eslint-plugin-render-policy 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 render-policy contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,31 @@
+# eslint-plugin-render-policy
+
+Two rules that make HTML injection sinks visible.
+
+```js
+// eslint.config.js
+import renderPolicy from 'eslint-plugin-render-policy';
+import templateParser from '@angular-eslint/template-parser';
+
+export default [
+  renderPolicy.configs.recommended,
+  { ...renderPolicy.configs['angular-templates'], languageOptions: { parser: templateParser } },
+];
+```
+
+## no-unsafe-innerhtml
+
+Flags, unless the value is a static string:
+
+- `el.innerHTML = x`, `el.outerHTML = x`, `el.innerHTML += x`, `el['innerHTML'] = x`
+- `el.insertAdjacentHTML(position, x)`, `el.setHTMLUnsafe(x)`, `range.createContextualFragment(x)`
+- `document.write(x)`, `document.writeln(x)`
+- `sanitizer.bypassSecurityTrustHtml(x)` (Angular)
+- `<div dangerouslySetInnerHTML={{ __html: x }} />` (React)
+
+Option `allowStatic` (default `true`): set to `false` to flag the sinks even with static strings.
+
+## no-innerhtml-binding
+
+Angular templates (needs `@angular-eslint/template-parser`): flags `[innerHTML]`, `[(innerHTML)]`,
+`bind-innerHTML`, `[innerHtml]` and `[outerHTML]`. A static `innerHTML="…"` attribute is allowed.

package/dist/index.d.ts

@@ -0,0 +1,24 @@
+import type { ESLint, Linter } from 'eslint';
+import noInnerhtmlBinding from './rules/no-innerhtml-binding.js';
+import noUnsafeInnerhtml from './rules/no-unsafe-innerhtml.js';
+declare const rules: {
+    'no-unsafe-innerhtml': import("eslint").Rule.RuleModule;
+    'no-innerhtml-binding': import("eslint").Rule.RuleModule;
+};
+interface RenderPolicyPlugin extends ESLint.Plugin {
+    readonly meta: {
+        readonly name: string;
+        readonly version: string;
+    };
+    readonly rules: typeof rules;
+    configs: {
+        /** JS/TS/JSX sources. */
+        recommended: Linter.Config;
+        /** Angular templates. Pair it with `@angular-eslint/template-parser` for `*.html`. */
+        'angular-templates': Linter.Config;
+    };
+}
+declare const plugin: RenderPolicyPlugin;
+export { noInnerhtmlBinding, noUnsafeInnerhtml, rules };
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,kBAAkB,MAAM,iCAAiC,CAAC;AACjE,OAAO,iBAAiB,MAAM,gCAAgC,CAAC;AAE/D,QAAA,MAAM,KAAK;IACT,qBAAqB;IACrB,sBAAsB;CACvB,CAAC;AAEF,UAAU,kBAAmB,SAAQ,MAAM,CAAC,MAAM;IAChD,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,QAAQ,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,EAAE;QACP,yBAAyB;QACzB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;QAC3B,sFAAsF;QACtF,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC;KACpC,CAAC;CACH;AAED,QAAA,MAAM,MAAM,EAAE,kBAOb,CAAC;AAeF,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;eACzC,MAAM"}

package/dist/index.js

@@ -0,0 +1,28 @@
+import noInnerhtmlBinding from './rules/no-innerhtml-binding.js';
+import noUnsafeInnerhtml from './rules/no-unsafe-innerhtml.js';
+const rules = {
+    'no-unsafe-innerhtml': noUnsafeInnerhtml,
+    'no-innerhtml-binding': noInnerhtmlBinding,
+};
+const plugin = {
+    meta: { name: 'eslint-plugin-render-policy', version: '0.1.0' },
+    rules,
+    configs: {
+        recommended: {},
+        'angular-templates': {},
+    },
+};
+plugin.configs.recommended = {
+    name: 'render-policy/recommended',
+    plugins: { 'render-policy': plugin },
+    rules: { 'render-policy/no-unsafe-innerhtml': 'error' },
+};
+plugin.configs['angular-templates'] = {
+    name: 'render-policy/angular-templates',
+    files: ['**/*.html'],
+    plugins: { 'render-policy': plugin },
+    rules: { 'render-policy/no-innerhtml-binding': 'error' },
+};
+export { noInnerhtmlBinding, noUnsafeInnerhtml, rules };
+export default plugin;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,kBAAkB,MAAM,iCAAiC,CAAC;AACjE,OAAO,iBAAiB,MAAM,gCAAgC,CAAC;AAE/D,MAAM,KAAK,GAAG;IACZ,qBAAqB,EAAE,iBAAiB;IACxC,sBAAsB,EAAE,kBAAkB;CAC3C,CAAC;AAaF,MAAM,MAAM,GAAuB;IACjC,IAAI,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,OAAO,EAAE;IAC/D,KAAK;IACL,OAAO,EAAE;QACP,WAAW,EAAE,EAAE;QACf,mBAAmB,EAAE,EAAE;KACxB;CACF,CAAC;AAEF,MAAM,CAAC,OAAO,CAAC,WAAW,GAAG;IAC3B,IAAI,EAAE,2BAA2B;IACjC,OAAO,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE;IACpC,KAAK,EAAE,EAAE,mCAAmC,EAAE,OAAO,EAAE;CACxD,CAAC;AAEF,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG;IACpC,IAAI,EAAE,iCAAiC;IACvC,KAAK,EAAE,CAAC,WAAW,CAAC;IACpB,OAAO,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE;IACpC,KAAK,EAAE,EAAE,oCAAoC,EAAE,OAAO,EAAE;CACzD,CAAC;AAEF,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;AACxD,eAAe,MAAM,CAAC"}

package/dist/rules/no-innerhtml-binding.d.ts

@@ -0,0 +1,4 @@
+import type { Rule } from 'eslint';
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=no-innerhtml-binding.d.ts.map

package/dist/rules/no-innerhtml-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-innerhtml-binding.d.ts","sourceRoot":"","sources":["../../src/rules/no-innerhtml-binding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAsBnC,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAuBhB,CAAC;eAEa,IAAI"}

package/dist/rules/no-innerhtml-binding.js

@@ -0,0 +1,36 @@
+/**
+ * Angular templates: flags `[innerHTML]`, `[(innerHTML)]`, `bind-innerHTML`, `[outerHTML]`
+ * and the `innerHtml` spelling Angular maps to the same property.
+ *
+ * Angular sanitizes `[innerHTML]` unless the value went through bypassSecurityTrustHtml(),
+ * but it cannot apply an image-host or link policy, and it is a string sink under
+ * Trusted Types. A static `innerHTML="..."` attribute is not flagged.
+ *
+ * Requires `@angular-eslint/template-parser` for `*.html` files.
+ */
+const SINKS = new Set(['innerhtml', 'outerhtml']);
+const rule = {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow [innerHTML], [(innerHTML)] and [outerHTML] bindings in Angular templates.',
+            recommended: true,
+            url: 'https://github.com/shteynu/render-policy/tree/main/packages/eslint-plugin#no-innerhtml-binding',
+        },
+        schema: [],
+        messages: {
+            binding: '[{{name}}] binds markup into the live DOM: no image or link policy applies, and it is a string sink under Trusted Types. Render agent content with [rpRender] or <rp-markdown> from @render-policy/angular.',
+        },
+    },
+    create(context) {
+        return {
+            BoundAttribute(node) {
+                if (!SINKS.has(node.name.toLowerCase()))
+                    return;
+                context.report({ node: node, messageId: 'binding', data: { name: node.name } });
+            },
+        };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-innerhtml-binding.js.map

package/dist/rules/no-innerhtml-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-innerhtml-binding.js","sourceRoot":"","sources":["../../src/rules/no-innerhtml-binding.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AAEH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAQlD,MAAM,IAAI,GAAoB;IAC5B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,oFAAoF;YACjG,WAAW,EAAE,IAAI;YACjB,GAAG,EAAE,gGAAgG;SACtG;QACD,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE;YACR,OAAO,EACL,6MAA6M;SAChN;KACF;IAED,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,cAAc,CAAC,IAAwB;gBACrC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBAAE,OAAO;gBAChD,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAA8B,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5G,CAAC;SAC8B,CAAC;IACpC,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/no-unsafe-innerhtml.d.ts

@@ -0,0 +1,4 @@
+import type { Rule } from 'eslint';
+declare const rule: Rule.RuleModule;
+export default rule;
+//# sourceMappingURL=no-unsafe-innerhtml.d.ts.map

package/dist/rules/no-unsafe-innerhtml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-unsafe-innerhtml.d.ts","sourceRoot":"","sources":["../../src/rules/no-unsafe-innerhtml.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAmEnC,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UAuFhB,CAAC;eAEa,IAAI"}

package/dist/rules/no-unsafe-innerhtml.js

@@ -0,0 +1,127 @@
+const SINK_PROPERTIES = new Set(['innerHTML', 'outerHTML']);
+/** Method name to the index of its HTML argument. */
+const SINK_METHODS = new Map([
+    ['insertAdjacentHTML', 1],
+    ['setHTMLUnsafe', 0],
+    ['createContextualFragment', 0],
+]);
+const DOCUMENT_METHODS = new Set(['write', 'writeln']);
+const BYPASS_METHODS = new Set(['bypassSecurityTrustHtml']);
+function propertyName(node) {
+    if (!node.computed && node.property.type === 'Identifier')
+        return node.property.name;
+    if (node.computed && node.property.type === 'Literal' && typeof node.property.value === 'string')
+        return node.property.value;
+    return null;
+}
+function isStatic(node) {
+    if (!node)
+        return false;
+    switch (node.type) {
+        case 'Literal':
+            return true;
+        case 'TemplateLiteral':
+            return node.expressions.every((expression) => isStatic(expression));
+        case 'BinaryExpression':
+            return node.operator === '+' && isStatic(node.left) && isStatic(node.right);
+        case 'ConditionalExpression':
+            return isStatic(node.consequent) && isStatic(node.alternate);
+        default:
+            return false;
+    }
+}
+function isDocument(node) {
+    if (node.type === 'Identifier')
+        return node.name === 'document';
+    if (node.type === 'MemberExpression')
+        return propertyName(node) === 'document';
+    return false;
+}
+const rule = {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow HTML injection sinks (innerHTML, outerHTML, insertAdjacentHTML, document.write, bypassSecurityTrustHtml, dangerouslySetInnerHTML) with non-static content.',
+            recommended: true,
+            url: 'https://github.com/shteynu/render-policy/tree/main/packages/eslint-plugin#no-unsafe-innerhtml',
+        },
+        schema: [
+            {
+                type: 'object',
+                properties: {
+                    allowStatic: { type: 'boolean' },
+                },
+                additionalProperties: false,
+            },
+        ],
+        messages: {
+            assignment: 'Assigning {{what}} to {{sink}} injects markup into the live DOM. Sanitize into a fragment and insert it with replaceChildren(), for example renderHtmlInto() from @render-policy/core.',
+            method: '{{method}}() is an HTML injection sink. Pass sanitized markup only, or render through @render-policy/core.',
+            bypass: 'bypassSecurityTrustHtml() switches Angular\'s sanitizer off for this value. Render agent content with [rpRender] or <rp-markdown> from @render-policy/angular instead.',
+            jsx: 'dangerouslySetInnerHTML injects markup into the DOM. Sanitize first (renderer.trustedHTML() from @render-policy/core) or render into a ref with renderHtmlInto().',
+        },
+    },
+    create(context) {
+        const options = (context.options[0] ?? {});
+        const allowStatic = options.allowStatic ?? true;
+        const allowed = (node) => allowStatic && isStatic(node);
+        const listeners = {
+            AssignmentExpression(node) {
+                if (node.left.type !== 'MemberExpression')
+                    return;
+                const sink = propertyName(node.left);
+                if (!sink || !SINK_PROPERTIES.has(sink))
+                    return;
+                if (node.operator === '=' && allowed(node.right))
+                    return;
+                context.report({
+                    node,
+                    messageId: 'assignment',
+                    data: { sink, what: node.operator === '=' ? 'dynamic content' : `content with ${node.operator}` },
+                });
+            },
+            CallExpression(node) {
+                if (node.callee.type !== 'MemberExpression')
+                    return;
+                const method = propertyName(node.callee);
+                if (!method)
+                    return;
+                if (BYPASS_METHODS.has(method)) {
+                    if (allowed(node.arguments[0]))
+                        return;
+                    context.report({ node, messageId: 'bypass' });
+                    return;
+                }
+                let argumentIndex = SINK_METHODS.get(method);
+                if (argumentIndex === undefined && DOCUMENT_METHODS.has(method) && isDocument(node.callee.object)) {
+                    argumentIndex = 0;
+                }
+                if (argumentIndex === undefined)
+                    return;
+                const argument = node.arguments[argumentIndex];
+                if (argument && argument.type !== 'SpreadElement' && allowed(argument))
+                    return;
+                if (!argument)
+                    return;
+                context.report({ node, messageId: 'method', data: { method } });
+            },
+        };
+        const jsx = (node) => {
+            if (node.name.name !== 'dangerouslySetInnerHTML')
+                return;
+            const expression = node.value?.type === 'JSXExpressionContainer' ? node.value.expression : undefined;
+            if (expression?.type === 'ObjectExpression') {
+                const html = expression.properties.find((property) => property.type === 'Property' &&
+                    ((property.key.type === 'Identifier' && property.key.name === '__html') ||
+                        (property.key.type === 'Literal' && property.key.value === '__html')));
+                if (html && html.value.type !== 'AssignmentPattern' && html.value.type !== 'ArrayPattern' && html.value.type !== 'ObjectPattern' && allowed(html.value)) {
+                    return;
+                }
+            }
+            context.report({ node: node, messageId: 'jsx' });
+        };
+        return { ...listeners, JSXAttribute: jsx };
+    },
+};
+export default rule;
+//# sourceMappingURL=no-unsafe-innerhtml.js.map

package/dist/rules/no-unsafe-innerhtml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-unsafe-innerhtml.js","sourceRoot":"","sources":["../../src/rules/no-unsafe-innerhtml.ts"],"names":[],"mappings":"AAoBA,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAE5D,qDAAqD;AACrD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAiB;IAC3C,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACzB,CAAC,eAAe,EAAE,CAAC,CAAC;IACpB,CAAC,0BAA0B,EAAE,CAAC,CAAC;CAChC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AACvD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC;AAS5D,SAAS,YAAY,CAAC,IAA6B;IACjD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IACrF,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;IAC7H,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,IAAoC;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC;QACd,KAAK,iBAAiB;YACpB,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QACtE,KAAK,kBAAkB;YACrB,OAAO,IAAI,CAAC,QAAQ,KAAK,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9E,KAAK,uBAAuB;YAC1B,OAAO,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/D;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAsC;IACxD,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC;IAChE,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB;QAAE,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC;IAC/E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,IAAI,GAAoB;IAC5B,IAAI,EAAE;QACJ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,WAAW,EAAE,qKAAqK;YAClL,WAAW,EAAE,IAAI;YACjB,GAAG,EAAE,+FAA+F;SACrG;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;iBACjC;gBACD,oBAAoB,EAAE,KAAK;aAC5B;SACF;QACD,QAAQ,EAAE;YACR,UAAU,EACR,wLAAwL;YAC1L,MAAM,EAAE,4GAA4G;YACpH,MAAM,EACJ,wKAAwK;YAC1K,GAAG,EAAE,mKAAmK;SACzK;KACF;IAED,MAAM,CAAC,OAAO;QACZ,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAY,CAAC;QACtD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;QAChD,MAAM,OAAO,GAAG,CAAC,IAAoC,EAAW,EAAE,CAAC,WAAW,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEjG,MAAM,SAAS,GAAsB;YACnC,oBAAoB,CAAC,IAAI;gBACvB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,kBAAkB;oBAAE,OAAO;gBAClD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,OAAO;gBAChD,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;oBAAE,OAAO;gBACzD,OAAO,CAAC,MAAM,CAAC;oBACb,IAAI;oBACJ,SAAS,EAAE,YAAY;oBACvB,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,QAAQ,EAAE,EAAE;iBAClG,CAAC,CAAC;YACL,CAAC;YAED,cAAc,CAAC,IAAI;gBACjB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;oBAAE,OAAO;gBACpD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzC,IAAI,CAAC,MAAM;oBAAE,OAAO;gBAEpB,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC/B,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;wBAAE,OAAO;oBACvC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;oBAC9C,OAAO;gBACT,CAAC;gBAED,IAAI,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC7C,IAAI,aAAa,KAAK,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClG,aAAa,GAAG,CAAC,CAAC;gBACpB,CAAC;gBACD,IAAI,aAAa,KAAK,SAAS;oBAAE,OAAO;gBACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;gBAC/C,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,IAAI,OAAO,CAAC,QAAQ,CAAC;oBAAE,OAAO;gBAC/E,IAAI,CAAC,QAAQ;oBAAE,OAAO;gBACtB,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAClE,CAAC;SACF,CAAC;QAEF,MAAM,GAAG,GAAG,CAAC,IAAsB,EAAQ,EAAE;YAC3C,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,yBAAyB;gBAAE,OAAO;YACzD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,KAAK,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YACrG,IAAI,UAAU,EAAE,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,CACrC,CAAC,QAAQ,EAA+B,EAAE,CACxC,QAAQ,CAAC,IAAI,KAAK,UAAU;oBAC5B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC;wBACrE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAC1E,CAAC;gBACF,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACxJ,OAAO;gBACT,CAAC;YACH,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAA8B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,CAAC,CAAC;QAEF,OAAO,EAAE,GAAG,SAAS,EAAE,YAAY,EAAE,GAAG,EAAkC,CAAC;IAC7E,CAAC;CACF,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "eslint-plugin-render-policy",
+  "version": "0.1.0",
+  "description": "ESLint rules that flag HTML injection sinks (innerHTML, outerHTML, insertAdjacentHTML, bypassSecurityTrustHtml, dangerouslySetInnerHTML) so agent content goes through a render policy instead.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  },
+  "peerDependencies": {
+    "eslint": ">=9.0.0"
+  },
+  "devDependencies": {
+    "@angular-eslint/template-parser": "^22.5.0",
+    "@types/estree": "^1.0.8",
+    "eslint": "^10.11.0"
+  },
+  "keywords": [
+    "eslint",
+    "eslintplugin",
+    "eslint-plugin",
+    "xss",
+    "innerHTML",
+    "security"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/shteynu/render-policy.git",
+    "directory": "packages/eslint-plugin"
+  }
+}