no-append-html: Catch .add(html)

Fixes #308.

Signed-off-by: Anders Kaseorg <[email protected]>

Author: andersk

docs/rules/no-append-html.md

@@ -2,7 +2,7 @@
 
 # no-append-html
 
-Disallows using [`.append`](https://api.jquery.com/append/)/[`.prepend`](https://api.jquery.com/prepend/)/[`.before`](https://api.jquery.com/before/)/[`.after`](https://api.jquery.com/after/)/[`.replaceWith`](https://api.jquery.com/replaceWith/) to inject HTML, in order to prevent possible XSS bugs.
+Disallows using [`.append`](https://api.jquery.com/append/)/[`.prepend`](https://api.jquery.com/prepend/)/[`.before`](https://api.jquery.com/before/)/[`.after`](https://api.jquery.com/after/)/[`.replaceWith`](https://api.jquery.com/replaceWith/)/[`.add`](https://api.jquery.com/add/) to inject HTML, in order to prevent possible XSS bugs.
 
 ## Rule details
 
@@ -13,6 +13,7 @@ $div.prepend( '<xss>' );
 $div.before( '<xss>' );
 $div.after( '<xss>' );
 $div.replaceWith( '<xss>' );
+$els.add( '<xss>' );
 $div.append( code + '<xss>' );
 $div.append( test ? $el : '<xss>' );
 $div.append( $el, '<xss>' );
@@ -28,6 +29,7 @@ $div.prepend( $el );
 $div.before( $el );
 $div.after( $el );
 $div.replaceWith( $el );
+$els.add( $el );
 $div.append( this.$el );
 $div.append( this.foo.$el );
 $div.append( $el1, $el2 );

src/rules/no-append-html.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const utils = require( '../utils.js' );
-const methods = [ 'append', 'prepend', 'before', 'after', 'replaceWith' ];
+const methods = [ 'append', 'prepend', 'before', 'after', 'replaceWith', 'add' ];
 
 function alljQueryOrEmpty( context, node ) {
 	if ( node.type === 'ConditionalExpression' ) {

tests/rules/no-append-html.js

@@ -13,6 +13,7 @@ ruleTester.run( 'no-append-html', rule, {
 		'$div.before($el)',
 		'$div.after($el)',
 		'$div.replaceWith($el)',
+		'$els.add($el)',
 		'$div.append(this.$el)',
 		'$div.append(this.foo.$el)',
 		'$div.append($el1, $el2)',
@@ -50,6 +51,10 @@ ruleTester.run( 'no-append-html', rule, {
 			code: '$div.replaceWith("<xss>")',
 			errors: [ error ]
 		},
+		{
+			code: '$els.add("<xss>")',
+			errors: [ error ]
+		},
 		{
 			code: '$div.append(code + "<xss>")',
 			errors: [ error ]