@stll/oxlint-plugin 0.2.2 → 0.3.0

package/dist/no-unsafe-inner-html.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"no-unsafe-inner-html.cjs","names":["getCalleeName","getPropertyName","unwrapExpression","isIdentifier"],"sources":["../src/no-unsafe-inner-html.ts"],"sourcesContent":["import { eslintCompatPlugin } from \"@oxlint/plugins\";\n// Forbid injecting un-proven HTML into the DOM.\n//\n// Raw HTML may only reach the DOM from a value that is provably sanitized or\n// escaped. This precise guard can replace a blanket `react/no-danger` rule:\n// approved sanitizer calls remain usable while unescaped stored or user input\n// cannot flow into `__html` or `el.innerHTML` unnoticed.\n//\n// Two sinks share one allowlist:\n//   • JSX `__html` property of a `dangerouslySetInnerHTML` object literal\n//     (report on the value expression).\n//   • `AssignmentExpression` whose LHS is a non-computed `.innerHTML`\n//     MemberExpression (report on the RHS).\n//\n// A value is allowed when it is:\n//   • a string Literal or TemplateLiteral whose interpolations are all\n//     independently proven safe (static markup, no raw injection), OR\n//   • a CallExpression whose callee is an HTML/DOM sanitizer or escaper\n//     (`escapeHtml`, `escapeXml`, `sanitizeHtml`, `sanitizeDom`,\n//     `DOMPurify.sanitize`), including a `.value` / `.data` / `.html`-style\n//     member read OFF such a call (some sanitizers return `{ value }`), OR\n//   • carries an explicit `// safe-html:` escape-hatch comment on the line\n//     directly above the sink (loc adjacency, like suppression-hygiene.ts).\n//\n// A value is NOT auto-allowed just because the identifier is named\n// `html` / `content` / `headline` / `body` — those are the sinks, not\n// proof of safety. Prove safety at the source or annotate with a reason.\n//\n// Flagged:\n//   <div dangerouslySetInnerHTML={{ __html: userInput }} />\n//   <div dangerouslySetInnerHTML={{ __html: hit.headline }} />   // unless annotated\n//   el.innerHTML = html;                                         // unless annotated\n//   el.innerHTML = data.body;\n//\n// Allowed:\n//   <div dangerouslySetInnerHTML={{ __html: sanitizeHtml(x) }} />\n//   <div dangerouslySetInnerHTML={{ __html: `<b>${escapeXml(n)}</b>` }} />\n//   <div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(x) }} />\n//   el.innerHTML = \"\";\n//   el.innerHTML = \"&nbsp;\";\n//   // safe-html: escaped by escapeAndHighlight()\n//   <div dangerouslySetInnerHTML={{ __html: hit.headline }} />\n\nimport {\n  getCalleeName,\n  getPropertyName,\n  isIdentifier,\n  unwrapExpression,\n} from \"./utils.ts\";\n\n// Callee names that prove the value was run through an HTML/DOM sanitizer or\n// escaper. Keep this narrow: `escapeRegex()` and `sanitizeFilename()` are not\n// HTML-safe.\nconst HTML_SANITIZER_LEAF_RE =\n  /^(?:escape(?:html|xml)|sanitize(?:html|dom)|purify(?:html|dom)|dompurify)$/iu;\n\nconst DOM_PURIFY_RE = /^dompurify$/iu;\n\n// Members that some sanitizers expose on their result object\n// (`sanitizeHtml(x).value`, `sanitizeHtml(x).html`). Reading one of these OFF a\n// sanitizer call is still proven-safe.\nconst SANITIZER_RESULT_MEMBERS = new Set([\"value\", \"data\", \"html\"]);\n\nconst ESCAPE_HATCH_RE = /^\\s*safe-html:/u;\n\nconst isComment = (value) =>\n  typeof value === \"object\" &&\n  value !== null &&\n  typeof value.value === \"string\" &&\n  typeof value.loc === \"object\" &&\n  value.loc !== null;\n\nconst isJsxIdentifier = (node, name) =>\n  typeof node === \"object\" &&\n  node !== null &&\n  node.type === \"JSXIdentifier\" &&\n  node.name === name;\n\nconst isHtmlSanitizerCalleeName = (dotted) => {\n  const parts = dotted.split(\".\");\n  const leaf = parts.at(-1);\n  if (leaf === undefined) {\n    return false;\n  }\n  if (HTML_SANITIZER_LEAF_RE.test(leaf)) {\n    return true;\n  }\n  const objectName = parts.at(-2);\n  return leaf === \"sanitize\" && DOM_PURIFY_RE.test(objectName ?? \"\");\n};\n\nconst isSanitizerCall = (node) => {\n  if (node.type !== \"CallExpression\") {\n    return false;\n  }\n  const dotted = getCalleeName(node.callee);\n  return dotted !== null && isHtmlSanitizerCalleeName(dotted);\n};\n\n// A value is proven safe by its own shape (independent of any comment):\n// static string, or the result of a sanitizer call (directly, or via a\n// `.value`/`.data`/`.html` accessor off the call).\nconst isProvenSafeValue = (node) => {\n  if (!node || typeof node.type !== \"string\") {\n    return false;\n  }\n  if (node.type === \"Literal\" && typeof node.value === \"string\") {\n    return true;\n  }\n  if (node.type === \"TemplateLiteral\") {\n    return (\n      Array.isArray(node.expressions) &&\n      node.expressions.every(isProvenSafeValue)\n    );\n  }\n  if (isSanitizerCall(node)) {\n    return true;\n  }\n  // `sanitize(x).value`, `purify(x).html` — a result accessor off a call.\n  if (\n    node.type === \"MemberExpression\" &&\n    node.computed === false &&\n    isProvenSafeMemberLeaf(node)\n  ) {\n    return true;\n  }\n  return false;\n};\n\nconst isProvenSafeMemberLeaf = (node) => {\n  const propertyName = getPropertyName(node.property);\n  if (propertyName === null || !SANITIZER_RESULT_MEMBERS.has(propertyName)) {\n    return false;\n  }\n  return isSanitizerCall(node.object);\n};\n\nconst isDangerouslySetInnerHtmlValue = (property) => {\n  if (getPropertyName(property.key) !== \"__html\") {\n    return false;\n  }\n  const objectExpression = property.parent;\n  if (objectExpression?.type !== \"ObjectExpression\") {\n    return false;\n  }\n\n  let current = objectExpression.parent;\n  while (\n    current?.type === \"TSAsExpression\" ||\n    current?.type === \"TSSatisfiesExpression\"\n  ) {\n    current = current.parent;\n  }\n\n  if (current?.type !== \"JSXExpressionContainer\") {\n    return false;\n  }\n  const attribute = current.parent;\n  return (\n    attribute?.type === \"JSXAttribute\" &&\n    isJsxIdentifier(attribute.name, \"dangerouslySetInnerHTML\")\n  );\n};\n\nexport default eslintCompatPlugin({\n  meta: { name: \"no-unsafe-inner-html\" },\n  rules: {\n    \"no-unsafe-inner-html\": {\n      meta: {\n        type: \"problem\",\n        messages: {\n          unsafeInnerHtml:\n            \"Raw HTML injected into the DOM must come from a provably \" +\n            \"sanitized/escaped value: a static string, an HTML/DOM \" +\n            \"sanitize/escape call (or its .value/.data/.html result). \" +\n            \"Wrap the value in a sanitizer, or add a `// safe-html: <reason \" +\n            \"naming the sanitizer/source>` comment on the line directly above \" +\n            \"if it is escaped at its source.\",\n          unsafeInnerHtmlSpread:\n            \"Do not spread an object into dangerouslySetInnerHTML. Keep \" +\n            \"`__html` inline so this rule can prove the HTML value is \" +\n            \"sanitized or escaped.\",\n        },\n      },\n      createOnce(context) {\n        const escapeHatchLines = new Set();\n\n        const recordEscapeHatches = (node) => {\n          const comments =\n            node && Array.isArray(node.comments)\n              ? node.comments.filter(isComment)\n              : [];\n          for (const comment of comments) {\n            if (ESCAPE_HATCH_RE.test(comment.value)) {\n              escapeHatchLines.add(comment.loc.end.line);\n            }\n          }\n        };\n\n        // The escape-hatch comment sits on the line directly above the\n        // reported node's first line. Sink expressions inside JSX object\n        // literals span multiple lines, so anchor on the node's start line.\n        const hasEscapeHatchAbove = (node) =>\n          escapeHatchLines.has(node.loc.start.line - 1);\n\n        const reportIfUnsafe = (node) => {\n          if (isProvenSafeValue(node)) {\n            return;\n          }\n          if (hasEscapeHatchAbove(node)) {\n            return;\n          }\n          context.report({ node, messageId: \"unsafeInnerHtml\" });\n        };\n\n        const reportPayloadSpreads = (objectNode) => {\n          for (const property of objectNode.properties) {\n            if (property?.type !== \"SpreadElement\") {\n              continue;\n            }\n            context.report({\n              node: property,\n              messageId: \"unsafeInnerHtmlSpread\",\n            });\n          }\n        };\n\n        return {\n          before() {\n            escapeHatchLines.clear();\n          },\n          Program(node) {\n            recordEscapeHatches(node);\n          },\n\n          // Reject hoisted payloads such as\n          // `dangerouslySetInnerHTML={payload}`. Keeping the `__html` object\n          // inline lets this rule inspect the actual HTML expression.\n          JSXAttribute(node) {\n            if (!isJsxIdentifier(node.name, \"dangerouslySetInnerHTML\")) {\n              return;\n            }\n            const value = node.value;\n            if (value?.type !== \"JSXExpressionContainer\") {\n              return;\n            }\n            if (!value.expression) {\n              return;\n            }\n            const expression = unwrapExpression(value.expression);\n            if (expression?.type === \"ObjectExpression\") {\n              reportPayloadSpreads(expression);\n              return;\n            }\n            reportIfUnsafe(value.expression);\n          },\n\n          // Sink 1: `dangerouslySetInnerHTML={{ __html: <expr> }}`.\n          Property(node) {\n            if (!isDangerouslySetInnerHtmlValue(node)) {\n              return;\n            }\n            reportIfUnsafe(node.value);\n          },\n\n          // Sink 2: `<el>.innerHTML = <expr>` (non-computed member LHS).\n          AssignmentExpression(node) {\n            const target = node.left;\n            if (\n              target.type !== \"MemberExpression\" ||\n              target.computed !== false ||\n              !isIdentifier(target.property, \"innerHTML\")\n            ) {\n              return;\n            }\n            reportIfUnsafe(node.right);\n          },\n        };\n      },\n    },\n  },\n});\n"],"mappings":";;;;;;;AAqDA,MAAM,yBACJ;AAEF,MAAM,gBAAgB;AAKtB,MAAM,2CAA2B,IAAI,IAAI;CAAC;CAAS;CAAQ;AAAM,CAAC;AAElE,MAAM,kBAAkB;AAExB,MAAM,aAAa,UACjB,OAAO,UAAU,YACjB,UAAU,QACV,OAAO,MAAM,UAAU,YACvB,OAAO,MAAM,QAAQ,YACrB,MAAM,QAAQ;AAEhB,MAAM,mBAAmB,MAAM,SAC7B,OAAO,SAAS,YAChB,SAAS,QACT,KAAK,SAAS,mBACd,KAAK,SAAS;AAEhB,MAAM,6BAA6B,WAAW;CAC5C,MAAM,QAAQ,OAAO,MAAM,GAAG;CAC9B,MAAM,OAAO,MAAM,GAAG,EAAE;CACxB,IAAI,SAAS,KAAA,GACX,OAAO;CAET,IAAI,uBAAuB,KAAK,IAAI,GAClC,OAAO;CAET,MAAM,aAAa,MAAM,GAAG,EAAE;CAC9B,OAAO,SAAS,cAAc,cAAc,KAAK,cAAc,EAAE;AACnE;AAEA,MAAM,mBAAmB,SAAS;CAChC,IAAI,KAAK,SAAS,kBAChB,OAAO;CAET,MAAM,SAASA,cAAAA,cAAc,KAAK,MAAM;CACxC,OAAO,WAAW,QAAQ,0BAA0B,MAAM;AAC5D;AAKA,MAAM,qBAAqB,SAAS;CAClC,IAAI,CAAC,QAAQ,OAAO,KAAK,SAAS,UAChC,OAAO;CAET,IAAI,KAAK,SAAS,aAAa,OAAO,KAAK,UAAU,UACnD,OAAO;CAET,IAAI,KAAK,SAAS,mBAChB,OACE,MAAM,QAAQ,KAAK,WAAW,KAC9B,KAAK,YAAY,MAAM,iBAAiB;CAG5C,IAAI,gBAAgB,IAAI,GACtB,OAAO;CAGT,IACE,KAAK,SAAS,sBACd,KAAK,aAAa,SAClB,uBAAuB,IAAI,GAE3B,OAAO;CAET,OAAO;AACT;AAEA,MAAM,0BAA0B,SAAS;CACvC,MAAM,eAAeC,cAAAA,gBAAgB,KAAK,QAAQ;CAClD,IAAI,iBAAiB,QAAQ,CAAC,yBAAyB,IAAI,YAAY,GACrE,OAAO;CAET,OAAO,gBAAgB,KAAK,MAAM;AACpC;AAEA,MAAM,kCAAkC,aAAa;CACnD,IAAIA,cAAAA,gBAAgB,SAAS,GAAG,MAAM,UACpC,OAAO;CAET,MAAM,mBAAmB,SAAS;CAClC,IAAI,kBAAkB,SAAS,oBAC7B,OAAO;CAGT,IAAI,UAAU,iBAAiB;CAC/B,OACE,SAAS,SAAS,oBAClB,SAAS,SAAS,yBAElB,UAAU,QAAQ;CAGpB,IAAI,SAAS,SAAS,0BACpB,OAAO;CAET,MAAM,YAAY,QAAQ;CAC1B,OACE,WAAW,SAAS,kBACpB,gBAAgB,UAAU,MAAM,yBAAyB;AAE7D;AAEA,IAAA,gCAAA,GAAA,gBAAA,mBAAA,CAAkC;CAChC,MAAM,EAAE,MAAM,uBAAuB;CACrC,OAAO,EACL,wBAAwB;EACtB,MAAM;GACJ,MAAM;GACN,UAAU;IACR,iBACE;IAMF,uBACE;GAGJ;EACF;EACA,WAAW,SAAS;GAClB,MAAM,mCAAmB,IAAI,IAAI;GAEjC,MAAM,uBAAuB,SAAS;IACpC,MAAM,WACJ,QAAQ,MAAM,QAAQ,KAAK,QAAQ,IAC/B,KAAK,SAAS,OAAO,SAAS,IAC9B,CAAC;IACP,KAAK,MAAM,WAAW,UACpB,IAAI,gBAAgB,KAAK,QAAQ,KAAK,GACpC,iBAAiB,IAAI,QAAQ,IAAI,IAAI,IAAI;GAG/C;GAKA,MAAM,uBAAuB,SAC3B,iBAAiB,IAAI,KAAK,IAAI,MAAM,OAAO,CAAC;GAE9C,MAAM,kBAAkB,SAAS;IAC/B,IAAI,kBAAkB,IAAI,GACxB;IAEF,IAAI,oBAAoB,IAAI,GAC1B;IAEF,QAAQ,OAAO;KAAE;KAAM,WAAW;IAAkB,CAAC;GACvD;GAEA,MAAM,wBAAwB,eAAe;IAC3C,KAAK,MAAM,YAAY,WAAW,YAAY;KAC5C,IAAI,UAAU,SAAS,iBACrB;KAEF,QAAQ,OAAO;MACb,MAAM;MACN,WAAW;KACb,CAAC;IACH;GACF;GAEA,OAAO;IACL,SAAS;KACP,iBAAiB,MAAM;IACzB;IACA,QAAQ,MAAM;KACZ,oBAAoB,IAAI;IAC1B;IAKA,aAAa,MAAM;KACjB,IAAI,CAAC,gBAAgB,KAAK,MAAM,yBAAyB,GACvD;KAEF,MAAM,QAAQ,KAAK;KACnB,IAAI,OAAO,SAAS,0BAClB;KAEF,IAAI,CAAC,MAAM,YACT;KAEF,MAAM,aAAaC,cAAAA,iBAAiB,MAAM,UAAU;KACpD,IAAI,YAAY,SAAS,oBAAoB;MAC3C,qBAAqB,UAAU;MAC/B;KACF;KACA,eAAe,MAAM,UAAU;IACjC;IAGA,SAAS,MAAM;KACb,IAAI,CAAC,+BAA+B,IAAI,GACtC;KAEF,eAAe,KAAK,KAAK;IAC3B;IAGA,qBAAqB,MAAM;KACzB,MAAM,SAAS,KAAK;KACpB,IACE,OAAO,SAAS,sBAChB,OAAO,aAAa,SACpB,CAACC,cAAAA,aAAa,OAAO,UAAU,WAAW,GAE1C;KAEF,eAAe,KAAK,KAAK;IAC3B;GACF;EACF;CACF,EACF;AACF,CAAC"}
+{"version":3,"file":"no-unsafe-inner-html.cjs","names":["unwrapExpression","isIdentifier","memberPropertyName","isAstNode","isStringLiteral","staticStringValue","getPropertyName","resolveLiteralArraySpreads","eslintCompatPlugin","invokedCallee","exhaustive"],"sources":["../src/no-unsafe-inner-html.ts"],"sourcesContent":["// Forbid injecting un-proven HTML into the DOM.\n//\n// Raw HTML may only reach the DOM from a value that is provably sanitized or\n// escaped. This rule covers common DOM and JSX sinks while allowing explicit\n// sanitizer calls and narrowly scoped provenance comments.\n//\n// Sinks, all sharing one allowlist:\n//   • `__html` of a `dangerouslySetInnerHTML` object, whether the object is a\n//     JSX attribute value or a property of any object literal (props passed\n//     to `createElement` / `jsx()`, or spread into JSX).\n//   • assignment to `innerHTML`, `outerHTML` or `srcdoc`, dot or static\n//     bracket notation, and the same keys in an `Object.assign` source.\n//   • the JSX `srcDoc` attribute.\n//   • `insertAdjacentHTML`, `setHTMLUnsafe`, `createContextualFragment`,\n//     `setAttribute(\"srcdoc\", …)`, and `write` / `writeln` on a document.\n//\n// In the default `allowlist` policy, a value is allowed when it is:\n//   • a static string Literal or TemplateLiteral whose interpolations are all\n//     independently static, OR\n//   • passed through the shared HTML sanitizer allowlist (`escapeHtml`,\n//     `escapeXml`, `sanitizeHtml`, `sanitizeDom`, `DOMPurify.sanitize`, and\n//     related established names), including `.value` / `.data` / `.html`\n//     result accessors; OR\n//   • annotated by a `// safe-html: <provenance>` comment with non-empty text\n//     on the line directly above the sink. One comment covers one sink: a\n//     second sink starting on the same line needs its own annotation.\n// The `provenance` policy omits the sanitizer-name allowlist and requires the\n// comment for dynamic sanitizer results as well.\n//\n// The sanitizer allowlist preserves the shared plugin contract. For dynamic\n// values outside that list, function names are not proof: a local identity\n// function can be named `sanitizeHtml`. Add explicit provenance at the sink\n// until the codebase has a branded SafeHtml boundary.\n\nimport type { Scope, Variable } from \"@oxlint/plugins\";\nimport { eslintCompatPlugin } from \"@oxlint/plugins\";\n\nimport type { AstNode, LiteralArgumentResolution } from \"./utils.ts\";\nimport {\n  getPropertyName,\n  invokedCallee,\n  isAstNode,\n  isIdentifier,\n  isStringLiteral,\n  memberPropertyName,\n  resolveLiteralArraySpreads,\n  staticStringValue,\n  unwrapExpression,\n} from \"./utils.ts\";\n\ntype DomElementProducer = {\n  name: string;\n  kind: \"property\" | \"method\" | \"collection\";\n  receiver: \"document\" | \"element\" | \"either\";\n};\n\n// DOM element provenance and the generated equivalence corpus share this table.\nexport const DOM_ELEMENT_PRODUCERS = [\n  { name: \"body\", kind: \"property\", receiver: \"document\" },\n  { name: \"head\", kind: \"property\", receiver: \"document\" },\n  { name: \"documentElement\", kind: \"property\", receiver: \"document\" },\n  { name: \"activeElement\", kind: \"property\", receiver: \"document\" },\n  { name: \"scrollingElement\", kind: \"property\", receiver: \"document\" },\n  { name: \"fullscreenElement\", kind: \"property\", receiver: \"document\" },\n  { name: \"createElement\", kind: \"method\", receiver: \"document\" },\n  { name: \"createElementNS\", kind: \"method\", receiver: \"document\" },\n  { name: \"getElementById\", kind: \"method\", receiver: \"document\" },\n  { name: \"querySelector\", kind: \"method\", receiver: \"either\" },\n  { name: \"closest\", kind: \"method\", receiver: \"element\" },\n  { name: \"elementFromPoint\", kind: \"method\", receiver: \"document\" },\n  { name: \"getElementsByClassName\", kind: \"collection\", receiver: \"either\" },\n  { name: \"getElementsByTagName\", kind: \"collection\", receiver: \"either\" },\n  { name: \"getElementsByTagNameNS\", kind: \"collection\", receiver: \"either\" },\n  { name: \"getElementsByName\", kind: \"collection\", receiver: \"document\" },\n  { name: \"querySelectorAll\", kind: \"collection\", receiver: \"either\" },\n  { name: \"parentElement\", kind: \"property\", receiver: \"element\" },\n  { name: \"firstElementChild\", kind: \"property\", receiver: \"element\" },\n  { name: \"lastElementChild\", kind: \"property\", receiver: \"element\" },\n  { name: \"nextElementSibling\", kind: \"property\", receiver: \"element\" },\n  { name: \"previousElementSibling\", kind: \"property\", receiver: \"element\" },\n  { name: \"offsetParent\", kind: \"property\", receiver: \"element\" },\n] as const satisfies readonly DomElementProducer[];\n\n// The provenance text after the marker must be non-empty.\nconst WAIVER_RE = /^\\s*safe-html:\\s*\\S/u;\n\nexport const REACT_HTML_PROPS = [\n  { name: \"dangerouslySetInnerHTML\", kind: \"payload\", htmlKey: \"__html\" },\n  { name: \"srcDoc\", kind: \"value\" },\n  { name: \"srcdoc\", kind: \"value\" },\n] as const;\ntype ReactHtmlProp = (typeof REACT_HTML_PROPS)[number];\nconst REACT_ELEMENT_FACTORIES: ReadonlySet<string> = new Set([\n  \"createElement\",\n  \"React.createElement\",\n  \"jsx\",\n  \"jsxs\",\n  \"jsxDEV\",\n]);\nconst HTML_PROPERTIES: ReadonlySet<string> = new Set([\n  \"innerHTML\",\n  \"outerHTML\",\n  \"srcdoc\",\n]);\n// Methods whose first argument is parsed as HTML.\nconst HTML_FIRST_ARGUMENT_METHODS: ReadonlySet<string> = new Set([\n  \"createContextualFragment\",\n  \"setHTMLUnsafe\",\n]);\nconst DOCUMENT_WRITE_METHODS: ReadonlySet<string> = new Set([\n  \"write\",\n  \"writeln\",\n]);\nconst DOCUMENT_MEMBERS: ReadonlySet<string> = new Set([\n  \"contentDocument\",\n  \"document\",\n  \"ownerDocument\",\n]);\n\nconst HTML_SANITIZER_LEAF_RE =\n  /^(?:escape(?:html|xml)|sanitize(?:html|dom)|purify(?:html|dom)|dompurify)$/iu;\nconst SANITIZER_RESULT_MEMBERS = new Set([\"value\", \"data\", \"html\"]);\nconst SANITIZER_POLICY = {\n  allowlist: \"allowlist\",\n  provenance: \"provenance\",\n} as const;\nconst SANITIZER_POLICY_VALUES = Object.values(SANITIZER_POLICY);\ntype SanitizerPolicy = (typeof SANITIZER_POLICY)[keyof typeof SANITIZER_POLICY];\n\nconst sanitizerPolicyFrom = (option: unknown): SanitizerPolicy => {\n  if (option === undefined) {\n    return SANITIZER_POLICY.allowlist;\n  }\n  if (typeof option !== \"object\" || option === null || Array.isArray(option)) {\n    throw new Error(\"no-unsafe-inner-html options must be an object\");\n  }\n  const policy = Reflect.get(option, \"sanitizerPolicy\");\n  switch (policy) {\n    case undefined:\n    case SANITIZER_POLICY.allowlist:\n      return SANITIZER_POLICY.allowlist;\n    case SANITIZER_POLICY.provenance:\n      return SANITIZER_POLICY.provenance;\n    default:\n      throw new Error(`unknown sanitizer policy: ${String(policy)}`);\n  }\n};\n\n// Use the same static member-name resolution for sinks and safe-value proofs.\nconst staticCalleeName = (node: unknown): string | null => {\n  const expression = unwrapExpression(node);\n  if (isIdentifier(expression)) return expression.name;\n  if (expression?.type !== \"MemberExpression\") return null;\n  const receiver = staticCalleeName(expression.object);\n  const property = memberPropertyName(expression);\n  return receiver === null || property === null\n    ? null\n    : `${receiver}.${property}`;\n};\n\nconst isSanitizerCall = (node: unknown): boolean => {\n  if (!isAstNode(node) || node.type !== \"CallExpression\") {\n    return false;\n  }\n  const dotted = staticCalleeName(node.callee);\n  if (dotted === null) {\n    return false;\n  }\n  const parts = dotted.split(\".\");\n  const leaf = parts.at(-1);\n  if (leaf === undefined) {\n    return false;\n  }\n  if (HTML_SANITIZER_LEAF_RE.test(leaf)) {\n    return true;\n  }\n  return leaf === \"sanitize\" && /^dompurify$/iu.test(parts.at(-2) ?? \"\");\n};\n\nconst isSanitizerResult = (node: unknown): boolean => {\n  const expression = unwrapExpression(node);\n  if (expression?.type !== \"MemberExpression\") {\n    return false;\n  }\n  const property = memberPropertyName(expression);\n  return (\n    property !== null &&\n    SANITIZER_RESULT_MEMBERS.has(property) &&\n    isSanitizerCall(expression.object)\n  );\n};\n\ntype Located = { loc: { start: { line: number } } };\n\nconst hasLocation = (node: unknown): node is Located =>\n  typeof node === \"object\" &&\n  node !== null &&\n  \"loc\" in node &&\n  typeof node.loc === \"object\" &&\n  node.loc !== null &&\n  \"start\" in node.loc &&\n  typeof node.loc.start === \"object\" &&\n  node.loc.start !== null &&\n  \"line\" in node.loc.start &&\n  typeof node.loc.start.line === \"number\";\n\n// A node without location data never matches a waiver line.\nconst startLine = (node: unknown): number =>\n  hasLocation(node) ? node.loc.start.line : Number.NaN;\n\ntype WaiverComment = {\n  value: string;\n  loc: { end: { line: number } };\n};\n\nconst isWaiverComment = (value: unknown): value is WaiverComment =>\n  typeof value === \"object\" &&\n  value !== null &&\n  \"value\" in value &&\n  typeof value.value === \"string\" &&\n  WAIVER_RE.test(value.value) &&\n  \"loc\" in value &&\n  typeof value.loc === \"object\" &&\n  value.loc !== null;\n\nconst jsxAttributeName = (node: unknown): string | null =>\n  isAstNode(node) && node.type === \"JSXIdentifier\" && typeof node.name === \"string\"\n    ? node.name\n    : null;\n\n// A value is proven safe by its own static shape, independent of comments.\nconst isProvenSafeValue = (\n  node: unknown,\n  sanitizerPolicy: SanitizerPolicy,\n): boolean => {\n  const expression = unwrapExpression(node);\n  if (expression === null) {\n    return false;\n  }\n  if (isStringLiteral(expression)) {\n    return true;\n  }\n  if (\n    sanitizerPolicy === SANITIZER_POLICY.allowlist &&\n    (isSanitizerCall(expression) || isSanitizerResult(expression))\n  ) {\n    return true;\n  }\n  return (\n    expression.type === \"TemplateLiteral\" &&\n    Array.isArray(expression.expressions) &&\n    expression.expressions.every((entry) =>\n      isProvenSafeValue(entry, sanitizerPolicy),\n    )\n  );\n};\n\n// The static key of an object-literal Property: `a`, `\"a\"`, `[\"a\"]`.\nconst objectPropertyKey = (property: unknown): string | null => {\n  if (!isAstNode(property)) {\n    return null;\n  }\n  if (property.computed === true) {\n    return staticStringValue(property.key);\n  }\n  return getPropertyName(property.key);\n};\n\nconst isOpaqueProperty = (property: AstNode): boolean =>\n  property.type === \"SpreadElement\" ||\n  (property.type === \"Property\" &&\n    property.computed === true &&\n    objectPropertyKey(property) === null);\n\nconst objectProperties = (node: unknown): AstNode[] => {\n  const expression = unwrapExpression(node);\n  if (\n    expression?.type !== \"ObjectExpression\" ||\n    !Array.isArray(expression.properties)\n  ) {\n    return [];\n  }\n  return expression.properties.filter(isAstNode);\n};\n\ntype AppliedArguments = LiteralArgumentResolution;\n\nconst appliedArgumentsFor = (args: unknown[]): AppliedArguments => {\n  const applied = unwrapExpression(args.at(1));\n  if (\n    applied === null ||\n    (applied.type === \"Literal\" && applied.value === null) ||\n    isIdentifier(applied, \"undefined\")\n  ) {\n    return { status: \"known\", args: [] };\n  }\n  if (applied.type !== \"ArrayExpression\" || !Array.isArray(applied.elements)) {\n    return { status: \"opaque\", args: [], spread: args.at(1), tail: [] };\n  }\n  return resolveLiteralArraySpreads(applied.elements);\n};\n\n// The arguments the invoked function receives: `f.call(thisArg, ...args)`\n// shifts them by one; `f.apply(thisArg, [...])` forwards a literal array.\nconst invokedArguments = (call: unknown): AppliedArguments => {\n  if (!isAstNode(call)) {\n    return { status: \"known\", args: [] };\n  }\n  const rawArguments = Array.isArray(call.arguments) ? call.arguments : [];\n  const resolved = resolveLiteralArraySpreads(rawArguments);\n  const callee = unwrapExpression(call.callee);\n  if (callee?.type !== \"MemberExpression\") return resolved;\n  const method = memberPropertyName(callee);\n  if (method === \"call\") {\n    return { ...resolved, args: resolved.args.slice(1) };\n  }\n  if (method !== \"apply\") return resolved;\n  if (resolved.status === \"opaque\") {\n    if (resolved.args.length >= 2) return appliedArgumentsFor(resolved.args);\n    return { ...resolved, args: [], tail: [] };\n  }\n  return appliedArgumentsFor(resolved.args);\n};\n\n// `document.write`, `window.document.write`, `frame.contentDocument.write`,\n// `node.ownerDocument.write`.\nconst isDocumentReceiver = (node: unknown): boolean => {\n  const receiver = unwrapExpression(node);\n  if (isIdentifier(receiver, \"document\")) {\n    return true;\n  }\n  if (receiver?.type !== \"MemberExpression\") {\n    return false;\n  }\n  const name = memberPropertyName(receiver);\n  return name !== null && DOCUMENT_MEMBERS.has(name);\n};\n\nexport default eslintCompatPlugin({\n  meta: { name: \"no-unsafe-inner-html\" },\n  rules: {\n    \"no-unsafe-inner-html\": {\n      meta: {\n        type: \"problem\",\n        schema: [\n          {\n            type: \"object\",\n            properties: {\n              sanitizerPolicy: {\n                type: \"string\",\n                enum: SANITIZER_POLICY_VALUES,\n              },\n            },\n            additionalProperties: false,\n          },\n        ],\n        messages: {\n          unsafeInnerHtml:\n            \"Dynamic HTML injected into the DOM must be static, proven by \" +\n            \"the configured sanitizer policy, or have an adjacent \" +\n            \"`// safe-html: <provenance>` comment naming the trusted source. \" +\n            \"Function names outside the allowlist are not proof because a \" +\n            \"local identity function can shadow them.\",\n          unsafeInnerHtmlSpread:\n            \"Do not spread an object into dangerouslySetInnerHTML. Keep \" +\n            \"`__html` inline so this rule can prove the HTML value is \" +\n            \"sanitized or escaped.\",\n        },\n      },\n      createOnce(context) {\n        type DomTargetOptions = {\n          node: unknown;\n          scope: Scope;\n          seen?: Set<Variable>;\n          kind?: \"element\" | \"collection\";\n        };\n        const isKnownDomTarget = ({\n          node,\n          scope,\n          seen = new Set<Variable>(),\n          kind = \"element\",\n        }: DomTargetOptions): boolean => {\n          const target = unwrapExpression(node);\n          if (isIdentifier(target)) {\n            let current: Scope | null = scope;\n            while (current !== null) {\n              const variable = current.set.get(target.name);\n              if (variable === undefined) {\n                current = current.upper;\n                continue;\n              }\n              if (variable.defs.length === 0) {\n                return kind === \"element\" && isDocumentReceiver(target);\n              }\n              if (seen.has(variable)) return false;\n              seen.add(variable);\n              const definition = variable.defs.at(0);\n              if (\n                variable.defs.length !== 1 ||\n                definition?.type !== \"Variable\" ||\n                definition.node.type !== \"VariableDeclarator\" ||\n                definition.node.id.type !== \"Identifier\" ||\n                definition.node.init === null ||\n                variable.references.some(\n                  (reference) => reference.isWrite() && !reference.init,\n                )\n              ) {\n                return false;\n              }\n              return isKnownDomTarget({\n                node: definition.node.init,\n                scope: context.sourceCode.getScope(definition.node),\n                seen,\n                kind,\n              });\n            }\n          }\n          const hasProducerReceiver = (\n            receiver: unknown,\n            producer: DomElementProducer,\n          ): boolean => {\n            if (\n              producer.receiver !== \"element\" &&\n              isDocumentReceiver(receiver)\n            ) {\n              return true;\n            }\n            return (\n              producer.receiver !== \"document\" &&\n              isKnownDomTarget({ node: receiver, scope, seen })\n            );\n          };\n          const isElementCollection = (collection: unknown): boolean =>\n            isKnownDomTarget({ node: collection, scope, seen, kind: \"collection\" });\n          if (kind === \"element\" && target?.type === \"MemberExpression\") {\n            const property = memberPropertyName(target);\n            const producer = DOM_ELEMENT_PRODUCERS.find(\n              (entry) => entry.kind === \"property\" && entry.name === property,\n            );\n            if (producer !== undefined) {\n              return hasProducerReceiver(target.object, producer);\n            }\n            const index = unwrapExpression(target.property);\n            if (\n              target.computed === true &&\n              index?.type === \"Literal\" &&\n              typeof index.value === \"number\" &&\n              Number.isInteger(index.value) &&\n              index.value >= 0\n            ) {\n              return isElementCollection(target.object);\n            }\n          }\n          if (target?.type === \"CallExpression\") {\n            const callee = invokedCallee(target);\n            if (callee?.type !== \"MemberExpression\") return false;\n            const method = memberPropertyName(callee);\n            if (\n              kind === \"element\" &&\n              method === \"item\" &&\n              isElementCollection(callee.object)\n            ) {\n              return true;\n            }\n            const producer = DOM_ELEMENT_PRODUCERS.find(\n              (entry) =>\n                entry.kind === (kind === \"collection\" ? \"collection\" : \"method\") &&\n                entry.name === method,\n            );\n            return (\n              producer !== undefined &&\n              hasProducerReceiver(callee.object, producer)\n            );\n          }\n          return kind === \"element\" && isDocumentReceiver(target);\n        };\n\n        let sanitizerPolicy: SanitizerPolicy = SANITIZER_POLICY.allowlist;\n        // Associate waivers after visiting the file, so source position decides\n        // the first covered sink even when AST visitors inspect values out of order.\n        const waiverLines = new Set<number>();\n        type SinkObservation = {\n          node: AstNode;\n          kind: \"safe\" | \"unsafe\" | \"opaque-payload\";\n        };\n        const sinks: SinkObservation[] = [];\n        const observeSink = (\n          node: unknown,\n          kind: SinkObservation[\"kind\"],\n        ): void => {\n          if (isAstNode(node)) sinks.push({ node, kind });\n        };\n\n        const consumeWaiver = (node: unknown): boolean => {\n          const line = startLine(node) - 1;\n          if (!waiverLines.has(line)) {\n            return false;\n          }\n          waiverLines.delete(line);\n          return true;\n        };\n\n        const reportIfUnsafe = (node: unknown): void => {\n          observeSink(\n            node,\n            isProvenSafeValue(node, sanitizerPolicy) ? \"safe\" : \"unsafe\",\n          );\n        };\n\n        // The value of a `dangerouslySetInnerHTML` prop: an inline object has\n        // its `__html` checked and its spreads rejected; anything else is a\n        // hoisted payload whose HTML this rule cannot see.\n        const checkDangerousPayload = (value: unknown, htmlKey: string): void => {\n          const expression = unwrapExpression(value);\n          if (expression?.type !== \"ObjectExpression\") {\n            reportIfUnsafe(value);\n            return;\n          }\n          for (const property of objectProperties(expression)) {\n            if (isOpaqueProperty(property)) {\n              observeSink(property, \"opaque-payload\");\n              continue;\n            }\n            if (\n              property.type === \"Property\" &&\n              objectPropertyKey(property) === htmlKey\n            ) {\n              reportIfUnsafe(property.value);\n            }\n          }\n        };\n\n        const checkReactHtmlProp = (prop: ReactHtmlProp, value: unknown): void => {\n          switch (prop.kind) {\n            case \"payload\":\n              checkDangerousPayload(value, prop.htmlKey);\n              return;\n            case \"value\":\n              reportIfUnsafe(value);\n              return;\n            default: {\n              const exhaustive: never = prop;\n              throw new Error(`Unknown React HTML prop: ${String(exhaustive)}`);\n            }\n          }\n        };\n\n        const checkHtmlPropertySources = (\n          sources: unknown[],\n          domTarget: boolean,\n        ): void => {\n          for (const source of sources) {\n            const expression = unwrapExpression(source);\n            if (expression?.type !== \"ObjectExpression\") {\n              if (domTarget) {\n                reportIfUnsafe(source);\n              }\n              continue;\n            }\n            for (const property of objectProperties(source)) {\n              if (isOpaqueProperty(property)) {\n                if (domTarget) {\n                  reportIfUnsafe(property);\n                }\n                continue;\n              }\n              const key =\n                property.type === \"Property\"\n                  ? objectPropertyKey(property)\n                  : null;\n              if (key !== null && HTML_PROPERTIES.has(key)) {\n                reportIfUnsafe(property.value);\n              }\n            }\n          }\n        };\n\n        return {\n          before() {\n            sanitizerPolicy = sanitizerPolicyFrom(context.options.at(0));\n            waiverLines.clear();\n            sinks.length = 0;\n          },\n          \"Program:exit\"() {\n            sinks.sort((left, right) => left.node.range[0] - right.node.range[0]);\n            for (const { node, kind } of sinks) {\n              const waived = consumeWaiver(node);\n              if (kind === \"safe\" || (kind === \"unsafe\" && waived)) continue;\n              context.report({\n                node,\n                messageId:\n                  kind === \"opaque-payload\"\n                    ? \"unsafeInnerHtmlSpread\"\n                    : \"unsafeInnerHtml\",\n              });\n            }\n            sinks.length = 0;\n          },\n          Program(node) {\n            const comments: unknown[] = Array.isArray(node.comments)\n              ? node.comments\n              : [];\n            for (const comment of comments) {\n              if (isWaiverComment(comment)) {\n                waiverLines.add(comment.loc.end.line);\n              }\n            }\n          },\n\n          JSXAttribute(node) {\n            const name = jsxAttributeName(node.name);\n            const prop = REACT_HTML_PROPS.find((entry) => entry.name === name);\n            if (prop === undefined) return;\n            const value = unwrapExpression(node.value);\n            checkReactHtmlProp(\n              prop,\n              value?.type === \"JSXExpressionContainer\" ? value.expression : value,\n            );\n          },\n\n          // Payload objects remain checked when hoisted or spread into JSX.\n          // Direct value props require a recognized factory-call context below.\n          Property(node) {\n            const key = objectPropertyKey(node);\n            const prop = REACT_HTML_PROPS.find((entry) => entry.name === key);\n            if (prop?.kind !== \"payload\") return;\n            const container = node.parent;\n            if (isAstNode(container) && container.type === \"ObjectExpression\") {\n              checkReactHtmlProp(prop, node.value);\n            }\n          },\n\n          AssignmentExpression(node) {\n            const target = unwrapExpression(node.left);\n            if (target?.type !== \"MemberExpression\") {\n              return;\n            }\n            const name = memberPropertyName(target);\n            if (name !== null && HTML_PROPERTIES.has(name)) {\n              reportIfUnsafe(node.right);\n            }\n          },\n\n          CallExpression(node) {\n            const call: unknown = node;\n            const callee = isAstNode(call) ? invokedCallee(call) : null;\n            const invoked = invokedArguments(node);\n            const factory = staticCalleeName(callee);\n            if (factory !== null && REACT_ELEMENT_FACTORIES.has(factory)) {\n              for (const property of objectProperties(invoked.args.at(1))) {\n                if (property.type !== \"Property\") continue;\n                const key = objectPropertyKey(property);\n                const prop = REACT_HTML_PROPS.find((entry) => entry.name === key);\n                // Payload props are already checked by the Property visitor.\n                if (prop?.kind === \"value\") {\n                  checkReactHtmlProp(prop, property.value);\n                }\n              }\n              return;\n            }\n            if (callee?.type !== \"MemberExpression\") {\n              return;\n            }\n            const method = memberPropertyName(callee);\n            if (method === null) {\n              return;\n            }\n            if (HTML_FIRST_ARGUMENT_METHODS.has(method)) {\n              if (invoked.status === \"opaque\") {\n                reportIfUnsafe(node);\n                return;\n              }\n              reportIfUnsafe(invoked.args.at(0));\n              return;\n            }\n            if (method === \"insertAdjacentHTML\") {\n              if (invoked.status === \"opaque\") {\n                reportIfUnsafe(node);\n                return;\n              }\n              reportIfUnsafe(invoked.args.at(1));\n              return;\n            }\n            if (method === \"setAttribute\") {\n              if (invoked.status === \"opaque\") {\n                reportIfUnsafe(node);\n                return;\n              }\n              const attribute = staticStringValue(invoked.args.at(0));\n              if (attribute?.toLowerCase() === \"srcdoc\") {\n                reportIfUnsafe(invoked.args.at(1));\n              }\n              return;\n            }\n            if (\n              DOCUMENT_WRITE_METHODS.has(method) &&\n              isDocumentReceiver(callee.object)\n            ) {\n              if (invoked.status === \"opaque\") {\n                reportIfUnsafe(node);\n                return;\n              }\n              observeSink(\n                node,\n                invoked.args.every((argument) =>\n                  isProvenSafeValue(argument, sanitizerPolicy),\n                )\n                  ? \"safe\"\n                  : \"unsafe\",\n              );\n              return;\n            }\n            if (isIdentifier(callee.object, \"Object\") && method === \"assign\") {\n              const domTarget = isKnownDomTarget({\n                node: invoked.args.at(0),\n                scope: context.sourceCode.getScope(node),\n              });\n              checkHtmlPropertySources(\n                [\n                  ...invoked.args.slice(1),\n                  ...(invoked.status === \"opaque\" ? invoked.tail : []),\n                ],\n                domTarget,\n              );\n              if (invoked.status === \"opaque\" && domTarget) {\n                reportIfUnsafe(invoked.spread);\n              }\n            }\n          },\n        };\n      },\n    },\n  },\n});\n"],"mappings":";;;;;;;AAyDA,MAAa,wBAAwB;CACnC;EAAE,MAAM;EAAQ,MAAM;EAAY,UAAU;CAAW;CACvD;EAAE,MAAM;EAAQ,MAAM;EAAY,UAAU;CAAW;CACvD;EAAE,MAAM;EAAmB,MAAM;EAAY,UAAU;CAAW;CAClE;EAAE,MAAM;EAAiB,MAAM;EAAY,UAAU;CAAW;CAChE;EAAE,MAAM;EAAoB,MAAM;EAAY,UAAU;CAAW;CACnE;EAAE,MAAM;EAAqB,MAAM;EAAY,UAAU;CAAW;CACpE;EAAE,MAAM;EAAiB,MAAM;EAAU,UAAU;CAAW;CAC9D;EAAE,MAAM;EAAmB,MAAM;EAAU,UAAU;CAAW;CAChE;EAAE,MAAM;EAAkB,MAAM;EAAU,UAAU;CAAW;CAC/D;EAAE,MAAM;EAAiB,MAAM;EAAU,UAAU;CAAS;CAC5D;EAAE,MAAM;EAAW,MAAM;EAAU,UAAU;CAAU;CACvD;EAAE,MAAM;EAAoB,MAAM;EAAU,UAAU;CAAW;CACjE;EAAE,MAAM;EAA0B,MAAM;EAAc,UAAU;CAAS;CACzE;EAAE,MAAM;EAAwB,MAAM;EAAc,UAAU;CAAS;CACvE;EAAE,MAAM;EAA0B,MAAM;EAAc,UAAU;CAAS;CACzE;EAAE,MAAM;EAAqB,MAAM;EAAc,UAAU;CAAW;CACtE;EAAE,MAAM;EAAoB,MAAM;EAAc,UAAU;CAAS;CACnE;EAAE,MAAM;EAAiB,MAAM;EAAY,UAAU;CAAU;CAC/D;EAAE,MAAM;EAAqB,MAAM;EAAY,UAAU;CAAU;CACnE;EAAE,MAAM;EAAoB,MAAM;EAAY,UAAU;CAAU;CAClE;EAAE,MAAM;EAAsB,MAAM;EAAY,UAAU;CAAU;CACpE;EAAE,MAAM;EAA0B,MAAM;EAAY,UAAU;CAAU;CACxE;EAAE,MAAM;EAAgB,MAAM;EAAY,UAAU;CAAU;AAChE;AAGA,MAAM,YAAY;AAElB,MAAa,mBAAmB;CAC9B;EAAE,MAAM;EAA2B,MAAM;EAAW,SAAS;CAAS;CACtE;EAAE,MAAM;EAAU,MAAM;CAAQ;CAChC;EAAE,MAAM;EAAU,MAAM;CAAQ;AAClC;AAEA,MAAM,0CAA+C,IAAI,IAAI;CAC3D;CACA;CACA;CACA;CACA;AACF,CAAC;AACD,MAAM,kCAAuC,IAAI,IAAI;CACnD;CACA;CACA;AACF,CAAC;AAED,MAAM,8CAAmD,IAAI,IAAI,CAC/D,4BACA,eACF,CAAC;AACD,MAAM,yCAA8C,IAAI,IAAI,CAC1D,SACA,SACF,CAAC;AACD,MAAM,mCAAwC,IAAI,IAAI;CACpD;CACA;CACA;AACF,CAAC;AAED,MAAM,yBACJ;AACF,MAAM,2CAA2B,IAAI,IAAI;CAAC;CAAS;CAAQ;AAAM,CAAC;AAClE,MAAM,mBAAmB;CACvB,WAAW;CACX,YAAY;AACd;AACA,MAAM,0BAA0B,OAAO,OAAO,gBAAgB;AAG9D,MAAM,uBAAuB,WAAqC;CAChE,IAAI,WAAW,KAAA,GACb,OAAO,iBAAiB;CAE1B,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GACvE,MAAM,IAAI,MAAM,gDAAgD;CAElE,MAAM,SAAS,QAAQ,IAAI,QAAQ,iBAAiB;CACpD,QAAQ,QAAR;EACE,KAAK,KAAA;EACL,KAAK,iBAAiB,WACpB,OAAO,iBAAiB;EAC1B,KAAK,iBAAiB,YACpB,OAAO,iBAAiB;EAC1B,SACE,MAAM,IAAI,MAAM,6BAA6B,OAAO,MAAM,GAAG;CACjE;AACF;AAGA,MAAM,oBAAoB,SAAiC;CACzD,MAAM,aAAaA,cAAAA,iBAAiB,IAAI;CACxC,IAAIC,cAAAA,aAAa,UAAU,GAAG,OAAO,WAAW;CAChD,IAAI,YAAY,SAAS,oBAAoB,OAAO;CACpD,MAAM,WAAW,iBAAiB,WAAW,MAAM;CACnD,MAAM,WAAWC,cAAAA,mBAAmB,UAAU;CAC9C,OAAO,aAAa,QAAQ,aAAa,OACrC,OACA,GAAG,SAAS,GAAG;AACrB;AAEA,MAAM,mBAAmB,SAA2B;CAClD,IAAI,CAACC,cAAAA,UAAU,IAAI,KAAK,KAAK,SAAS,kBACpC,OAAO;CAET,MAAM,SAAS,iBAAiB,KAAK,MAAM;CAC3C,IAAI,WAAW,MACb,OAAO;CAET,MAAM,QAAQ,OAAO,MAAM,GAAG;CAC9B,MAAM,OAAO,MAAM,GAAG,EAAE;CACxB,IAAI,SAAS,KAAA,GACX,OAAO;CAET,IAAI,uBAAuB,KAAK,IAAI,GAClC,OAAO;CAET,OAAO,SAAS,cAAc,gBAAgB,KAAK,MAAM,GAAG,EAAE,KAAK,EAAE;AACvE;AAEA,MAAM,qBAAqB,SAA2B;CACpD,MAAM,aAAaH,cAAAA,iBAAiB,IAAI;CACxC,IAAI,YAAY,SAAS,oBACvB,OAAO;CAET,MAAM,WAAWE,cAAAA,mBAAmB,UAAU;CAC9C,OACE,aAAa,QACb,yBAAyB,IAAI,QAAQ,KACrC,gBAAgB,WAAW,MAAM;AAErC;AAIA,MAAM,eAAe,SACnB,OAAO,SAAS,YAChB,SAAS,QACT,SAAS,QACT,OAAO,KAAK,QAAQ,YACpB,KAAK,QAAQ,QACb,WAAW,KAAK,OAChB,OAAO,KAAK,IAAI,UAAU,YAC1B,KAAK,IAAI,UAAU,QACnB,UAAU,KAAK,IAAI,SACnB,OAAO,KAAK,IAAI,MAAM,SAAS;AAGjC,MAAM,aAAa,SACjB,YAAY,IAAI,IAAI,KAAK,IAAI,MAAM,OAAO;AAO5C,MAAM,mBAAmB,UACvB,OAAO,UAAU,YACjB,UAAU,QACV,WAAW,SACX,OAAO,MAAM,UAAU,YACvB,UAAU,KAAK,MAAM,KAAK,KAC1B,SAAS,SACT,OAAO,MAAM,QAAQ,YACrB,MAAM,QAAQ;AAEhB,MAAM,oBAAoB,SACxBC,cAAAA,UAAU,IAAI,KAAK,KAAK,SAAS,mBAAmB,OAAO,KAAK,SAAS,WACrE,KAAK,OACL;AAGN,MAAM,qBACJ,MACA,oBACY;CACZ,MAAM,aAAaH,cAAAA,iBAAiB,IAAI;CACxC,IAAI,eAAe,MACjB,OAAO;CAET,IAAII,cAAAA,gBAAgB,UAAU,GAC5B,OAAO;CAET,IACE,oBAAoB,iBAAiB,cACpC,gBAAgB,UAAU,KAAK,kBAAkB,UAAU,IAE5D,OAAO;CAET,OACE,WAAW,SAAS,qBACpB,MAAM,QAAQ,WAAW,WAAW,KACpC,WAAW,YAAY,OAAO,UAC5B,kBAAkB,OAAO,eAAe,CAC1C;AAEJ;AAGA,MAAM,qBAAqB,aAAqC;CAC9D,IAAI,CAACD,cAAAA,UAAU,QAAQ,GACrB,OAAO;CAET,IAAI,SAAS,aAAa,MACxB,OAAOE,cAAAA,kBAAkB,SAAS,GAAG;CAEvC,OAAOC,cAAAA,gBAAgB,SAAS,GAAG;AACrC;AAEA,MAAM,oBAAoB,aACxB,SAAS,SAAS,mBACjB,SAAS,SAAS,cACjB,SAAS,aAAa,QACtB,kBAAkB,QAAQ,MAAM;AAEpC,MAAM,oBAAoB,SAA6B;CACrD,MAAM,aAAaN,cAAAA,iBAAiB,IAAI;CACxC,IACE,YAAY,SAAS,sBACrB,CAAC,MAAM,QAAQ,WAAW,UAAU,GAEpC,OAAO,CAAC;CAEV,OAAO,WAAW,WAAW,OAAOG,cAAAA,SAAS;AAC/C;AAIA,MAAM,uBAAuB,SAAsC;CACjE,MAAM,UAAUH,cAAAA,iBAAiB,KAAK,GAAG,CAAC,CAAC;CAC3C,IACE,YAAY,QACX,QAAQ,SAAS,aAAa,QAAQ,UAAU,QACjDC,cAAAA,aAAa,SAAS,WAAW,GAEjC,OAAO;EAAE,QAAQ;EAAS,MAAM,CAAC;CAAE;CAErC,IAAI,QAAQ,SAAS,qBAAqB,CAAC,MAAM,QAAQ,QAAQ,QAAQ,GACvE,OAAO;EAAE,QAAQ;EAAU,MAAM,CAAC;EAAG,QAAQ,KAAK,GAAG,CAAC;EAAG,MAAM,CAAC;CAAE;CAEpE,OAAOM,cAAAA,2BAA2B,QAAQ,QAAQ;AACpD;AAIA,MAAM,oBAAoB,SAAoC;CAC5D,IAAI,CAACJ,cAAAA,UAAU,IAAI,GACjB,OAAO;EAAE,QAAQ;EAAS,MAAM,CAAC;CAAE;CAErC,MAAM,eAAe,MAAM,QAAQ,KAAK,SAAS,IAAI,KAAK,YAAY,CAAC;CACvE,MAAM,WAAWI,cAAAA,2BAA2B,YAAY;CACxD,MAAM,SAASP,cAAAA,iBAAiB,KAAK,MAAM;CAC3C,IAAI,QAAQ,SAAS,oBAAoB,OAAO;CAChD,MAAM,SAASE,cAAAA,mBAAmB,MAAM;CACxC,IAAI,WAAW,QACb,OAAO;EAAE,GAAG;EAAU,MAAM,SAAS,KAAK,MAAM,CAAC;CAAE;CAErD,IAAI,WAAW,SAAS,OAAO;CAC/B,IAAI,SAAS,WAAW,UAAU;EAChC,IAAI,SAAS,KAAK,UAAU,GAAG,OAAO,oBAAoB,SAAS,IAAI;EACvE,OAAO;GAAE,GAAG;GAAU,MAAM,CAAC;GAAG,MAAM,CAAC;EAAE;CAC3C;CACA,OAAO,oBAAoB,SAAS,IAAI;AAC1C;AAIA,MAAM,sBAAsB,SAA2B;CACrD,MAAM,WAAWF,cAAAA,iBAAiB,IAAI;CACtC,IAAIC,cAAAA,aAAa,UAAU,UAAU,GACnC,OAAO;CAET,IAAI,UAAU,SAAS,oBACrB,OAAO;CAET,MAAM,OAAOC,cAAAA,mBAAmB,QAAQ;CACxC,OAAO,SAAS,QAAQ,iBAAiB,IAAI,IAAI;AACnD;AAEA,IAAA,gCAAA,GAAeM,gBAAAA,mBAAAA,CAAmB;CAChC,MAAM,EAAE,MAAM,uBAAuB;CACrC,OAAO,EACL,wBAAwB;EACtB,MAAM;GACJ,MAAM;GACN,QAAQ,CACN;IACE,MAAM;IACN,YAAY,EACV,iBAAiB;KACf,MAAM;KACN,MAAM;IACR,EACF;IACA,sBAAsB;GACxB,CACF;GACA,UAAU;IACR,iBACE;IAKF,uBACE;GAGJ;EACF;EACA,WAAW,SAAS;GAOlB,MAAM,oBAAoB,EACxB,MACA,OACA,uBAAO,IAAI,IAAc,GACzB,OAAO,gBACwB;IAC/B,MAAM,SAASR,cAAAA,iBAAiB,IAAI;IACpC,IAAIC,cAAAA,aAAa,MAAM,GAAG;KACxB,IAAI,UAAwB;KAC5B,OAAO,YAAY,MAAM;MACvB,MAAM,WAAW,QAAQ,IAAI,IAAI,OAAO,IAAI;MAC5C,IAAI,aAAa,KAAA,GAAW;OAC1B,UAAU,QAAQ;OAClB;MACF;MACA,IAAI,SAAS,KAAK,WAAW,GAC3B,OAAO,SAAS,aAAa,mBAAmB,MAAM;MAExD,IAAI,KAAK,IAAI,QAAQ,GAAG,OAAO;MAC/B,KAAK,IAAI,QAAQ;MACjB,MAAM,aAAa,SAAS,KAAK,GAAG,CAAC;MACrC,IACE,SAAS,KAAK,WAAW,KACzB,YAAY,SAAS,cACrB,WAAW,KAAK,SAAS,wBACzB,WAAW,KAAK,GAAG,SAAS,gBAC5B,WAAW,KAAK,SAAS,QACzB,SAAS,WAAW,MACjB,cAAc,UAAU,QAAQ,KAAK,CAAC,UAAU,IACnD,GAEA,OAAO;MAET,OAAO,iBAAiB;OACtB,MAAM,WAAW,KAAK;OACtB,OAAO,QAAQ,WAAW,SAAS,WAAW,IAAI;OAClD;OACA;MACF,CAAC;KACH;IACF;IACA,MAAM,uBACJ,UACA,aACY;KACZ,IACE,SAAS,aAAa,aACtB,mBAAmB,QAAQ,GAE3B,OAAO;KAET,OACE,SAAS,aAAa,cACtB,iBAAiB;MAAE,MAAM;MAAU;MAAO;KAAK,CAAC;IAEpD;IACA,MAAM,uBAAuB,eAC3B,iBAAiB;KAAE,MAAM;KAAY;KAAO;KAAM,MAAM;IAAa,CAAC;IACxE,IAAI,SAAS,aAAa,QAAQ,SAAS,oBAAoB;KAC7D,MAAM,WAAWC,cAAAA,mBAAmB,MAAM;KAC1C,MAAM,WAAW,sBAAsB,MACpC,UAAU,MAAM,SAAS,cAAc,MAAM,SAAS,QACzD;KACA,IAAI,aAAa,KAAA,GACf,OAAO,oBAAoB,OAAO,QAAQ,QAAQ;KAEpD,MAAM,QAAQF,cAAAA,iBAAiB,OAAO,QAAQ;KAC9C,IACE,OAAO,aAAa,QACpB,OAAO,SAAS,aAChB,OAAO,MAAM,UAAU,YACvB,OAAO,UAAU,MAAM,KAAK,KAC5B,MAAM,SAAS,GAEf,OAAO,oBAAoB,OAAO,MAAM;IAE5C;IACA,IAAI,QAAQ,SAAS,kBAAkB;KACrC,MAAM,SAASS,cAAAA,cAAc,MAAM;KACnC,IAAI,QAAQ,SAAS,oBAAoB,OAAO;KAChD,MAAM,SAASP,cAAAA,mBAAmB,MAAM;KACxC,IACE,SAAS,aACT,WAAW,UACX,oBAAoB,OAAO,MAAM,GAEjC,OAAO;KAET,MAAM,WAAW,sBAAsB,MACpC,UACC,MAAM,UAAU,SAAS,eAAe,eAAe,aACvD,MAAM,SAAS,MACnB;KACA,OACE,aAAa,KAAA,KACb,oBAAoB,OAAO,QAAQ,QAAQ;IAE/C;IACA,OAAO,SAAS,aAAa,mBAAmB,MAAM;GACxD;GAEA,IAAI,kBAAmC,iBAAiB;GAGxD,MAAM,8BAAc,IAAI,IAAY;GAKpC,MAAM,QAA2B,CAAC;GAClC,MAAM,eACJ,MACA,SACS;IACT,IAAIC,cAAAA,UAAU,IAAI,GAAG,MAAM,KAAK;KAAE;KAAM;IAAK,CAAC;GAChD;GAEA,MAAM,iBAAiB,SAA2B;IAChD,MAAM,OAAO,UAAU,IAAI,IAAI;IAC/B,IAAI,CAAC,YAAY,IAAI,IAAI,GACvB,OAAO;IAET,YAAY,OAAO,IAAI;IACvB,OAAO;GACT;GAEA,MAAM,kBAAkB,SAAwB;IAC9C,YACE,MACA,kBAAkB,MAAM,eAAe,IAAI,SAAS,QACtD;GACF;GAKA,MAAM,yBAAyB,OAAgB,YAA0B;IACvE,MAAM,aAAaH,cAAAA,iBAAiB,KAAK;IACzC,IAAI,YAAY,SAAS,oBAAoB;KAC3C,eAAe,KAAK;KACpB;IACF;IACA,KAAK,MAAM,YAAY,iBAAiB,UAAU,GAAG;KACnD,IAAI,iBAAiB,QAAQ,GAAG;MAC9B,YAAY,UAAU,gBAAgB;MACtC;KACF;KACA,IACE,SAAS,SAAS,cAClB,kBAAkB,QAAQ,MAAM,SAEhC,eAAe,SAAS,KAAK;IAEjC;GACF;GAEA,MAAM,sBAAsB,MAAqB,UAAyB;IACxE,QAAQ,KAAK,MAAb;KACE,KAAK;MACH,sBAAsB,OAAO,KAAK,OAAO;MACzC;KACF,KAAK;MACH,eAAe,KAAK;MACpB;KACF,SAEE,MAAM,IAAI,MAAM,4BAA4B,OAAOU,IAAU,GAAG;IAEpE;GACF;GAEA,MAAM,4BACJ,SACA,cACS;IACT,KAAK,MAAM,UAAU,SAAS;KAE5B,IADmBV,cAAAA,iBAAiB,MACvB,CAAC,EAAE,SAAS,oBAAoB;MAC3C,IAAI,WACF,eAAe,MAAM;MAEvB;KACF;KACA,KAAK,MAAM,YAAY,iBAAiB,MAAM,GAAG;MAC/C,IAAI,iBAAiB,QAAQ,GAAG;OAC9B,IAAI,WACF,eAAe,QAAQ;OAEzB;MACF;MACA,MAAM,MACJ,SAAS,SAAS,aACd,kBAAkB,QAAQ,IAC1B;MACN,IAAI,QAAQ,QAAQ,gBAAgB,IAAI,GAAG,GACzC,eAAe,SAAS,KAAK;KAEjC;IACF;GACF;GAEA,OAAO;IACL,SAAS;KACP,kBAAkB,oBAAoB,QAAQ,QAAQ,GAAG,CAAC,CAAC;KAC3D,YAAY,MAAM;KAClB,MAAM,SAAS;IACjB;IACA,iBAAiB;KACf,MAAM,MAAM,MAAM,UAAU,KAAK,KAAK,MAAM,KAAK,MAAM,KAAK,MAAM,EAAE;KACpE,KAAK,MAAM,EAAE,MAAM,UAAU,OAAO;MAClC,MAAM,SAAS,cAAc,IAAI;MACjC,IAAI,SAAS,UAAW,SAAS,YAAY,QAAS;MACtD,QAAQ,OAAO;OACb;OACA,WACE,SAAS,mBACL,0BACA;MACR,CAAC;KACH;KACA,MAAM,SAAS;IACjB;IACA,QAAQ,MAAM;KACZ,MAAM,WAAsB,MAAM,QAAQ,KAAK,QAAQ,IACnD,KAAK,WACL,CAAC;KACL,KAAK,MAAM,WAAW,UACpB,IAAI,gBAAgB,OAAO,GACzB,YAAY,IAAI,QAAQ,IAAI,IAAI,IAAI;IAG1C;IAEA,aAAa,MAAM;KACjB,MAAM,OAAO,iBAAiB,KAAK,IAAI;KACvC,MAAM,OAAO,iBAAiB,MAAM,UAAU,MAAM,SAAS,IAAI;KACjE,IAAI,SAAS,KAAA,GAAW;KACxB,MAAM,QAAQA,cAAAA,iBAAiB,KAAK,KAAK;KACzC,mBACE,MACA,OAAO,SAAS,2BAA2B,MAAM,aAAa,KAChE;IACF;IAIA,SAAS,MAAM;KACb,MAAM,MAAM,kBAAkB,IAAI;KAClC,MAAM,OAAO,iBAAiB,MAAM,UAAU,MAAM,SAAS,GAAG;KAChE,IAAI,MAAM,SAAS,WAAW;KAC9B,MAAM,YAAY,KAAK;KACvB,IAAIG,cAAAA,UAAU,SAAS,KAAK,UAAU,SAAS,oBAC7C,mBAAmB,MAAM,KAAK,KAAK;IAEvC;IAEA,qBAAqB,MAAM;KACzB,MAAM,SAASH,cAAAA,iBAAiB,KAAK,IAAI;KACzC,IAAI,QAAQ,SAAS,oBACnB;KAEF,MAAM,OAAOE,cAAAA,mBAAmB,MAAM;KACtC,IAAI,SAAS,QAAQ,gBAAgB,IAAI,IAAI,GAC3C,eAAe,KAAK,KAAK;IAE7B;IAEA,eAAe,MAAM;KACnB,MAAM,OAAgB;KACtB,MAAM,SAASC,cAAAA,UAAU,IAAI,IAAIM,cAAAA,cAAc,IAAI,IAAI;KACvD,MAAM,UAAU,iBAAiB,IAAI;KACrC,MAAM,UAAU,iBAAiB,MAAM;KACvC,IAAI,YAAY,QAAQ,wBAAwB,IAAI,OAAO,GAAG;MAC5D,KAAK,MAAM,YAAY,iBAAiB,QAAQ,KAAK,GAAG,CAAC,CAAC,GAAG;OAC3D,IAAI,SAAS,SAAS,YAAY;OAClC,MAAM,MAAM,kBAAkB,QAAQ;OACtC,MAAM,OAAO,iBAAiB,MAAM,UAAU,MAAM,SAAS,GAAG;OAEhE,IAAI,MAAM,SAAS,SACjB,mBAAmB,MAAM,SAAS,KAAK;MAE3C;MACA;KACF;KACA,IAAI,QAAQ,SAAS,oBACnB;KAEF,MAAM,SAASP,cAAAA,mBAAmB,MAAM;KACxC,IAAI,WAAW,MACb;KAEF,IAAI,4BAA4B,IAAI,MAAM,GAAG;MAC3C,IAAI,QAAQ,WAAW,UAAU;OAC/B,eAAe,IAAI;OACnB;MACF;MACA,eAAe,QAAQ,KAAK,GAAG,CAAC,CAAC;MACjC;KACF;KACA,IAAI,WAAW,sBAAsB;MACnC,IAAI,QAAQ,WAAW,UAAU;OAC/B,eAAe,IAAI;OACnB;MACF;MACA,eAAe,QAAQ,KAAK,GAAG,CAAC,CAAC;MACjC;KACF;KACA,IAAI,WAAW,gBAAgB;MAC7B,IAAI,QAAQ,WAAW,UAAU;OAC/B,eAAe,IAAI;OACnB;MACF;MAEA,IADkBG,cAAAA,kBAAkB,QAAQ,KAAK,GAAG,CAAC,CACzC,CAAC,EAAE,YAAY,MAAM,UAC/B,eAAe,QAAQ,KAAK,GAAG,CAAC,CAAC;MAEnC;KACF;KACA,IACE,uBAAuB,IAAI,MAAM,KACjC,mBAAmB,OAAO,MAAM,GAChC;MACA,IAAI,QAAQ,WAAW,UAAU;OAC/B,eAAe,IAAI;OACnB;MACF;MACA,YACE,MACA,QAAQ,KAAK,OAAO,aAClB,kBAAkB,UAAU,eAAe,CAC7C,IACI,SACA,QACN;MACA;KACF;KACA,IAAIJ,cAAAA,aAAa,OAAO,QAAQ,QAAQ,KAAK,WAAW,UAAU;MAChE,MAAM,YAAY,iBAAiB;OACjC,MAAM,QAAQ,KAAK,GAAG,CAAC;OACvB,OAAO,QAAQ,WAAW,SAAS,IAAI;MACzC,CAAC;MACD,yBACE,CACE,GAAG,QAAQ,KAAK,MAAM,CAAC,GACvB,GAAI,QAAQ,WAAW,WAAW,QAAQ,OAAO,CAAC,CACpD,GACA,SACF;MACA,IAAI,QAAQ,WAAW,YAAY,WACjC,eAAe,QAAQ,MAAM;KAEjC;IACF;GACF;EACF;CACF,EACF;AACF,CAAC"}

package/dist/no-unsafe-inner-html.d.cts

@@ -1,4 +1,109 @@
 //#region src/no-unsafe-inner-html.d.ts
+declare const DOM_ELEMENT_PRODUCERS: readonly [{
+  readonly name: "body";
+  readonly kind: "property";
+  readonly receiver: "document";
+}, {
+  readonly name: "head";
+  readonly kind: "property";
+  readonly receiver: "document";
+}, {
+  readonly name: "documentElement";
+  readonly kind: "property";
+  readonly receiver: "document";
+}, {
+  readonly name: "activeElement";
+  readonly kind: "property";
+  readonly receiver: "document";
+}, {
+  readonly name: "scrollingElement";
+  readonly kind: "property";
+  readonly receiver: "document";
+}, {
+  readonly name: "fullscreenElement";
+  readonly kind: "property";
+  readonly receiver: "document";
+}, {
+  readonly name: "createElement";
+  readonly kind: "method";
+  readonly receiver: "document";
+}, {
+  readonly name: "createElementNS";
+  readonly kind: "method";
+  readonly receiver: "document";
+}, {
+  readonly name: "getElementById";
+  readonly kind: "method";
+  readonly receiver: "document";
+}, {
+  readonly name: "querySelector";
+  readonly kind: "method";
+  readonly receiver: "either";
+}, {
+  readonly name: "closest";
+  readonly kind: "method";
+  readonly receiver: "element";
+}, {
+  readonly name: "elementFromPoint";
+  readonly kind: "method";
+  readonly receiver: "document";
+}, {
+  readonly name: "getElementsByClassName";
+  readonly kind: "collection";
+  readonly receiver: "either";
+}, {
+  readonly name: "getElementsByTagName";
+  readonly kind: "collection";
+  readonly receiver: "either";
+}, {
+  readonly name: "getElementsByTagNameNS";
+  readonly kind: "collection";
+  readonly receiver: "either";
+}, {
+  readonly name: "getElementsByName";
+  readonly kind: "collection";
+  readonly receiver: "document";
+}, {
+  readonly name: "querySelectorAll";
+  readonly kind: "collection";
+  readonly receiver: "either";
+}, {
+  readonly name: "parentElement";
+  readonly kind: "property";
+  readonly receiver: "element";
+}, {
+  readonly name: "firstElementChild";
+  readonly kind: "property";
+  readonly receiver: "element";
+}, {
+  readonly name: "lastElementChild";
+  readonly kind: "property";
+  readonly receiver: "element";
+}, {
+  readonly name: "nextElementSibling";
+  readonly kind: "property";
+  readonly receiver: "element";
+}, {
+  readonly name: "previousElementSibling";
+  readonly kind: "property";
+  readonly receiver: "element";
+}, {
+  readonly name: "offsetParent";
+  readonly kind: "property";
+  readonly receiver: "element";
+}];
+declare const REACT_HTML_PROPS: readonly [{
+  readonly name: "dangerouslySetInnerHTML";
+  readonly kind: "payload";
+  readonly htmlKey: "__html";
+}, {
+  readonly name: "srcDoc";
+  readonly kind: "value";
+}, {
+  readonly name: "srcdoc";
+  readonly kind: "value";
+}];
 declare const _default: import("@oxlint/plugins").Plugin;
-export = _default;
+//#endregion
+export { DOM_ELEMENT_PRODUCERS, REACT_HTML_PROPS, _default as default };
 //# sourceMappingURL=no-unsafe-inner-html.d.cts.map

package/dist/no-unsafe-inner-html.d.mts

@@ -1,5 +1,109 @@
 //#region src/no-unsafe-inner-html.d.ts
+declare const DOM_ELEMENT_PRODUCERS: readonly [{
+  readonly name: "body";
+  readonly kind: "property";
+  readonly receiver: "document";
+}, {
+  readonly name: "head";
+  readonly kind: "property";
+  readonly receiver: "document";
+}, {
+  readonly name: "documentElement";
+  readonly kind: "property";
+  readonly receiver: "document";
+}, {
+  readonly name: "activeElement";
+  readonly kind: "property";
+  readonly receiver: "document";
+}, {
+  readonly name: "scrollingElement";
+  readonly kind: "property";
+  readonly receiver: "document";
+}, {
+  readonly name: "fullscreenElement";
+  readonly kind: "property";
+  readonly receiver: "document";
+}, {
+  readonly name: "createElement";
+  readonly kind: "method";
+  readonly receiver: "document";
+}, {
+  readonly name: "createElementNS";
+  readonly kind: "method";
+  readonly receiver: "document";
+}, {
+  readonly name: "getElementById";
+  readonly kind: "method";
+  readonly receiver: "document";
+}, {
+  readonly name: "querySelector";
+  readonly kind: "method";
+  readonly receiver: "either";
+}, {
+  readonly name: "closest";
+  readonly kind: "method";
+  readonly receiver: "element";
+}, {
+  readonly name: "elementFromPoint";
+  readonly kind: "method";
+  readonly receiver: "document";
+}, {
+  readonly name: "getElementsByClassName";
+  readonly kind: "collection";
+  readonly receiver: "either";
+}, {
+  readonly name: "getElementsByTagName";
+  readonly kind: "collection";
+  readonly receiver: "either";
+}, {
+  readonly name: "getElementsByTagNameNS";
+  readonly kind: "collection";
+  readonly receiver: "either";
+}, {
+  readonly name: "getElementsByName";
+  readonly kind: "collection";
+  readonly receiver: "document";
+}, {
+  readonly name: "querySelectorAll";
+  readonly kind: "collection";
+  readonly receiver: "either";
+}, {
+  readonly name: "parentElement";
+  readonly kind: "property";
+  readonly receiver: "element";
+}, {
+  readonly name: "firstElementChild";
+  readonly kind: "property";
+  readonly receiver: "element";
+}, {
+  readonly name: "lastElementChild";
+  readonly kind: "property";
+  readonly receiver: "element";
+}, {
+  readonly name: "nextElementSibling";
+  readonly kind: "property";
+  readonly receiver: "element";
+}, {
+  readonly name: "previousElementSibling";
+  readonly kind: "property";
+  readonly receiver: "element";
+}, {
+  readonly name: "offsetParent";
+  readonly kind: "property";
+  readonly receiver: "element";
+}];
+declare const REACT_HTML_PROPS: readonly [{
+  readonly name: "dangerouslySetInnerHTML";
+  readonly kind: "payload";
+  readonly htmlKey: "__html";
+}, {
+  readonly name: "srcDoc";
+  readonly kind: "value";
+}, {
+  readonly name: "srcdoc";
+  readonly kind: "value";
+}];
 declare const _default: import("@oxlint/plugins").Plugin;
 //#endregion
-export { _default as default };
+export { DOM_ELEMENT_PRODUCERS, REACT_HTML_PROPS, _default as default };
 //# sourceMappingURL=no-unsafe-inner-html.d.mts.map