You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Template literals used as values for the css and svg tag functions are vulnerable to the same issues with invalid escape sequences as the html tag function.
For example the following code leads to an empty CSS result with no error or warning to indicate what's gone wrong:
so far we've stayed away from the css templates since something like stylelint should be responsible for that. but this particular case is actually about the JS around the template, so we're probably ok.
we should probably create some util function like isLitTemplate which basically asserts that its a html, css or svg tagged template expr.
we don't need to update the other rules to use that yet, so we can keep this tightly scoped. then just need to update the docs to mention that we check all 3 for this rule
Template literals used as values for the
css
andsvg
tag functions are vulnerable to the same issues with invalid escape sequences as thehtml
tag function.For example the following code leads to an empty CSS result with no error or warning to indicate what's gone wrong:
I'd be in favour of expanding the
no-invalid-escape-sequences
rule to cover these other kinds of template literals.Happy to do a PR for this with docs changes if that's helpful.
The text was updated successfully, but these errors were encountered: