spectral:arazzo warn on by default

arazzo-no-script-tags-in-markdown

Markdown descriptions must not have "<script>" tags.

Applies to
descriptiontitle
Selects
$..[description,title]
Function
pattern
Specs
Arazzo 1.0

Use it

This rule ships with OpenLint in spectral:arazzo. Extending the ruleset turns it on:

extends: spectral:arazzo
rules:
  arazzo-no-script-tags-in-markdown: warn   # or off, or another severity

Definition

As defined in @openlint/openlint-rulesets. Functions show by name.

arazzo-no-script-tags-in-markdown:
  description: Markdown descriptions must not have "<script>" tags.
  given: '$..[description,title]'
  then:
    function: pattern
    functionOptions:
      notMatch: <script

About this rule

This rule protects against a potential hack, for anyone bringing in Arazzo documents from third parties and then generating HTML documentation. If one of those third parties does something shady like injecting <script> tags, they could easily execute arbitrary code on your domain, which if it’s the same as your main application could be all sorts of terrible.

Bad Example

arazzo: "1.0.0"
info:
  title: 'some title with <script>alert("You are Hacked");</script>',

Sources