introduce eslint for DOM XSS linting

[mozfreddyb]

For this to be immediately useful, one needs to:

• fix existing violations (below) Remove use of innerHtml #621
• in package.json, add "script" to run eslint on all relevant source files
• integrate script into CI

Existing violations:

zap-hud/src/main/zapHomeFiles/hud/display.js
  1116:5  error  Unsafe assignment to innerHTML  no-unsanitized/property
zap-hud/src/main/zapHomeFiles/hud/libraries/alertify.js
  1:2257  error  Unsafe assignment to innerHTML  no-unsanitized/property
  1:2897  error  Unsafe assignment to innerHTML  no-unsanitized/property
zap-hud/src/main/zapHomeFiles/hud/target/inject.js
  454:3  error  Unsafe assignment to innerHTML  no-unsanitized/property

[thc202]

Can't this be configured through xo?

[psiinon]

For info have just raised #621 re removing the use of innerHtml

[mozfreddyb]

xo seems to use eslint underneath, so theoretically yes. I haven't ever used or looked at xo before though.

[thc202]

OK, xo is already running by default (locally and CI) and (I think) it includes all relevant source files, so it would just need the plugin(s).

[mozfreddyb]

OK. Waiting for #621 then :-)

[psiinon]

Can we whitelist the remaining 2 uses of innerHtml so that we can merge this PR?
If so we should add them to #608 so they dont get forgotten.
I think we should ignore everything under zap-hud/src/main/zapHomeFiles/hud/libraries/ as they are external libs.

[mozfreddyb]

imho it'd be easier to add DOMPurify than to whitelist. Especially since those whitelists are often forgotten and might introduce vulnerabilities long-term (as we've seen with others whitelisting existing and secure uses of innerHTML)

[psiinon]

Fine for display.js but I dont want to apply DOMPurify to the alertify.js library - no idea what impact that could have.

[mozfreddyb]

it seems alertify.js is already opted out of the linter. probably because it's minified?

[psiinon]

And because its an external lib :)

[kingthorin]

Thanks @mozfreddyb