Add rule for prevent from printing undefined to HTML #807
Conversation
|
There was a problem hiding this comment.
I don't think we need this.
| This rule reports all uses of `{@html}` in order to reduce the risk of injecting potentially unsafe / unescaped html into the browser leading to Cross-Site Scripting (XSS) attacks. | ||
|
|
||
| <ESLintCodeBlock> | ||
|
|
||
| <!--eslint-skip--> | ||
|
|
||
| ```svelte | ||
| <script> | ||
| /* eslint svelte/no-at-html-tags: "error" */ | ||
| </script> | ||
|
|
||
| <!-- ✓ GOOD --> | ||
| {foo} | ||
|
|
||
| <!-- ✗ BAD --> | ||
| {@html foo} | ||
| ``` |
There was a problem hiding this comment.
Please write proper document.
| meta: { | ||
| docs: { | ||
| description: 'Disallow from printing `undefined`', | ||
| category: 'Possible Errors', |
There was a problem hiding this comment.
I don't think printing undefined is possible error.
| docs: { | ||
| description: 'Disallow from printing `undefined`', | ||
| category: 'Possible Errors', | ||
| recommended: true |
There was a problem hiding this comment.
Please do not add recommended rules without major version up.
| recommended: true | |
| recommended: false |
| pageClass: 'rule-details' | ||
| sidebarDepth: 0 | ||
| title: 'svelte/no-undefined-print' | ||
| description: 'Disallow from printing `undefined`' |
There was a problem hiding this comment.
I think this is grammatically better?
| description: 'Disallow from printing `undefined`' | |
| description: 'Disallow printing `undefined`' |
| sidebarDepth: 0 | ||
| title: 'svelte/no-undefined-print' | ||
| description: 'Disallow from printing `undefined`' | ||
| since: 'v0.0.1' |
There was a problem hiding this comment.
We can use pnpm update to update docs automatically.
| }, | ||
| schema: [], | ||
| messages: { | ||
| unexpected: 'Unexpected `undefined`.' |
There was a problem hiding this comment.
| unexpected: 'Unexpected `undefined`.' | |
| unexpected: 'Disallow printing `undefined`' |
| let string = `this string contains some <strong>HTML!!!</strong>`; | ||
| </script> | ||
|
|
||
| <p>{@html string}</p> |
There was a problem hiding this comment.
I think this test is not for this rule.
close: #747