chore: re-enable and extend unescaped-html-literal eslint rule (#39832)

https://github.com/go-gitea/gitea/pull/38046 accidentally dropped
`gitea/unescaped-html-literal` from the eslint config, so it has been
off since. Raised in
https://github.com/go-gitea/gitea/pull/39829#issuecomment-6246720235.

- Re-enable the rule, exempting e2e tests like unit tests
- Detect tags anywhere in strings and template chunks, not only at the
start
- Allow `htmlRaw` templates, they escape like `html`
- Fix the existing violations, which escapes the heatmap tooltip and
shortcut keys

tools/eslint-rules/unescaped-html-literal.test.ts

@@ -28,6 +28,10 @@ ruleTester.run('unescaped-html-literal', rule, {
       code: 'const helloTemplate = (name) => html`<div>Hello ${name}!</div>`;',
       languageOptions: {ecmaVersion: 2017},
     },
+    {
+      code: 'const attr = htmlRaw` width="${width}"`, img = htmlRaw`<img ${attr}>`, cmp = "a < b";',
+      languageOptions: {ecmaVersion: 2017},
+    },
   ],
   invalid: [
     {
@@ -66,6 +70,21 @@ ruleTester.run('unescaped-html-literal', rule, {
         },
       ],
     },
+    {
+      code: "const rowHTML = `${cells}</tr>`, tailHTML = '</tbody>', textHTML = 'Hello <b>World</b>'",
+      languageOptions: {ecmaVersion: 2017},
+      errors: [
+        {
+          message: 'Unescaped HTML literal. Use html`` tag template literal for secure escaping.',
+        },
+        {
+          message: 'Unescaped HTML literal. Use html`` tag template literal for secure escaping.',
+        },
+        {
+          message: 'Unescaped HTML literal. Use html`` tag template literal for secure escaping.',
+        },
+      ],
+    },
     {
       code: 'const helloHTML = foo`<div>Hello ${name}!</div>`',
       languageOptions: {ecmaVersion: 2017},

tools/eslint-rules/unescaped-html-literal.ts

@@ -2,7 +2,8 @@
 // https://github.com/github/eslint-plugin-github/blob/main/lib/rules/unescaped-html-literal.js
 import type {JSRuleDefinition, JSRuleDefinitionTypeOptions} from 'eslint';
 
-const htmlOpenTag = /^\s*<[a-zA-Z]/;
+const htmlTag = /<\/?[a-z][\w-]*[\s/>]/i;
+const escapingTags = new Set(['html', 'htmlRaw']);
 
 const rule: JSRuleDefinition<JSRuleDefinitionTypeOptions> = {
   meta: {
@@ -14,7 +15,7 @@ const rule: JSRuleDefinition<JSRuleDefinitionTypeOptions> = {
 
   create: (context) => ({
     Literal(node) {
-      if (typeof node.value !== 'string' || !htmlOpenTag.test(node.value)) return;
+      if (typeof node.value !== 'string' || !htmlTag.test(node.value)) return;
 
       context.report({
         node,
@@ -22,11 +23,10 @@ const rule: JSRuleDefinition<JSRuleDefinitionTypeOptions> = {
       });
     },
     TemplateLiteral(node) {
-      const templateStart = node.quasis[0]?.value.raw;
-      if (!templateStart || !htmlOpenTag.test(templateStart)) return;
+      if (node.quasis.every((quasi) => !htmlTag.test(quasi.value.raw))) return;
 
       const parent = node.parent;
-      if (parent?.type === 'TaggedTemplateExpression' && parent.tag.type === 'Identifier' && parent.tag.name === 'html') return;
+      if (parent?.type === 'TaggedTemplateExpression' && parent.tag.type === 'Identifier' && escapingTags.has(parent.tag.name)) return;
 
       context.report({
         node,