@herb-tools/linter 0.8.10 → 0.9.0

package/src/rules/erb-no-interpolated-class-names.ts

@@ -0,0 +1,65 @@
+import { isLiteralNode, isPureWhitespaceNode, splitLiteralsAtWhitespace, groupNodesByClass } from "@herb-tools/core"
+import { IdentityPrinter } from "@herb-tools/printer"
+
+import { ParserRule } from "../types.js"
+import { AttributeVisitorMixin } from "./rule-utils.js"
+
+import type { Node } from "@herb-tools/core"
+import type { StaticAttributeDynamicValueParams } from "./rule-utils.js"
+import type { UnboundLintOffense, LintContext, FullRuleConfig } from "../types.js"
+import type { ParseResult } from "@herb-tools/core"
+
+function groupToString(group: Node[]): string {
+  return group.map(node => {
+    if (isLiteralNode(node)) {
+      return node.content
+    }
+
+    return IdentityPrinter.print(node, { ignoreErrors: true })
+  }).join("")
+}
+
+class ERBNoInterpolatedClassNamesVisitor extends AttributeVisitorMixin {
+  protected checkStaticAttributeDynamicValue({ attributeName, valueNodes, attributeNode }: StaticAttributeDynamicValueParams) {
+    if (attributeName !== "class") return
+
+    const splitNodes = splitLiteralsAtWhitespace(valueNodes)
+    const groups = groupNodesByClass(splitNodes)
+
+    for (const group of groups) {
+      if (group.every(node => isPureWhitespaceNode(node))) continue
+
+      const isInterpolated = group.some(node => !isLiteralNode(node))
+      if (!isInterpolated) continue
+
+      const hasAttachedLiteral = group.some(node => isLiteralNode(node) && node.content.trim())
+      if (!hasAttachedLiteral) continue
+
+      const className = groupToString(group)
+
+      this.addOffense(
+        `Avoid ERB interpolation inside class names: \`${className}\`. Use standalone ERB expressions that output complete class names instead.`,
+        attributeNode.value!.location,
+      )
+    }
+  }
+}
+
+export class ERBNoInterpolatedClassNamesRule extends ParserRule {
+  static ruleName = "erb-no-interpolated-class-names"
+
+  get defaultConfig(): FullRuleConfig {
+    return {
+      enabled: true,
+      severity: "warning"
+    }
+  }
+
+  check(result: ParseResult, context?: Partial<LintContext>): UnboundLintOffense[] {
+    const visitor = new ERBNoInterpolatedClassNamesVisitor(this.ruleName, context)
+
+    visitor.visit(result.value)
+
+    return visitor.offenses
+  }
+}

package/src/rules/erb-no-javascript-tag-helper.ts

@@ -0,0 +1,47 @@
+import { ParserRule } from "../types.js"
+import { BaseRuleVisitor } from "./rule-utils.js"
+import { isERBNode, isERBOutputNode } from "@herb-tools/core"
+
+import type { UnboundLintOffense, LintContext, FullRuleConfig } from "../types.js"
+import type { ParseResult, DocumentNode } from "@herb-tools/core"
+
+const JAVASCRIPT_TAG_PATTERN = /\bjavascript_tag\b/
+
+class ERBNoJavascriptTagHelperVisitor extends BaseRuleVisitor {
+  visitDocumentNode(node: DocumentNode): void {
+    for (const child of node.children || []) {
+      if (!isERBNode(child)) continue
+      if (!isERBOutputNode(child)) continue
+
+      const content = child.content?.value || ""
+
+      if (JAVASCRIPT_TAG_PATTERN.test(content)) {
+        this.addOffense(
+          "Avoid `javascript_tag`. Use inline `<script>` tags instead.",
+          child.location,
+        )
+      }
+    }
+
+    super.visitDocumentNode(node)
+  }
+}
+
+export class ERBNoJavascriptTagHelperRule extends ParserRule {
+  static ruleName = "erb-no-javascript-tag-helper"
+
+  get defaultConfig(): FullRuleConfig {
+    return {
+      enabled: true,
+      severity: "warning"
+    }
+  }
+
+  check(result: ParseResult, context?: Partial<LintContext>): UnboundLintOffense[] {
+    const visitor = new ERBNoJavascriptTagHelperVisitor(this.ruleName, context)
+
+    visitor.visit(result.value)
+
+    return visitor.offenses
+  }
+}

package/src/rules/erb-no-output-control-flow.ts

@@ -25,6 +25,13 @@ class ERBNoOutputControlFlowRuleVisitor extends BaseRuleVisitor {
     this.visitChildNodes(node)
   }
 
+  private static readonly CONTROL_BLOCK_NAMES: Record<string, string> = {
+    "AST_ERB_IF_NODE": "if",
+    "AST_ERB_ELSE_NODE": "else",
+    "AST_ERB_END_NODE": "end",
+    "AST_ERB_UNLESS_NODE": "unless"
+  }
+
   private checkOutputControlFlow(controlBlock: ERBIfNode | ERBUnlessNode | ERBElseNode | ERBEndNode): void {
     const openTag = controlBlock.tag_opening;
     if (!openTag) {
@@ -32,25 +39,18 @@ class ERBNoOutputControlFlowRuleVisitor extends BaseRuleVisitor {
     }
 
     if (openTag.value === "<%="){
-      let controlBlockType: string = controlBlock.type
-
-      if (controlBlock.type === "AST_ERB_IF_NODE") controlBlockType = "if"
-      if (controlBlock.type === "AST_ERB_ELSE_NODE") controlBlockType = "else"
-      if (controlBlock.type === "AST_ERB_END_NODE") controlBlockType = "end"
-      if (controlBlock.type === "AST_ERB_UNLESS_NODE") controlBlockType = "unless"
+      const controlBlockType = ERBNoOutputControlFlowRuleVisitor.CONTROL_BLOCK_NAMES[controlBlock.type] || controlBlock.type
 
       this.addOffense(
         `Control flow statements like \`${controlBlockType}\` should not be used with output tags. Use \`<% ${controlBlockType} ... %>\` instead.`,
         openTag.location,
       )
     }
-
-    return
   }
 }
 
 export class ERBNoOutputControlFlowRule extends ParserRule {
-  name = "erb-no-output-control-flow"
+  static ruleName = "erb-no-output-control-flow"
 
   get defaultConfig(): FullRuleConfig {
     return {
@@ -60,7 +60,7 @@ export class ERBNoOutputControlFlowRule extends ParserRule {
   }
 
   check(result: ParseResult, context?: Partial<LintContext>): UnboundLintOffense[] {
-    const visitor = new ERBNoOutputControlFlowRuleVisitor(this.name, context)
+    const visitor = new ERBNoOutputControlFlowRuleVisitor(this.ruleName, context)
 
     visitor.visit(result.value)
 

package/src/rules/erb-no-output-in-attribute-name.ts

@@ -0,0 +1,39 @@
+import { ParserRule } from "../types.js"
+import { BaseRuleVisitor } from "./rule-utils.js"
+import { isERBNode, isERBOutputNode } from "@herb-tools/core"
+
+import type { UnboundLintOffense, LintContext, FullRuleConfig } from "../types.js"
+import type { ParseResult, HTMLAttributeNameNode } from "@herb-tools/core"
+
+class ERBNoOutputInAttributeNameVisitor extends BaseRuleVisitor {
+  visitHTMLAttributeNameNode(node: HTMLAttributeNameNode): void {
+    for (const child of node.children) {
+      if (!isERBNode(child)) continue
+      if (!isERBOutputNode(child)) continue
+
+      this.addOffense(
+        "Avoid ERB output in attribute names. Use static attribute names with dynamic values instead.",
+        child.location,
+      )
+    }
+
+    super.visitHTMLAttributeNameNode(node)
+  }
+}
+
+export class ERBNoOutputInAttributeNameRule extends ParserRule {
+  static ruleName = "erb-no-output-in-attribute-name"
+
+  get defaultConfig(): FullRuleConfig {
+    return {
+      enabled: true,
+      severity: "error"
+    }
+  }
+
+  check(result: ParseResult, context?: Partial<LintContext>): UnboundLintOffense[] {
+    const visitor = new ERBNoOutputInAttributeNameVisitor(this.ruleName, context)
+    visitor.visit(result.value)
+    return visitor.offenses
+  }
+}

package/src/rules/erb-no-output-in-attribute-position.ts

@@ -0,0 +1,39 @@
+import { ParserRule } from "../types.js"
+import { BaseRuleVisitor } from "./rule-utils.js"
+import { isERBNode, isERBOutputNode } from "@herb-tools/core"
+
+import type { UnboundLintOffense, LintContext, FullRuleConfig } from "../types.js"
+import type { ParseResult, HTMLOpenTagNode } from "@herb-tools/core"
+
+class ERBNoOutputInAttributePositionVisitor extends BaseRuleVisitor {
+  visitHTMLOpenTagNode(node: HTMLOpenTagNode): void {
+    for (const child of node.children) {
+      if (!isERBNode(child)) continue
+      if (!isERBOutputNode(child)) continue
+
+      this.addOffense(
+        "Avoid `<%= %>` in attribute position. Use `<% if ... %>` with static attributes instead.",
+        child.location,
+      )
+    }
+
+    super.visitHTMLOpenTagNode(node)
+  }
+}
+
+export class ERBNoOutputInAttributePositionRule extends ParserRule {
+  static ruleName = "erb-no-output-in-attribute-position"
+
+  get defaultConfig(): FullRuleConfig {
+    return {
+      enabled: true,
+      severity: "error"
+    }
+  }
+
+  check(result: ParseResult, context?: Partial<LintContext>): UnboundLintOffense[] {
+    const visitor = new ERBNoOutputInAttributePositionVisitor(this.ruleName, context)
+    visitor.visit(result.value)
+    return visitor.offenses
+  }
+}

package/src/rules/erb-no-raw-output-in-attribute-value.ts

@@ -0,0 +1,47 @@
+import { ParserRule } from "../types.js"
+import { AttributeVisitorMixin } from "./rule-utils.js"
+import { isERBNode } from "@herb-tools/core"
+
+import type { UnboundLintOffense, LintContext, FullRuleConfig } from "../types.js"
+import type { ParseResult, Node } from "@herb-tools/core"
+import type { StaticAttributeDynamicValueParams, DynamicAttributeDynamicValueParams } from "./rule-utils.js"
+
+class ERBNoRawOutputInAttributeValueVisitor extends AttributeVisitorMixin {
+  protected checkStaticAttributeDynamicValue({ valueNodes, attributeNode }: StaticAttributeDynamicValueParams): void {
+    this.checkValueNodes(valueNodes)
+  }
+
+  protected checkDynamicAttributeDynamicValue({ valueNodes }: DynamicAttributeDynamicValueParams): void {
+    this.checkValueNodes(valueNodes)
+  }
+
+  private checkValueNodes(nodes: Node[]): void {
+    for (const node of nodes) {
+      if (!isERBNode(node)) continue
+
+      if (node.tag_opening?.value === "<%==") {
+        this.addOffense(
+          "Avoid `<%==` in attribute values. Use `<%= %>` instead to ensure proper HTML escaping.",
+          node.location,
+        )
+      }
+    }
+  }
+}
+
+export class ERBNoRawOutputInAttributeValueRule extends ParserRule {
+  static ruleName = "erb-no-raw-output-in-attribute-value"
+
+  get defaultConfig(): FullRuleConfig {
+    return {
+      enabled: true,
+      severity: "error"
+    }
+  }
+
+  check(result: ParseResult, context?: Partial<LintContext>): UnboundLintOffense[] {
+    const visitor = new ERBNoRawOutputInAttributeValueVisitor(this.ruleName, context)
+    visitor.visit(result.value)
+    return visitor.offenses
+  }
+}

package/src/rules/erb-no-silent-tag-in-attribute-name.ts

@@ -27,7 +27,7 @@ class ERBNoSilentTagInAttributeNameVisitor extends BaseRuleVisitor {
 }
 
 export class ERBNoSilentTagInAttributeNameRule extends ParserRule {
-  name = "erb-no-silent-tag-in-attribute-name"
+  static ruleName = "erb-no-silent-tag-in-attribute-name"
 
   get defaultConfig(): FullRuleConfig {
     return {
@@ -37,7 +37,7 @@ export class ERBNoSilentTagInAttributeNameRule extends ParserRule {
   }
 
   check(result: ParseResult, context?: Partial<LintContext>): UnboundLintOffense[] {
-    const visitor = new ERBNoSilentTagInAttributeNameVisitor(this.name, context)
+    const visitor = new ERBNoSilentTagInAttributeNameVisitor(this.ruleName, context)
 
     visitor.visit(result.value)
 

package/src/rules/erb-no-statement-in-script.ts

@@ -0,0 +1,82 @@
+import { ParserRule } from "../types.js"
+import { BaseRuleVisitor } from "./rule-utils.js"
+import {
+  getTagLocalName,
+  getAttribute,
+  getStaticAttributeValue,
+  isERBNode,
+  isERBOutputNode,
+  isERBCommentNode,
+  isHTMLOpenTagNode,
+} from "@herb-tools/core"
+
+import type { UnboundLintOffense, LintContext, FullRuleConfig } from "../types.js"
+import type { ParseResult, HTMLElementNode, Node } from "@herb-tools/core"
+
+const END_PATTERN = /^\s*end\b/
+
+class ERBNoStatementInScriptVisitor extends BaseRuleVisitor {
+  visitHTMLElementNode(node: HTMLElementNode): void {
+    if (!isHTMLOpenTagNode(node.open_tag)) {
+      super.visitHTMLElementNode(node)
+      return
+    }
+
+    if (getTagLocalName(node.open_tag) === "script") {
+      this.checkScriptElement(node)
+    }
+
+    super.visitHTMLElementNode(node)
+  }
+
+  private checkScriptElement(node: HTMLElementNode): void {
+    if (!isHTMLOpenTagNode(node.open_tag)) return
+
+    const typeAttribute = getAttribute(node.open_tag, "type")
+    const typeValue = typeAttribute ? getStaticAttributeValue(typeAttribute) : null
+
+    if (typeValue === "text/html") {
+      return
+    }
+
+    if (!node.body || node.body.length === 0) {
+      return
+    }
+
+    this.checkNodesForStatements(node.body)
+  }
+
+  private checkNodesForStatements(nodes: Node[]): void {
+    for (const child of nodes) {
+      if (!isERBNode(child)) continue
+      if (isERBOutputNode(child)) continue
+      if (isERBCommentNode(child)) continue
+
+      const content = child.content?.value || ""
+
+      if (END_PATTERN.test(content)) continue
+
+      this.addOffense(
+        "Avoid `<% %>` tags inside `<script>`. Use `<%= %>` to interpolate values into JavaScript.",
+        child.location,
+      )
+    }
+  }
+}
+
+export class ERBNoStatementInScriptRule extends ParserRule {
+  static ruleName = "erb-no-statement-in-script"
+
+  get defaultConfig(): FullRuleConfig {
+    return {
+      enabled: true,
+      severity: "warning"
+    }
+  }
+
+  check(result: ParseResult, context?: Partial<LintContext>): UnboundLintOffense[] {
+    const visitor = new ERBNoStatementInScriptVisitor(this.ruleName, context)
+    visitor.visit(result.value)
+    return visitor.offenses
+  }
+}

package/src/rules/erb-no-then-in-control-flow.ts

@@ -0,0 +1,62 @@
+import { ParserRule } from "../types.js"
+import { BaseRuleVisitor } from "./rule-utils.js"
+
+import type { UnboundLintOffense, LintContext, FullRuleConfig } from "../types.js"
+import type { ERBIfNode, ERBUnlessNode, ERBWhenNode, ERBInNode, ParseResult, ParserOptions, Location } from "@herb-tools/core"
+
+class ERBNoThenInControlFlowVisitor extends BaseRuleVisitor {
+  visitERBIfNode(node: ERBIfNode): void {
+    const content = node.content?.value?.trim() ?? ""
+    const keyword = content.startsWith("elsif") ? "elsif" : "if"
+
+    this.checkThenKeyword(keyword, node.then_keyword)
+    this.visitChildNodes(node)
+  }
+
+  visitERBUnlessNode(node: ERBUnlessNode): void {
+    this.checkThenKeyword("unless", node.then_keyword)
+    this.visitChildNodes(node)
+  }
+
+  visitERBWhenNode(node: ERBWhenNode): void {
+    this.checkThenKeyword("when", node.then_keyword)
+    this.visitChildNodes(node)
+  }
+
+  visitERBInNode(node: ERBInNode): void {
+    this.checkThenKeyword("in", node.then_keyword)
+    this.visitChildNodes(node)
+  }
+
+  private checkThenKeyword(keyword: string, thenKeyword: Location | null): void {
+    if (thenKeyword === null) return
+
+    this.addOffense(
+      `Avoid using \`then\` in \`${keyword}\` expressions inside ERB templates. Use the multiline block form instead.`,
+      thenKeyword,
+    )
+  }
+}
+
+export class ERBNoThenInControlFlowRule extends ParserRule {
+  static ruleName = "erb-no-then-in-control-flow"
+
+  get defaultConfig(): FullRuleConfig {
+    return {
+      enabled: true,
+      severity: "warning",
+    }
+  }
+
+  get parserOptions(): Partial<ParserOptions> {
+    return { strict: true }
+  }
+
+  check(result: ParseResult, context?: Partial<LintContext>): UnboundLintOffense[] {
+    const visitor = new ERBNoThenInControlFlowVisitor(this.ruleName, context)
+
+    visitor.visit(result.value)
+
+    return visitor.offenses
+  }
+}

package/src/rules/erb-no-trailing-whitespace.ts

@@ -0,0 +1,187 @@
+import { Location, Visitor } from "@herb-tools/core"
+import { ParserRule, Mutable, BaseAutofixContext } from "../types.js"
+
+import { isHTMLOpenTagNode, isHTMLTextNode, isLiteralNode, getTagLocalName } from "@herb-tools/core"
+import { findNodeAtPosition } from "./rule-utils.js"
+
+import type { UnboundLintOffense, LintOffense, LintContext, FullRuleConfig } from "../types.js"
+import type { HTMLElementNode, HTMLTextNode, LiteralNode, ParseResult, DocumentNode, ERBNode } from "@herb-tools/core"
+
+const TRAILING_WHITESPACE = /[ \t\r\v\f\u00A0]+$/
+const TRAILING_WHITESPACE_BEFORE_NEWLINE = /[ \t\r\v\f\u00A0]+(?=\n)/g
+const ONLY_WHITESPACE = /^[ \t\r\v\f\u00A0]+$/
+
+interface SkipZone {
+  startLine: number
+  startColumn: number
+  endLine: number
+  endColumn: number
+}
+
+interface TrailingWhitespaceCandidate {
+  line: number
+  column: number
+  length: number
+}
+
+interface ERBNoTrailingWhitespaceAutofixContext extends BaseAutofixContext {
+  node: Mutable<HTMLTextNode> | Mutable<LiteralNode>
+}
+
+class SkipZoneCollector extends Visitor {
+  skipZones: SkipZone[] = []
+
+  SKIP_TAGS = new Set(["pre", "textarea", "script", "style"])
+
+  visitHTMLElementNode(node: HTMLElementNode): void {
+    if (isHTMLOpenTagNode(node.open_tag)) {
+      const tagName = getTagLocalName(node.open_tag)
+
+      if (tagName && this.SKIP_TAGS.has(tagName)) {
+        this.skipZones.push({
+          startLine: node.location.start.line,
+          startColumn: node.location.start.column,
+          endLine: node.location.end.line,
+          endColumn: node.location.end.column
+        })
+
+        return
+      }
+    }
+
+    super.visitHTMLElementNode(node)
+  }
+
+  visitERBNode(node: ERBNode) {
+    if (!node.tag_opening) return
+    if (!node.tag_closing) return
+
+    this.skipZones.push({
+      startLine: node.tag_opening.location.start.line,
+      startColumn: node.tag_opening.location.start.column,
+      endLine: node.tag_closing.location.end.line,
+      endColumn: node.tag_closing.location.end.column
+    })
+  }
+}
+
+export class ERBNoTrailingWhitespaceRule extends ParserRule<ERBNoTrailingWhitespaceAutofixContext> {
+  static autocorrectable = true
+  static ruleName = "erb-no-trailing-whitespace"
+
+  get defaultConfig(): FullRuleConfig {
+    return {
+      enabled: true,
+      severity: "error",
+    }
+  }
+
+  check(result: ParseResult, _context?: Partial<LintContext>): UnboundLintOffense<ERBNoTrailingWhitespaceAutofixContext>[] {
+    const offenses: UnboundLintOffense<ERBNoTrailingWhitespaceAutofixContext>[] = []
+    const lines = result.source.split("\n")
+    const candidates = this.findTrailingWhitespaceCandidates(lines)
+
+    if (candidates.length === 0) return offenses
+
+    const skipZones = this.collectSkipZones(result.value)
+
+    for (const candidate of candidates) {
+      if (!this.isInSkipZone(candidate, skipZones)) {
+        const location = Location.from(candidate.line, candidate.column, candidate.line, candidate.column + candidate.length)
+        const node = findNodeAtPosition(result.value, candidate.line, candidate.column, (n) => isHTMLTextNode(n) || isLiteralNode(n)) as HTMLTextNode | LiteralNode | null
+
+        offenses.push({
+          rule: this.ruleName,
+          message: "Extra whitespace detected at end of line.",
+          location,
+          autofixContext: node ? { node } : undefined
+        })
+      }
+    }
+
+    return offenses
+  }
+
+  private findTrailingWhitespaceCandidates(lines: string[]): TrailingWhitespaceCandidate[] {
+    const candidates: TrailingWhitespaceCandidate[] = []
+
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i]
+      const match = line.match(TRAILING_WHITESPACE)
+
+      if (match && match.index !== undefined) {
+        candidates.push({
+          line: i + 1,
+          column: match.index,
+          length: match[0].length
+        })
+      }
+    }
+
+    return candidates
+  }
+
+  private collectSkipZones(root: DocumentNode): SkipZone[] {
+    const collector = new SkipZoneCollector()
+
+    collector.visit(root)
+
+    return collector.skipZones
+  }
+
+  private isInSkipZone(candidate: TrailingWhitespaceCandidate, skipZones: SkipZone[]): boolean {
+    for (const zone of skipZones) {
+      if (candidate.line < zone.startLine || candidate.line > zone.endLine) continue
+      if (candidate.line === zone.endLine && candidate.column >= zone.endColumn) continue
+      if (candidate.line === zone.startLine && candidate.column < zone.startColumn) continue
+
+      return true
+    }
+
+    return false
+  }
+
+  autofix(offense: LintOffense<ERBNoTrailingWhitespaceAutofixContext>, result: ParseResult, _context?: Partial<LintContext>): ParseResult | null {
+    if (!offense.autofixContext) return null
+
+    const { node } = offense.autofixContext
+
+    if (node.type === "AST_HTML_TEXT_NODE" || node.type === "AST_LITERAL_NODE") {
+      let fixedContent = node.content.replace(TRAILING_WHITESPACE_BEFORE_NEWLINE, "")
+      const offenseIsAtEndOfContent = this.isOffenseAtEndOfContent(offense, node)
+
+      if (offenseIsAtEndOfContent) {
+        if (this.hasTrailingWhitespaceNotIndentation(fixedContent)) {
+          fixedContent = fixedContent.replace(TRAILING_WHITESPACE, "")
+        }
+
+        if (ONLY_WHITESPACE.test(fixedContent) && node.location.start.column !== 0) {
+          fixedContent = ""
+        }
+      }
+
+      node.content = fixedContent
+    }
+
+    return result
+  }
+
+  private isOffenseAtEndOfContent(offense: LintOffense<ERBNoTrailingWhitespaceAutofixContext>, node: Mutable<HTMLTextNode> | Mutable<LiteralNode>): boolean {
+    return offense.location.end.line === node.location.end.line && offense.location.end.column === node.location.end.column
+  }
+
+  private hasTrailingWhitespaceNotIndentation(content: string): boolean {
+    if (content.endsWith("\n")) return false
+
+    const endMatch = content.match(TRAILING_WHITESPACE)
+    if (!endMatch) return false
+
+    const whitespaceStart = content.length - endMatch[0].length
+    if (whitespaceStart === 0) return false
+
+    const characterBefore = content[whitespaceStart - 1]
+    if (characterBefore === "\n") return false
+
+    return true
+  }
+}

package/src/rules/erb-no-unsafe-js-attribute.ts

@@ -0,0 +1,47 @@
+import { ParserRule } from "../types.js"
+import { AttributeVisitorMixin } from "./rule-utils.js"
+import { isERBNode, isERBOutputNode } from "@herb-tools/core"
+
+import type { UnboundLintOffense, LintContext, FullRuleConfig } from "../types.js"
+import type { ParseResult, Node } from "@herb-tools/core"
+import type { StaticAttributeDynamicValueParams } from "./rule-utils.js"
+
+const JS_ATTRIBUTE_PATTERN = /^on/i
+const SAFE_PATTERN = /\.to_json\s*$|\bj\s*[\s(]|\bescape_javascript\s*[\s(]/
+
+class ERBNoUnsafeJSAttributeVisitor extends AttributeVisitorMixin {
+  protected checkStaticAttributeDynamicValue({ attributeName, valueNodes }: StaticAttributeDynamicValueParams): void {
+    if (!JS_ATTRIBUTE_PATTERN.test(attributeName)) return
+
+    for (const node of valueNodes) {
+      if (!isERBNode(node)) continue
+      if (!isERBOutputNode(node)) continue
+
+      const content = node.content?.value?.trim() || ""
+
+      if (SAFE_PATTERN.test(content)) continue
+
+      this.addOffense(
+        `Unsafe ERB output in \`${attributeName}\` attribute. Use \`.to_json\`, \`j()\`, or \`escape_javascript()\` to safely encode values.`,
+        node.location,
+      )
+    }
+  }
+}
+
+export class ERBNoUnsafeJSAttributeRule extends ParserRule {
+  static ruleName = "erb-no-unsafe-js-attribute"
+
+  get defaultConfig(): FullRuleConfig {
+    return {
+      enabled: true,
+      severity: "error"
+    }
+  }
+
+  check(result: ParseResult, context?: Partial<LintContext>): UnboundLintOffense[] {
+    const visitor = new ERBNoUnsafeJSAttributeVisitor(this.ruleName, context)
+    visitor.visit(result.value)
+    return visitor.offenses
+  }
+}