eslint-plugin-chrome-extensions 2.6.0 → 2.8.0

package/src/rules/no-scrollbar-styling.js

@@ -0,0 +1,71 @@
+import array from '../utils/array.js'
+import node from '../utils/node.js'
+
+const re = {
+    scrollbarPseudo: /^(?:-webkit-)?scrollbar(?:-[\w-]+)?$/i } // oxlint-disable-line security/detect-unsafe-regex
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow scrollbar pseudo-elements (e.g. `::-webkit-scrollbar`) '
+                       + 'on unscoped selectors in content-script CSS',
+            category: 'Possible Errors',
+            css: true
+        },
+        defaultOptions: [{ allowedSelectors: [] }],
+        schema: [{
+            type: 'object',
+            properties: {
+                allowedSelectors: {
+                    oneOf: [
+                        { type: 'string', description: 'A single selector' },
+                        { type: 'array', items: { type: 'string' }, description: 'List of selectors' }
+                    ],
+                    description: 'Selectors to explicitly allow (e.g. `body::-webkit-scrollbar`)'
+                }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            noScrollbarStyling: 'Scrollbar pseudo-element on `{{selector}}` styles the host page\'s scrollbar. '
+                              + 'Scope it to a namespaced class (e.g. `.myext-panel::...`) or use `allowedSelectors`.'
+        }
+    },
+
+    create(context) {
+        const opts = context.options[0] || {},
+              allowedSelectors = new Set(array.to(opts.allowedSelectors))
+        function checkSelector(selector) {
+            if (!selector) return
+            const text = getSelectorText(selector).trim() ; if (allowedSelectors.has(text)) return
+            let hasScrollbarPseudo = false,
+                hasQualifier = false,
+                pastFirstCompound = false
+            for (const simple of selector.children ?? []) {
+                const type = node.plainType(simple)
+                if (type == 'Combinator') { pastFirstCompound = true; continue }
+                if (type == 'PseudoElementSelector' && re.scrollbarPseudo.test(simple.name ?? '')) {
+                    hasScrollbarPseudo = true
+                    continue
+                }
+                if (pastFirstCompound) continue
+                if (['AttributeSelector', 'ClassSelector', 'IdSelector'].includes(type)
+                    || (type == 'PseudoClassSelector' && (simple.name ?? '').toLowerCase().startsWith('host'))
+                ) hasQualifier = true
+            }
+            if (hasScrollbarPseudo && !hasQualifier)
+                context.report({ node: selector, messageId: 'noScrollbarStyling', data: { selector: text }})
+        }
+        function getSelectorText(selector) {
+            const { range } = selector
+            if (range?.length == 2) return context.sourceCode.text.slice(range[0], range[1])
+            return context.sourceCode.getText(selector)
+        }
+        function handleRule(node) {
+            for (const selector of node.prelude?.children ?? [])
+                checkSelector(selector)
+        }
+        return { Rule: handleRule, CSSRule: handleRule }
+    }
+}

package/src/rules/no-unrestricted-host-permissions.js

@@ -58,7 +58,7 @@ export default {
         return {
             'Program:exit'() {
                 for (const key of hostKeys) {
-                    const patterns = manifest[key] // eslint-disable-line security/detect-object-injection
+                    const patterns = manifest[key] // oxlint-disable-line security/detect-object-injection
                     if (!Array.isArray(patterns)) continue
                     for (const pattern of patterns)
                         if (isBroad(pattern))

package/src/rules/no-unused-i18n-keys.js

@@ -10,7 +10,6 @@ export default {
         docs: {
             description: 'Flag i18n keys in `messages.json` that are never referenced',
             category: 'Stylistic Issues',
-            recommended: false,
             manifest: true
         },
         schema: [{

package/src/rules/no-unused-permissions.js

@@ -1,3 +1,4 @@
+import apiUtils from '../utils/api.js'
 import extension from '../utils/extension.js'
 import fs from 'node:fs'
 import path from 'node:path'
@@ -14,15 +15,15 @@ function collectUsedAPIs(manifest, root) {
     if (manifest.action?.default_popup) files.add(manifest.action.default_popup)
     if (manifest.options_ui?.page) files.add(manifest.options_ui.page)
     if (manifest.devtools_page) files.add(manifest.devtools_page)
-    const re = { /* eslint-disable-next-line security/detect-unsafe-regex */
+    const re = { /* oxlint-disable-next-line security/detect-unsafe-regex */
         chromeAPI: /\bchrome\.\w+(?:\.\w+)*/g }
     const used = new Set()
     for (const file of files) {
         try {
-            const src = // eslint-disable-next-line security/detect-non-literal-fs-filename
+            const src = // oxlint-disable-next-line security/detect-non-literal-fs-filename
                 fs.readFileSync(path.resolve(root, file), 'utf8')
             for (const match of src.matchAll(re.chromeAPI)) used.add(match[0])
-        } catch {} // eslint-disable-line no-empty
+        } catch {}
     }
     return used
 }
@@ -54,7 +55,7 @@ export default {
                 if (perm == permission) { knownPerm = true ; break }
             if (!knownPerm) return true
             for (const api of usedAPIs)
-                if (apis.findPermission(api) == permission) return true
+                if (apiUtils.findPermission(api) == permission) return true
             return false
         }
         if (!regex.filename.manifest.test(filename)) {

package/src/rules/require-license-file.js

@@ -7,7 +7,6 @@ export default {
         type: 'problem',
         docs: {
             description: 'Requires a license file in the extension',
-            recommended: false,
             manifest: true
         },
         schema: [],
@@ -20,7 +19,7 @@ export default {
         const { filename } = context
         function check(node) {
             const pkgRoot = pkg.findRoot(path.dirname(filename))
-            if (!pkgRoot || !license.find(pkgRoot)) // eslint-disable-line e18e/prefer-array-some
+            if (!pkgRoot || !license.find(pkgRoot)) // oxlint-disable-line e18e/prefer-array-some
                 context.report({ node, messageId: 'missingFile' })
         }
         return { Program: check, Document: check }

package/src/rules/require-mv3.js

@@ -32,7 +32,8 @@ export default {
                 }
             }
         }
-        const manifest = extension.manifest.read(context) ; if (!manifest || manifest.manifest_version == 3) return {}
-        return { Program(node) { context.report({ node, messageId: 'notMV3' }) }}
+        const manifest = extension.manifest.read(context)
+        if (!manifest || manifest.manifest_version == 3) return {}
+        return { Program(node) { context.report({ node, messageId: 'notMV3' })}}
     }
 }

package/src/rules/require-short-name-when-useful.js

@@ -12,7 +12,6 @@ export default {
         docs: {
             description: 'Requires a `short_name` when `name` exceeds 12 chars',
             category: 'Stylistic Issues',
-            recommended: false,
             manifest: true
         },
         schema: [{

package/src/rules/valid-filenames.js

@@ -1,10 +1,10 @@
-/* eslint-disable security/detect-non-literal-fs-filename -- lint-time project inspection only */
+/* oxlint-disable security/detect-non-literal-fs-filename -- lint-time project inspection only */
 
 import extension from '../utils/extension.js'
 import fs from 'node:fs'
 import path from 'node:path'
 
-const re = { invalidChars: /[^\w\-.]/, reservedPrefix: /^_/ }
+const re = { invalidChars: /[^\w\-.]/ }
 
 const refKeys = [
     ['action.default_popup',      manifest => manifest.action?.default_popup],
@@ -112,7 +112,7 @@ export default {
               segments = path.relative(extRoot, filename).split(path.sep)
         if (noReservedPrefix)
             for (const seg of segments)
-                if (re.reservedPrefix.test(seg) && seg != '_locales')
+                if (seg.startsWith('_') && seg != '_locales')
                     context.report({ loc: { line: 1, column: 1 }, messageId: 'reservedPrefix', data: { name: seg }})
         if (noSpecialChars)
             for (const seg of segments)

package/src/rules/valid-license-file.js

@@ -1,10 +1,9 @@
+import array from '../utils/array.js'
 import license from '../utils/license.js'
 import path from 'node:path'
 
 import regex from '../data/regex.js'
 
-function toArray(value) { return value == null ? [] : Array.isArray(value) ? value : [value] }
-
 function validateContent(context, node, { requireSPDX, allowedLicenses }) {
     const text = context.sourceCode.text,
           id = license.spdx.parse(text)
@@ -28,7 +27,6 @@ export default {
         fixable: 'code',
         docs: {
             description: 'Validates SPDX identifiers in license files',
-            recommended: false,
             license: true
         },
         defaultOptions: [{ requireSPDX: false, allowedLicenses: [] }],
@@ -56,7 +54,7 @@ export default {
     create(context) {
         const opts = context.options[0],
             { requireSPDX } = opts,
-              allowedLicenses = toArray(opts.allowedLicenses),
+              allowedLicenses = array.to(opts.allowedLicenses),
             { filename } = context,
               basename = path.basename(filename)
         if (!regex.filename.license.test(basename) || regex.filename.script.test(basename))

package/src/rules/valid-manifest-icons.js

@@ -20,7 +20,7 @@ function validateIcons(context, icons, root, opts, loc) {
         if (typeof file != 'string') continue
         if (checkSVG && re.svg.test(file))
             context.report({ loc, messageId: 'svgNotSupported' })
-        else if (checkFiles && root // eslint-disable-next-line security/detect-non-literal-fs-filename
+        else if (checkFiles && root // oxlint-disable-next-line security/detect-non-literal-fs-filename
             && !fs.existsSync(path.resolve(root, file))
         ) context.report({ loc, messageId: 'missingFile', data: { file }})
     }
@@ -98,7 +98,7 @@ export default {
                     if (typeof file != 'string') continue
                     if (checkSVG && re.svg.test(file))
                         context.report({ node: fileNode, messageId: 'svgNotSupported' })
-                    else if (checkFiles && root // eslint-disable-next-line security/detect-non-literal-fs-filename
+                    else if (checkFiles && root // oxlint-disable-next-line security/detect-non-literal-fs-filename
                         && !fs.existsSync(path.resolve(root, file))
                     ) context.report({ node: fileNode, messageId: 'missingFile', data: { file }})
                 }

package/src/rules/valid-mv3-schema.js

@@ -85,10 +85,10 @@ export default {
                 }
             }
         }
-        const manifest = extension.manifest.read(context) ; if (!manifest || manifest.manifest_version != 3) return {}
+        const manifest = extension.manifest.read(context) ; if (manifest?.manifest_version != 3) return {}
         const isFF = manifest.browser_specific_settings != null
-        return {
-            Program(node) { /* eslint-disable security/detect-object-injection */
+        return { // oxlint-disable security/detect-object-injection
+            Program(node) {
                 for (const key of Object.keys(manifest))
                     if (manifestData.keys.mv2Only.has(key))
                         context.report({ node, messageId: 'mv2Key', data: { key, reason: 'MV2-only key' }})
@@ -117,7 +117,7 @@ export default {
                             if (!set.has(value))
                                 context.report({ node, messageId: 'invalidDataCollectionValue', data: { value, kind }})
                 }
-            } /* eslint-enable security/detect-object-injection */
-        }
+            }
+        } // oxlint-enable security/detect-object-injection
     }
 }

package/src/rules/valid-url-fields.js

@@ -6,7 +6,7 @@ import regex from '../data/regex.js'
 const re = {
     absoluteURL: /^[a-z][a-z0-9+.-]*:\/\/[^\s/]+/i,
     match: /^(\*|https?|file|ftp):\/\/([^/]*)(\/.*)$/,
-    template: /\{[^}]+\}/g
+    template: /\{[^{}]+\}/g
 }
 
 function collectStrings(obj, path = [], out = []) {
@@ -15,7 +15,7 @@ function collectStrings(obj, path = [], out = []) {
     else if (Array.isArray(obj))
         for (const elem of obj) collectStrings(elem, path, out)
     else if (typeof obj == 'object')
-        for (const key of Object.keys(obj)) // eslint-disable-next-line security/detect-object-injection
+        for (const key of Object.keys(obj)) // oxlint-disable-next-line security/detect-object-injection
             collectStrings(obj[key], [...path, key], out)
     return out
 }

package/src/rules/valid-version-field.js

@@ -1,11 +1,11 @@
 import extension from '../utils/extension.js'
 import regex from '../data/regex.js'
 
-const re = { /* eslint-disable security/detect-unsafe-regex */
+const re = { // oxlint-disable security/detect-unsafe-regex
     chromeParts: /^\d+(?:\.\d+){0,3}$/,
     date: /^\d{4}\.(?:0?[1-9]|1[0-2])\.(?:0?[1-9]|[12]\d|3[01])(?:\.\d+)?$/,
     semver: /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/
-} /* eslint-enable security/detect-unsafe-regex */
+} // oxlint-enable security/detect-unsafe-regex
 
 export default {
     meta: {

package/src/utils/api.js

@@ -0,0 +1,20 @@
+import apis from '../data/apis.js'
+
+export default {
+    findDeprecated(api) {
+        for (const [deprecated, replacement] of apis.deprecated)
+            if (api == deprecated || api.startsWith(`${deprecated}.`))
+                return { deprecated, replacement }
+        return null
+    },
+
+    findPermission(api) {
+        if (apis.permless.has(api)) return null
+        for (const [prefix, permission] of apis.permissionMap)
+            if (api == prefix || api.startsWith(`${prefix}.`))
+                return permission
+        return null
+    },
+
+    isExternalMsgListener(api) { return apis.externalMsgListeners.has(api) }
+}

package/src/utils/array.js

@@ -0,0 +1 @@
+export default { to(val) { return Array.isArray(val) ? val : val == null ? [] : [val] }}

package/src/utils/extension.js

@@ -1,4 +1,4 @@
-/* eslint-disable security/detect-non-literal-fs-filename -- lint-time test fixtures only */
+// oxlint-disable security/detect-non-literal-fs-filename
 
 import fs from 'node:fs'
 import path from 'node:path'
@@ -40,8 +40,6 @@ const utils = {
 
     manifest: {
         permission: {
-            valid: permissions.valid,
-            sensitive: permissions.sensitive,
             isValid(name, target = 'mv3') {
                 if (permissions.valid.has(name)) return true
                 if (target == 'mv3') return false

package/src/utils/html.js

@@ -0,0 +1,29 @@
+import regex from '../data/regex.js'
+
+export default {
+    isHTML(text) { return text.trimStart().startsWith('<') },
+
+    isRemote(src, allowedPrefixes) {
+        if (!src || allowedPrefixes.some(prefix => src.startsWith(prefix))) return false
+        return regex.scheme.test(src)
+    },
+
+    offsetToLoc(text, offset) {
+        let line = 1, column = 1
+        for (let i = 0; i < offset && i < text.length; i++) {
+            if (text[i] == '\n') { line++ ; column = 1 } // oxlint-disable-line security/detect-object-injection
+            else column++
+        }
+        return { line, column }
+    },
+
+    pickAttrVal(match) { return match ? (match[1] ?? match[2] ?? match[3] ?? '') : null },
+
+    re: {
+        attr: {
+            data: /\sdata\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/i,
+            src: /\ssrc\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/i,
+            type: /\stype\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/i
+        }
+    }
+}

package/src/utils/i18n.js

@@ -1,4 +1,4 @@
-/* eslint-disable security/detect-non-literal-fs-filename -- lint-time test fixtures only */
+// oxlint-disable security/detect-non-literal-fs-filename
 
 import fs from 'node:fs'
 import path from 'node:path'
@@ -7,7 +7,7 @@ import i18n from '../data/i18n.js'
 
 function templateToPattern(body) {
     const parts = body.split(i18n.re.templateExpr).map(part => part.replace(i18n.re.specialChars, '\\$&'))
-    return new RegExp(`^${parts.join('.*')}$`) // eslint-disable-line security/detect-non-literal-regexp
+    return new RegExp(`^${parts.join('.*')}$`) // oxlint-disable-line security/detect-non-literal-regexp
 }
 
 export default {

package/src/utils/init.js

@@ -1,14 +1,20 @@
 import css from '@eslint/css'
 import html from '@html-eslint/eslint-plugin'
 import json from '@eslint/json'
+import pkg from './pkg.js'
 import rulesUtils from './rules.js'
 import text from './text.js'
 
+import cssSpacing from '../rules/css-spacing.js'
 import manifestKeyOrder from '../rules/manifest-key-order.js'
 import manifestSpacing from '../rules/manifest-spacing.js'
 import noContentStyleLeak from '../rules/no-content-style-leak.js'
 import noDeprecatedAPIs from '../rules/no-deprecated-apis.js'
 import noDuplicateManifestKeys from '../rules/no-duplicate-manifest-keys.js'
+import noGlobalKeyframes from '../rules/no-global-keyframes.js'
+import noHostPageSelectors from '../rules/no-host-page-selectors.js'
+import noInlineEventHandlers from '../rules/no-inline-event-handlers.js'
+import noInlineScripts from '../rules/no-inline-scripts.js'
 import noInsecureFetch from '../rules/no-insecure-fetch.js'
 import noInsecureMessaging from '../rules/no-insecure-messaging.js'
 import noInvalidLocales from '../rules/no-invalid-locales.js'
@@ -18,6 +24,9 @@ import noMissingI18nKeys from '../rules/no-missing-i18n-keys.js'
 import noMissingPermissions from '../rules/no-missing-permissions.js'
 import noMissingWebAccessibleResources from '../rules/no-missing-web-accessible-resources.js'
 import noRemoteCode from '../rules/no-remote-code.js'
+import noRemoteObjects from '../rules/no-remote-objects.js'
+import noRemoteURLs from '../rules/no-remote-urls.js'
+import noScrollbarStyling from '../rules/no-scrollbar-styling.js'
 import noSensitivePermissions from '../rules/no-sensitive-permissions.js'
 import noUnrestrictedHostPermissions from '../rules/no-unrestricted-host-permissions.js'
 import noUnusedI18nKeys from '../rules/no-unused-i18n-keys.js'
@@ -33,15 +42,10 @@ import validServiceWorker from '../rules/valid-service-worker.js'
 import validURLfields from '../rules/valid-url-fields.js'
 import validVersionField from '../rules/valid-version-field.js'
 
-const namespace = 'chrome-extensions'
+const pkgName = pkg.getName(),
+      namespace = pkgName.replace(/^@[^/]+\//, '').replace(/^eslint-plugin-/, '')
 
 export default {
-    bundleDeprecation(plugin, [ruleId, bundleNames], pluginName) { /* eslint-disable security/detect-object-injection */
-        for (const bundleName of bundleNames)
-            if (plugin.configs[bundleName])
-                plugin.configs[bundleName].rules[`${pluginName}/${ruleId}`] = 'error'
-    }, /* eslint-enable security/detect-object-injection */
-
     configs(plugin) {
         const plugins = { [namespace]: plugin },
               rules = plugin.rules,
@@ -68,15 +72,20 @@ export default {
         }
     },
 
-    plugin() { return { rules: {}, configs: {} }},
+    plugin() { return { meta: { name: pkgName }, rules: {}, configs: {} }},
 
     rules(plugin) {
         plugin.rules = {
+            'css-spacing': cssSpacing,
             'manifest-key-order': manifestKeyOrder,
             'manifest-spacing': manifestSpacing,
             'no-content-style-leak': noContentStyleLeak,
             'no-deprecated-apis': noDeprecatedAPIs,
             'no-duplicate-manifest-keys': noDuplicateManifestKeys,
+            'no-global-keyframes': noGlobalKeyframes,
+            'no-host-page-selectors': noHostPageSelectors,
+            'no-inline-event-handlers': noInlineEventHandlers,
+            'no-inline-scripts': noInlineScripts,
             'no-insecure-fetch': noInsecureFetch,
             'no-insecure-messaging': noInsecureMessaging,
             'no-invalid-locales': noInvalidLocales,
@@ -86,6 +95,9 @@ export default {
             'no-missing-permissions': noMissingPermissions,
             'no-missing-web-accessible-resources': noMissingWebAccessibleResources,
             'no-remote-code': noRemoteCode,
+            'no-remote-objects': noRemoteObjects,
+            'no-remote-urls': noRemoteURLs,
+            'no-scrollbar-styling': noScrollbarStyling,
             'no-sensitive-permissions': noSensitivePermissions,
             'no-unrestricted-host-permissions': noUnrestrictedHostPermissions,
             'no-unused-i18n-keys': noUnusedI18nKeys,
@@ -102,6 +114,6 @@ export default {
             'valid-version-field': validVersionField
         }
         for (const [ruleId, rule] of Object.entries(plugin.rules))
-            rule.meta.docs.url = `https://codeberg.org/adamlui/eslint-plugin-${namespace}/#${ruleId}`
+            rule.meta.docs.url = `https://codeberg.org/adamlui/${pkgName}/#${ruleId}`
     }
 }

package/src/utils/license.js

@@ -1,4 +1,4 @@
-/* eslint-disable security/detect-non-literal-fs-filename -- lint-time test fixtures only */
+// oxlint-disable security/detect-non-literal-fs-filename
 
 import { createRequire } from 'node:module'
 import fs from 'node:fs'

package/src/utils/node.js

@@ -19,5 +19,7 @@ export default {
             ancestor = ancestor.parent
         }
         return false
-    }
+    },
+
+    plainType(node, prefix) { return node?.type?.replace(prefix, '') ?? '' }
 }

package/src/utils/pkg.js

@@ -1,3 +1,4 @@
+import { fileURLToPath } from 'node:url'
 import fs from 'node:fs'
 import path from 'node:path'
 
@@ -11,11 +12,27 @@ export default {
                 current = parent
                 continue
             }
-            if ( // eslint-disable-next-line security/detect-non-literal-fs-filename
+            if ( // oxlint-disable-next-line security/detect-non-literal-fs-filename
                 fs.existsSync(path.join(current, 'package.json'))) return current
             const parent = path.dirname(current)
             if (parent === current) return null
             current = parent
         }
-    }
+    },
+
+    getName() { // oxlint-disable security/detect-non-literal-fs-filename
+        let current = path.dirname(fileURLToPath(import.meta.url))
+        while (current) {
+            const pkgPath = path.join(current, 'package.json')
+            if (fs.existsSync(pkgPath))
+                try {
+                    const { name } = JSON.parse(fs.readFileSync(pkgPath, 'utf8'))
+                    if (name) return name
+                } catch { /* malformed, keep walking */ }
+            const parent = path.dirname(current)
+            if (parent === current) return null
+            current = parent
+        }
+        return null
+    } // oxlint-enable security/detect-non-literal-fs-filename
 }

package/src/utils/rules.js

@@ -1,7 +1,7 @@
 export default {
     bundle(rules, predicate, pluginName) {
         return Object.fromEntries(Object.entries(rules)
-            .filter(([, rule]) => predicate(rule))
+            .filter(([, rule]) => !rule.meta.deprecated && predicate(rule))
             .map(([ruleId]) => [`${pluginName}/${ruleId}`, 'error']))
     }
 }

package/src/data/deprecations.js

@@ -1,8 +0,0 @@
-// Delete a line to end support
-
-export default {
-    bundles: {
-        // <rule-id-a>: [<old-bundle>],
-        // <rule-id-b>: [<old-bundle>]
-    }
-}