feat: enforce browser security boundaries

2026-07-25 21:14:32 +09:00
parent 675603c3a2
commit 6f88915c7a
11 changed files with 163 additions and 1 deletions
@@ -35,6 +35,7 @@ export default [
      "artifacts/**",
      "tests/fixtures/typecheck/**",
      "tests/fixtures/architecture/forbidden/**",
+      "tests/fixtures/security/forbidden/**",
    ],
  },
  eslint.configs.recommended,
@@ -98,4 +99,24 @@ export default [
      ]),
    },
  },
+  {
+    files: ["**/*.{js,jsx}"],
+    rules: {
+      "no-eval": "error",
+      "no-new-func": "error",
+      "no-script-url": "error",
+      "no-restricted-syntax": [
+        "error",
+        {
+          selector: "JSXAttribute[name.name='dangerouslySetInnerHTML']",
+          message: "Raw HTML injection is prohibited by FE-OC-019.",
+        },
+        {
+          selector:
+            "CallExpression[callee.object.name='document'][callee.property.name='createElement'][arguments.0.value='script']",
+          message: "Runtime script construction is prohibited by FE-OC-019.",
+        },
+      ],
+    },
+  },
 ];