eslint-plugin-chrome-extensions 2.2.0 → 2.4.0

package/src/rules/valid-url-fields.js

@@ -0,0 +1,136 @@
+import { getFilename } from '../utils.js'
+
+const re = {
+    absoluteURL: /^[a-z][a-z0-9+.-]*:\/\/[^\s/]+/i, manifestFilename: /manifest\.json$/,
+    match: /^(\*|https?|file|ftp):\/\/([^/]*)(\/.*)$/, template: /\{[^}]+\}/g
+}
+
+const matchPaths = new Set([
+    'content_scripts.matches', 'externally_connectable.matches',
+    'host_permissions', 'optional_host_permissions', 'web_accessible_resources.matches'
+])
+
+const urlPaths = new Set([
+    'homepage_url', 'update_url', 'oauth2.scopes',
+    'chrome_settings_overrides.homepage',
+    'chrome_settings_overrides.search_provider.alternate_urls',
+    'chrome_settings_overrides.search_provider.favicon_url',
+    'chrome_settings_overrides.search_provider.image_url',
+    'chrome_settings_overrides.search_provider.instant_url',
+    'chrome_settings_overrides.search_provider.search_url',
+    'chrome_settings_overrides.search_provider.suggest_url',
+    'chrome_settings_overrides.startup_pages'
+])
+
+function collectStrings(obj, path = [], out = []) {
+    if (obj == null) return out
+    if (typeof obj == 'string') out.push({ path: path.join('.'), value: obj })
+    else if (Array.isArray(obj))
+        for (const el of obj) collectStrings(el, path, out)
+    else if (typeof obj == 'object')
+        for (const key of Object.keys(obj)) // eslint-disable-next-line security/detect-object-injection
+            collectStrings(obj[key], [...path, key], out)
+    return out
+}
+
+function isURL(value) { return re.absoluteURL.test(value.replace(re.template, 'x')) }
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Validates URLs and match patterns in manifest fields',
+            category: 'Possible Errors',
+            recommended: true,
+            manifest: true
+        },
+        schema: [{
+            type: 'object',
+            properties: {
+                checkURLfields: {
+                    type: 'boolean',
+                    description: 'Validate URL fields (`homepage_url`, `update_url`, etc.)'
+                },
+                checkMatchPatterns: {
+                    type: 'boolean',
+                    description: 'Validate match patterns (`host_permissions`, `content_scripts`, etc.)'
+                },
+                allowedSchemes: {
+                    type: 'array', items: { type: 'string' },
+                    description: 'Permitted URL schemes for match patterns (default `["https", "file"]`)'
+                },
+                allowAllURLs: {
+                    type: 'boolean',
+                    description: 'Allow unrestricted patterns (`<all_urls>`, `https://*/*`, `*://*/*`)'
+                }
+            },
+            additionalProperties: false
+        }],
+        defaultOptions: [{
+            checkURLfields: true, checkMatchPatterns: true,
+            allowedSchemes: ['https', 'file'], allowAllURLs: false
+        }],
+        messages: {
+            invalidURL: '`{{field}}` has an invalid URL: "{{value}}".',
+            invalidMatchPattern: '`{{field}}` has an invalid match pattern: "{{value}}".',
+            invalidScheme: '`{{field}}` uses a disallowed scheme: "{{value}}".',
+            invalidFileHost: '`{{field}}` uses a `file://` scheme w/ a non-empty host: "{{value}}".',
+            invalidHost: '`{{field}}` has an invalid wildcard host: "{{value}}". Use `*.` prefix instead.',
+            invalidWARPath: '`{{field}}` must use an effective path of `/*`: "{{value}}".',
+            invalidExternalHost: '`{{field}}` does not allow wildcards in the host: "{{value}}".',
+            allURLs: '`{{field}}` uses the unrestricted `<all_urls>` pattern.'
+        }
+    },
+
+    create(context) {
+        if (!re.manifestFilename.test(getFilename(context))) return {}
+        const opts = context.options[0] || {},
+              checkURLfields = opts.checkURLfields ?? true,
+              checkMatchPatterns = opts.checkMatchPatterns ?? true,
+              allowedSchemes = opts.allowedSchemes ?? ['https', 'file'],
+              allowAllURLs = opts.allowAllURLs ?? false
+        if (!checkURLfields && !checkMatchPatterns) return {}
+        return {
+            'Document:exit'() {
+                let manifest
+                try { manifest = JSON.parse(context.sourceCode.text) } catch { return }
+                for (const { path, value } of collectStrings(manifest)) {
+                    if (checkURLfields && urlPaths.has(path)) {
+                        if (!isURL(value))
+                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidURL',
+                                data: { field: path, value }})
+                    } else if (checkMatchPatterns && matchPaths.has(path)) {
+                        if (value == '<all_urls>') {
+                            if (!allowAllURLs)
+                                context.report({ loc: { line: 1, column: 1 }, messageId: 'allURLs',
+                                    data: { field: path }})
+                            continue
+                        }
+                        const match = value.match(re.match)
+                        if (!match) {
+                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidMatchPattern',
+                                data: { field: path, value }})
+                            continue
+                        }
+                        const [, scheme, host] = match
+                        if (scheme != '*' && !allowedSchemes.includes(scheme))
+                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidScheme',
+                                data: { field: path, value }})
+                        else if (scheme == 'file' && host != '')
+                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidFileHost',
+                                data: { field: path, value }})
+                        else if (path == 'externally_connectable.matches' && host.includes('*'))
+                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidExternalHost',
+                                data: { field: path, value }})
+                        else if (host.includes('*') && host != '*' && !host.startsWith('*.'))
+                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidHost',
+                                data: { field: path, value }})
+                        else if (path == 'web_accessible_resources.matches' && !value.endsWith('/*'))
+                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidWARPath',
+                                data: { field: path, value }})
+                    }
+                }
+            }
+        }
+    }
+}

package/src/rules/valid-version-field.js

@@ -30,14 +30,16 @@ export default {
                 },
                 timezone: {
                     type: 'string',
-                    description: 'IANA timezone for determining the current date (when omitted, only year and month are checked)'
+                    description: 'IANA timezone for determining the current date '
+                               + '(when omitted, only year and month are checked)'
                 }
             },
             additionalProperties: false
         }],
         defaultOptions: [{}],
         messages: {
-            invalidVersion: 'Invalid manifest `version`: must be a valid {{versionType}} version (expected format: {{example}}).',
+            invalidVersion: 'Invalid manifest `version`: must be a valid {{versionType}} version '
+                          + '(expected format: {{example}}).',
             futureVersion: 'Invalid manifest `version`: date cannot be in the future.'
         }
     },

package/src/utils.js

@@ -10,17 +10,6 @@ export function bundleRules(rules, predicate, pluginName) {
         .map(([ruleId]) => [`${pluginName}/${ruleId}`, 'error']))
 }
 
-export function initBundleDeprecation(plugin, [ruleId, bundleNames], pluginName) {
-    for (const bundleName of bundleNames) {
-        /* eslint-disable security/detect-object-injection */
-        if (plugin.configs[bundleName])
-            plugin.configs[bundleName].rules[`${pluginName}/${ruleId}`] = 'error'
-        /* eslint-enable security/detect-object-injection */
-        if (process.env.DEBUG_MODE)
-            console.warn(`[${pluginName}] '${ruleId}' will be removed from '${bundleName}' in a future major release`)
-    }
-}
-
 export function findExtensionRoot(context) {
     let dir = path.dirname(getFilename(context))
     while (dir) {
@@ -55,6 +44,17 @@ export function getMemberPath(node) {
     return parts.join('.')
 }
 
+export function initBundleDeprecation(plugin, [ruleId, bundleNames], pluginName) {
+    for (const bundleName of bundleNames) {
+        /* eslint-disable security/detect-object-injection */
+        if (plugin.configs[bundleName])
+            plugin.configs[bundleName].rules[`${pluginName}/${ruleId}`] = 'error'
+        /* eslint-enable security/detect-object-injection */
+        if (process.env.DEBUG_MODE)
+            console.warn(`[${pluginName}] '${ruleId}' will be removed from '${bundleName}' in a future major release`)
+    }
+}
+
 export function isContentScriptFile(context, manifest) {
     const scripts = (manifest?.content_scripts || []).flatMap(cs => cs.js || [])
     if (!scripts.length) return false
@@ -87,8 +87,7 @@ export function readManifest(context) {
     if (!root) return null
     if (manifestCache.has(root)) return manifestCache.get(root)
     let parsed
-    try {
-        // eslint-disable-next-line security/detect-non-literal-fs-filename
+    try { // eslint-disable-next-line security/detect-non-literal-fs-filename
         parsed = JSON.parse(fs.readFileSync(path.join(root, 'manifest.json'), 'utf8'))
     } catch { parsed = null }
     manifestCache.set(root, parsed)