feat(lint/html): add noAstroSetHtmlDirective

.changeset/light-ducks-lie.md

@@ -0,0 +1,11 @@
+---
+"@biomejs/biome": patch
+---
+
+Added a new nursery rule [`noAstroSetHtmlDirective`](https://biomejs.dev/linter/rules/no-astro-set-html-directive/), which disallows Astro's `set:html` directive because untrusted content can introduce cross-site scripting vulnerabilities.
+
+For example, the following snippet triggers the rule:
+
+```astro
+<div set:html={content} />
+```

crates/biome_html_analyze/src/lint/nursery/no_astro_set_html_directive.rs

@@ -0,0 +1,75 @@
+use biome_analyze::{
+    Ast, Rule, RuleDiagnostic, RuleDomain, RuleSource, context::RuleContext, declare_lint_rule,
+};
+use biome_console::markup;
+use biome_html_syntax::AstroSetDirective;
+use biome_languages::HtmlFileSource;
+use biome_rowan::AstNode;
+use biome_rule_options::no_astro_set_html_directive::NoAstroSetHtmlDirectiveOptions;
+
+declare_lint_rule! {
+    /// Disallow the use of Astro's `set:html` directive.
+    ///
+    /// `set:html` renders HTML without escaping it. Passing untrusted content to the directive can introduce cross-site scripting vulnerabilities.
+    ///
+    /// ## Examples
+    ///
+    /// ### Invalid
+    ///
+    /// ```astro,expect_diagnostic
+    /// <div set:html={content} />
+    /// ```
+    ///
+    /// ### Valid
+    ///
+    /// ```astro
+    /// <div>{content}</div>
+    /// ```
+    ///
+    /// ## References
+    ///
+    /// - [Astro `set:html` directive](https://docs.astro.build/en/reference/directives-reference/#sethtml)
+    pub NoAstroSetHtmlDirective {
+        version: "next",
+        name: "noAstroSetHtmlDirective",
+        language: "html",
+        recommended: false,
+        domains: &[RuleDomain::Astro],
+        sources: &[RuleSource::EslintAstro("no-set-html-directive").same()],
+    }
+}
+
+impl Rule for NoAstroSetHtmlDirective {
+    type Query = Ast<AstroSetDirective>;
+    type State = ();
+    type Signals = Option<Self::State>;
+    type Options = NoAstroSetHtmlDirectiveOptions;
+
+    fn run(ctx: &RuleContext<Self>) -> Self::Signals {
+        if !ctx.source_type::<HtmlFileSource>().is_astro() {
+            return None;
+        }
+
+        let value = ctx.query().value().ok()?;
+        let name = value.name().ok()?.token_text_trimmed()?;
+        (name.text() == "html").then_some(())
+    }
+
+    fn diagnostic(ctx: &RuleContext<Self>, _state: &Self::State) -> Option<RuleDiagnostic> {
+        Some(
+            RuleDiagnostic::new(
+                rule_category!(),
+                ctx.query().range(),
+                markup! {
+                    "This "<Emphasis>"set:html"</Emphasis>" directive inserts unescaped HTML."
+                },
+            )
+            .note(markup! {
+                "Passing untrusted content to "<Emphasis>"set:html"</Emphasis>" can introduce cross-site scripting vulnerabilities."
+            })
+            .note(markup! {
+                "Use a regular Astro expression to render text. If raw HTML is required, sanitize the value before passing it to "<Emphasis>"set:html"</Emphasis>" and suppress this diagnostic with an explanation."
+            }),
+        )
+    }
+}

crates/biome_html_analyze/tests/specs/nursery/noAstroSetHtmlDirective/invalid.astro

@@ -0,0 +1,5 @@
+<!-- should generate diagnostics -->
+<div set:html={content}></div>
+<section set:html="<p>content</p>"></section>
+<aside set:html=`<p>content</p>`></aside>
+<article set:html></article>

crates/biome_html_analyze/tests/specs/nursery/noAstroSetHtmlDirective/invalid.astro.snap

@@ -0,0 +1,150 @@
+---
+source: crates/biome_html_analyze/tests/spec_tests.rs
+expression: invalid.astro
+---
+# Input
+```astro
+<!-- should generate diagnostics -->
+<div set:html={content}></div>
+<section set:html="<p>content</p>"></section>
+<aside set:html=`<p>content</p>`></aside>
+<article set:html></article>
+
+```
+
+# Diagnostics
+```
+invalid.astro:4:17 parse ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  × Unexpected character in unquoted attribute value
+
+    2 │ <div set:html={content}></div>
+    3 │ <section set:html="<p>content</p>"></section>
+  > 4 │ <aside set:html=`<p>content</p>`></aside>
+      │                 ^
+    5 │ <article set:html></article>
+    6 │ 
+
+
+```
+
+```
+invalid.astro:4:17 parse ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  × Unexpected character ```
+
+    2 │ <div set:html={content}></div>
+    3 │ <section set:html="<p>content</p>"></section>
+  > 4 │ <aside set:html=`<p>content</p>`></aside>
+      │                 ^
+    5 │ <article set:html></article>
+    6 │ 
+
+
+```
+
+```
+invalid.astro:4:18 parse ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  × Expected an attribute but instead found '<'.
+
+    2 │ <div set:html={content}></div>
+    3 │ <section set:html="<p>content</p>"></section>
+  > 4 │ <aside set:html=`<p>content</p>`></aside>
+      │                  ^
+    5 │ <article set:html></article>
+    6 │ 
+
+  i Expected an attribute here.
+
+    2 │ <div set:html={content}></div>
+    3 │ <section set:html="<p>content</p>"></section>
+  > 4 │ <aside set:html=`<p>content</p>`></aside>
+      │                  ^
+    5 │ <article set:html></article>
+    6 │ 
+
+
+```
+
+```
+invalid.astro:2:6 lint/nursery/noAstroSetHtmlDirective ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  i This set:html directive inserts unescaped HTML.
+
+    1 │ <!-- should generate diagnostics -->
+  > 2 │ <div set:html={content}></div>
+      │      ^^^^^^^^^^^^^^^^^^
+    3 │ <section set:html="<p>content</p>"></section>
+    4 │ <aside set:html=`<p>content</p>`></aside>
+
+  i Passing untrusted content to set:html can introduce cross-site scripting vulnerabilities.
+
+  i Use a regular Astro expression to render text. If raw HTML is required, sanitize the value before passing it to set:html and suppress this diagnostic with an explanation.
+
+  i This rule belongs to the nursery group, which means it is not yet stable and may change in the future. Visit https://biomejs.dev/linter/#nursery for more information.
+
+
+```
+
+```
+invalid.astro:3:10 lint/nursery/noAstroSetHtmlDirective ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  i This set:html directive inserts unescaped HTML.
+
+    1 │ <!-- should generate diagnostics -->
+    2 │ <div set:html={content}></div>
+  > 3 │ <section set:html="<p>content</p>"></section>
+      │          ^^^^^^^^^^^^^^^^^^^^^^^^^
+    4 │ <aside set:html=`<p>content</p>`></aside>
+    5 │ <article set:html></article>
+
+  i Passing untrusted content to set:html can introduce cross-site scripting vulnerabilities.
+
+  i Use a regular Astro expression to render text. If raw HTML is required, sanitize the value before passing it to set:html and suppress this diagnostic with an explanation.
+
+  i This rule belongs to the nursery group, which means it is not yet stable and may change in the future. Visit https://biomejs.dev/linter/#nursery for more information.
+
+
+```
+
+```
+invalid.astro:4:8 lint/nursery/noAstroSetHtmlDirective ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  i This set:html directive inserts unescaped HTML.
+
+    2 │ <div set:html={content}></div>
+    3 │ <section set:html="<p>content</p>"></section>
+  > 4 │ <aside set:html=`<p>content</p>`></aside>
+      │        ^^^^^^^^^
+    5 │ <article set:html></article>
+    6 │ 
+
+  i Passing untrusted content to set:html can introduce cross-site scripting vulnerabilities.
+
+  i Use a regular Astro expression to render text. If raw HTML is required, sanitize the value before passing it to set:html and suppress this diagnostic with an explanation.
+
+  i This rule belongs to the nursery group, which means it is not yet stable and may change in the future. Visit https://biomejs.dev/linter/#nursery for more information.
+
+
+```
+
+```
+invalid.astro:5:10 lint/nursery/noAstroSetHtmlDirective ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  i This set:html directive inserts unescaped HTML.
+
+    3 │ <section set:html="<p>content</p>"></section>
+    4 │ <aside set:html=`<p>content</p>`></aside>
+  > 5 │ <article set:html></article>
+      │          ^^^^^^^^
+    6 │ 
+
+  i Passing untrusted content to set:html can introduce cross-site scripting vulnerabilities.
+
+  i Use a regular Astro expression to render text. If raw HTML is required, sanitize the value before passing it to set:html and suppress this diagnostic with an explanation.
+
+  i This rule belongs to the nursery group, which means it is not yet stable and may change in the future. Visit https://biomejs.dev/linter/#nursery for more information.
+
+
+```

crates/biome_html_analyze/tests/specs/nursery/noAstroSetHtmlDirective/valid.astro

@@ -0,0 +1,4 @@
+<!-- should not generate diagnostics -->
+<div set:text={content}></div>
+<div>{content}</div>
+<div set:HTML={content}></div>