mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-19 16:18:11 +00:00
silverwind
428d72d26f
https://github.com/go-gitea/gitea/pull/38046 accidentally dropped `gitea/unescaped-html-literal` from the eslint config, so it has been off since. Raised in https://github.com/go-gitea/gitea/pull/39829#issuecomment-6246720235. - Re-enable the rule, exempting e2e tests like unit tests - Detect tags anywhere in strings and template chunks, not only at the start - Allow `htmlRaw` templates, they escape like `html` - Fix the existing violations, which escapes the heatmap tooltip and shortcut keys
99 lines
2.9 KiB
TypeScript
99 lines
2.9 KiB
TypeScript
// MIT license, Copyright (c) GitHub, Inc.
|
|
// https://github.com/github/eslint-plugin-github/blob/main/lib/rules/unescaped-html-literal.js
|
|
/* eslint-disable no-template-curly-in-string -- the fixtures are template literal sources inside plain strings */
|
|
import rule from './unescaped-html-literal.ts';
|
|
import {RuleTester} from 'eslint';
|
|
|
|
const ruleTester = new RuleTester();
|
|
|
|
ruleTester.run('unescaped-html-literal', rule, {
|
|
valid: [
|
|
{
|
|
code: '`Hello World!`;',
|
|
languageOptions: {ecmaVersion: 2017},
|
|
},
|
|
{
|
|
code: "'Hello World!'",
|
|
languageOptions: {ecmaVersion: 2017},
|
|
},
|
|
{
|
|
code: '"Hello World!"',
|
|
languageOptions: {ecmaVersion: 2017},
|
|
},
|
|
{
|
|
code: 'const helloTemplate = () => html`<div>Hello World!</div>`;',
|
|
languageOptions: {ecmaVersion: 2017},
|
|
},
|
|
{
|
|
code: 'const helloTemplate = (name) => html`<div>Hello ${name}!</div>`;',
|
|
languageOptions: {ecmaVersion: 2017},
|
|
},
|
|
{
|
|
code: 'const attr = htmlRaw` width="${width}"`, img = htmlRaw`<img ${attr}>`, cmp = "a < b";',
|
|
languageOptions: {ecmaVersion: 2017},
|
|
},
|
|
],
|
|
invalid: [
|
|
{
|
|
code: "const helloHTML = '<div>Hello, World!</div>'",
|
|
languageOptions: {ecmaVersion: 2017},
|
|
errors: [
|
|
{
|
|
message: 'Unescaped HTML literal. Use html`` tag template literal for secure escaping.',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
code: 'const helloHTML = "<h1>Hello, World!</h1>"',
|
|
languageOptions: {ecmaVersion: 2017},
|
|
errors: [
|
|
{
|
|
message: 'Unescaped HTML literal. Use html`` tag template literal for secure escaping.',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
code: 'const helloHTML = `<div>Hello ${name}!</div>`',
|
|
languageOptions: {ecmaVersion: 2017},
|
|
errors: [
|
|
{
|
|
message: 'Unescaped HTML literal. Use html`` tag template literal for secure escaping.',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
code: 'const helloHTML = ` \n\t<div>Hello ${name}!</div>`',
|
|
languageOptions: {ecmaVersion: 2017},
|
|
errors: [
|
|
{
|
|
message: 'Unescaped HTML literal. Use html`` tag template literal for secure escaping.',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
code: "const rowHTML = `${cells}</tr>`, tailHTML = '</tbody>', textHTML = 'Hello <b>World</b>'",
|
|
languageOptions: {ecmaVersion: 2017},
|
|
errors: [
|
|
{
|
|
message: 'Unescaped HTML literal. Use html`` tag template literal for secure escaping.',
|
|
},
|
|
{
|
|
message: 'Unescaped HTML literal. Use html`` tag template literal for secure escaping.',
|
|
},
|
|
{
|
|
message: 'Unescaped HTML literal. Use html`` tag template literal for secure escaping.',
|
|
},
|
|
],
|
|
},
|
|
{
|
|
code: 'const helloHTML = foo`<div>Hello ${name}!</div>`',
|
|
languageOptions: {ecmaVersion: 2017},
|
|
errors: [
|
|
{
|
|
message: 'Unescaped HTML literal. Use html`` tag template literal for secure escaping.',
|
|
},
|
|
],
|
|
},
|
|
],
|
|
});
|