eslint-plugin-chrome-extensions 2.9.1 → 2.11.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eslint-plugin-chrome-extensions",
-  "version": "2.9.1",
+  "version": "2.11.0",
   "description": "ESLint rules for Chrome extensions",
   "keywords": [
     "eslint",
@@ -61,7 +61,7 @@
     "test": "node tests/run"
   },
   "dependencies": {
-    "globals": "^17.13.0",
+    "globals": "^17.14.0",
     "spdx-license-ids": "^3.0.24",
     "spdx-license-list": "^6.12.0"
   },
@@ -80,13 +80,13 @@
     "eslint-plugin-n": "^18.5.0",
     "eslint-plugin-no-secrets": "^2.3.3",
     "eslint-plugin-no-unsanitized": "^4.1.5",
-    "eslint-plugin-package-json": "^1.12.0",
+    "eslint-plugin-package-json": "^1.14.0",
     "eslint-plugin-promise": "^7.3.0",
-    "eslint-plugin-regexp": "^3.3.2",
+    "eslint-plugin-regexp": "^3.3.3",
     "eslint-plugin-security": "^4.2.1",
     "eslint-plugin-sonarjs": "^4.2.2",
     "eslint-plugin-woodpecker": "^1.1.2",
-    "oxlint": "^1.90.0",
+    "oxlint": "^1.91.0",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "typescript-latest": "npm:typescript@^7.0.2"
   },

package/src/data/i18n.js

@@ -1,11 +1,18 @@
 export default {
     defaultScanExtensions: ['cjs', 'css', 'htm', 'html', 'js', 'json', 'jsx', 'md', 'mjs', 'svg', 'ts', 'tsx', 'txt'],
     locales: {
-        supported: new Set([ // https://developer.chrome.com/docs/extensions/reference/api/i18n
-            'af', 'am', 'ar', 'bg', 'bn', 'ca', 'cs', 'da', 'de', 'el', 'en', 'en_AU', 'en_GB', 'en_IN', 'en_US', 'es',
-            'es_419', 'es_MX', 'es_US', 'et', 'fa', 'fi', 'fil', 'fr', 'fr_CA', 'fr_FR', 'gu', 'he', 'hi', 'hr', 'hu',
-            'id', 'it', 'ja', 'kn', 'ko', 'lt', 'lv', 'ml', 'mr', 'ms', 'nl', 'no', 'pl', 'pt_BR', 'pt_PT', 'ro', 'ru',
-            'sk', 'sl', 'sr', 'sv', 'sw', 'ta', 'te', 'th', 'tr', 'uk', 'vi', 'zh_CN', 'zh_TW'
+        supported: new Set([
+            // https://developer.chrome.com/docs/extensions/reference/api/i18n#locales
+            'am', 'ar', 'bg', 'bn', 'ca', 'cs', 'da', 'de', 'el', 'en', 'en_AU', 'en_GB', 'en_US', 'es', 'es_419', 'et',
+            'fa', 'fi', 'fil', 'fr', 'gu', 'he', 'hi', 'hr', 'hu', 'id', 'it', 'ja', 'kn', 'ko', 'lt', 'lv', 'ml', 'mr',
+            'ms', 'nl', 'no', 'pl', 'pt_BR', 'pt_PT', 'ro', 'ru', 'sk', 'sl', 'sr', 'sv', 'sw', 'ta', 'te', 'th', 'tr',
+            'uk', 'vi', 'zh_CN', 'zh_TW',
+            // https://searchfox.org/firefox-release/source/browser/locales/l10n.toml
+            'ach', 'af', 'an', 'ast', 'az', 'be', 'bo', 'br', 'brx', 'bs', 'ca_valencia', 'cak', 'ckb', 'cy', 'dsb',
+            'en_CA', 'eo', 'es_AR', 'es_CL', 'es_ES', 'es_MX', 'eu', 'ff', 'fur', 'fy_NL', 'ga_IE', 'gd', 'gl', 'gn',
+            'gu_IN', 'hi_IN', 'hsb', 'hy_AM', 'hye', 'ia', 'is', 'ja_JP_mac', 'ka', 'kab', 'kk', 'km', 'lij', 'lo',
+            'ltg', 'meh', 'mk', 'my', 'nb_NO', 'ne_NP', 'nn_NO', 'oc', 'pa_IN', 'rm', 'sat', 'sc', 'scn', 'sco', 'si',
+            'skr', 'son', 'sq', 'sv_SE', 'szl', 'tg', 'tl', 'trs', 'ur', 'uz', 'wo', 'xh'
         ])
     },
     re: {

package/src/data/regex.js

@@ -6,6 +6,7 @@ export default {
         manifest: /manifest\.json$/,
         script: /\.[cm]?[jt]sx?$/i
     },
+    i18n: { placeholder: /__MSG_.+?__/ },
     prefix: { at: /^@/, css: /^CSS/ },
     scheme: /^(?:([a-z][a-z0-9+.-]*):|\/\/)/i,
     url: /^https?:\/\//

package/src/rules/manifest-key-order.js

@@ -50,22 +50,21 @@ export default {
         return {
             'Document:exit'(document) {
                 const root = document.body ; if (root?.type != 'Object') return
-                const members = root.members || root.properties || [],
-                      violation = findViolation(members, master) ?? (order.length && findViolation(members, order))
+                const members = root.members || root.properties || []
+                let keys = master, violation = findViolation(members, master)
+                if (!violation && order.length) { keys = order ; violation = findViolation(members, order) }
                 if (!violation) return
                 const [first, second] = violation
                 context.report({
                     node: second.member, messageId: 'wrongOrder',
                     data: { first: second.key, second: first.key },
                     fix(fixer) {
-                        const sourceCode = context.sourceCode,
-                              firstText = sourceCode.text.slice(first.member.range[0], first.member.range[1]),
-                              secondText = sourceCode.text.slice(second.member.range[0], second.member.range[1]),
-                              between = sourceCode.text.slice(first.member.range[1], second.member.range[0])
-                        return fixer.replaceTextRange(
-                            [first.member.range[0], second.member.range[1]],
-                            secondText + between + firstText
-                        )
+                        const text = context.sourceCode.text,
+                              ranks = new Map(keys.map((key, index) => [key, index])),
+                              known = members.filter(member => ranks.has(keyOf(member))),
+                              sorted = known.toSorted((a, b) => ranks.get(keyOf(a)) - ranks.get(keyOf(b)))
+                        return known.map((member, idx) => // oxlint-disable-next-line security/detect-object-injection
+                            fixer.replaceTextRange(member.range, text.slice(...sorted[idx].range)))
                     }
                 })
             }

package/src/rules/no-invalid-locales.js

@@ -11,7 +11,7 @@ export default {
     meta: {
         type: 'problem',
         docs: {
-            description: 'Disallow invalid Chrome locale codes in `_locales/` folders and `default_locale`',
+            description: 'Disallow invalid locale codes in `_locales/` folders and `default_locale`',
             category: 'Possible Errors',
             recommended: true,
             manifest: true
@@ -35,7 +35,7 @@ export default {
         }],
         defaultOptions: [defaultOptions],
         messages: {
-            invalidLocale: '`{{value}}` is not a Chrome-supported locale code.'
+            invalidLocale: '`{{value}}` is not a supported locale code.'
         }
     },
 

package/src/rules/no-missing-default-locale.js

@@ -69,47 +69,66 @@ export default {
             { ignoreKeys, checkAllLocales } = { ...defaultOptions, ...context.options[0] },
               ignored = new Set(ignoreKeys),
               loc = { line: 1, column: 1 }
-        if (hasLocales && typeof defaultLocale != 'string') {
-            context.report({ loc, messageId: 'missingDefaultLocale' })
-            return {}
-        }
-        if (typeof defaultLocale == 'string' && !hasLocales) {
-            context.report({ loc, messageId: 'unexpectedDefaultLocale' })
-            return {}
-        }
-        if (typeof defaultLocale != 'string' || !hasLocales) return {}
-        const defaultMsgs = readMessages(path.join(localesDir, defaultLocale, 'messages.json'))
-        if (!defaultMsgs) {
-            context.report({ loc, messageId: 'missingDefaultLocaleFile', data: { locale: defaultLocale }})
-            return {}
-        }
-        const localeDirs = readLocaleDirs(localesDir)
-        if (checkAllLocales) {
-            const allMsgs = new Map([[defaultLocale, defaultMsgs]])
+        function run(report) {
+            if (hasLocales && typeof defaultLocale != 'string')
+                return report('missingDefaultLocale', null, null)
+            if (typeof defaultLocale == 'string' && !hasLocales)
+                return report('unexpectedDefaultLocale', 'default_locale', null)
+            if (typeof defaultLocale != 'string' || !hasLocales) return
+            const defaultMsgs = readMessages(path.join(localesDir, defaultLocale, 'messages.json'))
+            if (!defaultMsgs)
+                return report('missingDefaultLocaleFile', 'default_locale', { locale: defaultLocale })
+            const localeDirs = readLocaleDirs(localesDir)
+            if (checkAllLocales) {
+                const allMsgs = new Map([[defaultLocale, defaultMsgs]])
+                for (const locale of localeDirs) {
+                    if (locale == defaultLocale) continue
+                    const msgs = readMessages(path.join(localesDir, locale, 'messages.json'))
+                    if (msgs) allMsgs.set(locale, msgs)
+                }
+                const union = new Set()
+                for (const msgs of allMsgs.values())
+                    for (const key of Object.keys(msgs))
+                        if (!i18n.isPredefined(key) && !ignored.has(key)) union.add(key)
+                for (const [locale, msgs] of allMsgs)
+                    for (const key of union)
+                        if (!(key in msgs)) report('missingKeyInLocale', null, { key, locale })
+                return
+            }
             for (const locale of localeDirs) {
                 if (locale == defaultLocale) continue
-                const msgs = readMessages(path.join(localesDir, locale, 'messages.json'))
-                if (msgs) allMsgs.set(locale, msgs)
+                const msgs = readMessages(path.join(localesDir, locale, 'messages.json')) ; if (!msgs) continue
+                for (const key of Object.keys(msgs)) {
+                    if (i18n.isPredefined(key) || ignored.has(key)) continue
+                    if (!(key in defaultMsgs))
+                        report('missingKeyInDefault', null, { key, locale, defaultLocale })
+                }
             }
-            const union = new Set()
-            for (const msgs of allMsgs.values())
-                for (const key of Object.keys(msgs))
-                    if (!i18n.isPredefined(key) && !ignored.has(key)) union.add(key)
-            for (const [locale, msgs] of allMsgs)
-                for (const key of union)
-                    if (!(key in msgs))
-                        context.report({ loc, messageId: 'missingKeyInLocale', data: { key, locale }})
+        }
+        if (!regex.filename.manifest.test(filename)) {
+            run((messageId, _key, data) =>
+                context.report({ loc, messageId, ...(data ? { data } : {}) }))
             return {}
         }
-        for (const locale of localeDirs) {
-            if (locale == defaultLocale) continue
-            const msgs = readMessages(path.join(localesDir, locale, 'messages.json')) ; if (!msgs) continue
-            for (const key of Object.keys(msgs)) {
-                if (i18n.isPredefined(key) || ignored.has(key)) continue
-                if (!(key in defaultMsgs))
-                    context.report({ loc, messageId: 'missingKeyInDefault', data: { key, locale, defaultLocale }})
+        return {
+            'Document:exit'(document) {
+                const body = document.body ; if (body?.type != 'Object') return
+                const members = body.members || body.properties || [],
+                      findMember = key => members.find(m => {
+                          const k = m.name || m.key
+                          return (k?.value ?? k?.name) === key
+                      }),
+                      defaultLocaleMember = findMember('default_locale')
+                run((messageId, anchorKey, data) => {
+                    const targetNode = anchorKey == 'default_locale'
+                        ? defaultLocaleMember || body     // no key → point at body
+                        : body
+                    const reportObj = { messageId, ...(data ? { data } : {}) }
+                    if (targetNode) reportObj.node = targetNode
+                    else reportObj.loc = loc
+                    context.report(reportObj)
+                })
             }
         }
-        return {}
     }
 }

package/src/rules/no-missing-i18n-keys.js

@@ -29,32 +29,36 @@ export default {
         }],
         defaultOptions: [defaultOptions],
         messages: {
-            missingKey: '`{{key}}` is not in `_locales/{{locale}}/messages.json`.'
+            missingKey: '`{{key}}` is not in `_locales/{{locale}}/messages.json`.',
+            noMessagesFile: '`chrome.i18n` is used but `_locales/{{locale}}/messages.json` does not exist.'
         }
     },
 
     create(context) {
         const filename = context.filename ; if (!filename || filename == '<input>') return {}
-        const manifest = extension.manifest.read(context) ; if (!manifest?.default_locale) return {}
+        const manifest = extension.manifest.read(context) ; if (!manifest) return {}
         const root = extension.findRoot(context) ; if (!root) return {}
-        const i18n = i18nUtils.readDefaultLocaleMessages(manifest, root) ; if (!i18n) return {}
-        const { ignoreKeys } = { ...defaultOptions, ...context.options[0] },
-                ignored = new Set(ignoreKeys),
-                isMissing = key => !i18nUtils.isPredefined(key) && !ignored.has(key) && !(key in i18n.messages),
-                loc = { line: 1, column: 1 }
+        const i18n = i18nUtils.readDefaultLocaleMessages(manifest, root),
+              locale = manifest.default_locale ?? '<default_locale>',
+            { ignoreKeys } = { ...defaultOptions, ...context.options[0] },
+              ignored = new Set(ignoreKeys),
+              isMissing = key => !i18nUtils.isPredefined(key) && !ignored.has(key) && !(key in i18n.messages),
+              loc = { line: 1, column: 1 }
         if (regex.filename.script.test(filename))
             return {
                 CallExpression(node) {
                     if (node.callee.type != 'MemberExpression') return
                     const path = nodeUtils.getMemberPath(node.callee) ; if (!i18nData.re.getMsg.path.test(path)) return
                     const arg = node.arguments[0] ; if (!arg) return
+                    if (!i18n)
+                        return context.report({ node: arg, messageId: 'noMessagesFile', data: { locale }})
                     let key
                     if (arg.type == 'Literal' && typeof arg.value == 'string')
                         key = arg.value
                     else if (arg.type == 'TemplateLiteral' && arg.expressions.length === 0)
                         key = arg.quasis[0].value.cooked
                     if (key && isMissing(key))
-                        context.report({ loc, messageId: 'missingKey', data: { key, locale: i18n.locale }})
+                        context.report({ node: arg, messageId: 'missingKey', data: { key, locale: i18n.locale }})
                 }
             }
         if (!regex.filename.css.test(filename) && !regex.filename.manifest.test(filename))
@@ -65,6 +69,10 @@ export default {
                 const key = match[1]
                 if (seenKeys.has(key)) continue
                 seenKeys.add(key)
+                if (!i18n) {
+                    context.report({ loc, messageId: 'noMessagesFile', data: { locale }})
+                    continue
+                }
                 if (isMissing(key))
                     context.report({ loc, messageId: 'missingKey', data: { key, locale: i18n.locale }})
             }

package/src/rules/require-short-name-when-useful.js

@@ -1,10 +1,11 @@
 import extension from '../utils/extension.js'
 import regex from '../data/regex.js'
 
-const defaultOptions = { maxNameLength: 12, always: false, checkRedundant: false },
-      re = { i18nPlaceholder: /^__MSG_.+__$/ }
+const defaultOptions = { maxNameLength: 12, always: false, checkRedundant: false }
 
-function isI18n(value) { return typeof value == 'string' && re.i18nPlaceholder.test(value) }
+function findMember(members, key) { return members.find(member => keyOf(member) === key) }
+function getMinLength(name) { return typeof name == 'string' ? name.split(regex.i18n.placeholder).join('x').length : 0 }
+function keyOf(member) { const keyNode = member.name || member.key ; return keyNode?.value ?? keyNode?.name }
 
 export default {
     meta: {
@@ -35,7 +36,7 @@ export default {
         defaultOptions: [defaultOptions],
         messages: {
             missingShortName: '`name` exceeds {{max}} chars. Declare `short_name` to control truncation.',
-            shortNameTooLong: '`short_name` exceeds the recommended {{max}}-character limit (found {{length}}).',
+            shortNameTooLong: '`short_name` exceeds the recommended {{max}}-character limit (found at least {{length}}).',
             redundantShortName: '`short_name` duplicates `name` (Chrome falls back to `name` automatically).'
         }
     },
@@ -43,24 +44,27 @@ export default {
     create(context) {
         if (!regex.filename.manifest.test(extension.file.getName(context))) return {}
         const { maxNameLength, always, checkRedundant } = { ...defaultOptions, ...context.options[0] }
-        let manifest
-        try { manifest = JSON.parse(context.sourceCode.text) } catch { return {} }
-        if (!manifest || typeof manifest != 'object') return {}
-        const name = manifest.name, shortName = manifest.short_name
-        if (typeof name != 'string') return {}
-        const nameIsI18n = isI18n(name),
-              shortNameIsI18n = isI18n(shortName),
-              loc = { line: 1, column: 1 }
-        if (typeof shortName != 'string') {
-            if (always || (!nameIsI18n && name.length > maxNameLength))
-                context.report({ loc, messageId: 'missingShortName', data: { max: maxNameLength }})
-        } else {
-            if (!shortNameIsI18n && shortName.length > maxNameLength)
-                context.report({ loc, messageId: 'shortNameTooLong',
-                    data: { max: maxNameLength, length: shortName.length }})
-            if (checkRedundant && shortName == name)
-                context.report({ loc, messageId: 'redundantShortName' })
+        return {
+            'Document:exit'(document) {
+                const root = document.body ; if (root?.type != 'Object') return
+                const members = root.members || root.properties || [],
+                      nameMember = findMember(members, 'name'),
+                      shortNameMember = findMember(members, 'short_name'),
+                      name = nameMember?.value?.value,
+                      shortName = shortNameMember?.value?.value
+                if (typeof name != 'string') return
+                const nameLength = getMinLength(name), shortNameLength = getMinLength(shortName)
+                if (typeof shortName != 'string') {
+                    if (always || nameLength > maxNameLength)
+                        context.report({ node: nameMember, messageId: 'missingShortName', data: { max: maxNameLength }})
+                } else {
+                    if (shortNameLength > maxNameLength)
+                        context.report({ node: shortNameMember, messageId: 'shortNameTooLong',
+                            data: { max: maxNameLength, length: shortNameLength }})
+                    if (checkRedundant && shortName == name)
+                        context.report({ node: shortNameMember, messageId: 'redundantShortName' })
+                }
+            }
         }
-        return {}
     }
 }

package/src/rules/valid-filenames.js

@@ -25,23 +25,52 @@ function collectRefs(manifest) {
     const refs = []
     for (const [label, get] of refKeys) {
         const val = get(manifest)
-        if (typeof val == 'string') refs.push({ label, file: val })
+        if (typeof val == 'string') refs.push({ label, pathArr: label.split('.'), file: val })
     }
     if (manifest.background?.scripts)
-        refs.push(...manifest.background.scripts.map(file => ({ label: 'background.scripts', file })))
+        manifest.background.scripts.forEach((file, i) =>
+            refs.push({ label: 'background.scripts', pathArr: ['background', 'scripts', i], file }))
     if (manifest.icons)
-        refs.push(...Object.values(manifest.icons).map(file => ({ label: 'icons', file })))
+        Object.entries(manifest.icons).forEach(([k, file]) =>
+            refs.push({ label: 'icons', pathArr: ['icons', k], file }))
     if (manifest.action?.default_icon && typeof manifest.action.default_icon == 'object')
-        refs.push(...Object.values(manifest.action.default_icon).map(file => ({ label: 'action.default_icon', file })))
-    for (const cs of manifest.content_scripts || []) {
-        if (cs.js) refs.push(...cs.js.map(file => ({ label: 'content_scripts.js', file })))
-        if (cs.css) refs.push(...cs.css.map(file => ({ label: 'content_scripts.css', file })))
+        Object.entries(manifest.action.default_icon).forEach(([k, file]) =>
+            refs.push({ label: 'action.default_icon', pathArr: ['action', 'default_icon', k], file }))
+    for (const [ci, cs] of (manifest.content_scripts || []).entries()) {
+        if (cs.js) cs.js.forEach((file, i) =>
+            refs.push({ label: 'content_scripts.js', pathArr: ['content_scripts', ci, 'js', i], file }))
+        if (cs.css) cs.css.forEach((file, i) =>
+            refs.push({ label: 'content_scripts.css', pathArr: ['content_scripts', ci, 'css', i], file }))
     }
-    for (const war of manifest.web_accessible_resources || [])
-        if (war.resources) refs.push(...war.resources.map(file => ({ label: 'web_accessible_resources', file })))
+    for (const [wi, war] of (manifest.web_accessible_resources || []).entries())
+        if (war.resources) war.resources.forEach((file, i) =>
+            refs.push({ label: 'web_accessible_resources', pathArr: ['web_accessible_resources', wi, 'resources', i], file }))
     return refs
 }
 
+function getNodeAt(root, pathArr) {
+    let node = root
+    for (const seg of pathArr) {
+        if (node == null) return null
+        if (typeof seg == 'number') {
+            if (node.type != 'Array') return null
+            const elem = (node.elements || node.items || [])[seg]
+            if (elem == null) return null
+            // @eslint/json wraps array elements in `{ value: <node> }`; unwrap
+            node = (typeof elem.value == 'object' && elem.value !== null) ? elem.value : elem
+        } else {
+            if (node.type != 'Object') return null
+            const member = (node.members || node.properties || []).find(m => {
+                const k = m.name || m.key
+                return (k?.value ?? k?.name) === seg
+            })
+            if (!member) return null
+            node = member.value
+        }
+    }
+    return node
+}
+
 function resolveRef(abs) {
     const dir = path.dirname(abs),
           base = path.basename(abs)
@@ -122,22 +151,34 @@ export default {
                 data: { length: filename.length, max: maxFullPathLength }
             })
         if (basename != 'manifest.json' || (!checkFileExists && !enforceCaseSensitivity)) return {}
-        const manifestPath = path.join(extRoot, 'manifest.json')
-        if (!fs.existsSync(manifestPath)) return {}
-        let manifest ; try { manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8')) } catch { return {} }
-        for (const { label, file } of collectRefs(manifest)) {
-            if (file.includes('*')) continue // wildcard refs can't be verified
-            const abs = path.resolve(extRoot, file),
-                  result = resolveRef(abs)
-            if (!result
-                || result.id == 'fileMissing' && !checkFileExists
-                || result.id == 'caseMismatch' && !enforceCaseSensitivity
-            ) continue
-            const data = result.id == 'caseMismatch'
-                ? { label, file, actual: result.actual }
-                : { label, file }
-            context.report({ loc: { line: 1, column: 1 }, messageId: result.id, data })
+        return {
+            'Document:exit'(document) {
+                const root = document.body ; if (root?.type != 'Object') return
+                const manifestPath = path.join(extRoot, 'manifest.json')
+                let manifest
+                try {
+                    manifest = fs.existsSync(manifestPath)
+                        ? JSON.parse(fs.readFileSync(manifestPath, 'utf8'))
+                        : JSON.parse(context.sourceCode.text)
+                } catch { return }
+                for (const { label, pathArr, file } of collectRefs(manifest)) {
+                    if (file.includes('*')) continue // wildcard refs can't be verified
+                    const abs = path.resolve(extRoot, file),
+                          result = resolveRef(abs)
+                    if (!result
+                        || result.id == 'fileMissing' && !checkFileExists
+                        || result.id == 'caseMismatch' && !enforceCaseSensitivity
+                    ) continue
+                    const data = result.id == 'caseMismatch'
+                        ? { label, file, actual: result.actual }
+                        : { label, file }
+                    const node = getNodeAt(root, pathArr)
+                    context.report({
+                        ...(node ? { node } : { loc: { line: 1, column: 1 } }),
+                        messageId: result.id, data
+                    })
+                }
+            }
         }
-        return {}
     }
 }

package/src/rules/valid-url-fields.js

@@ -16,44 +16,64 @@ function collectStrings(obj, path = [], out = []) {
     if (obj == null) return out
     if (typeof obj == 'string') out.push({ path: path.join('.'), value: obj })
     else if (Array.isArray(obj))
-        for (const elem of obj) collectStrings(elem, path, out)
+        for (const element of obj) collectStrings(element, path, out)
     else if (typeof obj == 'object')
         for (const key of Object.keys(obj)) // oxlint-disable-next-line security/detect-object-injection
             collectStrings(obj[key], [...path, key], out)
     return out
 }
 
-function isURL(value) { return re.absoluteURL.test(value.replace(re.template, 'x')) }
+function collectNodes(node, pathArray = [], out = []) {
+    if (node?.type == 'Object') {
+        for (const member of node.members || node.properties || []) {
+            const keyNode = member.name || member.key
+            const key = keyNode?.value ?? keyNode?.name
+            if (typeof key != 'string') continue
+            collectNodes(member.value, [...pathArray, key], out)
+        }
+    } else if (node?.type == 'Array') {
+        for (const element of node.elements || node.items || []) {
+            if (element == null) continue
+            // @eslint/json wraps array elements in `{ value: <node> }`; unwrap
+            collectNodes(element.value ?? element, pathArray, out)
+        }
+    } else if (node?.type == 'String') {
+        out.push({ path: pathArray.join('.'), value: node.value, node })
+    }
+    return out
+}
 
-function validateManifest(context, manifest, opts) {
-    const { checkURLfields, checkMatchPatterns, allowedSchemes, allowAllURLs } = opts,
-          loc = { line: 1, column: 1 }
-    for (const { path, value } of collectStrings(manifest)) {
+function isURL(value) {
+    return value.match(regex.i18n.placeholder)?.[0] === value
+        || re.absoluteURL.test(value.replace(re.template, 'x'))
+}
+
+function validate(context, items, options) {
+    const { checkURLfields, checkMatchPatterns, allowedSchemes, allowAllURLs } = options,
+            loc = { line: 1, column: 1 }
+    function report(node, messageId, data) {
+        context.report({ ...(node ? { node } : { loc }), messageId, data }) }
+    for (const { path, value, node } of items) {
         if (checkURLfields && manifestData.paths.url.has(path)) {
-            if (!isURL(value))
-                context.report({ loc, messageId: 'invalidURL', data: { field: path, value }})
+            if (!isURL(value)) report(node, 'invalidURL', { field: path, value })
         } else if (checkMatchPatterns && manifestData.paths.match.has(path)) {
             if (value == '<all_urls>') {
-                if (!allowAllURLs)
-                    context.report({ loc, messageId: 'allURLs', data: { field: path }})
+                if (!allowAllURLs) report(node, 'allURLs', { field: path })
                 continue
             }
             const match = value.match(re.match)
-            if (!match) {
-                context.report({ loc, messageId: 'invalidMatchPattern', data: { field: path, value }})
-                continue
-            }
+            if (!match) { report(node, 'invalidMatchPattern', { field: path, value }) ; continue }
             const [, scheme, host] = match
             if (scheme != '*' && !allowedSchemes.includes(scheme))
-                context.report({ loc, messageId: 'invalidScheme', data: { field: path, value }})
+                report(node, 'invalidScheme', { field: path, value })
             else if (scheme == 'file' && host != '')
-                context.report({ loc, messageId: 'invalidFileHost', data: { field: path, value }})
+                report(node, 'invalidFileHost', { field: path, value })
             else if (path == 'externally_connectable.matches' && host.includes('*'))
-                context.report({ loc, messageId: 'invalidExternalHost', data: { field: path, value }})
+                report(node, 'invalidExternalHost', { field: path, value })
             else if (host.includes('*') && host != '*' && !host.startsWith('*.'))
-                context.report({ loc, messageId: 'invalidHost', data: { field: path, value }})
+                report(node, 'invalidHost', { field: path, value })
             else if (path == 'web_accessible_resources.matches' && !value.endsWith('/*'))
-                context.report({ loc, messageId: 'invalidWARPath', data: { field: path, value }})
+                report(node, 'invalidWARPath', { field: path, value })
         }
     }
 }
@@ -109,14 +129,12 @@ export default {
         if (!options.checkURLfields && !options.checkMatchPatterns) return {}
         if (!regex.filename.manifest.test(filename)) {
             const manifest = extension.manifest.read(context) ; if (!manifest) return {}
-            validateManifest(context, manifest, options)
-            return {}
+            return { 'Program:exit'() { validate(context, collectStrings(manifest), options) }}
         }
         return {
-            'Document:exit'() {
-                let manifest
-                try { manifest = JSON.parse(context.sourceCode.text) } catch { return }
-                validateManifest(context, manifest, options)
+            'Document:exit'(document) {
+                const body = document.body ; if (body?.type != 'Object') return
+                validate(context, collectNodes(body), options)
             }
         }
     }