eslint-plugin-chrome-extensions 1.0.1 → 2.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-chrome-extensions",
-  "version": "1.0.1",
+  "version": "2.1.0",
   "description": "ESLint rules for Chrome extensions",
   "type": "module",
   "engines": {
@@ -58,7 +58,8 @@
     "chromium"
   ],
   "peerDependencies": {
-    "eslint": ">=9.0.0"
+    "eslint": ">=9.6.0",
+    "@eslint/json": ">=0.1.0"
   },
   "devDependencies": {
     "@e18e/eslint-plugin": "^0.8.1",
@@ -66,11 +67,11 @@
     "@eslint/json": "^2.1.0",
     "@eslint/markdown": "^8.0.3",
     "@stylistic/eslint-plugin": "^5.10.0",
-    "eslint": "^10.11.0",
-    "eslint-plugin-constructors": "^1.4.0",
+    "eslint": "^10.12.0",
+    "eslint-plugin-constructors": "^1.4.1",
     "eslint-plugin-eslint-plugin": "^7.6.2",
     "eslint-plugin-import-x": "^4.17.1",
-    "eslint-plugin-n": "^18.4.0",
+    "eslint-plugin-n": "^18.4.1",
     "eslint-plugin-no-secrets": "^2.3.3",
     "eslint-plugin-no-unsanitized": "^4.1.5",
     "eslint-plugin-promise": "^7.3.0",

package/src/data/deprecations.js

@@ -0,0 +1,10 @@
+// Delete a line to end support
+
+export const bundles = { // ruleId: [bundleName, note]
+    'no-invalid-permissions': ['recommended'],
+    'require-mv3':            ['recommended'],
+    'valid-mv3-schema':       ['recommended'],
+    'valid-version-field':    ['recommended']
+}
+
+export default { bundles }

package/src/data/manifest.js

@@ -1,13 +1,32 @@
 import globals from 'globals'
 
-export const mv2OnlyKeys = new Set(['browser_action', 'page_action'])
-export const forbiddenCSPDirectives = [
+const serviceWorkerGlobals = new Set(Object.keys(globals.serviceworker || {}))
+export const domGlobals = new Set(Object.keys(globals.browser).filter(name => !serviceWorkerGlobals.has(name)))
+
+export const forbiddenCSPdirectives = [
     `'unsafe-eval'`, `'unsafe-inline'`, `'unsafe-hashes'`, `'wasm-unsafe-eval'`, 'http://', 'https://']
 
-export const serviceWorkerKeepaliveMinMS = 30000
+export const manifestKeyOrder = [
+    // platform-required
+    'manifest_version', 'name', 'version',
+    // CWS-required
+    'description', 'icons',
+    // optional (alphabetical, per docs)
+    'action', 'background', 'chrome_settings_overrides', 'chrome_url_overrides',
+    'commands', 'content_scripts', 'content_security_policy',
+    'cross_origin_embedder_policy', 'cross_origin_opener_policy',
+    'declarative_net_request', 'default_locale', 'devtools_page', 'export',
+    'externally_connectable', 'homepage_url', 'host_permissions', 'import',
+    'incognito', 'key', 'mime_types_handler', 'minimum_chrome_version',
+    'oauth2', 'omnibox', 'optional_host_permissions', 'optional_permissions',
+    'options_page', 'options_ui', 'permissions', 'requirements', 'sandbox',
+    'short_name', 'side_panel', 'storage', 'tts_engine', 'update_url',
+    'version_name', 'web_accessible_resources'
+]
 
-const serviceWorkerGlobals = new Set(Object.keys(globals.serviceworker || {}))
-export const domGlobals = new Set(Object.keys(globals.browser).filter(name => !serviceWorkerGlobals.has(name)))
+export const mv2OnlyKeys = new Set(['browser_action', 'page_action'])
 
 export const remoteCodePatterns = [
     'eval', 'new-function', 'string-timer', 'dynamic-import', 'remote-script-src', 'execute-script-url']
+
+export const serviceWorkerKeepaliveMinMS = 30000

package/src/index.js

@@ -1,26 +1,44 @@
+import { bundles as oldBundles } from './data/deprecations.js'
+
+import manifestKeyOrder from './rules/manifest-key-order.js'
 import noContentStyleLeak from './rules/no-content-style-leak.js'
 import noDeprecatedAPIs from './rules/no-deprecated-apis.js'
+import noDuplicateManifestKeys from './rules/no-duplicate-manifest-keys.js'
+import noInsecureFetch from './rules/no-insecure-fetch.js'
 import noInsecureMessaging from './rules/no-insecure-messaging.js'
 import noInvalidPermissions from './rules/no-invalid-permissions.js'
 import noMissingPermissions from './rules/no-missing-permissions.js'
+import noMissingWebAccessibleResources from './rules/no-missing-web-accessible-resources.js'
 import noRemoteCode from './rules/no-remote-code.js'
+import noUnrestrictedHostPermissions from './rules/no-unrestricted-host-permissions.js'
 import noUnusedPermissions from './rules/no-unused-permissions.js'
 import requireMV3 from './rules/require-mv3.js'
+import validManifestIcons from './rules/valid-manifest-icons.js'
 import validMV3schema from './rules/valid-mv3-schema.js'
 import validServiceWorker from './rules/valid-service-worker.js'
+import validVersionField from './rules/valid-version-field.js'
+
+import { bundleRules, deprecatedFrom, initBundleDeprecation } from './utils.js'
 
 const plugin = {
     rules: {
-        'require-mv3': requireMV3,
-        'valid-mv3-schema': validMV3schema,
-        'no-deprecated-apis': noDeprecatedAPIs,
-        'no-remote-code': noRemoteCode,
-        'valid-service-worker': validServiceWorker,
+        'manifest-key-order': manifestKeyOrder,
         'no-content-style-leak': noContentStyleLeak,
+        'no-deprecated-apis': noDeprecatedAPIs,
+        'no-duplicate-manifest-keys': noDuplicateManifestKeys,
+        'no-insecure-fetch': noInsecureFetch,
+        'no-insecure-messaging': noInsecureMessaging,
         'no-invalid-permissions': noInvalidPermissions,
         'no-missing-permissions': noMissingPermissions,
+        'no-missing-web-accessible-resources': noMissingWebAccessibleResources,
+        'no-remote-code': noRemoteCode,
+        'no-unrestricted-host-permissions': noUnrestrictedHostPermissions,
         'no-unused-permissions': noUnusedPermissions,
-        'no-insecure-messaging': noInsecureMessaging
+        'require-mv3': requireMV3,
+        'valid-manifest-icons': validManifestIcons,
+        'valid-mv3-schema': validMV3schema,
+        'valid-service-worker': validServiceWorker,
+        'valid-version-field': validVersionField
     }
 }
 
@@ -30,29 +48,30 @@ for (const [ruleId, rule] of Object.entries(plugin.rules))
 plugin.configs = {
     recommended: {
         plugins: { 'chrome-extensions': plugin },
-        rules: {
-            'chrome-extensions/require-mv3': 'error',
-            'chrome-extensions/valid-mv3-schema': 'error',
-            'chrome-extensions/no-deprecated-apis': 'error',
-            'chrome-extensions/no-remote-code': 'error',
-            'chrome-extensions/valid-service-worker': 'error',
-            'chrome-extensions/no-invalid-permissions': 'error',
-            'chrome-extensions/no-missing-permissions': 'error',
-            'chrome-extensions/no-unused-permissions': 'error',
-            'chrome-extensions/no-insecure-messaging': 'error'
-        }
+        rules: bundleRules(plugin.rules, rule => rule.meta.docs.recommended,
+            'chrome-extensions', deprecatedFrom(oldBundles, 'recommended'))
     },
     strict: {
         plugins: { 'chrome-extensions': plugin },
-        rules: Object.fromEntries(Object.keys(plugin.rules)
-            .map(ruleId => [`chrome-extensions/${ruleId}`, 'error']))
+        rules: bundleRules(plugin.rules, () => true, 'chrome-extensions')
     },
     problem: {
         plugins: { 'chrome-extensions': plugin },
-        rules: Object.fromEntries(Object.entries(plugin.rules)
-            .filter(([, rule]) => rule.meta.type == 'problem')
-            .map(([ruleId]) => [`chrome-extensions/${ruleId}`, 'error']))
+        rules: bundleRules(plugin.rules, rule => rule.meta.type == 'problem', 'chrome-extensions')
+    },
+    security: {
+        plugins: { 'chrome-extensions': plugin },
+        rules: bundleRules(plugin.rules, rule => rule.meta.docs.security,
+            'chrome-extensions', deprecatedFrom(oldBundles, 'security'))
+    },
+    manifest: {
+        plugins: { 'chrome-extensions': plugin },
+        rules: bundleRules(plugin.rules, rule => rule.meta.docs.manifest,
+            'chrome-extensions', deprecatedFrom(oldBundles, 'manifest'))
     }
 }
 
+for (const entry of Object.entries(oldBundles))
+    initBundleDeprecation(plugin, entry, 'chrome-extensions')
+
 export { plugin as default, plugin as chromeExtensions }

package/src/rules/manifest-key-order.js

@@ -0,0 +1,76 @@
+import { manifestKeyOrder } from '../data/manifest.js'
+
+import { getFilename } from '../utils.js'
+
+const re = { manifestFilename: /manifest\.json$/ }
+
+function keyOf(member) {
+    const keyNode = member.name || member.key
+    return keyNode?.value ?? keyNode?.name
+}
+
+function findViolation(members, keys) {
+    const ranks = new Map(keys.map((key, index) => [key, index])),
+          known = members.map(member => {
+              const key = keyOf(member)
+              return { member, key, rank: ranks.get(key) }
+          }).filter(item => item.rank !== undefined)
+    for (let i = 1; i < known.length; i++)
+        // eslint-disable-next-line security/detect-object-injection
+        if (known[i -1].rank > known[i].rank) return [known[i -1], known[i]]
+}
+
+export default {
+    meta: {
+        type: 'layout',
+        docs: {
+            description: 'Enforces a preferred order for manifest keys',
+            category: 'Stylistic Issues',
+            recommended: false,
+            manifest: true
+        },
+        fixable: 'code',
+        schema: [{
+            type: 'object',
+            properties: {
+                order: {
+                    type: 'array', items: { type: 'string' },
+                    description: 'Manifest keys in preferred order; unspecified keys are ignored'
+                }
+            },
+            additionalProperties: false
+        }],
+        defaultOptions: [{ order: [] }],
+        messages: { wrongOrder: '`{{first}}` should appear before `{{second}}`.' }
+    },
+
+    create(context) {
+        if (!re.manifestFilename.test(getFilename(context))) return {}
+        const custom = context.options[0]?.order ?? [],
+              master = custom.length ? manifestKeyOrder.filter(key => !custom.includes(key))
+                     : manifestKeyOrder
+        return {
+            'Document:exit'(document) {
+                const root = document.body ; if (root?.type != 'Object') return
+                const members = root.members || root.properties || []
+                const violation = findViolation(members, master) ?? (custom.length && findViolation(members, custom))
+                if (!violation) return
+                const [first, second] = violation
+                context.report({
+                    node: second.member, messageId: 'wrongOrder',
+                    data: { first: second.key, second: first.key },
+                    fix(fixer) {
+                        const sourceCode = context.sourceCode,
+                              firstText = sourceCode.text.slice(first.member.range[0], first.member.range[1]),
+                              secondText = sourceCode.text.slice(second.member.range[0], second.member.range[1]),
+                              between = sourceCode.text.slice(first.member.range[1], second.member.range[0])
+                        return fixer.replaceTextRange(
+                            [first.member.range[0], second.member.range[1]],
+                            secondText + between + firstText
+                        )
+                    }
+                })
+            }
+        }
+    }
+}

package/src/rules/no-content-style-leak.js

@@ -10,7 +10,7 @@ export default {
         },
         schema: [],
         messages: {
-            styleLeak: 'Inject styles via `chrome.scripting.insertCSS()` or `content_scripts.css` instead of appending to the host document.'
+            styleLeak: 'Inject styles into a `shadowRoot` instead of the host document.'
         }
     },
 

package/src/rules/no-duplicate-manifest-keys.js

@@ -0,0 +1,36 @@
+import { getFilename } from '../utils.js'
+
+const re = { manifestFilename: /manifest\.json$/ }
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow duplicate keys in manifest.json',
+            category: 'Possible Errors',
+            recommended: false,
+            manifest: true
+        },
+        schema: [],
+        messages: {
+            duplicateKey: 'Duplicate manifest key "{{key}}".'
+        }
+    },
+
+    create(context) {
+        if (!re.manifestFilename.test(getFilename(context))) return {}
+        return {
+            Object(node) {
+                const members = node.members || node.properties || [],
+                      seen = new Set()
+                for (const member of members) {
+                    const keyNode = member.name || member.key ; if (!keyNode) continue
+                    const keyName = keyNode.value ?? keyNode.name ; if (typeof keyName != 'string') continue
+                    if (seen.has(keyName))
+                        context.report({ node: keyNode, messageId: 'duplicateKey', data: { key: keyName } })
+                    else seen.add(keyName)
+                }
+            }
+        }
+    }
+}

package/src/rules/no-insecure-fetch.js

@@ -0,0 +1,52 @@
+const re = { insecureURL: /^http:\/\/(?!localhost\b|127\.0\.0\.1\b|\[::1\])/i }
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Flags `fetch()` and `XMLHttpRequest.open()` calls that use `http://`',
+            category: 'Possible Errors',
+            recommended: true,
+            security: true
+        },
+        schema: [],
+        messages: {
+            insecureFetch: '`fetch()` to "{{url}}" insecure. Use HTTPS or a relative path instead.',
+            insecureXHR: '`XMLHttpRequest.open()` to "{{url}}" insecure. Use HTTPS or a relative path instead.'
+        }
+    },
+
+    create(context) {
+        const xhrVars = new Set()
+        function urlFromLiteral(node) {
+            return ( node?.type == 'Literal'
+                && typeof node.value == 'string'
+                && re.insecureURL.test(node.value)
+            ) ? node.value : null
+        }
+        return {
+            VariableDeclarator(node) {
+                if (node.init?.type == 'NewExpression'
+                    && node.init.callee?.name == 'XMLHttpRequest'
+                    && node.id.type == 'Identifier'
+                ) xhrVars.add(node.id.name)
+            },
+            CallExpression(node) {
+                if (node.callee.type == 'Identifier' && node.callee.name == 'fetch') {
+                    const url = urlFromLiteral(node.arguments[0])
+                    if (url)
+                        context.report({ node: node.arguments[0], messageId: 'insecureFetch', data: { url }})
+                }
+                if (node.callee.type == 'MemberExpression'
+                    && node.callee.property?.name == 'open'
+                    && node.callee.object?.type == 'Identifier'
+                    && xhrVars.has(node.callee.object.name)
+                ) {
+                    const url = urlFromLiteral(node.arguments[1])
+                    if (url)
+                        context.report({ node: node.arguments[1], messageId: 'insecureXHR', data: { url }})
+                }
+            }
+        }
+    }
+}

package/src/rules/no-insecure-messaging.js

@@ -1,24 +1,46 @@
-import { isExternalMessagingListener } from '../data/apis.js'
 import { getMemberPath } from '../utils.js'
+import { isExternalMessagingListener } from '../data/apis.js'
 
-const RE_SENDER_VALIDATION = /sender\.(?:id|origin)/
+const re = { postmsgValidation: /\b\w+\.(?:origin|source)\b/, senderValidation: /sender\.(?:id|origin)/ }
 
 export default {
     meta: {
         type: 'problem',
         docs: {
-            description: 'Require sender validation on external messaging + filtered tab broadcasts',
+            description: 'Requires sender/origin validation + filtered `tabs.query()` + explicit `window.postMessage()` target',
             category: 'Possible Errors',
-            recommended: true
+            recommended: true,
+            security: true
         },
-        schema: [],
+        defaultOptions: [{ disallowWildcardTarget: true }],
+        schema: [{
+            type: 'object',
+            properties: {
+                disallowWildcardTarget: {
+                    type: 'boolean',
+                    description: 'Flag postMessage calls that use "*" as targetOrigin'
+                }
+            },
+            additionalProperties: false
+        }],
         messages: {
             unvalidatedExternal: '`{{listener}}` handler must validate `sender.<id|origin>` before processing messages.',
-            unfilteredBroadcast: '`chrome.tabs.query({})` with no filter broadcasts to every open tab - add `url` or `currentWindow`.'
+            unfilteredBroadcast: '`chrome.tabs.query({})` w/ no filter broadcasts to every open tab. Add `url` or `currentWindow` instead.',
+            unvalidatedPostMessage: '`{{target}}` message handler must validate `event.origin`/`event.source` before processing messages.',
+            wildcardTarget: '`postMessage` to `"*"` leaks data to any origin. Explicitly specify `targetOrigin` instead.'
         }
     },
 
     create(context) {
+        const opts = context.options[0] || {},
+              disallowWildcard = opts.disallowWildcardTarget !== false
+        function checkPostMessageHandler(node, handlerNode, target) {
+            if (!handlerNode) return
+            const body = context.sourceCode.getText(handlerNode)
+            if (re.postmsgValidation.test(body)) return
+            context.report({ node, messageId: 'unvalidatedPostMessage', data: { target }})
+        }
+        function isMessageTarget(obj) { return obj?.type == 'Identifier' && ['self', 'window'].includes(obj.name) }
         return {
             CallExpression(node) {
                 if (node.callee.type != 'MemberExpression') return
@@ -27,7 +49,7 @@ export default {
                 if (listenerRoot && isExternalMessagingListener(listenerRoot)) {
                     const handler = node.arguments[0] ; if (!handler) return
                     const body = context.sourceCode.getText(handler)
-                    if (!RE_SENDER_VALIDATION.test(body))
+                    if (!re.senderValidation.test(body))
                         context.report({ node, messageId: 'unvalidatedExternal', data: { listener: listenerRoot }})
                 }
                 if (path == 'chrome.tabs.query') {
@@ -36,6 +58,21 @@ export default {
                     if (isEmpty)
                         context.report({ node, messageId: 'unfilteredBroadcast' })
                 }
+                if (node.callee.property?.name == 'addEventListener'
+                    && node.arguments[0]?.value == 'message'
+                    && isMessageTarget(node.callee.object)
+                ) checkPostMessageHandler(node, node.arguments[1], node.callee.object.name)
+                if (disallowWildcard && node.callee.property?.name == 'postMessage') {
+                    const target = node.arguments[1]
+                    if (target?.type == 'Literal' && target.value == '*')
+                        context.report({ node: target, messageId: 'wildcardTarget' })
+                }
+            },
+            AssignmentExpression(node) {
+                if (node.left.type == 'MemberExpression'
+                    && node.left.property?.name == 'onmessage'
+                    && isMessageTarget(node.left.object)
+                ) checkPostMessageHandler(node, node.right, node.left.object.name)
             }
         }
     }

package/src/rules/no-invalid-permissions.js

@@ -1,5 +1,7 @@
+import { getFilename, readManifest } from '../utils.js'
 import { isValidPermission } from '../data/permissions.js'
-import { readManifest } from '../utils.js'
+
+const re = { manifestFilename: /manifest\.json$/ }
 
 export default {
     meta: {
@@ -7,7 +9,8 @@ export default {
         docs: {
             description: 'Disallow invalid or unsupported manifest permission names',
             category: 'Possible Errors',
-            recommended: true
+            recommended: false,
+            manifest: true
         },
         defaultOptions: [{ target: 'mv3', allowedPermissions: [] }],
         schema: [{
@@ -40,9 +43,27 @@ export default {
         const opts = context.options[0] || {},
               target = opts.target || 'mv3',
               allowed = new Set(Array.isArray(opts.allowedPermissions) ? opts.allowedPermissions
-                      : opts.allowedPermissions ? [opts.allowedPermissions] : []),
-              manifest = readManifest(context)
-        if (!manifest) return {}
+                      : opts.allowedPermissions ? [opts.allowedPermissions] : [])
+        function checkPermission(node, permission) {
+            if (typeof permission != 'string') return
+            if (allowed.has(permission) || isValidPermission(permission, target)) return
+            context.report({ node, messageId: 'invalidPermission', data: { permission, target }})
+        }
+        if (re.manifestFilename.test(getFilename(context))) // lint it directly
+            return {
+                '*'(node) {
+                    const keyNode = node.name || node.key ; if (!keyNode) return
+                    const keyName = keyNode.value ?? keyNode.name
+                    if (keyName != 'permissions' && keyName != 'optional_permissions') return
+                    const arrNode = node.value ; if (arrNode?.type != 'Array') return
+                    const elements = arrNode.elements || arrNode.items || []
+                    for (const el of elements) {
+                        const valueNode = el.value || el
+                        checkPermission(valueNode, valueNode?.value)
+                    }
+                }
+            }
+        const manifest = readManifest(context) ; if (!manifest) return {}
         const all = [...(manifest.permissions || []), ...(manifest.optional_permissions || [])]
         return {
             'Program:exit'() {

package/src/rules/no-missing-web-accessible-resources.js

@@ -0,0 +1,51 @@
+import { getMemberPath, isContentScriptFile, readManifest } from '../utils.js'
+
+const re = { leadingSlash: /^\//, regexSpecial: /[.+?^${}()|[\]\\]/g }
+
+function collectWarPatterns(manifest) {
+    const war = manifest.web_accessible_resources
+    if (!Array.isArray(war)) return []
+    const patterns = []
+    for (const entry of war) {
+        if (typeof entry == 'string') patterns.push(entry)  // MV2 flat
+        else if (Array.isArray(entry?.resources))
+            for (const res of entry.resources) patterns.push(res)  // MV3 object
+    }
+    return patterns
+}
+
+function patternToRegex(pattern) {
+    const escaped = pattern.replace(re.regexSpecial, '\\$&').replace(/\*/g, '.*')
+    return new RegExp(`^${escaped}$`) // eslint-disable-line security/detect-non-literal-regexp
+}
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Require content-script getURL() paths to be listed in `web_accessible_resources`',
+            category: 'Possible Errors',
+            recommended: true
+        },
+        schema: [],
+        messages: {
+            missingWar: '`{{path}}` is not in `web_accessible_resources`.'
+        }
+    },
+
+    create(context) {
+        const manifest = readManifest(context) ; if (!manifest) return {}
+        if (!isContentScriptFile(context, manifest)) return {}
+        const regexes = collectWarPatterns(manifest).map(patternToRegex)
+        return {
+            CallExpression(node) {
+                if (node.callee.type != 'MemberExpression') return
+                if (getMemberPath(node.callee) != 'chrome.runtime.getURL') return
+                const arg = node.arguments[0] ; if (arg?.type != 'Literal' || typeof arg.value != 'string') return
+                const resourcePath = arg.value.replace(re.leadingSlash, '')
+                for (const regex of regexes) if (regex.test(resourcePath)) return
+                context.report({ node: arg, messageId: 'missingWar', data: { path: arg.value }})
+            }
+        }
+    }
+}

package/src/rules/no-remote-code.js

@@ -1,4 +1,5 @@
 import { remoteCodePatterns } from '../data/manifest.js'
+
 import { getMemberPath } from '../utils.js'
 
 const re = { url: /^https?:\/\// }
@@ -7,9 +8,10 @@ export default {
     meta: {
         type: 'problem',
         docs: {
-            description: 'Disallow remote or dynamically-evaluated code, per the MV3 CSP',
+            description: 'Disallow remote or dynamically-evaluated code, per MV3\'s CSP',
             category: 'Possible Errors',
-            recommended: true
+            recommended: true,
+            security: true
         },
         defaultOptions: [{
             patterns: ['eval', 'new-function', 'string-timer',
@@ -26,19 +28,19 @@ export default {
                 },
                 checkExecuteScriptClosures: {
                     type: 'boolean',
-                    description: 'Flag chrome.scripting.executeScript calls whose func captures outer scope'
+                    description: 'Flag `chrome.scripting.executeScript` calls whose func captures outer scope'
                 }
             },
             additionalProperties: false
         }],
         messages: {
-            eval: '`eval()` is forbidden by the MV3 CSP.',
-            newFunction: '`new Function()` is forbidden by the MV3 CSP.',
-            stringTimer: 'String-argument `{{fn}}` is forbidden by the MV3 CSP - pass a function reference.',
-            dynamicImport: 'Remote dynamic `import()` is forbidden by the MV3 CSP.',
-            remoteScriptSrc: 'Injecting remote `<script src>` is forbidden by the MV3 CSP - use `chrome.runtime.getURL()`.',
+            eval: '`eval()` is forbidden under MV3\'s CSP. Use static code instead.',
+            newFunction: '`new Function()` is forbidden under MV3\'s CSP. Use a real function instead.',
+            stringTimer: 'String-argument `{{fn}}` is forbidden under MV3\'s CSP. Pass a function reference instead.',
+            dynamicImport: 'Remote dynamic `import()` is forbidden under MV3\'s CSP. Use a relative path instead.',
+            remoteScriptSrc: 'Injecting remote `<script src>` is forbidden under MV3\'s CSP. Use `chrome.runtime.getURL()` for bundled scripts instead.',
             executeScriptURL: '`chrome.scripting.executeScript` must use local `files`, not a remote URL.',
-            executeScriptClosure: '`chrome.scripting.executeScript({ func })` captures outer-scope variables that fail after serialization - pass them via `args`.'
+            executeScriptClosure: '`chrome.scripting.executeScript({ func })` captures outer-scope variables that fail after serialization. Pass them via `args` instead.'
         }
     },
 

package/src/rules/no-unrestricted-host-permissions.js

@@ -0,0 +1,54 @@
+import { getFilename } from '../utils.js'
+
+const re = { broadHost: /^(?:<all_urls>|\*:\/\/\*\/\*|\w+:\/\/\*\/\*)$/, manifestFilename: /manifest\.json$/ },
+      hostKeys = new Set(['host_permissions', 'optional_host_permissions', 'optional_permissions', 'permissions'])
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow broad host permissions that grant access to every site',
+            category: 'Possible Errors',
+            recommended: false,
+            manifest: true
+        },
+        defaultOptions: [{ allowedPatterns: [] }],
+        schema: [{
+            type: 'object',
+            properties: {
+                allowedPatterns: {
+                    type: 'array',
+                    items: { type: 'string' },
+                    description: 'Host patterns to explicitly allow despite being broad'
+                }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            unrestrictedHost: 'Host permission "{{pattern}}" grants access to every site. Narrow to specific origins or allow explicitly instead.'
+        }
+    },
+
+    create(context) {
+        if (!re.manifestFilename.test(getFilename(context))) return {}
+        const allowed = new Set(context.options[0]?.allowedPatterns || [])
+        return {
+            '*'(node) {
+                const keyNode = node.name || node.key ; if (!keyNode) return
+                const keyName = keyNode.value ?? keyNode.name
+                if (!hostKeys.has(keyName)) return
+                const arrNode = node.value ; if (arrNode?.type != 'Array') return
+                const elements = arrNode.elements || arrNode.items || []
+                for (const el of elements) {
+                    const valueNode = el.value || el,
+                          pattern = valueNode?.value
+                    if (typeof pattern != 'string'
+                        || allowed.has(pattern)
+                        || !re.broadHost.test(pattern)
+                    ) continue
+                    context.report({ node: valueNode, messageId: 'unrestrictedHost', data: { pattern }})
+                }
+            }
+        }
+    }
+}