Rule proposal: Disallow `__html`

There's an existing no-danger rule to prevent the usage of dangerouslySetInnerHTML.

However, the actual issue is construction of the __html object. The original idea with __html is that the server-side (or a client-side HTML sanitization library) would sanitize the content, then return it as a __html object. You'd then use this directly in the React component.

Essentially, the __html object is a JSON-serializable way for the server (or a library) to communicate to the client that the string of HTML is safe to use directly. It's never supposed to be used directly in product code.

Examples

Invalid

<Foo dangerouslySetInnerHTML={{__html: bar}} />

const myHTML = {__html: bar};

Valid

<Foo dangerouslySetInnerHTML={sanitizedContent} />