chore: migrate unescaped-html-literal eslint rule to our repo and fix more cases (#38072)

2026-08-10 05:24:18 +09:00 · 2026-06-11 16:37:22 +02:00
parent 360f34d7fa
commit 250a38abb5
10 changed files with 184 additions and 45 deletions
@@ -0,0 +1,85 @@
+// MIT license, Copyright (c) GitHub, Inc.
+// https://github.com/github/eslint-plugin-github/blob/main/lib/rules/unescaped-html-literal.js
+/* eslint-disable no-template-curly-in-string */
+import rule from './unescaped-html-literal.ts';
+import {RuleTester} from 'eslint';
+
+class VitestRuleTester extends RuleTester {
+  static describe = describe;
+  static it = it;
+  static itOnly = it.only;
+}
+
+const ruleTester = new VitestRuleTester();
+
+ruleTester.run('unescaped-html-literal', rule, {
+  valid: [
+    {
+      code: '`Hello World!`;',
+      languageOptions: {ecmaVersion: 2017},
+    },
+    {
+      code: "'Hello World!'",
+      languageOptions: {ecmaVersion: 2017},
+    },
+    {
+      code: '"Hello World!"',
+      languageOptions: {ecmaVersion: 2017},
+    },
+    {
+      code: 'const helloTemplate = () => html`<div>Hello World!</div>`;',
+      languageOptions: {ecmaVersion: 2017},
+    },
+    {
+      code: 'const helloTemplate = (name) => html`<div>Hello ${name}!</div>`;',
+      languageOptions: {ecmaVersion: 2017},
+    },
+  ],
+  invalid: [
+    {
+      code: "const helloHTML = '<div>Hello, World!</div>'",
+      languageOptions: {ecmaVersion: 2017},
+      errors: [
+        {
+          message: 'Unescaped HTML literal. Use html`` tag template literal for secure escaping.',
+        },
+      ],
+    },
+    {
+      code: 'const helloHTML = "<h1>Hello, World!</h1>"',
+      languageOptions: {ecmaVersion: 2017},
+      errors: [
+        {
+          message: 'Unescaped HTML literal. Use html`` tag template literal for secure escaping.',
+        },
+      ],
+    },
+    {
+      code: 'const helloHTML = `<div>Hello ${name}!</div>`',
+      languageOptions: {ecmaVersion: 2017},
+      errors: [
+        {
+          message: 'Unescaped HTML literal. Use html`` tag template literal for secure escaping.',
+        },
+      ],
+    },
+    {
+      code: 'const helloHTML = ` \n\t<div>Hello ${name}!</div>`',
+      languageOptions: {ecmaVersion: 2017},
+      errors: [
+        {
+          message: 'Unescaped HTML literal. Use html`` tag template literal for secure escaping.',
+        },
+      ],
+    },
+    {
+      code: 'const helloHTML = foo`<div>Hello ${name}!</div>`',
+      languageOptions: {ecmaVersion: 2017},
+      errors: [
+        {
+          message: 'Unescaped HTML literal. Use html`` tag template literal for secure escaping.',
+        },
+      ],
+    },
+  ],
+});
@@ -0,0 +1,41 @@
+// MIT license, Copyright (c) GitHub, Inc.
+// https://github.com/github/eslint-plugin-github/blob/main/lib/rules/unescaped-html-literal.js
+import type {JSRuleDefinition, JSRuleDefinitionTypeOptions} from 'eslint';
+
+const htmlOpenTag = /^\s*<[a-zA-Z]/;
+
+const rule: JSRuleDefinition<JSRuleDefinitionTypeOptions> = {
+  meta: {
+    type: 'problem',
+    messages: {
+      unescapedHtmlLiteral: 'Unescaped HTML literal. Use html`` tag template literal for secure escaping.',
+    },
+  },
+
+  create(context) {
+    return {
+      Literal(node) {
+        if (typeof node.value !== 'string' || !htmlOpenTag.test(node.value)) return;
+
+        context.report({
+          node,
+          messageId: 'unescapedHtmlLiteral',
+        });
+      },
+      TemplateLiteral(node) {
+        const templateStart = node.quasis[0]?.value.raw;
+        if (!templateStart || !htmlOpenTag.test(templateStart)) return;
+
+        const parent = node.parent;
+        if (parent?.type === 'TaggedTemplateExpression' && parent.tag.type === 'Identifier' && parent.tag.name === 'html') return;
+
+        context.report({
+          node,
+          messageId: 'unescapedHtmlLiteral',
+        });
+      },
+    };
+  },
+};
+
+export default rule;