | | | | | require-csp-headers | CWE-1021 | | | CWE: CWE-1021 | 🟢 | | | | | | | require-https-only | CWE-319 | | | This rule detects HTTP (unencrypted) URLs in fetch() and axios requests | 🟢 | 💼 | | | | | | require-mime-type-validation | CWE-434 | | | CWE: CWE-434 | 🟢 | | | | | | | require-postmessage-origin-check | CWE-346 | | | Detects postMessage event handlers without origin validation | 🟢 | 💼 | | | | | | require-url-validation | CWE-601 | | | CWE: CWE-601 | 🟢 | | | | | | | require-websocket-wss | CWE-319 | A02:2021 | | This rule enforces the use of wss:// (WebSocket Secure) protocol instead of ws:// (unencrypted WebSocket) | 🟢 | 💼 | | | | |

🔗 Related ESLint Plugins

Part of the Interlace ESLint ecosystem — AI-native rules with LLM-optimized error messages:

Security

Code quality

⭐ Support & follow

If this plugin caught a real bug for you, star the repo — stars are the signal that keeps the Interlace ESLint ecosystem maintained — and follow the writeups on Dev.to for the benchmarks and security research behind these rules.