Questions regarding writing custom rules with SonarJS

Question

I have written a custom check in SonarJS to detect persistent Cross-site scripting vulnerabilities in javascript. However, I got a lot false positives and try to improve the code.

I have below two questions:

1. Does SonarJS support data flow analysis? For example, tracking some value comes from the Ajax response and finally print to the HTML (like innerHtml).

2. Do we have any parser in SonarJS plugin to parse the "+" operator? For example, get the part this.name from '<input value="' + this.name + '">' expression.

Regards! Jack Yao

Answer 1

1. There is data-flow analysis in SonarJS, but it's not supposed to be used in custom rules and it's not oriented to the kind of things you need
2. There is just one parser in SonarJS and as far as I can know it parses "+" operator