codelaw-rules-security-html 0.3.0__py3-none-any.whl

codelaw_rules_security_html/rules/sec-html/no-template-html-sink.md

@@ -0,0 +1,39 @@
+---
+id: sec-html/no-template-html-sink
+title: "No template binding that writes HTML"
+languages: [html]
+fix: manual
+fix_reason: "whether the value is trusted, and how to sanitise it, is the author's call"
+stability: preview
+security: { cwe: [79], owasp: ["A05:2025"], severity: high }
+since: 0.2.0
+---
+
+A template does not bind a value as HTML: Angular `[innerHTML]` and `[outerHTML]`, Vue `v-html`, Alpine `x-html`.
+
+**Why:** The value is written into the page as markup, so any part of it a user controls is cross-site scripting.
+
+```codelaw
+native: sec-html/no-template-html-sink
+```
+
+## How to fix
+
+1. Bind text instead (`{{ value }}`, `v-text`, `x-text`, `[textContent]`).
+2. If it must be HTML, sanitise it with a maintained library such as DOMPurify and bind the sanitised result.
+
+## Examples
+
+### HTML
+
+#### Don't
+
+```html
+<div [innerHTML]="comment"></div>
+```
+
+#### Do
+
+```html
+<div>{{ comment }}</div>
+```

codelaw_rules_security_html/rules/sec-html/no-unsafe-template-interpolation.cases.md

@@ -0,0 +1,45 @@
+# sec-html/no-unsafe-template-interpolation — cases
+
+### case: each syntax
+
+```html
+<p>{{ x|safe }}</p>
+{% autoescape off %}
+<%- user %>
+```
+
+```expect
+1:4 sec-html/no-unsafe-template-interpolation
+2:1 sec-html/no-unsafe-template-interpolation
+3:1 sec-html/no-unsafe-template-interpolation
+```
+
+### case: a literal string marked safe
+
+```html
+<p>{{ "<b>"|safe }}</p>
+```
+
+```expect
+(none)
+```
+
+### case: EJS include and ERB trim marks
+
+```html
+<%- include('a') %><%- if x -%>
+```
+
+```expect
+(none)
+```
+
+### case: a raw block is not triple-stache
+
+```html
+{{{{raw}}}}
+```
+
+```expect
+(none)
+```

codelaw_rules_security_html/rules/sec-html/no-unsafe-template-interpolation.md

@@ -0,0 +1,39 @@
+---
+id: sec-html/no-unsafe-template-interpolation
+title: "No template syntax that turns escaping off"
+languages: [html]
+fix: manual
+fix_reason: "whether the value is trusted, and how to sanitise it, is the author's call"
+stability: preview
+security: { cwe: [79], owasp: ["A05:2025"], severity: high }
+since: 0.2.0
+---
+
+A template does not turn escaping off: Handlebars `{{{ }}}`, Jinja and Nunjucks `|safe`, Django `{% autoescape off %}`, EJS `<%-`.
+
+**Why:** The value is written into the page as markup, so any part of it a user controls is cross-site scripting.
+
+```codelaw
+native: sec-html/no-unsafe-template-interpolation
+```
+
+## How to fix
+
+1. Use the escaping form: `{{ value }}` (Handlebars, Jinja, Django), `<%= value %>` (EJS).
+2. If the value must be markup, sanitise it with a maintained library first and mark only the sanitised result safe.
+
+## Examples
+
+### HTML
+
+#### Don't
+
+```html
+<p>{{{ comment }}}</p>
+```
+
+#### Do
+
+```html
+<p>{{ comment }}</p>
+```

codelaw_rules_security_html/rules/sec-html/password-form-post.cases.md

@@ -0,0 +1,63 @@
+# sec-html/password-form-post — cases
+
+### case: get is replaced
+
+```html
+<form method="GET"><input type="password"></form>
+```
+
+```expect
+1:1 sec-html/password-form-post
+```
+
+```fixed
+<form method="post"><input type="password"></form>
+```
+
+### case: no method means get
+
+```html
+<form action="/x"><input type="password"></form>
+```
+
+```expect
+1:1 sec-html/password-form-post
+```
+
+```fixed
+<form method="post" action="/x"><input type="password"></form>
+```
+
+### case: a framework handles the submit
+
+```html
+<form (ngSubmit)="go()"><input type="password"></form>
+```
+
+```expect
+(none)
+```
+
+### case: an http action
+
+```html
+<form method="post" action="http://a.example/l"><input type="password"></form>
+```
+
+```expect
+1:21 sec-html/password-form-post
+```
+
+```fixed
+<form method="post" action="https://a.example/l"><input type="password"></form>
+```
+
+### case: no password, no finding
+
+```html
+<form method="get"><input type="search" name="q"></form>
+```
+
+```expect
+(none)
+```

codelaw_rules_security_html/rules/sec-html/password-form-post.md

@@ -0,0 +1,34 @@
+---
+id: sec-html/password-form-post
+title: "A form with a password sends it with POST over HTTPS"
+languages: [html]
+fix: suggest
+fix_reason: "a server that reads only the query string has to change with the form"
+stability: preview
+security: { cwe: [598], owasp: ["A04:2025"], severity: high }
+since: 0.2.0
+---
+
+A form holding a password field sets `method="post"` and does not post to an `http:` URL.
+
+**Why:** A form with no `method` or with `method="get"` puts the password in the URL, where history, logs and referrers keep it; an `http:` action sends it in the clear.
+
+```codelaw
+native: sec-html/password-form-post
+```
+
+## Examples
+
+### HTML
+
+#### Don't
+
+```html
+<form action="/login" method="get"><input type="password" name="pw"></form>
+```
+
+#### Do
+
+```html
+<form action="/login" method="post"><input type="password" name="pw"></form>
+```

codelaw_rules_security_html/rules/sec-html/referrer-policy.cases.md

@@ -0,0 +1,39 @@
+# sec-html/referrer-policy — cases
+
+### case: an attribute
+
+```html
+<a href="/a" referrerpolicy="unsafe-url">a</a>
+```
+
+```expect
+1:14 sec-html/referrer-policy
+```
+
+```fixed
+<a href="/a" referrerpolicy="strict-origin-when-cross-origin">a</a>
+```
+
+### case: a meta tag
+
+```html
+<meta name="referrer" content="no-referrer-when-downgrade">
+```
+
+```expect
+1:23 sec-html/referrer-policy
+```
+
+```fixed
+<meta name="referrer" content="strict-origin-when-cross-origin">
+```
+
+### case: no-referrer is safe
+
+```html
+<meta name="referrer" content="no-referrer">
+```
+
+```expect
+(none)
+```

codelaw_rules_security_html/rules/sec-html/referrer-policy.md

@@ -0,0 +1,34 @@
+---
+id: sec-html/referrer-policy
+title: "No referrer policy that leaks full URLs"
+languages: [html]
+fix: suggest
+fix_reason: "a partner may rely on the full referrer; the safer value is a suggestion"
+stability: preview
+security: { cwe: [200], owasp: ["A02:2025"], severity: low }
+since: 0.2.0
+---
+
+A `referrerpolicy` attribute or `<meta name="referrer">` is not `unsafe-url` or `no-referrer-when-downgrade`.
+
+**Why:** Both send the full URL of the page, query string included, to other sites, and a URL often holds a token or an identifier.
+
+```codelaw
+native: sec-html/referrer-policy
+```
+
+## Examples
+
+### HTML
+
+#### Don't
+
+```html
+<a href="https://other.example/" referrerpolicy="unsafe-url">Other</a>
+```
+
+#### Do
+
+```html
+<a href="https://other.example/" referrerpolicy="strict-origin-when-cross-origin">Other</a>
+```

codelaw_rules_security_html/rules/sec-html/sri-crossorigin.cases.md

@@ -0,0 +1,35 @@
+# sec-html/sri-crossorigin — cases
+
+### case: a stylesheet
+
+```html
+<link rel="stylesheet" href="https://cdn.example.com/a.css" integrity="sha384-abc">
+```
+
+```expect
+1:61 sec-html/sri-crossorigin
+```
+
+```fixed
+<link rel="stylesheet" href="https://cdn.example.com/a.css" integrity="sha384-abc" crossorigin="anonymous">
+```
+
+### case: a file on this origin
+
+```html
+<script src="/a.js" integrity="sha384-abc"></script>
+```
+
+```expect
+(none)
+```
+
+### case: crossorigin already there
+
+```html
+<script src="https://cdn.example.com/a.js" integrity="sha384-abc" crossorigin></script>
+```
+
+```expect
+(none)
+```

codelaw_rules_security_html/rules/sec-html/sri-crossorigin.md

@@ -0,0 +1,34 @@
+---
+id: sec-html/sri-crossorigin
+title: "A script or stylesheet with an integrity hash has crossorigin"
+languages: [html]
+fix: suggest
+fix_reason: "`anonymous` is right unless the file needs credentials; the suggestion assumes it does not"
+stability: preview
+security: { cwe: [353], owasp: ["A08:2025"], severity: low }
+since: 0.2.0
+---
+
+A `<script>` or `<link>` from another origin that has `integrity` also has `crossorigin`.
+
+**Why:** Without `crossorigin` the browser fetches the file without CORS and cannot read it to check the hash, so the `integrity` protects nothing.
+
+```codelaw
+native: sec-html/sri-crossorigin
+```
+
+## Examples
+
+### HTML
+
+#### Don't
+
+```html
+<script src="https://cdn.example.com/lib.js" integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"></script>
+```
+
+#### Do
+
+```html
+<script src="https://cdn.example.com/lib.js" integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC" crossorigin="anonymous"></script>
+```

codelaw_rules_security_html-0.3.0.dist-info/METADATA

@@ -0,0 +1,108 @@
+Metadata-Version: 2.4
+Name: codelaw-rules-security-html
+Version: 0.3.0
+Summary: codelaw's security rules for HTML; its presets also turn on the html pack's security rules (SR-RULE-PACKS)
+License-Expression: MIT
+License-File: LICENSE
+Project-URL: Repository, https://github.com/arpitarya/codelaw
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+
+# `@codelaw/rules-security-html` · `codelaw-rules-security-html`
+
+codelaw's HTML security rules (CSP, mixed content, iframes, forms, template sinks) — one of codelaw's first-party rule packs
+([SR-RULE-PACKS](../../records/0101_rule-packs.md)). The same files ship on npm as `@codelaw/rules-security-html` and on PyPI as
+`codelaw-rules-security-html`. Its presets **extend** `codelaw:html/security`,
+so the html pack's five security rules (`html/require-sri`,
+`html/target-blank-rel`, `html/no-inline-script`, `html/autocomplete-password`,
+`html/meta-refresh`) run without being copied here; it needs the html pack
+(`@codelaw/rules-html` or `codelaw-rules-html`) installed beside it.
+
+```toml
+# codelaw.toml
+extends = ["codelaw:html/recommended", "codelaw:sec-html/recommended"]
+preview = true   # every rule is `preview` until a corpus run promotes it
+```
+
+`codelaw init` does not add it: a security pack is chosen, not detected.
+
+## Presets
+
+<!-- docs-sync:presets -->
+
+| preset | rules | ported from |
+|---|---|---|
+| `sec-html/recommended` | 19 | extends `html/security` (the html pack's five security rules); high-confidence rules, at `error` |
+| `sec-html/strict` | 24 | `sec-html/recommended` and the heuristic rules, at `warn` |
+
+<!-- /docs-sync:presets -->
+
+`recommended` holds only high-confidence rules, at `error`; `strict` adds the
+heuristic ones, at `warn`, so a team can start without noise.
+
+## Rules
+
+| rule | flags | CWE | OWASP 2025 | fix | preset |
+|---|---|---|---|---|---|
+| `sec-html/no-inline-event-handler` | `onclick=`, `onerror=` … attributes (they block a strict CSP) | 79 | A05 | manual | `recommended` |
+| `sec-html/no-javascript-url` | `javascript:` in `href`, `src`, `action`, `formaction`, `xlink:href`, `<object data>` | 79 | A05 | manual | `recommended` |
+| `sec-html/no-mixed-content` | `http://` in `src`, `action`, a stylesheet/script `href`, a download link | 319 | A04 | suggest | `recommended` |
+| `sec-html/password-form-post` | a password form with `method=get`, no `method`, or an `http:` action | 598 | A04 | suggest | `recommended` |
+| `sec-html/iframe-sandbox` | `<iframe>` without `sandbox`, or `allow-scripts` with `allow-same-origin` | 1021 | A02 | suggest | `recommended` |
+| `sec-html/csp-meta-unsafe` | a meta CSP with `'unsafe-inline'`, `'unsafe-eval'`, `*` or `data:` in script sources | 693 | A02 | manual | `recommended` |
+| `sec-html/no-credentials-in-url` | `user:pass@host` in a URL attribute | 522 | A07 | manual | `recommended` |
+| `sec-html/no-template-html-sink` | Angular `[innerHTML]`, Vue `v-html`, Alpine `x-html` | 79 | A05 | manual | `recommended` |
+| `sec-html/referrer-policy` | `referrerpolicy` or `<meta name=referrer>` set to `unsafe-url` or `no-referrer-when-downgrade` | 200 | A02 | suggest | `recommended` |
+| `sec-html/no-srcdoc-script` | `<iframe srcdoc>` holding a script, handler or `javascript:` | 79 | A05 | manual | `recommended` |
+| `sec-html/sri-crossorigin` | `integrity` on a cross-origin file without `crossorigin` | 353 | A08 | suggest | `recommended` |
+| `sec-html/no-secret-in-hidden-input` | a hidden `password`/`token`/`secret`/`api-key` input with a literal value (CSRF tokens excluded) | 798, 200 | A07 | manual | `recommended` |
+| `sec-html/angularjs-url-expression` | `href="{{…}}"` / `src="{{…}}"` in an AngularJS page | 79 | A05 | suggest | `recommended` |
+| `sec-html/no-unsafe-template-interpolation` | Handlebars `{{{ }}}`, `|safe`, `{% autoescape off %}`, EJS `<%-` | 79 | A05 | manual | `recommended` |
+| `sec-html/no-external-base` | `<base href>` on another origin | — | A05 | manual | `strict` |
+| `sec-html/no-plugin-embed` | `<object>`, `<embed>`, `<applet>` | — | A02 | manual | `strict` |
+| `sec-html/no-sensitive-comments` | an HTML comment with a password, key, internal host or a note to remove | 615 | A02 | auto | `strict` |
+| `sec-html/form-csrf-token` | a `method=post` form with no CSRF field (extra names: `names` option) | 352 | A01 | manual | `strict` |
+| `sec-html/iframe-allow-powerful` | a cross-origin `<iframe allow="camera; microphone; …">` | 250 | A02 | manual | `strict` |
+
+Each rule is native (a Rust implementation in the engine, read with the same
+document model as the `html/*` rules) and is pattern-level: one start tag,
+one attribute, one comment or one run of template syntax. A value that is
+template code (`{{ }}`, `<% %>`) is judged by its literal prefix only, and
+the AngularJS rule runs only on a page that shows AngularJS. The catalogue
+and its sources are [W-56](../../archive/open/W-56-security-html-pack.md) and the
+OWASP HTML5, CSP and Cross-Site Request Forgery cheat sheets.
+
+`sec-html/no-inline-event-handler` and `sec-html/no-javascript-url` overlap
+`html/no-inline-script`, which the preset also turns on: a handler is
+reported twice, once with its CWE. Turn either off in `[rules]` if one report
+is enough.
+
+`suggest` fixes (`https://`, `method="post"`, `sandbox`, `crossorigin`,
+`referrerpolicy`) apply with `codelaw fix --unsafe`. A fix is not applied when
+it would add a finding the file did not have: under `strict`, turning a form
+to POST is refused while `sec-html/form-csrf-token` has nothing to see.
+
+Every rule here carries `security: { cwe, owasp, severity }`
+([SR-RULE-FORMAT](../../records/0112_rule-format.md) decision 2a), so
+
+- its finding names the CWE (`sec-html/<rule> (CWE-79) …`);
+- `codelaw rules --tag cwe:79` and `--tag owasp:A05` find it, and
+  `codelaw rules --security-coverage` puts it in the OWASP Top 10:2025 matrix;
+- SARIF carries its `security` and `external/cwe/cwe-<n>` tags and a
+  `security-severity` that GitHub code scanning ranks by
+  ([SR-CLI-MCP](../../records/0115_cli-and-mcp.md) decision 4).
+
+## `from_source:` is not taint analysis
+
+A rule here that asks whether a sink's argument comes from a request
+uses the `from_source:` predicate ([SR-RULE-FORMAT](../../records/0112_rule-format.md)
+decision 3a). It holds when the argument **is** a listed request source
+(or a method called on one), is built from one by concatenation,
+interpolation or `?:`, or is a local name bound to one **in the same
+function** — one or more assignments or destructurings away. It never
+follows a call, a return value, a parameter, a closure's outer variable or
+another file, so a value that crosses a function boundary is not seen
+(cross-function flow waits on a deeper analysis, as B-049's type-aware
+rules do). Every rule
+page that uses it says so. The sources are listed per framework in this
+pack's `data/sources/<framework>.json`.

codelaw_rules_security_html-0.3.0.dist-info/RECORD

@@ -0,0 +1,49 @@
+codelaw_rules_security_html/LICENSE,sha256=_R8NFLyGiKUo7mPzbUGbqg3hdEKYhaTsIgBGXqtFfa8,1097
+codelaw_rules_security_html/NOTICE,sha256=pz5xQ3-bTIX7I5AWsynK94tIXi5y-yeXccKjjzuGEoc,595
+codelaw_rules_security_html/README.md,sha256=mYLx3udkKxOfMxS3CJI-l_BbEn8rtm7NSiwySybm4Kk,6533
+codelaw_rules_security_html/codelaw-pack.toml,sha256=GR7Nodld6-voCGQwhhgwQmblAhqvZBz6pKEhjk-4TwY,276
+codelaw_rules_security_html/corpus.toml,sha256=tHkkuidxwbVOLwKfAy8HF8slbkqxikrF35nBjEKyyQk,807
+codelaw_rules_security_html/presets/sec-html/recommended.toml,sha256=Y5lgiv5UZObIIcLHS9bdQKNPtbmzWebEp29Z4Py4J-s,709
+codelaw_rules_security_html/presets/sec-html/strict.toml,sha256=-Zai8FsvhVcdbTCj7MmOhw-DOLmKoqGTq2RO8IEBzfM,329
+codelaw_rules_security_html/rules/sec-html/angularjs-url-expression.cases.md,sha256=7JVgqzxm0_lmUg9fKOly13R9YNWQi1OLGvVz7ELIbeY,443
+codelaw_rules_security_html/rules/sec-html/angularjs-url-expression.md,sha256=vqqeSsFk-j8lb43R18uyzpMGSpBunGV_K0P05m7W2mY,855
+codelaw_rules_security_html/rules/sec-html/csp-meta-unsafe.cases.md,sha256=AtVl27yVI319ZQ60brrubOg-_qDA3LJJIi2otjNcdq8,969
+codelaw_rules_security_html/rules/sec-html/csp-meta-unsafe.md,sha256=NQXfP-UlRtxhWhas0lHLgc6tM42d4Gky23EefpuFH48,1094
+codelaw_rules_security_html/rules/sec-html/form-csrf-token.cases.md,sha256=icHIIZoC96ag56fmw0e3PFF5-3U8J_pNhQW5gLdv2p4,702
+codelaw_rules_security_html/rules/sec-html/form-csrf-token.md,sha256=8WJj33l1vO9kYgZv-PCgAMMJ9b6CiB9l1vytzcg_u-M,1307
+codelaw_rules_security_html/rules/sec-html/iframe-allow-powerful.cases.md,sha256=HnfdfmqIHjR4GP0wh6nfqr4n9pAREiOQFS6CpGQPh4w,454
+codelaw_rules_security_html/rules/sec-html/iframe-allow-powerful.md,sha256=wGrPZau1PPBFi577nboele_LK4QZ3BhiT9g_97AUi7o,1046
+codelaw_rules_security_html/rules/sec-html/iframe-sandbox.cases.md,sha256=vgQvUYc7bPo4Z2dfvZhO4DcF5kDxllxoN-TuxbIqyN4,900
+codelaw_rules_security_html/rules/sec-html/iframe-sandbox.md,sha256=jkfpo5kdjKeDlBM4aRD0OUVnAxg1rk5gfKIq8cRxZ8I,737
+codelaw_rules_security_html/rules/sec-html/no-credentials-in-url.cases.md,sha256=PnPu9cavNhMBu9ztwnpanPepKPlWLkY7DosPY4cBVnI,310
+codelaw_rules_security_html/rules/sec-html/no-credentials-in-url.md,sha256=0Vb-lnsvH8l-nleFCEL9MKheWQhMXoYtN0Az2KDQ3pE,857
+codelaw_rules_security_html/rules/sec-html/no-external-base.cases.md,sha256=eKN4egbHaxF7xlnAcU6K0TFd-IggqKHotbwgK8NuMe0,253
+codelaw_rules_security_html/rules/sec-html/no-external-base.md,sha256=r49try5rfsm8GJj6H05Pyf2M_q97xnaGQoFyp1RxHV8,789
+codelaw_rules_security_html/rules/sec-html/no-inline-event-handler.cases.md,sha256=Wjlcip9wACUmneZe1r8qICP-BtwH8N7hbVzsJqMx8sw,560
+codelaw_rules_security_html/rules/sec-html/no-inline-event-handler.md,sha256=owCbaCFqdoKFFAuNwldEZ8xT5sFpRk6_wNqCn9Udr0g,936
+codelaw_rules_security_html/rules/sec-html/no-javascript-url.cases.md,sha256=AE7UquBNfSM1mj6T789XMdh9LQLd8EMQS_Dhh-lttOw,799
+codelaw_rules_security_html/rules/sec-html/no-javascript-url.md,sha256=O1P4blISboe6WTAZb7Lc_udc5gPonqN1h9NKpGDQNek,952
+codelaw_rules_security_html/rules/sec-html/no-mixed-content.cases.md,sha256=7F-IbMhTB4nZ22Z0Bz9gYOyg5KNvxCZi-5xP2nUpXFc,1177
+codelaw_rules_security_html/rules/sec-html/no-mixed-content.md,sha256=YHg6HfmXctrY8M3MhtlS2eBhZqvOU8rEuPV05CDCQKM,772
+codelaw_rules_security_html/rules/sec-html/no-plugin-embed.cases.md,sha256=jrUm5Y5qITsw9xqqlRN4fbFLf-vmLy4qOeSOkxfdxnE,394
+codelaw_rules_security_html/rules/sec-html/no-plugin-embed.md,sha256=nWyLpHjlSWtpWcOv40iBtG5pfkiUuYJVFHNFa_zPycE,833
+codelaw_rules_security_html/rules/sec-html/no-secret-in-hidden-input.cases.md,sha256=3oxfhm3yjggoqNajdX2lxpzyWlB_Qxx9_4xxRbjim7U,549
+codelaw_rules_security_html/rules/sec-html/no-secret-in-hidden-input.md,sha256=BuJiETRBq1np2pXRqwVtzTem3kxvifXCNYooE7cL6pk,969
+codelaw_rules_security_html/rules/sec-html/no-sensitive-comments.cases.md,sha256=eX0h8As-N8rboXm-PVXiqMna24RiVk32uBTqgiM0H6Y,738
+codelaw_rules_security_html/rules/sec-html/no-sensitive-comments.md,sha256=sBrXanUM1dUq68-tM8kP9Z8pGBnsMImNF7Rlap4lvxE,632
+codelaw_rules_security_html/rules/sec-html/no-srcdoc-script.cases.md,sha256=Hb6aIcqHDTfkWko6PfashKlPw4NokXF5LH20EFrOiCU,309
+codelaw_rules_security_html/rules/sec-html/no-srcdoc-script.md,sha256=FRzzUuL_uOTkj0gzuSOO7S7LrkqPz_0Cg0ngp7BOemA,866
+codelaw_rules_security_html/rules/sec-html/no-template-html-sink.cases.md,sha256=AjJcFJpybPliUXkcyv6eA5BKrMUuvoNO3EqFft7hOxc,302
+codelaw_rules_security_html/rules/sec-html/no-template-html-sink.md,sha256=UTYPLq45GZzaTGPXepIbGR2dU2ijTdCkJ2lAqyBHMjQ,916
+codelaw_rules_security_html/rules/sec-html/no-unsafe-template-interpolation.cases.md,sha256=VwSXPpMD3zqQpAca4huPyBARw0ZIePhg8cf0YO1OqIo,595
+codelaw_rules_security_html/rules/sec-html/no-unsafe-template-interpolation.md,sha256=fA6FYFSL5TDKwHXpF3O4UDYbg5QkgjzQ2wSUf11e7vg,969
+codelaw_rules_security_html/rules/sec-html/password-form-post.cases.md,sha256=y3lcsegT2gEwI2hZH0blqpKr66QXQykaLkUjgnX67SE,978
+codelaw_rules_security_html/rules/sec-html/password-form-post.md,sha256=TLTIM7NVxmIRCIZkSAcDoXG3lT7kCMdmEJpxLqjHV2c,848
+codelaw_rules_security_html/rules/sec-html/referrer-policy.cases.md,sha256=QIbqZ3t53l-jzgA717uisoAdfNHrcstZTZXM7fWrgFo,578
+codelaw_rules_security_html/rules/sec-html/referrer-policy.md,sha256=VXSR7AvibI3GNSbb_Oy6gQS5KNLIUPe_vvbK2JJhSsE,823
+codelaw_rules_security_html/rules/sec-html/sri-crossorigin.cases.md,sha256=h3k6cjyZGrYo_VF_I3oAfvEWY9_F51nmdX0T1fH2o94,606
+codelaw_rules_security_html/rules/sec-html/sri-crossorigin.md,sha256=RLoXHrVCWBouDvMtHFYjHhJWvzMwitasqPsmLVnWzWA,998
+codelaw_rules_security_html-0.3.0.dist-info/METADATA,sha256=dLvfu-hKbVbEtfJUifadHROaDrABYEacRNPhsFNT8vE,6893
+codelaw_rules_security_html-0.3.0.dist-info/WHEEL,sha256=iL940CG79gUG1gJG0fuOXtdNe75u1bVsFzkAeObStpM,97
+codelaw_rules_security_html-0.3.0.dist-info/licenses/LICENSE,sha256=_R8NFLyGiKUo7mPzbUGbqg3hdEKYhaTsIgBGXqtFfa8,1097
+codelaw_rules_security_html-0.3.0.dist-info/RECORD,,

codelaw_rules_security_html-0.3.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: codelaw scripts/package.py
+Root-Is-Purelib: true
+Tag: py3-none-any

codelaw_rules_security_html-0.3.0.dist-info/licenses/LICENSE

@@ -0,0 +1,23 @@
+MIT License
+
+Copyright (c) 2026 Arpit Arya
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+SPDX-License-Identifier: MIT