no-unsafe-markdown

Disallows potentially executable content in description fields.

Description fields support Markdown and are rendered by documentation tools. Embedded <script> tags, HTML event handler attributes (such as onerror), and javascript: URLs can execute in the reader's browser, which makes them a cross-site scripting risk — especially when parts of the API description come from external sources. This rule flags the common patterns, but it doesn't replace HTML sanitization in the rendering tool. Keep executable code out of descriptions.

Example configuration:

rules:
  no-unsafe-markdown: error

Examples of incorrect Markdown in description fields :

info:
  description: Contains a malicious script tag <script>alert('hello')</script>

info:
  description: Contains an event handler <img src=x onerror=alert('hello')>

info:
  description: Contains a malicious link [click](javascript:alert('hello'))

Example of correct Markdown in description fields:

info:
  description: Plain text, no executable code.

• no-enum-type-mismatch
• configurable rules

• Rule source