
Security News
Meet Socket at Black Hat and DEF CON 2025 in Las Vegas
Meet Socket at Black Hat & DEF CON 2025 for 1:1s, insider security talks at Allegiant Stadium, and a private dinner with top minds in software supply chain security.
eslint-plugin-script-tags
Advanced tools
An ESLint plugin that allows you to lint the content of <script>
tags in arbitrary text.
Unlike eslint-plugin-html, which parses HTML to find <script>
s, this plugin uses a regular expression.
The advantage of using a regular expression, and the reason this plugin exists, is that by avoiding a parser you can find and lint <script>
s in arbitrary text — text that might not parse nicely as HTML, such as Markdown files with HTML fenced code blocks that contain <script>
s. Like this (imagine the '''
s are backticks):
Here is some *markdown*.
'''html
<div>
<script>
// Here is JS you'd like to lint!
var a = "foo";
</script>
'''
(If you want to lint JS fenced code blocks, use eslint-plugin-markdown).
The disadvantage of using a regular expression, of course, is that it's not as robust as a real parser. If your <script>
is within a comment, for example, it will still be linted: the regular expression doesn't know about the comment. You might like that, or you might not.
Use this module like any other ESLint plugin.
Unfortunately, we do need to provide a finite list of file extensions to check. Here's the current list:
.html
.md
.jsp
.tag
.hbs
.ejs
.php
.vue
.erb
There's no reason not to add more: so if you'd like another, please PR!
Expected indentation (if you use the indent
rule) is determined by the first line of code. This can get hairy if you do something sloppy like:
<script>var a = 'foo';
var b = 'bar';
</script>
So I wouldn't do that.
Ideally this module could allow you to arbitrarily modify the expected tags regular expression, from <script>...</script>
to something like {% highlight js %}...{% endhighlight %}
or [javascript-block]...[end javascript-block]
, etc. However, to do so would require adding options, and it doesn't seem that ESLint's built options into the processor API. If you would like this feature and want to work on adding options, your help would be welcome.
0.5.0
.erb
extension.FAQs
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Meet Socket at Black Hat & DEF CON 2025 for 1:1s, insider security talks at Allegiant Stadium, and a private dinner with top minds in software supply chain security.
Security News
CAI is a new open source AI framework that automates penetration testing tasks like scanning and exploitation up to 3,600× faster than humans.
Security News
Deno 2.4 brings back bundling, improves dependency updates and telemetry, and makes the runtime more practical for real-world JavaScript projects.