eslint-plugin-chrome-extensions 2.8.1 → 2.9.1

package/src/rules/no-insecure-fetch.js

@@ -1,10 +1,13 @@
+import nodeUtils from '../utils/node.js'
+
 const re = { insecureURL: /^http:\/\/(?!localhost\b|127\.0\.0\.1\b|\[::1\])/i }
 
 function urlFromLiteral(node) {
-    return ( node?.type == 'Literal'
-        && typeof node.value == 'string'
-        && re.insecureURL.test(node.value)
-    ) ? node.value : null
+    const inner = nodeUtils.unwrapTS(node)
+    return ( inner?.type == 'Literal'
+        && typeof inner.value == 'string'
+        && re.insecureURL.test(inner.value)
+    ) ? inner.value : null
 }
 
 export default {
@@ -27,8 +30,9 @@ export default {
         const xhrVars = new Set()
         return {
             VariableDeclarator(node) {
-                if (node.init?.type == 'NewExpression'
-                    && node.init.callee?.name == 'XMLHttpRequest'
+                const init = nodeUtils.unwrapTS(node.init)
+                if (init?.type == 'NewExpression'
+                    && init.callee?.name == 'XMLHttpRequest'
                     && node.id.type == 'Identifier'
                 ) xhrVars.add(node.id.name)
             },

package/src/rules/no-insecure-messaging.js

@@ -1,7 +1,8 @@
 import api from '../utils/api.js'
 import nodeUtils from '../utils/node.js'
 
-const re = { postmsgValidation: /\b\w+\.(?:origin|source)\b/, senderValidation: /sender\.(?:id|origin)/ },
+const defaultOptions = { disallowWildcardTarget: true },
+      re = { postmsgValidation: /\b\w+\.(?:origin|source)\b/, senderValidation: /sender\.(?:id|origin)/ },
       isMessageTarget = obj => obj?.type == 'Identifier' && ['self', 'window'].includes(obj.name)
 
 export default {
@@ -13,7 +14,7 @@ export default {
             recommended: true,
             security: true
         },
-        defaultOptions: [{ disallowWildcardTarget: true }],
+        defaultOptions: [defaultOptions],
         schema: [{
             type: 'object',
             properties: {
@@ -33,8 +34,7 @@ export default {
     },
 
     create(context) {
-        const opts = context.options[0] || {},
-              disallowWildcard = opts.disallowWildcardTarget !== false
+        const { disallowWildcardTarget } = { ...defaultOptions, ...context.options[0] }
         function checkPostMessageHandler(node, handlerNode, target) {
             if (!handlerNode) return
             const body = context.sourceCode.getText(handlerNode)
@@ -59,14 +59,12 @@ export default {
                         context.report({ node, messageId: 'unfilteredBroadcast' })
                 }
                 if (node.callee.property?.name == 'addEventListener'
-                    && node.arguments[0]?.value == 'message'
+                    && nodeUtils.getStringLiteral(node.arguments[0]) == 'message'
                     && isMessageTarget(node.callee.object)
                 ) checkPostMessageHandler(node, node.arguments[1], node.callee.object.name)
-                if (disallowWildcard && node.callee.property?.name == 'postMessage') {
-                    const target = node.arguments[1]
-                    if (target?.type == 'Literal' && target.value == '*')
-                        context.report({ node: target, messageId: 'wildcardTarget' })
-                }
+                if (disallowWildcardTarget && node.callee.property?.name == 'postMessage'
+                    && nodeUtils.getStringLiteral(node.arguments[1]) == '*'
+                ) context.report({ node: node.arguments[1], messageId: 'wildcardTarget' })
             },
             AssignmentExpression(node) {
                 if (node.left.type == 'MemberExpression'

package/src/rules/no-invalid-locales.js

@@ -5,6 +5,8 @@ import path from 'node:path'
 
 import regex from '../data/regex.js'
 
+const defaultOptions = { allowedLocales: [] }
+
 export default {
     meta: {
         type: 'problem',
@@ -31,7 +33,7 @@ export default {
             },
             additionalProperties: false
         }],
-        defaultOptions: [{ allowedLocales: [] }],
+        defaultOptions: [defaultOptions],
         messages: {
             invalidLocale: '`{{value}}` is not a Chrome-supported locale code.'
         }
@@ -42,11 +44,10 @@ export default {
               isManifest = regex.filename.manifest.test(filename),
               isScript = regex.filename.script.test(filename)
         if (!isManifest && !isScript) return {}
-        const opts = context.options[0] || {},
-              allowed = new Set(Array.isArray(opts.allowedLocales) ? opts.allowedLocales
-                      : opts.allowedLocales ? [opts.allowedLocales] : []),
-              invalidFolders = [],
-              root = extension.findRoot(context)
+        const { allowedLocales } = { ...defaultOptions, ...context.options[0] },
+                allowed = new Set(Array.isArray(allowedLocales) ? allowedLocales : [allowedLocales]),
+                invalidFolders = [],
+                root = extension.findRoot(context)
         if (root) {
             const localesDir = path.join(root, '_locales')
             try { // oxlint-disable-next-line security/detect-non-literal-fs-filename

package/src/rules/no-invalid-permissions.js

@@ -1,6 +1,8 @@
 import extension from '../utils/extension.js'
 import regex from '../data/regex.js'
 
+const defaultOptions = { target: 'mv3', allowedPermissions: [] }
+
 export default {
     meta: {
         type: 'problem',
@@ -10,7 +12,7 @@ export default {
             recommended: true,
             manifest: true
         },
-        defaultOptions: [{ target: 'mv3', allowedPermissions: [] }],
+        defaultOptions: [defaultOptions],
         schema: [{
             type: 'object',
             properties: {
@@ -38,10 +40,8 @@ export default {
     },
 
     create(context) {
-        const opts = context.options[0] || {},
-              target = opts.target || 'mv3',
-              allowed = new Set(Array.isArray(opts.allowedPermissions) ? opts.allowedPermissions
-                      : opts.allowedPermissions ? [opts.allowedPermissions] : [])
+        const { target, allowedPermissions } = { ...defaultOptions, ...context.options[0] },
+                allowed = new Set(Array.isArray(allowedPermissions) ? allowedPermissions : [allowedPermissions])
         function checkPermission(node, permission) {
             if (typeof permission != 'string') return
             if (allowed.has(permission) || extension.manifest.permission.isValid(permission, target)) return

package/src/rules/no-missing-default-locale.js

@@ -7,6 +7,8 @@ import path from 'node:path'
 
 import regex from '../data/regex.js'
 
+const defaultOptions = { ignoreKeys: [], checkAllLocales: false }
+
 function readLocaleDirs(localesDir)  {
     try {
         return fs.readdirSync(localesDir, { withFileTypes: true })
@@ -45,7 +47,7 @@ export default {
             },
             additionalProperties: false
         }],
-        defaultOptions: [{ ignoreKeys: [], checkAllLocales: false }],
+        defaultOptions: [defaultOptions],
         messages: {
             missingDefaultLocale: '`_locales/` exists but `default_locale` is not declared.',
             unexpectedDefaultLocale: '`default_locale` is declared but no `_locales/` directory exists.',
@@ -64,9 +66,8 @@ export default {
         const localesDir = path.join(root, '_locales'),
               hasLocales = fs.existsSync(localesDir),
               defaultLocale = manifest.default_locale,
-              opts = context.options[0] || {},
-              ignored = new Set(opts.ignoreKeys || []),
-              checkAllLocales = opts.checkAllLocales ?? false,
+            { ignoreKeys, checkAllLocales } = { ...defaultOptions, ...context.options[0] },
+              ignored = new Set(ignoreKeys),
               loc = { line: 1, column: 1 }
         if (hasLocales && typeof defaultLocale != 'string') {
             context.report({ loc, messageId: 'missingDefaultLocale' })

package/src/rules/no-missing-i18n-keys.js

@@ -5,6 +5,8 @@ import nodeUtils from '../utils/node.js'
 import i18nData from '../data/i18n.js'
 import regex from '../data/regex.js'
 
+const defaultOptions = { ignoreKeys: [] }
+
 export default {
     meta: {
         type: 'problem',
@@ -25,7 +27,7 @@ export default {
             },
             additionalProperties: false
         }],
-        defaultOptions: [{ ignoreKeys: [] }],
+        defaultOptions: [defaultOptions],
         messages: {
             missingKey: '`{{key}}` is not in `_locales/{{locale}}/messages.json`.'
         }
@@ -36,10 +38,10 @@ export default {
         const manifest = extension.manifest.read(context) ; if (!manifest?.default_locale) return {}
         const root = extension.findRoot(context) ; if (!root) return {}
         const i18n = i18nUtils.readDefaultLocaleMessages(manifest, root) ; if (!i18n) return {}
-        const opts = context.options[0] || {},
-              ignored = new Set(opts.ignoreKeys || []),
-              isMissing = key => !i18nUtils.isPredefined(key) && !ignored.has(key) && !(key in i18n.messages),
-              loc = { line: 1, column: 1 }
+        const { ignoreKeys } = { ...defaultOptions, ...context.options[0] },
+                ignored = new Set(ignoreKeys),
+                isMissing = key => !i18nUtils.isPredefined(key) && !ignored.has(key) && !(key in i18n.messages),
+                loc = { line: 1, column: 1 }
         if (regex.filename.script.test(filename))
             return {
                 CallExpression(node) {

package/src/rules/no-missing-permissions.js

@@ -7,7 +7,7 @@ function queriesActiveTab(node) {
     return arg.properties.some(prop => {
         if (prop.type != 'Property') return false
         const key = prop.key?.name ?? prop.key?.value
-        return key == 'active' && prop.value?.type == 'Literal' && prop.value.value === true
+        return key == 'active' && nodeUtils.getLiteral(prop.value)?.value === true
     })
 }
 

package/src/rules/no-missing-web-accessible-resources.js

@@ -8,13 +8,12 @@ function collectWARpatterns(manifest) {
     if (!Array.isArray(war)) return []
     const patterns = []
     for (const entry of war) {
-        if (typeof entry == 'string') patterns.push(entry)  // MV2 flat
+        if (typeof entry == 'string') patterns.push(entry)
         else if (Array.isArray(entry?.resources))
-            for (const res of entry.resources) patterns.push(res)  // MV3 object
+            for (const res of entry.resources) patterns.push(res)
     }
     return patterns
 }
-
 function patternToRegex(pattern) {
     const escaped = pattern.replaceAll(re.regexSpecial, '\\$&').replaceAll('*', '.*')
     return new RegExp(`^${escaped}$`) // oxlint-disable-line security/detect-non-literal-regexp
@@ -29,9 +28,7 @@ export default {
             recommended: true
         },
         schema: [],
-        messages: {
-            missingWAR: '`{{path}}` is not in `web_accessible_resources`.'
-        }
+        messages: { missingWAR: '`{{path}}` is not in `web_accessible_resources`.' }
     },
 
     create(context) {
@@ -43,10 +40,13 @@ export default {
                 if (node.callee.type != 'MemberExpression'
                     || nodeUtils.getMemberPath(node.callee) != 'chrome.runtime.getURL'
                 ) return
-                const arg = node.arguments[0] ; if (arg?.type != 'Literal' || typeof arg.value != 'string') return
-                const resourcePath = arg.value.replace(re.leadingSlash, '')
-                for (const regex of regexes) if (regex.test(resourcePath)) return
-                context.report({ node: arg, messageId: 'missingWAR', data: { path: arg.value }})
+                const arg = node.arguments[0],
+                      val = nodeUtils.getStringLiteral(arg)
+                if (val === null) return
+                const resourcePath = val.replace(re.leadingSlash, '')
+                for (const regex of regexes)
+                    if (regex.test(resourcePath)) return
+                context.report({ node: arg, messageId: 'missingWAR', data: { path: val }})
             }
         }
     }

package/src/rules/no-remote-code.js

@@ -3,22 +3,21 @@ import nodeUtils from '../utils/node.js'
 import manifest from '../data/manifest.js'
 import regex from '../data/regex.js'
 
-const re = { inlineHandler: /^on[a-z]+$/i, inlineHandlerInHTML: /\son[a-z]+\s*=/i }
+const defaultOptions = { patterns: manifest.patterns.remoteCode, checkExecuteScriptClosures: true },
+      re = { inlineHandler: /^on[a-z]+$/i, inlineHandlerInHTML: /\son[a-z]+\s*=/i }
 
 function isCreateScript(node) {
     return node?.type == 'CallExpression'
         && node.callee?.property?.name == 'createElement'
-        && node.arguments[0]?.value == 'script'
+        && nodeUtils.getStringLiteral(node.arguments[0]) == 'script'
 }
 function isInlineHandlerInString(node) {
-    return node?.type == 'Literal'
-        && typeof node.value == 'string'
-        && re.inlineHandlerInHTML.test(node.value)
+    const value = nodeUtils.getStringLiteral(node)
+    return value !== null && re.inlineHandlerInHTML.test(value)
 }
 function isLiteralURL(node) {
-    return node?.type == 'Literal'
-        && typeof node.value == 'string'
-        && regex.url.test(node.value)
+    const value = nodeUtils.getStringLiteral(node)
+    return value !== null && regex.url.test(value)
 }
 function isObjectAssign(node) {
     return node?.type == 'CallExpression'
@@ -44,10 +43,7 @@ export default {
             recommended: true,
             security: true
         },
-        defaultOptions: [{
-            patterns: manifest.patterns.remoteCode,
-            checkExecuteScriptClosures: true
-        }],
+        defaultOptions: [defaultOptions],
         schema: [{
             type: 'object',
             properties: {
@@ -77,10 +73,9 @@ export default {
     },
 
     create(context) {
-        const opts = context.options[0] || {},
-              patterns = new Set(opts.patterns || manifest.patterns.remoteCode),
-              checkClosures = opts.checkExecuteScriptClosures !== false,
-              scriptElems = new Set()
+        const { patterns: rawPatterns, checkExecuteScriptClosures } = { ...defaultOptions, ...context.options[0] },
+                patterns = new Set(rawPatterns),
+                scriptElems = new Set()
         function isScriptSrcAssignment(left, right) {
             if (left.type != 'MemberExpression') return false
             if (left.property?.name != 'src') return false
@@ -97,7 +92,7 @@ export default {
         }
         return {
             VariableDeclarator(node) {
-                if (isCreateScript(node.init) && node.id.type == 'Identifier')
+                if (isCreateScript(nodeUtils.unwrapTS(node.init)) && node.id.type == 'Identifier')
                     scriptElems.add(node.id.name)
             },
             ImportExpression(node) {
@@ -113,8 +108,7 @@ export default {
                 if (patterns.has('string-timer')
                     && node.callee.type == 'Identifier'
                     && ['setTimeout', 'setInterval'].includes(node.callee.name)
-                    && node.arguments[0]?.type == 'Literal'
-                    && typeof node.arguments[0].value == 'string'
+                    && nodeUtils.getStringLiteral(node.arguments[0]) !== null
                 ) context.report({ node, messageId: 'stringTimer', data: { fn: node.callee.name }})
                 if (patterns.has('dynamic-import')
                     && node.callee.type == 'Import'
@@ -130,16 +124,17 @@ export default {
                               hasArgs = optsNode.properties.some(prop => prop.key?.name == 'args')
                         if (patterns.has('execute-script-url') && urlProp)
                             context.report({ node: urlProp, messageId: 'executeScriptURL' })
-                        if (checkClosures && funcProp && !hasArgs)
+                        if (checkExecuteScriptClosures && funcProp && !hasArgs)
                             context.report({ node: funcProp, messageId: 'executeScriptClosure' })
                     }
                     if (patterns.has('inline-event-handler')
                         && node.callee.property?.name == 'setAttribute'
-                        && node.arguments[0]?.type == 'Literal'
-                        && typeof node.arguments[0].value == 'string'
-                        && re.inlineHandler.test(node.arguments[0].value)
-                    ) context.report({ node, messageId: 'inlineEventHandler',
-                        data: { attr: node.arguments[0].value.toLowerCase() }})
+                    ) {
+                        const attr = nodeUtils.getStringLiteral(node.arguments[0])
+                        if (attr !== null && re.inlineHandler.test(attr))
+                            context.report({ node, messageId: 'inlineEventHandler',
+                                data: { attr: attr.toLowerCase() }})
+                    }
                     if (patterns.has('inline-event-handler')
                         && node.callee.property?.name == 'insertAdjacentHTML'
                         && isInlineHandlerInString(node.arguments[1])
@@ -148,10 +143,11 @@ export default {
                     if (patterns.has('inline-script-body')
                         && ['append', 'prepend'].includes(node.callee.property?.name)
                         && isScriptElement(node.callee.object)
-                        && node.arguments[0]?.type == 'Literal'
-                        && typeof node.arguments[0].value == 'string'
-                        && node.arguments[0].value.trim().length > 0
-                    ) context.report({ node: node.arguments[0], messageId: 'inlineScriptBody' })
+                    ) {
+                        const body = nodeUtils.getStringLiteral(node.arguments[0])
+                        if (body !== null && body.trim().length > 0)
+                            context.report({ node: node.arguments[0], messageId: 'inlineScriptBody' })
+                    }
                 }
             },
             NewExpression(node) {
@@ -170,10 +166,11 @@ export default {
                     && node.left.type == 'MemberExpression'
                     && ['textContent', 'innerText', 'innerHTML', 'text'].includes(node.left.property?.name)
                     && isScriptElement(node.left.object)
-                    && node.right?.type == 'Literal'
-                    && typeof node.right.value == 'string'
-                    && node.right.value.trim().length > 0
-                ) context.report({ node, messageId: 'inlineScriptBody' })
+                ) {
+                    const body = nodeUtils.getStringLiteral(node.right)
+                    if (body !== null && body.trim().length > 0)
+                        context.report({ node, messageId: 'inlineScriptBody' })
+                }
                 if (!patterns.has('remote-script-src')) return
                 if (isScriptSrcAssignment(node.left, node.right))
                     context.report({ node: node.right, messageId: 'remoteScriptSrc' })

package/src/rules/no-remote-objects.js

@@ -1,7 +1,8 @@
 import array from '../utils/array.js'
 import html from '../utils/html.js'
 
-const re = { objectTag: /<(?:object|embed)\b([^>]*)>/gi }
+const defaultOptions = { allowedPrefixes: ['chrome-extension://'] },
+      re = { objectTag: /<(?:object|embed)\b([^>]*)>/gi }
 
 export default {
     meta: {
@@ -11,7 +12,7 @@ export default {
             category: 'Possible Errors',
             html: true
         },
-        defaultOptions: [{ allowedPrefixes: ['chrome-extension://'] }],
+        defaultOptions: [defaultOptions],
         schema: [{
             type: 'object',
             properties: {
@@ -32,9 +33,9 @@ export default {
     },
 
     create(context) {
-        const opts = context.options[0] || {},
-              allowedPrefixes = array.to(opts.allowedPrefixes ?? ['chrome-extension://']),
-              text = context.sourceCode.text
+        const { allowedPrefixes } = { ...defaultOptions, ...context.options[0] },
+                allowedPrefixesArray = array.to(allowedPrefixes),
+                text = context.sourceCode.text
         let scanned = false
         function scan() {
             if (scanned) return
@@ -45,7 +46,7 @@ export default {
                        tag = full.trimStart().toLowerCase().startsWith('<object') ? 'object' : 'embed',
                        attr = tag == 'object' ? 'data' : 'src',
                        val = html.pickAttrVal(attrs.match(tag == 'object' ? html.re.attr.data : html.re.attr.src))
-                if (val !== null && html.isRemote(val.trim(), allowedPrefixes))
+                if (val !== null && html.isRemote(val.trim(), allowedPrefixesArray))
                     context.report({ loc: html.offsetToLoc(text, match.index), messageId: 'remoteObject',
                         data: { tag, attr, src: val.trim() }})
             }

package/src/rules/no-remote-urls.js

@@ -1,6 +1,8 @@
 import array from '../utils/array.js'
 import regex from '../data/regex.js'
 
+const defaultOptions = { allowedSchemes: ['blob', 'chrome-extension', 'data'], patterns: ['at-import', 'url'] }
+
 function getPreludeURLnode(prelude) {
     if (!prelude) return null
     if (['Url', 'CSSUrl', 'String', 'CSSString'].includes(prelude.type))
@@ -28,10 +30,7 @@ export default {
             category: 'Possible Errors',
             css: true
         },
-        defaultOptions: [{
-            allowedSchemes: ['blob', 'chrome-extension', 'data'],
-            patterns: ['at-import', 'url']
-        }],
+        defaultOptions: [defaultOptions],
         schema: [{
             type: 'object',
             properties: {
@@ -60,20 +59,20 @@ export default {
     },
 
     create(context) {
-        const opts = context.options[0] || {},
-              allowedSchemes = new Set(array.to(opts.allowedSchemes ?? ['blob', 'chrome-extension', 'data'])),
-              patterns = new Set(array.to(opts.patterns ?? ['at-import', 'url'])),
-              handledURLs = new WeakSet()
+        const { allowedSchemes, patterns } = { ...defaultOptions, ...context.options[0] },
+                allowedSchemeSet = new Set(array.to(allowedSchemes)),
+                patternSet = new Set(array.to(patterns)),
+                handledURLs = new WeakSet()
         function handleAtrule(node) {
             if (!node.prelude) return
-            if (node.name == 'import' && patterns.has('at-import')) {
+            if (node.name == 'import' && patternSet.has('at-import')) {
                 const urlNode = getPreludeURLnode(node.prelude)
                 if (urlNode && isRemote(getURLstr(urlNode))) {
                     handledURLs.add(urlNode)
                     context.report({ node, messageId: 'remoteImport' })
                 }
             }
-            if (node.name == 'namespace' && patterns.has('namespace')) {
+            if (node.name == 'namespace' && patternSet.has('namespace')) {
                 const urlNode = getPreludeURLnode(node.prelude)
                 if (urlNode && isRemote(getURLstr(urlNode))) {
                     handledURLs.add(urlNode)
@@ -82,7 +81,7 @@ export default {
             }
         }
         function handleURL(node) {
-            if (!patterns.has('url')) return
+            if (!patternSet.has('url')) return
             if (handledURLs.has(node)) return
             if (node.parent?.type == 'AtrulePrelude' || node.parent?.type == 'CSSAtRulePrelude') return
             if (isRemote(getURLstr(node)))
@@ -95,7 +94,7 @@ export default {
             if (match[0] == '//') return true
             const scheme = (match[1] || '').toLowerCase()
             if (['http', 'https', 'ftp'].includes(scheme)) return true
-            return !allowedSchemes.has(scheme)
+            return !allowedSchemeSet.has(scheme)
         }
         return { Atrule: handleAtrule, CSSAtRule: handleAtrule, Url: handleURL, CSSUrl: handleURL }
     }

package/src/rules/no-scrollbar-styling.js

@@ -1,8 +1,8 @@
 import array from '../utils/array.js'
 import node from '../utils/node.js'
 
-const re = {
-    scrollbarPseudo: /^(?:-webkit-)?scrollbar(?:-[\w-]+)?$/i } // oxlint-disable-line security/detect-unsafe-regex
+const defaultOptions = { allowedSelectors: [] }, // oxlint-disable-next-line security/detect-unsafe-regex
+      re = { scrollbarPseudo: /^(?:-webkit-)?scrollbar(?:-[\w-]+)?$/i }
 
 export default {
     meta: {
@@ -13,7 +13,7 @@ export default {
             category: 'Possible Errors',
             css: true
         },
-        defaultOptions: [{ allowedSelectors: [] }],
+        defaultOptions: [defaultOptions],
         schema: [{
             type: 'object',
             properties: {
@@ -34,11 +34,11 @@ export default {
     },
 
     create(context) {
-        const opts = context.options[0] || {},
-              allowedSelectors = new Set(array.to(opts.allowedSelectors))
+        const { allowedSelectors } = { ...defaultOptions, ...context.options[0] },
+                allowedSelectorSet = new Set(array.to(allowedSelectors))
         function checkSelector(selector) {
             if (!selector) return
-            const text = getSelectorText(selector).trim() ; if (allowedSelectors.has(text)) return
+            const text = getSelectorText(selector).trim() ; if (allowedSelectorSet.has(text)) return
             let hasScrollbarPseudo = false,
                 hasQualifier = false,
                 pastFirstCompound = false

package/src/rules/no-sensitive-permissions.js

@@ -1,8 +1,11 @@
+import array from '../utils/array.js'
 import extension from '../utils/extension.js'
 
 import permissions from '../data/permissions.js'
 import regex from '../data/regex.js'
 
+const defaultOptions = { allowedPermissions: [] }
+
 export default {
     meta: {
         type: 'problem',
@@ -13,7 +16,7 @@ export default {
             security: true,
             manifest: true
         },
-        defaultOptions: [{ allowedPermissions: [] }],
+        defaultOptions: [defaultOptions],
         schema: [{
             type: 'object',
             properties: {
@@ -38,9 +41,8 @@ export default {
     },
 
     create(context) {
-        const opts = context.options[0] || {},
-              allowed = new Set(Array.isArray(opts.allowedPermissions) ? opts.allowedPermissions
-                      : opts.allowedPermissions ? [opts.allowedPermissions] : [])
+        const { allowedPermissions } = { ...defaultOptions, ...context.options[0] },
+                allowed = new Set(array.to(allowedPermissions))
         function checkPermission(node, permission) {
             if (typeof permission != 'string') return
             if (allowed.has(permission) || !permissions.sensitive.has(permission)) return

package/src/rules/no-unrestricted-host-permissions.js

@@ -1,7 +1,8 @@
 import extension from '../utils/extension.js'
 import regex from '../data/regex.js'
 
-const re = { broadHost: /^(?:<all_urls>|\*:\/\/\*\/\*|\w+:\/\/\*\/\*)$/ },
+const defaultOptions = { allowedPatterns: [] },
+      re = { broadHost: /^(?:<all_urls>|\*:\/\/\*\/\*|\w+:\/\/\*\/\*)$/ },
       hostKeys = new Set(['host_permissions', 'optional_host_permissions', 'optional_permissions', 'permissions'])
 
 export default {
@@ -14,7 +15,7 @@ export default {
             security: true,
             manifest: true
         },
-        defaultOptions: [{ allowedPatterns: [] }],
+        defaultOptions: [defaultOptions],
         schema: [{
             type: 'object',
             properties: {
@@ -33,12 +34,10 @@ export default {
     },
 
     create(context) {
-        const allowedPatterns = new Set(context.options[0]?.allowedPatterns || [])
+        const { allowedPatterns } = { ...defaultOptions, ...context.options[0] },
+                allowedPatternSet = new Set(allowedPatterns)
         function isBroad(pattern) {
-            return typeof pattern == 'string'
-                && !allowedPatterns.has(pattern)
-                && re.broadHost.test(pattern)
-        }
+            return typeof pattern == 'string' && !allowedPatternSet.has(pattern) && re.broadHost.test(pattern) }
         if (regex.filename.manifest.test(extension.file.getName(context))) // lint it directly
             return {
                 '*'(node) {

package/src/rules/no-unused-i18n-keys.js

@@ -4,6 +4,8 @@ import i18nUtils from '../utils/i18n.js'
 import i18nData from '../data/i18n.js'
 import regex from '../data/regex.js'
 
+const defaultOptions = { ignoreKeys: [], scanExtensions: i18nData.defaultScanExtensions }
+
 export default {
     meta: {
         type: 'suggestion',
@@ -26,7 +28,7 @@ export default {
             },
             additionalProperties: false
         }],
-        defaultOptions: [{ ignoreKeys: [], scanExtensions: i18nData.defaultScanExtensions }],
+        defaultOptions: [defaultOptions],
         messages: {
             unusedKey: '`{{key}}` in `_locales/{{locale}}/messages.json` is never referenced.'
         }
@@ -38,9 +40,8 @@ export default {
         const manifest = extension.manifest.read(context) ; if (!manifest?.default_locale) return {}
         const root = extension.findRoot(context) ; if (!root) return {}
         const i18n = i18nUtils.readDefaultLocaleMessages(manifest, root) ; if (!i18n) return {}
-        const opts = context.options[0] || {},
-              ignored = new Set(opts.ignoreKeys || []),
-              scanExtensions = opts.scanExtensions || i18nData.defaultScanExtensions
+        const { ignoreKeys, scanExtensions } = { ...defaultOptions, ...context.options[0] },
+                ignored = new Set(ignoreKeys)
         function check() {
             const { used, patterns } = i18nUtils.collectUsedKeys(root, scanExtensions)
             for (const key of Object.keys(i18n.messages)) {