eslint-plugin-chrome-extensions 2.7.0 → 2.8.0

package/src/rules/no-inline-scripts.js

@@ -0,0 +1,65 @@
+import array from '../utils/array.js'
+import html from '../utils/html.js'
+
+const re = {
+    nonExecutable: /^(?:application\/(?:ld\+)?json|importmap|speculationrules|text\/(?:x-)?template)$/i,
+    script: /<script\b([^>]*)>([\s\S]*?)<\/script\s*>/gi
+}
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow inline `<script>` bodies and remote `<script src>` in extension HTML',
+            category: 'Possible Errors',
+            html: true
+        },
+        defaultOptions: [{ allowedSrcPrefixes: ['chrome-extension://'] }],
+        schema: [{
+            type: 'object',
+            properties: {
+                allowedSrcPrefixes: {
+                    oneOf: [
+                        { type: 'string', description: 'A single allowed src prefix' },
+                        { type: 'array', items: { type: 'string' }, description: 'List of allowed src prefixes' }
+                    ],
+                    description: 'Additional src prefixes to permit'
+                }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            inlineBody: 'Inline `<script>` bodies are blocked by MV3\'s `script-src \'self\'`. Move the code to an external file.',
+            remoteSrc: 'Remote `<script src="{{src}}">` is blocked by MV3\'s `script-src \'self\'`. Bundle the script or use `chrome.runtime.getURL()`.'
+        }
+    },
+
+    create(context) {
+        const opts = context.options[0] || {},
+              allowedPrefixes = array.to(opts.allowedSrcPrefixes ?? ['chrome-extension://']),
+              text = context.sourceCode.text
+        let scanned = false
+        function scan() {
+            if (scanned) return
+            scanned = true
+            if (!html.isHTML(text)) return
+            for (const match of text.matchAll(re.script)) {
+                const [, attrs, body] = match,
+                      type = html.pickAttrVal(attrs.match(html.re.attr.type))
+                if (type && re.nonExecutable.test(type.trim())) continue
+                const src = html.pickAttrVal(attrs.match(html.re.attr.src))
+                if (src !== null) {
+                    const trimmed = src.trim()
+                    if (trimmed && html.isRemote(trimmed, allowedPrefixes))
+                        context.report({ loc: html.offsetToLoc(text, match.index),
+                            messageId: 'remoteSrc', data: { src: trimmed }})
+                    continue
+                }
+                if (body && body.trim().length > 0)
+                    context.report({ loc: html.offsetToLoc(text, match.index),
+                        messageId: 'inlineBody' })
+            }
+        }
+        return { 'Program:exit': scan, 'Document:exit': scan, '*': scan }
+    }
+}

package/src/rules/no-insecure-fetch.js

@@ -1,5 +1,12 @@
 const re = { insecureURL: /^http:\/\/(?!localhost\b|127\.0\.0\.1\b|\[::1\])/i }
 
+function urlFromLiteral(node) {
+    return ( node?.type == 'Literal'
+        && typeof node.value == 'string'
+        && re.insecureURL.test(node.value)
+    ) ? node.value : null
+}
+
 export default {
     meta: {
         type: 'problem',
@@ -18,12 +25,6 @@ export default {
 
     create(context) {
         const xhrVars = new Set()
-        function urlFromLiteral(node) {
-            return ( node?.type == 'Literal'
-                && typeof node.value == 'string'
-                && re.insecureURL.test(node.value)
-            ) ? node.value : null
-        }
         return {
             VariableDeclarator(node) {
                 if (node.init?.type == 'NewExpression'

package/src/rules/no-insecure-messaging.js

@@ -1,7 +1,8 @@
+import api from '../utils/api.js'
 import nodeUtils from '../utils/node.js'
-import apis from '../data/apis.js'
 
-const re = { postmsgValidation: /\b\w+\.(?:origin|source)\b/, senderValidation: /sender\.(?:id|origin)/ }
+const re = { postmsgValidation: /\b\w+\.(?:origin|source)\b/, senderValidation: /sender\.(?:id|origin)/ },
+      isMessageTarget = obj => obj?.type == 'Identifier' && ['self', 'window'].includes(obj.name)
 
 export default {
     meta: {
@@ -40,13 +41,12 @@ export default {
             if (re.postmsgValidation.test(body)) return
             context.report({ node, messageId: 'unvalidatedPostMessage', data: { target }})
         }
-        function isMessageTarget(obj) { return obj?.type == 'Identifier' && ['self', 'window'].includes(obj.name) }
         return {
             CallExpression(node) {
                 if (node.callee.type != 'MemberExpression') return
                 const path = nodeUtils.getMemberPath(node.callee) ; if (!path) return
                 const listenerRoot = path.endsWith('.addListener') ? path.slice(0, -'.addListener'.length) : null
-                if (listenerRoot && apis.isExternalMsgListener(listenerRoot)) {
+                if (listenerRoot && api.isExternalMsgListener(listenerRoot)) {
                     const handler = node.arguments[0] ; if (!handler) return
                     const body = context.sourceCode.getText(handler)
                     if (!re.senderValidation.test(body))

package/src/rules/no-invalid-locales.js

@@ -1,5 +1,3 @@
-/* eslint-disable security/detect-non-literal-fs-filename -- lint-time project inspection only */
-
 import extension from '../utils/extension.js'
 import fs from 'node:fs'
 import i18nUtils from '../utils/i18n.js'
@@ -51,11 +49,11 @@ export default {
               root = extension.findRoot(context)
         if (root) {
             const localesDir = path.join(root, '_locales')
-            try {
+            try { // oxlint-disable-next-line security/detect-non-literal-fs-filename
                 for (const entry of fs.readdirSync(localesDir, { withFileTypes: true }))
                     if (entry.isDirectory() && isInvalid(entry.name)) invalidFolders.push(entry.name)
-                invalidFolders.sort()
-            } catch {} // eslint-disable-line no-empty
+                invalidFolders.sort((a, b) => a < b ? -1 : a > b ? 1 : 0)
+            } catch {}
         }
         const loc = { line: 1, column: 1 }
         if (!isManifest) {

package/src/rules/no-missing-default-locale.js

@@ -1,4 +1,4 @@
-/* eslint-disable security/detect-non-literal-fs-filename -- lint-time project inspection only */
+/* oxlint-disable security/detect-non-literal-fs-filename */
 
 import extension from '../utils/extension.js'
 import fs from 'node:fs'

package/src/rules/no-missing-permissions.js

@@ -1,8 +1,7 @@
+import apiUtils from '../utils/api.js'
 import extension from '../utils/extension.js'
 import nodeUtils from '../utils/node.js'
 
-import apis from '../data/apis.js'
-
 function queriesActiveTab(node) {
     const arg = node.arguments[0] ; if (arg?.type != 'ObjectExpression') return false
     return arg.properties.some(prop => {
@@ -34,7 +33,7 @@ export default {
             CallExpression(node) {
                 if (node.callee.type != 'MemberExpression') return
                 const api = nodeUtils.getMemberPath(node.callee) ; if (!api) return
-                const permission = apis.findPermission(api) ; if (!permission || declared.has(permission)) return
+                const permission = apiUtils.findPermission(api) ; if (!permission || declared.has(permission)) return
                 const isActiveTabQuery = permission == 'tabs' && queriesActiveTab(node)
                 if (isActiveTabQuery && declared.has('activeTab')) return
                 const messageId = `missing${ isActiveTabQuery ? 'ActiveTab' : 'Permission' }`

package/src/rules/no-missing-web-accessible-resources.js

@@ -16,8 +16,8 @@ function collectWARpatterns(manifest) {
 }
 
 function patternToRegex(pattern) {
-    const escaped = pattern.replace(re.regexSpecial, '\\$&').replace(/\*/g, '.*')
-    return new RegExp(`^${escaped}$`) // eslint-disable-line security/detect-non-literal-regexp
+    const escaped = pattern.replaceAll(re.regexSpecial, '\\$&').replaceAll('*', '.*')
+    return new RegExp(`^${escaped}$`) // oxlint-disable-line security/detect-non-literal-regexp
 }
 
 export default {

package/src/rules/no-remote-code.js

@@ -3,6 +3,38 @@ import nodeUtils from '../utils/node.js'
 import manifest from '../data/manifest.js'
 import regex from '../data/regex.js'
 
+const re = { inlineHandler: /^on[a-z]+$/i, inlineHandlerInHTML: /\son[a-z]+\s*=/i }
+
+function isCreateScript(node) {
+    return node?.type == 'CallExpression'
+        && node.callee?.property?.name == 'createElement'
+        && node.arguments[0]?.value == 'script'
+}
+function isInlineHandlerInString(node) {
+    return node?.type == 'Literal'
+        && typeof node.value == 'string'
+        && re.inlineHandlerInHTML.test(node.value)
+}
+function isLiteralURL(node) {
+    return node?.type == 'Literal'
+        && typeof node.value == 'string'
+        && regex.url.test(node.value)
+}
+function isObjectAssign(node) {
+    return node?.type == 'CallExpression'
+        && node.callee?.type == 'MemberExpression'
+        && node.callee.object?.name == 'Object'
+        && node.callee.property?.name == 'assign'
+}
+function isScriptSrcProperty(node) {
+    const obj = node.parent
+    if (obj?.type != 'ObjectExpression') return false
+    const parent = obj.parent
+    if (isCreateScript(parent)) return true
+    if (isObjectAssign(parent) && isCreateScript(parent.arguments[0])) return true
+    return false
+}
+
 export default {
     meta: {
         type: 'problem',
@@ -13,8 +45,7 @@ export default {
             security: true
         },
         defaultOptions: [{
-            patterns: ['eval', 'new-function', 'string-timer',
-                'dynamic-import', 'remote-script-src', 'execute-script-url'],
+            patterns: manifest.patterns.remoteCode,
             checkExecuteScriptClosures: true
         }],
         schema: [{
@@ -39,31 +70,17 @@ export default {
             dynamicImport: 'Remote dynamic `import()` is forbidden under MV3\'s CSP. Use a relative path instead.',
             remoteScriptSrc: 'Injecting remote `<script src>` is forbidden under MV3\'s CSP. Use `chrome.runtime.getURL()` for bundled scripts instead.',
             executeScriptURL: '`chrome.scripting.executeScript` must use local `files`, not a remote URL.',
-            executeScriptClosure: '`chrome.scripting.executeScript({ func })` captures outer-scope variables that fail after serialization. Pass them via `args` instead.'
+            executeScriptClosure: '`chrome.scripting.executeScript({ func })` captures outer-scope variables that fail after serialization. Pass them via `args` instead.',
+            inlineEventHandler: 'Inline event handler `{{attr}}` is blocked by MV3\'s `script-src \'self\'`. Use `addEventListener()` instead.',
+            inlineScriptBody: 'Inline `<script>` body injection is blocked by MV3\'s `script-src \'self\'`. Move the code to an external file.'
         }
     },
 
     create(context) {
         const opts = context.options[0] || {},
-              patterns = new Set(opts.patterns || manifest.regexmoteCode),
+              patterns = new Set(opts.patterns || manifest.patterns.remoteCode),
               checkClosures = opts.checkExecuteScriptClosures !== false,
               scriptElems = new Set()
-        function isCreateScript(node) {
-            return node?.type == 'CallExpression'
-                && node.callee?.property?.name == 'createElement'
-                && node.arguments[0]?.value == 'script'
-        }
-        function isLiteralURL(node) {
-            return node?.type == 'Literal'
-                && typeof node.value == 'string'
-                && regex.url.test(node.value)
-        }
-        function isObjectAssign(node) {
-            return node?.type == 'CallExpression'
-                && node.callee?.type == 'MemberExpression'
-                && node.callee.object?.name == 'Object'
-                && node.callee.property?.name == 'assign'
-        }
         function isScriptSrcAssignment(left, right) {
             if (left.type != 'MemberExpression') return false
             if (left.property?.name != 'src') return false
@@ -72,12 +89,10 @@ export default {
             if (left.object.type == 'Identifier' && scriptElems.has(left.object.name)) return true
             return false
         }
-        function isScriptSrcProperty(node) {
-            const obj = node.parent
-            if (obj?.type != 'ObjectExpression') return false
-            const parent = obj.parent
-            if (isCreateScript(parent)) return true
-            if (isObjectAssign(parent) && isCreateScript(parent.arguments[0])) return true
+        function isScriptElement(node) {
+            if (!node) return false
+            if (isCreateScript(node)) return true
+            if (node.type == 'Identifier' && scriptElems.has(node.name)) return true
             return false
         }
         return {
@@ -112,12 +127,31 @@ export default {
                         if (optsNode?.type != 'ObjectExpression') return
                         const urlProp = optsNode.properties.find(prop => prop.key?.name == 'url'),
                               funcProp = optsNode.properties.find(prop => prop.key?.name == 'func'),
-                              argsProp = optsNode.properties.find(prop => prop.key?.name == 'args')
+                              hasArgs = optsNode.properties.some(prop => prop.key?.name == 'args')
                         if (patterns.has('execute-script-url') && urlProp)
                             context.report({ node: urlProp, messageId: 'executeScriptURL' })
-                        if (checkClosures && funcProp && !argsProp)
+                        if (checkClosures && funcProp && !hasArgs)
                             context.report({ node: funcProp, messageId: 'executeScriptClosure' })
                     }
+                    if (patterns.has('inline-event-handler')
+                        && node.callee.property?.name == 'setAttribute'
+                        && node.arguments[0]?.type == 'Literal'
+                        && typeof node.arguments[0].value == 'string'
+                        && re.inlineHandler.test(node.arguments[0].value)
+                    ) context.report({ node, messageId: 'inlineEventHandler',
+                        data: { attr: node.arguments[0].value.toLowerCase() }})
+                    if (patterns.has('inline-event-handler')
+                        && node.callee.property?.name == 'insertAdjacentHTML'
+                        && isInlineHandlerInString(node.arguments[1])
+                    ) context.report({ node: node.arguments[1], messageId: 'inlineEventHandler',
+                        data: { attr: 'on*' }})
+                    if (patterns.has('inline-script-body')
+                        && ['append', 'prepend'].includes(node.callee.property?.name)
+                        && isScriptElement(node.callee.object)
+                        && node.arguments[0]?.type == 'Literal'
+                        && typeof node.arguments[0].value == 'string'
+                        && node.arguments[0].value.trim().length > 0
+                    ) context.report({ node: node.arguments[0], messageId: 'inlineScriptBody' })
                 }
             },
             NewExpression(node) {
@@ -125,6 +159,21 @@ export default {
                     context.report({ node, messageId: 'newFunction' })
             },
             AssignmentExpression(node) {
+                if (patterns.has('inline-event-handler')
+                    && node.left.type == 'MemberExpression'
+                    && ['innerHTML', 'outerHTML'].includes(node.left.property?.name)
+                    && !isScriptElement(node.left.object)
+                    && isInlineHandlerInString(node.right)
+                ) context.report({ node: node.right, messageId: 'inlineEventHandler',
+                    data: { attr: 'on*' }})
+                if (patterns.has('inline-script-body')
+                    && node.left.type == 'MemberExpression'
+                    && ['textContent', 'innerText', 'innerHTML', 'text'].includes(node.left.property?.name)
+                    && isScriptElement(node.left.object)
+                    && node.right?.type == 'Literal'
+                    && typeof node.right.value == 'string'
+                    && node.right.value.trim().length > 0
+                ) context.report({ node, messageId: 'inlineScriptBody' })
                 if (!patterns.has('remote-script-src')) return
                 if (isScriptSrcAssignment(node.left, node.right))
                     context.report({ node: node.right, messageId: 'remoteScriptSrc' })

package/src/rules/no-remote-objects.js

@@ -0,0 +1,55 @@
+import array from '../utils/array.js'
+import html from '../utils/html.js'
+
+const re = { objectTag: /<(?:object|embed)\b([^>]*)>/gi }
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow remote `<object data>` and `<embed src>` in extension HTML',
+            category: 'Possible Errors',
+            html: true
+        },
+        defaultOptions: [{ allowedPrefixes: ['chrome-extension://'] }],
+        schema: [{
+            type: 'object',
+            properties: {
+                allowedPrefixes: {
+                    oneOf: [
+                        { type: 'string', description: 'A single allowed prefix' },
+                        { type: 'array', items: { type: 'string' }, description: 'List of allowed prefixes' }
+                    ],
+                    description: 'Additional prefixes to permit'
+                }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            remoteObject: 'Remote `<{{tag}} {{attr}}="{{src}}">` is blocked by MV3\'s `object-src \'self\'`. '
+                        + 'Bundle the resource or use `chrome.runtime.getURL()`.'
+        }
+    },
+
+    create(context) {
+        const opts = context.options[0] || {},
+              allowedPrefixes = array.to(opts.allowedPrefixes ?? ['chrome-extension://']),
+              text = context.sourceCode.text
+        let scanned = false
+        function scan() {
+            if (scanned) return
+            scanned = true
+            if (!html.isHTML(text)) return
+            for (const match of text.matchAll(re.objectTag)) {
+                const [full, attrs] = match,
+                       tag = full.trimStart().toLowerCase().startsWith('<object') ? 'object' : 'embed',
+                       attr = tag == 'object' ? 'data' : 'src',
+                       val = html.pickAttrVal(attrs.match(tag == 'object' ? html.re.attr.data : html.re.attr.src))
+                if (val !== null && html.isRemote(val.trim(), allowedPrefixes))
+                    context.report({ loc: html.offsetToLoc(text, match.index), messageId: 'remoteObject',
+                        data: { tag, attr, src: val.trim() }})
+            }
+        }
+        return { 'Program:exit': scan, 'Document:exit': scan, '*': scan }
+    }
+}

package/src/rules/no-remote-urls.js

@@ -1,6 +1,24 @@
 import array from '../utils/array.js'
+import regex from '../data/regex.js'
 
-const re = { urlScheme: /^(?:([a-z][a-z0-9+.-]*):|\/\/)/i }
+function getPreludeURLnode(prelude) {
+    if (!prelude) return null
+    if (['Url', 'CSSUrl', 'String', 'CSSString'].includes(prelude.type))
+        return prelude
+    for (const child of prelude.children ?? [])
+        if (['Url', 'CSSUrl', 'String', 'CSSString'].includes(child.type))
+            return child
+    return null
+}
+function getURLstr(node) {
+    if (!node) return null
+    if (typeof node == 'string') return node
+    if (typeof node.url == 'string') return node.url
+    if (typeof node.value == 'string') return node.value
+    if (node.value && typeof node.value == 'object' && typeof node.value.value == 'string')
+        return node.value.value
+    return null
+}
 
 export default {
     meta: {
@@ -46,24 +64,6 @@ export default {
               allowedSchemes = new Set(array.to(opts.allowedSchemes ?? ['blob', 'chrome-extension', 'data'])),
               patterns = new Set(array.to(opts.patterns ?? ['at-import', 'url'])),
               handledURLs = new WeakSet()
-        function getPreludeURLnode(prelude) {
-            if (!prelude) return null
-            if (['Url', 'CSSUrl', 'String', 'CSSString'].includes(prelude.type))
-                return prelude
-            for (const child of prelude.children ?? [])
-                if (['Url', 'CSSUrl', 'String', 'CSSString'].includes(child.type))
-                    return child
-            return null
-        }
-        function getURLstr(node) {
-            if (!node) return null
-            if (typeof node == 'string') return node
-            if (typeof node.url == 'string') return node.url
-            if (typeof node.value == 'string') return node.value
-            if (node.value && typeof node.value == 'object' && typeof node.value.value == 'string')
-                return node.value.value
-            return null
-        }
         function handleAtrule(node) {
             if (!node.prelude) return
             if (node.name == 'import' && patterns.has('at-import')) {
@@ -90,7 +90,7 @@ export default {
         }
         function isRemote(str) {
             if (typeof str != 'string') return false
-            const match = str.match(re.urlScheme)
+            const match = regex.scheme.exec(str)
             if (!match) return false
             if (match[0] == '//') return true
             const scheme = (match[1] || '').toLowerCase()

package/src/rules/no-scrollbar-styling.js

@@ -1,8 +1,8 @@
 import array from '../utils/array.js'
-import regex from '../data/regex.js'
+import node from '../utils/node.js'
 
 const re = {
-    scrollbarPseudo: /^(?:-webkit-)?scrollbar(?:-[\w-]+)?$/i } // eslint-disable-line security/detect-unsafe-regex
+    scrollbarPseudo: /^(?:-webkit-)?scrollbar(?:-[\w-]+)?$/i } // oxlint-disable-line security/detect-unsafe-regex
 
 export default {
     meta: {
@@ -43,31 +43,29 @@ export default {
                 hasQualifier = false,
                 pastFirstCompound = false
             for (const simple of selector.children ?? []) {
-                const type = plainType(simple)
+                const type = node.plainType(simple)
                 if (type == 'Combinator') { pastFirstCompound = true; continue }
                 if (type == 'PseudoElementSelector' && re.scrollbarPseudo.test(simple.name ?? '')) {
                     hasScrollbarPseudo = true
                     continue
                 }
                 if (pastFirstCompound) continue
-                if (type == 'ClassSelector' || type == 'IdSelector' || type == 'AttributeSelector')
-                    hasQualifier = true
-                else if (type == 'PseudoClassSelector' && (simple.name ?? '').toLowerCase().startsWith('host'))
-                    hasQualifier = true
+                if (['AttributeSelector', 'ClassSelector', 'IdSelector'].includes(type)
+                    || (type == 'PseudoClassSelector' && (simple.name ?? '').toLowerCase().startsWith('host'))
+                ) hasQualifier = true
             }
             if (hasScrollbarPseudo && !hasQualifier)
                 context.report({ node: selector, messageId: 'noScrollbarStyling', data: { selector: text }})
         }
         function getSelectorText(selector) {
-            const range = selector.range
-            if (range && range.length == 2) return context.sourceCode.text.slice(range[0], range[1])
+            const { range } = selector
+            if (range?.length == 2) return context.sourceCode.text.slice(range[0], range[1])
             return context.sourceCode.getText(selector)
         }
         function handleRule(node) {
             for (const selector of node.prelude?.children ?? [])
                 checkSelector(selector)
         }
-        function plainType(node) { return node?.type?.replace(regex.prefix.css, '') ?? '' }
         return { Rule: handleRule, CSSRule: handleRule }
     }
 }

package/src/rules/no-unrestricted-host-permissions.js

@@ -58,7 +58,7 @@ export default {
         return {
             'Program:exit'() {
                 for (const key of hostKeys) {
-                    const patterns = manifest[key] // eslint-disable-line security/detect-object-injection
+                    const patterns = manifest[key] // oxlint-disable-line security/detect-object-injection
                     if (!Array.isArray(patterns)) continue
                     for (const pattern of patterns)
                         if (isBroad(pattern))

package/src/rules/no-unused-permissions.js

@@ -1,3 +1,4 @@
+import apiUtils from '../utils/api.js'
 import extension from '../utils/extension.js'
 import fs from 'node:fs'
 import path from 'node:path'
@@ -14,15 +15,15 @@ function collectUsedAPIs(manifest, root) {
     if (manifest.action?.default_popup) files.add(manifest.action.default_popup)
     if (manifest.options_ui?.page) files.add(manifest.options_ui.page)
     if (manifest.devtools_page) files.add(manifest.devtools_page)
-    const re = { /* eslint-disable-next-line security/detect-unsafe-regex */
+    const re = { /* oxlint-disable-next-line security/detect-unsafe-regex */
         chromeAPI: /\bchrome\.\w+(?:\.\w+)*/g }
     const used = new Set()
     for (const file of files) {
         try {
-            const src = // eslint-disable-next-line security/detect-non-literal-fs-filename
+            const src = // oxlint-disable-next-line security/detect-non-literal-fs-filename
                 fs.readFileSync(path.resolve(root, file), 'utf8')
             for (const match of src.matchAll(re.chromeAPI)) used.add(match[0])
-        } catch {} // eslint-disable-line no-empty
+        } catch {}
     }
     return used
 }
@@ -54,7 +55,7 @@ export default {
                 if (perm == permission) { knownPerm = true ; break }
             if (!knownPerm) return true
             for (const api of usedAPIs)
-                if (apis.findPermission(api) == permission) return true
+                if (apiUtils.findPermission(api) == permission) return true
             return false
         }
         if (!regex.filename.manifest.test(filename)) {

package/src/rules/require-license-file.js

@@ -19,7 +19,7 @@ export default {
         const { filename } = context
         function check(node) {
             const pkgRoot = pkg.findRoot(path.dirname(filename))
-            if (!pkgRoot || !license.find(pkgRoot)) // eslint-disable-line e18e/prefer-array-some
+            if (!pkgRoot || !license.find(pkgRoot)) // oxlint-disable-line e18e/prefer-array-some
                 context.report({ node, messageId: 'missingFile' })
         }
         return { Program: check, Document: check }

package/src/rules/require-mv3.js

@@ -32,7 +32,8 @@ export default {
                 }
             }
         }
-        const manifest = extension.manifest.read(context) ; if (!manifest || manifest.manifest_version == 3) return {}
-        return { Program(node) { context.report({ node, messageId: 'notMV3' }) }}
+        const manifest = extension.manifest.read(context)
+        if (!manifest || manifest.manifest_version == 3) return {}
+        return { Program(node) { context.report({ node, messageId: 'notMV3' })}}
     }
 }

package/src/rules/valid-filenames.js

@@ -1,10 +1,10 @@
-/* eslint-disable security/detect-non-literal-fs-filename -- lint-time project inspection only */
+/* oxlint-disable security/detect-non-literal-fs-filename -- lint-time project inspection only */
 
 import extension from '../utils/extension.js'
 import fs from 'node:fs'
 import path from 'node:path'
 
-const re = { invalidChars: /[^\w\-.]/, reservedPrefix: /^_/ }
+const re = { invalidChars: /[^\w\-.]/ }
 
 const refKeys = [
     ['action.default_popup',      manifest => manifest.action?.default_popup],
@@ -112,7 +112,7 @@ export default {
               segments = path.relative(extRoot, filename).split(path.sep)
         if (noReservedPrefix)
             for (const seg of segments)
-                if (re.reservedPrefix.test(seg) && seg != '_locales')
+                if (seg.startsWith('_') && seg != '_locales')
                     context.report({ loc: { line: 1, column: 1 }, messageId: 'reservedPrefix', data: { name: seg }})
         if (noSpecialChars)
             for (const seg of segments)

package/src/rules/valid-manifest-icons.js

@@ -20,7 +20,7 @@ function validateIcons(context, icons, root, opts, loc) {
         if (typeof file != 'string') continue
         if (checkSVG && re.svg.test(file))
             context.report({ loc, messageId: 'svgNotSupported' })
-        else if (checkFiles && root // eslint-disable-next-line security/detect-non-literal-fs-filename
+        else if (checkFiles && root // oxlint-disable-next-line security/detect-non-literal-fs-filename
             && !fs.existsSync(path.resolve(root, file))
         ) context.report({ loc, messageId: 'missingFile', data: { file }})
     }
@@ -98,7 +98,7 @@ export default {
                     if (typeof file != 'string') continue
                     if (checkSVG && re.svg.test(file))
                         context.report({ node: fileNode, messageId: 'svgNotSupported' })
-                    else if (checkFiles && root // eslint-disable-next-line security/detect-non-literal-fs-filename
+                    else if (checkFiles && root // oxlint-disable-next-line security/detect-non-literal-fs-filename
                         && !fs.existsSync(path.resolve(root, file))
                     ) context.report({ node: fileNode, messageId: 'missingFile', data: { file }})
                 }

package/src/rules/valid-mv3-schema.js

@@ -85,10 +85,10 @@ export default {
                 }
             }
         }
-        const manifest = extension.manifest.read(context) ; if (!manifest || manifest.manifest_version != 3) return {}
+        const manifest = extension.manifest.read(context) ; if (manifest?.manifest_version != 3) return {}
         const isFF = manifest.browser_specific_settings != null
-        return {
-            Program(node) { /* eslint-disable security/detect-object-injection */
+        return { // oxlint-disable security/detect-object-injection
+            Program(node) {
                 for (const key of Object.keys(manifest))
                     if (manifestData.keys.mv2Only.has(key))
                         context.report({ node, messageId: 'mv2Key', data: { key, reason: 'MV2-only key' }})
@@ -117,7 +117,7 @@ export default {
                             if (!set.has(value))
                                 context.report({ node, messageId: 'invalidDataCollectionValue', data: { value, kind }})
                 }
-            } /* eslint-enable security/detect-object-injection */
-        }
+            }
+        } // oxlint-enable security/detect-object-injection
     }
 }