no-disabled-template-escaping

CWE: CWE-79 OWASP: A03:2021 — Injection

Auto-escaping is the XSS defence of a template engine, and escapeMarkup = false turns it off for every template at once. This rule is part of eslint-plugin-secure-coding, and is the drop-in for eslint-plugin-security's detect-disable-mustache-escape.

Quick SummaryCopy Anchor Link

Vulnerability and RiskCopy Anchor Link

Vulnerability: With escapeMarkup on, a template engine turns <script> in a value into the text <script>. With it false, every interpolated value is written into the page as HTML.

Risk: One user-controlled value in any template rendered by that engine becomes stored or reflected cross-site scripting. The setting is made once, usually in setup code, so no review of an individual template ever sees it.

Rule DetailsCopy Anchor Link

Reports an assignment of the literal false to a property named escapeMarkup, in any spelling of the property:

• view.escapeMarkup = false
• view['escapeMarkup'] = false
• view[`escapeMarkup`] = false

It does not report:

• a bare variable named escapeMarkup — it is not an option on anything;
• escapeMarkup = true, or any value other than the literal false (the string 'false' is truthy);
• view[escapeMarkup] = false where escapeMarkup is a variable — which property that writes is decided at runtime;
• a comparison such as view.escapeMarkup === false.

ExamplesCopy Anchor Link

❌ IncorrectCopy Anchor Link

a.escapeMarkup = false;
view['escapeMarkup'] = false;
this.options.escapeMarkup = false;

✅ CorrectCopy Anchor Link

// Leave auto-escaping on.
view.escapeMarkup = true;

// Render the one trusted, sanitized fragment through the engine's raw-output
// syntax (for example a triple mustache) instead of disabling escaping globally.

OptionsCopy Anchor Link

This rule has no options.

Error Message FormatCopy Anchor Link

🔒 CWE-79 OWASP:A05-Injection CVSS:6.1 | escapeMarkup is set to false, so the template engine renders every interpolated value as raw HTML. One user-controlled value in any template is then a cross-site scripting vulnerability. | MEDIUM [SOC2,PCI-DSS,GDPR,ISO27001]
   Fix: Remove the assignment and keep auto-escaping on. Render trusted HTML through the template engine's explicit raw-output syntax at the one site that needs it, after sanitizing it. | https://cwe.mitre.org/data/definitions/79.html

Known False NegativesCopy Anchor Link

The option set in an object literalCopy Anchor Link

Why: The rule reports the assignment form x.escapeMarkup = false, as eslint-plugin-security does. new Engine({ escapeMarkup: false }) is not an assignment.

Mitigation: Keep engine configuration in one reviewed module.

A falsy value other than falseCopy Anchor Link

Why: x.escapeMarkup = 0, = null or = !1 disables escaping in an engine that tests the option for truthiness, but whether a given engine does is not visible in the AST.

Mitigation: Write the option as a boolean.

The key held in a variableCopy Anchor Link

Why: const k = 'escapeMarkup'; x[k] = false names the property only at runtime.

Mitigation: Accepted; the rule does not do data-flow.

Further ReadingCopy Anchor Link

• CWE-79 — Improper Neutralization of Input During Web Page Generation
• OWASP XSS Prevention Cheat Sheet

Related RulesCopy Anchor Link

• no-template-injection — user input used as the template itself

Use this rule

npm install -D oxlint-plugin-secure-coding

{  "jsPlugins": ["oxlint-plugin-secure-coding"],  "rules": {    "secure-coding/no-disabled-template-escaping": "error"  }}

import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-secure-coding'],    rules: {      'secure-coding/no-disabled-template-escaping': 'error',    },  },});