spectral:oas warn on by default

no-eval-in-markdown

Markdown descriptions must not have "eval(".

Applies to
descriptiontitle
Selects
$..[description,title]
Function
pattern
Specs
OpenAPI 2.0OpenAPI 3.0OpenAPI 3.1OpenAPI 3.2

Use it

This rule ships with OpenLint in spectral:oas. Extending the ruleset turns it on:

extends: spectral:oas
rules:
  no-eval-in-markdown: warn   # or off, or another severity

Definition

As defined in @openlint/openlint-rulesets. Functions show by name.

no-eval-in-markdown:
  description: Markdown descriptions must not have "eval(".
  recommended: true
  given: '$..[description,title]'
  then:
    function: pattern
    functionOptions:
      notMatch: eval\(

About this rule

This rule protects against an edge case, for anyone bringing in description documents from third parties and using the parsed content rendered in HTML/JS. If one of those third parties does something shady like injecting eval() JavaScript statements, it could lead to an XSS attack.

Bad Example

openapi: "3.0.2"
info:
  title: 'some title with eval(',

Sources