noAstroSetHtmlDirective (JavaScript)
Summary
Section titled “Summary”- Rule available since:
v2.5.11 - Diagnostic Category:
lint/nursery/noAstroSetHtmlDirective - This rule doesn’t have a fix.
- The default severity of this rule is error.
- This rule belongs to the following domains:
- Sources:
- Same as
astro/no-set-html-directive
- Same as
How to configure
Section titled “How to configure”{ "linter": { "rules": { "nursery": { "noAstroSetHtmlDirective": "error" } } }}Description
Section titled “Description”Disallow the use of Astro’s set:html directive.
set:html renders HTML without escaping it. Using set:html can introduce cross-site scripting vulnerabilities.
When raw HTML is required, sanitize the value before passing it to set:html, then suppress the diagnostic with an explanation.
Examples
Section titled “Examples”Invalid
Section titled “Invalid”{show && <span set:html={content} />}{show && <span>{content}</span>}References
Section titled “References”Related links
Section titled “Related links”Sponsored by
Copyright (c) 2023-present Biome Developers and Contributors.