noSvelteAtHtmlTags (HTML)

Language HTML

Summary

Rule available since: v2.5.11
Diagnostic Category: lint/nursery/noSvelteAtHtmlTags
This rule doesn’t have a fix.
The default severity of this rule is information.
This rule belongs to the following domains:
- svelte
Sources:
- Same as svelte/no-at-html-tags

How to configure

1
{
2
  "linter": {
3
    "rules": {
4
      "nursery": {
5
        "noSvelteAtHtmlTags": "error"
6
      }
7
    }
8
  }
9
}

Description

Disallow the use of Svelte’s {@html} tag.

The {@html} tag renders its value as unescaped HTML. This can lead to cross-site scripting (XSS) vulnerabilities when the value contains untrusted content.

If raw HTML is required, sanitize the value before passing it to {@html}.

Examples

Invalid

1
{@html content}

code-block.svelte:1:1 lint/nursery/noSvelteAtHtmlTags ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ℹ The {@html} tag renders unescaped HTML.
  
  > 1 │ {@html content}
      │ ^^^^^^^^^^^^^^^
    2 │ 
  
  ℹ Using {@html} can lead to cross-site scripting (XSS) vulnerabilities.
  
  ℹ Render the value as text, or sanitize it before using {@html}.
  
  ℹ This rule belongs to the nursery group, which means it is not yet stable and may change in the future. Visit https://biomejs.dev/linter/#nursery for more information.

Valid

1
{content}

References

Svelte HTML tag