eslint-plugin-no-unsanitized/docs/rules/customization.md

ESLint rule to disallow unsanitized code

# Customization

## Variable Tracing

The plugin allows a limit back-tracing of variables.
This will be used to check code like here:

```js
const greeting_template = `<p>Hello World!</p>`;
// ... lots of other code in between ...
someElement.innerHTML = greeting_template;
```

Currently, backtracing will only allow const and let variables that contain string literals only.
Further assignments to these variables will also be checked for validation.

**Backtracing can be disabled by setting the boolean
option `variableTracing` to `false`.**

Both values are supported and tested in CI.

## Customization Examples

You can customize the way this rule works in various ways.

-   Add to the list of properties or functions to be checked for potentially
    dangers variable input
-   Add to the list of allowed escaping functions to mitigate security concerns
-   Besides adding to the list, you may override the defaults and provide an exhaustive list yourself

### Disallow the `html` function by specifically checking input for the first function parameter

```json
{
    "rules": {
        "no-unsanitized/method": [
            "error",
            {},
            {
                "html": {
                    "properties": [0]
                }
            }
        ]
    }
}
```

## Advanced configuration

```js
{
    "plugins": ["no-unsanitized"],
    "rules": {
        "no-unsanitized/method": [
            "error",
            {
                disableDefault: true,
                escape: {
                    taggedTemplates: ["safeHTML"]
                }
            },
            {
                html: {
                    properties: [0]
                }
            }
        ],
        "no-unsanitized/method": [
            "error",
            {
                escape: {
                    taggedTemplates: ["safeHTML"]
                }
            },
            {
                innerHTML: {
                    objectMatches: ["document.*"]
                }
            }
        ]
    }
}
```

### Override list of escaping functions for property assignments only

TBD

#### More

-   See [our rule schema definition](https://github.com/mozilla/eslint-plugin-no-unsanitized/blob/main/SCHEMA.md).