@lipemat/eslint-config 4.0.5 → 5.0.0-beta.2

package/plugins/security/rules/html-sinks.js

@@ -0,0 +1,128 @@
+import { AST_NODE_TYPES } from '@typescript-eslint/utils';
+import { isSanitized, isStringLike } from '../utils/shared.js';
+/**
+ * Check if a node is a literal string
+ */
+function isLiteralString(node) {
+    return AST_NODE_TYPES.Literal === node.type && 'string' === typeof node.value;
+}
+/**
+ * Get the callee name from a call expression
+ */
+function getCalleeName(node) {
+    if (AST_NODE_TYPES.Identifier === node.callee.type) {
+        return node.callee.name;
+    }
+    else if (AST_NODE_TYPES.MemberExpression === node.callee.type) {
+        if ('name' in node.callee.object && 'name' in node.callee.property) {
+            return `${node.callee.object.name}.${node.callee.property.name}`;
+        }
+        else if ('name' in node.callee.property) {
+            return node.callee.property.name;
+        }
+    }
+    return '';
+}
+/**
+ * Check if the assignment is to body.style.cssText
+ */
+function isCssTextAssignment(node) {
+    if (AST_NODE_TYPES.MemberExpression !== node.left.type) {
+        return false;
+    }
+    const memberExpr = node.left;
+    if (AST_NODE_TYPES.MemberExpression !== memberExpr.object.type || !('name' in memberExpr.property)) {
+        return false;
+    }
+    const parentMember = memberExpr.object;
+    if (!('name' in parentMember.object) || !('name' in parentMember.property)) {
+        return false;
+    }
+    return ('body' === parentMember.object.name &&
+        'style' === parentMember.property.name &&
+        'cssText' === memberExpr.property.name);
+}
+const plugin = {
+    defaultOptions: [],
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Detect security issues with HTML sinks: setTimeout/setInterval with strings, unsanitized window.open, and unsanitized body.style.cssText',
+        },
+        messages: {
+            setTimeoutString: 'setTimeout should not receive a string. Pass a function instead.',
+            setIntervalString: 'setInterval should not receive a string. Pass a function instead.',
+            windowOpenUnsanitized: 'window.open should be sanitized to prevent XSS attacks.',
+            cssTextUnsanitized: 'body.style.cssText should be sanitized when not a literal string to prevent XSS attacks.',
+            sanitize: 'Wrap with sanitize(...)',
+            domPurify: 'Wrap with DOMPurify.sanitize(...)',
+        },
+        schema: [],
+        hasSuggestions: true,
+    },
+    create(context) {
+        return {
+            CallExpression(node) {
+                const calleeName = getCalleeName(node);
+                // Handle setTimeout and setInterval with string arguments (not allowed)
+                if ('setTimeout' === calleeName || 'setInterval' === calleeName) {
+                    const firstArg = node.arguments[0];
+                    if (isStringLike(firstArg, context)) {
+                        context.report({
+                            node,
+                            messageId: 'setTimeout' === calleeName ? 'setTimeoutString' : 'setIntervalString',
+                        });
+                    }
+                    return;
+                }
+                // Handle window.open with string arguments (must be sanitized)
+                if ('window.open' === calleeName) {
+                    const firstArg = node.arguments[0];
+                    if (!isSanitized(firstArg)) {
+                        const sourceCode = context.sourceCode;
+                        const argText = sourceCode.getText(firstArg);
+                        context.report({
+                            node,
+                            messageId: 'windowOpenUnsanitized',
+                            suggest: [
+                                {
+                                    messageId: 'domPurify',
+                                    fix: fixer => fixer.replaceText(firstArg, `DOMPurify.sanitize(${argText})`),
+                                },
+                                {
+                                    messageId: 'sanitize',
+                                    fix: fixer => fixer.replaceText(firstArg, `sanitize(${argText})`),
+                                },
+                            ],
+                        });
+                    }
+                }
+            },
+            AssignmentExpression(node) {
+                // Handle body.style.cssText assignments
+                if (isCssTextAssignment(node)) {
+                    // Allow literal strings but require sanitization for other values
+                    if (!isLiteralString(node.right) && !isSanitized(node.right)) {
+                        const sourceCode = context.sourceCode;
+                        const rightText = sourceCode.getText(node.right);
+                        context.report({
+                            node,
+                            messageId: 'cssTextUnsanitized',
+                            suggest: [
+                                {
+                                    messageId: 'domPurify',
+                                    fix: fixer => fixer.replaceText(node.right, `DOMPurify.sanitize(${rightText})`),
+                                },
+                                {
+                                    messageId: 'sanitize',
+                                    fix: fixer => fixer.replaceText(node.right, `sanitize(${rightText})`),
+                                },
+                            ],
+                        });
+                    }
+                }
+            },
+        };
+    },
+};
+export default plugin;

package/plugins/security/rules/html-string-concat.js

@@ -0,0 +1,58 @@
+import { AST_NODE_TYPES } from '@typescript-eslint/utils';
+function isStringConcat(node) {
+    // 'foo' + userInput + 'bar' (HTML-like only)
+    return AST_NODE_TYPES.BinaryExpression === node.type && '+' === node.operator && hasHtmlLikeStrings(node);
+}
+function hasHtmlLikeStrings(node) {
+    if (AST_NODE_TYPES.Literal === node.type && 'string' === typeof node.value) {
+        return /[<>]/.test(node.value);
+    }
+    if (AST_NODE_TYPES.TemplateLiteral === node.type) {
+        // Check any static part of the template for HTML-like content.
+        return node.quasis.some(q => /[<>]/.test(q.value.cooked));
+    }
+    if (AST_NODE_TYPES.BinaryExpression === node.type && '+' === node.operator) {
+        return hasHtmlLikeStrings(node.left) || hasHtmlLikeStrings(node.right);
+    }
+    return false;
+}
+const plugin = {
+    defaultOptions: [],
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow string concatenation with HTML-like content',
+        },
+        messages: {
+            htmlStringConcat: 'HTML string concatenation detected, this is a security risk, use DOM node construction or a templating language instead.',
+        },
+        schema: [],
+    },
+    create(context) {
+        return {
+            AssignmentExpression(node) {
+                const right = node.right;
+                if (isStringConcat(right)) {
+                    context.report({
+                        node,
+                        messageId: 'htmlStringConcat',
+                    });
+                }
+            },
+            VariableDeclarator(node) {
+                // Detect string concatenation assigned at declaration time
+                const init = node.init;
+                if (null === init) {
+                    return;
+                }
+                if (isStringConcat(init)) {
+                    context.report({
+                        node,
+                        messageId: 'htmlStringConcat',
+                    });
+                }
+            },
+        };
+    },
+};
+export default plugin;

package/plugins/security/rules/jquery-executing.js

@@ -0,0 +1,105 @@
+import { AST_NODE_TYPES } from '@typescript-eslint/utils';
+import { getType, isSanitized } from '../utils/shared.js';
+/**
+ * @link https://docs.wpvip.com/security/javascript-security-recommendations/#h-stripping-tags
+ */
+const JQUERY_METHODS = [
+    'after', 'append', 'appendTo', 'before', 'html',
+    'insertAfter', 'insertBefore', 'prepend', 'prependTo',
+    'replaceAll', 'replaceWith',
+];
+/**
+ * Is the type of variable being passed a jQuery element?
+ *
+ * - jQuery elements are of type `JQuery`.
+ * - jQuery elements do not require sanitization.
+ *
+ * @link https://typescript-eslint.io/developers/custom-rules/#typed-rules
+ */
+export function isJQueryElementType(arg, context) {
+    const element = getType(arg, context);
+    return 'JQuery' === element.getSymbol()?.escapedName;
+}
+function isJQueryMethod(methodName) {
+    return JQUERY_METHODS.includes(methodName);
+}
+export function isJQueryCall(node) {
+    if (AST_NODE_TYPES.MemberExpression !== node.callee.type || !('name' in node.callee.property)) {
+        return false;
+    }
+    // Walk to the root object of the call chain
+    let obj = node.callee.object ?? null;
+    if (null === obj) {
+        return false;
+    }
+    while (AST_NODE_TYPES.MemberExpression === obj.type) {
+        obj = obj.object;
+    }
+    return (AST_NODE_TYPES.CallExpression === obj.type && AST_NODE_TYPES.Identifier === obj.callee.type &&
+        ('$' === obj.callee.name || 'jQuery' === obj.callee.name));
+}
+export function getJQueryCall(node) {
+    // Detect $(...).method(userInput) or jQuery(...).method(...)
+    if (AST_NODE_TYPES.MemberExpression !== node.callee.type || !('name' in node.callee.property)) {
+        return null;
+    }
+    const methodName = node.callee.property.name;
+    if (!isJQueryMethod(methodName)) {
+        return null;
+    }
+    return isJQueryCall(node) ? methodName : null;
+}
+const plugin = {
+    defaultOptions: [],
+    meta: {
+        docs: {
+            description: 'Disallow using unsanitized values in jQuery methods that execute HTML',
+        },
+        fixable: 'code',
+        hasSuggestions: true,
+        messages: {
+            needsEscaping: 'Any HTML used with `{{methodName}}` gets executed. Make sure it\'s properly escaped.',
+            // Suggestions
+            domPurify: 'Wrap the argument with a `DOMPurify.sanitize()` call.',
+            sanitize: 'Wrap the argument with a `sanitize()` call.',
+        },
+        schema: [],
+        type: 'problem',
+    },
+    create(context) {
+        return {
+            CallExpression(node) {
+                const methodName = getJQueryCall(node);
+                if (null !== methodName) {
+                    const arg = node.arguments[0];
+                    if (!isSanitized(arg) && !isJQueryElementType(arg, context)) {
+                        context.report({
+                            node,
+                            messageId: 'needsEscaping',
+                            data: {
+                                methodName,
+                            },
+                            suggest: [
+                                {
+                                    messageId: 'domPurify',
+                                    fix: (fixer) => {
+                                        const argText = context.sourceCode.getText(arg);
+                                        return fixer.replaceText(arg, `DOMPurify.sanitize(${argText})`);
+                                    },
+                                },
+                                {
+                                    messageId: 'sanitize',
+                                    fix: (fixer) => {
+                                        const argText = context.sourceCode.getText(arg);
+                                        return fixer.replaceText(arg, `sanitize(${argText})`);
+                                    },
+                                },
+                            ],
+                        });
+                    }
+                }
+            },
+        };
+    },
+};
+export default plugin;

package/plugins/security/rules/vulnerable-tag-stripping.js

@@ -0,0 +1,76 @@
+import { AST_NODE_TYPES } from '@typescript-eslint/utils';
+import { isJQueryCall } from './jquery-executing.js';
+/**
+ * Detects a vulnerable tag stripping pattern: .html(value).text()
+ *
+ * This pattern can lead to XSS vulnerabilities when HTML is inserted and then text is extracted.
+ *
+ * @link https://docs.wpvip.com/security/javascript-security-recommendations/#h-stripping-tags
+ */
+function isTextAfterHtml(node) {
+    // Check if this is a .text() call
+    if (AST_NODE_TYPES.MemberExpression !== node.callee.type || !('name' in node.callee.property)) {
+        return null;
+    }
+    if (node.callee.property.name !== 'text') {
+        return null;
+    }
+    const parentCall = node.callee.object;
+    if (AST_NODE_TYPES.CallExpression !== parentCall.type) {
+        return null;
+    }
+    if (AST_NODE_TYPES.MemberExpression !== parentCall.callee.type || !('name' in parentCall.callee.property)) {
+        return null;
+    }
+    if (parentCall.callee.property.name !== 'html') {
+        return null;
+    }
+    return isJQueryCall(parentCall) ? parentCall.callee : null;
+}
+const plugin = {
+    defaultOptions: [],
+    meta: {
+        docs: {
+            description: 'Disallow jQuery .html().text() chaining which can lead to XSS through tag stripping',
+        },
+        fixable: 'code',
+        hasSuggestions: true,
+        messages: {
+            vulnerableTagStripping: 'Using .html().text() can lead to XSS vulnerabilities through tag stripping. Use only .text()',
+            useTextOnly: 'Remove .html() and move the argument to .text()',
+        },
+        schema: [],
+        type: 'problem',
+    },
+    create(context) {
+        return {
+            CallExpression(node) {
+                const htmlProperty = isTextAfterHtml(node);
+                if (null === htmlProperty) {
+                    return;
+                }
+                const jquerySelector = htmlProperty.object;
+                const parentCall = htmlProperty.parent;
+                if (AST_NODE_TYPES.CallExpression !== parentCall.type) {
+                    return;
+                }
+                const htmlArg = parentCall.arguments[0];
+                context.report({
+                    node,
+                    messageId: 'vulnerableTagStripping',
+                    suggest: [
+                        {
+                            messageId: 'useTextOnly',
+                            fix: (fixer) => {
+                                const selectorText = context.sourceCode.getText(jquerySelector);
+                                const argText = context.sourceCode.getText(htmlArg);
+                                return fixer.replaceText(node, `${selectorText}.text( ${argText} )`);
+                            },
+                        },
+                    ],
+                });
+            },
+        };
+    },
+};
+export default plugin;

package/plugins/security/rules/window-escaping.js

@@ -0,0 +1,213 @@
+import { AST_NODE_TYPES } from '@typescript-eslint/utils';
+import { isSanitized } from '../utils/shared.js';
+// Window and location properties that need special handling
+const LOCATION_PROPS = new Set(['href', 'src', 'action',
+    'protocol', 'host', 'hostname', 'pathname', 'search', 'hash', 'username', 'port', 'name', 'status',
+]);
+const WINDOW_PROPS = new Set(['name', 'status']);
+export function isSafeUrlString(value) {
+    return !/^\s*(?:javascript|data|vbscript|about|livescript)\s*:/i.test(decodeURIComponent(value.replace(/[\u0000-\u001F\u007F]+/g, '')));
+}
+function isSafeUrlLiteral(node) {
+    if (AST_NODE_TYPES.TemplateElement !== node.type && AST_NODE_TYPES.Literal !== node.type) {
+        return false;
+    }
+    if (typeof node.value !== 'string') {
+        return false;
+    }
+    return isSafeUrlString(node.value);
+}
+function isSafeUrlTemplate(node) {
+    if (AST_NODE_TYPES.TemplateLiteral !== node.type || 0 === node.quasis.length) {
+        return false;
+    }
+    // Basic scheme safety on the first static chunk
+    const firstChunk = node.quasis[0];
+    if (isSafeUrlLiteral(firstChunk)) {
+        return true;
+    }
+    return isUrlEncoded(node);
+}
+function isUrlEncoded(node) {
+    if (AST_NODE_TYPES.TemplateLiteral !== node.type) {
+        return false;
+    }
+    return Array.isArray(node.expressions) && node.expressions.length > 0 && node.expressions.every(isEncoded);
+}
+function isEncoded(node) {
+    if (AST_NODE_TYPES.CallExpression !== node.type) {
+        return false;
+    }
+    return AST_NODE_TYPES.Identifier === node.callee.type &&
+        ('encodeURIComponent' === node.callee.name || 'encodeURI' === node.callee.name);
+}
+function isWindowLocationAssignment(node) {
+    // window.location.<prop> = ...
+    return (AST_NODE_TYPES.MemberExpression === node.left.type &&
+        AST_NODE_TYPES.MemberExpression === node.left.object.type &&
+        AST_NODE_TYPES.Identifier === node.left.object.property.type &&
+        AST_NODE_TYPES.Identifier === node.left.object.object.type &&
+        AST_NODE_TYPES.Identifier === node.left.property.type &&
+        'window' === node.left.object.object.name &&
+        'location' === node.left.object.property.name &&
+        LOCATION_PROPS.has(node.left.property.name));
+}
+function isWindowAssignment(node) {
+    // window.<prop> = ...
+    return (AST_NODE_TYPES.MemberExpression === node.left.type &&
+        AST_NODE_TYPES.Identifier === node.left.object.type &&
+        AST_NODE_TYPES.Identifier === node.left.property.type &&
+        'window' === node.left.object.name &&
+        WINDOW_PROPS.has(node.left.property.name));
+}
+function isWindowOrLocationMemberExpression(memberExpr) {
+    // Helper to detect a window.* or window.location.*
+    if (AST_NODE_TYPES.MemberExpression !== memberExpr.type) {
+        return false;
+    }
+    if (AST_NODE_TYPES.Identifier === memberExpr.object.type && 'window' === memberExpr.object.name) {
+        return true;
+    }
+    if (AST_NODE_TYPES.MemberExpression === memberExpr.object.type) {
+        const memberObject = memberExpr.object;
+        const isObjectWindow = AST_NODE_TYPES.Identifier === memberObject.object.type && 'window' === memberObject.object.name;
+        const isPropertyLocation = AST_NODE_TYPES.Identifier === memberObject.property.type && 'location' === memberObject.property.name;
+        return isObjectWindow && isPropertyLocation;
+    }
+    return false;
+}
+const plugin = {
+    defaultOptions: [],
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Require proper escaping for the window and location property access',
+        },
+        messages: {
+            unsafeWindow: 'Assignment to "{{propName}}" must be sanitized.',
+            unsafeWindowLocation: 'Assignment to window.location.{{propName}} must be sanitized.',
+            unsafeRead: 'Data from JS global {{propName}} may contain user-supplied values and should be sanitized before output to prevent XSS.',
+            // Suggestions
+            domPurify: 'Wrap the argument with a `DOMPurify.sanitize()` call.',
+            sanitize: 'Wrap the argument with a `sanitize()` call.',
+        },
+        schema: [],
+        hasSuggestions: true,
+    },
+    create(context) {
+        return {
+            AssignmentExpression(node) {
+                const right = node.right;
+                if (AST_NODE_TYPES.MemberExpression !== node.left.type || !('name' in node.left.property)) {
+                    return;
+                }
+                const propName = node.left.property.name;
+                // window.location.<prop> = ...
+                if (isWindowLocationAssignment(node)) {
+                    const rhsResolved = right;
+                    if (!LOCATION_PROPS.has(propName)) {
+                        return;
+                    }
+                    if (isSafeUrlLiteral(rhsResolved) || isSafeUrlTemplate(rhsResolved)) {
+                        return;
+                    }
+                    if (isSanitized(rhsResolved)) {
+                        return;
+                    }
+                    context.report({
+                        node,
+                        messageId: 'unsafeWindowLocation',
+                        data: {
+                            propName,
+                        },
+                        suggest: [
+                            {
+                                messageId: 'sanitize',
+                                fix: (fixer) => {
+                                    const argText = context.sourceCode.getText(right);
+                                    return fixer.replaceText(right, `sanitize(${argText})`);
+                                },
+                            }, {
+                                messageId: 'domPurify',
+                                fix: (fixer) => {
+                                    const argText = context.sourceCode.getText(right);
+                                    return fixer.replaceText(right, `DOMPurify.sanitize(${argText})`);
+                                },
+                            },
+                        ],
+                    });
+                    return;
+                }
+                // window.<prop> = ...
+                if (isWindowAssignment(node)) {
+                    if (isSanitized(node.right)) {
+                        return;
+                    }
+                    context.report({
+                        node,
+                        messageId: 'unsafeWindow',
+                        data: {
+                            propName,
+                        },
+                        suggest: [
+                            {
+                                messageId: 'sanitize',
+                                fix: (fixer) => {
+                                    const argText = context.sourceCode.getText(right);
+                                    return fixer.replaceText(right, `sanitize(${argText})`);
+                                },
+                            }, {
+                                messageId: 'domPurify',
+                                fix: (fixer) => {
+                                    const argText = context.sourceCode.getText(right);
+                                    return fixer.replaceText(right, `DOMPurify.sanitize(${argText})`);
+                                },
+                            },
+                        ],
+                    });
+                }
+            },
+            // Check for reading from the window.location properties
+            MemberExpression(node) {
+                const parent = node.parent;
+                if (AST_NODE_TYPES.AssignmentExpression === parent.type && parent.left === node) {
+                    return;
+                }
+                if (!isWindowOrLocationMemberExpression(node) || !('name' in node.property)) {
+                    return;
+                }
+                const propName = node.property.name;
+                if (!LOCATION_PROPS.has(propName)) {
+                    return;
+                }
+                if (AST_NODE_TYPES.CallExpression === parent.type && isSanitized(parent)) {
+                    return;
+                }
+                context.report({
+                    node,
+                    messageId: 'unsafeRead',
+                    data: {
+                        propName,
+                    },
+                    suggest: [
+                        {
+                            messageId: 'sanitize',
+                            fix: (fixer) => {
+                                const argText = context.sourceCode.getText(node);
+                                return fixer.replaceText(node, `sanitize( ${argText} )`);
+                            },
+                        },
+                        {
+                            messageId: 'domPurify',
+                            fix: (fixer) => {
+                                const argText = context.sourceCode.getText(node);
+                                return fixer.replaceText(node, `DOMPurify.sanitize( ${argText} )`);
+                            },
+                        },
+                    ],
+                });
+            },
+        };
+    },
+};
+export default plugin;

package/plugins/security/utils/shared.js

@@ -0,0 +1,47 @@
+import { AST_NODE_TYPES, ESLintUtils } from '@typescript-eslint/utils';
+import {} from 'typescript';
+export function isStringLike(node, context) {
+    const type = getType(node, context);
+    const literal = type.isStringLiteral();
+    const intrinsic = 'intrinsicName' in type && 'string' === type.intrinsicName;
+    return (AST_NODE_TYPES.Literal === node.type && 'string' === typeof node.value) || (AST_NODE_TYPES.TemplateLiteral === node.type) || literal || intrinsic;
+}
+/**
+ * Get the TypeScript type of node.
+ */
+export function getType(arg, context) {
+    const { getTypeAtLocation } = ESLintUtils.getParserServices(context);
+    const type = getTypeAtLocation(arg);
+    return type.getNonNullableType();
+}
+/**
+ * Is the type of variable being passed a DOM element?
+ *
+ * - DOM elements are of the type `HTML{*}Element`.
+ * - DOM elements do not require sanitization.
+ *
+ * @link https://typescript-eslint.io/developers/custom-rules/#typed-rules
+ */
+export function isDomElementType(arg, context) {
+    const element = getType(arg, context);
+    const name = element.getSymbol()?.escapedName ?? '';
+    // Match any type that ends with "Element", e.g., HTMLElement, HTMLDivElement, Element, etc.
+    return name.startsWith('HTML') && name.endsWith('Element');
+}
+/**
+ * Check if a node is a call to a known sanitization function.
+ * - Currently recognizes `sanitize(...)` and `DOMPurify.sanitize(...)`.
+ */
+export function isSanitized(node) {
+    if (AST_NODE_TYPES.CallExpression !== node.type) {
+        return false;
+    }
+    if (AST_NODE_TYPES.Identifier === node.callee.type && 'sanitize' === node.callee.name) {
+        return true;
+    }
+    if (AST_NODE_TYPES.MemberExpression === node.callee.type && AST_NODE_TYPES.Identifier === node.callee.object.type) {
+        return 'dompurify' === node.callee.object.name.toLowerCase() &&
+            AST_NODE_TYPES.Identifier === node.callee.property.type && 'sanitize' === node.callee.property.name;
+    }
+    return false;
+}

package/types/helpers/config.d.ts

@@ -0,0 +1,22 @@
+import type { FlatConfig } from '@typescript-eslint/utils/ts-eslint';
+/**
+ * Get a config from our /index.js merged with any
+ * matching configuration from the project directory.
+ *
+ * For instance, if we have a file named config/eslint.config.js in our project
+ * we will merge the contents with our config/eslint.config.js in favor of whatever
+ * is specified with the project's file.
+ *
+ * If the `module.exports` are a function, the existing configuration will be passed
+ * as the only argument. Otherwise, standard `module.exports` are also supported.
+ *
+ * @see @lipemat/js-boilerplate/helpers/config
+ *
+ * @example ```ts
+ * // function
+ * module.exports = function( config: { configs: Linter.Config[] } ) {
+ *     config.configs[0].push({extra: 'Extra'});
+ *     return config
+ * }
+ */
+export declare function getConfig(configs: FlatConfig.Config[]): FlatConfig.Config[];

package/types/index.d.ts

@@ -0,0 +1,3 @@
+import type { FlatConfig } from '@typescript-eslint/utils/ts-eslint';
+declare const _default: (FlatConfig.Config | import("eslint").Linter.Config<import("eslint").Linter.RulesRecord>)[];
+export default _default;

package/types/plugins/security/index.d.ts

@@ -0,0 +1,8 @@
+import type { FlatConfig } from '@typescript-eslint/utils/ts-eslint';
+type Plugin = FlatConfig.Plugin & {
+    configs: {
+        recommended: FlatConfig.ConfigArray;
+    };
+};
+declare const plugin: Plugin;
+export default plugin;

package/types/plugins/security/rules/dangerously-set-inner-html.d.ts

@@ -0,0 +1,3 @@
+import { type TSESLint } from '@typescript-eslint/utils';
+declare const plugin: TSESLint.RuleModule<'dangerousInnerHtml'>;
+export default plugin;

package/types/plugins/security/rules/html-executing-assignment.d.ts

@@ -0,0 +1,4 @@
+import { type TSESLint } from '@typescript-eslint/utils';
+type Messages = 'executed' | 'sanitize' | 'domPurify';
+declare const plugin: TSESLint.RuleModule<Messages>;
+export default plugin;