webhook/node_modules/eslint-plugin-github/lib/rules/unescaped-html-literal.js

module.exports = {
  meta: {
    type: 'problem',
    docs: {
      description: 'disallow unescaped HTML literals',
      url: require('../url')(module)
    },
    schema: []
  },

  create(context) {
    const htmlOpenTag = /^<[a-zA-Z]/
    const message = 'Unescaped HTML literal. Use html`` tag template literal for secure escaping.'

    return {
      Literal(node) {
        if (!htmlOpenTag.test(node.value)) return

        context.report({
          node,
          message
        })
      },
      TemplateLiteral(node) {
        if (!htmlOpenTag.test(node.quasis[0].value.raw)) return

        if (!node.parent.tag || node.parent.tag.name !== 'html') {
          context.report({
            node,
            message
          })
        }
      }
    }
  }
}