noAstroSetHtmlDirective (HTML)

Summary

Rule available since: v2.5.11
Diagnostic Category: lint/nursery/noAstroSetHtmlDirective
This rule doesn’t have a fix.
The default severity of this rule is error.
This rule belongs to the following domains:
- astro
Sources:
- Same as astro/no-set-html-directive

How to configure

1
{
2
  "linter": {
3
    "rules": {
4
      "nursery": {
5
        "noAstroSetHtmlDirective": "error"
6
      }
7
    }
8
  }
9
}

Description

Disallow the use of Astro’s set:html directive.

set:html renders HTML without escaping it. Using set:html can introduce cross-site scripting vulnerabilities. When raw HTML is required, sanitize the value before passing it to set:html, then suppress the diagnostic with an explanation.

Examples

Invalid

1
<div set:html={content} />

code-block.astro:1:6 lint/nursery/noAstroSetHtmlDirective ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ✖ The set:html directive inserts unescaped HTML.
  
  > 1 │ <div set:html={content} />
      │      ^^^^^^^^^^^^^^^^^^
    2 │ 
  
  ℹ Using set:html can introduce cross-site scripting vulnerabilities.
  
  ℹ Use a regular Astro expression to render text, or suppress this diagnostic with an explanation if raw HTML is required.
  
  ℹ This rule belongs to the nursery group, which means it is not yet stable and may change in the future. Visit https://biomejs.dev/linter/#nursery for more information.

Valid

1
<div>{content}</div>