how to install erb_lint in a Rails project

Add 'gem "erb_lint", require: false' to your Gemfile and run bundle install. For standalone use, install globally with gem install erb_lint, then run commands via bundle exec or directly.

can erb_lint fix errors automatically

Yes, many linters support autocorrection. For example, RightTrim can enforce trimming styles, and NoJavascriptTagHelper can replace javascript_tag with script tags. Enable linters with autocorrect in your config.

erb_lint vs rubocop for ERB templates

RuboCop lints Ruby code but isn't ERB-aware; erb_lint extends RuboCop to ERB contexts and adds HTML/security checks. Use erb_lint for comprehensive template linting, and integrate RuboCop via its linter for Ruby snippets.

how to disable a rule in erb_lint

Add a disable comment like on the offending line, or configure exclusions in .erb_lint.yml. For global disables, set enabled: false for that linter in the config.

what are the most important erb_lint rules for security

Focus on ErbSafety for unsafe JavaScript interpolations, RequireScriptNonce for CSP compliance, and AllowedScriptType to restrict script tags. These are highlighted in the README as key for preventing XSS.

how to write a custom linter for erb_lint

Create a Ruby file in .erb_linters/ with a class inheriting from Linter, implement run and optionally autocorrect methods. Reference the CustomLinter example in the README, and enable it in your YAML config.

Open-Awesome

ERB Lint

MITRubyv0.9.0

A Ruby tool to lint ERB and HTML files using built-in and custom linters for code quality and security.

GitHub

747 stars137 forks0 contributors

What is ERB Lint?

ERB Lint is a Ruby gem that analyzes ERB and HTML template files to detect style violations, security issues, and common errors. It provides a suite of built-in linters for tasks like enforcing safe data interpolation, checking accessibility attributes, and ensuring consistent formatting, helping teams maintain high-quality view code.

Target Audience

Ruby on Rails developers and teams working with ERB templates who need to enforce coding standards, improve security, and ensure consistency across their view layer.

Value Proposition

Developers choose ERB Lint for its comprehensive set of Rails-aware linters, extensibility through custom linters, and seamless integration with existing tools like RuboCop, making it a robust solution for template linting without heavy configuration.

Overview

Lint your ERB or HTML files

Use Cases

Best For

Enforcing secure data interpolation in JavaScript contexts within ERB templates
Checking HTML input elements for required autocomplete attributes to improve accessibility
Ensuring consistent ERB tag formatting and whitespace across a Rails codebase
Detecting deprecated CSS classes and suggesting replacements in views
Running RuboCop rules specifically on Ruby code embedded in ERB files
Writing custom linting rules for project-specific ERB or HTML conventions

Not Ideal For

Projects using non-ERB templating engines like Haml or Slim
Teams wanting a zero-configuration linting tool out of the box
Very small or throwaway prototypes where linting overhead isn't justified
Environments with strict CI/CD performance constraints without caching enabled

Pros & Cons

Pros

Strong Security Enforcement

Linters like ErbSafety mandate safe helpers like .to_json for JavaScript interpolations, directly preventing XSS vulnerabilities as highlighted in the README examples.

Deep RuboCop Integration

The Rubocop linter runs RuboCop rules on Ruby code within ERB templates, allowing consistent style and security checks across view and application code.

Highly Extensible Architecture

Supports custom linters loaded from a .erb_linters directory, enabling teams to write project-specific rules, as demonstrated with the CustomLinter example.

Practical Autocorrection

Many linters like RightTrim and NoJavascriptTagHelper offer automatic fixing of violations, reducing manual cleanup effort and enforcing standards quickly.

Cons

Configuration Fragility

Linters such as ErbSafety and Rubocop require external config files (.better-html.yml, .rubocop.yml), and errors occur if missing, adding setup complexity.

Ruby-Only Lock-In

Tightly coupled to Ruby and ERB templates, making it useless for projects using other languages or frontend frameworks, limiting its versatility.

RuboCop Context Limitations

The README admits that RuboCop rules can trigger false positives in ERB, like Lint/UselessAssignment, due to analyzing each Ruby statement independently.

Frequently Asked Questions

Related Projects

Gitleaks

Find secrets with Gitleaks 🔑

A PHP parser written in PHP

Stars17,452

Forks1,129

Last commit12 days ago

TypeScript ESLint

:sparkles: Monorepo for all the tooling which enables ESLint to support TypeScript

Stars16,320

Forks2,952