Overview

⭐ If this plugin caught a real bug for you, star the repo — it's the signal that keeps these rules maintained.

Description

This plugin provides Browser-specific security rules to prevent XSS and other client-side attacks.

Philosophy

Interlace fosters strength through integration. Instead of stacking isolated rules, we interlace security directly into your workflow to create a resilient fabric of code. We believe tools should guide rather than gatekeep, providing educational feedback that strengthens the developer with every interaction.

Getting Started

• To check out the guide, visit eslint.interlace.tools. 📚
• 要查看中文 指南, 请访问 eslint.interlace.tools. 📚
• 가이드 문서는 eslint.interlace.tools에서 확인하실 수 있습니다. 📚
• ガイドは eslint.interlace.toolsでご確認ください。 📚
• Para ver la guía, visita eslint.interlace.tools. 📚
• للاطلاع على الدليل، قم بزيارة eslint.interlace.tools. 📚

npm install eslint-plugin-browser-security --save-dev

⚙️ Configuration Presets

🤖 LLM-Optimized Messages

All rules include structured remediation guidance designed for AI assistants:

[browser-security/no-innerhtml] XSS vulnerability: Direct HTML assignment detected.

📋 CONTEXT:
  • Pattern: element.innerHTML = unsanitizedInput
  • Risk: Any script in unsanitizedInput will execute

🛠️ REMEDIATION:
  Option A (Preferred): Use textContent for plain text
    element.textContent = userInput;

  Option B: Sanitize before insertion
    element.innerHTML = DOMPurify.sanitize(userInput);

📚 References:
  • CWE-79: https://cwe.mitre.org/data/definitions/79.html
  • OWASP XSS Prevention: https://owasp.org/...

By providing this structured context (CWE, OWASP, Fix), we enable AI tools to reason about the security flaw rather than hallucinating. This allows Copilot/Cursor to suggest the exact correct fix immediately.

💡 What You Get

• 21 security rules targeting browser-specific vulnerabilities
• XSS prevention via DOM manipulation and dynamic content detection
• Storage security preventing sensitive data exposure in localStorage/sessionStorage/IndexedDB
• Cross-origin protection with postMessage origin validation
• LLM-optimized messages with CWE references and auto-fix suggestions
• OWASP Top 10 coverage for browser security patterns

🎯 Why This Plugin?

Modern browser applications face unique security challenges across storage APIs, cross-origin communication, and dynamic content rendering. This plugin provides static analysis rules specifically designed for browser security patterns:

• XSS Prevention: Detects dangerous DOM manipulation patterns
• Storage Security: Prevents sensitive data exposure in localStorage/sessionStorage/IndexedDB
• Cross-Origin Protection: Validates postMessage origin checks
• Cookie Security: Identifies insecure cookie handling in JavaScript
• LLM-Optimized: All rules include AI-friendly remediation guidance

🔍 Detection Examples

❌ Vulnerable Code

// XSS via innerHTML
element.innerHTML = userInput;

// Code injection via eval
eval(dynamicCode);

// JWT in localStorage (XSS can steal it)
localStorage.setItem('token', jwt);

// postMessage without origin check
window.addEventListener('message', (event) => {
  processData(event.data); // Anyone can send messages!
});

✅ Secure Code

// Safe text assignment
element.textContent = userInput;

// Or sanitize before HTML insertion
element.innerHTML = DOMPurify.sanitize(userInput);

// Use HttpOnly cookies for auth tokens (set by server)
// Server: Set-Cookie: token=xxx; HttpOnly; Secure; SameSite=Strict

// Origin validation
window.addEventListener('message', (event) => {
  if (event.origin !== 'https://trusted-domain.com') return;
  processData(event.data);
});

📦 Compatibility

See the ESLint Version Support Policy — current ecosystem share data, the 20% gate, and the forward-looking exception that covers v10.

Rules

Legend

🔗 Related ESLint Plugins

Part of the Interlace ESLint Ecosystem — AI-native security plugins with LLM-optimized error messages:

Plugin	Downloads	Description
eslint-plugin-secure-coding		General security rules & OWASP guidelines.
eslint-plugin-pg		PostgreSQL security & best practices.
eslint-plugin-node-security		Node.js core-module security (fs, child_process, vm, crypto, Buffer).
eslint-plugin-jwt		JWT security & best practices.
eslint-plugin-browser-security		Browser-specific security & XSS prevention.
eslint-plugin-express-security		Express.js security hardening rules.
eslint-plugin-lambda-security		AWS Lambda security best practices.
eslint-plugin-nestjs-security		NestJS security rules & patterns.
eslint-plugin-mongodb-security		MongoDB security best practices.
eslint-plugin-vercel-ai-security		Vercel AI SDK security hardening.
eslint-plugin-import-next		Next-gen import sorting & architecture.

⭐ Support & follow

If this plugin caught a real bug for you, star the repo — stars are the signal that keeps the Interlace ESLint ecosystem maintained — and follow the writeups on Dev.to for the benchmarks and security research behind these rules.

📄 License

MIT © Ofri Peretz