eslint-plugin-chrome-extensions 2.5.0 → 2.7.0

package/src/rules/require-license-file.js

@@ -7,7 +7,6 @@ export default {
         type: 'problem',
         docs: {
             description: 'Requires a license file in the extension',
-            recommended: false,
             manifest: true
         },
         schema: [],

package/src/rules/require-mv3.js

@@ -7,7 +7,7 @@ export default {
         docs: {
             description: 'Require manifest_version 3',
             category: 'Possible Errors',
-            recommended: false,
+            recommended: true,
             manifest: true
         },
         schema: [],

package/src/rules/require-short-name-when-useful.js

@@ -12,7 +12,6 @@ export default {
         docs: {
             description: 'Requires a `short_name` when `name` exceeds 12 chars',
             category: 'Stylistic Issues',
-            recommended: false,
             manifest: true
         },
         schema: [{

package/src/rules/valid-license-file.js

@@ -1,10 +1,9 @@
+import array from '../utils/array.js'
 import license from '../utils/license.js'
 import path from 'node:path'
 
 import regex from '../data/regex.js'
 
-function toArray(value) { return value == null ? [] : Array.isArray(value) ? value : [value] }
-
 function validateContent(context, node, { requireSPDX, allowedLicenses }) {
     const text = context.sourceCode.text,
           id = license.spdx.parse(text)
@@ -28,7 +27,6 @@ export default {
         fixable: 'code',
         docs: {
             description: 'Validates SPDX identifiers in license files',
-            recommended: false,
             license: true
         },
         defaultOptions: [{ requireSPDX: false, allowedLicenses: [] }],
@@ -56,7 +54,7 @@ export default {
     create(context) {
         const opts = context.options[0],
             { requireSPDX } = opts,
-              allowedLicenses = toArray(opts.allowedLicenses),
+              allowedLicenses = array.to(opts.allowedLicenses),
             { filename } = context,
               basename = path.basename(filename)
         if (!regex.filename.license.test(basename) || regex.filename.script.test(basename))

package/src/rules/valid-manifest-icons.js

@@ -7,13 +7,32 @@ import regex from '../data/regex.js'
 const re = { svg: /\.svg$/i },
       sizes = { recommended: ['16', '32', '48', '128'], required: '128' }
 
+function validateIcons(context, icons, root, opts, loc) {
+    const { requireRecommended, checkFiles, checkSVG } = opts,
+            declaredSizes = new Set(Object.keys(icons))
+    if (requireRecommended) {
+        for (const size of sizes.recommended)
+            if (!declaredSizes.has(size))
+                context.report({ loc, messageId: 'missingSize', data: { size }})
+    } else if (!declaredSizes.has(sizes.required))
+        context.report({ loc, messageId: 'missingRequiredSize' })
+    for (const file of Object.values(icons)) {
+        if (typeof file != 'string') continue
+        if (checkSVG && re.svg.test(file))
+            context.report({ loc, messageId: 'svgNotSupported' })
+        else if (checkFiles && root // eslint-disable-next-line security/detect-non-literal-fs-filename
+            && !fs.existsSync(path.resolve(root, file))
+        ) context.report({ loc, messageId: 'missingFile', data: { file }})
+    }
+}
+
 export default {
     meta: {
         type: 'problem',
         docs: {
             description: 'Validate manifest icons: sizes, existing files, no SVG',
             category: 'Possible Errors',
-            recommended: false,
+            recommended: true,
             manifest: true
         },
         defaultOptions: [{
@@ -48,12 +67,21 @@ export default {
     },
 
     create(context) {
-        if (!regex.filename.manifest.test(extension.file.getName(context))) return {}
+        const filename = extension.file.getName(context)
+        if (!regex.filename.manifest.test(filename) && !regex.filename.script.test(filename)) return {}
         const opts = context.options[0] || {},
               requireRecommended = opts.requireRecommendedSizes !== false,
               checkFiles = opts.checkIconExists !== false,
               checkSVG = opts.noSVG !== false,
-              root = checkFiles ? extension.findRoot(context) : null
+              root = checkFiles ? extension.findRoot(context) : null,
+              resolved = { requireRecommended, checkFiles, checkSVG }
+        if (!regex.filename.manifest.test(filename)) {
+            const manifest = extension.manifest.read(context) ; if (!manifest) return {}
+            const icons = manifest.icons
+            if (!icons || typeof icons != 'object' || Array.isArray(icons)) return {}
+            validateIcons(context, icons, root, resolved, { line: 1, column: 1 })
+            return {}
+        }
         return {
             '*'(node) {
                 const keyNode = node.name || node.key ; if (!keyNode) return

package/src/rules/valid-mv3-schema.js

@@ -9,7 +9,7 @@ export default {
         docs: {
             description: 'Validate manifest against the MV3 schema',
             category: 'Possible Errors',
-            recommended: false,
+            recommended: true,
             manifest: true
         },
         schema: [],

package/src/rules/valid-url-fields.js

@@ -22,6 +22,39 @@ function collectStrings(obj, path = [], out = []) {
 
 function isURL(value) { return re.absoluteURL.test(value.replace(re.template, 'x')) }
 
+function validateManifest(context, manifest, opts) {
+    const { checkURLfields, checkMatchPatterns, allowedSchemes, allowAllURLs } = opts,
+          loc = { line: 1, column: 1 }
+    for (const { path, value } of collectStrings(manifest)) {
+        if (checkURLfields && manifestData.paths.url.has(path)) {
+            if (!isURL(value))
+                context.report({ loc, messageId: 'invalidURL', data: { field: path, value }})
+        } else if (checkMatchPatterns && manifestData.paths.match.has(path)) {
+            if (value == '<all_urls>') {
+                if (!allowAllURLs)
+                    context.report({ loc, messageId: 'allURLs', data: { field: path }})
+                continue
+            }
+            const match = value.match(re.match)
+            if (!match) {
+                context.report({ loc, messageId: 'invalidMatchPattern', data: { field: path, value }})
+                continue
+            }
+            const [, scheme, host] = match
+            if (scheme != '*' && !allowedSchemes.includes(scheme))
+                context.report({ loc, messageId: 'invalidScheme', data: { field: path, value }})
+            else if (scheme == 'file' && host != '')
+                context.report({ loc, messageId: 'invalidFileHost', data: { field: path, value }})
+            else if (path == 'externally_connectable.matches' && host.includes('*'))
+                context.report({ loc, messageId: 'invalidExternalHost', data: { field: path, value }})
+            else if (host.includes('*') && host != '*' && !host.startsWith('*.'))
+                context.report({ loc, messageId: 'invalidHost', data: { field: path, value }})
+            else if (path == 'web_accessible_resources.matches' && !value.endsWith('/*'))
+                context.report({ loc, messageId: 'invalidWARPath', data: { field: path, value }})
+        }
+    }
+}
+
 export default {
     meta: {
         type: 'problem',
@@ -70,53 +103,25 @@ export default {
     },
 
     create(context) {
-        if (!regex.filename.manifest.test(extension.file.getName(context))) return {}
+        const filename = extension.file.getName(context)
+        if (!regex.filename.manifest.test(filename) && !regex.filename.script.test(filename)) return {}
         const opts = context.options[0] || {},
               checkURLfields = opts.checkURLfields ?? true,
               checkMatchPatterns = opts.checkMatchPatterns ?? true,
               allowedSchemes = opts.allowedSchemes ?? ['https', 'file'],
               allowAllURLs = opts.allowAllURLs ?? false
         if (!checkURLfields && !checkMatchPatterns) return {}
+        const resolved = { checkURLfields, checkMatchPatterns, allowedSchemes, allowAllURLs }
+        if (!regex.filename.manifest.test(filename)) {
+            const manifest = extension.manifest.read(context) ; if (!manifest) return {}
+            validateManifest(context, manifest, resolved)
+            return {}
+        }
         return {
             'Document:exit'() {
                 let manifest
                 try { manifest = JSON.parse(context.sourceCode.text) } catch { return }
-                for (const { path, value } of collectStrings(manifest)) {
-                    if (checkURLfields && manifestData.paths.url.has(path)) {
-                        if (!isURL(value))
-                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidURL',
-                                data: { field: path, value }})
-                    } else if (checkMatchPatterns && manifestData.paths.match.has(path)) {
-                        if (value == '<all_urls>') {
-                            if (!allowAllURLs)
-                                context.report({ loc: { line: 1, column: 1 }, messageId: 'allURLs',
-                                    data: { field: path }})
-                            continue
-                        }
-                        const match = value.match(re.match)
-                        if (!match) {
-                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidMatchPattern',
-                                data: { field: path, value }})
-                            continue
-                        }
-                        const [, scheme, host] = match
-                        if (scheme != '*' && !allowedSchemes.includes(scheme))
-                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidScheme',
-                                data: { field: path, value }})
-                        else if (scheme == 'file' && host != '')
-                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidFileHost',
-                                data: { field: path, value }})
-                        else if (path == 'externally_connectable.matches' && host.includes('*'))
-                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidExternalHost',
-                                data: { field: path, value }})
-                        else if (host.includes('*') && host != '*' && !host.startsWith('*.'))
-                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidHost',
-                                data: { field: path, value }})
-                        else if (path == 'web_accessible_resources.matches' && !value.endsWith('/*'))
-                            context.report({ loc: { line: 1, column: 1 }, messageId: 'invalidWARPath',
-                                data: { field: path, value }})
-                    }
-                }
+                validateManifest(context, manifest, resolved)
             }
         }
     }

package/src/rules/valid-version-field.js

@@ -13,7 +13,7 @@ export default {
         docs: {
             description: 'Validate the manifest version field format',
             category: 'Possible Errors',
-            recommended: false,
+            recommended: true,
             manifest: true
         },
         schema: [{

package/src/utils/array.js

@@ -0,0 +1 @@
+export default { to(val) { return Array.isArray(val) ? val : val == null ? [] : [val] }}

package/src/utils/extension.js

@@ -3,6 +3,9 @@
 import fs from 'node:fs'
 import path from 'node:path'
 
+import permissions from '../data/permissions.js'
+import regex from '../data/regex.js'
+
 const manifestCache = new Map()
 
 const utils = {
@@ -36,6 +39,16 @@ const utils = {
     },
 
     manifest: {
+        permission: {
+            valid: permissions.valid,
+            sensitive: permissions.sensitive,
+            isValid(name, target = 'mv3') {
+                if (permissions.valid.has(name)) return true
+                if (target == 'mv3') return false
+                return regex.url.test(name) || name.startsWith('<') || name == '*://*/*'
+            }
+        },
+
         read(context) {
             const root = utils.findRoot(context) ; if (!root) return null
             if (manifestCache.has(root)) return manifestCache.get(root)

package/src/utils/i18n.js

@@ -43,6 +43,9 @@ export default {
 
     isPredefined(key) { return key.startsWith('@@') },
 
+    localeIsValid(code, allowed = new Set()) {
+        return typeof code == 'string' && (allowed.has(code) || i18n.locales.supported.has(code)) },
+
     readDefaultLocaleMessages(manifest, root) {
         const locale = manifest?.default_locale
         if (typeof locale != 'string') return null

package/src/utils/init.js

@@ -4,19 +4,25 @@ import json from '@eslint/json'
 import rulesUtils from './rules.js'
 import text from './text.js'
 
+import cssSpacing from '../rules/css-spacing.js'
 import manifestKeyOrder from '../rules/manifest-key-order.js'
 import manifestSpacing from '../rules/manifest-spacing.js'
 import noContentStyleLeak from '../rules/no-content-style-leak.js'
 import noDeprecatedAPIs from '../rules/no-deprecated-apis.js'
 import noDuplicateManifestKeys from '../rules/no-duplicate-manifest-keys.js'
+import noGlobalKeyframes from '../rules/no-global-keyframes.js'
+import noHostPageSelectors from '../rules/no-host-page-selectors.js'
 import noInsecureFetch from '../rules/no-insecure-fetch.js'
 import noInsecureMessaging from '../rules/no-insecure-messaging.js'
+import noInvalidLocales from '../rules/no-invalid-locales.js'
 import noInvalidPermissions from '../rules/no-invalid-permissions.js'
 import noMissingDefaultLocale from '../rules/no-missing-default-locale.js'
 import noMissingI18nKeys from '../rules/no-missing-i18n-keys.js'
 import noMissingPermissions from '../rules/no-missing-permissions.js'
 import noMissingWebAccessibleResources from '../rules/no-missing-web-accessible-resources.js'
 import noRemoteCode from '../rules/no-remote-code.js'
+import noRemoteURLs from '../rules/no-remote-urls.js'
+import noScrollbarStyling from '../rules/no-scrollbar-styling.js'
 import noSensitivePermissions from '../rules/no-sensitive-permissions.js'
 import noUnrestrictedHostPermissions from '../rules/no-unrestricted-host-permissions.js'
 import noUnusedI18nKeys from '../rules/no-unused-i18n-keys.js'
@@ -35,12 +41,6 @@ import validVersionField from '../rules/valid-version-field.js'
 const namespace = 'chrome-extensions'
 
 export default {
-    bundleDeprecation(plugin, [ruleId, bundleNames], pluginName) { /* eslint-disable security/detect-object-injection */
-        for (const bundleName of bundleNames)
-            if (plugin.configs[bundleName])
-                plugin.configs[bundleName].rules[`${pluginName}/${ruleId}`] = 'error'
-    }, /* eslint-enable security/detect-object-injection */
-
     configs(plugin) {
         const plugins = { [namespace]: plugin },
               rules = plugin.rules,
@@ -67,23 +67,29 @@ export default {
         }
     },
 
-    plugin() { return { rules: {}, configs: {}}},
+    plugin() { return { rules: {}, configs: {} }},
 
     rules(plugin) {
         plugin.rules = {
+            'css-spacing': cssSpacing,
             'manifest-key-order': manifestKeyOrder,
             'manifest-spacing': manifestSpacing,
             'no-content-style-leak': noContentStyleLeak,
             'no-deprecated-apis': noDeprecatedAPIs,
             'no-duplicate-manifest-keys': noDuplicateManifestKeys,
+            'no-global-keyframes': noGlobalKeyframes,
+            'no-host-page-selectors': noHostPageSelectors,
             'no-insecure-fetch': noInsecureFetch,
             'no-insecure-messaging': noInsecureMessaging,
+            'no-invalid-locales': noInvalidLocales,
             'no-invalid-permissions': noInvalidPermissions,
             'no-missing-default-locale': noMissingDefaultLocale,
             'no-missing-i18n-keys': noMissingI18nKeys,
             'no-missing-permissions': noMissingPermissions,
             'no-missing-web-accessible-resources': noMissingWebAccessibleResources,
             'no-remote-code': noRemoteCode,
+            'no-remote-urls': noRemoteURLs,
+            'no-scrollbar-styling': noScrollbarStyling,
             'no-sensitive-permissions': noSensitivePermissions,
             'no-unrestricted-host-permissions': noUnrestrictedHostPermissions,
             'no-unused-i18n-keys': noUnusedI18nKeys,

package/src/utils/license.js

@@ -14,8 +14,7 @@ const re = { spdxTag: /SPDX-License-Identifier:\s*([\w.-]+)/i },
           .map(([id, { name }]) => ({ id, name }))
           .sort((a, b) => b.name.length - a.name.length)
 
-function tryReaddir(dir) {
-    try { return fs.readdirSync(dir, { withFileTypes: true }) } catch { return null }}
+function tryReaddir(dir) { try { return fs.readdirSync(dir, { withFileTypes: true }) } catch { return null }}
 
 export default {
     find(root) {
@@ -38,6 +37,7 @@ export default {
                 trailer = `${text.endsWith(nl) ? '' : nl}${nl}SPDX-License-Identifier: ${id}${nl}`
             return fixer.insertTextAfterRange([0, text.length], trailer)
         },
+
         find(text) {
             const normalizedTxt = text.replace(/\s+/g, ' ')
             let best = null
@@ -49,6 +49,7 @@ export default {
             }
             return best?.id ?? null
         },
+
         isValid(id) { return spdxIDs.has(id) },
         parse(text) { return text.match(re.spdxTag)?.[1] ?? null }
     }

package/src/data/deprecations.js

@@ -1,10 +0,0 @@
-// Delete a line to end support
-
-export default {
-    bundles: {
-        'no-invalid-permissions': ['recommended'], // 2026-10-5 announced future removal
-        'require-mv3':            ['recommended'], // 2026-10-5 announced future removal
-        'valid-mv3-schema':       ['recommended'], // 2026-10-5 announced future removal
-        'valid-version-field':    ['recommended']  // 2026-10-5 announced future removal
-    }
-}