eslint-plugin-chrome-extensions 2.7.0 → 2.8.1

package/src/data/apis.js

@@ -19,7 +19,7 @@ export default {
         ['chrome.pageAction.setPopup',         'chrome.action.setPopup'],
         ['chrome.pageAction.getTitle',         'chrome.action.getTitle'],
         ['chrome.pageAction.getPopup',         'chrome.action.getPopup'],
-        ['chrome.pageAction',                  'chrome.action'], // must stay after pageAction.* — prefix match
+        ['chrome.pageAction',                  'chrome.action'],
         ['chrome.tabs.executeScript',          'chrome.scripting.executeScript'],
         ['chrome.tabs.getAllInWindow',         'chrome.tabs.query({ currentWindow: true })'],
         ['chrome.tabs.getSelected',            'chrome.tabs.query({ active: true })'],
@@ -31,77 +31,77 @@ export default {
     ]),
     externalMsgListeners: new Set(['chrome.runtime.onMessageExternal', 'chrome.runtime.onConnectExternal']),
     permissionMap: new Map([
-        ['chrome.accessibilityFeatures.set',    'accessibilityFeatures.modify'],
-        ['chrome.accessibilityFeatures.clear',  'accessibilityFeatures.modify'],
-        ['chrome.accessibilityFeatures',        'accessibilityFeatures.read'],
-        ['chrome.alarms',                       'alarms'],
-        ['chrome.audio',                        'audio'],
-        ['chrome.bookmarks',                    'bookmarks'],
-        ['chrome.browsingData',                 'browsingData'],
-        ['chrome.certificateProvider',          'certificateProvider'],
-        ['chrome.contentSettings',              'contentSettings'],
-        ['chrome.contextMenus',                 'contextMenus'],
-        ['chrome.cookies',                      'cookies'],
-        ['chrome.debugger',                     'debugger'],
-        ['chrome.declarativeContent',           'declarativeContent'],
-        ['chrome.declarativeNetRequest',        'declarativeNetRequest'],
-        ['chrome.dns',                          'dns'],
-        ['chrome.desktopCapture',               'desktopCapture'],
-        ['chrome.documentScan',                 'documentScan'],
-        ['chrome.downloads.open',               'downloads.open'],
-        ['chrome.downloads.setUiOptions',       'downloads.ui'],
-        ['chrome.downloads',                    'downloads'],
-        ['chrome.enterprise.deviceAttributes',    'enterprise.deviceAttributes'],
-        ['chrome.enterprise.hardwarePlatform',    'enterprise.hardwarePlatform'],
-        ['chrome.enterprise.networkingAttributes','enterprise.networkingAttributes'],
-        ['chrome.enterprise.platformKeys',        'enterprise.platformKeys'],
-        ['chrome.favicon',                      'favicon'],
-        ['chrome.fileBrowserHandler',           'fileBrowserHandler'],
-        ['chrome.fontSettings',                 'fontSettings'],
-        ['chrome.gcm',                          'gcm'],
-        ['chrome.instanceID',                   'gcm'],
-        ['chrome.history',                      'history'],
-        ['chrome.identity.getProfileUserInfo',  'identity.email'],
-        ['chrome.identity',                     'identity'],
-        ['chrome.idle',                         'idle'],
-        ['chrome.loginState',                   'loginState'],
-        ['chrome.management',                   'management'],
-        ['chrome.runtime.connectNative',        'nativeMessaging'],
-        ['chrome.runtime.sendNativeMessage',    'nativeMessaging'],
-        ['chrome.notifications',                'notifications'],
-        ['chrome.offscreen',                    'offscreen'],
-        ['chrome.pageCapture',                  'pageCapture'],
-        ['chrome.platformKeys',                 'platformKeys'],
-        ['chrome.power',                        'power'],
-        ['chrome.printerProvider',              'printerProvider'],
-        ['chrome.printingMetrics',              'printingMetrics'],
-        ['chrome.printing',                     'printing'],
-        ['chrome.privacy',                      'privacy'],
-        ['chrome.processes',                    'processes'],
-        ['chrome.proxy',                        'proxy'],
-        ['chrome.publicSuffix',                 'publicSuffix'],
-        ['chrome.readingList',                  'readingList'],
-        ['chrome.scripting',                    'scripting'],
-        ['chrome.search',                       'search'],
-        ['chrome.sessions',                     'sessions'],
-        ['chrome.sidePanel',                    'sidePanel'],
-        ['chrome.storage',                      'storage'],
-        ['chrome.system.cpu',                   'system.cpu'],
-        ['chrome.system.display',               'system.display'],
-        ['chrome.system.memory',                'system.memory'],
-        ['chrome.system.storage',               'system.storage'],
-        ['chrome.tabCapture',                   'tabCapture'],
-        ['chrome.tabGroups',                    'tabGroups'],
-        ['chrome.tabs.query',                   'tabs'],
-        ['chrome.topSites',                     'topSites'],
-        ['chrome.ttsEngine',                    'ttsEngine'],
-        ['chrome.tts',                          'tts'],
-        ['chrome.userScripts',                  'userScripts'],
-        ['chrome.vpnProvider',                  'vpnProvider'],
-        ['chrome.wallpaper',                    'wallpaper'],
-        ['chrome.webAuthenticationProxy',       'webAuthenticationProxy'],
-        ['chrome.webNavigation',                'webNavigation'],
-        ['chrome.webRequest',                   'webRequest']
+        ['chrome.accessibilityFeatures.set',        'accessibilityFeatures.modify'],
+        ['chrome.accessibilityFeatures.clear',      'accessibilityFeatures.modify'],
+        ['chrome.accessibilityFeatures',            'accessibilityFeatures.read'],
+        ['chrome.alarms',                           'alarms'],
+        ['chrome.audio',                            'audio'],
+        ['chrome.bookmarks',                        'bookmarks'],
+        ['chrome.browsingData',                     'browsingData'],
+        ['chrome.certificateProvider',              'certificateProvider'],
+        ['chrome.contentSettings',                  'contentSettings'],
+        ['chrome.contextMenus',                     'contextMenus'],
+        ['chrome.cookies',                          'cookies'],
+        ['chrome.debugger',                         'debugger'],
+        ['chrome.declarativeContent',               'declarativeContent'],
+        ['chrome.declarativeNetRequest',            'declarativeNetRequest'],
+        ['chrome.dns',                              'dns'],
+        ['chrome.desktopCapture',                   'desktopCapture'],
+        ['chrome.documentScan',                     'documentScan'],
+        ['chrome.downloads.open',                   'downloads.open'],
+        ['chrome.downloads.setUiOptions',           'downloads.ui'],
+        ['chrome.downloads',                        'downloads'],
+        ['chrome.enterprise.deviceAttributes',      'enterprise.deviceAttributes'],
+        ['chrome.enterprise.hardwarePlatform',      'enterprise.hardwarePlatform'],
+        ['chrome.enterprise.networkingAttributes',  'enterprise.networkingAttributes'],
+        ['chrome.enterprise.platformKeys',          'enterprise.platformKeys'],
+        ['chrome.favicon',                          'favicon'],
+        ['chrome.fileBrowserHandler',               'fileBrowserHandler'],
+        ['chrome.fontSettings',                     'fontSettings'],
+        ['chrome.gcm',                              'gcm'],
+        ['chrome.instanceID',                       'gcm'],
+        ['chrome.history',                          'history'],
+        ['chrome.identity.getProfileUserInfo',      'identity.email'],
+        ['chrome.identity',                         'identity'],
+        ['chrome.idle',                             'idle'],
+        ['chrome.loginState',                       'loginState'],
+        ['chrome.management',                       'management'],
+        ['chrome.runtime.connectNative',            'nativeMessaging'],
+        ['chrome.runtime.sendNativeMessage',        'nativeMessaging'],
+        ['chrome.notifications',                    'notifications'],
+        ['chrome.offscreen',                        'offscreen'],
+        ['chrome.pageCapture',                      'pageCapture'],
+        ['chrome.platformKeys',                     'platformKeys'],
+        ['chrome.power',                            'power'],
+        ['chrome.printerProvider',                  'printerProvider'],
+        ['chrome.printingMetrics',                  'printingMetrics'],
+        ['chrome.printing',                         'printing'],
+        ['chrome.privacy',                          'privacy'],
+        ['chrome.processes',                        'processes'],
+        ['chrome.proxy',                            'proxy'],
+        ['chrome.publicSuffix',                     'publicSuffix'],
+        ['chrome.readingList',                      'readingList'],
+        ['chrome.scripting',                        'scripting'],
+        ['chrome.search',                           'search'],
+        ['chrome.sessions',                         'sessions'],
+        ['chrome.sidePanel',                        'sidePanel'],
+        ['chrome.storage',                          'storage'],
+        ['chrome.system.cpu',                       'system.cpu'],
+        ['chrome.system.display',                   'system.display'],
+        ['chrome.system.memory',                    'system.memory'],
+        ['chrome.system.storage',                   'system.storage'],
+        ['chrome.tabCapture',                       'tabCapture'],
+        ['chrome.tabGroups',                        'tabGroups'],
+        ['chrome.tabs.query',                       'tabs'],
+        ['chrome.topSites',                         'topSites'],
+        ['chrome.ttsEngine',                        'ttsEngine'],
+        ['chrome.tts',                              'tts'],
+        ['chrome.userScripts',                      'userScripts'],
+        ['chrome.vpnProvider',                      'vpnProvider'],
+        ['chrome.wallpaper',                        'wallpaper'],
+        ['chrome.webAuthenticationProxy',           'webAuthenticationProxy'],
+        ['chrome.webNavigation',                    'webNavigation'],
+        ['chrome.webRequest',                       'webRequest']
     ]),
     permless: new Set([
         'chrome.i18n',
@@ -112,7 +112,7 @@ export default {
         'chrome.runtime.getManifest',
         'chrome.runtime.getPlatformInfo',
         'chrome.runtime.getURL',
-        'chrome.runtime.onBrowserUpdateAvailable', // eslint-disable-line no-secrets/no-secrets
+        'chrome.runtime.onBrowserUpdateAvailable', // oxlint-disable-line no-secrets/no-secrets
         'chrome.runtime.onConnect',
         'chrome.runtime.onConnectExternal',
         'chrome.runtime.onInstalled',
@@ -149,19 +149,5 @@ export default {
         'chrome.tabs.sendMessage',
         'chrome.tabs.update',
         'chrome.windows'
-    ]),
-    findDeprecated(api) {
-        for (const [deprecated, replacement] of this.deprecated)
-            if (api == deprecated || api.startsWith(`${deprecated}.`))
-                return { deprecated, replacement }
-        return null
-    },
-    findPermission(api) {
-        if (this.permless.has(api)) return null
-        for (const [prefix, permission] of this.permissionMap)
-            if (api == prefix || api.startsWith(`${prefix}.`))
-                return permission
-        return null
-    },
-    isExternalMsgListener(api) { return this.externalMsgListeners.has(api) }
+    ])
 }

package/src/data/manifest.js

@@ -60,6 +60,8 @@ export default {
     },
     patterns: {
         remoteCode: [
-            'eval', 'new-function', 'string-timer', 'dynamic-import', 'remote-script-src', 'execute-script-url']
+            'dynamic-import', 'eval', 'execute-script-url', 'inline-event-handler', 'inline-script-body',
+            'new-function', 'remote-script-src', 'string-timer'
+        ]
     }
 }

package/src/data/regex.js

@@ -1,11 +1,12 @@
 export default {
     filename: {
         css: /\.css$/i,
-        license: // eslint-disable-next-line security/detect-unsafe-regex
+        license: // oxlint-disable-next-line security/detect-unsafe-regex
             /^(?:[\w.-]*-)?(?:LICEN[SC]E|COPYING)(?:[-.][\w.-]+)?$/i,
         manifest: /manifest\.json$/,
         script: /\.[cm]?[jt]sx?$/i
     },
     prefix: { at: /^@/, css: /^CSS/ },
+    scheme: /^(?:([a-z][a-z0-9+.-]*):|\/\/)/i,
     url: /^https?:\/\//
 }

package/src/index.d.ts

@@ -0,0 +1,42 @@
+type RuleSeverity = 0 | 1 | 2 | 'off' | 'warn' | 'error'
+type RuleSetting = RuleSeverity | [RuleSeverity, ...unknown[]]
+
+type ConfigName =
+    | 'recommended'
+    | 'strict'
+    | 'problem'
+    | 'security'
+    | 'manifest'
+    | 'license'
+    | 'css'
+    | 'html'
+    | 'json'
+    | 'json5'
+    | 'jsonc'
+
+interface PluginConfig {
+    plugins: Record<string, unknown>
+    rules: Record<string, RuleSetting>
+    language?: string
+    languageOptions?: Record<string, unknown>
+}
+
+interface PluginRule {
+    meta: {
+        type?: 'problem' | 'suggestion' | 'layout'
+        deprecated?: boolean | {
+            message?: string
+            replacedBy?: Array<{ rule: { name: string } }>
+        }
+        docs?: Record<string, unknown>
+    }
+    create: (context: unknown) => Record<string, (...args: unknown[]) => void>
+}
+
+declare const plugin: {
+    meta: { name: string }
+    rules: Record<string, PluginRule>
+    configs: Record<ConfigName, PluginConfig>
+}
+
+export { plugin as default, plugin as chromeExtensions }

package/src/rules/css-spacing.js

@@ -1,13 +1,18 @@
-/* eslint-disable security/detect-object-injection -- array indices are controlled */
+// oxlint-disable security/detect-object-injection
 
 import extension from '../utils/extension.js'
 import regex from '../data/regex.js'
 
-const re = { leadingWhitespace: /^[ \t]+/, trailingWhitespace: /[ \t]+$/ },
+const re = { leadingWhitespace: /^[ \t]+/ },
       combinators = new Set(['>', '+', '~'])
 
 function endOf(node) { return node.loc.end.offset }
 function startOf(node) { return node.loc.start.offset }
+function getTrailingWs(str) {
+    let end = str.length
+    while (end > 0 && (str[end -1] == ' ' || str[end -1] == '\t')) end--
+    return str.slice(end)
+}
 
 export default {
     meta: {
@@ -92,7 +97,7 @@ export default {
                     loc: block.loc.start, messageId: 'spaceAfterBrace',
                     fix(fixer) { return fixer.replaceTextRange([innerStart, innerStart + leadingWs.length], ' ') }
                 })
-            const trailingWs = interior.match(re.trailingWhitespace)?.[0] ?? ''
+            const trailingWs = getTrailingWs(interior)
             if (trailingWs != ' ')
                 context.report({
                     loc: block.loc.end, messageId: 'spaceBeforeBrace',
@@ -117,7 +122,7 @@ export default {
                     loc: node.loc.start, messageId: 'spaceAfterBracket',
                     fix(fixer) { return fixer.replaceTextRange([innerStart, innerStart + leadingWs.length], '') }
                 })
-            const trailingWs = interior.match(re.trailingWhitespace)?.[0] ?? ''
+            const trailingWs = getTrailingWs(interior)
             if (trailingWs)
                 context.report({
                     loc: node.loc.end, messageId: 'spaceBeforeBracket',
@@ -134,7 +139,7 @@ export default {
             if (colonPos < 0) return
             const before = between.slice(0, colonPos),
                   after = between.slice(colonPos +1),
-                  beforeTrailing = before.match(re.trailingWhitespace)?.[0] ?? ''
+                  beforeTrailing = getTrailingWs(before)
             if (beforeTrailing) {
                 const fixEnd = declStart + colonPos
                 context.report({
@@ -210,20 +215,20 @@ export default {
             if (openIdx < 0 || closeIdx <= openIdx) return
             const interior = nodeText.slice(openIdx +1, closeIdx)
             if (interior.includes('\n')) return
-            let depth = 0, inString = null
-            for (let i = 0 ; i < interior.length ; i++) {
+            let depth = 0, inString = null, i = 0
+            while (i < interior.length) {
                 const ch = interior[i]
                 if (inString) {
-                    if (ch == '\\') { i++; continue }
+                    if (ch == '\\') { i += 2 ; continue }
                     if (ch === inString) inString = null
-                    continue
+                    i++ ; continue
                 }
-                if (ch == '"' || ch === `'`) { inString = ch; continue }
-                if (ch == '(') { depth++; continue }
-                if (ch == ')') { depth--; continue }
+                if (ch == '"' || ch === `'`) { inString = ch ; i++ ; continue }
+                if (ch == '(') { depth++ ; i++ ; continue }
+                if (ch == ')') { depth-- ; i++ ; continue }
                 if (ch == ',' && depth === 0) {
                     const commaPos = nodeStart + openIdx +1 + i,
-                          before = interior.slice(0, i).match(re.trailingWhitespace)?.[0] ?? '',
+                          before = getTrailingWs(interior.slice(0, i)),
                           after = interior.slice(i +1).match(re.leadingWhitespace)?.[0] ?? ''
                     if (before)
                         context.report({
@@ -236,6 +241,7 @@ export default {
                             fix(fixer) { return fixer.replaceTextRange([commaPos +1, commaPos +1 + after.length], ' ') }
                         })
                 }
+                i++
             }
         }
         function checkIndent(lineNum, expectedDepth) {
@@ -277,7 +283,7 @@ export default {
                             [nodeStart + openIdx +1, nodeStart + openIdx +1 + leadingWs.length], '')
                     }
                 })
-            const trailingWs = interior.match(re.trailingWhitespace)?.[0] ?? ''
+            const trailingWs = getTrailingWs(interior)
             if (trailingWs)
                 context.report({
                     loc: node.loc.end, messageId: 'spaceBeforeParen',
@@ -302,19 +308,19 @@ export default {
         function checkValueSpacing(valueStart, valueEnd) {
             const rawText = text.slice(valueStart, valueEnd),
                   scanStart = valueStart + (rawText.length - rawText.trimStart().length),
-                  scanEnd = valueEnd - (rawText.length - rawText.trimEnd().length)
+                  scanEnd = valueEnd - getTrailingWs(rawText).length
             if (scanEnd <= scanStart) return
             const valueText = text.slice(scanStart, scanEnd)
             if (valueText.includes('\n')) return
-            let inString = null
-            for (let i = 0 ; i < valueText.length ; i++) {
+            let inString = null, i = 0
+            while (i < valueText.length) {
                 const ch = valueText[i]
                 if (inString) {
-                    if (ch == '\\') { i++; continue }
+                    if (ch == '\\') { i += 2 ; continue }
                     if (ch === inString) inString = null
-                    continue
+                    i++ ; continue
                 }
-                if (ch == '"' || ch === `'`) { inString = ch; continue }
+                if (ch == '"' || ch === `'`) { inString = ch ; i++ ; continue }
                 if (ch == ' ' && valueText[i +1] == ' ') {
                     let end = i
                     while (end < valueText.length -1 && valueText[end +1] == ' ') end++
@@ -323,8 +329,10 @@ export default {
                         loc: offsetToLoc(runStart), messageId: 'spaceBetweenValues',
                         fix(fixer) { return fixer.replaceTextRange([runStart, scanStart + end +1], ' ') }
                     })
-                    i = end
+                    i = end +1
+                    continue
                 }
+                i++
             }
         }
         function walkTree(node, depth) {

package/src/rules/manifest-key-order.js

@@ -14,7 +14,7 @@ function findViolation(members, keys) {
               const key = keyOf(member)
               return { member, key, rank: ranks.get(key) }
           }).filter(item => item.rank !== undefined)
-    for (let i = 1 ; i < known.length ; i++) // eslint-disable-next-line security/detect-object-injection
+    for (let i = 1 ; i < known.length ; i++) // oxlint-disable-next-line security/detect-object-injection
         if (known[i -1].rank > known[i].rank) return [known[i -1], known[i]]
 }
 

package/src/rules/manifest-spacing.js

@@ -102,7 +102,7 @@ export default {
                     prevToken = token
                 }
                 for (let t = 0 ; t < tokens.length ; t++) { // check inline spacing
-                    const token = tokens[t], // eslint-disable-line security/detect-object-injection
+                    const token = tokens[t], // oxlint-disable-line security/detect-object-injection
                           type = token.type,
                           prev = tokens[t -1], next = tokens[t +1]
                     if (next) {

package/src/rules/no-content-style-leak.js

@@ -2,6 +2,18 @@ import extension from '../utils/extension.js'
 
 const re = { appendMethod: /^append(?:Child)?$/ }
 
+function isCreateStyle(node) {
+    return node?.type == 'CallExpression'
+        && node.callee?.property?.name == 'createElement'
+        && node.arguments[0]?.value == 'style'
+}
+function isObjectAssign(node) {
+    return node?.type == 'CallExpression'
+        && node.callee?.type == 'MemberExpression'
+        && node.callee.object?.name == 'Object'
+        && node.callee.property?.name == 'assign'
+}
+
 export default {
     meta: {
         type: 'suggestion',
@@ -20,17 +32,6 @@ export default {
         const manifest = extension.manifest.read(context)
         if (!manifest || !extension.file.isContentScript(context, manifest)) return {}
         const styleElems = new Set(), docAliases = new Set()
-        function isCreateStyle(node) {
-            return node?.type == 'CallExpression'
-                && node.callee?.property?.name == 'createElement'
-                && node.arguments[0]?.value == 'style'
-        }
-        function isObjectAssign(node) {
-            return node?.type == 'CallExpression'
-                && node.callee?.type == 'MemberExpression'
-                && node.callee.object?.name == 'Object'
-                && node.callee.property?.name == 'assign'
-        }
         function isDocumentRef(node) {
             return node?.type == 'Identifier'
                 && (node.name == 'document' || docAliases.has(node.name))

package/src/rules/no-deprecated-apis.js

@@ -1,5 +1,5 @@
+import apiUtils from '../utils/api.js'
 import nodeUtils from '../utils/node.js'
-import apis from '../data/apis.js'
 
 export default {
     meta: {
@@ -51,7 +51,7 @@ export default {
             MemberExpression(node) {
                 if (node.parent.type == 'MemberExpression' && node.parent.object === node) return
                 const api = nodeUtils.getMemberPath(node) ; if (!api?.startsWith('chrome.') || isAllowed(api)) return
-                const found = apis.findDeprecated(api) ; if (!found) return
+                const found = apiUtils.findDeprecated(api) ; if (!found) return
                 context.report({ node, messageId: 'deprecatedAPI',
                     data: { api: found.deprecated, replacement: found.replacement, target }})
             }

package/src/rules/no-host-page-selectors.js

@@ -1,5 +1,5 @@
 import array from '../utils/array.js'
-import regex from '../data/regex.js'
+import node from '../utils/node.js'
 
 const re = { keyframeSelector: /^(?:from|to|[\d.]+%)$/i }
 
@@ -61,7 +61,7 @@ export default {
             if (re.keyframeSelector.test(text) || allowedSelectors.has(text)) return
             const simples = []
             for (const child of selector.children ?? []) {
-                if (plainType(child) == 'Combinator') break
+                if (node.plainType(child) == 'Combinator') break
                 simples.push(child)
             }
             let hasQualifier = false,
@@ -69,8 +69,8 @@ export default {
                 isRoot = false,
                 elementTypes = []
             for (const simple of simples) {
-                const type = plainType(simple)
-                if (type == 'ClassSelector' || type == 'IdSelector' || type == 'AttributeSelector') hasQualifier = true
+                const type = node.plainType(simple)
+                if (['AttributeSelector', 'ClassSelector', 'IdSelector'].includes(type)) hasQualifier = true
                 else if (type == 'PseudoClassSelector' && (simple.name ?? '').toLowerCase() == 'root') isRoot = true
                 else if (type == 'TypeSelector') {
                     const name = (simple.name ?? '').toLowerCase()
@@ -93,14 +93,13 @@ export default {
         }
         function getSelectorText(selector) {
             const range = selector.range
-            if (range && range.length == 2) return context.sourceCode.text.slice(range[0], range[1])
+            if (range?.length == 2) return context.sourceCode.text.slice(range[0], range[1])
             return context.sourceCode.getText(selector)
         }
         function handleRule(node) {
             for (const selector of node.prelude?.children ?? [])
                 checkSelector(selector)
         }
-        function plainType(node) { return node?.type?.replace(regex.prefix.css, '') ?? '' }
         return { Rule: handleRule, CSSRule: handleRule }
     }
 }

package/src/rules/no-inline-event-handlers.js

@@ -0,0 +1,116 @@
+/* oxlint-disable security/detect-object-injection */
+
+import array from '../utils/array.js'
+import html from '../utils/html.js'
+
+const re = {
+    attrNameEnd: /[\s=>]/,
+    block: {
+        script: /(<script\b[^>]*>)([\s\S]*?)(<\/script\s*>)/gi,
+        style: /(<style\b[^>]*>)([\s\S]*?)(<\/style\s*>)/gi
+    },
+    htmlComment: /<!--[\s\S]*?-->/g,
+    inlineHandler: /^on[a-z]+$/i,
+    quote: /["']/,
+    tagOpen: /<[a-z][\w-]*/gi,
+    whitespace: /\s/
+}
+
+function isQuote(char) { return re.quote.test(char) }
+function maskInner(_, open, inner, close) { return open + spaces(inner.length) + close }
+function spaces(n) { return ' '.repeat(n) }
+
+function parseAttrs(attrPart) {
+    const attrs = [] ; let i = 0
+    while (i < attrPart.length) {
+        while (i < attrPart.length && re.whitespace.test(attrPart[i])) i++
+        if (i >= attrPart.length) break
+        const nameStart = i
+        while (i < attrPart.length && !re.attrNameEnd.test(attrPart[i])) i++
+        const name = attrPart.slice(nameStart, i)
+        if (!name) { i++ ; continue }
+        while (i < attrPart.length && re.whitespace.test(attrPart[i])) i++
+        if (attrPart[i] == '=') {
+            i++
+            while (i < attrPart.length && re.whitespace.test(attrPart[i])) i++
+            if (isQuote(attrPart[i])) {
+                const q = attrPart[i]
+                i++
+                while (i < attrPart.length && attrPart[i] !== q) i++
+                i++
+            } else
+                while (i < attrPart.length && !re.whitespace.test(attrPart[i]) && attrPart[i] != '>') i++
+        }
+        attrs.push({ name, offset: nameStart })
+    }
+    return attrs
+}
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Disallow inline event handlers (e.g. `onclick`, `onload`) in HTML '
+                       + '(blocked by MV3\'s CSP at runtime)',
+            category: 'Possible Errors',
+            html: true
+        },
+        defaultOptions: [{ allowedAttributes: [] }],
+        schema: [{
+            type: 'object',
+            properties: {
+                allowedAttributes: {
+                    oneOf: [
+                        { type: 'string', description: 'A single attribute name' },
+                        { type: 'array', items: { type: 'string' }, description: 'List of attribute names' }
+                    ],
+                    description: 'Inline event handler attributes to permit'
+                }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            inlineHandler: 'Inline event handler `{{attr}}` is blocked by MV3\'s `script-src \'self\'`. '
+                         + 'Move the handler to JS with `addEventListener()`.'
+        }
+    },
+
+    create(context) {
+        const opts = context.options[0] || {},
+              allowedAttributes = new Set(array.to(opts.allowedAttributes ?? []).map(a => a.toLowerCase())),
+              text = context.sourceCode.text
+        let scanned = false
+        function maskContent() {
+            return text
+                .replace(re.htmlComment, match => spaces(match.length))
+                .replace(re.block.script, maskInner)
+                .replace(re.block.style, maskInner)
+        }
+        function scan() {
+            if (scanned) return
+            scanned = true
+            if (!html.isHTML(text)) return
+            const masked = maskContent()
+            for (const tagMatch of masked.matchAll(re.tagOpen)) {
+                const tagEnd = tagMatch.index + tagMatch[0].length
+                let i = tagEnd, quote = null
+                while (i < masked.length) {
+                    const char = masked[i]
+                    if (quote) { if (char === quote) quote = null }
+                    else if (isQuote(char)) quote = char
+                    else if (char == '>') break
+                    i++
+                }
+                const attrPart = masked.slice(tagEnd, i)
+                for (const attr of parseAttrs(attrPart)) {
+                    if (!re.inlineHandler.test(attr.name)) continue
+                    const attrLower = attr.name.toLowerCase()
+                    if (allowedAttributes.has(attrLower)) continue
+                    context.report({ loc: html.offsetToLoc(text, tagEnd + attr.offset),
+                        messageId: 'inlineHandler', data: { attr: attrLower }})
+                }
+            }
+        }
+        return { 'Program:exit': scan, 'Document:exit': scan, '*': scan }
+    }
+}