eslint-plugin-chrome-extensions 2.3.0 → 2.4.1

package/src/rules/no-missing-web-accessible-resources.js

@@ -2,7 +2,7 @@ import { getMemberPath, isContentScriptFile, readManifest } from '../utils.js'
 
 const re = { leadingSlash: /^\//, regexSpecial: /[.+?^${}()|[\]\\]/g }
 
-function collectWarPatterns(manifest) {
+function collectWARpatterns(manifest) {
     const war = manifest.web_accessible_resources
     if (!Array.isArray(war)) return []
     const patterns = []
@@ -29,14 +29,14 @@ export default {
         },
         schema: [],
         messages: {
-            missingWar: '`{{path}}` is not in `web_accessible_resources`.'
+            missingWAR: '`{{path}}` is not in `web_accessible_resources`.'
         }
     },
 
     create(context) {
         const manifest = readManifest(context) ; if (!manifest) return {}
         if (!isContentScriptFile(context, manifest)) return {}
-        const regexes = collectWarPatterns(manifest).map(patternToRegex)
+        const regexes = collectWARpatterns(manifest).map(patternToRegex)
         return {
             CallExpression(node) {
                 if (node.callee.type != 'MemberExpression') return
@@ -44,7 +44,7 @@ export default {
                 const arg = node.arguments[0] ; if (arg?.type != 'Literal' || typeof arg.value != 'string') return
                 const resourcePath = arg.value.replace(re.leadingSlash, '')
                 for (const regex of regexes) if (regex.test(resourcePath)) return
-                context.report({ node: arg, messageId: 'missingWar', data: { path: arg.value }})
+                context.report({ node: arg, messageId: 'missingWAR', data: { path: arg.value }})
             }
         }
     }

package/src/rules/no-remote-code.js

@@ -48,16 +48,16 @@ export default {
               patterns = new Set(opts.patterns || remoteCodePatterns),
               checkClosures = opts.checkExecuteScriptClosures !== false,
               scriptElems = new Set()
-        function isLiteralUrl(node) {
-            return node?.type == 'Literal'
-                && typeof node.value == 'string'
-                && re.url.test(node.value)
-        }
         function isCreateScript(node) {
             return node?.type == 'CallExpression'
                 && node.callee?.property?.name == 'createElement'
                 && node.arguments[0]?.value == 'script'
         }
+        function isLiteralUrl(node) {
+            return node?.type == 'Literal'
+                && typeof node.value == 'string'
+                && re.url.test(node.value)
+        }
         function isObjectAssign(node) {
             return node?.type == 'CallExpression'
                 && node.callee?.type == 'MemberExpression'

package/src/rules/no-unrestricted-host-permissions.js

@@ -25,7 +25,8 @@ export default {
             additionalProperties: false
         }],
         messages: {
-            unrestrictedHost: 'Host permission "{{pattern}}" grants access to every site. Narrow to specific origins or allow explicitly instead.'
+            unrestrictedHost: 'Host permission "{{pattern}}" grants access to every site. '
+                            + 'Narrow to specific origins or allow explicitly instead.'
         }
     },
 
@@ -38,9 +39,9 @@ export default {
                 const keyName = keyNode.value ?? keyNode.name
                 if (!hostKeys.has(keyName)) return
                 const arrNode = node.value ; if (arrNode?.type != 'Array') return
-                const elements = arrNode.elements || arrNode.items || []
-                for (const el of elements) {
-                    const valueNode = el.value || el,
+                const elems = arrNode.elements || arrNode.items || []
+                for (const elem of elems) {
+                    const valueNode = elem.value || elem,
                           pattern = valueNode?.value
                     if (typeof pattern != 'string'
                         || allowed.has(pattern)

package/src/rules/no-unused-i18n-keys.js

@@ -0,0 +1,54 @@
+import { readManifest } from '../utils.js'
+import { collectUsedKeys, defaultScanExtensions, findExtensionRoot, readDefaultLocaleMessages } from '../data/i18n.js'
+
+const re = { manifestFile: /manifest\.json$/ }
+
+export default {
+    meta: {
+        type: 'suggestion',
+        docs: {
+            description: 'Flag i18n keys in `messages.json` that are never referenced',
+            category: 'Stylistic Issues',
+            recommended: false,
+            manifest: true
+        },
+        schema: [{
+            type: 'object',
+            properties: {
+                ignoreKeys: {
+                    type: 'array', items: { type: 'string' },
+                    description: 'Keys to always treat as used (e.g. `["myKey"]`)'
+                },
+                scanExtensions: {
+                    type: 'array', items: { type: 'string' },
+                    description: 'File extensions to scan for references'
+                }
+            },
+            additionalProperties: false
+        }],
+        defaultOptions: [{ ignoreKeys: [], scanExtensions: defaultScanExtensions }],
+        messages: {
+            unusedKey: '`{{key}}` in `_locales/{{locale}}/messages.json` is never referenced.'
+        }
+    },
+
+    create(context) {
+        const filename = context.filename
+        if (!filename || !re.manifestFile.test(filename)) return {}
+        const manifest = readManifest(context) ; if (!manifest?.default_locale) return {}
+        const root = findExtensionRoot(filename) ; if (!root) return {}
+        const i18n = readDefaultLocaleMessages(manifest, root) ; if (!i18n) return {}
+        const opts = context.options[0] || {},
+              ignored = new Set(opts.ignoreKeys || []),
+              scanExtensions = opts.scanExtensions || defaultScanExtensions
+        function check() {
+            const { used, patterns } = collectUsedKeys(root, scanExtensions)
+            for (const key of Object.keys(i18n.messages)) {
+                if (ignored.has(key) || used.has(key) || patterns.some(patt => patt.test(key))) continue
+                context.report({ loc: { line: 1, column: 1 }, messageId: 'unusedKey',
+                    data: { key, locale: i18n.locale }})
+            }
+        }
+        return { 'Document:exit': check, 'Program:exit': check }
+    }
+}

package/src/rules/no-unused-permissions.js

@@ -1,8 +1,7 @@
-import { apiPermissionMap, findPermission } from '../data/apis.js'
-
 import fs from 'node:fs'
 import path from 'node:path'
 
+import { apiPermissionMap, findPermission } from '../data/apis.js'
 import { findExtensionRoot, getFilename, readManifest } from '../utils.js'
 
 const re = { manifestFilename: /manifest\.json$/ }
@@ -21,8 +20,8 @@ function collectUsedAPIs(manifest, root) {
     const used = new Set()
     for (const file of files) {
         try {
-            // eslint-disable-next-line security/detect-non-literal-fs-filename
-            const src = fs.readFileSync(path.resolve(root, file), 'utf8')
+            const src = // eslint-disable-next-line security/detect-non-literal-fs-filename
+                fs.readFileSync(path.resolve(root, file), 'utf8')
             for (const match of src.matchAll(re.chromeAPI)) used.add(match[0])
         } catch {} // eslint-disable-line no-empty
     }
@@ -65,9 +64,9 @@ export default {
                 const keyName = keyNode.value ?? keyNode.name
                 if (keyName != 'permissions' && keyName != 'optional_permissions') return
                 const arrNode = node.value ; if (arrNode?.type != 'Array') return
-                const elements = arrNode.elements || arrNode.items || []
-                for (const el of elements) {
-                    const valueNode = el.value || el
+                const elems = arrNode.elements || arrNode.items || []
+                for (const elem of elems) {
+                    const valueNode = elem.value || elem
                     const perm = valueNode?.value
                     if (typeof perm != 'string') continue
                     if (!permissionNodes.has(perm)) permissionNodes.set(perm, [])

package/src/rules/require-license-file.js

@@ -0,0 +1,27 @@
+import path from 'node:path'
+
+import { findLicenseFile } from '../data/license.js'
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Requires a license file in the extension',
+            recommended: false,
+            manifest: true
+        },
+        schema: [],
+        messages: {
+            missingFile: 'No license file found. Add one of: LICENSE, LICENSE.md, LICENSE.txt, COPYING '
+                       + '(at extension root or in a subdir).'
+        }
+    },
+    create(context) {
+        const { filename } = context,
+              check = node => {
+                  if (!findLicenseFile(path.dirname(filename)))
+                      context.report({ node, messageId: 'missingFile' })
+              }
+        return { Program: check, Document: check }
+    }
+}

package/src/rules/require-short-name-when-useful.js

@@ -0,0 +1,71 @@
+import { getFilename } from '../utils.js'
+
+const defaults = { maxNameLength: 12 },
+      re = { i18nPlaceholder: /^__MSG_.+__$/, manifestFilename: /manifest\.json$/ }
+
+function isI18n(value) { return typeof value == 'string' && re.i18nPlaceholder.test(value) }
+
+export default {
+    meta: {
+        type: 'suggestion',
+        docs: {
+            description: 'Requires a `short_name` when `name` exceeds 12 chars',
+            category: 'Stylistic Issues',
+            recommended: false,
+            manifest: true
+        },
+        schema: [{
+            type: 'object',
+            properties: {
+                maxNameLength: {
+                    type: 'number',
+                    description: 'Length of `name` above which `short_name` is required (default `12`)'
+                },
+                always: {
+                    type: 'boolean',
+                    description: 'Require `short_name` regardless of `name` length (default `false`)'
+                },
+                checkRedundant: {
+                    type: 'boolean',
+                    description: 'Also flag `short_name` that duplicates `name` (default `false`)'
+                }
+            },
+            additionalProperties: false
+        }],
+        defaultOptions: [{
+            maxNameLength: defaults.maxNameLength, always: false, checkRedundant: false
+        }],
+        messages: {
+            missingShortName: '`name` exceeds {{max}} chars. Declare `short_name` to control truncation.',
+            shortNameTooLong: '`short_name` exceeds the recommended {{max}}-character limit (found {{length}}).',
+            redundantShortName: '`short_name` duplicates `name` (Chrome falls back to `name` automatically).'
+        }
+    },
+
+    create(context) {
+        if (!re.manifestFilename.test(getFilename(context))) return {}
+        const opts = context.options[0] || {},
+              maxNameLength = opts.maxNameLength ?? defaults.maxNameLength,
+              always = opts.always ?? false,
+              checkRedundant = opts.checkRedundant ?? false
+        let manifest
+        try { manifest = JSON.parse(context.sourceCode.text) } catch { return {} }
+        if (!manifest || typeof manifest != 'object') return {}
+        const name = manifest.name, shortName = manifest.short_name
+        if (typeof name != 'string') return {}
+        const nameIsI18n = isI18n(name),
+              shortNameIsI18n = isI18n(shortName),
+              loc = { line: 1, column: 1 }
+        if (typeof shortName != 'string') {
+            if (always || (!nameIsI18n && name.length > maxNameLength))
+                context.report({ loc, messageId: 'missingShortName', data: { max: maxNameLength }})
+        } else {
+            if (!shortNameIsI18n && shortName.length > maxNameLength)
+                context.report({ loc, messageId: 'shortNameTooLong',
+                    data: { max: maxNameLength, length: shortName.length }})
+            if (checkRedundant && shortName == name)
+                context.report({ loc, messageId: 'redundantShortName' })
+        }
+        return {}
+    }
+}

package/src/rules/valid-filenames.js

@@ -0,0 +1,152 @@
+/* eslint-disable security/detect-non-literal-fs-filename -- lint-time project inspection only */
+
+import fs from 'node:fs'
+import path from 'node:path'
+
+const re = { invalidChars: /[^\w\-.]/, manifestFilename: /manifest\.json$/, reservedPrefix: /^_/ }
+
+const refKeys = [
+    ['action.default_popup',      manifest => manifest.action?.default_popup],
+    ['background.page',           manifest => manifest.background?.page],
+    ['background.service_worker', manifest => manifest.background?.service_worker],
+    ['devtools_page',             manifest => manifest.devtools_page],
+    ['options_page',              manifest => manifest.options_page],
+    ['options_ui.page',           manifest => manifest.options_ui?.page],
+    ['side_panel.default_path',   manifest => manifest.side_panel?.default_path]
+]
+
+function findExtensionRoot(startPath) {
+    let dir = path.dirname(startPath)
+    while (dir != path.dirname(dir)) {
+        if (fs.existsSync(path.join(dir, 'manifest.json'))) return dir
+        dir = path.dirname(dir)
+    }
+}
+
+function collectRefs(manifest) {
+    const refs = []
+    for (const [label, get] of refKeys) {
+        const val = get(manifest)
+        if (typeof val == 'string') refs.push({ label, file: val })
+    }
+    if (manifest.background?.scripts)
+        refs.push(...manifest.background.scripts.map(file => ({ label: 'background.scripts', file })))
+    if (manifest.icons)
+        refs.push(...Object.values(manifest.icons).map(file => ({ label: 'icons', file })))
+    if (manifest.action?.default_icon && typeof manifest.action.default_icon == 'object')
+        refs.push(...Object.values(manifest.action.default_icon).map(file => ({ label: 'action.default_icon', file })))
+    for (const cs of manifest.content_scripts || []) {
+        if (cs.js) refs.push(...cs.js.map(file => ({ label: 'content_scripts.js', file })))
+        if (cs.css) refs.push(...cs.css.map(file => ({ label: 'content_scripts.css', file })))
+    }
+    for (const war of manifest.web_accessible_resources || [])
+        if (war.resources) refs.push(...war.resources.map(file => ({ label: 'web_accessible_resources', file })))
+    return refs
+}
+
+function resolveRef(abs) {
+    const dir = path.dirname(abs),
+          base = path.basename(abs)
+    let entries
+    try { entries = fs.readdirSync(dir) } catch { return { id: 'fileMissing' }}
+    if (entries.includes(base)) return null
+    const hit = entries.find(entry => entry.toLowerCase() == base.toLowerCase())
+    return hit ? { id: 'caseMismatch', actual: hit } : { id: 'fileMissing' }
+}
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Enforce valid filenames and paths in Chrome extensions',
+            category: 'Possible Errors',
+            recommended: true,
+            manifest: true,
+            css: true,
+            html: true,
+            json: true
+        },
+        schema: [{
+            type: 'object',
+            properties: {
+                noReservedPrefix: {
+                    type: 'boolean',
+                    description: 'Disallow filenames/dirs starting w/ `_` (except `_locales`)'
+                },
+                noSpecialChars: {
+                    type: 'boolean',
+                    description: 'Warn on characters outside `a-z`, `0-9`, `-`, `_`, `.`'
+                },
+                checkFileExists: {
+                    type: 'boolean',
+                    description: 'Verify files referenced in `manifest.json` exist on disk'
+                },
+                enforceCaseSensitivity: {
+                    type: 'boolean',
+                    description: 'Verify manifest references match actual file case'
+                },
+                maxFullPathLength: {
+                    type: 'number',
+                    description: 'Max full path length (default 260)'
+                }
+            },
+            additionalProperties: false
+        }],
+        defaultOptions: [{
+            noReservedPrefix: true, noSpecialChars: true, checkFileExists: true, enforceCaseSensitivity: true,
+            maxFullPathLength: 260
+        }],
+        messages: {
+            reservedPrefix: '`{{name}}` starts with reserved prefix `_` (only `_locales` is allowed).',
+            specialChars: '`{{name}}` contains characters outside `a-z`, `0-9`, `-`, `_`, and `.`.',
+            pathTooLong: 'Full path length ({{length}}) exceeds the {{max}}-character limit (Windows `MAX_PATH`).',
+            fileMissing: '`{{label}}` references `{{file}}`, which does not exist.',
+            caseMismatch: '`{{label}}` references `{{file}}`, but the actual file is `{{actual}}`.'
+        }
+    },
+
+    create(context) {
+        const opts = context.options[0] || {},
+              noReservedPrefix = opts.noReservedPrefix ?? true,
+              noSpecialChars = opts.noSpecialChars ?? true,
+              checkFileExists = opts.checkFileExists ?? true,
+              enforceCaseSensitivity = opts.enforceCaseSensitivity ?? true,
+              maxFullPathLength = opts.maxFullPathLength ?? 260,
+              filename = context.filename
+        if (!filename || filename == '<input>') return {}
+        const basename = path.basename(filename),
+              extRoot = findExtensionRoot(filename) || path.dirname(filename),
+              segments = path.relative(extRoot, filename).split(path.sep)
+        if (noReservedPrefix)
+            for (const seg of segments)
+                if (re.reservedPrefix.test(seg) && seg != '_locales')
+                    context.report({ loc: { line: 1, column: 1 }, messageId: 'reservedPrefix', data: { name: seg }})
+        if (noSpecialChars)
+            for (const seg of segments)
+                if (re.invalidChars.test(seg))
+                    context.report({ loc: { line: 1, column: 1 }, messageId: 'specialChars', data: { name: seg }})
+        if (filename.length >= maxFullPathLength)
+            context.report({
+                loc: { line: 1, column: 1 }, messageId: 'pathTooLong',
+                data: { length: filename.length, max: maxFullPathLength }
+            })
+        if (basename != 'manifest.json' || (!checkFileExists && !enforceCaseSensitivity)) return {}
+        const manifestPath = path.join(extRoot, 'manifest.json')
+        if (!fs.existsSync(manifestPath)) return {}
+        let manifest ; try { manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8')) } catch { return {} }
+        for (const { label, file } of collectRefs(manifest)) {
+            if (file.includes('*')) continue // wildcard refs can't be verified
+            const abs = path.resolve(extRoot, file),
+                  result = resolveRef(abs)
+            if (!result
+                || result.id == 'fileMissing' && !checkFileExists
+                || result.id == 'caseMismatch' && !enforceCaseSensitivity
+            ) continue
+            const data = result.id == 'caseMismatch'
+                ? { label, file, actual: result.actual }
+                : { label, file }
+            context.report({ loc: { line: 1, column: 1 }, messageId: result.id, data })
+        }
+        return {}
+    }
+}

package/src/rules/valid-license-file.js

@@ -0,0 +1,59 @@
+import { createRequire } from 'node:module'
+import path from 'node:path'
+
+import { re } from '../data/license.js'
+
+const require = createRequire(import.meta.url),
+      spdxLicenseIDs = require('spdx-license-ids')
+
+function toArray(value) { return value == null ? [] : Array.isArray(value) ? value : [value] }
+
+function validateContent(context, node, { requireSPDX, allowedLicenses }) {
+    const match = context.sourceCode.text.match(re.spdxTag)
+    if (!match) return void (requireSPDX && context.report({ node, messageId: 'missingSPDX' }))
+    const id = match[1]
+    if (!spdxLicenseIDs.includes(id))
+        return context.report({ node, messageId: 'invalidSPDX', data: { id }})
+    if (allowedLicenses.length && !allowedLicenses.includes(id))
+        context.report({ node, messageId: 'disallowedSPDX', data: { id, allowed: allowedLicenses.join(', ') }})
+}
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Validates SPDX identifiers in license files',
+            recommended: false,
+            license: true
+        },
+        defaultOptions: [{ requireSPDX: false, allowedLicenses: [] }],
+        schema: [{
+            type: 'object',
+            properties: {
+                requireSPDX: { type: 'boolean', description: 'Require an SPDX-License-Identifier line' },
+                allowedLicenses: {
+                    description: 'SPDX license IDs to restrict to',
+                    oneOf: [
+                        { type: 'string', description: 'Single SPDX license ID' },
+                        { type: 'array', description: 'Array of SPDX license IDs', items: { type: 'string' }}
+                    ]
+                }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            missingSPDX:    'License file missing `SPDX-License-Identifier` line (e.g. `SPDX-License-Identifier: MIT`).',
+            invalidSPDX:    'Invalid SPDX identifier `{{id}}` (see https://spdx.org/licenses/).',
+            disallowedSPDX: 'License `{{id}}` is not in allowed list: {{allowed}}.'
+        }
+    },
+    create(context) {
+        const opts = context.options[0],
+              { requireSPDX } = opts,
+              allowedLicenses = toArray(opts.allowedLicenses),
+            { filename } = context,
+              basename = path.basename(filename)
+        if (!re.licenseFilename.test(basename)) return {}
+        return { Program: node => validateContent(context, node, { requireSPDX, allowedLicenses })}
+    }
+}

package/src/rules/valid-mv3-schema.js

@@ -64,12 +64,12 @@ export default {
                                         data: { directive }})
                         if (inDataCollection && (keyName == 'required' || keyName == 'optional')
                             && Array.isArray(node.value?.elements)
-                        ) for (const el of node.value.elements) {
-                            const value = typeof el.value == 'string' ? el.value : el.value?.value
+                        ) for (const elem of node.value.elements) {
+                            const value = typeof elem.value == 'string' ? elem.value : elem.value?.value
                             if (typeof value == 'string') {
                                 const set = keyName == 'required' ? ffDataCollectionRequired : ffDataCollectionOptional
                                 if (!set.has(value))
-                                    pendingReports.push({ node: el, messageId: 'invalidDataCollectionValue',
+                                    pendingReports.push({ node: elem, messageId: 'invalidDataCollectionValue',
                                         data: { value, kind: keyName }})
                             }
                         }

package/src/rules/valid-service-worker.js

@@ -11,7 +11,8 @@ export default {
         },
         schema: [],
         messages: {
-            listenerNotTopLevel: '`chrome.*.addListener()` must be registered at module top level so it attaches on service worker wake-up.',
+            listenerNotTopLevel: '`chrome.*.addListener()` must be registered at module top level'
+                               + ' so it attaches on service worker wake-up.',
             keepaliveTimer: 'Sub-30s `{{fn}}` will not keep the MV3 service worker alive. Use `chrome.alarms` instead.',
             domInSW: '`{{global}}` is not available in a service worker.'
         }
@@ -34,9 +35,10 @@ export default {
                 ) context.report({ node, messageId: 'keepaliveTimer', data: { fn: node.callee.name }})
             },
             Identifier(node) {
-                if (node.parent?.type == 'MemberExpression' && node.parent.property === node) return
-                if (node.parent?.type == 'Property' && node.parent.key === node && !node.parent.computed) return
-                if (!domGlobals.has(node.name)) return
+                if (node.parent?.type == 'MemberExpression' && node.parent.property === node
+                    || node.parent?.type == 'Property' && node.parent.key === node && !node.parent.computed
+                    || !domGlobals.has(node.name)
+                ) return
                 for (let scope = context.sourceCode.getScope(node) ;
                     scope && scope.type != 'global' ;
                     scope = scope.upper

package/src/rules/valid-url-fields.js

@@ -0,0 +1,120 @@
+import { matchPaths, urlPaths } from '../data/manifest.js'
+import { getFilename } from '../utils.js'
+
+const re = {
+    absoluteURL: /^[a-z][a-z0-9+.-]*:\/\/[^\s/]+/i, manifestFilename: /manifest\.json$/,
+    match: /^(\*|https?|file|ftp):\/\/([^/]*)(\/.*)$/, template: /\{[^}]+\}/g
+}
+
+function collectStrings(obj, path = [], out = []) {
+    if (obj == null) return out
+    if (typeof obj == 'string') out.push({ path: path.join('.'), value: obj })
+    else if (Array.isArray(obj))
+        for (const elem of obj) collectStrings(elem, path, out)
+    else if (typeof obj == 'object')
+        for (const key of Object.keys(obj)) // eslint-disable-next-line security/detect-object-injection
+            collectStrings(obj[key], [...path, key], out)
+    return out
+}
+
+function isURL(value) { return re.absoluteURL.test(value.replace(re.template, 'x')) }
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Validates URLs and match patterns in manifest fields',
+            category: 'Possible Errors',
+            recommended: true,
+            manifest: true
+        },
+        schema: [{
+            type: 'object',
+            properties: {
+                checkURLfields: {
+                    type: 'boolean',
+                    description: 'Validate URL fields (`homepage_url`, `update_url`, etc.)'
+                },
+                checkMatchPatterns: {
+                    type: 'boolean',
+                    description: 'Validate match patterns (`host_permissions`, `content_scripts`, etc.)'
+                },
+                allowedSchemes: {
+                    type: 'array', items: { type: 'string' },
+                    description: 'Permitted URL schemes for match patterns (default `["https", "file"]`)'
+                },
+                allowAllURLs: {
+                    type: 'boolean',
+                    description: 'Allow unrestricted patterns (`<all_urls>`, `https://*/*`, `*://*/*`)'
+                }
+            },
+            additionalProperties: false
+        }],
+        defaultOptions: [{
+            checkURLfields: true, checkMatchPatterns: true,
+            allowedSchemes: ['https', 'file'], allowAllURLs: false
+        }],
+        messages: {
+            invalidURL: '`{{field}}` has an invalid URL: "{{value}}".',
+            invalidMatchPattern: '`{{field}}` has an invalid match pattern: "{{value}}".',
+            invalidScheme: '`{{field}}` uses a disallowed scheme: "{{value}}".',
+            invalidFileHost: '`{{field}}` uses a `file://` scheme w/ a non-empty host: "{{value}}".',
+            invalidHost: '`{{field}}` has an invalid wildcard host: "{{value}}". Use `*.` prefix instead.',
+            invalidWARPath: '`{{field}}` must use an effective path of `/*`: "{{value}}".',
+            invalidExternalHost: '`{{field}}` does not allow wildcards in the host: "{{value}}".',
+            allURLs: '`{{field}}` uses the unrestricted `<all_urls>` pattern.'
+        }
+    },
+
+    create(context) {
+        if (!re.manifestFilename.test(getFilename(context))) return {}
+        const opts = context.options[0] || {},
+              checkURLfields = opts.checkURLfields ?? true,
+              checkMatchPatterns = opts.checkMatchPatterns ?? true,
+              allowedSchemes = opts.allowedSchemes ?? ['https', 'file'],
+              allowAllURLs = opts.allowAllURLs ?? false
+        if (!checkURLfields && !checkMatchPatterns) return {}
+        return {
+            'Document:exit'() {
+                let manifest
+                try { manifest = JSON.parse(context.sourceCode.text) } catch { return }
+                for (const { path, value } of collectStrings(manifest)) {
+                    if (checkURLfields && urlPaths.has(path)) {
+                        if (!isURL(value))
+                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidURL',
+                                data: { field: path, value }})
+                    } else if (checkMatchPatterns && matchPaths.has(path)) {
+                        if (value == '<all_urls>') {
+                            if (!allowAllURLs)
+                                context.report({ loc: { line: 1, column: 1 }, messageId: 'allURLs',
+                                    data: { field: path }})
+                            continue
+                        }
+                        const match = value.match(re.match)
+                        if (!match) {
+                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidMatchPattern',
+                                data: { field: path, value }})
+                            continue
+                        }
+                        const [, scheme, host] = match
+                        if (scheme != '*' && !allowedSchemes.includes(scheme))
+                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidScheme',
+                                data: { field: path, value }})
+                        else if (scheme == 'file' && host != '')
+                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidFileHost',
+                                data: { field: path, value }})
+                        else if (path == 'externally_connectable.matches' && host.includes('*'))
+                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidExternalHost',
+                                data: { field: path, value }})
+                        else if (host.includes('*') && host != '*' && !host.startsWith('*.'))
+                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidHost',
+                                data: { field: path, value }})
+                        else if (path == 'web_accessible_resources.matches' && !value.endsWith('/*'))
+                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidWARPath',
+                                data: { field: path, value }})
+                    }
+                }
+            }
+        }
+    }
+}