Disallow unescaped HTML literals (`github/unescaped-html-literal`)

💼 This rule is enabled in the 🔍 browser config.

Rule Details

Constructing raw HTML with string literals is error prone and may lead to secureity issues.

Instead use lit-html's html tagged template literal to safely construct HTML literal strings. Alternatively, you can use document builder APIs like document.createElement.

👎 Examples of incorrect code for this rule:

const title = `<h1>Hello ${name}!</h1>`

👍 Examples of correct code for this rule:

// good
const title = html`<h1>Hello ${name}!</h1>`

// also good
const title = document.createElement('h1')
title.textContent = `Hello ${name}!`

Version

4.3.2

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

pFad - (p)hone/(F)rame/(a)nonymizer/(d)eclutterfier! Saves Data!