@stll/oxlint-plugin 0.4.0 → 0.6.0

package/dist/index.mjs

@@ -5,6 +5,15 @@ const noPartialRecordSatisfiesPluginSpecifier = "@stll/oxlint-plugin/no-partial-
 const noUnsafeInnerHtmlPluginSpecifier = "@stll/oxlint-plugin/no-unsafe-inner-html";
 const noRawRouteQueryClientPluginSpecifier = "@stll/oxlint-plugin/no-raw-route-query-client";
 const requireLoaderPrefetchPluginSpecifier = "@stll/oxlint-plugin/require-loader-prefetch";
+const bunTestHygienePluginSpecifier = "@stll/oxlint-plugin/bun-test-hygiene";
+const bunTestHygienePluginSpecifiers = [bunTestHygienePluginSpecifier];
+const bunTestHygieneRules = {
+	"bun-test-hygiene/no-disabled-tests": "error",
+	"bun-test-hygiene/no-focused-tests": "error",
+	"bun-test-hygiene/no-forced-database-drop": "error",
+	"bun-test-hygiene/no-identical-title": "error",
+	"bun-test-hygiene/no-promise-matchers": "error"
+};
 const portableSafetyPluginSpecifiers = [
 	noAnyCastsPluginSpecifier,
 	noDangerousTypeAssertionsPluginSpecifier,
@@ -27,21 +36,24 @@ const noRealTimerWaitsInTestsPluginSpecifier = "@stll/oxlint-plugin/no-real-time
 const noUnseededRandomInTestsPluginSpecifier = "@stll/oxlint-plugin/no-unseeded-random-in-tests";
 const noRealNetworkInTestsPluginSpecifier = "@stll/oxlint-plugin/no-real-network-in-tests";
 const noCheckoutWritesInTestsPluginSpecifier = "@stll/oxlint-plugin/no-checkout-writes-in-tests";
+const noWallClockBoundPluginSpecifier = "@stll/oxlint-plugin/no-wall-clock-bound";
 const testReliabilityPluginSpecifiers = [
 	noWallClockInTestsPluginSpecifier,
 	noRealTimerWaitsInTestsPluginSpecifier,
 	noUnseededRandomInTestsPluginSpecifier,
 	noRealNetworkInTestsPluginSpecifier,
-	noCheckoutWritesInTestsPluginSpecifier
+	noCheckoutWritesInTestsPluginSpecifier,
+	noWallClockBoundPluginSpecifier
 ];
 const testReliabilityRules = {
 	"no-wall-clock-in-tests/no-wall-clock-in-tests": "error",
 	"no-real-timer-waits-in-tests/no-real-timer-waits-in-tests": "error",
 	"no-unseeded-random-in-tests/no-unseeded-random-in-tests": "error",
 	"no-real-network-in-tests/no-real-network-in-tests": "error",
-	"no-checkout-writes-in-tests/no-checkout-writes-in-tests": "error"
+	"no-checkout-writes-in-tests/no-checkout-writes-in-tests": "error",
+	"no-wall-clock-bound/no-wall-clock-bound": "error"
 };
 //#endregion
-export { noAnyCastsPluginSpecifier, noCheckoutWritesInTestsPluginSpecifier, noDangerousTypeAssertionsPluginSpecifier, noPartialRecordSatisfiesPluginSpecifier, noRawRouteQueryClientPluginSpecifier, noRealNetworkInTestsPluginSpecifier, noRealTimerWaitsInTestsPluginSpecifier, noUnsafeInnerHtmlPluginSpecifier, noUnseededRandomInTestsPluginSpecifier, noWallClockInTestsPluginSpecifier, portableSafetyPluginSpecifiers, portableSafetyRules, requireLoaderPrefetchPluginSpecifier, routeQueryPluginSpecifiers, routeQueryRules, testReliabilityPluginSpecifiers, testReliabilityRules };
+export { bunTestHygienePluginSpecifier, bunTestHygienePluginSpecifiers, bunTestHygieneRules, noAnyCastsPluginSpecifier, noCheckoutWritesInTestsPluginSpecifier, noDangerousTypeAssertionsPluginSpecifier, noPartialRecordSatisfiesPluginSpecifier, noRawRouteQueryClientPluginSpecifier, noRealNetworkInTestsPluginSpecifier, noRealTimerWaitsInTestsPluginSpecifier, noUnsafeInnerHtmlPluginSpecifier, noUnseededRandomInTestsPluginSpecifier, noWallClockBoundPluginSpecifier, noWallClockInTestsPluginSpecifier, portableSafetyPluginSpecifiers, portableSafetyRules, requireLoaderPrefetchPluginSpecifier, routeQueryPluginSpecifiers, routeQueryRules, testReliabilityPluginSpecifiers, testReliabilityRules };
 
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.ts"],"sourcesContent":["import type { OxlintConfig } from \"oxlint\";\n\ntype JsPlugins = NonNullable<OxlintConfig[\"jsPlugins\"]>;\ntype Rules = NonNullable<OxlintConfig[\"rules\"]>;\n\nexport const noAnyCastsPluginSpecifier = \"@stll/oxlint-plugin/no-any-casts\";\nexport const noDangerousTypeAssertionsPluginSpecifier =\n  \"@stll/oxlint-plugin/no-dangerous-type-assertions\";\nexport const noPartialRecordSatisfiesPluginSpecifier =\n  \"@stll/oxlint-plugin/no-partial-record-satisfies\";\nexport const noUnsafeInnerHtmlPluginSpecifier =\n  \"@stll/oxlint-plugin/no-unsafe-inner-html\";\nexport const noRawRouteQueryClientPluginSpecifier =\n  \"@stll/oxlint-plugin/no-raw-route-query-client\";\nexport const requireLoaderPrefetchPluginSpecifier =\n  \"@stll/oxlint-plugin/require-loader-prefetch\";\n\nexport const portableSafetyPluginSpecifiers = [\n  noAnyCastsPluginSpecifier,\n  noDangerousTypeAssertionsPluginSpecifier,\n  noPartialRecordSatisfiesPluginSpecifier,\n  noUnsafeInnerHtmlPluginSpecifier,\n] satisfies JsPlugins;\n\nexport const portableSafetyRules = {\n  \"no-any-casts/no-any-casts\": \"error\",\n  \"no-dangerous-type-assertions/no-dangerous-type-assertions\": \"error\",\n  \"no-partial-record-satisfies/no-partial-record-satisfies\": \"error\",\n  \"no-unsafe-inner-html/no-unsafe-inner-html\": \"error\",\n} satisfies Rules;\n\nexport const routeQueryPluginSpecifiers = [\n  noRawRouteQueryClientPluginSpecifier,\n  requireLoaderPrefetchPluginSpecifier,\n] satisfies JsPlugins;\n\nexport const routeQueryRules = {\n  \"no-raw-route-query-client/no-raw-route-query-client\": \"error\",\n  \"require-loader-prefetch/require-loader-prefetch\": \"error\",\n} satisfies Rules;\n\nexport const noWallClockInTestsPluginSpecifier =\n  \"@stll/oxlint-plugin/no-wall-clock-in-tests\";\nexport const noRealTimerWaitsInTestsPluginSpecifier =\n  \"@stll/oxlint-plugin/no-real-timer-waits-in-tests\";\nexport const noUnseededRandomInTestsPluginSpecifier =\n  \"@stll/oxlint-plugin/no-unseeded-random-in-tests\";\nexport const noRealNetworkInTestsPluginSpecifier =\n  \"@stll/oxlint-plugin/no-real-network-in-tests\";\nexport const noCheckoutWritesInTestsPluginSpecifier =\n  \"@stll/oxlint-plugin/no-checkout-writes-in-tests\";\n\n// Intentionally separate from every preset: consumers adopt these with a\n// shrink-only test baseline.\nexport const testReliabilityPluginSpecifiers = [\n  noWallClockInTestsPluginSpecifier,\n  noRealTimerWaitsInTestsPluginSpecifier,\n  noUnseededRandomInTestsPluginSpecifier,\n  noRealNetworkInTestsPluginSpecifier,\n  noCheckoutWritesInTestsPluginSpecifier,\n] satisfies JsPlugins;\n\nexport const testReliabilityRules = {\n  \"no-wall-clock-in-tests/no-wall-clock-in-tests\": \"error\",\n  \"no-real-timer-waits-in-tests/no-real-timer-waits-in-tests\": \"error\",\n  \"no-unseeded-random-in-tests/no-unseeded-random-in-tests\": \"error\",\n  \"no-real-network-in-tests/no-real-network-in-tests\": \"error\",\n  \"no-checkout-writes-in-tests/no-checkout-writes-in-tests\": \"error\",\n} satisfies Rules;\n"],"mappings":";AAKA,MAAa,4BAA4B;AACzC,MAAa,2CACX;AACF,MAAa,0CACX;AACF,MAAa,mCACX;AACF,MAAa,uCACX;AACF,MAAa,uCACX;AAEF,MAAa,iCAAiC;CAC5C;CACA;CACA;CACA;AACF;AAEA,MAAa,sBAAsB;CACjC,6BAA6B;CAC7B,6DAA6D;CAC7D,2DAA2D;CAC3D,6CAA6C;AAC/C;AAEA,MAAa,6BAA6B,CACxC,sCACA,oCACF;AAEA,MAAa,kBAAkB;CAC7B,uDAAuD;CACvD,mDAAmD;AACrD;AAEA,MAAa,oCACX;AACF,MAAa,yCACX;AACF,MAAa,yCACX;AACF,MAAa,sCACX;AACF,MAAa,yCACX;AAIF,MAAa,kCAAkC;CAC7C;CACA;CACA;CACA;CACA;AACF;AAEA,MAAa,uBAAuB;CAClC,iDAAiD;CACjD,6DAA6D;CAC7D,2DAA2D;CAC3D,qDAAqD;CACrD,2DAA2D;AAC7D"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.ts"],"sourcesContent":["import type { OxlintConfig } from \"oxlint\";\n\ntype JsPlugins = NonNullable<OxlintConfig[\"jsPlugins\"]>;\ntype Rules = NonNullable<OxlintConfig[\"rules\"]>;\n\nexport const noAnyCastsPluginSpecifier = \"@stll/oxlint-plugin/no-any-casts\";\nexport const noDangerousTypeAssertionsPluginSpecifier =\n  \"@stll/oxlint-plugin/no-dangerous-type-assertions\";\nexport const noPartialRecordSatisfiesPluginSpecifier =\n  \"@stll/oxlint-plugin/no-partial-record-satisfies\";\nexport const noUnsafeInnerHtmlPluginSpecifier =\n  \"@stll/oxlint-plugin/no-unsafe-inner-html\";\nexport const noRawRouteQueryClientPluginSpecifier =\n  \"@stll/oxlint-plugin/no-raw-route-query-client\";\nexport const requireLoaderPrefetchPluginSpecifier =\n  \"@stll/oxlint-plugin/require-loader-prefetch\";\nexport const bunTestHygienePluginSpecifier =\n  \"@stll/oxlint-plugin/bun-test-hygiene\";\n\nexport const bunTestHygienePluginSpecifiers = [\n  bunTestHygienePluginSpecifier,\n] satisfies JsPlugins;\n\nexport const bunTestHygieneRules = {\n  \"bun-test-hygiene/no-disabled-tests\": \"error\",\n  \"bun-test-hygiene/no-focused-tests\": \"error\",\n  \"bun-test-hygiene/no-forced-database-drop\": \"error\",\n  \"bun-test-hygiene/no-identical-title\": \"error\",\n  \"bun-test-hygiene/no-promise-matchers\": \"error\",\n} satisfies Rules;\n\nexport const portableSafetyPluginSpecifiers = [\n  noAnyCastsPluginSpecifier,\n  noDangerousTypeAssertionsPluginSpecifier,\n  noPartialRecordSatisfiesPluginSpecifier,\n  noUnsafeInnerHtmlPluginSpecifier,\n] satisfies JsPlugins;\n\nexport const portableSafetyRules = {\n  \"no-any-casts/no-any-casts\": \"error\",\n  \"no-dangerous-type-assertions/no-dangerous-type-assertions\": \"error\",\n  \"no-partial-record-satisfies/no-partial-record-satisfies\": \"error\",\n  \"no-unsafe-inner-html/no-unsafe-inner-html\": \"error\",\n} satisfies Rules;\n\nexport const routeQueryPluginSpecifiers = [\n  noRawRouteQueryClientPluginSpecifier,\n  requireLoaderPrefetchPluginSpecifier,\n] satisfies JsPlugins;\n\nexport const routeQueryRules = {\n  \"no-raw-route-query-client/no-raw-route-query-client\": \"error\",\n  \"require-loader-prefetch/require-loader-prefetch\": \"error\",\n} satisfies Rules;\n\nexport const noWallClockInTestsPluginSpecifier =\n  \"@stll/oxlint-plugin/no-wall-clock-in-tests\";\nexport const noRealTimerWaitsInTestsPluginSpecifier =\n  \"@stll/oxlint-plugin/no-real-timer-waits-in-tests\";\nexport const noUnseededRandomInTestsPluginSpecifier =\n  \"@stll/oxlint-plugin/no-unseeded-random-in-tests\";\nexport const noRealNetworkInTestsPluginSpecifier =\n  \"@stll/oxlint-plugin/no-real-network-in-tests\";\nexport const noCheckoutWritesInTestsPluginSpecifier =\n  \"@stll/oxlint-plugin/no-checkout-writes-in-tests\";\nexport const noWallClockBoundPluginSpecifier =\n  \"@stll/oxlint-plugin/no-wall-clock-bound\";\n\n// Intentionally separate from every preset: consumers adopt these with a\n// shrink-only test baseline.\nexport const testReliabilityPluginSpecifiers = [\n  noWallClockInTestsPluginSpecifier,\n  noRealTimerWaitsInTestsPluginSpecifier,\n  noUnseededRandomInTestsPluginSpecifier,\n  noRealNetworkInTestsPluginSpecifier,\n  noCheckoutWritesInTestsPluginSpecifier,\n  noWallClockBoundPluginSpecifier,\n] satisfies JsPlugins;\n\nexport const testReliabilityRules = {\n  \"no-wall-clock-in-tests/no-wall-clock-in-tests\": \"error\",\n  \"no-real-timer-waits-in-tests/no-real-timer-waits-in-tests\": \"error\",\n  \"no-unseeded-random-in-tests/no-unseeded-random-in-tests\": \"error\",\n  \"no-real-network-in-tests/no-real-network-in-tests\": \"error\",\n  \"no-checkout-writes-in-tests/no-checkout-writes-in-tests\": \"error\",\n  \"no-wall-clock-bound/no-wall-clock-bound\": \"error\",\n} satisfies Rules;\n"],"mappings":";AAKA,MAAa,4BAA4B;AACzC,MAAa,2CACX;AACF,MAAa,0CACX;AACF,MAAa,mCACX;AACF,MAAa,uCACX;AACF,MAAa,uCACX;AACF,MAAa,gCACX;AAEF,MAAa,iCAAiC,CAC5C,6BACF;AAEA,MAAa,sBAAsB;CACjC,sCAAsC;CACtC,qCAAqC;CACrC,4CAA4C;CAC5C,uCAAuC;CACvC,wCAAwC;AAC1C;AAEA,MAAa,iCAAiC;CAC5C;CACA;CACA;CACA;AACF;AAEA,MAAa,sBAAsB;CACjC,6BAA6B;CAC7B,6DAA6D;CAC7D,2DAA2D;CAC3D,6CAA6C;AAC/C;AAEA,MAAa,6BAA6B,CACxC,sCACA,oCACF;AAEA,MAAa,kBAAkB;CAC7B,uDAAuD;CACvD,mDAAmD;AACrD;AAEA,MAAa,oCACX;AACF,MAAa,yCACX;AACF,MAAa,yCACX;AACF,MAAa,sCACX;AACF,MAAa,yCACX;AACF,MAAa,kCACX;AAIF,MAAa,kCAAkC;CAC7C;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAa,uBAAuB;CAClC,iDAAiD;CACjD,6DAA6D;CAC7D,2DAA2D;CAC3D,qDAAqD;CACrD,2DAA2D;CAC3D,2CAA2C;AAC7C"}

package/dist/no-unsafe-inner-html.cjs

@@ -91,6 +91,11 @@ const DOM_ELEMENT_PRODUCERS = [
 		kind: "collection",
 		receiver: "either"
 	},
+	{
+		name: "children",
+		kind: "collection-property",
+		receiver: "element"
+	},
 	{
 		name: "parentElement",
 		kind: "property",
@@ -152,11 +157,28 @@ const HTML_PROPERTIES = /* @__PURE__ */ new Set([
 ]);
 const HTML_FIRST_ARGUMENT_METHODS = /* @__PURE__ */ new Set(["createContextualFragment", "setHTMLUnsafe"]);
 const DOCUMENT_WRITE_METHODS = /* @__PURE__ */ new Set(["write", "writeln"]);
+const HTML_ATTRIBUTE_SINKS = [{
+	name: "setAttribute",
+	namespaceIndex: null,
+	nameIndex: 0,
+	valueIndex: 1
+}, {
+	name: "setAttributeNS",
+	namespaceIndex: 0,
+	nameIndex: 1,
+	valueIndex: 2
+}];
 const DOCUMENT_MEMBERS = /* @__PURE__ */ new Set([
 	"contentDocument",
 	"document",
 	"ownerDocument"
 ]);
+const FILE_SYSTEM_MODULES = /* @__PURE__ */ new Set([
+	"fs",
+	"fs/promises",
+	"node:fs",
+	"node:fs/promises"
+]);
 const HTML_SANITIZER_LEAF_RE = /^(?:escape(?:html|xml)|sanitize(?:html|dom)|purify(?:html|dom)|dompurify)$/iu;
 const SANITIZER_RESULT_MEMBERS = /* @__PURE__ */ new Set([
 	"value",
@@ -223,7 +245,15 @@ const isOpaqueProperty = (property) => property.type === "SpreadElement" || prop
 const objectProperties = (node) => {
 	const expression = require_utils.unwrapExpression(node);
 	if (expression?.type !== "ObjectExpression" || !Array.isArray(expression.properties)) return [];
-	return expression.properties.filter(require_utils.isAstNode);
+	const properties = [];
+	for (const property of expression.properties.filter(require_utils.isAstNode)) {
+		if (property.type === "SpreadElement" && require_utils.unwrapExpression(property.argument)?.type === "ObjectExpression") {
+			properties.push(...objectProperties(property.argument));
+			continue;
+		}
+		properties.push(property);
+	}
+	return properties;
 };
 const appliedArgumentsFor = (args) => {
 	const applied = require_utils.unwrapExpression(args.at(1));
@@ -264,13 +294,6 @@ const invokedArguments = (call) => {
 	}
 	return appliedArgumentsFor(resolved.args);
 };
-const isDocumentReceiver = (node) => {
-	const receiver = require_utils.unwrapExpression(node);
-	if (require_utils.isIdentifier(receiver, "document")) return true;
-	if (receiver?.type !== "MemberExpression") return false;
-	const name = require_utils.memberPropertyName(receiver);
-	return name !== null && DOCUMENT_MEMBERS.has(name);
-};
 var no_unsafe_inner_html_default = (0, _oxlint_plugins.eslintCompatPlugin)({
 	meta: { name: "no-unsafe-inner-html" },
 	rules: { "no-unsafe-inner-html": {
@@ -286,35 +309,133 @@ var no_unsafe_inner_html_default = (0, _oxlint_plugins.eslintCompatPlugin)({
 			}],
 			messages: {
 				unsafeInnerHtml: "Dynamic HTML injected into the DOM must be static, proven by the configured sanitizer policy, or have an adjacent `// safe-html: <provenance>` comment naming the trusted source. Function names outside the allowlist are not proof because a local identity function can shadow them.",
-				unsafeInnerHtmlSpread: "Do not spread an object into dangerouslySetInnerHTML. Keep `__html` inline so this rule can prove the HTML value is sanitized or escaped."
+				unsafeInnerHtmlSpread: "Do not spread an object in dangerouslySetInnerHTML. Keep `__html` inline so this rule can prove the HTML value is sanitized or escaped.",
+				unsafeInnerHtmlComputedKey: "Do not use an unresolved computed key in dangerouslySetInnerHTML. Write an explicit `__html` property so this rule can prove the HTML value is sanitized or escaped."
 			}
 		},
 		createOnce(context) {
-			const isKnownDomTarget = ({ node, scope, seen = /* @__PURE__ */ new Set(), kind = "element" }) => {
-				const target = require_utils.unwrapExpression(node);
-				if (require_utils.isIdentifier(target)) {
+			const resolveStableBinding = ({ node, scope, seen }) => {
+				let target = require_utils.unwrapExpression(node);
+				while (require_utils.isIdentifier(target)) {
 					let current = scope;
+					let variable;
 					while (current !== null) {
-						const variable = current.set.get(target.name);
-						if (variable === void 0) {
-							current = current.upper;
-							continue;
-						}
-						if (variable.defs.length === 0) return kind === "element" && isDocumentReceiver(target);
-						if (seen.has(variable)) return false;
-						seen.add(variable);
-						const definition = variable.defs.at(0);
-						if (variable.defs.length !== 1 || definition?.type !== "Variable" || definition.node.type !== "VariableDeclarator" || definition.node.id.type !== "Identifier" || definition.node.init === null || variable.references.some((reference) => reference.isWrite() && !reference.init)) return false;
-						return isKnownDomTarget({
-							node: definition.node.init,
-							scope: context.sourceCode.getScope(definition.node),
-							seen,
-							kind
-						});
+						variable = current.set.get(target.name);
+						if (variable !== void 0) break;
+						current = current.upper;
 					}
+					if (variable === void 0 || variable.defs.length === 0) return {
+						kind: "expression",
+						node: target,
+						scope
+					};
+					if (seen.has(variable)) return null;
+					seen.add(variable);
+					const definition = variable.defs.at(0);
+					if (variable.defs.length !== 1 || definition?.type !== "Variable" || definition.node.type !== "VariableDeclarator" || definition.node.id.type !== "Identifier" || variable.references.some((reference) => reference.isWrite() && !reference.init)) return null;
+					const declarator = definition.node;
+					if (declarator.init !== null) {
+						target = require_utils.unwrapExpression(declarator.init);
+						scope = context.sourceCode.getScope(declarator);
+						continue;
+					}
+					const declaration = declarator.parent;
+					if (declaration.type !== "VariableDeclaration") return null;
+					const loop = declaration.parent;
+					if (loop.type !== "ForOfStatement" || loop.left !== declaration) return null;
+					return {
+						kind: "iteration",
+						node: require_utils.unwrapExpression(loop.right),
+						scope: context.sourceCode.getScope(loop.right)
+					};
+				}
+				return {
+					kind: "expression",
+					node: target,
+					scope
+				};
+			};
+			const isKnownNonEmptyNamespace = (namespace, scope) => {
+				const source = resolveStableBinding({
+					node: namespace,
+					scope,
+					seen: /* @__PURE__ */ new Set()
+				});
+				if (source?.kind !== "expression") return false;
+				const text = require_utils.staticStringValue(source.node);
+				if (text !== null) return text !== "";
+				if (source.node?.type !== "Literal") return false;
+				const { value } = source.node;
+				return typeof value === "number" || typeof value === "boolean" || typeof value === "bigint";
+			};
+			const variableFor = (identifier, initialScope) => {
+				let current = initialScope;
+				while (current !== null) {
+					const variable = current.set.get(identifier.name);
+					if (variable !== void 0) return variable;
+					current = current.upper;
 				}
+			};
+			const isKnownNonDocumentReceiver = (node, scope) => {
+				const isUnshadowedGlobal = (identifier, name) => require_utils.isIdentifier(identifier, name) && variableFor(identifier, scope) === void 0;
+				const isFileSystemImport = (identifier) => {
+					if (!require_utils.isIdentifier(identifier)) return false;
+					const variable = variableFor(identifier, scope);
+					if (variable?.defs.length !== 1) return false;
+					const definition = variable.defs.at(0);
+					return definition?.type === "ImportBinding" && definition.parent?.type === "ImportDeclaration" && FILE_SYSTEM_MODULES.has(definition.parent.source.value);
+				};
+				const root = require_utils.unwrapExpression(node);
+				if (isUnshadowedGlobal(root, "Bun") || isFileSystemImport(root)) return true;
+				return root?.type === "MemberExpression" && (require_utils.memberPropertyName(root) === "stdout" || require_utils.memberPropertyName(root) === "stderr") && isUnshadowedGlobal(require_utils.unwrapExpression(root.object), "process");
+			};
+			const isDocumentReceiver = (node, scope) => {
+				if (isKnownNonDocumentReceiver(node, scope)) return false;
+				const source = resolveStableBinding({
+					node,
+					scope,
+					seen: /* @__PURE__ */ new Set()
+				});
+				if (source === null || source.kind !== "expression") return true;
+				const receiver = source.node;
+				if (require_utils.isIdentifier(receiver, "document")) return true;
+				if (receiver?.type !== "MemberExpression") return false;
+				const name = require_utils.memberPropertyName(receiver);
+				return name !== null && DOCUMENT_MEMBERS.has(name);
+			};
+			const isDocumentSinkReceiver = (node, scope) => {
+				if (isKnownNonDocumentReceiver(node, scope)) return false;
+				const receiver = require_utils.unwrapExpression(node);
+				if (!require_utils.isIdentifier(receiver)) return true;
+				let current = scope;
+				let variable;
+				while (current !== null) {
+					variable = current.set.get(receiver.name);
+					if (variable !== void 0) break;
+					current = current.upper;
+				}
+				if (variable === void 0 || variable.defs.length !== 1) return true;
+				const definition = variable.defs.at(0);
+				if (definition?.type !== "Variable" || definition.node.type !== "VariableDeclarator" || definition.node.id.type !== "Identifier" || definition.node.init === null || require_utils.unwrapExpression(definition.node.init)?.type !== "ObjectExpression" || definition.node.parent.type !== "VariableDeclaration" || definition.node.parent.kind !== "const" || variable.scope.variableScope !== scope.variableScope || variable.references.some((reference) => reference.isWrite() && !reference.init)) return true;
+				return false;
+			};
+			const isKnownDomTarget = ({ node, scope, seen = /* @__PURE__ */ new Set(), kind = "element" }) => {
+				const source = resolveStableBinding({
+					node,
+					scope,
+					seen
+				});
+				if (source === null) return true;
+				if (source.kind === "iteration") return kind === "element" && isKnownDomTarget({
+					node: source.node,
+					scope: source.scope,
+					seen,
+					kind: "collection"
+				});
+				const target = source.node;
+				scope = source.scope;
 				const hasProducerReceiver = (receiver, producer) => {
-					if (producer.receiver !== "element" && isDocumentReceiver(receiver)) return true;
+					if (producer.receiver !== "element" && isDocumentReceiver(receiver, scope)) return true;
 					return producer.receiver !== "document" && isKnownDomTarget({
 						node: receiver,
 						scope,
@@ -327,12 +448,12 @@ var no_unsafe_inner_html_default = (0, _oxlint_plugins.eslintCompatPlugin)({
 					seen,
 					kind: "collection"
 				});
-				if (kind === "element" && target?.type === "MemberExpression") {
+				if (target?.type === "MemberExpression") {
 					const property = require_utils.memberPropertyName(target);
-					const producer = DOM_ELEMENT_PRODUCERS.find((entry) => entry.kind === "property" && entry.name === property);
+					const producer = DOM_ELEMENT_PRODUCERS.find((entry) => entry.kind === (kind === "collection" ? "collection-property" : "property") && entry.name === property);
 					if (producer !== void 0) return hasProducerReceiver(target.object, producer);
 					const index = require_utils.unwrapExpression(target.property);
-					if (target.computed === true && index?.type === "Literal" && typeof index.value === "number" && Number.isInteger(index.value) && index.value >= 0) return isElementCollection(target.object);
+					if (kind === "element" && target.computed === true && index?.type === "Literal" && typeof index.value === "number" && Number.isInteger(index.value) && index.value >= 0) return isElementCollection(target.object);
 				}
 				if (target?.type === "CallExpression") {
 					const callee = require_utils.invokedCallee(target);
@@ -342,7 +463,7 @@ var no_unsafe_inner_html_default = (0, _oxlint_plugins.eslintCompatPlugin)({
 					const producer = DOM_ELEMENT_PRODUCERS.find((entry) => entry.kind === (kind === "collection" ? "collection" : "method") && entry.name === method);
 					return producer !== void 0 && hasProducerReceiver(callee.object, producer);
 				}
-				return kind === "element" && isDocumentReceiver(target);
+				return kind === "element" && isDocumentReceiver(target, scope);
 			};
 			let sanitizerPolicy = SANITIZER_POLICY.allowlist;
 			const waiverLines = /* @__PURE__ */ new Set();
@@ -353,6 +474,11 @@ var no_unsafe_inner_html_default = (0, _oxlint_plugins.eslintCompatPlugin)({
 					kind
 				});
 			};
+			const messageIdFor = (kind) => {
+				if (kind === "opaque-payload-spread") return "unsafeInnerHtmlSpread";
+				if (kind === "opaque-payload-computed-key") return "unsafeInnerHtmlComputedKey";
+				return "unsafeInnerHtml";
+			};
 			const consumeWaiver = (node) => {
 				const line = startLine(node) - 1;
 				if (!waiverLines.has(line)) return false;
@@ -370,7 +496,7 @@ var no_unsafe_inner_html_default = (0, _oxlint_plugins.eslintCompatPlugin)({
 				}
 				for (const property of objectProperties(expression)) {
 					if (isOpaqueProperty(property)) {
-						observeSink(property, "opaque-payload");
+						observeSink(property, property.type === "SpreadElement" ? "opaque-payload-spread" : "opaque-payload-computed-key");
 						continue;
 					}
 					if (property.type === "Property" && objectPropertyKey(property) === htmlKey) reportIfUnsafe(property.value);
@@ -387,6 +513,14 @@ var no_unsafe_inner_html_default = (0, _oxlint_plugins.eslintCompatPlugin)({
 					default: throw new Error(`Unknown React HTML prop: ${String(prop)}`);
 				}
 			};
+			const checkReactProps = (value) => {
+				for (const property of objectProperties(value)) {
+					if (property.type !== "Property") continue;
+					const key = objectPropertyKey(property);
+					const prop = REACT_HTML_PROPS.find((entry) => entry.name === key);
+					if (prop?.kind === "value") checkReactHtmlProp(prop, property.value);
+				}
+			};
 			const checkHtmlPropertySources = (sources, domTarget) => {
 				for (const source of sources) {
 					if (require_utils.unwrapExpression(source)?.type !== "ObjectExpression") {
@@ -416,7 +550,7 @@ var no_unsafe_inner_html_default = (0, _oxlint_plugins.eslintCompatPlugin)({
 						if (kind === "safe" || kind === "unsafe" && waived) continue;
 						context.report({
 							node,
-							messageId: kind === "opaque-payload" ? "unsafeInnerHtmlSpread" : "unsafeInnerHtml"
+							messageId: messageIdFor(kind)
 						});
 					}
 					sinks.length = 0;
@@ -432,6 +566,9 @@ var no_unsafe_inner_html_default = (0, _oxlint_plugins.eslintCompatPlugin)({
 					const value = require_utils.unwrapExpression(node.value);
 					checkReactHtmlProp(prop, value?.type === "JSXExpressionContainer" ? value.expression : value);
 				},
+				JSXSpreadAttribute(node) {
+					checkReactProps(node.argument);
+				},
 				Property(node) {
 					const key = objectPropertyKey(node);
 					const prop = REACT_HTML_PROPS.find((entry) => entry.name === key);
@@ -451,12 +588,7 @@ var no_unsafe_inner_html_default = (0, _oxlint_plugins.eslintCompatPlugin)({
 					const invoked = invokedArguments(node);
 					const factory = staticCalleeName(callee);
 					if (factory !== null && REACT_ELEMENT_FACTORIES.has(factory)) {
-						for (const property of objectProperties(invoked.args.at(1))) {
-							if (property.type !== "Property") continue;
-							const key = objectPropertyKey(property);
-							const prop = REACT_HTML_PROPS.find((entry) => entry.name === key);
-							if (prop?.kind === "value") checkReactHtmlProp(prop, property.value);
-						}
+						checkReactProps(invoked.args.at(1));
 						return;
 					}
 					if (callee?.type !== "MemberExpression") return;
@@ -478,15 +610,17 @@ var no_unsafe_inner_html_default = (0, _oxlint_plugins.eslintCompatPlugin)({
 						reportIfUnsafe(invoked.args.at(1));
 						return;
 					}
-					if (method === "setAttribute") {
+					const attributeSink = HTML_ATTRIBUTE_SINKS.find((entry) => entry.name === method);
+					if (attributeSink !== void 0) {
+						if (attributeSink.namespaceIndex !== null && isKnownNonEmptyNamespace(invoked.args.at(attributeSink.namespaceIndex), context.sourceCode.getScope(node))) return;
 						if (invoked.status === "opaque") {
 							reportIfUnsafe(node);
 							return;
 						}
-						if (require_utils.staticStringValue(invoked.args.at(0))?.toLowerCase() === "srcdoc") reportIfUnsafe(invoked.args.at(1));
+						if (require_utils.staticStringValue(invoked.args.at(attributeSink.nameIndex))?.toLowerCase() === "srcdoc") reportIfUnsafe(invoked.args.at(attributeSink.valueIndex));
 						return;
 					}
-					if (DOCUMENT_WRITE_METHODS.has(method) && isDocumentReceiver(callee.object)) {
+					if (DOCUMENT_WRITE_METHODS.has(method) && isDocumentSinkReceiver(callee.object, context.sourceCode.getScope(node))) {
 						if (invoked.status === "opaque") {
 							reportIfUnsafe(node);
 							return;
@@ -508,7 +642,10 @@ var no_unsafe_inner_html_default = (0, _oxlint_plugins.eslintCompatPlugin)({
 	} }
 });
 //#endregion
+exports.DOCUMENT_WRITE_METHODS = DOCUMENT_WRITE_METHODS;
 exports.DOM_ELEMENT_PRODUCERS = DOM_ELEMENT_PRODUCERS;
+exports.HTML_ATTRIBUTE_SINKS = HTML_ATTRIBUTE_SINKS;
+exports.REACT_ELEMENT_FACTORIES = REACT_ELEMENT_FACTORIES;
 exports.REACT_HTML_PROPS = REACT_HTML_PROPS;
 exports.default = no_unsafe_inner_html_default;