sds / haml-lint / 28000525549

97%

push

github

Add `UnescapedHtml` linter (#656)

Flag HAML's unescaped-output markers (`!=`, `!~`, and dynamic plain-text
`!`) at script and tag level. These bypass HTML escaping and make it easy
to introduce XSS holes when output includes user-controlled data.

Detection uses the source marker (anchored so the Ruby `!=` operator is
not flagged); only unescaped output of dynamic content is reported.
Enabled by default, detection only.

Co-authored-by: Shane da Silva <shane@dasilva.io>

25 of 25 new or added lines in 2 files covered. (100.0%)

3043 of 3125 relevant lines covered (97.38%)

23069.32 hits per line