# eslint-plugin-no-unsanitized

> ESLint rule to disallow unsanitized code

Latest version **4.1.5** (published 2026-02-19) · MPL-2.0 license · 0 weekly downloads

## Install

```sh
npm install eslint-plugin-no-unsanitized
pnpm add eslint-plugin-no-unsanitized
yarn add eslint-plugin-no-unsanitized
bun add eslint-plugin-no-unsanitized
```

## Health

**Score 58/100 (C)** — status: stable.

Positive: has types package; no vulnerabilities; high maintenance score; high quality score.

Warnings: low downloads; no esm support.

## Facts

| | |
|---|---|
| Version | 4.1.5 |
| Published | 2026-02-19 |
| First published | 2017-05-09 |
| Weekly downloads | 0 |
| License | MPL-2.0 |
| TypeScript types | separate (@types/eslint-plugin-no-unsanitized) |
| Module format | CommonJS |
| Dependencies | 0 |
| Unpacked size | 64.8 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 248 |
| Author | Frederik Braun et al. |
| Maintainers | mozfreddyb |
| Keywords | eslint, eslint-plugin, eslintplugin, lint, sanitize, innerHTML, security |

## Links

- npm: https://www.npmjs.com/package/eslint-plugin-no-unsanitized
- Repository: https://github.com/mozilla/eslint-plugin-no-unsanitized/issues
- Homepage: https://github.com/mozilla/eslint-plugin-no-unsanitized/
- Issues: https://github.com/mozilla/eslint-plugin-no-unsanitized/issues
- npm.io page: https://npm.io/package/eslint-plugin-no-unsanitized

## Alternatives

- [eslint-plugin-sonarjs](https://npm.io/package/eslint-plugin-sonarjs.md) — 2.9M weekly downloads
- [eslint-config-expo](https://npm.io/package/eslint-config-expo.md) — 1.5M weekly downloads
- [@matter/protocol](https://npm.io/package/@matter/protocol.md) — 63.5K weekly downloads
- [@eventcatalog/linter](https://npm.io/package/@eventcatalog/linter.md) — 24.8K weekly downloads
- [@inrupt/eslint-config-base](https://npm.io/package/@inrupt/eslint-config-base.md) — 4.5K weekly downloads

## Recent versions

- 4.1.5 (latest) — 2026-02-19
- 4.1.4 — 2025-09-05
- 4.1.2 — 2024-09-30
- 4.1.1 — 2024-09-25
- 4.1.0 — 2024-09-02
- 4.0.2 — 2022-11-24
- 4.0.1 — 2021-12-10
- 4.0.0 — 2021-11-03
- 3.2.0 — 2021-10-20
- 3.1.5 — 2021-04-14
- 3.1.4 — 2020-10-01
- 3.1.3 — 2020-09-30
- 3.1.2 — 2020-06-10
- 3.1.1 — 2020-05-05
- 3.1.0 — 2020-03-20
- … 7 more at https://npm.io/package/eslint-plugin-no-unsanitized/versions

## README

[![Build Status](https://travis-ci.org/mozilla/eslint-plugin-no-unsanitized.svg?branch=master)](https://travis-ci.org/mozilla/eslint-plugin-no-unsanitized)

# Disallow unsanitized code (no-unsanitized)

These rules disallow unsafe coding practices that may result into security
vulnerabilities. We will disallow assignments (e.g., to innerHTML) as well as
calls (e.g., to insertAdjacentHTML) without the use of a pre-defined escaping
function. The escaping functions must be called with a template string.
The function names are hardcoded as `Sanitizer.escapeHTML` and `escapeHTML`.
The plugin also supports the
[Sanitizer API](https://developer.mozilla.org/en-US/docs/Web/API/HTML_Sanitizer_API)
and calls to `.setHTML()` are also allowed by default.

This plugin is built for and used within Mozilla to maintain and improve the security
of our products and services.

# Rule Details

## method

The _method_ rule disallows certain function calls.
E.g., `document.write()` or `insertAdjacentHTML()`.
See [docs/rules/method.md](docs/rules/method.md) for more.

## property

The _property_ rule disallows certain assignment expressions, e.g., to `innerHTML`.

See [docs/rules/property.md](docs/rules/property.md) for more.

## Examples

Here are a few examples of code that we do not want to allow:

```js
foo.innerHTML = input.value;
bar.innerHTML = "<a href='" + url + "'>About</a>";
```

A few examples of allowed practices:

```js
foo.innerHTML = 5;
bar.innerHTML = "<a href='/about.html'>About</a>";
bar.innerHTML = escapeHTML`<a href='${url}'>About</a>`;
```

# Install

With **yarn** or **npm**:

```bash
$ yarn add -D eslint-plugin-no-unsanitized
$ npm install --save-dev eslint-plugin-no-unsanitized
```

## Usage

### Flat config

```js
import nounsanitized from "eslint-plugin-no-unsanitized";

export default config = [nounsanitized.configs.recommended];
```

or

```js
import nounsanitized from "eslint-plugin-no-unsanitized";

export default config = [
    {
        files: ["**/*.js"],
        plugins: { nounsanitized },
        rules: {
            "nounsanitized/method": "error",
            "nounsanitized/property": "error",
        },
    },
];
```

### eslintrc

In your `.eslintrc.json` file enable this rule with the following:

```json
{
    "extends": ["plugin:no-unsanitized/recommended-legacy"]
}
```

Or:

```json
{
    "plugins": ["no-unsanitized"],
    "rules": {
        "no-unsanitized/method": "error",
        "no-unsanitized/property": "error"
    }
}
```

# Documentation

See [docs/](docs/).

---
_Source: https://npm.io/package/eslint-plugin-no-unsanitized · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._