Investigate situation where static (safe) string is defined outside the current function

[mozfreddyb]

The isolated case should be somewhere along the lines of

const tpl = `safe`;
async function foo() {
  bar.innerHTML = tpl;
}

If this one here above doesn't help, the original issues was at http://phabricator.services.mozilla.com/D223419#C8478574NL84

We do have tests for variable tracing within the same scope, so maybe that's just a limitation.

[mozfreddyb]

I made some progress: The scope we use as per the source line here

eslint-plugin-no-unsanitized/lib/ruleHelper.js

Line 170 in c933df1

const scope = getScope(this.context, expression);

is just the current function scope. If we used the outer scope (e.g., scope.upper), then we'd actually see where the variable is defined and could mark it as safe.

What if there are multiple definitions of the same variable name though? Should be doable with good testing and making sure to match the inner scope before moving up.