This site uses cookies for analytics. By continuing to browse this site, you agree to this use.
A JS Foundation Project

No vulnerable libraries

No vulnerable libraries (@sonarwhal/rule-no-vulnerable-javascript-libraries)

no-vulnerable-javascript-libraries checks for known vulnerabilities within client-side JavaScript libraries and frameworks detected on a web site.

sonarwhal uses Snyk’s Vulnerability DB to lookup known vulnerabilities.

Why is this important?

Making sure your website dependencies are free of known vulnerabilities is important in preventing malicious attacks such as cross-site scripting attacks that can be used to compromise web site information.

What does the rule check?

This rules uses Snyk’s Vulnerability DB and js-library-detector to check if the website is running a vulnerable version of a client-side JavaScript library or framework.

The vulnerability database is updated automatically from Snyk if the cached content is older than 24h.

Can the rule be configured?

You can configure the minimum severity to report in the .sonarwhalrc file:

{
"connector": {...},
"formatters": [...],
"rules": {
"no-vulnerable-javascript-libraries": ["error", {
"severity": "low|medium|high"
}],
...
},
...
}

The severity possible values are: low (default), medium, and high.

If you configure this rule to high, and sonarwhal only finds low or medium vulnerabilities, no issues will be raised.

How to use this rule?

To use it you will have to install it via npm:

npm install @sonarwhal/rule-no-vulnerable-javascript-libraries

Note: You can make npm install it as a devDependency using the --save-dev parameter, or to install it globally, you can use the -g parameter. For other options see npm's documentation.

And then activate it via the .sonarwhalrc configuration file:

{
"connector": {...},
"formatters": [...],
"parsers": [...],
"rules": {
"no-vulnerable-javascript-libraries": "error"
},
...
}

Further Reading