+
+```
+
+```gjs
+
+ {{#if condition}}
+ {{debugger}}
+ {{/if}}
+
+```
+
+Examples of **correct** code for this rule:
+
+```gjs
+
+
Content
+
+```
+
+```gjs
+
+ {{this.debug}}
+
+```
+
+## Related Rules
+
+- [no-debugger](https://eslint.org/docs/rules/no-debugger) from ESLint
+
+## References
+
+- [ember-template-lint no-debugger](https://github.com/ember-template-lint/ember-template-lint/blob/master/docs/rule/no-debugger.md)
diff --git a/docs/rules/template-no-log.md b/docs/rules/template-no-log.md
new file mode 100644
index 0000000000..6992fda47c
--- /dev/null
+++ b/docs/rules/template-no-log.md
@@ -0,0 +1,60 @@
+# ember/template-no-log
+
+💼 This rule is enabled in the following [configs](https://github.com/ember-cli/eslint-plugin-ember#-configurations):  `recommended-gjs`,  `recommended-gts`.
+
+
+
+Disallows usage of `{{log}}` in templates.
+
+The `{{log}}` helper is useful for debugging but should not be present in production code. Use proper logging libraries or console statements in JavaScript code instead.
+
+## Rule Details
+
+This rule disallows the use of `{{log}}` statements in templates.
+
+## Examples
+
+Examples of **incorrect** code for this rule:
+
+```gjs
+
+ {{log "debug message"}}
+
Content
+
+```
+
+```gjs
+
+ {{#if condition}}
+ {{log this.value}}
+ {{/if}}
+
+```
+
+Examples of **correct** code for this rule:
+
+```gjs
+
+
Content
+
+```
+
+```gjs
+
+ {{this.log}}
+
+```
+
+```gjs
+
+ {{logger "info"}}
+
+```
+
+## Related Rules
+
+- [no-console](https://eslint.org/docs/rules/no-console) from ESLint
+
+## References
+
+- [ember-template-lint no-log](https://github.com/ember-template-lint/ember-template-lint/blob/master/docs/rule/no-log.md)
diff --git a/docs/rules/template-no-triple-curlies.md b/docs/rules/template-no-triple-curlies.md
new file mode 100644
index 0000000000..fe91051fc4
--- /dev/null
+++ b/docs/rules/template-no-triple-curlies.md
@@ -0,0 +1,64 @@
+# ember/template-no-triple-curlies
+
+💼 This rule is enabled in the following [configs](https://github.com/ember-cli/eslint-plugin-ember#-configurations):  `recommended-gjs`,  `recommended-gts`.
+
+
+
+Disallows usage of triple curly brackets (unescaped output) in templates.
+
+Triple curly brackets (`{{{ }}}`) render unescaped HTML, which can lead to XSS (Cross-Site Scripting) vulnerabilities if user input is not properly sanitized.
+
+## Rule Details
+
+This rule disallows the use of triple curly brackets for unescaped output. If you need to render HTML, use the `htmlSafe` helper or `SafeString` API with proper sanitization.
+
+## Examples
+
+Examples of **incorrect** code for this rule:
+
+```gjs
+
+ {{{this.content}}}
+
+```
+
+```gjs
+
+
+ {{{@htmlContent}}}
+
+
+```
+
+Examples of **correct** code for this rule:
+
+```gjs
+
+ {{this.content}}
+
+```
+
+```gjs
+
+ {{htmlSafe this.sanitizedContent}}
+
+```
+
+```gjs
+
+
+ `,
+ output: null,
+ errors: [{
+ message: 'Usage of triple curly brackets is unsafe. Use {{htmlSafe}} if absolutely necessary.',
+ type: 'GlimmerMustacheStatement',
+ }],
+ },
+ ],
+});
From 65c497d86900af1062e2a50e37c65a8928dfd9e8 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 27 Jan 2026 21:39:35 +0000
Subject: [PATCH 05/43] Add template-no-duplicate-attributes,
template-require-button-type, and template-no-positive-tabindex rules
Co-authored-by: NullVoxPopuli <199018+NullVoxPopuli@users.noreply.github.com>
---
README.md | 16 ++-
.../rules/template-no-duplicate-attributes.md | 61 ++++++++++
docs/rules/template-no-positive-tabindex.md | 59 ++++++++++
docs/rules/template-require-button-type.md | 60 ++++++++++
lib/recommended-rules-gjs.js | 5 +-
lib/recommended-rules-gts.js | 5 +-
lib/rules/template-no-duplicate-attributes.js | 69 ++++++++++++
lib/rules/template-no-positive-tabindex.js | 105 ++++++++++++++++++
lib/rules/template-require-button-type.js | 77 +++++++++++++
.../rules/template-no-duplicate-attributes.js | 89 +++++++++++++++
.../rules/template-no-positive-tabindex.js | 65 +++++++++++
.../lib/rules/template-require-button-type.js | 75 +++++++++++++
12 files changed, 680 insertions(+), 6 deletions(-)
create mode 100644 docs/rules/template-no-duplicate-attributes.md
create mode 100644 docs/rules/template-no-positive-tabindex.md
create mode 100644 docs/rules/template-require-button-type.md
create mode 100644 lib/rules/template-no-duplicate-attributes.js
create mode 100644 lib/rules/template-no-positive-tabindex.js
create mode 100644 lib/rules/template-require-button-type.js
create mode 100644 tests/lib/rules/template-no-duplicate-attributes.js
create mode 100644 tests/lib/rules/template-no-positive-tabindex.js
create mode 100644 tests/lib/rules/template-require-button-type.js
diff --git a/README.md b/README.md
index 7ed2faeb44..747f406c09 100644
--- a/README.md
+++ b/README.md
@@ -174,12 +174,20 @@ rules in templates can be disabled with eslint directives with mustache or html
🔧 Automatically fixable by the [`--fix` CLI option](https://eslint.org/docs/user-guide/command-line-interface#--fix).\
💡 Manually fixable by [editor suggestions](https://eslint.org/docs/latest/use/core-concepts#rule-suggestions).
+### Accessibility
+
+| Name | Description | 💼 | 🔧 | 💡 |
+| :--------------------------------------------------------------------------- | :-------------------------------- | :-------------------------------------------------------------- | :- | :- |
+| [template-no-positive-tabindex](docs/rules/template-no-positive-tabindex.md) | disallow positive tabindex values |   | | |
+
### Best Practices
-| Name | Description | 💼 | 🔧 | 💡 |
-| :--------------------------------------------------------- | :--------------------------------- | :-------------------------------------------------------------- | :- | :- |
-| [template-no-debugger](docs/rules/template-no-debugger.md) | disallow {{debugger}} in templates |   | | |
-| [template-no-log](docs/rules/template-no-log.md) | disallow {{log}} in templates |   | | |
+| Name | Description | 💼 | 🔧 | 💡 |
+| :--------------------------------------------------------------------------------- | :----------------------------------------------------- | :-------------------------------------------------------------- | :- | :- |
+| [template-no-debugger](docs/rules/template-no-debugger.md) | disallow {{debugger}} in templates |   | | |
+| [template-no-duplicate-attributes](docs/rules/template-no-duplicate-attributes.md) | disallow duplicate attribute names in templates |   | 🔧 | |
+| [template-no-log](docs/rules/template-no-log.md) | disallow {{log}} in templates |   | | |
+| [template-require-button-type](docs/rules/template-require-button-type.md) | require button elements to have a valid type attribute |   | 🔧 | |
### Components
diff --git a/docs/rules/template-no-duplicate-attributes.md b/docs/rules/template-no-duplicate-attributes.md
new file mode 100644
index 0000000000..4bd721bcb6
--- /dev/null
+++ b/docs/rules/template-no-duplicate-attributes.md
@@ -0,0 +1,61 @@
+# ember/template-no-duplicate-attributes
+
+💼 This rule is enabled in the following [configs](https://github.com/ember-cli/eslint-plugin-ember#-configurations):  `recommended-gjs`,  `recommended-gts`.
+
+🔧 This rule is automatically fixable by the [`--fix` CLI option](https://eslint.org/docs/latest/user-guide/command-line-interface#--fix).
+
+
+
+Disallows duplicate attribute names in templates.
+
+Duplicate attributes on the same element can lead to unexpected behavior and are often a mistake.
+
+## Rule Details
+
+This rule disallows duplicate attributes on HTML elements, components, and helpers.
+
+## Examples
+
+Examples of **incorrect** code for this rule:
+
+```gjs
+
+
+
+```
+
+```gjs
+
+
+
+```
+
+```gjs
+
+ {{helper foo="bar" foo="baz"}}
+
+```
+
+Examples of **correct** code for this rule:
+
+```gjs
+
+
+
+```
+
+```gjs
+
+
+
+```
+
+```gjs
+
+ {{helper foo="bar" baz="qux"}}
+
+```
+
+## References
+
+- [ember-template-lint no-duplicate-attributes](https://github.com/ember-template-lint/ember-template-lint/blob/master/docs/rule/no-duplicate-attributes.md)
diff --git a/docs/rules/template-no-positive-tabindex.md b/docs/rules/template-no-positive-tabindex.md
new file mode 100644
index 0000000000..1f03f74145
--- /dev/null
+++ b/docs/rules/template-no-positive-tabindex.md
@@ -0,0 +1,59 @@
+# ember/template-no-positive-tabindex
+
+💼 This rule is enabled in the following [configs](https://github.com/ember-cli/eslint-plugin-ember#-configurations):  `recommended-gjs`,  `recommended-gts`.
+
+
+
+Disallows positive `tabindex` values.
+
+Positive `tabindex` values disrupt the natural tab order of the page, making keyboard navigation confusing for users. This is especially problematic for users who rely on keyboard navigation, such as those with motor disabilities.
+
+## Rule Details
+
+This rule disallows positive integer values for the `tabindex` attribute. Only `0` (for naturally focusable elements) and `-1` (for programmatically focusable elements) are allowed.
+
+## Examples
+
+Examples of **incorrect** code for this rule:
+
+```gjs
+
+
Content
+
+```
+
+```gjs
+
+
+
+```
+
+Examples of **correct** code for this rule:
+
+```gjs
+
+
Content
+
+```
+
+```gjs
+
+
Content
+
+```
+
+```gjs
+
+
+
+```
+
+## When Not To Use It
+
+This rule should generally always be enabled for accessibility. However, if you have a specific use case where positive tabindex values are necessary and well-tested, you may disable it.
+
+## References
+
+- [ember-template-lint no-positive-tabindex](https://github.com/ember-template-lint/ember-template-lint/blob/master/docs/rule/no-positive-tabindex.md)
+- [MDN tabindex](https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/tabindex)
+- [WebAIM: Keyboard Accessibility](https://webaim.org/techniques/keyboard/tabindex)
diff --git a/docs/rules/template-require-button-type.md b/docs/rules/template-require-button-type.md
new file mode 100644
index 0000000000..3c952f9ede
--- /dev/null
+++ b/docs/rules/template-require-button-type.md
@@ -0,0 +1,60 @@
+# ember/template-require-button-type
+
+💼 This rule is enabled in the following [configs](https://github.com/ember-cli/eslint-plugin-ember#-configurations):  `recommended-gjs`,  `recommended-gts`.
+
+🔧 This rule is automatically fixable by the [`--fix` CLI option](https://eslint.org/docs/latest/user-guide/command-line-interface#--fix).
+
+
+
+Requires button elements to have a valid `type` attribute.
+
+The default behavior of buttons in forms is to submit the form. This can lead to unexpected behavior if not explicitly set. This rule ensures that all `