Linter rulesAsyncAPIsafe-markdown

safe-markdown

Since 0.9.0 · fixed by --fix

This rule ensures that Markdown strings (descriptions) do not contain unsafe constructs like script tags or eval() calls.

Rule Details

Unsafe constructs embedded in Markdown strings can pose security risks when the documentation is rendered, for example by a documentation portal.

The safe-markdown rule checks the description field of every object that supports CommonMark descriptions: the info object, servers, server variables, channels, parameters, operations, operation traits, operation reply addresses, messages, message traits, correlation IDs, tags, external documentation, schemas and security schemes. It reports:

  • Markdown contains <script> tag when a description contains a script element,
  • Markdown contains eval() function when a description contains an eval() call.

Configuration

None.

Examples

Good.

asyncapi: 3.0.0
info:
  title: Pet Events
  version: 1.0.0
  description: Events published when pets are adopted or returned.

Bad.

asyncapi: 3.0.0
info:
  title: Pet Events
  version: 1.0.0
  description: "Events published when pets are adopted. <script>alert('Unsafe')</script>"

Automatic fixes

When invoked with --fix, this rule escapes the delimiters of recognized script elements and eval() calls. It preserves the surrounding Markdown and does not alter code spans or fenced code blocks.

When Not to Use It

We recommend to always enable this rule.

Compatibility

This rule is compatible with AsyncAPI 3.x documents. AsyncAPI 2.x documents are rejected by the reader and are not linted.

Related rules