From d2c4dad627768283014022a687257d8858b8f7ab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Johan=20R=C3=B8ed?= <johanroed@gmail.com>
Date: Mon, 27 Apr 2026 21:26:40 +0200
Subject: [PATCH 1/3] feat: add template-no-invalid-link-href

---
 README.md                                     |   1 +
 docs/rules/template-no-invalid-link-href.md   |  51 ++++++
 lib/rules/template-no-invalid-link-href.js    | Bin 0 -> 3628 bytes
 lib/utils/static-attr-value.js                |  64 ++++++++
 .../rules/template-no-invalid-link-href.js    | 154 ++++++++++++++++++
 tests/lib/utils/static-attr-value-test.js     | 129 +++++++++++++++
 6 files changed, 399 insertions(+)
 create mode 100644 docs/rules/template-no-invalid-link-href.md
 create mode 100644 lib/rules/template-no-invalid-link-href.js
 create mode 100644 lib/utils/static-attr-value.js
 create mode 100644 tests/lib/rules/template-no-invalid-link-href.js
 create mode 100644 tests/lib/utils/static-attr-value-test.js

diff --git a/README.md b/README.md
index dafcfd0640..ea7516a68b 100644
--- a/README.md
+++ b/README.md
@@ -239,6 +239,7 @@ To disable a rule for an entire `.gjs`/`.gts` file, use a regular ESLint file-le
 | [template-no-heading-inside-button](docs/rules/template-no-heading-inside-button.md)                             | disallow heading elements inside button elements                                 | 📋 |    |    |
 | [template-no-invalid-aria-attributes](docs/rules/template-no-invalid-aria-attributes.md)                         | disallow invalid aria-* attributes                                               | 📋 |    |    |
 | [template-no-invalid-interactive](docs/rules/template-no-invalid-interactive.md)                                 | disallow non-interactive elements with interactive handlers                      | 📋 |    |    |
+| [template-no-invalid-link-href](docs/rules/template-no-invalid-link-href.md)                                     | disallow invalid href values on anchor elements                                  |    |    |    |
 | [template-no-invalid-link-text](docs/rules/template-no-invalid-link-text.md)                                     | disallow invalid or uninformative link text content                              | 📋 |    |    |
 | [template-no-invalid-link-title](docs/rules/template-no-invalid-link-title.md)                                   | disallow invalid title attributes on link elements                               | 📋 |    |    |
 | [template-no-invalid-role](docs/rules/template-no-invalid-role.md)                                               | disallow invalid ARIA roles                                                      | 📋 |    |    |
diff --git a/docs/rules/template-no-invalid-link-href.md b/docs/rules/template-no-invalid-link-href.md
new file mode 100644
index 0000000000..42e9ba5948
--- /dev/null
+++ b/docs/rules/template-no-invalid-link-href.md
@@ -0,0 +1,51 @@
+# ember/template-no-invalid-link-href
+
+<!-- end auto-generated rule header -->
+
+Disallow link elements — `<a>` and `<area>` — whose `href` value is a commonly-misused placeholder (e.g. `href="#"`, `href=""`, `href="javascript:..."`). Both carry URL semantics per HTML §4.5.1 / §4.8.14, so the same validity rules apply on each.
+
+This rule is **pragmatic accessibility/UX guidance, not spec enforcement.** Values like `href="#"` and `href="javascript:void(0)"` are technically valid URLs per the [HTML spec](https://html.spec.whatwg.org/multipage/text-level-semantics.html#the-a-element); the rule flags them because they are widely-recognized anti-patterns for faking a clickable anchor:
+
+- Breaks expected keyboard behavior (anchors should navigate; buttons should act)
+- The `javascript:` pseudo-protocol is [called out as an anti-pattern by MDN](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/a#javascript_pseudo-protocol)
+- Leaves assistive tech announcing a link that doesn't navigate
+
+If a click handler is what you want, use a `<button>`. If you want a genuine fragment link, use `href="#section-id"`.
+
+Complements [`template-link-href-attributes`](./template-link-href-attributes.md), which handles the **missing** href case. This rule validates the href **value**.
+
+## Examples
+
+This rule **forbids** the following:
+
+```gjs
+<template>
+  <a href="#">Click</a>
+  <a href="#!">Click</a>
+  <a href="">Click</a>
+  <a href>Click</a>
+  <a href="javascript:void(0)">Click</a>
+  <a href="JavaScript:alert(1)">Execute</a>
+</template>
+```
+
+This rule **allows** the following:
+
+```gjs
+<template>
+  <a href="/x">Link</a>
+  <a href="https://example.com">Link</a>
+  <a href="#section">Fragment link</a>
+  <a href="mailto:a@example.com">Email</a>
+  <a href={{this.url}}>Dynamic</a>
+</template>
+```
+
+Mustache hrefs whose value is a **static literal** (string, number, or boolean) are validated — the rule unwraps them to their static value via `getStaticAttrValue`. Only **truly dynamic** mustaches (PathExpressions, helpers with arguments, or concat statements that include a dynamic part) are skipped, because we can't statically determine what they will resolve to at runtime.
+
+## References
+
+- [HTML Living Standard — the `<a>` element](https://html.spec.whatwg.org/multipage/text-level-semantics.html#the-a-element)
+- [MDN — `<a>` — javascript: pseudo-protocol](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/a#javascript_pseudo-protocol)
+- [`anchor-is-valid` — eslint-plugin-jsx-a11y](https://github.com/jsx-eslint/eslint-plugin-jsx-a11y/blob/main/docs/rules/anchor-is-valid.md)
+- [`anchor-is-valid` — eslint-plugin-lit-a11y](https://github.com/open-wc/open-wc/blob/main/packages/eslint-plugin-lit-a11y/docs/rules/anchor-is-valid.md)
diff --git a/lib/rules/template-no-invalid-link-href.js b/lib/rules/template-no-invalid-link-href.js
new file mode 100644
index 0000000000000000000000000000000000000000..e820a95a76ba774cfecf9ed463a74595b0289340
GIT binary patch
literal 3628
zcma)9?QYye6y<kcg4>N$d&{n!3Xo7}3L%uXsBKV^0umqHS$ncO#9z#e)2zZuyaT)g
z@4=(+B%FK4cAW+aD<$#T<2!TDIrrR~sCAm0w<hz^$G2`}b>%!=(MtOhue`|)ytiMg
zqSdseeX{!J)>s`!Ns_kS6fSkLYOb(se!=UaDZ->FJySkgYe#;qY4MY~P%g8k@p}tu
zZ0+l;F6h--S7bbyuu5gVRRz5`eo79nmO9}$k58XHjhx(Vly%w?4qG}Zw8~AjO1)L4
zzy%$g96ou1n8s_@s7%wDtxH;4edcJX&uXhV9LM0*@i&hTPQQ61asT||{p21^mdcrI
zw9#ZbBUjU6LZjnf)FzL2r;`N-v)a|g1t(cco}+br3Up9ys0IkOKQU!%Ws$44j^ag<
zE@m8Rv9p+w_E|EeQmabB37(9O!cGO)xX^OE+9Ef#Ds|;&RMj5OM>}&gU^pXH<y5wy
zlb4iCN7C{8<;lyhj*m`{4v(I`Jbw7-;kTeR{qcKucN8WyZ6NY+m!Jx7LD=}@FW%e5
z=dWLX<BNM=OcOc<(<4+nwpd$@5bT72Kt%@+<=X4ao4N{6e}B2VJ32#>B#XC!%&B%#
zp%d&=tr8KJ-!wX5nZ#4dYw+{@=oE3v8UTWdQZ{=Pbl=Dwj-)S}!equ5n@%q`IE5;+
z^B%;*-Is?)&rgq!o}K_iLGZhG=I{RSUJBgK+Dg&_drvCxX!6Gpq7+grv`*>j7Lhrl
z@Rj!W_o=ONeP$}1(=WeJAfInnZBc~fgd}`xD>_q!(;p+i7C)h8Io%Sk?uR$K^mz?$
zGCW1RD0(BBx9t!NI2=^j8WL-2Q+X~Gh#Lx8^JS$j%t|c_O@ICRJ56>bgoTrx+Y?e&
z;~-^OS2U^WdEHE~GlDe*N^xBmIm_Lzm8YfE>KwFLt*be%@uZ8(Iv}S@g?%%Z{L|5Q
zBF5%gHaoZfBOg{qGgRL{%ehk}o7G5v5IhK%T=66%bW`C$SR(PVS58pnb$N&P7jI~M
z0rxdUaZTpqBj^j5q+i$VYAty~(y%_5P6&r5F!1FDrbng<a5Hj26jFSRsG`Fxv05mJ
zugiDFs_4aX!yXbu_i-O=`WE?I*XMRr2t!ACT?pJXLM#a7h3lGygFWKJi{XW#1ubZ;
ziw1ImE3>gF&@(UK_ZDqKj6PrzFRrej&FvPJ%9kTJd;7+-sTd?TgF???R-Q4-ln*hu
z(V+xkv9Mog8`maR9tUHMI8|y=Lb*Xh(wBZ-)j3x{Tj4kyP4tVrj-_H9Er#k|5SkI?
zn@W}FH&W;51Yaq?et6lSr8ty<n{}t5SH`bNg+ul4aQrEwz-O^7$}vOBaOaRY?v%`b
zN5oAKV@CaxM79OvpeVh2mp*07q$^W4we@kN9a^f7rpYma%dcm3j>|3GO>dQQnZPcw
z*1>St$x7|jo?H=etUZcg#c+x;n&C0QhcnkNz&9Pn0i=qRxpAr}>Q_*(;4EbJ$iNd+
za3qarOh^|IA_pO>+HMfyAj=rJC1wG?85Xp*z_YdYjoVAp6`*XF32Z9W<x<;uR+u!T
zI&X@0WvaQ{$4sGhS}F%BQ$Baf7`xQ#61C$sxSn?>h5V}XIcqN|^I_Y5AwXjwmT=GR
z**1W2W-i%9_r%-7EpZG$_}vfTdx><^N{=w>w&eQR6G$1>=oAv*{fT)s%hp2?VM^n<
zLEyxYF!(kmgM_~3K@B66IoE9BGa8o&nlA1@p^y|3_8S=wVgA9mIpNnPE#Al@q{1FD
zpj34wpisva#X4CfbRQ@4b@f2Be_uVAhUt$5+%J?)&9h24t=GvIG$4nh(KSFo%mWFE
z?hPYi9rEW<!L86f403r65@N2-el;&aVSWZy=)My09*7s*N1^xMGiB{YrmdkN5nB(B
zqx9z=A0!_p_XZLWEtQ)eCHFo^=!D%tkcSqfK0!s(V6Nb<DVV01_tI-)@i>_9i2zIz
zn-BOzeQbvEKuKt5SzE63@Zl!UNhV&c=r(tG715nL=-k)tA;F<rh8KfTu=R%z457aa
zJ%kU#7K}odV1v%wCkdvNJdV|r_JLpmL(?+IMEp+ZCm|M}?sgw&%!4rT%%E~1FiD#s
zT4QuAV71E)ytS*jq0r=i4G}s_lI4QY#0ko;(dhl}Eolk7$Z2rM$2hYTMm!w!_3QsK
zsNG2A^RcT7-Eii}2Q@&ss3rcdirM_1r{$ghb%?yae^(XU;@QQogs(k;l?j}|q{UO7
a<S?a?n?$sg-rozL`x|^{%OIfm@b_<E8<K<o

literal 0
HcmV?d00001

diff --git a/lib/utils/static-attr-value.js b/lib/utils/static-attr-value.js
new file mode 100644
index 0000000000..6499c782a9
--- /dev/null
+++ b/lib/utils/static-attr-value.js
@@ -0,0 +1,64 @@
+'use strict';
+
+/**
+ * Return the statically-known string value of a Glimmer attribute value node,
+ * or `undefined` when the value is dynamic (cannot be resolved at lint time).
+ *
+ * Unwraps:
+ *   - GlimmerTextNode → chars
+ *   - GlimmerMustacheStatement with a literal path (boolean/string/number) → stringified value
+ *   - GlimmerConcatStatement whose parts are all statically resolvable → joined string
+ *
+ * A missing/undefined value (valueless attribute, e.g. `<input disabled>`)
+ * returns the empty string. Pass `attr.value` — not the attribute itself.
+ */
+function getStaticAttrValue(value) {
+  if (value === null || value === undefined) {
+    return '';
+  }
+  if (value.type === 'GlimmerTextNode') {
+    return value.chars;
+  }
+  if (value.type === 'GlimmerMustacheStatement') {
+    return extractLiteral(value.path);
+  }
+  if (value.type === 'GlimmerConcatStatement') {
+    const parts = value.parts || [];
+    let out = '';
+    for (const part of parts) {
+      if (part.type === 'GlimmerTextNode') {
+        out += part.chars;
+        continue;
+      }
+      if (part.type === 'GlimmerMustacheStatement') {
+        const literal = extractLiteral(part.path);
+        if (literal === undefined) {
+          return undefined;
+        }
+        out += literal;
+        continue;
+      }
+      return undefined;
+    }
+    return out;
+  }
+  return undefined;
+}
+
+function extractLiteral(path) {
+  if (!path) {
+    return undefined;
+  }
+  if (path.type === 'GlimmerBooleanLiteral') {
+    return path.value ? 'true' : 'false';
+  }
+  if (path.type === 'GlimmerStringLiteral') {
+    return path.value;
+  }
+  if (path.type === 'GlimmerNumberLiteral') {
+    return String(path.value);
+  }
+  return undefined;
+}
+
+module.exports = { getStaticAttrValue };
diff --git a/tests/lib/rules/template-no-invalid-link-href.js b/tests/lib/rules/template-no-invalid-link-href.js
new file mode 100644
index 0000000000..930a345c5e
--- /dev/null
+++ b/tests/lib/rules/template-no-invalid-link-href.js
@@ -0,0 +1,154 @@
+'use strict';
+
+const rule = require('../../../lib/rules/template-no-invalid-link-href');
+const RuleTester = require('eslint').RuleTester;
+
+const ruleTester = new RuleTester({
+  parser: require.resolve('ember-eslint-parser'),
+  parserOptions: { ecmaVersion: 2022, sourceType: 'module' },
+});
+
+ruleTester.run('template-no-invalid-link-href', rule, {
+  valid: [
+    // Valid navigable hrefs.
+    '<template><a href="/x">Link</a></template>',
+    '<template><a href="https://example.com">Link</a></template>',
+    '<template><a href="#section">Link</a></template>',
+    '<template><a href="mailto:a@example.com">Email</a></template>',
+    '<template><a href="tel:+47123">Phone</a></template>',
+
+    // Dynamic href — rule can't statically validate, skips.
+    '<template><a href={{this.url}}>Link</a></template>',
+    '<template><a href="{{this.prefix}}/{{this.slug}}">Link</a></template>',
+
+    // No href at all — handled by template-link-href-attributes, not this rule.
+    '<template><a>Not a link</a></template>',
+
+    // Non-anchor elements are not in scope.
+    '<template><button>Click me</button></template>',
+    '<template><div href="#">Not an anchor</div></template>',
+
+    // <area> is in scope — same href semantics as <a>. Valid values pass.
+    '<template><map name="m"><area href="/region-a" shape="rect" coords="0,0,10,10" /></map></template>',
+    '<template><area href="#section" shape="default" /></template>',
+    // Dynamic area href — skip.
+    '<template><area href={{this.url}} shape="rect" coords="0,0,1,1" /></template>',
+
+    // Non-scheme URLs that happen to contain `javascript:` are not javascript:
+    // URLs — they are relative paths or fragments. The URL parser resolves
+    // them against the base URL; no script runs.
+    '<template><a href="./javascript:foo">Relative path</a></template>',
+    '<template><a href="#javascript:foo">Fragment id</a></template>',
+    '<template><a href="/javascript:foo">Absolute path</a></template>',
+    '<template><a href="?q=javascript:foo">Query string</a></template>',
+    // `javascript` as a bare word (no colon) — treated as a relative path.
+    // Our regex only matches the `javascript:` scheme (with colon), so these pass.
+    '<template><a href="javascript">Relative</a></template>',
+    '<template><a href="javascriptFoo">Relative</a></template>',
+  ],
+  invalid: [
+    // Plain "#" placeholder.
+    {
+      code: '<template><a href="#">Click</a></template>',
+      output: null,
+      errors: [{ messageId: 'invalidHref' }],
+    },
+    {
+      code: '<template><a href="#!">Click</a></template>',
+      output: null,
+      errors: [{ messageId: 'invalidHref' }],
+    },
+    // Empty / whitespace href.
+    {
+      code: '<template><a href="">Click</a></template>',
+      output: null,
+      errors: [{ messageId: 'invalidHref' }],
+    },
+    {
+      code: '<template><a href="   ">Click</a></template>',
+      output: null,
+      errors: [{ messageId: 'invalidHref' }],
+    },
+    {
+      code: '<template><a href>Click</a></template>',
+      output: null,
+      errors: [{ messageId: 'invalidHref' }],
+    },
+    // javascript: protocol.
+    {
+      code: '<template><a href="javascript:void(0)">Click</a></template>',
+      output: null,
+      errors: [{ messageId: 'invalidHref' }],
+    },
+    {
+      code: '<template><a href="JavaScript:alert(1)">Click</a></template>',
+      output: null,
+      errors: [{ messageId: 'invalidHref' }],
+    },
+    // Leading whitespace — catches obfuscations.
+    {
+      code: '<template><a href=" javascript:void(0)">Click</a></template>',
+      output: null,
+      errors: [{ messageId: 'invalidHref' }],
+    },
+    // Mustache-string-literal hrefs resolve to their static value via the
+    // shared `getStaticAttrValue` helper — the rule validates them the same
+    // as text-node values. Covers the common bypass hole where authors
+    // wrap a literal href in mustaches (`{{"#"}}`) to dodge a simple
+    // "is this a text node" check.
+    {
+      code: '<template><a href={{"#"}}>Click</a></template>',
+      output: null,
+      errors: [{ messageId: 'invalidHref' }],
+    },
+    {
+      code: '<template><a href={{"javascript:void(0)"}}>Click</a></template>',
+      output: null,
+      errors: [{ messageId: 'invalidHref' }],
+    },
+    // Single-part quoted-mustache (GlimmerConcatStatement wrapping a
+    // literal) resolves the same way.
+    {
+      code: '<template><a href="{{\'#\'}}">Click</a></template>',
+      output: null,
+      errors: [{ messageId: 'invalidHref' }],
+    },
+    // <area> shares <a>'s href semantics — same invalid values flag.
+    {
+      code: '<template><area href="#" shape="rect" coords="0,0,10,10" /></template>',
+      output: null,
+      errors: [{ messageId: 'invalidHref' }],
+    },
+    {
+      code: '<template><area href="" shape="rect" coords="0,0,10,10" /></template>',
+      output: null,
+      errors: [{ messageId: 'invalidHref' }],
+    },
+    {
+      code: '<template><area href="javascript:alert(1)" shape="rect" coords="0,0,10,10" /></template>',
+      output: null,
+      errors: [{ messageId: 'invalidHref' }],
+    },
+  ],
+});
+
+const hbsRuleTester = new RuleTester({
+  parser: require.resolve('ember-eslint-parser/hbs'),
+  parserOptions: { ecmaVersion: 2022, sourceType: 'module' },
+});
+
+hbsRuleTester.run('template-no-invalid-link-href', rule, {
+  valid: ['<a href="/x">Link</a>', '<a href={{this.url}}>Link</a>', '<a>Not a link</a>'],
+  invalid: [
+    {
+      code: '<a href="#">Click</a>',
+      output: null,
+      errors: [{ messageId: 'invalidHref' }],
+    },
+    {
+      code: '<a href="javascript:void(0)">Click</a>',
+      output: null,
+      errors: [{ messageId: 'invalidHref' }],
+    },
+  ],
+});
diff --git a/tests/lib/utils/static-attr-value-test.js b/tests/lib/utils/static-attr-value-test.js
new file mode 100644
index 0000000000..ea9a4f30c6
--- /dev/null
+++ b/tests/lib/utils/static-attr-value-test.js
@@ -0,0 +1,129 @@
+'use strict';
+
+const { getStaticAttrValue } = require('../../../lib/utils/static-attr-value');
+
+describe('getStaticAttrValue', () => {
+  it('returns empty string for null/undefined (valueless attribute)', () => {
+    expect(getStaticAttrValue(null)).toBe('');
+    expect(getStaticAttrValue(undefined)).toBe('');
+  });
+
+  it('returns chars for GlimmerTextNode', () => {
+    expect(getStaticAttrValue({ type: 'GlimmerTextNode', chars: 'hello' })).toBe('hello');
+    expect(getStaticAttrValue({ type: 'GlimmerTextNode', chars: '' })).toBe('');
+  });
+
+  it('unwraps GlimmerMustacheStatement with BooleanLiteral', () => {
+    expect(
+      getStaticAttrValue({
+        type: 'GlimmerMustacheStatement',
+        path: { type: 'GlimmerBooleanLiteral', value: true },
+      })
+    ).toBe('true');
+    expect(
+      getStaticAttrValue({
+        type: 'GlimmerMustacheStatement',
+        path: { type: 'GlimmerBooleanLiteral', value: false },
+      })
+    ).toBe('false');
+  });
+
+  it('unwraps GlimmerMustacheStatement with StringLiteral', () => {
+    expect(
+      getStaticAttrValue({
+        type: 'GlimmerMustacheStatement',
+        path: { type: 'GlimmerStringLiteral', value: 'foo' },
+      })
+    ).toBe('foo');
+    expect(
+      getStaticAttrValue({
+        type: 'GlimmerMustacheStatement',
+        path: { type: 'GlimmerStringLiteral', value: '' },
+      })
+    ).toBe('');
+  });
+
+  it('unwraps GlimmerMustacheStatement with NumberLiteral', () => {
+    expect(
+      getStaticAttrValue({
+        type: 'GlimmerMustacheStatement',
+        path: { type: 'GlimmerNumberLiteral', value: -1 },
+      })
+    ).toBe('-1');
+    expect(
+      getStaticAttrValue({
+        type: 'GlimmerMustacheStatement',
+        path: { type: 'GlimmerNumberLiteral', value: 0 },
+      })
+    ).toBe('0');
+  });
+
+  it('returns undefined for GlimmerMustacheStatement with a dynamic PathExpression', () => {
+    expect(
+      getStaticAttrValue({
+        type: 'GlimmerMustacheStatement',
+        path: { type: 'GlimmerPathExpression', original: 'this.foo' },
+      })
+    ).toBeUndefined();
+  });
+
+  it('joins GlimmerConcatStatement with only static parts', () => {
+    expect(
+      getStaticAttrValue({
+        type: 'GlimmerConcatStatement',
+        parts: [
+          { type: 'GlimmerTextNode', chars: 'prefix-' },
+          {
+            type: 'GlimmerMustacheStatement',
+            path: { type: 'GlimmerStringLiteral', value: 'mid' },
+          },
+          { type: 'GlimmerTextNode', chars: '-suffix' },
+        ],
+      })
+    ).toBe('prefix-mid-suffix');
+  });
+
+  it('joins concat with boolean and number literal parts', () => {
+    expect(
+      getStaticAttrValue({
+        type: 'GlimmerConcatStatement',
+        parts: [
+          {
+            type: 'GlimmerMustacheStatement',
+            path: { type: 'GlimmerBooleanLiteral', value: true },
+          },
+        ],
+      })
+    ).toBe('true');
+    expect(
+      getStaticAttrValue({
+        type: 'GlimmerConcatStatement',
+        parts: [
+          {
+            type: 'GlimmerMustacheStatement',
+            path: { type: 'GlimmerNumberLiteral', value: -1 },
+          },
+        ],
+      })
+    ).toBe('-1');
+  });
+
+  it('returns undefined for GlimmerConcatStatement with a dynamic part', () => {
+    expect(
+      getStaticAttrValue({
+        type: 'GlimmerConcatStatement',
+        parts: [
+          { type: 'GlimmerTextNode', chars: 'x-' },
+          {
+            type: 'GlimmerMustacheStatement',
+            path: { type: 'GlimmerPathExpression', original: 'this.foo' },
+          },
+        ],
+      })
+    ).toBeUndefined();
+  });
+
+  it('returns undefined for an unknown node type', () => {
+    expect(getStaticAttrValue({ type: 'GlimmerSubExpression' })).toBeUndefined();
+  });
+});

From e9695003c77ab01c48cd7a574b1ba8706a4bf79f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Johan=20R=C3=B8ed?= <johanroed@gmail.com>
Date: Tue, 28 Apr 2026 10:28:29 +0200
Subject: [PATCH 2/3] fix(template-no-invalid-link-href): guard concat parts
 with isArray; clarify README to include <area>

---
 README.md                      | 2 +-
 lib/utils/static-attr-value.js | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index ea7516a68b..cc24b23d92 100644
--- a/README.md
+++ b/README.md
@@ -239,7 +239,7 @@ To disable a rule for an entire `.gjs`/`.gts` file, use a regular ESLint file-le
 | [template-no-heading-inside-button](docs/rules/template-no-heading-inside-button.md)                             | disallow heading elements inside button elements                                 | 📋 |    |    |
 | [template-no-invalid-aria-attributes](docs/rules/template-no-invalid-aria-attributes.md)                         | disallow invalid aria-* attributes                                               | 📋 |    |    |
 | [template-no-invalid-interactive](docs/rules/template-no-invalid-interactive.md)                                 | disallow non-interactive elements with interactive handlers                      | 📋 |    |    |
-| [template-no-invalid-link-href](docs/rules/template-no-invalid-link-href.md)                                     | disallow invalid href values on anchor elements                                  |    |    |    |
+| [template-no-invalid-link-href](docs/rules/template-no-invalid-link-href.md)                                     | disallow invalid href values on `<a>` and `<area>` elements                      |    |    |    |
 | [template-no-invalid-link-text](docs/rules/template-no-invalid-link-text.md)                                     | disallow invalid or uninformative link text content                              | 📋 |    |    |
 | [template-no-invalid-link-title](docs/rules/template-no-invalid-link-title.md)                                   | disallow invalid title attributes on link elements                               | 📋 |    |    |
 | [template-no-invalid-role](docs/rules/template-no-invalid-role.md)                                               | disallow invalid ARIA roles                                                      | 📋 |    |    |
diff --git a/lib/utils/static-attr-value.js b/lib/utils/static-attr-value.js
index 6499c782a9..54244b5ab0 100644
--- a/lib/utils/static-attr-value.js
+++ b/lib/utils/static-attr-value.js
@@ -23,9 +23,11 @@ function getStaticAttrValue(value) {
     return extractLiteral(value.path);
   }
   if (value.type === 'GlimmerConcatStatement') {
-    const parts = value.parts || [];
+    if (!Array.isArray(value.parts)) {
+      return undefined;
+    }
     let out = '';
-    for (const part of parts) {
+    for (const part of value.parts) {
       if (part.type === 'GlimmerTextNode') {
         out += part.chars;
         continue;

From d1423df40be8b079a811a714cb280560db031a1d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Johan=20R=C3=B8ed?= <johanroed@gmail.com>
Date: Tue, 28 Apr 2026 11:58:34 +0200
Subject: [PATCH 3/3] =?UTF-8?q?docs(template-no-invalid-link-href):=20swap?=
 =?UTF-8?q?=20fragile=20HTML=20=C2=A7-numbers=20for=20stable=20anchor=20UR?=
 =?UTF-8?q?Ls?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/rules/template-no-invalid-link-href.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/rules/template-no-invalid-link-href.md b/docs/rules/template-no-invalid-link-href.md
index 42e9ba5948..ca2e89e8f2 100644
--- a/docs/rules/template-no-invalid-link-href.md
+++ b/docs/rules/template-no-invalid-link-href.md
@@ -2,7 +2,7 @@
 
 <!-- end auto-generated rule header -->
 
-Disallow link elements — `<a>` and `<area>` — whose `href` value is a commonly-misused placeholder (e.g. `href="#"`, `href=""`, `href="javascript:..."`). Both carry URL semantics per HTML §4.5.1 / §4.8.14, so the same validity rules apply on each.
+Disallow link elements — `<a>` and `<area>` — whose `href` value is a commonly-misused placeholder (e.g. `href="#"`, `href=""`, `href="javascript:..."`). Both carry URL semantics per the HTML spec ([the `<a>` element](https://html.spec.whatwg.org/multipage/text-level-semantics.html#the-a-element), [the `<area>` element](https://html.spec.whatwg.org/multipage/image-maps.html#the-area-element)), so the same validity rules apply on each.
 
 This rule is **pragmatic accessibility/UX guidance, not spec enforcement.** Values like `href="#"` and `href="javascript:void(0)"` are technically valid URLs per the [HTML spec](https://html.spec.whatwg.org/multipage/text-level-semantics.html#the-a-element); the rule flags them because they are widely-recognized anti-patterns for faking a clickable anchor: