/**
 * HTML Attribute Security Pass
 *
 * Runs attribute-level security checks directly on the HTML AST.
 * These rules do not require IR — they operate on element attributes.
 *
 * Rules:
 *   H1: html-missing-noopener   (CWE-1022) — <a target="_blank"> without rel="noopener"
 *   H2: html-javascript-uri     (CWE-79)   — javascript: in href/src/action
 *   H3: html-missing-sandbox    (CWE-1021) — <iframe> without sandbox
 *   H4: html-mixed-content      (CWE-319)  — http:// resource in script/link/img/iframe
 *   H5: html-missing-sri        (CWE-353)  — CDN script/stylesheet without integrity
 *   H6: html-autocomplete-sensitive (CWE-525) — sensitive input without autocomplete="off"
 *   H7: html-inline-event-handler (CWE-79) — inline on* handler (CSP incompatible)
 *   H8: html-form-action-javascript (CWE-79) — <form action="javascript:...">
 */
import type { Node as SyntaxNode } from 'web-tree-sitter';
import type { SastFinding } from '../../types/index.js';
/**
 * Run all HTML attribute security checks.
 */
export declare function runHtmlAttributeSecurityChecks(rootNode: SyntaxNode, filePath: string): SastFinding[];
//# sourceMappingURL=html-attribute-security-pass.d.ts.map