/*
 * Copyright (c) 2018, 2025, Oracle and/or its affiliates.
 * Licensed under The Universal Permissive License (UPL), Version 1.0
 * as shown at https://oss.oracle.com/licenses/upl/
 */
const RULE_NAME="csp-html-script-unsafe-inline";const LONG_DESCRIPT="CSP-1020:<br>"+"Inline script blocks are considered to be CSP violation. The general solution is to use hashes or a nonce to allow inline scripts to run."+"<p>CSP-1021:<br>"+"The execution of a JS event handler from inline HTML markup is a CSP violation. e.g. onclick onload onmouseover onsubmit, etc.<p>"+"The general solution is to use <b>addEventListener()</b>. e.g.<p>"+" &nbsp; &nbsp; <b>&lt;button id=\"btn\" <b>onclick='doSomething()'&gt;</b><p>"+"can be replaced with<p>"+" &nbsp; &nbsp; document.getElementById(\"btn\")<b>.addEventListener('click', doSomething)</b>";const SHORT_DESCRIPT=LONG_DESCRIPT;const TYPE="type";const MIME_TEXT_HTML="text/html";const NONCE="nonce";const SRC="src";function getName(){return RULE_NAME};function getShortDescription(){return SHORT_DESCRIPT};function getDescription(){return LONG_DESCRIPT};function register(){return{"script":_fnScript,"tag":_fnElem}};function _fnScript(context){var o,a,issue;o=context.tagNode.attribs;for(a in o){if(a===SRC||a===NONCE||a===TYPE&&o[a]===MIME_TEXT_HTML){return}}issue=new context.Issue("inline <script> 'nonce' attribute required - CSP violation");issue.setMsgKey(context.ruleName+"_1");context.reporter.addIssue(issue,context)};function _fnElem(context,elem){var node,attribs,attrib,issue,attrPos;node=context.node;if(!node||!node.attribs){return}attribs=node.attribs;for(attrib in attribs){if(!attrib.startsWith(":")&&attrib.startsWith("on")&&!attrib.startsWith("on-")){if(context.utils.DomUtils.isCommonEventAttr(attrib)){issue=new context.Issue("inline event handler '"+attrib+"' - CSP violation");attrPos=context.utils.DomUtils.getAttribPosition(context.data,context.node,attrib);issue.setPosition(attrPos.row,attrPos.col,attrPos.start,attrPos.end);issue.setMsgKey(context.ruleName+"_2");context.reporter.addIssue(issue,context)}}}};module.exports={getName,getDescription,getShortDescription,register};