$ npm install @hint/hint-no-vulnerable-javascript-libraries
no-vulnerable-javascript-libraries
)no-vulnerable-javascript-libraries
checks for known vulnerabilities
within client-side JavaScript libraries and frameworks detected on a
web site.
webhint
uses Snyk’s Vulnerability DB to lookup known
vulnerabilities.
Making sure your website dependencies are free of known vulnerabilities is important in preventing malicious attacks such as cross-site scripting attacks that can be used to compromise web site information.
This hint uses Snyk’s Vulnerability DB and js-library-detector to check if the website is running a vulnerable version of a client-side JavaScript library or framework.
The vulnerability database is updated automatically from Snyk if the cached content is older than 24h.
You can configure the minimum severity to report in the
.hintrc
file:
{
"connector": {...},
"formatters": [...],
"hints": {
"no-vulnerable-javascript-libraries": ["error", {
"severity": "low|medium|high"
}],
...
},
...
}
The severity
possible values are: low
(default), medium
,
and high
.
If you configure this hint to high
, and webhint
only finds
low
or medium
vulnerabilities, no issues will be raised.
This package is installed automatically by webhint:
npm install hint --save-dev
To use it, activate it via the .hintrc
configuration file:
{
"connector": {...},
"formatters": [...],
"hints": {
"no-vulnerable-javascript-libraries": "error",
...
},
"parsers": [...],
...
}
Note: The recommended way of running webhint is as a devDependency
of
your project.
© 2010 - cnpmjs.org x YWFE | Home | YWFE