@lipemat/eslint-config 5.0.0-beta.2 → 5.0.0-beta.4

package/index.js

@@ -7,10 +7,6 @@ import globals from 'globals';
 import stylisticTs from '@stylistic/eslint-plugin-ts';
 import { getConfig } from './helpers/config.js';
 const flatCompat = new FlatCompat();
-/**
- * Default config if no extensions override it.
- *
- */
 const BASE_CONFIG = {
     languageOptions: {
         ecmaVersion: 7,
@@ -115,16 +111,20 @@ const TS_CONFIG = {
 /**
  * Merge in any extensions' config.
  */
-let mergedConfig = [BASE_CONFIG, TS_CONFIG];
+const defaultConfig = [
+    BASE_CONFIG,
+    TS_CONFIG,
+    securityPlugin.configs.recommended,
+];
+let mergedConfig = [];
 try {
-    mergedConfig = getConfig(mergedConfig);
+    mergedConfig = getConfig(defaultConfig);
 }
 catch (e) {
+    // JS Boilerplate is likely not installed.
     console.debug(e);
-    // JS Boilerplate is not installed.
 }
 export default [
-    ...securityPlugin.configs.recommended,
     ...fixupConfigRules(flatCompat.extends('plugin:@wordpress/eslint-plugin/recommended-with-formatting')),
     ...fixupConfigRules(flatCompat.extends('plugin:deprecation/recommended')),
     ...mergedConfig,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lipemat/eslint-config",
-  "version": "5.0.0-beta.2",
+  "version": "5.0.0-beta.4",
   "license": "MIT",
   "description": "Eslint configuration for all @lipemat packages",
   "engines": {

package/plugins/security/index.js

@@ -25,27 +25,25 @@ const plugin = {
         'window-escaping': windowEscaping,
     },
     configs: {
-        recommended: [],
+        recommended: {},
     },
 };
 // Freeze the plugin to prevent modifications and use the plugin within.
 plugin.configs = Object.freeze({
-    recommended: [
-        {
-            plugins: {
-                '@lipemat/security': plugin,
-            },
-            rules: {
-                '@lipemat/security/dangerously-set-inner-html': 'error',
-                '@lipemat/security/html-executing-assignment': 'error',
-                '@lipemat/security/html-executing-function': 'error',
-                '@lipemat/security/html-sinks': 'error',
-                '@lipemat/security/html-string-concat': 'error',
-                '@lipemat/security/jquery-executing': 'error',
-                '@lipemat/security/vulnerable-tag-stripping': 'error',
-                '@lipemat/security/window-escaping': 'error',
-            },
+    recommended: {
+        plugins: {
+            '@lipemat/security': plugin,
         },
-    ],
+        rules: {
+            '@lipemat/security/dangerously-set-inner-html': 'error',
+            '@lipemat/security/html-executing-assignment': 'error',
+            '@lipemat/security/html-executing-function': 'error',
+            '@lipemat/security/html-sinks': 'error',
+            '@lipemat/security/html-string-concat': 'error',
+            '@lipemat/security/jquery-executing': 'error',
+            '@lipemat/security/vulnerable-tag-stripping': 'error',
+            '@lipemat/security/window-escaping': 'error',
+        },
+    },
 });
 export default plugin;

package/plugins/security/rules/dangerously-set-inner-html.js

@@ -29,12 +29,15 @@ const plugin = {
     defaultOptions: [],
     meta: {
         type: 'problem',
-        fixable: 'code',
+        hasSuggestions: true,
         docs: {
             description: 'Disallow using unsanitized values in dangerouslySetInnerHTML',
         },
         messages: {
             dangerousInnerHtml: 'Any HTML passed to `dangerouslySetInnerHTML` gets executed. Please make sure it\'s properly escaped.',
+            // Suggestions
+            domPurify: 'Wrap the content with a `DOMPurify.sanitize()` call.',
+            sanitize: 'Wrap the content with a `sanitize()` call.',
         },
         schema: [],
     },
@@ -51,9 +54,20 @@ const plugin = {
                 context.report({
                     node,
                     messageId: 'dangerousInnerHtml',
-                    fix: (fixer) => {
-                        return fixer.replaceText(node, `dangerouslySetInnerHTML={{__html: DOMPurify.sanitize(${context.sourceCode.getText(htmlValue)})}}`);
-                    },
+                    suggest: [
+                        {
+                            messageId: 'domPurify',
+                            fix: (fixer) => {
+                                return fixer.replaceText(node, `dangerouslySetInnerHTML={{__html: DOMPurify.sanitize( ${context.sourceCode.getText(htmlValue)} )}}`);
+                            },
+                        },
+                        {
+                            messageId: 'sanitize',
+                            fix: (fixer) => {
+                                return fixer.replaceText(node, `dangerouslySetInnerHTML={{__html: sanitize( ${context.sourceCode.getText(htmlValue)} )}}`);
+                            },
+                        },
+                    ],
                 });
             },
         };

package/plugins/security/rules/html-executing-assignment.js

@@ -1,7 +1,8 @@
 import { AST_NODE_TYPES } from '@typescript-eslint/utils';
-import { isSanitized } from '../utils/shared.js';
+import { isDomElementType, isSafeLiteralString, isSanitized } from '../utils/shared.js';
 const UNSAFE_PROPERTIES = [
-    'innerHTML', 'outerHTML',
+    'innerHTML',
+    'outerHTML',
 ];
 function isUnsafeProperty(propertyName) {
     return UNSAFE_PROPERTIES.includes(propertyName);
@@ -12,7 +13,6 @@ const plugin = {
         docs: {
             description: 'Disallow using unsanitized values in HTML executing property assignments',
         },
-        fixable: 'code',
         hasSuggestions: true,
         messages: {
             executed: 'Any HTML used with `{{propertyName}}` gets executed. Make sure it\'s properly escaped.',
@@ -26,8 +26,7 @@ const plugin = {
     create(context) {
         return {
             AssignmentExpression(node) {
-                // Handle element.innerHTML = value and element.outerHTML = value
-                if (AST_NODE_TYPES.MemberExpression !== node.left.type || !('name' in node.left.property)) {
+                if (AST_NODE_TYPES.MemberExpression !== node.left.type || AST_NODE_TYPES.Identifier !== node.left.property.type) {
                     return;
                 }
                 const propertyName = node.left.property.name;
@@ -35,7 +34,7 @@ const plugin = {
                     return;
                 }
                 const value = node.right;
-                if (!isSanitized(value)) {
+                if (!isSafeLiteralString(value) && !isSanitized(value) && isDomElementType(node.left.object, context)) {
                     context.report({
                         node,
                         messageId: 'executed',
@@ -47,14 +46,14 @@ const plugin = {
                                 messageId: 'domPurify',
                                 fix: (fixer) => {
                                     const valueText = context.sourceCode.getText(value);
-                                    return fixer.replaceText(value, `DOMPurify.sanitize(${valueText})`);
+                                    return fixer.replaceText(value, `DOMPurify.sanitize( ${valueText} )`);
                                 },
                             },
                             {
                                 messageId: 'sanitize',
                                 fix: (fixer) => {
                                     const valueText = context.sourceCode.getText(value);
-                                    return fixer.replaceText(value, `sanitize(${valueText})`);
+                                    return fixer.replaceText(value, `sanitize( ${valueText} )`);
                                 },
                             },
                         ],

package/plugins/security/rules/html-executing-function.js

@@ -1,5 +1,5 @@
 import { AST_NODE_TYPES } from '@typescript-eslint/utils';
-import { isDomElementType, isSanitized } from '../utils/shared.js';
+import { isDomElementType, isSafeLiteralString, isSanitized } from '../utils/shared.js';
 import { isJQueryCall } from './jquery-executing.js';
 const DOCUMENT_METHODS = [
     'document.write',
@@ -42,19 +42,20 @@ function getDocumentCall(node) {
     }
     return null;
 }
-function getElementMethodCall(node) {
-    // Detect element.method(userInput) calls
-    if (AST_NODE_TYPES.MemberExpression !== node.callee.type || !('name' in node.callee.property)) {
+function getElementMethodCall(node, context) {
+    if (AST_NODE_TYPES.MemberExpression !== node.callee.type || AST_NODE_TYPES.Identifier !== node.callee.property.type) {
         return null;
     }
     const methodName = node.callee.property.name;
+    if (!isDomElementType(node.callee.object, context)) {
+        return null; // We only care about DOM element method calls.
+    }
     if (!isUnsafeMethod(methodName)) {
         return null;
     }
     if (isJQueryCall(node)) {
         return null; // Handled in jquery-executing rule
     }
-    // This is a generic element method call, not jQuery specific
     return methodName;
 }
 const plugin = {
@@ -63,7 +64,6 @@ const plugin = {
         docs: {
             description: 'Disallow using unsanitized values in functions that execute HTML',
         },
-        fixable: 'code',
         hasSuggestions: true,
         messages: {
             'document.write': 'Any HTML used with `document.write` gets executed. Make sure it\'s properly escaped.',
@@ -91,7 +91,7 @@ const plugin = {
                     method = documentMethod;
                 }
                 else {
-                    method = getElementMethodCall(node);
+                    method = getElementMethodCall(node, context);
                     if (null === method) {
                         return;
                     }
@@ -100,7 +100,7 @@ const plugin = {
                 if (isSecondArgMethod(method)) {
                     arg = node.arguments[1];
                 }
-                if (!isSanitized(arg) && !isDomElementType(arg, context)) {
+                if (!isSafeLiteralString(arg) && !isSanitized(arg) && !isDomElementType(arg, context)) {
                     context.report({
                         node,
                         messageId: method,
@@ -109,14 +109,14 @@ const plugin = {
                                 messageId: 'domPurify',
                                 fix: (fixer) => {
                                     const argText = context.sourceCode.getText(arg);
-                                    return fixer.replaceText(arg, `DOMPurify.sanitize(${argText})`);
+                                    return fixer.replaceText(arg, `DOMPurify.sanitize( ${argText} )`);
                                 },
                             },
                             {
                                 messageId: 'sanitize',
                                 fix: (fixer) => {
                                     const argText = context.sourceCode.getText(arg);
-                                    return fixer.replaceText(arg, `sanitize(${argText})`);
+                                    return fixer.replaceText(arg, `sanitize( ${argText} )`);
                                 },
                             },
                         ],

package/plugins/security/rules/html-sinks.js

@@ -1,11 +1,5 @@
 import { AST_NODE_TYPES } from '@typescript-eslint/utils';
-import { isSanitized, isStringLike } from '../utils/shared.js';
-/**
- * Check if a node is a literal string
- */
-function isLiteralString(node) {
-    return AST_NODE_TYPES.Literal === node.type && 'string' === typeof node.value;
-}
+import { isLiteralString, isSanitized, isStringLike } from '../utils/shared.js';
 /**
  * Get the callee name from a call expression
  */
@@ -87,11 +81,11 @@ const plugin = {
                             suggest: [
                                 {
                                     messageId: 'domPurify',
-                                    fix: fixer => fixer.replaceText(firstArg, `DOMPurify.sanitize(${argText})`),
+                                    fix: fixer => fixer.replaceText(firstArg, `DOMPurify.sanitize( ${argText} )`),
                                 },
                                 {
                                     messageId: 'sanitize',
-                                    fix: fixer => fixer.replaceText(firstArg, `sanitize(${argText})`),
+                                    fix: fixer => fixer.replaceText(firstArg, `sanitize( ${argText} )`),
                                 },
                             ],
                         });
@@ -111,11 +105,11 @@ const plugin = {
                             suggest: [
                                 {
                                     messageId: 'domPurify',
-                                    fix: fixer => fixer.replaceText(node.right, `DOMPurify.sanitize(${rightText})`),
+                                    fix: fixer => fixer.replaceText(node.right, `DOMPurify.sanitize( ${rightText} )`),
                                 },
                                 {
                                     messageId: 'sanitize',
-                                    fix: fixer => fixer.replaceText(node.right, `sanitize(${rightText})`),
+                                    fix: fixer => fixer.replaceText(node.right, `sanitize( ${rightText} )`),
                                 },
                             ],
                         });

package/plugins/security/rules/html-string-concat.js

@@ -3,7 +3,12 @@ function isStringConcat(node) {
     // 'foo' + userInput + 'bar' (HTML-like only)
     return AST_NODE_TYPES.BinaryExpression === node.type && '+' === node.operator && hasHtmlLikeStrings(node);
 }
-function hasHtmlLikeStrings(node) {
+/**
+ * Check if an expression contains any HTML-like strings.
+ * - Looks for `<` or `>` characters in string literals and template literals.
+ * - Recursively checks binary expressions with the ` + ` operator.
+ */
+export function hasHtmlLikeStrings(node) {
     if (AST_NODE_TYPES.Literal === node.type && 'string' === typeof node.value) {
         return /[<>]/.test(node.value);
     }

package/plugins/security/rules/jquery-executing.js

@@ -55,7 +55,6 @@ const plugin = {
         docs: {
             description: 'Disallow using unsanitized values in jQuery methods that execute HTML',
         },
-        fixable: 'code',
         hasSuggestions: true,
         messages: {
             needsEscaping: 'Any HTML used with `{{methodName}}` gets executed. Make sure it\'s properly escaped.',
@@ -84,14 +83,14 @@ const plugin = {
                                     messageId: 'domPurify',
                                     fix: (fixer) => {
                                         const argText = context.sourceCode.getText(arg);
-                                        return fixer.replaceText(arg, `DOMPurify.sanitize(${argText})`);
+                                        return fixer.replaceText(arg, `DOMPurify.sanitize( ${argText} )`);
                                     },
                                 },
                                 {
                                     messageId: 'sanitize',
                                     fix: (fixer) => {
                                         const argText = context.sourceCode.getText(arg);
-                                        return fixer.replaceText(arg, `sanitize(${argText})`);
+                                        return fixer.replaceText(arg, `sanitize( ${argText} )`);
                                     },
                                 },
                             ],

package/plugins/security/rules/vulnerable-tag-stripping.js

@@ -33,7 +33,6 @@ const plugin = {
         docs: {
             description: 'Disallow jQuery .html().text() chaining which can lead to XSS through tag stripping',
         },
-        fixable: 'code',
         hasSuggestions: true,
         messages: {
             vulnerableTagStripping: 'Using .html().text() can lead to XSS vulnerabilities through tag stripping. Use only .text()',

package/plugins/security/rules/window-escaping.js

@@ -1,5 +1,5 @@
 import { AST_NODE_TYPES } from '@typescript-eslint/utils';
-import { isSanitized } from '../utils/shared.js';
+import { isLiteralString, isSanitized } from '../utils/shared.js';
 // Window and location properties that need special handling
 const LOCATION_PROPS = new Set(['href', 'src', 'action',
     'protocol', 'host', 'hostname', 'pathname', 'search', 'hash', 'username', 'port', 'name', 'status',
@@ -9,37 +9,7 @@ export function isSafeUrlString(value) {
     return !/^\s*(?:javascript|data|vbscript|about|livescript)\s*:/i.test(decodeURIComponent(value.replace(/[\u0000-\u001F\u007F]+/g, '')));
 }
 function isSafeUrlLiteral(node) {
-    if (AST_NODE_TYPES.TemplateElement !== node.type && AST_NODE_TYPES.Literal !== node.type) {
-        return false;
-    }
-    if (typeof node.value !== 'string') {
-        return false;
-    }
-    return isSafeUrlString(node.value);
-}
-function isSafeUrlTemplate(node) {
-    if (AST_NODE_TYPES.TemplateLiteral !== node.type || 0 === node.quasis.length) {
-        return false;
-    }
-    // Basic scheme safety on the first static chunk
-    const firstChunk = node.quasis[0];
-    if (isSafeUrlLiteral(firstChunk)) {
-        return true;
-    }
-    return isUrlEncoded(node);
-}
-function isUrlEncoded(node) {
-    if (AST_NODE_TYPES.TemplateLiteral !== node.type) {
-        return false;
-    }
-    return Array.isArray(node.expressions) && node.expressions.length > 0 && node.expressions.every(isEncoded);
-}
-function isEncoded(node) {
-    if (AST_NODE_TYPES.CallExpression !== node.type) {
-        return false;
-    }
-    return AST_NODE_TYPES.Identifier === node.callee.type &&
-        ('encodeURIComponent' === node.callee.name || 'encodeURI' === node.callee.name);
+    return isLiteralString(node) && isSafeUrlString(node.value);
 }
 function isWindowLocationAssignment(node) {
     // window.location.<prop> = ...
@@ -60,16 +30,16 @@ function isWindowAssignment(node) {
         'window' === node.left.object.name &&
         WINDOW_PROPS.has(node.left.property.name));
 }
-function isWindowOrLocationMemberExpression(memberExpr) {
+function isWindowOrLocation(expression) {
     // Helper to detect a window.* or window.location.*
-    if (AST_NODE_TYPES.MemberExpression !== memberExpr.type) {
+    if (AST_NODE_TYPES.MemberExpression !== expression.type) {
         return false;
     }
-    if (AST_NODE_TYPES.Identifier === memberExpr.object.type && 'window' === memberExpr.object.name) {
+    if (AST_NODE_TYPES.Identifier === expression.object.type && 'window' === expression.object.name) {
         return true;
     }
-    if (AST_NODE_TYPES.MemberExpression === memberExpr.object.type) {
-        const memberObject = memberExpr.object;
+    if (AST_NODE_TYPES.MemberExpression === expression.object.type) {
+        const memberObject = expression.object;
         const isObjectWindow = AST_NODE_TYPES.Identifier === memberObject.object.type && 'window' === memberObject.object.name;
         const isPropertyLocation = AST_NODE_TYPES.Identifier === memberObject.property.type && 'location' === memberObject.property.name;
         return isObjectWindow && isPropertyLocation;
@@ -108,10 +78,7 @@ const plugin = {
                     if (!LOCATION_PROPS.has(propName)) {
                         return;
                     }
-                    if (isSafeUrlLiteral(rhsResolved) || isSafeUrlTemplate(rhsResolved)) {
-                        return;
-                    }
-                    if (isSanitized(rhsResolved)) {
+                    if (isSafeUrlLiteral(rhsResolved) || isSanitized(rhsResolved)) {
                         return;
                     }
                     context.report({
@@ -125,13 +92,13 @@ const plugin = {
                                 messageId: 'sanitize',
                                 fix: (fixer) => {
                                     const argText = context.sourceCode.getText(right);
-                                    return fixer.replaceText(right, `sanitize(${argText})`);
+                                    return fixer.replaceText(right, `sanitize( ${argText} )`);
                                 },
                             }, {
                                 messageId: 'domPurify',
                                 fix: (fixer) => {
                                     const argText = context.sourceCode.getText(right);
-                                    return fixer.replaceText(right, `DOMPurify.sanitize(${argText})`);
+                                    return fixer.replaceText(right, `DOMPurify.sanitize( ${argText} )`);
                                 },
                             },
                         ],
@@ -154,13 +121,13 @@ const plugin = {
                                 messageId: 'sanitize',
                                 fix: (fixer) => {
                                     const argText = context.sourceCode.getText(right);
-                                    return fixer.replaceText(right, `sanitize(${argText})`);
+                                    return fixer.replaceText(right, `sanitize( ${argText} )`);
                                 },
                             }, {
                                 messageId: 'domPurify',
                                 fix: (fixer) => {
                                     const argText = context.sourceCode.getText(right);
-                                    return fixer.replaceText(right, `DOMPurify.sanitize(${argText})`);
+                                    return fixer.replaceText(right, `DOMPurify.sanitize( ${argText} )`);
                                 },
                             },
                         ],
@@ -173,7 +140,7 @@ const plugin = {
                 if (AST_NODE_TYPES.AssignmentExpression === parent.type && parent.left === node) {
                     return;
                 }
-                if (!isWindowOrLocationMemberExpression(node) || !('name' in node.property)) {
+                if (!isWindowOrLocation(node) || !('name' in node.property)) {
                     return;
                 }
                 const propName = node.property.name;

package/plugins/security/utils/shared.js

@@ -1,5 +1,12 @@
 import { AST_NODE_TYPES, ESLintUtils } from '@typescript-eslint/utils';
 import {} from 'typescript';
+/**
+ * Is the node of type string.
+ * - String literals.
+ * - constants of type string.
+ * - template literals.
+ * - intrinsic type string.
+ */
 export function isStringLike(node, context) {
     const type = getType(node, context);
     const literal = type.isStringLiteral();
@@ -9,9 +16,9 @@ export function isStringLike(node, context) {
 /**
  * Get the TypeScript type of node.
  */
-export function getType(arg, context) {
+export function getType(expression, context) {
     const { getTypeAtLocation } = ESLintUtils.getParserServices(context);
-    const type = getTypeAtLocation(arg);
+    const type = getTypeAtLocation(expression);
     return type.getNonNullableType();
 }
 /**
@@ -22,10 +29,13 @@ export function getType(arg, context) {
  *
  * @link https://typescript-eslint.io/developers/custom-rules/#typed-rules
  */
-export function isDomElementType(arg, context) {
-    const element = getType(arg, context);
-    const name = element.getSymbol()?.escapedName ?? '';
+export function isDomElementType(expression, context) {
+    const type = getType(expression, context);
+    const name = type.getSymbol()?.escapedName ?? '';
     // Match any type that ends with "Element", e.g., HTMLElement, HTMLDivElement, Element, etc.
+    if ('Element' === name) {
+        return true;
+    }
     return name.startsWith('HTML') && name.endsWith('Element');
 }
 /**
@@ -45,3 +55,24 @@ export function isSanitized(node) {
     }
     return false;
 }
+/**
+ * Check if a node is a literal string
+ */
+export function isLiteralString(node) {
+    return AST_NODE_TYPES.Literal === node.type && 'string' === typeof node.value;
+}
+/**
+ * Check if a node is a literal string that is safe to use in an HTML context.
+ * - Must be a literal string.
+ * - Must not contain `<script`.
+ * - Must not start with a dangerous protocol (javascript:, data:, vbscript:, about:, livescript:).
+ */
+export function isSafeLiteralString(node) {
+    if (!isLiteralString(node)) {
+        return false;
+    }
+    if (node.value.includes('<script')) {
+        return false;
+    }
+    return !/^\s*(?:javascript|data|vbscript|about|livescript)\s*:/i.test(decodeURIComponent(node.value.replace(/[\u0000-\u001F\u007F]+/g, '')));
+}

package/types/plugins/security/index.d.ts

@@ -1,7 +1,7 @@
 import type { FlatConfig } from '@typescript-eslint/utils/ts-eslint';
 type Plugin = FlatConfig.Plugin & {
     configs: {
-        recommended: FlatConfig.ConfigArray;
+        recommended: FlatConfig.Config;
     };
 };
 declare const plugin: Plugin;

package/types/plugins/security/rules/dangerously-set-inner-html.d.ts

@@ -1,3 +1,4 @@
 import { type TSESLint } from '@typescript-eslint/utils';
-declare const plugin: TSESLint.RuleModule<'dangerousInnerHtml'>;
+type Messages = 'dangerousInnerHtml' | 'sanitize' | 'domPurify';
+declare const plugin: TSESLint.RuleModule<Messages>;
 export default plugin;

package/types/plugins/security/rules/html-string-concat.d.ts

@@ -1,3 +1,9 @@
-import { type TSESLint } from '@typescript-eslint/utils';
+import { type TSESLint, type TSESTree } from '@typescript-eslint/utils';
+/**
+ * Check if an expression contains any HTML-like strings.
+ * - Looks for `<` or `>` characters in string literals and template literals.
+ * - Recursively checks binary expressions with the ` + ` operator.
+ */
+export declare function hasHtmlLikeStrings(node: TSESTree.Expression | TSESTree.PrivateIdentifier): boolean;
 declare const plugin: TSESLint.RuleModule<'htmlStringConcat'>;
 export default plugin;

package/types/plugins/security/utils/shared.d.ts

@@ -1,10 +1,17 @@
 import { type TSESLint, type TSESTree } from '@typescript-eslint/utils';
 import { type Type } from 'typescript';
+/**
+ * Is the node of type string.
+ * - String literals.
+ * - constants of type string.
+ * - template literals.
+ * - intrinsic type string.
+ */
 export declare function isStringLike(node: TSESTree.CallExpressionArgument, context: Readonly<TSESLint.RuleContext<string, readonly []>>): boolean;
 /**
  * Get the TypeScript type of node.
  */
-export declare function getType<Context extends Readonly<TSESLint.RuleContext<string, readonly []>>>(arg: TSESTree.CallExpressionArgument, context: Context): Type;
+export declare function getType<Context extends Readonly<TSESLint.RuleContext<string, readonly []>>>(expression: TSESTree.CallExpressionArgument, context: Context): Type;
 /**
  * Is the type of variable being passed a DOM element?
  *
@@ -13,9 +20,20 @@ export declare function getType<Context extends Readonly<TSESLint.RuleContext<st
  *
  * @link https://typescript-eslint.io/developers/custom-rules/#typed-rules
  */
-export declare function isDomElementType<Context extends Readonly<TSESLint.RuleContext<string, readonly []>>>(arg: TSESTree.CallExpressionArgument, context: Context): boolean;
+export declare function isDomElementType<Context extends Readonly<TSESLint.RuleContext<string, readonly []>>>(expression: TSESTree.CallExpressionArgument, context: Context): boolean;
 /**
  * Check if a node is a call to a known sanitization function.
  * - Currently recognizes `sanitize(...)` and `DOMPurify.sanitize(...)`.
  */
 export declare function isSanitized(node: TSESTree.Property['value'] | TSESTree.CallExpressionArgument): boolean;
+/**
+ * Check if a node is a literal string
+ */
+export declare function isLiteralString(node: TSESTree.Property['value'] | TSESTree.CallExpressionArgument): node is TSESTree.StringLiteral;
+/**
+ * Check if a node is a literal string that is safe to use in an HTML context.
+ * - Must be a literal string.
+ * - Must not contain `<script`.
+ * - Must not start with a dangerous protocol (javascript:, data:, vbscript:, about:, livescript:).
+ */
+export declare function isSafeLiteralString(node: TSESTree.Property['value'] | TSESTree.CallExpressionArgument): boolean;