@askviraj/linter 1.1.5 → 1.1.6

package/node_modules/@rviscomi/capo.js/src/lib/validations/content-type.js

@@ -0,0 +1,94 @@
+/**
+ * @typedef {import('../../adapters/adapter.js').AdapterInterface} AdapterInterface
+ * @typedef {import('../validation.js').CustomValidationResult} CustomValidationResult
+ */
+
+/**
+ * @param {any} element
+ * @param {AdapterInterface} adapter
+ * @returns {boolean}
+ */
+export function isContentType(element, adapter) {
+  if (adapter.getTagName(element) !== "meta") return false;
+  if (adapter.hasAttribute(element, "charset")) return true;
+  const httpEquiv = adapter.getAttribute(element, "http-equiv");
+  return httpEquiv?.toLowerCase() === "content-type";
+}
+
+/**
+ * @param {any} element
+ * @param {AdapterInterface} adapter
+ * @returns {CustomValidationResult}
+ */
+export function validateContentType(element, adapter) {
+  /** @type {string[]} */
+  const warnings = [];
+  /** @type {any} */
+  let payload = null;
+
+  const isCharset = adapter.hasAttribute(element, "charset");
+  const httpEquiv = adapter.getAttribute(element, "http-equiv");
+  const isContentTypeMeta = httpEquiv?.toLowerCase() === "content-type";
+
+  if (isCharset || isContentTypeMeta) {
+    const siblings = adapter.getSiblings(element);
+    const hasDuplicateCharset = siblings.some((sibling) => {
+      if (adapter.getTagName(sibling) !== "meta") return false;
+      if (adapter.hasAttribute(sibling, "charset")) return true;
+      const siblingHttpEquiv = adapter.getAttribute(sibling, "http-equiv");
+      return siblingHttpEquiv?.toLowerCase() === "content-type";
+    });
+
+    if (hasDuplicateCharset) {
+      const parent = adapter.getParent(element);
+      if (parent) {
+        const charsetElements = adapter.getChildren(parent).filter((/** @type {any} */ child) => {
+          if (adapter.getTagName(child) !== "meta") return false;
+          if (adapter.hasAttribute(child, "charset")) return true;
+          const childHttpEquiv = adapter.getAttribute(child, "http-equiv");
+          return childHttpEquiv?.toLowerCase() === "content-type";
+        });
+        const encodingDeclaration = charsetElements.find((/** @type {any} */ el) => el !== element);
+        if (encodingDeclaration) {
+          payload = payload ?? {};
+          payload.encodingDeclaration = encodingDeclaration;
+          warnings.push(
+            `There can only be one meta-based character encoding declaration per document. Already found \`${adapter.stringify(encodingDeclaration)}\`.`,
+          );
+        }
+      }
+    }
+  }
+
+  if (typeof adapter.getCharacterPosition === "function") {
+    const charPos = adapter.getCharacterPosition(element);
+    if (charPos !== null && charPos > 1024) {
+      payload = payload ?? {};
+      payload.characterPosition = charPos;
+      warnings.push(
+        `The element containing the character encoding declaration must be serialized completely within the first 1024 bytes of the document. Found at byte ${charPos}.`,
+      );
+    }
+  }
+
+  let charset = null;
+  if (isCharset) {
+    charset = adapter.getAttribute(element, "charset");
+  } else {
+    const charsetPattern = /text\/html;\s*charset=(.*)/i;
+    charset = adapter.getAttribute(element, "content")?.match(charsetPattern)?.[1]?.trim();
+  }
+
+  if (charset?.toLowerCase() !== "utf-8") {
+    payload = payload ?? {};
+    payload.charset = charset;
+    warnings.push(`Documents are required to use UTF-8 encoding. Found "${charset}".`);
+  }
+
+  if (warnings.length) {
+    warnings[warnings.length - 1] +=
+      "\nLearn more: https://html.spec.whatwg.org/multipage/semantics.html#character-encoding-declaration";
+  }
+
+  return { ruleId: "valid-charset", warnings, payload };
+}

package/node_modules/@rviscomi/capo.js/src/lib/validations/csp.js

@@ -0,0 +1,68 @@
+/**
+ * @typedef {import('../../adapters/adapter.js').AdapterInterface} AdapterInterface
+ * @typedef {import('../validation.js').CustomValidationResult} CustomValidationResult
+ */
+
+/**
+ * @param {any} element
+ * @param {AdapterInterface} adapter
+ * @returns {CustomValidationResult}
+ */
+export function validateCSP(element, adapter) {
+  /** @type {string[]} */
+  const warnings = [];
+  /** @type {any} */
+  let payload = null;
+
+  const httpEquiv = adapter.getAttribute(element, "http-equiv");
+  const httpEquivLower = httpEquiv?.toLowerCase();
+
+  if (httpEquivLower === "content-security-policy-report-only") {
+    warnings.push("CSP Report-Only is forbidden in meta tags");
+    return {
+      ruleId: "no-meta-csp",
+      warnings,
+      payload,
+    };
+  }
+
+  if (httpEquivLower === "content-security-policy") {
+    warnings.push("meta CSP discouraged. See https://crbug.com/1458493.");
+  }
+
+  const content = adapter.getAttribute(element, "content");
+  if (!content) {
+    warnings.push("Invalid CSP. The content attribute must be set.");
+    return { ruleId: "no-meta-csp", warnings, payload };
+  }
+
+  /** @type {Record<string, string>} */
+  const directives = Object.fromEntries(
+    content.split(/\s*;\s*/).map((directive) => {
+      const [key, ...value] = directive.split(" ");
+      return [key, value.join(" ")];
+    }),
+  );
+  payload = payload ?? {};
+  payload.directives = directives;
+
+  if ("report-uri" in directives) {
+    warnings.push(
+      "The report-uri directive is not supported. Use the Content-Security-Policy-Report-Only HTTP header instead.",
+    );
+  }
+  if ("frame-ancestors" in directives) {
+    warnings.push(
+      "The frame-ancestors directive is not supported. Use the Content-Security-Policy HTTP header instead.",
+    );
+  }
+  if ("sandbox" in directives) {
+    warnings.push("The sandbox directive is not supported. Use the Content-Security-Policy HTTP header instead.");
+  }
+
+  return {
+    ruleId: "no-meta-csp",
+    warnings,
+    payload,
+  };
+}

package/node_modules/@rviscomi/capo.js/src/lib/validations/default-style.js

@@ -0,0 +1,62 @@
+/**
+ * @typedef {import('../../adapters/adapter.js').AdapterInterface} AdapterInterface
+ * @typedef {import('../validation.js').CustomValidationResult} CustomValidationResult
+ */
+
+/**
+ * @param {any} element
+ * @param {AdapterInterface} adapter
+ * @returns {boolean}
+ */
+export function isDefaultStyle(element, adapter) {
+  if (adapter.getTagName(element) !== "meta") return false;
+  const httpEquiv = adapter.getAttribute(element, "http-equiv");
+  return httpEquiv?.toLowerCase() === "default-style";
+}
+
+/**
+ * @param {any} element
+ * @param {AdapterInterface} adapter
+ * @returns {CustomValidationResult}
+ */
+export function validateDefaultStyle(element, adapter) {
+  /** @type {string[]} */
+  const warnings = [];
+  /** @type {any} */
+  let payload = null;
+
+  const title = adapter.getAttribute(element, "content");
+
+  if (!title) {
+    warnings.push("This has no effect. The content attribute must be set to a valid stylesheet title.");
+  } else {
+    const parent = adapter.getParent(element);
+    let stylesheet = null;
+    let alternateStylesheets = [];
+
+    if (parent) {
+      const children = adapter.getChildren(parent);
+      alternateStylesheets = children.filter((child) => {
+        if (adapter.getTagName(child) !== "link") return false;
+        const rel = adapter.getAttribute(child, "rel") || "";
+        const rels = rel.toLowerCase().split(/\s+/);
+        return rels.includes("alternate") && rels.includes("stylesheet");
+      });
+
+      stylesheet = alternateStylesheets.find((child) => adapter.getAttribute(child, "title") === title);
+    }
+
+    if (!stylesheet) {
+      payload = {
+        alternateStylesheets,
+      };
+      warnings.push(`This has no effect. No alternate stylesheet found having title="${title}".`);
+    }
+  }
+
+  warnings.push(
+    "Even when used correctly, the default-style method of setting a preferred stylesheet results in a flash of unstyled content. Use modern CSS features like @media rules instead.",
+  );
+
+  return { ruleId: "no-default-style", warnings, payload };
+}

package/node_modules/@rviscomi/capo.js/src/lib/validations/http-equiv.js

@@ -0,0 +1,138 @@
+/**
+ * @typedef {import('../../adapters/adapter.js').AdapterInterface} AdapterInterface
+ * @typedef {import('../validation.js').CustomValidationResult} CustomValidationResult
+ */
+
+/**
+ * @param {any} element
+ * @param {AdapterInterface} adapter
+ * @returns {boolean}
+ */
+export function isHttpEquiv(element, adapter) {
+  if (adapter.getTagName(element) !== "meta") return false;
+  return adapter.hasAttribute(element, "http-equiv");
+}
+
+/**
+ * @param {any} element
+ * @param {AdapterInterface} adapter
+ * @returns {CustomValidationResult}
+ */
+export function validateHttpEquiv(element, adapter) {
+  /** @type {string[]} */
+  const warnings = [];
+  const type = adapter.getAttribute(element, "http-equiv")?.toLowerCase() || "";
+  const content = adapter.getAttribute(element, "content")?.toLowerCase();
+
+  switch (type) {
+    case "content-security-policy":
+    case "content-security-policy-report-only":
+    case "origin-trial":
+    case "content-type":
+    case "default-style":
+      break;
+
+    case "refresh":
+      if (!content) {
+        warnings.push(
+          "This doesn't do anything. The content attribute must be set. However, using refresh is discouraged.",
+        );
+        break;
+      }
+      if (content.includes("url=")) {
+        warnings.push("Meta auto-redirects are discouraged. Use HTTP 3XX responses instead.");
+      } else {
+        warnings.push("Meta auto-refreshes are discouraged unless users have the ability to disable it.");
+      }
+      break;
+
+    case "x-dns-prefetch-control":
+      if (content === "on") {
+        warnings.push(`DNS prefetching is enabled by default. Setting it to "${content}" has no effect.`);
+      } else if (content !== "off") {
+        warnings.push(
+          `This is a non-standard way of disabling DNS prefetching, which is a performance optimization. Found content="${content}". Use content="off" if you have a legitimate security concern, otherwise remove it.`,
+        );
+      } else {
+        warnings.push(
+          "This is non-standard, however most browsers support disabling speculative DNS prefetching. It should still be noted that DNS prefetching is a generally accepted performance optimization and you should only disable it if you have specific security concerns.",
+        );
+      }
+      break;
+
+    case "cache-control":
+    case "etag":
+    case "pragma":
+    case "expires":
+    case "last-modified":
+      warnings.push("This doesn't do anything. Use HTTP headers for any cache directives.");
+      break;
+
+    case "x-frame-options":
+      warnings.push("This doesn't do anything. Use the CSP HTTP header with the frame-ancestors directive instead.");
+      break;
+
+    case "x-ua-compatible":
+    case "content-style-type":
+    case "content-script-type":
+    case "imagetoolbar":
+    case "cleartype":
+    case "page-enter":
+    case "page-exit":
+    case "site-enter":
+    case "site-exit":
+    case "msthemecompatible":
+    case "window-target":
+      warnings.push("This doesn't do anything. It was an Internet Explorer feature and is now deprecated.");
+      break;
+
+    case "content-language":
+    case "language":
+      warnings.push("This is non-conforming. Use the html[lang] attribute instead.");
+      break;
+
+    case "set-cookie":
+      warnings.push("This is non-conforming. Use the Set-Cookie HTTP header instead.");
+      break;
+
+    case "application-name":
+    case "author":
+    case "description":
+    case "generator":
+    case "keywords":
+    case "referrer":
+    case "theme-color":
+    case "color-scheme":
+    case "viewport":
+    case "creator":
+    case "googlebot":
+    case "publisher":
+    case "robots":
+      warnings.push(`This doesn't do anything. Did you mean \`meta[name=${type}]\`?`);
+      break;
+
+    case "encoding":
+      warnings.push("This doesn't do anything. Did you mean `meta[charset]`?");
+      break;
+
+    case "title":
+      warnings.push("This doesn't do anything. Did you mean to use the `title` tag instead?");
+      break;
+
+    case "accept-ch":
+    case "delegate-ch":
+      warnings.push("This is non-standard and may not work across browsers. Use HTTP headers instead.");
+      break;
+
+    default:
+      warnings.push(
+        "This is non-standard and may not work across browsers. http-equiv is not an alternative to HTTP headers.",
+      );
+      break;
+  }
+
+  return {
+    ruleId: "no-invalid-http-equiv",
+    warnings,
+  };
+}

package/node_modules/@rviscomi/capo.js/src/lib/validations/origin-trial.js

@@ -0,0 +1,80 @@
+/**
+ * @typedef {import('../../adapters/adapter.js').AdapterInterface} AdapterInterface
+ * @typedef {import('../validation.js').CustomValidationResult} CustomValidationResult
+ */
+
+/**
+ * @param {string} a
+ * @param {string} b
+ * @returns {boolean}
+ */
+function isSameOrigin(a, b) {
+  return new URL(a).origin === new URL(b).origin;
+}
+
+/**
+ * @param {string} tokenOrigin - Origin from origin trial token (e.g., https://youtube.com:443)
+ * @param {string} pageUrl - Page URL or origin (e.g., https://www.youtube.com)
+ * @returns {boolean}
+ */
+function isSubdomain(tokenOrigin, pageUrl) {
+  const urlA = new URL(tokenOrigin);
+  const urlB = new URL(pageUrl);
+  return urlB.host.endsWith(`.${urlA.host}`);
+}
+
+/**
+ * Decode origin trial token payload
+ * @param {string|null} token
+ * @returns {any}
+ */
+export function decodeOriginTrialToken(token) {
+  if (!token) throw new Error("Missing token");
+  const buffer = new Uint8Array([...atob(token)].map((a) => a.charCodeAt(0)));
+  const view = new DataView(buffer.buffer);
+  const length = view.getUint32(65, false);
+  const payload = JSON.parse(new TextDecoder().decode(buffer.slice(69, 69 + length)));
+  payload.expiry = new Date(payload.expiry * 1000);
+  return payload;
+}
+
+/**
+ * @param {any} element
+ * @param {AdapterInterface} adapter
+ * @param {string|null} [pageOrigin=null]
+ * @returns {CustomValidationResult}
+ */
+export function validateOriginTrial(element, adapter, pageOrigin = null) {
+  /** @type {CustomValidationResult} */
+  const metadata = {
+    ruleId: "no-invalid-origin-trial",
+    payload: null,
+    warnings: [],
+  };
+
+  const token = adapter.getAttribute(element, "content");
+  try {
+    metadata.payload = decodeOriginTrialToken(token);
+  } catch {
+    metadata.warnings?.push("Invalid origin trial token: invalid token");
+    return metadata;
+  }
+
+  if (metadata.payload.expiry < new Date()) {
+    metadata.warnings?.push("Invalid origin trial token: expired");
+  }
+
+  const targetOrigin = pageOrigin || (typeof document !== "undefined" && document.location && document.location.href);
+  if (targetOrigin) {
+    if (!isSameOrigin(metadata.payload.origin, targetOrigin)) {
+      const subdomain = isSubdomain(metadata.payload.origin, targetOrigin);
+      if (subdomain && !metadata.payload.isSubdomain) {
+        metadata.warnings?.push("Invalid origin trial token: invalid subdomain");
+      } else if (!subdomain && !metadata.payload.isThirdParty) {
+        metadata.warnings?.push("Invalid origin trial token: invalid third-party origin");
+      }
+    }
+  }
+
+  return metadata;
+}

package/node_modules/@rviscomi/capo.js/src/lib/validations/preload.js

@@ -0,0 +1,135 @@
+/**
+ * @typedef {import('../../adapters/adapter.js').AdapterInterface} AdapterInterface
+ * @typedef {import('../validation.js').CustomValidationResult} CustomValidationResult
+ */
+
+/**
+ * Find an element with matching source using adapter
+ * @param {any} parent - Parent element to search within
+ * @param {string} sourceUrl - URL to match
+ * @param {any} excludeElement - Element to exclude from search
+ * @param {AdapterInterface} adapter - Adapter instance
+ * @returns {any|null} - Matching element or null
+ */
+export function findElementWithSource(parent, sourceUrl, excludeElement, adapter) {
+  const children = adapter.getChildren(parent);
+
+  for (const child of children) {
+    if (child === excludeElement) {
+      continue;
+    }
+
+    const tagName = adapter.getTagName(child);
+
+    if (tagName === "link") {
+      const rel = adapter.getAttribute(child, "rel");
+      if (rel && /\b(preload|modulepreload)\b/i.test(rel)) {
+        continue;
+      }
+
+      const childHref = adapter.getAttribute(child, "href");
+      if (childHref === sourceUrl) {
+        return child;
+      }
+    }
+
+    if (tagName === "script") {
+      const src = adapter.getAttribute(child, "src");
+      if (src === sourceUrl) {
+        return child;
+      }
+    }
+  }
+
+  return null;
+}
+
+/**
+ * @param {any} element
+ * @param {AdapterInterface} adapter
+ * @param {any} [parentElement=null]
+ * @returns {boolean}
+ */
+export function isUnnecessaryPreload(element, adapter, parentElement = null) {
+  const tagName = adapter.getTagName(element);
+  if (tagName !== "link") {
+    return false;
+  }
+  const rel = adapter.getAttribute(element, "rel");
+  const relLower = rel?.toLowerCase();
+  if (relLower !== "preload" && relLower !== "modulepreload") {
+    return false;
+  }
+  const href = adapter.getAttribute(element, "href");
+  if (!href) {
+    return false;
+  }
+  const parent = parentElement || adapter.getParent(element);
+  if (!parent) {
+    return false;
+  }
+  const found = findElementWithSource(parent, href, element, adapter);
+  return found !== null && found !== undefined;
+}
+
+/**
+ * @param {any} element
+ * @param {AdapterInterface} adapter
+ * @returns {boolean}
+ */
+export function isInvalidFontPreload(element, adapter) {
+  const tagName = adapter.getTagName(element);
+  if (tagName !== "link") {
+    return false;
+  }
+  const rel = adapter.getAttribute(element, "rel");
+  if (rel?.toLowerCase() !== "preload") {
+    return false;
+  }
+  const as = adapter.getAttribute(element, "as");
+  if (as?.toLowerCase() !== "font") {
+    return false;
+  }
+  return !adapter.hasAttribute(element, "crossorigin");
+}
+
+/**
+ * @param {any} element
+ * @param {AdapterInterface} adapter
+ * @param {any} [parentElement=null]
+ * @returns {CustomValidationResult}
+ */
+export function validateUnnecessaryPreload(element, adapter, parentElement = null) {
+  const href = adapter.getAttribute(element, "href");
+  if (!href) {
+    return { ruleId: "no-unnecessary-preload", warnings: [] };
+  }
+  const parent = parentElement || adapter.getParent(element);
+  if (!parent) {
+    return { ruleId: "no-unnecessary-preload", warnings: [] };
+  }
+  const preloadedElement = findElementWithSource(parent, href, element, adapter);
+  if (!preloadedElement) {
+    return { ruleId: "no-unnecessary-preload", warnings: [] };
+  }
+  return {
+    ruleId: "no-unnecessary-preload",
+    warnings: [
+      `This preload has little to no effect. ${href} is already discoverable by another ${adapter.getTagName(preloadedElement)} element.`,
+    ],
+  };
+}
+
+/**
+ * @param {any} element
+ * @param {AdapterInterface} adapter
+ * @returns {CustomValidationResult}
+ */
+export function validateInvalidFontPreload(element, adapter) {
+  const warnings = ["Font preloads must have the crossorigin attribute set, even for same-origin fonts."];
+  return {
+    ruleId: "valid-font-preload",
+    warnings,
+    payload: null,
+  };
+}