rules-bootstrap

Deprecated Bootstrap sanitizer option 'whitelist' detected. In Bootstrap 5, the 'whitelist' option for sanitization has been replaced by 'allowList'. Update your sanitizer configuration to use 'allowList' for improved clarity and compatibility with modern Bootstrap versions.

Potential Cross-Site Scripting (XSS) vulnerability: 'data-bs-sanitize="false"' explicitly disables Bootstrap's built-in sanitizer for tooltips/popovers. This is highly dangerous if content is user-supplied. Ensure all dynamic content is thoroughly sanitized using a robust library like DOMPurify, or remove this attribute to enable Bootstrap's default sanitization.

Google JavaScript Style Guide violation: Use of 'var' keyword detected. The Google JavaScript Style Guide recommends using 'const' or 'let' instead of 'var' for block-scoped variable declarations. Update to 'const' or 'let' for better scope management and code clarity.

Potential Cross-Site Scripting (XSS) risk: 'data-bs-html="true"' allows HTML content in Bootstrap components (e.g., tooltips, popovers). If this content is derived from untrusted user input, it creates an XSS vector. Ensure any HTML rendered via this attribute is strictly sanitized using a library like DOMPurify or only originates from trusted sources. Prefer 'data-bs-html="false"' or 'textContent' for untrusted input.

Critical Cross-Site Scripting (XSS) vulnerability: 'javascript:' scheme detected in 'href' or 'data-bs-target' attribute. This allows direct execution of arbitrary JavaScript code. Never use 'javascript:' URLs with untrusted input. Remove this pattern and use proper event handlers or secure navigation methods.

Legacy jQuery script import detected. Bootstrap 5+ does not require jQuery — including it adds unnecessary overhead and a larger attack surface. For new Bootstrap 5+ projects, prefer vanilla JavaScript. If you need jQuery for legacy reasons, ensure it is up-to-date (>=3.7.x) to avoid known XSS vulnerabilities.

RISK: Assigning user-influenced or dynamic content to innerHTML is a classic XSS vector (CWE-79). If the value originates from user input, an API response, or a URL parameter it can inject arbitrary HTML/JS. FIX: Use element.textContent for plain text, or sanitize with DOMPurify.sanitize() before assigning to innerHTML.