rules-capacitor

Potential path traversal vulnerability with Capacitor Filesystem plugin. Using untrusted input (e.g., from user input, query parameters, or deep links) directly as a file path without validation can allow attackers to access or modify arbitrary files outside the intended directory. Always sanitize and validate file paths rigorously, or use a fixed, application-controlled path.

Violation of type safety best practices (aligned with Google's general TypeScript style tenets). The use of the 'any' type bypasses TypeScript's type checking, reducing code reliability and making it harder to catch errors. Consider defining specific types or interfaces for variables and function parameters/return values to improve code quality and maintainability.

Insecure storage of sensitive data detected. Storing authentication tokens, JWTs, passwords, or other secrets directly in localStorage is vulnerable to XSS attacks. Use the Capacitor Secure Storage plugin (e.g., @capacitor-community/secure-storage) for sensitive data that needs to persist securely on the device.

Potential insecure use of window.open(). Opening URLs based on untrusted user input (e.g., from event.url or form fields) can lead to phishing attacks or redirection to malicious sites. Always validate and sanitize URLs before opening them, or use a allow-list of trusted domains.

Use of the 'eval()' function is strictly prohibited. 'eval()' executes arbitrary JavaScript code and is a major security risk, often leading to injection vulnerabilities. Refactor your code to use safer alternatives like JSON.parse() for data parsing, or function constructors for dynamic function creation with controlled input.

Weak Content Security Policy (CSP) detected. The use of 'unsafe-inline' or 'unsafe-eval' in your CSP significantly reduces the security posture of your Capacitor application, making it vulnerable to XSS. Strive to remove these directives by using nonces, hashes, or refactoring code to avoid inline scripts/styles and eval().

Potential Cross-Site Scripting (XSS) vulnerability detected. Assigning untrusted user input (e.g., from event.detail.value) directly to innerHTML can lead to arbitrary code execution in the user's browser. Use element.textContent for displaying user-controlled data, or sanitize input rigorously with a library like DOMPurify before using innerHTML.