eslint-plugin-chrome-extensions 2.6.0 → 2.7.0

package/src/rules/no-remote-urls.js

@@ -0,0 +1,102 @@
+import array from '../utils/array.js'
+
+const re = { urlScheme: /^(?:([a-z][a-z0-9+.-]*):|\/\/)/i }
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow remote resources (`@import`, `url()`, `@namespace`) in extension CSS',
+            category: 'Possible Errors',
+            css: true
+        },
+        defaultOptions: [{
+            allowedSchemes: ['blob', 'chrome-extension', 'data'],
+            patterns: ['at-import', 'url']
+        }],
+        schema: [{
+            type: 'object',
+            properties: {
+                allowedSchemes: {
+                    oneOf: [
+                        { type: 'string', description: 'A single URL scheme' },
+                        { type: 'array', items: { type: 'string' }, description: 'List of URL schemes' }
+                    ],
+                    description: 'URL schemes to allow (e.g. `chrome-extension`, `data`, `blob`)'
+                },
+                patterns: {
+                    oneOf: [
+                        { enum: ['at-import', 'url', 'namespace'], description: 'A single detection path' },
+                        { type: 'array', items: { enum: ['at-import', 'url', 'namespace'] }, description: 'List of detection paths' }
+                    ],
+                    description: 'Detection paths to enable'
+                }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            remoteImport: 'Remote `@import` is disallowed. Bundle the stylesheet or use `chrome.runtime.getURL()`.',
+            remoteURL: 'Remote `url()` is disallowed. Bundle the asset or use `chrome.runtime.getURL()`.',
+            remoteNamespace: 'Remote `@namespace` is disallowed. Reference a bundled stylesheet.'
+        }
+    },
+
+    create(context) {
+        const opts = context.options[0] || {},
+              allowedSchemes = new Set(array.to(opts.allowedSchemes ?? ['blob', 'chrome-extension', 'data'])),
+              patterns = new Set(array.to(opts.patterns ?? ['at-import', 'url'])),
+              handledURLs = new WeakSet()
+        function getPreludeURLnode(prelude) {
+            if (!prelude) return null
+            if (['Url', 'CSSUrl', 'String', 'CSSString'].includes(prelude.type))
+                return prelude
+            for (const child of prelude.children ?? [])
+                if (['Url', 'CSSUrl', 'String', 'CSSString'].includes(child.type))
+                    return child
+            return null
+        }
+        function getURLstr(node) {
+            if (!node) return null
+            if (typeof node == 'string') return node
+            if (typeof node.url == 'string') return node.url
+            if (typeof node.value == 'string') return node.value
+            if (node.value && typeof node.value == 'object' && typeof node.value.value == 'string')
+                return node.value.value
+            return null
+        }
+        function handleAtrule(node) {
+            if (!node.prelude) return
+            if (node.name == 'import' && patterns.has('at-import')) {
+                const urlNode = getPreludeURLnode(node.prelude)
+                if (urlNode && isRemote(getURLstr(urlNode))) {
+                    handledURLs.add(urlNode)
+                    context.report({ node, messageId: 'remoteImport' })
+                }
+            }
+            if (node.name == 'namespace' && patterns.has('namespace')) {
+                const urlNode = getPreludeURLnode(node.prelude)
+                if (urlNode && isRemote(getURLstr(urlNode))) {
+                    handledURLs.add(urlNode)
+                    context.report({ node, messageId: 'remoteNamespace' })
+                }
+            }
+        }
+        function handleURL(node) {
+            if (!patterns.has('url')) return
+            if (handledURLs.has(node)) return
+            if (node.parent?.type == 'AtrulePrelude' || node.parent?.type == 'CSSAtRulePrelude') return
+            if (isRemote(getURLstr(node)))
+                context.report({ node, messageId: 'remoteURL' })
+        }
+        function isRemote(str) {
+            if (typeof str != 'string') return false
+            const match = str.match(re.urlScheme)
+            if (!match) return false
+            if (match[0] == '//') return true
+            const scheme = (match[1] || '').toLowerCase()
+            if (['http', 'https', 'ftp'].includes(scheme)) return true
+            return !allowedSchemes.has(scheme)
+        }
+        return { Atrule: handleAtrule, CSSAtRule: handleAtrule, Url: handleURL, CSSUrl: handleURL }
+    }
+}

package/src/rules/no-scrollbar-styling.js

@@ -0,0 +1,73 @@
+import array from '../utils/array.js'
+import regex from '../data/regex.js'
+
+const re = {
+    scrollbarPseudo: /^(?:-webkit-)?scrollbar(?:-[\w-]+)?$/i } // eslint-disable-line security/detect-unsafe-regex
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow scrollbar pseudo-elements (e.g. `::-webkit-scrollbar`) '
+                       + 'on unscoped selectors in content-script CSS',
+            category: 'Possible Errors',
+            css: true
+        },
+        defaultOptions: [{ allowedSelectors: [] }],
+        schema: [{
+            type: 'object',
+            properties: {
+                allowedSelectors: {
+                    oneOf: [
+                        { type: 'string', description: 'A single selector' },
+                        { type: 'array', items: { type: 'string' }, description: 'List of selectors' }
+                    ],
+                    description: 'Selectors to explicitly allow (e.g. `body::-webkit-scrollbar`)'
+                }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            noScrollbarStyling: 'Scrollbar pseudo-element on `{{selector}}` styles the host page\'s scrollbar. '
+                              + 'Scope it to a namespaced class (e.g. `.myext-panel::...`) or use `allowedSelectors`.'
+        }
+    },
+
+    create(context) {
+        const opts = context.options[0] || {},
+              allowedSelectors = new Set(array.to(opts.allowedSelectors))
+        function checkSelector(selector) {
+            if (!selector) return
+            const text = getSelectorText(selector).trim() ; if (allowedSelectors.has(text)) return
+            let hasScrollbarPseudo = false,
+                hasQualifier = false,
+                pastFirstCompound = false
+            for (const simple of selector.children ?? []) {
+                const type = plainType(simple)
+                if (type == 'Combinator') { pastFirstCompound = true; continue }
+                if (type == 'PseudoElementSelector' && re.scrollbarPseudo.test(simple.name ?? '')) {
+                    hasScrollbarPseudo = true
+                    continue
+                }
+                if (pastFirstCompound) continue
+                if (type == 'ClassSelector' || type == 'IdSelector' || type == 'AttributeSelector')
+                    hasQualifier = true
+                else if (type == 'PseudoClassSelector' && (simple.name ?? '').toLowerCase().startsWith('host'))
+                    hasQualifier = true
+            }
+            if (hasScrollbarPseudo && !hasQualifier)
+                context.report({ node: selector, messageId: 'noScrollbarStyling', data: { selector: text }})
+        }
+        function getSelectorText(selector) {
+            const range = selector.range
+            if (range && range.length == 2) return context.sourceCode.text.slice(range[0], range[1])
+            return context.sourceCode.getText(selector)
+        }
+        function handleRule(node) {
+            for (const selector of node.prelude?.children ?? [])
+                checkSelector(selector)
+        }
+        function plainType(node) { return node?.type?.replace(regex.prefix.css, '') ?? '' }
+        return { Rule: handleRule, CSSRule: handleRule }
+    }
+}

package/src/rules/no-unused-i18n-keys.js

@@ -10,7 +10,6 @@ export default {
         docs: {
             description: 'Flag i18n keys in `messages.json` that are never referenced',
             category: 'Stylistic Issues',
-            recommended: false,
             manifest: true
         },
         schema: [{

package/src/rules/require-license-file.js

@@ -7,7 +7,6 @@ export default {
         type: 'problem',
         docs: {
             description: 'Requires a license file in the extension',
-            recommended: false,
             manifest: true
         },
         schema: [],

package/src/rules/require-short-name-when-useful.js

@@ -12,7 +12,6 @@ export default {
         docs: {
             description: 'Requires a `short_name` when `name` exceeds 12 chars',
             category: 'Stylistic Issues',
-            recommended: false,
             manifest: true
         },
         schema: [{

package/src/rules/valid-license-file.js

@@ -1,10 +1,9 @@
+import array from '../utils/array.js'
 import license from '../utils/license.js'
 import path from 'node:path'
 
 import regex from '../data/regex.js'
 
-function toArray(value) { return value == null ? [] : Array.isArray(value) ? value : [value] }
-
 function validateContent(context, node, { requireSPDX, allowedLicenses }) {
     const text = context.sourceCode.text,
           id = license.spdx.parse(text)
@@ -28,7 +27,6 @@ export default {
         fixable: 'code',
         docs: {
             description: 'Validates SPDX identifiers in license files',
-            recommended: false,
             license: true
         },
         defaultOptions: [{ requireSPDX: false, allowedLicenses: [] }],
@@ -56,7 +54,7 @@ export default {
     create(context) {
         const opts = context.options[0],
             { requireSPDX } = opts,
-              allowedLicenses = toArray(opts.allowedLicenses),
+              allowedLicenses = array.to(opts.allowedLicenses),
             { filename } = context,
               basename = path.basename(filename)
         if (!regex.filename.license.test(basename) || regex.filename.script.test(basename))

package/src/utils/array.js

@@ -0,0 +1 @@
+export default { to(val) { return Array.isArray(val) ? val : val == null ? [] : [val] }}

package/src/utils/init.js

@@ -4,11 +4,14 @@ import json from '@eslint/json'
 import rulesUtils from './rules.js'
 import text from './text.js'
 
+import cssSpacing from '../rules/css-spacing.js'
 import manifestKeyOrder from '../rules/manifest-key-order.js'
 import manifestSpacing from '../rules/manifest-spacing.js'
 import noContentStyleLeak from '../rules/no-content-style-leak.js'
 import noDeprecatedAPIs from '../rules/no-deprecated-apis.js'
 import noDuplicateManifestKeys from '../rules/no-duplicate-manifest-keys.js'
+import noGlobalKeyframes from '../rules/no-global-keyframes.js'
+import noHostPageSelectors from '../rules/no-host-page-selectors.js'
 import noInsecureFetch from '../rules/no-insecure-fetch.js'
 import noInsecureMessaging from '../rules/no-insecure-messaging.js'
 import noInvalidLocales from '../rules/no-invalid-locales.js'
@@ -18,6 +21,8 @@ import noMissingI18nKeys from '../rules/no-missing-i18n-keys.js'
 import noMissingPermissions from '../rules/no-missing-permissions.js'
 import noMissingWebAccessibleResources from '../rules/no-missing-web-accessible-resources.js'
 import noRemoteCode from '../rules/no-remote-code.js'
+import noRemoteURLs from '../rules/no-remote-urls.js'
+import noScrollbarStyling from '../rules/no-scrollbar-styling.js'
 import noSensitivePermissions from '../rules/no-sensitive-permissions.js'
 import noUnrestrictedHostPermissions from '../rules/no-unrestricted-host-permissions.js'
 import noUnusedI18nKeys from '../rules/no-unused-i18n-keys.js'
@@ -36,12 +41,6 @@ import validVersionField from '../rules/valid-version-field.js'
 const namespace = 'chrome-extensions'
 
 export default {
-    bundleDeprecation(plugin, [ruleId, bundleNames], pluginName) { /* eslint-disable security/detect-object-injection */
-        for (const bundleName of bundleNames)
-            if (plugin.configs[bundleName])
-                plugin.configs[bundleName].rules[`${pluginName}/${ruleId}`] = 'error'
-    }, /* eslint-enable security/detect-object-injection */
-
     configs(plugin) {
         const plugins = { [namespace]: plugin },
               rules = plugin.rules,
@@ -72,11 +71,14 @@ export default {
 
     rules(plugin) {
         plugin.rules = {
+            'css-spacing': cssSpacing,
             'manifest-key-order': manifestKeyOrder,
             'manifest-spacing': manifestSpacing,
             'no-content-style-leak': noContentStyleLeak,
             'no-deprecated-apis': noDeprecatedAPIs,
             'no-duplicate-manifest-keys': noDuplicateManifestKeys,
+            'no-global-keyframes': noGlobalKeyframes,
+            'no-host-page-selectors': noHostPageSelectors,
             'no-insecure-fetch': noInsecureFetch,
             'no-insecure-messaging': noInsecureMessaging,
             'no-invalid-locales': noInvalidLocales,
@@ -86,6 +88,8 @@ export default {
             'no-missing-permissions': noMissingPermissions,
             'no-missing-web-accessible-resources': noMissingWebAccessibleResources,
             'no-remote-code': noRemoteCode,
+            'no-remote-urls': noRemoteURLs,
+            'no-scrollbar-styling': noScrollbarStyling,
             'no-sensitive-permissions': noSensitivePermissions,
             'no-unrestricted-host-permissions': noUnrestrictedHostPermissions,
             'no-unused-i18n-keys': noUnusedI18nKeys,

package/src/data/deprecations.js

@@ -1,8 +0,0 @@
-// Delete a line to end support
-
-export default {
-    bundles: {
-        // <rule-id-a>: [<old-bundle>],
-        // <rule-id-b>: [<old-bundle>]
-    }
-}