eslint-plugin-chrome-extensions 2.6.0 → 2.8.0

package/src/rules/no-inline-event-handlers.js

@@ -0,0 +1,116 @@
+/* oxlint-disable security/detect-object-injection */
+
+import array from '../utils/array.js'
+import html from '../utils/html.js'
+
+const re = {
+    attrNameEnd: /[\s=>]/,
+    block: {
+        script: /(<script\b[^>]*>)([\s\S]*?)(<\/script\s*>)/gi,
+        style: /(<style\b[^>]*>)([\s\S]*?)(<\/style\s*>)/gi
+    },
+    htmlComment: /<!--[\s\S]*?-->/g,
+    inlineHandler: /^on[a-z]+$/i,
+    quote: /["']/,
+    tagOpen: /<[a-z][\w-]*/gi,
+    whitespace: /\s/
+}
+
+function isQuote(char) { return re.quote.test(char) }
+function maskInner(_, open, inner, close) { return open + spaces(inner.length) + close }
+function spaces(n) { return ' '.repeat(n) }
+
+function parseAttrs(attrPart) {
+    const attrs = [] ; let i = 0
+    while (i < attrPart.length) {
+        while (i < attrPart.length && re.whitespace.test(attrPart[i])) i++
+        if (i >= attrPart.length) break
+        const nameStart = i
+        while (i < attrPart.length && !re.attrNameEnd.test(attrPart[i])) i++
+        const name = attrPart.slice(nameStart, i)
+        if (!name) { i++ ; continue }
+        while (i < attrPart.length && re.whitespace.test(attrPart[i])) i++
+        if (attrPart[i] == '=') {
+            i++
+            while (i < attrPart.length && re.whitespace.test(attrPart[i])) i++
+            if (isQuote(attrPart[i])) {
+                const q = attrPart[i]
+                i++
+                while (i < attrPart.length && attrPart[i] !== q) i++
+                i++
+            } else
+                while (i < attrPart.length && !re.whitespace.test(attrPart[i]) && attrPart[i] != '>') i++
+        }
+        attrs.push({ name, offset: nameStart })
+    }
+    return attrs
+}
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow inline event handlers (e.g. `onclick`, `onload`) in HTML '
+                       + '(blocked by MV3\'s CSP at runtime)',
+            category: 'Possible Errors',
+            html: true
+        },
+        defaultOptions: [{ allowedAttributes: [] }],
+        schema: [{
+            type: 'object',
+            properties: {
+                allowedAttributes: {
+                    oneOf: [
+                        { type: 'string', description: 'A single attribute name' },
+                        { type: 'array', items: { type: 'string' }, description: 'List of attribute names' }
+                    ],
+                    description: 'Inline event handler attributes to permit'
+                }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            inlineHandler: 'Inline event handler `{{attr}}` is blocked by MV3\'s `script-src \'self\'`. '
+                         + 'Move the handler to JS with `addEventListener()`.'
+        }
+    },
+
+    create(context) {
+        const opts = context.options[0] || {},
+              allowedAttributes = new Set(array.to(opts.allowedAttributes ?? []).map(a => a.toLowerCase())),
+              text = context.sourceCode.text
+        let scanned = false
+        function maskContent() {
+            return text
+                .replace(re.htmlComment, match => spaces(match.length))
+                .replace(re.block.script, maskInner)
+                .replace(re.block.style, maskInner)
+        }
+        function scan() {
+            if (scanned) return
+            scanned = true
+            if (!html.isHTML(text)) return
+            const masked = maskContent()
+            for (const tagMatch of masked.matchAll(re.tagOpen)) {
+                const tagEnd = tagMatch.index + tagMatch[0].length
+                let i = tagEnd, quote = null
+                while (i < masked.length) {
+                    const char = masked[i]
+                    if (quote) { if (char === quote) quote = null }
+                    else if (isQuote(char)) quote = char
+                    else if (char == '>') break
+                    i++
+                }
+                const attrPart = masked.slice(tagEnd, i)
+                for (const attr of parseAttrs(attrPart)) {
+                    if (!re.inlineHandler.test(attr.name)) continue
+                    const attrLower = attr.name.toLowerCase()
+                    if (allowedAttributes.has(attrLower)) continue
+                    context.report({ loc: html.offsetToLoc(text, tagEnd + attr.offset),
+                        messageId: 'inlineHandler', data: { attr: attrLower }})
+                }
+            }
+        }
+        return { 'Program:exit': scan, 'Document:exit': scan, '*': scan }
+    }
+}

package/src/rules/no-inline-scripts.js

@@ -0,0 +1,65 @@
+import array from '../utils/array.js'
+import html from '../utils/html.js'
+
+const re = {
+    nonExecutable: /^(?:application\/(?:ld\+)?json|importmap|speculationrules|text\/(?:x-)?template)$/i,
+    script: /<script\b([^>]*)>([\s\S]*?)<\/script\s*>/gi
+}
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow inline `<script>` bodies and remote `<script src>` in extension HTML',
+            category: 'Possible Errors',
+            html: true
+        },
+        defaultOptions: [{ allowedSrcPrefixes: ['chrome-extension://'] }],
+        schema: [{
+            type: 'object',
+            properties: {
+                allowedSrcPrefixes: {
+                    oneOf: [
+                        { type: 'string', description: 'A single allowed src prefix' },
+                        { type: 'array', items: { type: 'string' }, description: 'List of allowed src prefixes' }
+                    ],
+                    description: 'Additional src prefixes to permit'
+                }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            inlineBody: 'Inline `<script>` bodies are blocked by MV3\'s `script-src \'self\'`. Move the code to an external file.',
+            remoteSrc: 'Remote `<script src="{{src}}">` is blocked by MV3\'s `script-src \'self\'`. Bundle the script or use `chrome.runtime.getURL()`.'
+        }
+    },
+
+    create(context) {
+        const opts = context.options[0] || {},
+              allowedPrefixes = array.to(opts.allowedSrcPrefixes ?? ['chrome-extension://']),
+              text = context.sourceCode.text
+        let scanned = false
+        function scan() {
+            if (scanned) return
+            scanned = true
+            if (!html.isHTML(text)) return
+            for (const match of text.matchAll(re.script)) {
+                const [, attrs, body] = match,
+                      type = html.pickAttrVal(attrs.match(html.re.attr.type))
+                if (type && re.nonExecutable.test(type.trim())) continue
+                const src = html.pickAttrVal(attrs.match(html.re.attr.src))
+                if (src !== null) {
+                    const trimmed = src.trim()
+                    if (trimmed && html.isRemote(trimmed, allowedPrefixes))
+                        context.report({ loc: html.offsetToLoc(text, match.index),
+                            messageId: 'remoteSrc', data: { src: trimmed }})
+                    continue
+                }
+                if (body && body.trim().length > 0)
+                    context.report({ loc: html.offsetToLoc(text, match.index),
+                        messageId: 'inlineBody' })
+            }
+        }
+        return { 'Program:exit': scan, 'Document:exit': scan, '*': scan }
+    }
+}

package/src/rules/no-insecure-fetch.js

@@ -1,5 +1,12 @@
 const re = { insecureURL: /^http:\/\/(?!localhost\b|127\.0\.0\.1\b|\[::1\])/i }
 
+function urlFromLiteral(node) {
+    return ( node?.type == 'Literal'
+        && typeof node.value == 'string'
+        && re.insecureURL.test(node.value)
+    ) ? node.value : null
+}
+
 export default {
     meta: {
         type: 'problem',
@@ -18,12 +25,6 @@ export default {
 
     create(context) {
         const xhrVars = new Set()
-        function urlFromLiteral(node) {
-            return ( node?.type == 'Literal'
-                && typeof node.value == 'string'
-                && re.insecureURL.test(node.value)
-            ) ? node.value : null
-        }
         return {
             VariableDeclarator(node) {
                 if (node.init?.type == 'NewExpression'

package/src/rules/no-insecure-messaging.js

@@ -1,7 +1,8 @@
+import api from '../utils/api.js'
 import nodeUtils from '../utils/node.js'
-import apis from '../data/apis.js'
 
-const re = { postmsgValidation: /\b\w+\.(?:origin|source)\b/, senderValidation: /sender\.(?:id|origin)/ }
+const re = { postmsgValidation: /\b\w+\.(?:origin|source)\b/, senderValidation: /sender\.(?:id|origin)/ },
+      isMessageTarget = obj => obj?.type == 'Identifier' && ['self', 'window'].includes(obj.name)
 
 export default {
     meta: {
@@ -40,13 +41,12 @@ export default {
             if (re.postmsgValidation.test(body)) return
             context.report({ node, messageId: 'unvalidatedPostMessage', data: { target }})
         }
-        function isMessageTarget(obj) { return obj?.type == 'Identifier' && ['self', 'window'].includes(obj.name) }
         return {
             CallExpression(node) {
                 if (node.callee.type != 'MemberExpression') return
                 const path = nodeUtils.getMemberPath(node.callee) ; if (!path) return
                 const listenerRoot = path.endsWith('.addListener') ? path.slice(0, -'.addListener'.length) : null
-                if (listenerRoot && apis.isExternalMsgListener(listenerRoot)) {
+                if (listenerRoot && api.isExternalMsgListener(listenerRoot)) {
                     const handler = node.arguments[0] ; if (!handler) return
                     const body = context.sourceCode.getText(handler)
                     if (!re.senderValidation.test(body))

package/src/rules/no-invalid-locales.js

@@ -1,5 +1,3 @@
-/* eslint-disable security/detect-non-literal-fs-filename -- lint-time project inspection only */
-
 import extension from '../utils/extension.js'
 import fs from 'node:fs'
 import i18nUtils from '../utils/i18n.js'
@@ -51,11 +49,11 @@ export default {
               root = extension.findRoot(context)
         if (root) {
             const localesDir = path.join(root, '_locales')
-            try {
+            try { // oxlint-disable-next-line security/detect-non-literal-fs-filename
                 for (const entry of fs.readdirSync(localesDir, { withFileTypes: true }))
                     if (entry.isDirectory() && isInvalid(entry.name)) invalidFolders.push(entry.name)
-                invalidFolders.sort()
-            } catch {} // eslint-disable-line no-empty
+                invalidFolders.sort((a, b) => a < b ? -1 : a > b ? 1 : 0)
+            } catch {}
         }
         const loc = { line: 1, column: 1 }
         if (!isManifest) {

package/src/rules/no-missing-default-locale.js

@@ -1,4 +1,4 @@
-/* eslint-disable security/detect-non-literal-fs-filename -- lint-time project inspection only */
+/* oxlint-disable security/detect-non-literal-fs-filename */
 
 import extension from '../utils/extension.js'
 import fs from 'node:fs'

package/src/rules/no-missing-permissions.js

@@ -1,8 +1,7 @@
+import apiUtils from '../utils/api.js'
 import extension from '../utils/extension.js'
 import nodeUtils from '../utils/node.js'
 
-import apis from '../data/apis.js'
-
 function queriesActiveTab(node) {
     const arg = node.arguments[0] ; if (arg?.type != 'ObjectExpression') return false
     return arg.properties.some(prop => {
@@ -34,7 +33,7 @@ export default {
             CallExpression(node) {
                 if (node.callee.type != 'MemberExpression') return
                 const api = nodeUtils.getMemberPath(node.callee) ; if (!api) return
-                const permission = apis.findPermission(api) ; if (!permission || declared.has(permission)) return
+                const permission = apiUtils.findPermission(api) ; if (!permission || declared.has(permission)) return
                 const isActiveTabQuery = permission == 'tabs' && queriesActiveTab(node)
                 if (isActiveTabQuery && declared.has('activeTab')) return
                 const messageId = `missing${ isActiveTabQuery ? 'ActiveTab' : 'Permission' }`

package/src/rules/no-missing-web-accessible-resources.js

@@ -16,8 +16,8 @@ function collectWARpatterns(manifest) {
 }
 
 function patternToRegex(pattern) {
-    const escaped = pattern.replace(re.regexSpecial, '\\$&').replace(/\*/g, '.*')
-    return new RegExp(`^${escaped}$`) // eslint-disable-line security/detect-non-literal-regexp
+    const escaped = pattern.replaceAll(re.regexSpecial, '\\$&').replaceAll('*', '.*')
+    return new RegExp(`^${escaped}$`) // oxlint-disable-line security/detect-non-literal-regexp
 }
 
 export default {

package/src/rules/no-remote-code.js

@@ -3,6 +3,38 @@ import nodeUtils from '../utils/node.js'
 import manifest from '../data/manifest.js'
 import regex from '../data/regex.js'
 
+const re = { inlineHandler: /^on[a-z]+$/i, inlineHandlerInHTML: /\son[a-z]+\s*=/i }
+
+function isCreateScript(node) {
+    return node?.type == 'CallExpression'
+        && node.callee?.property?.name == 'createElement'
+        && node.arguments[0]?.value == 'script'
+}
+function isInlineHandlerInString(node) {
+    return node?.type == 'Literal'
+        && typeof node.value == 'string'
+        && re.inlineHandlerInHTML.test(node.value)
+}
+function isLiteralURL(node) {
+    return node?.type == 'Literal'
+        && typeof node.value == 'string'
+        && regex.url.test(node.value)
+}
+function isObjectAssign(node) {
+    return node?.type == 'CallExpression'
+        && node.callee?.type == 'MemberExpression'
+        && node.callee.object?.name == 'Object'
+        && node.callee.property?.name == 'assign'
+}
+function isScriptSrcProperty(node) {
+    const obj = node.parent
+    if (obj?.type != 'ObjectExpression') return false
+    const parent = obj.parent
+    if (isCreateScript(parent)) return true
+    if (isObjectAssign(parent) && isCreateScript(parent.arguments[0])) return true
+    return false
+}
+
 export default {
     meta: {
         type: 'problem',
@@ -13,8 +45,7 @@ export default {
             security: true
         },
         defaultOptions: [{
-            patterns: ['eval', 'new-function', 'string-timer',
-                'dynamic-import', 'remote-script-src', 'execute-script-url'],
+            patterns: manifest.patterns.remoteCode,
             checkExecuteScriptClosures: true
         }],
         schema: [{
@@ -39,31 +70,17 @@ export default {
             dynamicImport: 'Remote dynamic `import()` is forbidden under MV3\'s CSP. Use a relative path instead.',
             remoteScriptSrc: 'Injecting remote `<script src>` is forbidden under MV3\'s CSP. Use `chrome.runtime.getURL()` for bundled scripts instead.',
             executeScriptURL: '`chrome.scripting.executeScript` must use local `files`, not a remote URL.',
-            executeScriptClosure: '`chrome.scripting.executeScript({ func })` captures outer-scope variables that fail after serialization. Pass them via `args` instead.'
+            executeScriptClosure: '`chrome.scripting.executeScript({ func })` captures outer-scope variables that fail after serialization. Pass them via `args` instead.',
+            inlineEventHandler: 'Inline event handler `{{attr}}` is blocked by MV3\'s `script-src \'self\'`. Use `addEventListener()` instead.',
+            inlineScriptBody: 'Inline `<script>` body injection is blocked by MV3\'s `script-src \'self\'`. Move the code to an external file.'
         }
     },
 
     create(context) {
         const opts = context.options[0] || {},
-              patterns = new Set(opts.patterns || manifest.regexmoteCode),
+              patterns = new Set(opts.patterns || manifest.patterns.remoteCode),
               checkClosures = opts.checkExecuteScriptClosures !== false,
               scriptElems = new Set()
-        function isCreateScript(node) {
-            return node?.type == 'CallExpression'
-                && node.callee?.property?.name == 'createElement'
-                && node.arguments[0]?.value == 'script'
-        }
-        function isLiteralURL(node) {
-            return node?.type == 'Literal'
-                && typeof node.value == 'string'
-                && regex.url.test(node.value)
-        }
-        function isObjectAssign(node) {
-            return node?.type == 'CallExpression'
-                && node.callee?.type == 'MemberExpression'
-                && node.callee.object?.name == 'Object'
-                && node.callee.property?.name == 'assign'
-        }
         function isScriptSrcAssignment(left, right) {
             if (left.type != 'MemberExpression') return false
             if (left.property?.name != 'src') return false
@@ -72,12 +89,10 @@ export default {
             if (left.object.type == 'Identifier' && scriptElems.has(left.object.name)) return true
             return false
         }
-        function isScriptSrcProperty(node) {
-            const obj = node.parent
-            if (obj?.type != 'ObjectExpression') return false
-            const parent = obj.parent
-            if (isCreateScript(parent)) return true
-            if (isObjectAssign(parent) && isCreateScript(parent.arguments[0])) return true
+        function isScriptElement(node) {
+            if (!node) return false
+            if (isCreateScript(node)) return true
+            if (node.type == 'Identifier' && scriptElems.has(node.name)) return true
             return false
         }
         return {
@@ -112,12 +127,31 @@ export default {
                         if (optsNode?.type != 'ObjectExpression') return
                         const urlProp = optsNode.properties.find(prop => prop.key?.name == 'url'),
                               funcProp = optsNode.properties.find(prop => prop.key?.name == 'func'),
-                              argsProp = optsNode.properties.find(prop => prop.key?.name == 'args')
+                              hasArgs = optsNode.properties.some(prop => prop.key?.name == 'args')
                         if (patterns.has('execute-script-url') && urlProp)
                             context.report({ node: urlProp, messageId: 'executeScriptURL' })
-                        if (checkClosures && funcProp && !argsProp)
+                        if (checkClosures && funcProp && !hasArgs)
                             context.report({ node: funcProp, messageId: 'executeScriptClosure' })
                     }
+                    if (patterns.has('inline-event-handler')
+                        && node.callee.property?.name == 'setAttribute'
+                        && node.arguments[0]?.type == 'Literal'
+                        && typeof node.arguments[0].value == 'string'
+                        && re.inlineHandler.test(node.arguments[0].value)
+                    ) context.report({ node, messageId: 'inlineEventHandler',
+                        data: { attr: node.arguments[0].value.toLowerCase() }})
+                    if (patterns.has('inline-event-handler')
+                        && node.callee.property?.name == 'insertAdjacentHTML'
+                        && isInlineHandlerInString(node.arguments[1])
+                    ) context.report({ node: node.arguments[1], messageId: 'inlineEventHandler',
+                        data: { attr: 'on*' }})
+                    if (patterns.has('inline-script-body')
+                        && ['append', 'prepend'].includes(node.callee.property?.name)
+                        && isScriptElement(node.callee.object)
+                        && node.arguments[0]?.type == 'Literal'
+                        && typeof node.arguments[0].value == 'string'
+                        && node.arguments[0].value.trim().length > 0
+                    ) context.report({ node: node.arguments[0], messageId: 'inlineScriptBody' })
                 }
             },
             NewExpression(node) {
@@ -125,6 +159,21 @@ export default {
                     context.report({ node, messageId: 'newFunction' })
             },
             AssignmentExpression(node) {
+                if (patterns.has('inline-event-handler')
+                    && node.left.type == 'MemberExpression'
+                    && ['innerHTML', 'outerHTML'].includes(node.left.property?.name)
+                    && !isScriptElement(node.left.object)
+                    && isInlineHandlerInString(node.right)
+                ) context.report({ node: node.right, messageId: 'inlineEventHandler',
+                    data: { attr: 'on*' }})
+                if (patterns.has('inline-script-body')
+                    && node.left.type == 'MemberExpression'
+                    && ['textContent', 'innerText', 'innerHTML', 'text'].includes(node.left.property?.name)
+                    && isScriptElement(node.left.object)
+                    && node.right?.type == 'Literal'
+                    && typeof node.right.value == 'string'
+                    && node.right.value.trim().length > 0
+                ) context.report({ node, messageId: 'inlineScriptBody' })
                 if (!patterns.has('remote-script-src')) return
                 if (isScriptSrcAssignment(node.left, node.right))
                     context.report({ node: node.right, messageId: 'remoteScriptSrc' })

package/src/rules/no-remote-objects.js

@@ -0,0 +1,55 @@
+import array from '../utils/array.js'
+import html from '../utils/html.js'
+
+const re = { objectTag: /<(?:object|embed)\b([^>]*)>/gi }
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow remote `<object data>` and `<embed src>` in extension HTML',
+            category: 'Possible Errors',
+            html: true
+        },
+        defaultOptions: [{ allowedPrefixes: ['chrome-extension://'] }],
+        schema: [{
+            type: 'object',
+            properties: {
+                allowedPrefixes: {
+                    oneOf: [
+                        { type: 'string', description: 'A single allowed prefix' },
+                        { type: 'array', items: { type: 'string' }, description: 'List of allowed prefixes' }
+                    ],
+                    description: 'Additional prefixes to permit'
+                }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            remoteObject: 'Remote `<{{tag}} {{attr}}="{{src}}">` is blocked by MV3\'s `object-src \'self\'`. '
+                        + 'Bundle the resource or use `chrome.runtime.getURL()`.'
+        }
+    },
+
+    create(context) {
+        const opts = context.options[0] || {},
+              allowedPrefixes = array.to(opts.allowedPrefixes ?? ['chrome-extension://']),
+              text = context.sourceCode.text
+        let scanned = false
+        function scan() {
+            if (scanned) return
+            scanned = true
+            if (!html.isHTML(text)) return
+            for (const match of text.matchAll(re.objectTag)) {
+                const [full, attrs] = match,
+                       tag = full.trimStart().toLowerCase().startsWith('<object') ? 'object' : 'embed',
+                       attr = tag == 'object' ? 'data' : 'src',
+                       val = html.pickAttrVal(attrs.match(tag == 'object' ? html.re.attr.data : html.re.attr.src))
+                if (val !== null && html.isRemote(val.trim(), allowedPrefixes))
+                    context.report({ loc: html.offsetToLoc(text, match.index), messageId: 'remoteObject',
+                        data: { tag, attr, src: val.trim() }})
+            }
+        }
+        return { 'Program:exit': scan, 'Document:exit': scan, '*': scan }
+    }
+}

package/src/rules/no-remote-urls.js

@@ -0,0 +1,102 @@
+import array from '../utils/array.js'
+import regex from '../data/regex.js'
+
+function getPreludeURLnode(prelude) {
+    if (!prelude) return null
+    if (['Url', 'CSSUrl', 'String', 'CSSString'].includes(prelude.type))
+        return prelude
+    for (const child of prelude.children ?? [])
+        if (['Url', 'CSSUrl', 'String', 'CSSString'].includes(child.type))
+            return child
+    return null
+}
+function getURLstr(node) {
+    if (!node) return null
+    if (typeof node == 'string') return node
+    if (typeof node.url == 'string') return node.url
+    if (typeof node.value == 'string') return node.value
+    if (node.value && typeof node.value == 'object' && typeof node.value.value == 'string')
+        return node.value.value
+    return null
+}
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow remote resources (`@import`, `url()`, `@namespace`) in extension CSS',
+            category: 'Possible Errors',
+            css: true
+        },
+        defaultOptions: [{
+            allowedSchemes: ['blob', 'chrome-extension', 'data'],
+            patterns: ['at-import', 'url']
+        }],
+        schema: [{
+            type: 'object',
+            properties: {
+                allowedSchemes: {
+                    oneOf: [
+                        { type: 'string', description: 'A single URL scheme' },
+                        { type: 'array', items: { type: 'string' }, description: 'List of URL schemes' }
+                    ],
+                    description: 'URL schemes to allow (e.g. `chrome-extension`, `data`, `blob`)'
+                },
+                patterns: {
+                    oneOf: [
+                        { enum: ['at-import', 'url', 'namespace'], description: 'A single detection path' },
+                        { type: 'array', items: { enum: ['at-import', 'url', 'namespace'] }, description: 'List of detection paths' }
+                    ],
+                    description: 'Detection paths to enable'
+                }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            remoteImport: 'Remote `@import` is disallowed. Bundle the stylesheet or use `chrome.runtime.getURL()`.',
+            remoteURL: 'Remote `url()` is disallowed. Bundle the asset or use `chrome.runtime.getURL()`.',
+            remoteNamespace: 'Remote `@namespace` is disallowed. Reference a bundled stylesheet.'
+        }
+    },
+
+    create(context) {
+        const opts = context.options[0] || {},
+              allowedSchemes = new Set(array.to(opts.allowedSchemes ?? ['blob', 'chrome-extension', 'data'])),
+              patterns = new Set(array.to(opts.patterns ?? ['at-import', 'url'])),
+              handledURLs = new WeakSet()
+        function handleAtrule(node) {
+            if (!node.prelude) return
+            if (node.name == 'import' && patterns.has('at-import')) {
+                const urlNode = getPreludeURLnode(node.prelude)
+                if (urlNode && isRemote(getURLstr(urlNode))) {
+                    handledURLs.add(urlNode)
+                    context.report({ node, messageId: 'remoteImport' })
+                }
+            }
+            if (node.name == 'namespace' && patterns.has('namespace')) {
+                const urlNode = getPreludeURLnode(node.prelude)
+                if (urlNode && isRemote(getURLstr(urlNode))) {
+                    handledURLs.add(urlNode)
+                    context.report({ node, messageId: 'remoteNamespace' })
+                }
+            }
+        }
+        function handleURL(node) {
+            if (!patterns.has('url')) return
+            if (handledURLs.has(node)) return
+            if (node.parent?.type == 'AtrulePrelude' || node.parent?.type == 'CSSAtRulePrelude') return
+            if (isRemote(getURLstr(node)))
+                context.report({ node, messageId: 'remoteURL' })
+        }
+        function isRemote(str) {
+            if (typeof str != 'string') return false
+            const match = regex.scheme.exec(str)
+            if (!match) return false
+            if (match[0] == '//') return true
+            const scheme = (match[1] || '').toLowerCase()
+            if (['http', 'https', 'ftp'].includes(scheme)) return true
+            return !allowedSchemes.has(scheme)
+        }
+        return { Atrule: handleAtrule, CSSAtRule: handleAtrule, Url: handleURL, CSSUrl: handleURL }
+    }
+}