eslint-plugin-chrome-extensions 2.2.0 → 2.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-chrome-extensions",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "ESLint rules for Chrome extensions",
   "type": "module",
   "engines": {
@@ -57,14 +57,14 @@
     "chromium"
   ],
   "peerDependencies": {
-    "eslint": ">=9.6.0",
-    "@eslint/json": ">=0.1.0"
+    "@eslint/json": ">=0.1.0",
+    "eslint": ">=9.6.0"
   },
   "devDependencies": {
     "@e18e/eslint-plugin": "^0.8.1",
     "@eslint/js": "^10.0.1",
     "@eslint/json": "^2.1.1",
-    "@eslint/markdown": "^8.0.3",
+    "@eslint/markdown": "^7.5.1",
     "@stylistic/eslint-plugin": "^5.10.0",
     "eslint": "^10.12.0",
     "eslint-plugin-constructors": "^1.4.2",

package/src/data/apis.js

@@ -1,26 +1,3 @@
-export const deprecatedAPIs = new Map([
-    ['chrome.pageAction.show',             'chrome.action.enable'],
-    ['chrome.pageAction.hide',             'chrome.action.disable'],
-    ['chrome.pageAction.setIcon',          'chrome.action.setIcon'],
-    ['chrome.pageAction.setTitle',         'chrome.action.setTitle'],
-    ['chrome.pageAction.setPopup',         'chrome.action.setPopup'],
-    ['chrome.pageAction.getTitle',         'chrome.action.getTitle'],
-    ['chrome.pageAction.getPopup',         'chrome.action.getPopup'],
-    ['chrome.browserAction',               'chrome.action'],
-    ['chrome.pageAction',                  'chrome.action'],
-    ['chrome.extension.getBackgroundPage', 'chrome.runtime.getContexts'],
-    ['chrome.extension.getURL',            'chrome.runtime.getURL'],
-    ['chrome.extension.sendRequest',       'chrome.runtime.sendMessage'],
-    ['chrome.extension.onRequest',         'chrome.runtime.onMessage'],
-    ['chrome.extension.onRequestExternal', 'chrome.runtime.onMessageExternal'],
-    ['chrome.extension.connect',           'chrome.runtime.connect'],
-    ['chrome.extension.onConnect',         'chrome.runtime.onConnect'],
-    ['chrome.extension.onConnectExternal', 'chrome.runtime.onConnectExternal'],
-    ['chrome.tabs.executeScript',          'chrome.scripting.executeScript'],
-    ['chrome.tabs.insertCSS',              'chrome.scripting.insertCSS'],
-    ['chrome.tabs.removeCSS',              'chrome.scripting.removeCSS']
-])
-
 export const apiPermissionMap = new Map([
     ['chrome.alarms',                'alarms'],
     ['chrome.bookmarks',             'bookmarks'],
@@ -47,7 +24,33 @@ export const apiPermissionMap = new Map([
     ['chrome.webRequest',            'webRequest']
 ])
 
-export const permissionlessAPIs = new Set([
+export const deprecatedAPIs = new Map([
+    ['chrome.pageAction.show',             'chrome.action.enable'],
+    ['chrome.pageAction.hide',             'chrome.action.disable'],
+    ['chrome.pageAction.setIcon',          'chrome.action.setIcon'],
+    ['chrome.pageAction.setTitle',         'chrome.action.setTitle'],
+    ['chrome.pageAction.setPopup',         'chrome.action.setPopup'],
+    ['chrome.pageAction.getTitle',         'chrome.action.getTitle'],
+    ['chrome.pageAction.getPopup',         'chrome.action.getPopup'],
+    ['chrome.browserAction',               'chrome.action'],
+    ['chrome.pageAction',                  'chrome.action'],
+    ['chrome.extension.getBackgroundPage', 'chrome.runtime.getContexts'],
+    ['chrome.extension.getURL',            'chrome.runtime.getURL'],
+    ['chrome.extension.sendRequest',       'chrome.runtime.sendMessage'],
+    ['chrome.extension.onRequest',         'chrome.runtime.onMessage'],
+    ['chrome.extension.onRequestExternal', 'chrome.runtime.onMessageExternal'],
+    ['chrome.extension.connect',           'chrome.runtime.connect'],
+    ['chrome.extension.onConnect',         'chrome.runtime.onConnect'],
+    ['chrome.extension.onConnectExternal', 'chrome.runtime.onConnectExternal'],
+    ['chrome.tabs.executeScript',          'chrome.scripting.executeScript'],
+    ['chrome.tabs.insertCSS',              'chrome.scripting.insertCSS'],
+    ['chrome.tabs.removeCSS',              'chrome.scripting.removeCSS']
+])
+
+export const externalMessagingListeners =
+    new Set(['chrome.runtime.onMessageExternal', 'chrome.runtime.onConnectExternal'])
+
+export const permlessAPIs = new Set([
     // https://developer.chrome.com/docs/extensions/reference/api/management
     'chrome.management.getPermissionWarningsByManifest',
     'chrome.management.getSelf',
@@ -96,9 +99,6 @@ export const permissionlessAPIs = new Set([
     'chrome.tabs.update'
 ])
 
-export const externalMessagingListeners =
-    new Set(['chrome.runtime.onMessageExternal', 'chrome.runtime.onConnectExternal'])
-
 export function findDeprecated(api) {
     for (const [deprecated, replacement] of deprecatedAPIs)
         if (api == deprecated || api.startsWith(`${deprecated}.`))
@@ -107,7 +107,7 @@ export function findDeprecated(api) {
 }
 
 export function findPermission(api) {
-    if (permissionlessAPIs.has(api)) return null
+    if (permlessAPIs.has(api)) return null
     for (const [prefix, permission] of apiPermissionMap)
         if (api == prefix || api.startsWith(`${prefix}.`))
             return permission

package/src/data/manifest.js

@@ -3,6 +3,20 @@ import globals from 'globals'
 const serviceWorkerGlobals = new Set(Object.keys(globals.serviceworker || {}))
 export const domGlobals = new Set(Object.keys(globals.browser).filter(name => !serviceWorkerGlobals.has(name)))
 
+export const ffDataCollectionRequired = new Set([
+    'none', 'authenticationInfo', 'bookmarksInfo', 'browsingActivity', 'financialAndPaymentInfo', 'healthInfo',
+    'locationInfo', 'personalCommunications', 'personallyIdentifyingInfo', 'searchTerms', 'websiteActivity',
+    'websiteContent'
+])
+
+export const ffDataCollectionOptional = new Set([
+    'authenticationInfo', 'bookmarksInfo', 'browsingActivity', 'financialAndPaymentInfo', 'healthInfo', 'locationInfo',
+    'personalCommunications', 'personallyIdentifyingInfo', 'searchTerms', 'technicalAndInteraction', 'websiteActivity',
+    'websiteContent'
+])
+
+export const ffMV3bgKeys = new Set(['scripts', 'page'])
+
 export const forbiddenCSPdirectives = [
     `'unsafe-eval'`, `'unsafe-inline'`, `'unsafe-hashes'`, `'wasm-unsafe-eval'`, 'http://', 'https://']
 
@@ -21,20 +35,6 @@ export const manifestKeyOrder = [
     'protocol_handlers', 'requirements', 'sandbox', 'short_name', 'sidebar_action', 'side_panel', 'storage', 'theme',
     'theme_experiment', 'tts_engine', 'update_url', 'version_name', 'web_accessible_resources'
 ]
-
-export const ffDataCollectionRequired = new Set([
-    'none', 'authenticationInfo', 'bookmarksInfo', 'browsingActivity', 'financialAndPaymentInfo', 'healthInfo',
-    'locationInfo', 'personalCommunications', 'personallyIdentifyingInfo', 'searchTerms', 'websiteActivity',
-    'websiteContent'
-])
-
-export const ffDataCollectionOptional = new Set([
-    'authenticationInfo', 'bookmarksInfo', 'browsingActivity', 'financialAndPaymentInfo', 'healthInfo', 'locationInfo',
-    'personalCommunications', 'personallyIdentifyingInfo', 'searchTerms', 'technicalAndInteraction', 'websiteActivity',
-    'websiteContent'
-])
-
-export const ffMV3bgKeys = new Set(['scripts', 'page'])
 export const mv2OnlyKeys = new Set(['browser_action', 'page_action'])
 
 export const remoteCodePatterns = [

package/src/rules/manifest-key-order.js

@@ -1,5 +1,4 @@
 import { manifestKeyOrder } from '../data/manifest.js'
-
 import { getFilename } from '../utils.js'
 
 const re = { manifestFilename: /manifest\.json$/ }

package/src/rules/manifest-spacing.js

@@ -73,7 +73,7 @@ export default {
                       lineOffsets = [0]
                 for (const line of lines)
                     lineOffsets.push(lineOffsets.at(-1) + line.length +1)
-                let depth = 0, lastLine = 0
+                let depth = 0, lastLine = 0, prevToken = null
                 for (const token of tokens) { // check indentation
                     const startLine = token.loc.start.line
                     if (startLine != lastLine) {
@@ -92,8 +92,15 @@ export default {
                         }
                         lastLine = startLine
                     }
-                    if (brackets.open.has(token.type)) depth += 1
-                    else if (brackets.close.has(token.type)) depth -= 1
+                    const isOpen = brackets.open.has(token.type),
+                          isClose = brackets.close.has(token.type),
+                          wasOpen = prevToken && brackets.open.has(prevToken.type),
+                          wasClose = prevToken && brackets.close.has(prevToken.type),
+                          isSameLine = prevToken && prevToken.loc.end.line == token.loc.start.line,
+                          isContiguous = prevToken && prevToken.range[1] == token.range[0]
+                    if (isOpen && !(wasOpen && isSameLine)) depth += 1
+                    else if (isClose && !(wasClose && isContiguous)) depth -= 1
+                    prevToken = token
                 }
                 for (let t = 0 ; t < tokens.length ; t++) { // check inline spacing
                     const token = tokens[t], // eslint-disable-line security/detect-object-injection

package/src/rules/no-missing-permissions.js

@@ -1,5 +1,14 @@
 import { findPermission } from '../data/apis.js'
-import { readManifest, getMemberPath } from '../utils.js'
+import { getMemberPath, readManifest } from '../utils.js'
+
+function queriesActiveTab(node) {
+    const arg = node.arguments[0] ; if (arg?.type != 'ObjectExpression') return false
+    return arg.properties.some(prop => {
+        if (prop.type != 'Property') return false
+        const key = prop.key?.name ?? prop.key?.value
+        return key == 'active' && prop.value?.type == 'Literal' && prop.value.value === true
+    })
+}
 
 export default {
     meta: {
@@ -11,19 +20,23 @@ export default {
         },
         schema: [],
         messages: {
-            missingPermission: '`{{api}}` requires the "{{permission}}" manifest permission.'
+            missingPermission: '`{{api}}` requires the "{{permission}}" manifest permission.',
+            missingActiveTab: '`{{api}}` requires the "activeTab" manifest permission.'
         }
     },
 
     create(context) {
         const manifest = readManifest(context) ; if (!manifest) return {}
         const declared = new Set([...(manifest.permissions || []), ...(manifest.optional_permissions || [])])
+        if (declared.has('activeTab')) declared.add('tabs')
         return {
             CallExpression(node) {
                 if (node.callee.type != 'MemberExpression') return
                 const api = getMemberPath(node.callee) ; if (!api) return
                 const permission = findPermission(api) ; if (!permission || declared.has(permission)) return
-                context.report({ node, messageId: 'missingPermission', data: { api, permission }})
+                const messageId = permission == 'tabs' && queriesActiveTab(node)
+                    ? 'missingActiveTab' : 'missingPermission'
+                context.report({ node, messageId, data: { api, permission }})
             }
         }
     }

package/src/rules/no-remote-code.js

@@ -1,5 +1,4 @@
 import { remoteCodePatterns } from '../data/manifest.js'
-
 import { getMemberPath } from '../utils.js'
 
 const re = { url: /^https?:\/\// }

package/src/rules/no-unused-permissions.js

@@ -1,6 +1,8 @@
+import { apiPermissionMap, findPermission } from '../data/apis.js'
+
 import fs from 'node:fs'
 import path from 'node:path'
-import { apiPermissionMap, findPermission } from '../data/apis.js'
+
 import { findExtensionRoot, getFilename, readManifest } from '../utils.js'
 
 const re = { manifestFilename: /manifest\.json$/ }

package/src/rules/valid-mv3-schema.js

@@ -1,7 +1,8 @@
-import { getFilename, readManifest } from '../utils.js'
 import { mv2OnlyKeys, forbiddenCSPdirectives, ffMV3bgKeys, ffDataCollectionRequired, ffDataCollectionOptional }
     from '../data/manifest.js'
 
+import { getFilename, readManifest } from '../utils.js'
+
 const re = { manifestFilename: /manifest\.json$/ }
 
 export default {

package/src/rules/valid-service-worker.js

@@ -1,5 +1,5 @@
 import { domGlobals, serviceWorkerKeepaliveMinMS } from '../data/manifest.js'
-import { readManifest, isServiceWorkerFile, isInsideNestedFunction } from '../utils.js'
+import { isServiceWorkerFile, isInsideNestedFunction, readManifest } from '../utils.js'
 
 export default {
     meta: {