Rule proposal: require-css-escape

[silverwind]

Description

CSS.escape should always be used when interpolating arbritrary variables into a CSS selector to ensure correct escaping.

Fail

document.querySelector(`#${id}`);

el.querySelectorAll(`a[href^="#${hash}"]`);

Pass

document.querySelector(`#${CSS.escape(id)}`);

el.querySelectorAll(`a[href^="#${CSS.escape(hash)}"]`);

Any tagged template should not trigger the rule:

document.querySelector(cssEscape`#${id}`);

[sindresorhus]

Accepted