eslint-plugin-chrome-extensions 2.5.0 → 2.7.0

package/src/rules/no-host-page-selectors.js

@@ -0,0 +1,106 @@
+import array from '../utils/array.js'
+import regex from '../data/regex.js'
+
+const re = { keyframeSelector: /^(?:from|to|[\d.]+%)$/i }
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow host-page selectors (`html`, `body`, `:root`, `*`, bare element types) in content-script CSS',
+            category: 'Possible Errors',
+            css: true
+        },
+        defaultOptions: [{
+            allowedSelectors: [],
+            disallowUniversal: true,
+            disallowStructural: true,
+            disallowBareElements: true
+        }],
+        schema: [{
+            type: 'object',
+            properties: {
+                allowedSelectors: {
+                    oneOf: [
+                        { type: 'string', description: 'A single selector' },
+                        { type: 'array', items: { type: 'string' }, description: 'List of selectors' }
+                    ],
+                    description: 'Selectors to explicitly allow (e.g. `body.dark`)'
+                },
+                disallowUniversal: {
+                    type: 'boolean',
+                    description: 'Flag `*`'
+                },
+                disallowStructural: {
+                    type: 'boolean',
+                    description: 'Flag `html`, `body`, `:root`'
+                },
+                disallowBareElements: {
+                    type: 'boolean',
+                    description: 'Flag bare element types (`div`, `a`, etc.) lacking a class/id/attribute qualifier'
+                }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            universalSelector: 'Universal selector `*` targets every element on the host page. Scope with a namespaced class or use `:host`.',
+            structuralSelector: 'Selector `{{selector}}` targets a host-page structural element. Use `:host` or a namespaced root instead.',
+            elementSelector: 'Selector `{{selector}}` targets a bare element type on the host page. Scope with a namespaced class or wrap in `:host()`.'
+        }
+    },
+
+    create(context) {
+        const opts = context.options[0] || {},
+              allowedSelectors = new Set(array.to(opts.allowedSelectors)),
+              checkUniversal = opts.disallowUniversal !== false,
+              checkStructural = opts.disallowStructural !== false,
+              checkBareElements = opts.disallowBareElements !== false
+        function checkSelector(selector) {
+            if (!selector) return
+            const text = getSelectorText(selector).trim()
+            if (re.keyframeSelector.test(text) || allowedSelectors.has(text)) return
+            const simples = []
+            for (const child of selector.children ?? []) {
+                if (plainType(child) == 'Combinator') break
+                simples.push(child)
+            }
+            let hasQualifier = false,
+                isUniversal = false,
+                isRoot = false,
+                elementTypes = []
+            for (const simple of simples) {
+                const type = plainType(simple)
+                if (type == 'ClassSelector' || type == 'IdSelector' || type == 'AttributeSelector') hasQualifier = true
+                else if (type == 'PseudoClassSelector' && (simple.name ?? '').toLowerCase() == 'root') isRoot = true
+                else if (type == 'TypeSelector') {
+                    const name = (simple.name ?? '').toLowerCase()
+                    if (name == '*') isUniversal = true
+                    else if (name) elementTypes.push(name)
+                }
+            }
+            if (isUniversal && checkUniversal)
+                return context.report({ node: selector, messageId: 'universalSelector' })
+            if (isRoot && checkStructural)
+                return context.report({ node: selector, messageId: 'structuralSelector', data: { selector: text }})
+            for (const type of elementTypes) {
+                if (type == 'html' || type == 'body') {
+                    if (checkStructural)
+                        return context.report({ node: selector, messageId: 'structuralSelector', data: { selector: text }})
+                } else if (checkBareElements && !hasQualifier) {
+                    return context.report({ node: selector, messageId: 'elementSelector', data: { selector: text }})
+                }
+            }
+        }
+        function getSelectorText(selector) {
+            const range = selector.range
+            if (range && range.length == 2) return context.sourceCode.text.slice(range[0], range[1])
+            return context.sourceCode.getText(selector)
+        }
+        function handleRule(node) {
+            for (const selector of node.prelude?.children ?? [])
+                checkSelector(selector)
+        }
+        function plainType(node) { return node?.type?.replace(regex.prefix.css, '') ?? '' }
+        return { Rule: handleRule, CSSRule: handleRule }
+    }
+}

package/src/rules/no-invalid-locales.js

@@ -0,0 +1,89 @@
+/* eslint-disable security/detect-non-literal-fs-filename -- lint-time project inspection only */
+
+import extension from '../utils/extension.js'
+import fs from 'node:fs'
+import i18nUtils from '../utils/i18n.js'
+import path from 'node:path'
+
+import regex from '../data/regex.js'
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow invalid Chrome locale codes in `_locales/` folders and `default_locale`',
+            category: 'Possible Errors',
+            recommended: true,
+            manifest: true
+        },
+        schema: [{
+            type: 'object',
+            properties: {
+                allowedLocales: {
+                    oneOf: [
+                        { type: 'string', description: 'Single locale code to allow' },
+                        {
+                            type: 'array',
+                            items: { type: 'string', description: 'Locale code to allow' },
+                            description: 'List of locale codes to allow'
+                        }
+                    ],
+                    description: 'Additional locale codes to allow (e.g. for Chromium forks)'
+                }
+            },
+            additionalProperties: false
+        }],
+        defaultOptions: [{ allowedLocales: [] }],
+        messages: {
+            invalidLocale: '`{{value}}` is not a Chrome-supported locale code.'
+        }
+    },
+
+    create(context) {
+        const filename = extension.file.getName(context),
+              isManifest = regex.filename.manifest.test(filename),
+              isScript = regex.filename.script.test(filename)
+        if (!isManifest && !isScript) return {}
+        const opts = context.options[0] || {},
+              allowed = new Set(Array.isArray(opts.allowedLocales) ? opts.allowedLocales
+                      : opts.allowedLocales ? [opts.allowedLocales] : []),
+              invalidFolders = [],
+              root = extension.findRoot(context)
+        if (root) {
+            const localesDir = path.join(root, '_locales')
+            try {
+                for (const entry of fs.readdirSync(localesDir, { withFileTypes: true }))
+                    if (entry.isDirectory() && isInvalid(entry.name)) invalidFolders.push(entry.name)
+                invalidFolders.sort()
+            } catch {} // eslint-disable-line no-empty
+        }
+        const loc = { line: 1, column: 1 }
+        if (!isManifest) {
+            const manifest = extension.manifest.read(context)
+            if (manifest) {
+                const defaultLocale = manifest.default_locale
+                if (isInvalid(defaultLocale))
+                    context.report({ loc, messageId: 'invalidLocale', data: { value: defaultLocale }})
+            }
+            for (const name of invalidFolders)
+                context.report({ loc, messageId: 'invalidLocale', data: { value: name }})
+            return {}
+        }
+        function isInvalid(locale) {
+            return typeof locale == 'string' && !i18nUtils.localeIsValid(locale, allowed) }
+        return {
+            '*'(node) {
+                const keyNode = node.name || node.key ; if (!keyNode) return
+                const keyName = keyNode.value ?? keyNode.name ; if (keyName != 'default_locale') return
+                const valueNode = node.value ; if (valueNode?.type != 'String') return
+                if (isInvalid(valueNode.value))
+                    context.report({ node: valueNode, messageId: 'invalidLocale',
+                                     data: { value: valueNode.value }})
+            },
+            'Document:exit'() {
+                for (const name of invalidFolders)
+                    context.report({ loc, messageId: 'invalidLocale', data: { value: name }})
+            }
+        }
+    }
+}

package/src/rules/no-invalid-permissions.js

@@ -1,6 +1,4 @@
 import extension from '../utils/extension.js'
-
-import permissions from '../data/permissions.js'
 import regex from '../data/regex.js'
 
 export default {
@@ -9,7 +7,7 @@ export default {
         docs: {
             description: 'Disallow invalid or unsupported manifest permission names',
             category: 'Possible Errors',
-            recommended: false,
+            recommended: true,
             manifest: true
         },
         defaultOptions: [{ target: 'mv3', allowedPermissions: [] }],
@@ -46,7 +44,7 @@ export default {
                       : opts.allowedPermissions ? [opts.allowedPermissions] : [])
         function checkPermission(node, permission) {
             if (typeof permission != 'string') return
-            if (allowed.has(permission) || permissions.isValid(permission, target)) return
+            if (allowed.has(permission) || extension.manifest.permission.isValid(permission, target)) return
             context.report({ node, messageId: 'invalidPermission', data: { permission, target }})
         }
         if (regex.filename.manifest.test(extension.file.getName(context))) // lint it directly
@@ -67,7 +65,7 @@ export default {
         return {
             'Program:exit'() {
                 for (const permission of allPermissions) {
-                    if (allowed.has(permission) || permissions.isValid(permission, target)) continue
+                    if (allowed.has(permission) || extension.manifest.permission.isValid(permission, target)) continue
                     context.report({ loc: { line: 1, column: 0 },
                         messageId: 'invalidPermission', data: { permission, target }})
                 }

package/src/rules/no-missing-default-locale.js

@@ -7,14 +7,7 @@ import path from 'node:path'
 
 import regex from '../data/regex.js'
 
-function readMessages(filePath) {
-    try {
-        const data = JSON.parse(fs.readFileSync(filePath, 'utf8'))
-        return (data && typeof data == 'object' && !Array.isArray(data)) ? data : null
-    } catch { return null }
-}
-
-function readLocaleDirs(localesDir) {
+function readLocaleDirs(localesDir)  {
     try {
         return fs.readdirSync(localesDir, { withFileTypes: true })
             .filter(entry => entry.isDirectory())
@@ -22,13 +15,20 @@ function readLocaleDirs(localesDir) {
     } catch { return [] }
 }
 
+function readMessages(filePath) {
+    try {
+        const data = JSON.parse(fs.readFileSync(filePath, 'utf8'))
+        return (data && typeof data == 'object' && !Array.isArray(data)) ? data : null
+    } catch { return null }
+}
+
 export default {
     meta: {
         type: 'problem',
         docs: {
             description: 'Ensure `default_locale` is valid and all `_locales` keys exist in it',
             category: 'Possible Errors',
-            recommended: false,
+            recommended: true,
             manifest: true
         },
         schema: [{
@@ -36,23 +36,29 @@ export default {
             properties: {
                 ignoreKeys: {
                     type: 'array', items: { type: 'string' },
-                    description: 'Keys to skip when checking the default locale'
+                    description: 'Keys to skip when checking locales'
+                },
+                checkAllLocales: {
+                    type: 'boolean',
+                    description: 'Also flag keys missing from any locale, not just the default'
                 }
             },
             additionalProperties: false
         }],
-        defaultOptions: [{ ignoreKeys: [] }],
+        defaultOptions: [{ ignoreKeys: [], checkAllLocales: false }],
         messages: {
             missingDefaultLocale: '`_locales/` exists but `default_locale` is not declared.',
             unexpectedDefaultLocale: '`default_locale` is declared but no `_locales/` directory exists.',
             missingDefaultLocaleFile: '`_locales/{{locale}}/messages.json` does not exist.',
             missingKeyInDefault: '`{{key}}` exists in `_locales/{{locale}}/messages.json`, '
-                               + 'but not in default locale `{{defaultLocale}}`.'
+                               + 'but not in default locale `{{defaultLocale}}`.',
+            missingKeyInLocale: '`{{key}}` is missing from `_locales/{{locale}}/messages.json`.'
         }
     },
 
     create(context) {
-        const filename = context.filename ; if (!filename || !regex.filename.manifest.test(filename)) return {}
+        const filename = extension.file.getName(context) ; if (!filename) return {}
+        if (!regex.filename.manifest.test(filename) && !regex.filename.script.test(filename)) return {}
         const manifest = extension.manifest.read(context) ; if (!manifest) return {}
         const root = extension.findRoot(context) ; if (!root) return {}
         const localesDir = path.join(root, '_locales'),
@@ -60,6 +66,7 @@ export default {
               defaultLocale = manifest.default_locale,
               opts = context.options[0] || {},
               ignored = new Set(opts.ignoreKeys || []),
+              checkAllLocales = opts.checkAllLocales ?? false,
               loc = { line: 1, column: 1 }
         if (hasLocales && typeof defaultLocale != 'string') {
             context.report({ loc, messageId: 'missingDefaultLocale' })
@@ -75,7 +82,25 @@ export default {
             context.report({ loc, messageId: 'missingDefaultLocaleFile', data: { locale: defaultLocale }})
             return {}
         }
-        for (const locale of readLocaleDirs(localesDir)) {
+        const localeDirs = readLocaleDirs(localesDir)
+        if (checkAllLocales) {
+            const allMsgs = new Map([[defaultLocale, defaultMsgs]])
+            for (const locale of localeDirs) {
+                if (locale == defaultLocale) continue
+                const msgs = readMessages(path.join(localesDir, locale, 'messages.json'))
+                if (msgs) allMsgs.set(locale, msgs)
+            }
+            const union = new Set()
+            for (const msgs of allMsgs.values())
+                for (const key of Object.keys(msgs))
+                    if (!i18n.isPredefined(key) && !ignored.has(key)) union.add(key)
+            for (const [locale, msgs] of allMsgs)
+                for (const key of union)
+                    if (!(key in msgs))
+                        context.report({ loc, messageId: 'missingKeyInLocale', data: { key, locale }})
+            return {}
+        }
+        for (const locale of localeDirs) {
             if (locale == defaultLocale) continue
             const msgs = readMessages(path.join(localesDir, locale, 'messages.json')) ; if (!msgs) continue
             for (const key of Object.keys(msgs)) {

package/src/rules/no-missing-i18n-keys.js

@@ -13,9 +13,7 @@ export default {
             category: 'Possible Errors',
             recommended: true,
             manifest: true,
-            css: true,
-            html: true,
-            json: true
+            css: true
         },
         schema: [{
             type: 'object',
@@ -57,7 +55,7 @@ export default {
                         context.report({ loc, messageId: 'missingKey', data: { key, locale: i18n.locale }})
                 }
             }
-        if (!regex.filename.cssHTML.test(filename) && !regex.filename.manifest.test(filename))
+        if (!regex.filename.css.test(filename) && !regex.filename.manifest.test(filename))
             return {}
         const seenKeys = new Set()
         function scanPlaceholders() {
@@ -69,6 +67,6 @@ export default {
                     context.report({ loc, messageId: 'missingKey', data: { key, locale: i18n.locale }})
             }
         }
-        return { 'Document': scanPlaceholders, 'Program': scanPlaceholders }
+        return { 'Document': scanPlaceholders, 'Program': scanPlaceholders, 'StyleSheet': scanPlaceholders }
     }
 }

package/src/rules/no-remote-urls.js

@@ -0,0 +1,102 @@
+import array from '../utils/array.js'
+
+const re = { urlScheme: /^(?:([a-z][a-z0-9+.-]*):|\/\/)/i }
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow remote resources (`@import`, `url()`, `@namespace`) in extension CSS',
+            category: 'Possible Errors',
+            css: true
+        },
+        defaultOptions: [{
+            allowedSchemes: ['blob', 'chrome-extension', 'data'],
+            patterns: ['at-import', 'url']
+        }],
+        schema: [{
+            type: 'object',
+            properties: {
+                allowedSchemes: {
+                    oneOf: [
+                        { type: 'string', description: 'A single URL scheme' },
+                        { type: 'array', items: { type: 'string' }, description: 'List of URL schemes' }
+                    ],
+                    description: 'URL schemes to allow (e.g. `chrome-extension`, `data`, `blob`)'
+                },
+                patterns: {
+                    oneOf: [
+                        { enum: ['at-import', 'url', 'namespace'], description: 'A single detection path' },
+                        { type: 'array', items: { enum: ['at-import', 'url', 'namespace'] }, description: 'List of detection paths' }
+                    ],
+                    description: 'Detection paths to enable'
+                }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            remoteImport: 'Remote `@import` is disallowed. Bundle the stylesheet or use `chrome.runtime.getURL()`.',
+            remoteURL: 'Remote `url()` is disallowed. Bundle the asset or use `chrome.runtime.getURL()`.',
+            remoteNamespace: 'Remote `@namespace` is disallowed. Reference a bundled stylesheet.'
+        }
+    },
+
+    create(context) {
+        const opts = context.options[0] || {},
+              allowedSchemes = new Set(array.to(opts.allowedSchemes ?? ['blob', 'chrome-extension', 'data'])),
+              patterns = new Set(array.to(opts.patterns ?? ['at-import', 'url'])),
+              handledURLs = new WeakSet()
+        function getPreludeURLnode(prelude) {
+            if (!prelude) return null
+            if (['Url', 'CSSUrl', 'String', 'CSSString'].includes(prelude.type))
+                return prelude
+            for (const child of prelude.children ?? [])
+                if (['Url', 'CSSUrl', 'String', 'CSSString'].includes(child.type))
+                    return child
+            return null
+        }
+        function getURLstr(node) {
+            if (!node) return null
+            if (typeof node == 'string') return node
+            if (typeof node.url == 'string') return node.url
+            if (typeof node.value == 'string') return node.value
+            if (node.value && typeof node.value == 'object' && typeof node.value.value == 'string')
+                return node.value.value
+            return null
+        }
+        function handleAtrule(node) {
+            if (!node.prelude) return
+            if (node.name == 'import' && patterns.has('at-import')) {
+                const urlNode = getPreludeURLnode(node.prelude)
+                if (urlNode && isRemote(getURLstr(urlNode))) {
+                    handledURLs.add(urlNode)
+                    context.report({ node, messageId: 'remoteImport' })
+                }
+            }
+            if (node.name == 'namespace' && patterns.has('namespace')) {
+                const urlNode = getPreludeURLnode(node.prelude)
+                if (urlNode && isRemote(getURLstr(urlNode))) {
+                    handledURLs.add(urlNode)
+                    context.report({ node, messageId: 'remoteNamespace' })
+                }
+            }
+        }
+        function handleURL(node) {
+            if (!patterns.has('url')) return
+            if (handledURLs.has(node)) return
+            if (node.parent?.type == 'AtrulePrelude' || node.parent?.type == 'CSSAtRulePrelude') return
+            if (isRemote(getURLstr(node)))
+                context.report({ node, messageId: 'remoteURL' })
+        }
+        function isRemote(str) {
+            if (typeof str != 'string') return false
+            const match = str.match(re.urlScheme)
+            if (!match) return false
+            if (match[0] == '//') return true
+            const scheme = (match[1] || '').toLowerCase()
+            if (['http', 'https', 'ftp'].includes(scheme)) return true
+            return !allowedSchemes.has(scheme)
+        }
+        return { Atrule: handleAtrule, CSSAtRule: handleAtrule, Url: handleURL, CSSUrl: handleURL }
+    }
+}

package/src/rules/no-scrollbar-styling.js

@@ -0,0 +1,73 @@
+import array from '../utils/array.js'
+import regex from '../data/regex.js'
+
+const re = {
+    scrollbarPseudo: /^(?:-webkit-)?scrollbar(?:-[\w-]+)?$/i } // eslint-disable-line security/detect-unsafe-regex
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow scrollbar pseudo-elements (e.g. `::-webkit-scrollbar`) '
+                       + 'on unscoped selectors in content-script CSS',
+            category: 'Possible Errors',
+            css: true
+        },
+        defaultOptions: [{ allowedSelectors: [] }],
+        schema: [{
+            type: 'object',
+            properties: {
+                allowedSelectors: {
+                    oneOf: [
+                        { type: 'string', description: 'A single selector' },
+                        { type: 'array', items: { type: 'string' }, description: 'List of selectors' }
+                    ],
+                    description: 'Selectors to explicitly allow (e.g. `body::-webkit-scrollbar`)'
+                }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            noScrollbarStyling: 'Scrollbar pseudo-element on `{{selector}}` styles the host page\'s scrollbar. '
+                              + 'Scope it to a namespaced class (e.g. `.myext-panel::...`) or use `allowedSelectors`.'
+        }
+    },
+
+    create(context) {
+        const opts = context.options[0] || {},
+              allowedSelectors = new Set(array.to(opts.allowedSelectors))
+        function checkSelector(selector) {
+            if (!selector) return
+            const text = getSelectorText(selector).trim() ; if (allowedSelectors.has(text)) return
+            let hasScrollbarPseudo = false,
+                hasQualifier = false,
+                pastFirstCompound = false
+            for (const simple of selector.children ?? []) {
+                const type = plainType(simple)
+                if (type == 'Combinator') { pastFirstCompound = true; continue }
+                if (type == 'PseudoElementSelector' && re.scrollbarPseudo.test(simple.name ?? '')) {
+                    hasScrollbarPseudo = true
+                    continue
+                }
+                if (pastFirstCompound) continue
+                if (type == 'ClassSelector' || type == 'IdSelector' || type == 'AttributeSelector')
+                    hasQualifier = true
+                else if (type == 'PseudoClassSelector' && (simple.name ?? '').toLowerCase().startsWith('host'))
+                    hasQualifier = true
+            }
+            if (hasScrollbarPseudo && !hasQualifier)
+                context.report({ node: selector, messageId: 'noScrollbarStyling', data: { selector: text }})
+        }
+        function getSelectorText(selector) {
+            const range = selector.range
+            if (range && range.length == 2) return context.sourceCode.text.slice(range[0], range[1])
+            return context.sourceCode.getText(selector)
+        }
+        function handleRule(node) {
+            for (const selector of node.prelude?.children ?? [])
+                checkSelector(selector)
+        }
+        function plainType(node) { return node?.type?.replace(regex.prefix.css, '') ?? '' }
+        return { Rule: handleRule, CSSRule: handleRule }
+    }
+}

package/src/rules/no-sensitive-permissions.js

@@ -7,7 +7,7 @@ export default {
     meta: {
         type: 'problem',
         docs: {
-            description: 'Flag sensitive permissions that warrant security review',
+            description: 'Flag sensitive permissions',
             category: 'Possible Errors',
             recommended: true,
             security: true,

package/src/rules/no-unrestricted-host-permissions.js

@@ -10,7 +10,8 @@ export default {
         docs: {
             description: 'Disallow broad host permissions that grant access to every site',
             category: 'Possible Errors',
-            recommended: false,
+            recommended: true,
+            security: true,
             manifest: true
         },
         defaultOptions: [{ allowedPatterns: [] }],
@@ -32,23 +33,37 @@ export default {
     },
 
     create(context) {
-        if (!regex.filename.manifest.test(extension.file.getName(context))) return {}
         const allowedPatterns = new Set(context.options[0]?.allowedPatterns || [])
+        function isBroad(pattern) {
+            return typeof pattern == 'string'
+                && !allowedPatterns.has(pattern)
+                && re.broadHost.test(pattern)
+        }
+        if (regex.filename.manifest.test(extension.file.getName(context))) // lint it directly
+            return {
+                '*'(node) {
+                    const keyNode = node.name || node.key ; if (!keyNode) return
+                    const keyName = keyNode.value ?? keyNode.name ; if (!hostKeys.has(keyName)) return
+                    const arrNode = node.value ; if (arrNode?.type != 'Array') return
+                    const nodeElems = arrNode.elements || arrNode.items || []
+                    for (const elem of nodeElems) {
+                        const valueNode = elem.value || elem,
+                              pattern = valueNode?.value
+                        if (!isBroad(pattern)) continue
+                        context.report({ node: valueNode, messageId: 'unrestrictedHost', data: { pattern }})
+                    }
+                }
+            }
+        const manifest = extension.manifest.read(context) ; if (!manifest) return {}
         return {
-            '*'(node) {
-                const keyNode = node.name || node.key ; if (!keyNode) return
-                const keyName = keyNode.value ?? keyNode.name
-                if (!hostKeys.has(keyName)) return
-                const arrNode = node.value ; if (arrNode?.type != 'Array') return
-                const nodeElems = arrNode.elements || arrNode.items || []
-                for (const elem of nodeElems) {
-                    const valueNode = elem.value || elem,
-                          pattern = valueNode?.value
-                    if (typeof pattern != 'string'
-                        || allowedPatterns.has(pattern)
-                        || !re.broadHost.test(pattern)
-                    ) continue
-                    context.report({ node: valueNode, messageId: 'unrestrictedHost', data: { pattern }})
+            'Program:exit'() {
+                for (const key of hostKeys) {
+                    const patterns = manifest[key] // eslint-disable-line security/detect-object-injection
+                    if (!Array.isArray(patterns)) continue
+                    for (const pattern of patterns)
+                        if (isBroad(pattern))
+                            context.report({ loc: { line: 1, column: 1 },
+                                messageId: 'unrestrictedHost', data: { pattern }})
                 }
             }
         }

package/src/rules/no-unused-i18n-keys.js

@@ -10,7 +10,6 @@ export default {
         docs: {
             description: 'Flag i18n keys in `messages.json` that are never referenced',
             category: 'Stylistic Issues',
-            recommended: false,
             manifest: true
         },
         schema: [{

package/src/rules/no-unused-permissions.js

@@ -33,7 +33,7 @@ export default {
         docs: {
             description: 'Flag manifest permissions whose APIs are never used',
             category: 'Possible Errors',
-            recommended: false,
+            recommended: true,
             manifest: true
         },
         schema: [],
@@ -43,11 +43,11 @@ export default {
     },
 
     create(context) {
-        if (!regex.filename.manifest.test(extension.file.getName(context))) return {}
+        const filename = extension.file.getName(context)
+        if (!regex.filename.manifest.test(filename) && !regex.filename.script.test(filename)) return {}
         const manifest = extension.manifest.read(context) ; if (!manifest) return {}
         const root = extension.findRoot(context) ; if (!root) return {}
-        const usedAPIs = collectUsedAPIs(manifest, root),
-              permissionNodes = new Map()
+        const usedAPIs = collectUsedAPIs(manifest, root)
         function isUsed(permission) {
             let knownPerm = false
             for (const [, perm] of apis.permissionMap)
@@ -57,6 +57,15 @@ export default {
                 if (apis.findPermission(api) == permission) return true
             return false
         }
+        if (!regex.filename.manifest.test(filename)) {
+            const loc = { line: 1, column: 1 },
+                  declared = [...(manifest.permissions || []), ...(manifest.optional_permissions || [])]
+            for (const permission of declared)
+                if (typeof permission == 'string' && !isUsed(permission))
+                    context.report({ loc, messageId: 'unusedPermission', data: { permission }})
+            return {}
+        }
+        const permissionNodes = new Map()
         return {
             '*'(node) {
                 const keyNode = node.name || node.key ; if (!keyNode) return