eslint-plugin-chrome-extensions 2.12.0 → 2.12.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-chrome-extensions",
-  "version": "2.12.0",
+  "version": "2.12.2",
   "description": "ESLint rules for Chrome extensions",
   "keywords": [
     "eslint",
@@ -61,10 +61,13 @@
     "test": "node tests/run"
   },
   "overrides": {
-    "@eslint/config-array": {
+    "@eslint/markdown": {
+      "katex": "^0.19.1"
+    },
+    "eslint": {
       "minimatch": "^11.0.5"
     },
-    "@typescript-eslint/typescript-estree": {
+    "eslint-plugin-import-x": {
       "minimatch": "^11.0.5"
     },
     "eslint-plugin-sonarjs": {
@@ -80,15 +83,15 @@
     "@e18e/eslint-plugin": "^0.8.1",
     "@eslint/css": "^2.0.1",
     "@eslint/json": "^2.1.1",
-    "@eslint/markdown": "^7.5.1",
-    "@html-eslint/eslint-plugin": "^0.67.0",
+    "@eslint/markdown": "^8.0.3",
+    "@html-eslint/eslint-plugin": "^0.68.0",
     "@stylistic/eslint-plugin": "^5.10.0",
-    "@typescript-eslint/parser": "^8.72.1",
-    "@typescript-eslint/utils": "^8.72.1",
+    "@typescript-eslint/parser": "^8.72.2",
+    "@typescript-eslint/utils": "^8.72.2",
     "eslint": "^10.14.0",
-    "eslint-plugin-constructors": "^1.7.1",
+    "eslint-plugin-constructors": "^1.7.2",
     "eslint-plugin-eslint-plugin": "^7.6.2",
-    "eslint-plugin-import-x": "^4.18.0",
+    "eslint-plugin-import-x": "^4.18.1",
     "eslint-plugin-n": "^18.5.0",
     "eslint-plugin-no-secrets": "^2.3.3",
     "eslint-plugin-no-unsanitized": "^4.1.5",
@@ -97,8 +100,8 @@
     "eslint-plugin-regexp": "^3.3.3",
     "eslint-plugin-security": "^4.2.1",
     "eslint-plugin-sonarjs": "^4.2.2",
-    "eslint-plugin-woodpecker": "^1.1.2",
-    "oxlint": "^1.91.0",
+    "eslint-plugin-woodpecker": "^1.1.4",
+    "oxlint": "^1.93.0",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "typescript-latest": "npm:typescript@^7.0.2"
   },

package/src/rules/manifest-key-order.js

@@ -5,11 +5,6 @@ import regex from '../data/regex.js'
 
 const defaultOptions = { order: [] }
 
-function keyOf(member) {
-    const keyNode = member.name || member.key
-    return keyNode?.value ?? keyNode?.name
-}
-
 function findViolation(members, keys) {
     const ranks = new Map(keys.map((key, index) => [key, index])),
           known = members.map(member => {
@@ -17,7 +12,26 @@ function findViolation(members, keys) {
               return { member, key, rank: ranks.get(key) }
           }).filter(item => item.rank !== undefined)
     for (let i = 1 ; i < known.length ; i++) // oxlint-disable-next-line security/detect-object-injection
-        if (known[i -1].rank > known[i].rank) return [known[i -1], known[i]]
+        if (known[i - 1].rank > known[i].rank) return [known[i - 1], known[i]]
+}
+function isSubsequence(sub, arr) {
+    let i = 0
+    for (const item of arr) if (item === sub[i]) i++ // oxlint-disable-line security/detect-object-injection
+    return i === sub.length
+}
+function keyOf(member) {
+    const keyNode = member.name || member.key
+    return keyNode?.value ?? keyNode?.name
+}
+function mergeOrder(master, custom) {
+    if (!custom.length || isSubsequence(custom, master)) return master
+    const customSet = new Set(custom),
+          insertAt = Math.min(...custom.map(key => master.indexOf(key)).filter(idx => idx >= 0))
+    return [
+        ...master.slice(0, insertAt),
+        ...custom,
+        ...master.slice(insertAt).filter(key => !customSet.has(key))
+    ]
 }
 
 export default {
@@ -46,14 +60,12 @@ export default {
     create(context) {
         if (!regex.filename.manifest.test(extension.file.getName(context))) return {}
         const { order } = { ...defaultOptions, ...context.options[0] },
-                master = order.length ? manifest.keys.order.filter(key => !order.includes(key)) : manifest.keys.order
+                keys = mergeOrder(manifest.keys.order, order)
         return {
             'Document:exit'(document) {
                 const root = document.body ; if (root?.type != 'Object') return
                 const members = root.members || root.properties || []
-                let keys = master, violation = findViolation(members, master)
-                if (!violation && order.length) { keys = order ; violation = findViolation(members, order) }
-                if (!violation) return
+                const violation = findViolation(members, keys) ; if (!violation) return
                 const [first, second] = violation
                 context.report({
                     node: second.member, messageId: 'wrongOrder',

package/src/rules/no-content-style-leak.js

@@ -1,18 +1,30 @@
 import extension from '../utils/extension.js'
 import nodeUtils from '../utils/node.js'
 
-const re = { appendMethod: /^append(?:Child)?$/ }
+const re = {
+    appendMethod: /^(?:append|appendChild|prepend|replaceChildren|insertBefore)$/,
+    invokeMethod: /^(?:apply|call)$/,
+    styleName: /style/i
+}
 
+function flattenArgs(args) {
+    return args.filter(Boolean).flatMap(arg =>
+        arg.type != 'SpreadElement' ? [arg]
+      : arg.argument?.type == 'ArrayExpression' ? arg.argument.elements.filter(Boolean)
+      : [arg.argument]
+    )
+}
+function getPropName(node) { return node?.name ?? node?.value }
 function isCreateStyle(node) {
     return node?.type == 'CallExpression'
-        && node.callee?.property?.name == 'createElement'
+        && getPropName(node.callee?.property) == 'createElement'
         && nodeUtils.getStringLiteral(node.arguments[0]) == 'style'
 }
 function isObjectAssign(node) {
     return node?.type == 'CallExpression'
         && node.callee?.type == 'MemberExpression'
         && node.callee.object?.name == 'Object'
-        && node.callee.property?.name == 'assign'
+        && getPropName(node.callee.property) == 'assign'
 }
 
 export default {
@@ -37,33 +49,60 @@ export default {
             return node?.type == 'Identifier'
                 && (node.name == 'document' || docAliases.has(node.name))
         }
-        function isDocumentMember(node) {
-            return node?.type == 'MemberExpression' && isDocumentRef(node.object)
+        function isDocRooted(node) {
+            if (!node) return false
+            if (node.type == 'Identifier') return isDocumentRef(node)
+            if (node.type == 'MemberExpression')
+                return node.object?.type == 'Identifier'
+                    && (node.object.name == 'window' || node.object.name == 'self')
+                    && getPropName(node.property) == 'document'
+                    || isDocRooted(node.object)
+            if (node.type == 'CallExpression' && getPropName(node.callee?.property) != 'createElement')
+                return isDocRooted(node.callee)
+            return false
         }
         function isStyleTarget(node) {
-            if (isCreateStyle(node)) return true
-            if (node?.type == 'Identifier' && styleElems.has(node.name)) return true
-            if (isObjectAssign(node) && isCreateStyle(node.arguments[0])) return true
-            if (isObjectAssign(node)
-                && node.arguments[0]?.type == 'Identifier'
-                && styleElems.has(node.arguments[0].name)
+            if (!node) return false
+            if (isCreateStyle(node)
+                || node.type == 'Identifier' && (styleElems.has(node.name) || re.styleName.test(node.name))
             ) return true
+            if (isObjectAssign(node)) {
+                const target = node.arguments[0]
+                if (isCreateStyle(target)
+                    || target?.type == 'Identifier' && styleElems.has(target.name)
+                ) return true
+            }
             return false
         }
+        function addAliases(pattern, source) {
+            if (!isDocRooted(source)) return
+            if (pattern.type == 'Identifier') docAliases.add(pattern.name)
+            else if (pattern.type == 'ObjectPattern')
+                for (const prop of pattern.properties) {
+                    if (prop.type != 'Property') continue
+                    if (prop.value?.type == 'Identifier') docAliases.add(prop.value.name)
+                }
+        }
         return {
             VariableDeclarator(node) {
-                if (node.id.type != 'Identifier') return
-                if (isCreateStyle(nodeUtils.unwrapTS(node.init))) styleElems.add(node.id.name)
-                if (nodeUtils.unwrapTS(node.init)?.type == 'Identifier' && isDocumentRef(node.init))
-                    docAliases.add(node.id.name)
+                const init = nodeUtils.unwrapTS(node.init)
+                if (node.id.type == 'Identifier' && isCreateStyle(init)) styleElems.add(node.id.name)
+                addAliases(node.id, init)
             },
             CallExpression(node) {
                 if (node.callee.type != 'MemberExpression') return
-                const method = node.callee.property.name
-                if (!re.appendMethod.test(method)
-                    || !isDocumentMember(node.callee.object)
+                const outerMethod = getPropName(node.callee.property),
+                      isInvoke = re.invokeMethod.test(outerMethod),
+                      callee = isInvoke ? node.callee.object : node.callee
+                if (callee?.type != 'MemberExpression'
+                    || !re.appendMethod.test(getPropName(callee.property))
+                    || !isDocRooted(callee.object)
                 ) return
-                for (const arg of node.arguments)
+                const args = !isInvoke ? node.arguments
+                    : outerMethod == 'apply'
+                        ? node.arguments[1]?.type == 'ArrayExpression' ? node.arguments[1].elements : []
+                        : node.arguments.slice(1)
+                for (const arg of flattenArgs(args))
                     if (isStyleTarget(arg))
                         context.report({ node: arg, messageId: 'styleLeak' })
             }

package/src/rules/no-unused-permissions.js

@@ -6,27 +6,57 @@ import path from 'node:path'
 import apis from '../data/apis.js'
 import regex from '../data/regex.js'
 
-function collectUsedAPIs(manifest, root) {
-    const files = new Set()
-    if (manifest.background?.service_worker) files.add(manifest.background.service_worker)
-    for (const script of manifest.background?.scripts || []) files.add(script)
+const re = {
+    chromeAPI: /\bchrome\.\w+(?:\.\w+)*/g, // oxlint-disable-line security/detect-unsafe-regex
+    htmlExt: /\.html?$/i,
+    htmlScriptSrc: /<script\b[^>]*?\ssrc\s*=\s*(?:"([^"]+)"|'([^']+)')/gi,
+    urlLike: /^(?:[a-z][a-z0-9+.-]*:|\/\/)/i
+}
+
+function collectScannableFiles(manifest) {
+    const files = new Set(),
+          add = file => { if (typeof file == 'string' && file) files.add(file) }
+    add(manifest.background?.service_worker)
+    add(manifest.background?.page)
+    for (const script of manifest.background?.scripts || []) add(script)
     for (const contentScript of manifest.content_scripts || [])
-        for (const file of contentScript.js || []) files.add(file)
-    if (manifest.action?.default_popup) files.add(manifest.action.default_popup)
-    if (manifest.options_ui?.page) files.add(manifest.options_ui.page)
-    if (manifest.devtools_page) files.add(manifest.devtools_page)
-    const re = { /* oxlint-disable-next-line security/detect-unsafe-regex */
-        chromeAPI: /\bchrome\.\w+(?:\.\w+)*/g }
-    const used = new Set()
-    for (const file of files) {
-        try {
-            const src = // oxlint-disable-next-line security/detect-non-literal-fs-filename
-                fs.readFileSync(path.resolve(root, file), 'utf8')
-            for (const match of src.matchAll(re.chromeAPI)) used.add(match[0])
-        } catch {}
+        for (const file of contentScript.js || []) add(file)
+    add(manifest.action?.default_popup)
+    add(manifest.browser_action?.default_popup)
+    add(manifest.page_action?.default_popup)
+    add(manifest.options_ui?.page)
+    add(manifest.options_page)
+    add(manifest.devtools_page)
+    add(manifest.side_panel?.default_path)
+    for (const page of Object.values(manifest.chrome_url_overrides || {})) add(page)
+    return files
+}
+function collectUsedAPIs(manifest, root) {
+    const queue = [...collectScannableFiles(manifest)],
+          visited = new Set(),
+          used = new Set()
+    while (queue.length) {
+        const relPath = queue.shift() ; if (!relPath) continue
+        const absPath = path.resolve(root, relPath) ; if (visited.has(absPath)) continue
+        visited.add(absPath)
+        let src
+        try { src = fs.readFileSync(absPath, 'utf8') } // oxlint-disable-line security/detect-non-literal-fs-filename
+        catch { continue }
+        for (const match of src.matchAll(re.chromeAPI)) used.add(match[0])
+        if (re.htmlExt.test(relPath))
+            for (const nested of extractScriptSrcs(src, relPath)) queue.push(nested)
     }
     return used
 }
+function extractScriptSrcs(html, htmlRelPath) {
+    const srcs = []
+    for (const match of html.matchAll(re.htmlScriptSrc)) {
+        const src = (match[1] ?? match[2])?.trim()
+        if (!src || re.urlLike.test(src)) continue
+        srcs.push(src.startsWith('/') ? src.slice(1) : path.join(path.dirname(htmlRelPath), src))
+    }
+    return srcs
+}
 
 export default {
     meta: {
@@ -50,10 +80,10 @@ export default {
         const root = extension.findRoot(context) ; if (!root) return {}
         const usedAPIs = collectUsedAPIs(manifest, root)
         function isUsed(permission) {
-            let knownPerm = false
-            for (const [, perm] of apis.permissionMap)
-                if (perm == permission) { knownPerm = true ; break }
-            if (!knownPerm) return true
+            let knownPermission = false
+            for (const [, mappedPermission] of apis.permissionMap)
+                if (mappedPermission == permission) { knownPermission = true ; break }
+            if (!knownPermission) return true
             for (const api of usedAPIs)
                 if (apiUtils.findPermission(api) == permission) return true
             return false
@@ -72,9 +102,9 @@ export default {
                 const keyNode = node.name || node.key ; if (!keyNode) return
                 const keyName = keyNode.value ?? keyNode.name
                 if (keyName != 'permissions' && keyName != 'optional_permissions') return
-                const arrNode = node.value ; if (arrNode?.type != 'Array') return
-                const nodeElems = arrNode.elements || arrNode.items || []
-                for (const elem of nodeElems) {
+                const arrayNode = node.value ; if (arrayNode?.type != 'Array') return
+                const elems = arrayNode.elements || arrayNode.items || []
+                for (const elem of elems) {
                     const valueNode = elem.value || elem,
                           permission = valueNode?.value
                     if (typeof permission != 'string') continue

package/src/rules/valid-license-file.js

@@ -58,8 +58,9 @@ export default {
                 allowedLicenses = array.to(rawAllowedLicenses),
               { filename } = context,
                 basename = path.basename(filename)
-        if (!regex.filename.license.test(basename) || regex.filename.script.test(basename))
-            return {}
-        return { Program: node => validateContent(context, node, { requireSPDX, allowedLicenses })}
+        return !regex.filename.license.test(basename) || regex.filename.script.test(basename) ? {} : {
+            Program:  node => validateContent(context, node, { requireSPDX, allowedLicenses }),
+            Document: node => validateContent(context, node, { requireSPDX, allowedLicenses })
+        }
     }
 }