Registry / testing / eslint-plugin-no-unsanitized

eslint-plugin-no-unsanitized

library4.1.5jsnpmunverified

ESLint plugin to disallow unsafe coding practices like direct assignments to innerHTML or calls to insertAdjacentHTML without sanitization. Developed by Mozilla, it supports ESLint 9 and 10 (v4.x), and the Sanitizer API. Key differentiators: focuses on security, requires tagged template literals for escaping, and has two rules (method and property).

testing auth-security

npm install eslint-plugin-no-unsanitized

github ↗package ↗

INSTALL

IMPORT

SIG · ESLINT-PLUGIN-NO-U

eslint-plugin-no-unsanitized

testingjavascriptv4.1.5

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

default

✓ import nounsanitized from 'eslint-plugin-no-unsanitized'

✗ const nounsanitized = require('eslint-plugin-no-unsanitized')

ESM-only since v4. Flat config only.

configs.recommended

✓ import nounsanitized from 'eslint-plugin-no-unsanitized'; ... nounsanitized.configs.recommended

✗ require('eslint-plugin-no-unsanitized').configs.recommended

Access via default import; no named export for configs.

plugins

✓ plugins: { nounsanitized }

✗ plugins: { 'no-unsanitized': nounsanitized }

The plugin object is keyed as 'nounsanitized' in flat config; rules are prefixed with 'nounsanitized/'

Shows how to enable both rules using flat config (ESLint >=9).

import nounsanitized from 'eslint-plugin-no-unsanitized'; export default [ nounsanitized.configs.recommended, { rules: { 'nounsanitized/method': 'error', 'nounsanitized/property': 'error' } } ];

Debug

Known issues

breakingv4 dropped support for eslintrc (legacy) config format. Only flat config is supported.

fix

Migrate to flat config using `import nounsanitized from 'eslint-plugin-no-unsanitized'` and spread `nounsanitized.configs.recommended`.

affects: >=4.0.0

breakingv4 requires ESLint ^9.0.0; no longer works with ESLint <9.

fix

Upgrade ESLint to version 9 or 10.

affects: >=4.0.0

deprecatedIn v3 and earlier, the plugin was imported via require and rules referenced as 'no-unsanitized/...'. This pattern is deprecated in v4.

fix

Use `import nounsanitized from 'eslint-plugin-no-unsanitized'` and reference rules as 'nounsanitized/...'.

affects: <4.0.0

gotchaThe plugin only allows sanitization via tagged template literals with `Sanitizer.escapeHTML` or `escapeHTML`. Other escaping functions are not recognized.

fix

Use `escapeHTML` tagged template syntax: `escapeHTML`userInput` or `Sanitizer.escapeHTML`userInput``.

affects: >=1.0.0

gotchaCalling `setHTMLUnsafe` is disallowed by default since v4.1.0 unless configured otherwise.

fix

To allow `setHTMLUnsafe`, set `'nounsanitized/method': ['error', { allowSafe: false }]` or similar custom config.

affects: >=4.1.0

Errors

Common errors & fixes

ESLint couldn't find the plugin "eslint-plugin-no-unsanitized".

Missing plugin in flat config; using legacy require or incorrect plugin object.

fix

Ensure correct import: `import nounsanitized from 'eslint-plugin-no-unsanitized'` and add to plugins object.

Definition for rule 'no-unsanitized/method' was not found.

Using legacy rule prefix 'no-unsanitized/' in flat config v4.

fix

Use prefix 'nounsanitized/' instead: `'nounsanitized/method': 'error'`.

Cannot find module 'eslint-plugin-no-unsanitized'

Plugin not installed or used in CommonJS environment without default import.

fix

Install with 'npm install --save-dev eslint-plugin-no-unsanitized' and use ESM import syntax.

Failed to load config "plugin:no-unsanitized/recommended-legacy"

Using legacy eslintrc extends in ESLint 9+ with flat config.

fix

Migrate to flat config: import plugin and spread its configs.recommended.

Upgrade

Version history

4.1.5latest on npm

Audit

Dependencies

eslintrequiredrequired peer dependency; works with ESLint ^9 or ^10

Agent activity

16 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/mozilla/eslint-plugin-no-unsanitized ↗

packagehttps://www.npmjs.com/package/eslint-plugin-no-unsanitized ↗