eslint-plugin-chrome-extensions 2.0.0 → 2.2.0

package/docs/LICENSE.md

@@ -1,6 +1,6 @@
 # 🏛️ MIT License
 
-**Copyright © 2026 [Adam Lui](https://codeberg.org/adamlui).**
+**Copyright © 2026 [Adam Lui](https://codeberg.org/adamlui)**
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-chrome-extensions",
-  "version": "2.0.0",
+  "version": "2.2.0",
   "description": "ESLint rules for Chrome extensions",
   "type": "module",
   "engines": {
@@ -34,7 +34,6 @@
   ],
   "types": "src/index.d.ts",
   "scripts": {
-    "prepare": "husky",
     "lint": "eslint . --cache && yamllint .",
     "lint:all": "eslint . && yamllint .",
     "lint:fix": "eslint . --fix --cache && yamllint .",
@@ -64,11 +63,11 @@
   "devDependencies": {
     "@e18e/eslint-plugin": "^0.8.1",
     "@eslint/js": "^10.0.1",
-    "@eslint/json": "^2.1.0",
+    "@eslint/json": "^2.1.1",
     "@eslint/markdown": "^8.0.3",
     "@stylistic/eslint-plugin": "^5.10.0",
     "eslint": "^10.12.0",
-    "eslint-plugin-constructors": "^1.4.0",
+    "eslint-plugin-constructors": "^1.4.2",
     "eslint-plugin-eslint-plugin": "^7.6.2",
     "eslint-plugin-import-x": "^4.17.1",
     "eslint-plugin-n": "^18.4.1",
@@ -77,7 +76,6 @@
     "eslint-plugin-promise": "^7.3.0",
     "eslint-plugin-regexp": "^3.3.1",
     "eslint-plugin-security": "^4.2.0",
-    "husky": "^9.1.7",
     "yamllint-js": "^0.2.4"
   },
   "dependencies": {

package/src/data/apis.js

@@ -33,6 +33,7 @@ export const apiPermissionMap = new Map([
     ['chrome.history',               'history'],
     ['chrome.idle',                  'idle'],
     ['chrome.management',            'management'],
+    ['chrome.menus',                 'menus'],
     ['chrome.notifications',         'notifications'],
     ['chrome.pageCapture',           'pageCapture'],
     ['chrome.privacy',               'privacy'],
@@ -41,10 +42,60 @@ export const apiPermissionMap = new Map([
     ['chrome.sessions',              'sessions'],
     ['chrome.storage',               'storage'],
     ['chrome.tabCapture',            'tabCapture'],
+    ['chrome.tabs.query',            'tabs'],
     ['chrome.topSites',              'topSites'],
     ['chrome.webRequest',            'webRequest']
 ])
 
+export const permissionlessAPIs = new Set([
+    // https://developer.chrome.com/docs/extensions/reference/api/management
+    'chrome.management.getPermissionWarningsByManifest',
+    'chrome.management.getSelf',
+    'chrome.management.uninstallSelf',
+    // https://developer.chrome.com/docs/extensions/reference/api/runtime
+    'chrome.runtime.connect',
+    'chrome.runtime.getManifest',
+    'chrome.runtime.getPlatformInfo',
+    'chrome.runtime.getURL',
+    'chrome.runtime.onBrowserUpdateAvailable', // eslint-disable-line no-secrets/no-secrets
+    'chrome.runtime.onConnect',
+    'chrome.runtime.onConnectExternal',
+    'chrome.runtime.onInstalled',
+    'chrome.runtime.onMessage',
+    'chrome.runtime.onMessageExternal',
+    'chrome.runtime.onStartup',
+    'chrome.runtime.onSuspend',
+    'chrome.runtime.onSuspendCanceled',
+    'chrome.runtime.onUpdateAvailable',
+    'chrome.runtime.openOptionsPage',
+    'chrome.runtime.reload',
+    'chrome.runtime.requestUpdateCheck',
+    'chrome.runtime.restart',
+    'chrome.runtime.restartAfterDelay',
+    'chrome.runtime.sendMessage',
+    'chrome.runtime.setUninstallURL',
+    // https://developer.chrome.com/docs/extensions/reference/api/tabs
+    'chrome.tabs.captureVisibleTab',
+    'chrome.tabs.connect',
+    'chrome.tabs.create',
+    'chrome.tabs.detectLanguage',
+    'chrome.tabs.discard',
+    'chrome.tabs.duplicate',
+    'chrome.tabs.executeScript',
+    'chrome.tabs.get',
+    'chrome.tabs.getCurrent',
+    'chrome.tabs.goBack',
+    'chrome.tabs.goForward',
+    'chrome.tabs.highlight',
+    'chrome.tabs.insertCSS',
+    'chrome.tabs.move',
+    'chrome.tabs.reload',
+    'chrome.tabs.remove',
+    'chrome.tabs.removeCSS',
+    'chrome.tabs.sendMessage',
+    'chrome.tabs.update'
+])
+
 export const externalMessagingListeners =
     new Set(['chrome.runtime.onMessageExternal', 'chrome.runtime.onConnectExternal'])
 
@@ -56,6 +107,7 @@ export function findDeprecated(api) {
 }
 
 export function findPermission(api) {
+    if (permissionlessAPIs.has(api)) return null
     for (const [prefix, permission] of apiPermissionMap)
         if (api == prefix || api.startsWith(`${prefix}.`))
             return permission

package/src/data/deprecations.js

@@ -0,0 +1,10 @@
+// Delete a line to end support
+
+export const bundles = {
+    'no-invalid-permissions': ['recommended'], // 2026-10-5 announced future removal
+    'require-mv3':            ['recommended'], // 2026-10-5 announced future removal
+    'valid-mv3-schema':       ['recommended'], // 2026-10-5 announced future removal
+    'valid-version-field':    ['recommended']  // 2026-10-5 announced future removal
+}
+
+export default { bundles }

package/src/data/manifest.js

@@ -11,19 +11,30 @@ export const manifestKeyOrder = [
     'manifest_version', 'name', 'version',
     // CWS-required
     'description', 'icons',
-    // optional (alphabetical, per docs)
-    'action', 'background', 'chrome_settings_overrides', 'chrome_url_overrides',
-    'commands', 'content_scripts', 'content_security_policy',
-    'cross_origin_embedder_policy', 'cross_origin_opener_policy',
-    'declarative_net_request', 'default_locale', 'devtools_page', 'export',
-    'externally_connectable', 'homepage_url', 'host_permissions', 'import',
-    'incognito', 'key', 'mime_types_handler', 'minimum_chrome_version',
-    'oauth2', 'omnibox', 'optional_host_permissions', 'optional_permissions',
-    'options_page', 'options_ui', 'permissions', 'requirements', 'sandbox',
-    'short_name', 'side_panel', 'storage', 'tts_engine', 'update_url',
-    'version_name', 'web_accessible_resources'
+    // optional
+    'action', 'author', 'background', 'browser_specific_settings', 'chrome_settings_overrides', 'chrome_url_overrides',
+    'commands', 'content_scripts', 'content_security_policy', 'cross_origin_embedder_policy',
+    'cross_origin_opener_policy', 'dark_theme', 'declarative_net_request', 'default_locale', 'developer',
+    'devtools_page', 'dictionaries', 'export', 'externally_connectable', 'homepage_url', 'host_permissions', 'import',
+    'incognito', 'key', 'mime_types_handler', 'minimum_chrome_version', 'oauth2', 'omnibox',
+    'optional_host_permissions', 'optional_permissions', 'options_page', 'options_ui', 'permissions',
+    'protocol_handlers', 'requirements', 'sandbox', 'short_name', 'sidebar_action', 'side_panel', 'storage', 'theme',
+    'theme_experiment', 'tts_engine', 'update_url', 'version_name', 'web_accessible_resources'
 ]
 
+export const ffDataCollectionRequired = new Set([
+    'none', 'authenticationInfo', 'bookmarksInfo', 'browsingActivity', 'financialAndPaymentInfo', 'healthInfo',
+    'locationInfo', 'personalCommunications', 'personallyIdentifyingInfo', 'searchTerms', 'websiteActivity',
+    'websiteContent'
+])
+
+export const ffDataCollectionOptional = new Set([
+    'authenticationInfo', 'bookmarksInfo', 'browsingActivity', 'financialAndPaymentInfo', 'healthInfo', 'locationInfo',
+    'personalCommunications', 'personallyIdentifyingInfo', 'searchTerms', 'technicalAndInteraction', 'websiteActivity',
+    'websiteContent'
+])
+
+export const ffMV3bgKeys = new Set(['scripts', 'page'])
 export const mv2OnlyKeys = new Set(['browser_action', 'page_action'])
 
 export const remoteCodePatterns = [

package/src/data/permissions.js

@@ -16,7 +16,7 @@ export const validPermissions = new Set([
     'downloads', 'downloads.open', 'downloads.ui', 'enterprise.deviceAttributes', 'enterprise.hardwarePlatform',
     'enterprise.networkingAttributes', 'enterprise.platformKeys', 'favicon', 'fileBrowserHandler',
     'fileSystemProvider', 'fontSettings', 'gcm', 'geolocation', 'history', 'identity', 'identity.email', 'idle',
-    'loginState', 'management', 'nativeMessaging', 'notifications', 'offscreen', 'pageCapture', 'platformKeys',
+    'loginState', 'management', 'menus', 'nativeMessaging', 'notifications', 'offscreen', 'pageCapture', 'platformKeys',
     'power', 'printerProvider', 'printing', 'printingMetrics', 'privacy', 'processes', 'proxy', 'publicSuffix',
     'readingList', 'runtime', 'scripting', 'search', 'sessions', 'sidePanel', 'storage', 'system.cpu',
     'system.display', 'system.memory', 'system.storage', 'tabCapture', 'tabGroups', 'tabs', 'topSites', 'tts',

package/src/index.js

@@ -1,29 +1,43 @@
-import { bundleRules } from './utils.js'
+import { bundles as oldBundles } from './data/deprecations.js'
 
 import manifestKeyOrder from './rules/manifest-key-order.js'
+import manifestSpacing from './rules/manifest-spacing.js'
 import noContentStyleLeak from './rules/no-content-style-leak.js'
 import noDeprecatedAPIs from './rules/no-deprecated-apis.js'
+import noDuplicateManifestKeys from './rules/no-duplicate-manifest-keys.js'
+import noInsecureFetch from './rules/no-insecure-fetch.js'
 import noInsecureMessaging from './rules/no-insecure-messaging.js'
 import noInvalidPermissions from './rules/no-invalid-permissions.js'
 import noMissingPermissions from './rules/no-missing-permissions.js'
+import noMissingWebAccessibleResources from './rules/no-missing-web-accessible-resources.js'
 import noRemoteCode from './rules/no-remote-code.js'
+import noUnrestrictedHostPermissions from './rules/no-unrestricted-host-permissions.js'
 import noUnusedPermissions from './rules/no-unused-permissions.js'
 import requireMV3 from './rules/require-mv3.js'
+import validManifestIcons from './rules/valid-manifest-icons.js'
 import validMV3schema from './rules/valid-mv3-schema.js'
 import validServiceWorker from './rules/valid-service-worker.js'
 import validVersionField from './rules/valid-version-field.js'
 
+import { bundleRules, initBundleDeprecation } from './utils.js'
+
 const plugin = {
     rules: {
         'manifest-key-order': manifestKeyOrder,
+        'manifest-spacing': manifestSpacing,
         'no-content-style-leak': noContentStyleLeak,
         'no-deprecated-apis': noDeprecatedAPIs,
+        'no-duplicate-manifest-keys': noDuplicateManifestKeys,
+        'no-insecure-fetch': noInsecureFetch,
         'no-insecure-messaging': noInsecureMessaging,
         'no-invalid-permissions': noInvalidPermissions,
         'no-missing-permissions': noMissingPermissions,
+        'no-missing-web-accessible-resources': noMissingWebAccessibleResources,
         'no-remote-code': noRemoteCode,
+        'no-unrestricted-host-permissions': noUnrestrictedHostPermissions,
         'no-unused-permissions': noUnusedPermissions,
         'require-mv3': requireMV3,
+        'valid-manifest-icons': validManifestIcons,
         'valid-mv3-schema': validMV3schema,
         'valid-service-worker': validServiceWorker,
         'valid-version-field': validVersionField
@@ -46,10 +60,17 @@ plugin.configs = {
         plugins: { 'chrome-extensions': plugin },
         rules: bundleRules(plugin.rules, rule => rule.meta.type == 'problem', 'chrome-extensions')
     },
+    security: {
+        plugins: { 'chrome-extensions': plugin },
+        rules: bundleRules(plugin.rules, rule => rule.meta.docs.security, 'chrome-extensions')
+    },
     manifest: {
         plugins: { 'chrome-extensions': plugin },
         rules: bundleRules(plugin.rules, rule => rule.meta.docs.manifest, 'chrome-extensions')
     }
 }
 
+for (const entry of Object.entries(oldBundles))
+    initBundleDeprecation(plugin, entry, 'chrome-extensions')
+
 export { plugin as default, plugin as chromeExtensions }

package/src/rules/manifest-key-order.js

@@ -1,4 +1,5 @@
 import { manifestKeyOrder } from '../data/manifest.js'
+
 import { getFilename } from '../utils.js'
 
 const re = { manifestFilename: /manifest\.json$/ }
@@ -23,7 +24,7 @@ export default {
     meta: {
         type: 'layout',
         docs: {
-            description: 'Enforce an order for manifest keys',
+            description: 'Enforces a preferred order for manifest keys',
             category: 'Stylistic Issues',
             recommended: false,
             manifest: true
@@ -40,7 +41,7 @@ export default {
             additionalProperties: false
         }],
         defaultOptions: [{ order: [] }],
-        messages: { wrongOrder: '`{{first}}` should appear before `{{second}}`' }
+        messages: { wrongOrder: '`{{first}}` should appear before `{{second}}`.' }
     },
 
     create(context) {

package/src/rules/manifest-spacing.js

@@ -0,0 +1,160 @@
+import { getFilename } from '../utils.js'
+
+const re = { manifestFilename: /manifest\.json$/, leadingWhitespace: /^[ \t]+/ },
+      brackets = { open: new Set(['LBrace', 'LBracket']), close: new Set(['RBrace', 'RBracket']) }
+
+export default {
+    meta: {
+        type: 'layout',
+        docs: {
+            description: 'Enforces consistent indentation and spacing in `manifest.json`',
+            category: 'Stylistic Issues',
+            recommended: false,
+            manifest: true
+        },
+        fixable: 'whitespace',
+        schema: [{
+            type: 'object',
+            properties: {
+                spaces: {
+                    type: 'number',
+                    description: 'Number of spaces per indent level (default 2)'
+                },
+                checkColons: {
+                    type: 'boolean',
+                    description: 'Enforce no spaces before and 1 space after `:` in key/value pairs (default true)'
+                },
+                checkCommas: {
+                    type: 'boolean',
+                    description: 'Enforce no spaces before and 1 space after `,` in inline objects (default true)'
+                },
+                checkBraces: {
+                    type: 'boolean',
+                    description: 'Enforce 1 space after `{` and before `}` in inline objects (default true)'
+                },
+                checkBrackets: {
+                    type: 'boolean',
+                    description: 'Enforce no spaces after `[` or before `]` in inline arrays (default true)'
+                }
+            },
+            additionalProperties: false
+        }],
+        defaultOptions: [{ spaces: 2, checkColons: true, checkCommas: true,
+                           checkBraces: true, checkBrackets: true }],
+        messages: {
+            wrongIndent: 'Expected {{expected}} spaces of indentation (found {{found}}).',
+            tabFound: 'Expected spaces for indentation, found tabs.',
+            spaceBeforeColon: 'Expected no spaces before `:`.',
+            spaceAfterColon: 'Expected 1 space after `:`.',
+            spaceBeforeComma: 'Expected no spaces before `,`.',
+            spaceAfterComma: 'Expected 1 space after `,`.',
+            spaceAfterBrace: 'Expected 1 space after `{`.',
+            spaceBeforeBrace: 'Expected 1 space before `}`.',
+            spaceInEmptyBraces: 'Expected no spaces in empty `{}`.',
+            spaceAfterBracket: 'Expected no spaces after `[`.',
+            spaceBeforeBracket: 'Expected no spaces before `]`.'
+        }
+    },
+
+    create(context) {
+        if (!re.manifestFilename.test(getFilename(context))) return {}
+        const opts = context.options[0] || {},
+              spaces = opts.spaces ?? 2,
+              checkColons = opts.checkColons ?? true,
+              checkCommas = opts.checkCommas ?? true,
+              checkBraces = opts.checkBraces ?? true,
+              checkBrackets = opts.checkBrackets ?? true
+        return {
+            'Document'(document) {
+                const sourceCode = context.sourceCode,
+                      text = sourceCode.getText(),
+                      lines = text.split('\n'),
+                      tokens = document.tokens || [],
+                      lineOffsets = [0]
+                for (const line of lines)
+                    lineOffsets.push(lineOffsets.at(-1) + line.length +1)
+                let depth = 0, lastLine = 0
+                for (const token of tokens) { // check indentation
+                    const startLine = token.loc.start.line
+                    if (startLine != lastLine) {
+                        const indent = lines[startLine -1].match(re.leadingWhitespace)?.[0] || '',
+                              effectiveDepth = brackets.close.has(token.type) ? Math.max(0, depth -1) : depth,
+                              expected = ' '.repeat(effectiveDepth * spaces)
+                        if (indent != expected) {
+                            const lineStart = lineOffsets[startLine -1],
+                                  isTab = indent.includes('\t')
+                            context.report({
+                                loc: { line: startLine, column: 1 }, messageId: isTab ? 'tabFound' : 'wrongIndent',
+                                data: { expected: effectiveDepth * spaces, found: indent.length },
+                                fix(fixer) {
+                                    return fixer.replaceTextRange([lineStart, lineStart + indent.length], expected) }
+                            })
+                        }
+                        lastLine = startLine
+                    }
+                    if (brackets.open.has(token.type)) depth += 1
+                    else if (brackets.close.has(token.type)) depth -= 1
+                }
+                for (let t = 0 ; t < tokens.length ; t++) { // check inline spacing
+                    const token = tokens[t], // eslint-disable-line security/detect-object-injection
+                          type = token.type,
+                          prev = tokens[t -1], next = tokens[t +1]
+                    if (next) {
+                        const between = text.slice(token.range[1], next.range[0]),
+                              inline = !between.includes('\n'),
+                              isColon = type == 'Colon', isComma = type == 'Comma'
+                        if (checkColons && isColon && inline && between != ' ')
+                            context.report({
+                                loc: token.loc.end, messageId: 'spaceAfterColon',
+                                fix(fixer) { return fixer.replaceTextRange([token.range[1], next.range[0]], ' ') }
+                            })
+                        if (checkCommas && isComma && inline && between != ' ')
+                            context.report({
+                                loc: token.loc.end, messageId: 'spaceAfterComma',
+                                fix(fixer) { return fixer.replaceTextRange([token.range[1], next.range[0]], ' ') }
+                            })
+                        if (checkBraces && type == 'LBrace' && inline) {
+                            const empty = next.type == 'RBrace', want = empty ? '' : ' '
+                            if (between != want)
+                                context.report({
+                                    loc: token.loc.end,
+                                    messageId: empty ? 'spaceInEmptyBraces' : 'spaceAfterBrace',
+                                    fix(fixer) { return fixer.replaceTextRange([token.range[1], next.range[0]], want) }
+                                })
+                        }
+                        if (checkBrackets && type == 'LBracket' && inline && between != '')
+                            context.report({
+                                loc: token.loc.end, messageId: 'spaceAfterBracket',
+                                fix(fixer) { return fixer.replaceTextRange([token.range[1], next.range[0]], '') }
+                            })
+                    }
+                    if (prev) {
+                        const between = text.slice(prev.range[1], token.range[0]),
+                              inline = !between.includes('\n'),
+                              isColon = type == 'Colon', isComma = type == 'Comma'
+                        if (checkColons && isColon && inline && between != '')
+                            context.report({
+                                loc: token.loc.start, messageId: 'spaceBeforeColon',
+                                fix(fixer) { return fixer.replaceTextRange([prev.range[1], token.range[0]], '') }
+                            })
+                        if (checkCommas && isComma && inline && between != '')
+                            context.report({
+                                loc: token.loc.start, messageId: 'spaceBeforeComma',
+                                fix(fixer) { return fixer.replaceTextRange([prev.range[1], token.range[0]], '') }
+                            })
+                        if (checkBraces && type == 'RBrace' && prev.type != 'LBrace' && inline && between != ' ')
+                            context.report({
+                                loc: token.loc.start, messageId: 'spaceBeforeBrace',
+                                fix(fixer) { return fixer.replaceTextRange([prev.range[1], token.range[0]], ' ') }
+                            })
+                        if (checkBrackets && type == 'RBracket' && prev.type != 'LBracket' && inline && between != '')
+                            context.report({
+                                loc: token.loc.start, messageId: 'spaceBeforeBracket',
+                                fix(fixer) { return fixer.replaceTextRange([prev.range[1], token.range[0]], '') }
+                            })
+                    }
+                }
+            }
+        }
+    }
+}

package/src/rules/no-duplicate-manifest-keys.js

@@ -0,0 +1,36 @@
+import { getFilename } from '../utils.js'
+
+const re = { manifestFilename: /manifest\.json$/ }
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow duplicate keys in manifest.json',
+            category: 'Possible Errors',
+            recommended: false,
+            manifest: true
+        },
+        schema: [],
+        messages: {
+            duplicateKey: 'Duplicate manifest key "{{key}}".'
+        }
+    },
+
+    create(context) {
+        if (!re.manifestFilename.test(getFilename(context))) return {}
+        return {
+            Object(node) {
+                const members = node.members || node.properties || [],
+                      seen = new Set()
+                for (const member of members) {
+                    const keyNode = member.name || member.key ; if (!keyNode) continue
+                    const keyName = keyNode.value ?? keyNode.name ; if (typeof keyName != 'string') continue
+                    if (seen.has(keyName))
+                        context.report({ node: keyNode, messageId: 'duplicateKey', data: { key: keyName } })
+                    else seen.add(keyName)
+                }
+            }
+        }
+    }
+}

package/src/rules/no-insecure-fetch.js

@@ -0,0 +1,52 @@
+const re = { insecureURL: /^http:\/\/(?!localhost\b|127\.0\.0\.1\b|\[::1\])/i }
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Flags `fetch()` and `XMLHttpRequest.open()` calls that use `http://`',
+            category: 'Possible Errors',
+            recommended: true,
+            security: true
+        },
+        schema: [],
+        messages: {
+            insecureFetch: '`fetch()` to "{{url}}" insecure. Use HTTPS or a relative path instead.',
+            insecureXHR: '`XMLHttpRequest.open()` to "{{url}}" insecure. Use HTTPS or a relative path instead.'
+        }
+    },
+
+    create(context) {
+        const xhrVars = new Set()
+        function urlFromLiteral(node) {
+            return ( node?.type == 'Literal'
+                && typeof node.value == 'string'
+                && re.insecureURL.test(node.value)
+            ) ? node.value : null
+        }
+        return {
+            VariableDeclarator(node) {
+                if (node.init?.type == 'NewExpression'
+                    && node.init.callee?.name == 'XMLHttpRequest'
+                    && node.id.type == 'Identifier'
+                ) xhrVars.add(node.id.name)
+            },
+            CallExpression(node) {
+                if (node.callee.type == 'Identifier' && node.callee.name == 'fetch') {
+                    const url = urlFromLiteral(node.arguments[0])
+                    if (url)
+                        context.report({ node: node.arguments[0], messageId: 'insecureFetch', data: { url }})
+                }
+                if (node.callee.type == 'MemberExpression'
+                    && node.callee.property?.name == 'open'
+                    && node.callee.object?.type == 'Identifier'
+                    && xhrVars.has(node.callee.object.name)
+                ) {
+                    const url = urlFromLiteral(node.arguments[1])
+                    if (url)
+                        context.report({ node: node.arguments[1], messageId: 'insecureXHR', data: { url }})
+                }
+            }
+        }
+    }
+}

package/src/rules/no-insecure-messaging.js

@@ -1,24 +1,46 @@
-import { isExternalMessagingListener } from '../data/apis.js'
 import { getMemberPath } from '../utils.js'
+import { isExternalMessagingListener } from '../data/apis.js'
 
-const RE_SENDER_VALIDATION = /sender\.(?:id|origin)/
+const re = { postmsgValidation: /\b\w+\.(?:origin|source)\b/, senderValidation: /sender\.(?:id|origin)/ }
 
 export default {
     meta: {
         type: 'problem',
         docs: {
-            description: 'Require sender validation on external messaging + filtered tab broadcasts',
+            description: 'Requires sender/origin validation + filtered `tabs.query()` + explicit `window.postMessage()` target',
             category: 'Possible Errors',
-            recommended: true
+            recommended: true,
+            security: true
         },
-        schema: [],
+        defaultOptions: [{ disallowWildcardTarget: true }],
+        schema: [{
+            type: 'object',
+            properties: {
+                disallowWildcardTarget: {
+                    type: 'boolean',
+                    description: 'Flag postMessage calls that use "*" as targetOrigin'
+                }
+            },
+            additionalProperties: false
+        }],
         messages: {
             unvalidatedExternal: '`{{listener}}` handler must validate `sender.<id|origin>` before processing messages.',
-            unfilteredBroadcast: '`chrome.tabs.query({})` with no filter broadcasts to every open tab - add `url` or `currentWindow`.'
+            unfilteredBroadcast: '`chrome.tabs.query({})` w/ no filter broadcasts to every open tab. Add `url` or `currentWindow` instead.',
+            unvalidatedPostMessage: '`{{target}}` message handler must validate `event.origin`/`event.source` before processing messages.',
+            wildcardTarget: '`postMessage` to `"*"` leaks data to any origin. Explicitly specify `targetOrigin` instead.'
         }
     },
 
     create(context) {
+        const opts = context.options[0] || {},
+              disallowWildcard = opts.disallowWildcardTarget !== false
+        function checkPostMessageHandler(node, handlerNode, target) {
+            if (!handlerNode) return
+            const body = context.sourceCode.getText(handlerNode)
+            if (re.postmsgValidation.test(body)) return
+            context.report({ node, messageId: 'unvalidatedPostMessage', data: { target }})
+        }
+        function isMessageTarget(obj) { return obj?.type == 'Identifier' && ['self', 'window'].includes(obj.name) }
         return {
             CallExpression(node) {
                 if (node.callee.type != 'MemberExpression') return
@@ -27,7 +49,7 @@ export default {
                 if (listenerRoot && isExternalMessagingListener(listenerRoot)) {
                     const handler = node.arguments[0] ; if (!handler) return
                     const body = context.sourceCode.getText(handler)
-                    if (!RE_SENDER_VALIDATION.test(body))
+                    if (!re.senderValidation.test(body))
                         context.report({ node, messageId: 'unvalidatedExternal', data: { listener: listenerRoot }})
                 }
                 if (path == 'chrome.tabs.query') {
@@ -36,6 +58,21 @@ export default {
                     if (isEmpty)
                         context.report({ node, messageId: 'unfilteredBroadcast' })
                 }
+                if (node.callee.property?.name == 'addEventListener'
+                    && node.arguments[0]?.value == 'message'
+                    && isMessageTarget(node.callee.object)
+                ) checkPostMessageHandler(node, node.arguments[1], node.callee.object.name)
+                if (disallowWildcard && node.callee.property?.name == 'postMessage') {
+                    const target = node.arguments[1]
+                    if (target?.type == 'Literal' && target.value == '*')
+                        context.report({ node: target, messageId: 'wildcardTarget' })
+                }
+            },
+            AssignmentExpression(node) {
+                if (node.left.type == 'MemberExpression'
+                    && node.left.property?.name == 'onmessage'
+                    && isMessageTarget(node.left.object)
+                ) checkPostMessageHandler(node, node.right, node.left.object.name)
             }
         }
     }

package/src/rules/no-invalid-permissions.js

@@ -1,5 +1,5 @@
-import { isValidPermission } from '../data/permissions.js'
 import { getFilename, readManifest } from '../utils.js'
+import { isValidPermission } from '../data/permissions.js'
 
 const re = { manifestFilename: /manifest\.json$/ }
 
@@ -9,7 +9,7 @@ export default {
         docs: {
             description: 'Disallow invalid or unsupported manifest permission names',
             category: 'Possible Errors',
-            recommended: true,
+            recommended: false,
             manifest: true
         },
         defaultOptions: [{ target: 'mv3', allowedPermissions: [] }],