lint errors blocking did some research but not successful

Question

I am new to tslint and typescript.
I am trying to fix this error.
can you tell me how to fix it.
i did some research but not able to find solutions.
providing code below.

(no-inner-html) app/components/sports.ts[717, 9]: Using the html() function to write a string to innerHTML is insecure: $('.tubing').html(health.title)

if (health.title == "waterS") {
      let that = this;
      let recordPlayersWeight = {};
      this.futureParrot = [];
      this.pastParrot = [];
      this.peacockService.getResponse(health.url, 'get', null)
        .subscribe(recordPlayersWeight => {
            this.gridData = recordPlayersWeight.waterDtos;
            that._recordPlayersWeightSource.recordPlayersWeight(this.gridData);
          },
          err => {
          }
        );
    }

    that.window = $("#TigerwatersPopup");
    that.window.kendoWindow({
      width: "60%",
      title: false,
      visible: false,
      resizable: false,
      actions: [],
      draggable: false,
      modal: true,
      open: function() {
        $("html, body").css("overflow", "hidden");
        that.isVisible = true;
        $('.tubing').html(health.title);

see https://stackoverflow.com/questions/26990899/is-it-really-insecure-to-build-html-strings-in-javascript — Damon, Sep 22 '17 at 02:49

score 0 · Accepted Answer · answered Sep 21 '17 at 22:56

0

When you use jQuery's .html() function, it's possible to accidentally add "unsafe" elements to your page, for example iframe tags or source tags. If the html you add was submitted by a malicious user (e.g. as part of a query or data entered in a form), you're giving them a way to attack you. It's a form of code injection attack (see https://en.wikipedia.org/wiki/Code_injection).

In your case it looks like you're just trying to put plain text into the .tubing element, so it's safer to do

$('.tubing').text( health.title );

What this does is it "escapes" any HTML special characters like < or > so that they appear as text rather than being treated as elements. This is safe and prevents code injection by an attacker, and will not trigger the lint rule.

answered Sep 21 '17 at 22:56

Duncan Thacker

5,073
1
10
20

thanks for your reply...I am getting another error can you tell me how to fix it Property 'waterService' cannot be declared in the constructor – Sep 22 '17 at 00:13
That's not in the code you posted, so I can't help. Maybe ask another question. The error you get should give you a hint as to the file and line that's causing the problem. – Duncan Thacker Sep 22 '17 at 00:18
hey its happening at this line constructor(public waterService: WATERService) can you help me – Sep 22 '17 at 00:46

lint errors blocking did some research but not successful

1 Answers1