eslint-plugin-chrome-extensions 2.4.0 → 2.4.1

package/README.md

@@ -40,7 +40,7 @@ import chromeExtensions from 'eslint-plugin-chrome-extensions'
 export default [
     // other configs
     {
-        files: ['**/*extension/**/*.{cjs,js,jsx,mjs,ts,tsx}'],
+        files: ['**/extension/**/*.{cjs,js,jsx,mjs,ts,tsx}'],
         plugins: { 'chrome-extensions': chromeExtensions },
         rules: {
             ...chromeExtensions.configs.recommended.rules,
@@ -55,11 +55,11 @@ export default [
         }
     },
     { files: ['**/*LICENSE*'],             ...chromeExtensions.configs.license },
-    { files: ['**/*extension/**/*.css'],   ...chromeExtensions.configs.css     },
-    { files: ['**/*extension/**/*.html'],  ...chromeExtensions.configs.html    },
-    { files: ['**/*extension/**/*.json'],  ...chromeExtensions.configs.json    },
-    { files: ['**/*extension/**/*.json5'], ...chromeExtensions.configs.json5   },
-    { files: ['**/*extension/**/*.jsonc'], ...chromeExtensions.configs.jsonc   }
+    { files: ['**/extension/**/*.css'],   ...chromeExtensions.configs.css     },
+    { files: ['**/extension/**/*.html'],  ...chromeExtensions.configs.html    },
+    { files: ['**/extension/**/*.json'],  ...chromeExtensions.configs.json    },
+    { files: ['**/extension/**/*.json5'], ...chromeExtensions.configs.json5   },
+    { files: ['**/extension/**/*.jsonc'], ...chromeExtensions.configs.jsonc   }
 ]
 ```
 
@@ -488,7 +488,7 @@ If you intentionally target HTTP endpoints.
 
 <details>
 
-<summary>Requires sender/origin validation + filtered <code>tabs.query()</code> + explicit <code>window.postMessage()</code> target.</summary>
+<summary>Requires sender/origin validation + filtered <code>chrome.tabs.query()</code> + explicit <code>window.postMessage()</code> target.</summary>
 
 <h4 id="no-insecure-messaging-options">Options</h4>
 
@@ -728,9 +728,9 @@ If your `_locales/` is externally populated at build time.
         <img height=18 alt="[HTML]" src="https://img.shields.io/badge/HTML-a8d8ea?style=flat-square" align="middle"></a>
     <a title="Works in 'json/json' config block" href="#usage">
         <img height=18 alt="[JSON]" src="https://img.shields.io/badge/JSON-a8e6cf?style=flat-square" align="middle"></a>
-    <a title="Works in 'json5' config block" href="#usage">
+    <a title="Works in 'json/json5' config block" href="#usage">
         <img height=18 alt="[JSON5]" src="https://img.shields.io/badge/JSON5-c7e6b8?style=flat-square" align="middle"></a>
-    <a title="Works in 'jsonc' config block" href="#usage">
+    <a title="Works in 'json/jsonc' config block" href="#usage">
         <img height=18 alt="[JSONC]" src="https://img.shields.io/badge/JSONC-e6e6a8?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
@@ -760,7 +760,7 @@ If your `_locales/` is externally populated at build time.
   }
 
   // _locales/en/messages.json
-  { "unrelated": { "message": "…" }}
+  { "unrelated": { "message": "sup" }}
 ```
 
 #### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
@@ -776,7 +776,7 @@ If your `_locales/` is externally populated at build time.
   }
 
   // _locales/en/messages.json
-- { "unrelated": { "message": "…" }}
+- { "unrelated": { "message": "sup" }}
 + {
 +   "greeting": { "message": "Hello" },
 +   "extName": { "message": "My Extension" }
@@ -1135,8 +1135,8 @@ If your i18n keys are referenced dynamically.
     <a title="Works in 'css/css' config block" href="#usage"><img height=14 alt="[CSS]" src="https://img.shields.io/badge/CSS-dcd6f7?style=flat-square" align="middle"></a>
     <a title="Works in 'html/html' config block" href="#usage"><img height=14 alt="[HTML]" src="https://img.shields.io/badge/HTML-a8d8ea?style=flat-square" align="middle"></a>
     <a title="Works in 'json/json' config block" href="#usage"><img height=14 alt="[JSON]" src="https://img.shields.io/badge/JSON-a8e6cf?style=flat-square" align="middle"></a>
-    <a title="Works in 'json5' config block" href="#usage"><img height=14 alt="[JSON5]" src="https://img.shields.io/badge/JSON5-c7e6b8?style=flat-square" align="middle"></a>
-    <a title="Works in 'jsonc' config block" href="#usage"><img height=14 alt="[JSONC]" src="https://img.shields.io/badge/JSONC-e6e6a8?style=flat-square" align="middle"></a>
+    <a title="Works in 'json/json5' config block" href="#usage"><img height=14 alt="[JSON5]" src="https://img.shields.io/badge/JSON5-c7e6b8?style=flat-square" align="middle"></a>
+    <a title="Works in 'json/jsonc' config block" href="#usage"><img height=14 alt="[JSONC]" src="https://img.shields.io/badge/JSONC-e6e6a8?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#no-missing-i18n-keys-options"><img height=14 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
 - <img height=12 src="https://www.google.com/s2/favicons?domain=developer.chrome.com&sz=64">&ensp;<a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/api/i18n">Chrome for Developers — `i18n`</a>
 
@@ -1228,20 +1228,18 @@ If you access the granted API through an alias or computed property rather than
 
 <summary>Requires a license file in the extension.</summary>
 
-#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect code
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/gray.svg" align="bottom"> Incorrect structure
 
 ```diff
-  // files
   /extension/manifest.json
 !
 ```
 
-#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct code
+#### <img width=13 height=13 src="https://cdn.staticdelivr.com/gl/adamlui/eslint-plugin-greasemonkey/99f14247b2/assets/images/icons/square/with-symbol/green.svg" align="bottom"> Correct structure
 
 ```diff
-  // files
   /extension/manifest.json
-+ /extension/LICENSE
++ /extension/LICENSE.md
 ```
 
 #### When not to use it
@@ -1403,9 +1401,9 @@ If you primarily target a browser that doesn't support `short_name`.
         <img height=18 alt="[HTML]" src="https://img.shields.io/badge/HTML-a8d8ea?style=flat-square" align="middle"></a>
     <a title="Works in 'json/json' config block" href="#usage">
         <img height=18 alt="[JSON]" src="https://img.shields.io/badge/JSON-a8e6cf?style=flat-square" align="middle"></a>
-    <a title="Works in 'json5' config block" href="#usage">
+    <a title="Works in 'json/json5' config block" href="#usage">
         <img height=18 alt="[JSON5]" src="https://img.shields.io/badge/JSON5-c7e6b8?style=flat-square" align="middle"></a>
-    <a title="Works in 'jsonc' config block" href="#usage">
+    <a title="Works in 'json/jsonc' config block" href="#usage">
         <img height=18 alt="[JSONC]" src="https://img.shields.io/badge/JSONC-e6e6a8?style=flat-square" align="middle"></a>
     <a title="Accepts array w/ options" href="#usage">
         <img height=18 alt="[Configurable]" src="https://img.shields.io/badge/Configurable-black?style=flat-square" align="middle"></a>
@@ -1776,7 +1774,7 @@ If your background context isn't a service worker.
 <h4 id="valid-url-fields-options">Options</h4>
 
 - `checkURLfields` (default `true`) – validate URL fields (<a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/chrome-settings-override">`chrome_settings_overrides`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/homepage-url">`homepage_url`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/oauth2">`oauth2.scopes`</a>, <a target="_blank" href="https://developer.chrome.com/docs/apps/autoupdate#update_url">`update_url`</a>)
-- `checkMatchPatterns` (default `true`) – validate match patterns (in <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/content-scripts">`content_scripts`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/externally-connectable">`externally_connectable`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/declare-permissions#host-permissions">`host_permissions`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/declare-permissions">`optional_host_permissions`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/web-accessible-resources">`web_accessible_resources`</a>)
+- `checkMatchPatterns` (default `true`) – validate <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/match-patterns">match patterns</a> (in <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/content-scripts">`content_scripts`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/externally-connectable">`externally_connectable`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/declare-permissions#host-permissions">`host_permissions`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/declare-permissions">`optional_host_permissions`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/reference/manifest/web-accessible-resources">`web_accessible_resources`</a>)
 - `allowedSchemes` (default `['https', 'file']`) – permitted URL schemes for <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/match-patterns">match patterns</a>
 - `allowAllURLs` (default `false`) – allow unrestricted patterns (<a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/match-patterns">`<all_urls>`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/match-patterns">`https://*/*`</a>, <a target="_blank" href="https://developer.chrome.com/docs/extensions/develop/concepts/match-patterns">`*://*/*`</a>)
 
@@ -1810,7 +1808,7 @@ If your background context isn't a service worker.
 
 #### When not to use it
 
-If your URLs or match patterns are generated at build time.
+If your URLs or patterns are generated at build time.
 
 #### Introduced in
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-chrome-extensions",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "description": "ESLint rules for Chrome extensions",
   "keywords": [
     "eslint",
@@ -66,12 +66,14 @@
   },
   "devDependencies": {
     "@e18e/eslint-plugin": "^0.8.1",
+    "@eslint/css": "^2.0.0",
     "@eslint/js": "^10.0.1",
     "@eslint/json": "^2.1.1",
     "@eslint/markdown": "^7.5.1",
+    "@html-eslint/eslint-plugin": "^0.66.1",
     "@stylistic/eslint-plugin": "^5.10.0",
     "eslint": "^10.12.0",
-    "eslint-plugin-constructors": "^1.4.2",
+    "eslint-plugin-constructors": "^1.4.3",
     "eslint-plugin-eslint-plugin": "^7.6.2",
     "eslint-plugin-import-x": "^4.17.1",
     "eslint-plugin-n": "^18.4.1",

package/src/data/manifest.js

@@ -36,9 +36,26 @@ export const manifestKeyOrder = [
     'theme_experiment', 'tts_engine', 'update_url', 'version_name', 'web_accessible_resources'
 ]
 
+export const matchPaths = new Set([
+    'content_scripts.matches', 'externally_connectable.matches',
+    'host_permissions', 'optional_host_permissions', 'web_accessible_resources.matches'
+])
+
 export const mv2OnlyKeys = new Set(['browser_action', 'page_action'])
 
 export const remoteCodePatterns = [
     'eval', 'new-function', 'string-timer', 'dynamic-import', 'remote-script-src', 'execute-script-url']
 
 export const serviceWorkerKeepaliveMinMS = 30000
+
+export const urlPaths = new Set([
+    'homepage_url', 'update_url', 'oauth2.scopes',
+    'chrome_settings_overrides.homepage',
+    'chrome_settings_overrides.search_provider.alternate_urls',
+    'chrome_settings_overrides.search_provider.favicon_url',
+    'chrome_settings_overrides.search_provider.image_url',
+    'chrome_settings_overrides.search_provider.instant_url',
+    'chrome_settings_overrides.search_provider.search_url',
+    'chrome_settings_overrides.search_provider.suggest_url',
+    'chrome_settings_overrides.startup_pages'
+])

package/src/rules/no-invalid-permissions.js

@@ -56,9 +56,9 @@ export default {
                     const keyName = keyNode.value ?? keyNode.name
                     if (keyName != 'permissions' && keyName != 'optional_permissions') return
                     const arrNode = node.value ; if (arrNode?.type != 'Array') return
-                    const elements = arrNode.elements || arrNode.items || []
-                    for (const el of elements) {
-                        const valueNode = el.value || el
+                    const elems = arrNode.elements || arrNode.items || []
+                    for (const elem of elems) {
+                        const valueNode = elem.value || elem
                         checkPermission(valueNode, valueNode?.value)
                     }
                 }

package/src/rules/no-unused-permissions.js

@@ -64,9 +64,9 @@ export default {
                 const keyName = keyNode.value ?? keyNode.name
                 if (keyName != 'permissions' && keyName != 'optional_permissions') return
                 const arrNode = node.value ; if (arrNode?.type != 'Array') return
-                const elements = arrNode.elements || arrNode.items || []
-                for (const el of elements) {
-                    const valueNode = el.value || el
+                const elems = arrNode.elements || arrNode.items || []
+                for (const elem of elems) {
+                    const valueNode = elem.value || elem
                     const perm = valueNode?.value
                     if (typeof perm != 'string') continue
                     if (!permissionNodes.has(perm)) permissionNodes.set(perm, [])

package/src/rules/valid-filenames.js

@@ -62,6 +62,7 @@ export default {
             category: 'Possible Errors',
             recommended: true,
             manifest: true,
+            css: true,
             html: true,
             json: true
         },

package/src/rules/valid-mv3-schema.js

@@ -64,12 +64,12 @@ export default {
                                         data: { directive }})
                         if (inDataCollection && (keyName == 'required' || keyName == 'optional')
                             && Array.isArray(node.value?.elements)
-                        ) for (const el of node.value.elements) {
-                            const value = typeof el.value == 'string' ? el.value : el.value?.value
+                        ) for (const elem of node.value.elements) {
+                            const value = typeof elem.value == 'string' ? elem.value : elem.value?.value
                             if (typeof value == 'string') {
                                 const set = keyName == 'required' ? ffDataCollectionRequired : ffDataCollectionOptional
                                 if (!set.has(value))
-                                    pendingReports.push({ node: el, messageId: 'invalidDataCollectionValue',
+                                    pendingReports.push({ node: elem, messageId: 'invalidDataCollectionValue',
                                         data: { value, kind: keyName }})
                             }
                         }

package/src/rules/valid-service-worker.js

@@ -35,9 +35,10 @@ export default {
                 ) context.report({ node, messageId: 'keepaliveTimer', data: { fn: node.callee.name }})
             },
             Identifier(node) {
-                if (node.parent?.type == 'MemberExpression' && node.parent.property === node) return
-                if (node.parent?.type == 'Property' && node.parent.key === node && !node.parent.computed) return
-                if (!domGlobals.has(node.name)) return
+                if (node.parent?.type == 'MemberExpression' && node.parent.property === node
+                    || node.parent?.type == 'Property' && node.parent.key === node && !node.parent.computed
+                    || !domGlobals.has(node.name)
+                ) return
                 for (let scope = context.sourceCode.getScope(node) ;
                     scope && scope.type != 'global' ;
                     scope = scope.upper

package/src/rules/valid-url-fields.js

@@ -1,3 +1,4 @@
+import { matchPaths, urlPaths } from '../data/manifest.js'
 import { getFilename } from '../utils.js'
 
 const re = {
@@ -5,28 +6,11 @@ const re = {
     match: /^(\*|https?|file|ftp):\/\/([^/]*)(\/.*)$/, template: /\{[^}]+\}/g
 }
 
-const matchPaths = new Set([
-    'content_scripts.matches', 'externally_connectable.matches',
-    'host_permissions', 'optional_host_permissions', 'web_accessible_resources.matches'
-])
-
-const urlPaths = new Set([
-    'homepage_url', 'update_url', 'oauth2.scopes',
-    'chrome_settings_overrides.homepage',
-    'chrome_settings_overrides.search_provider.alternate_urls',
-    'chrome_settings_overrides.search_provider.favicon_url',
-    'chrome_settings_overrides.search_provider.image_url',
-    'chrome_settings_overrides.search_provider.instant_url',
-    'chrome_settings_overrides.search_provider.search_url',
-    'chrome_settings_overrides.search_provider.suggest_url',
-    'chrome_settings_overrides.startup_pages'
-])
-
 function collectStrings(obj, path = [], out = []) {
     if (obj == null) return out
     if (typeof obj == 'string') out.push({ path: path.join('.'), value: obj })
     else if (Array.isArray(obj))
-        for (const el of obj) collectStrings(el, path, out)
+        for (const elem of obj) collectStrings(elem, path, out)
     else if (typeof obj == 'object')
         for (const key of Object.keys(obj)) // eslint-disable-next-line security/detect-object-injection
             collectStrings(obj[key], [...path, key], out)