eslint-plugin-greasemonkey 1.8.4 → 1.10.0

package/src/rules/no-insecure-fetch.js

@@ -0,0 +1,108 @@
+import headers from '../data/headers.js'
+import regex from '../data/regex.js'
+
+const re = {
+    insecureURL: /^http:\/\/(?!localhost\b|127\.0\.0\.1\b|\[::1\])/i,
+    meta: {
+        end:   /^\/\/\s*==\/UserScript==\s*$/,
+        line:  /^\/\/\s*@([\w-]+)(?::[\w-]+)?\s+(\S.*)$/, // oxlint-disable-line security/detect-unsafe-regex
+        start: /^\/\/\s*==UserScript==\s*$/
+    }
+}
+
+function isInsecure(url) { return typeof url == 'string' && re.insecureURL.test(url) }
+function urlFromLiteral(node) {
+    return (node?.type == 'Literal'
+        && typeof node.value == 'string'
+        && isInsecure(node.value)
+    ) ? node.value : null
+}
+function urlFromOptions(node) {
+    if (node?.type != 'ObjectExpression') return null
+    for (const prop of node.properties)
+        if (prop.type == 'Property' && (prop.key?.name == 'url' || prop.key?.value == 'url')) {
+            const val = prop.value
+            if (val?.type == 'Literal' && isInsecure(val.value)) return val.value
+        }
+    return null
+}
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Flags `fetch()`, `XMLHttpRequest.open()`, `GM_xmlhttpRequest()`, `GM.xmlHttpRequest()` calls and URL fields that use `http://`',
+            category: 'Possible Errors',
+            recommended: true,
+            security: true
+        },
+        schema: [],
+        messages: {
+            insecureFetch: '`fetch()` to "{{url}}" insecure. Use HTTPS or a relative path instead.',
+            insecureXHR: '`XMLHttpRequest.open()` to "{{url}}" insecure. Use HTTPS or a relative path instead.',
+            insecureGMXHR: '`{{callee}}()` to "{{url}}" insecure. Use HTTPS or a relative path instead.',
+            insecureMetadata: '`@{{key}}` URL "{{url}}" insecure. Use HTTPS instead.'
+        }
+    },
+
+    create(context) {
+        const xhrVars = new Set(),
+              sourceCode = context.sourceCode ?? context.getSourceCode()
+        function reportMetadata() {
+            const lines = sourceCode.text.split(regex.newline)
+            let inBlock = false
+            for (const [i, rawLine] of lines.entries()) {
+                const line = rawLine.trimEnd()
+                if (re.meta.start.test(line.trim())) { inBlock = true ; continue }
+                if (inBlock && re.meta.end.test(line.trim())) break
+                if (!inBlock) continue
+                const match = line.match(re.meta.line) ; if (!match) continue
+                const key = match[1]
+                const type = headers.url.get(key) ; if (!type) continue
+                const tokens = match[2].split(regex.whitespace.all),
+                      url = type == 'named-url' ? tokens[1] : tokens[0]
+                if (!url || !isInsecure(url)) continue
+                const col = line.lastIndexOf(url)
+                context.report({
+                    loc: { start: { line: i +1, column: col },
+                           end:   { line: i +1, column: col + url.length }},
+                    messageId: 'insecureMetadata', data: { key, url }
+                })
+            }
+        }
+        function reportGMXHR(node) {
+            const url = urlFromLiteral(node.arguments[0]) ?? urlFromOptions(node.arguments[0]) ; if (!url) return
+            const callee = node.callee.type == 'MemberExpression'
+                ? `${node.callee.object.name}.${node.callee.property.name}`
+                : node.callee.name
+            context.report({ node: node.arguments[0], messageId: 'insecureGMXHR', data: { callee, url }})
+        }
+        return {
+            Program() { reportMetadata() },
+            VariableDeclarator(node) {
+                if (node.init?.type == 'NewExpression'
+                    && node.init.callee?.name == 'XMLHttpRequest'
+                    && node.id.type == 'Identifier'
+                ) xhrVars.add(node.id.name)
+            },
+            CallExpression(node) {
+                if (node.callee.type == 'Identifier' && node.callee.name == 'fetch') {
+                    const url = urlFromLiteral(node.arguments[0])
+                    if (url) context.report({ node: node.arguments[0], messageId: 'insecureFetch', data: { url }})
+                } else if (node.callee.type == 'MemberExpression'
+                    && node.callee.property?.name == 'open'
+                    && node.callee.object?.type == 'Identifier'
+                    && xhrVars.has(node.callee.object.name)
+                ) { // xhr.open('GET', 'http://…')
+                    const url = urlFromLiteral(node.arguments[1])
+                    if (url) context.report({ node: node.arguments[1], messageId: 'insecureXHR', data: { url }})
+                } else if (node.callee.type == 'Identifier'
+                    && node.callee.name == 'GM_xmlhttpRequest'
+                    || node.callee.type == 'MemberExpression'
+                        && node.callee.object?.name == 'GM'
+                        && node.callee.property?.name == 'xmlHttpRequest'
+                ) reportGMXHR(node)
+            }
+        }
+    }
+}

package/src/rules/no-insecure-messaging.js

@@ -0,0 +1,67 @@
+const re = {
+    messageTargets: new Set(['window', 'self', 'unsafeWindow']),
+    postmsgValidation: /\b\w+\.(?:origin|source)\b/
+}
+
+function isMessageTarget(obj) { return obj?.type == 'Identifier' && re.messageTargets.has(obj.name) }
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Requires origin/source validation + explicit `postMessage()` target',
+            category: 'Possible Errors',
+            recommended: true,
+            security: true
+        },
+        defaultOptions: [{ disallowWildcardTarget: true }],
+        schema: [{
+            type: 'object',
+            properties: {
+                disallowWildcardTarget: {
+                    type: 'boolean',
+                    description: 'Flag postMessage calls that use "*" as targetOrigin'
+                }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            unvalidatedPostMessage: '`{{target}}` message handler must validate `event.origin`/`event.source` '
+                                  + 'before processing messages.',
+            wildcardTarget: '`postMessage` to `"*"` leaks data to any origin. '
+                          + 'Explicitly specify `targetOrigin` instead.'
+        }
+    },
+
+    create(context) {
+        const opts = context.options[0] || {},
+              disallowWildcard = opts.disallowWildcardTarget !== false,
+              sourceCode = context.sourceCode ?? context.getSourceCode()
+        function checkPostMessageHandler(node, handlerNode, target) {
+            if (!handlerNode) return
+            const body = sourceCode.getText(handlerNode)
+            if (re.postmsgValidation.test(body)) return
+            context.report({ node, messageId: 'unvalidatedPostMessage', data: { target }})
+        }
+        return {
+            CallExpression(node) {
+                if (node.callee.type != 'MemberExpression') return
+                if (node.callee.property?.name == 'addEventListener'
+                    && node.arguments[0]?.value == 'message'
+                    && isMessageTarget(node.callee.object)
+                ) checkPostMessageHandler(node, node.arguments[1], node.callee.object.name)
+                if (disallowWildcard && node.callee.property?.name == 'postMessage') {
+                    const target = node.arguments[1]
+                    if (target?.type == 'Literal' && target.value == '*')
+                        context.report({ node: target, messageId: 'wildcardTarget' })
+                }
+            },
+            AssignmentExpression(node) {
+                if (node.left.type == 'MemberExpression'
+                    && node.left.property?.name == 'onmessage'
+                    && isMessageTarget(node.left.object)
+                ) checkPostMessageHandler(node, node.right, node.left.object.name)
+            }
+        }
+    }
+}

package/src/rules/no-invalid-grants.js

@@ -1,10 +1,11 @@
-import { allAPIs, supportsAPI } from '../data/apis.js'
+import api from '../utils/api.js'
+import metadata from '../utils/metadata.js'
 
-import { extractMetadata } from '../utils.js'
+import apis from '../data/apis.js'
+import headers from '../data/headers.js'
 
-const managers = ['tampermonkey', 'violentmonkey', 'greasemonkey', 'scriptcat', 'adguard'],
-      specialGrants = new Set(['none', 'unsafeWindow', 'window.close', 'window.focus', 'window.onurlchange']),
-      allGrants = new Set([...allAPIs, ...specialGrants]),
+const specialGrants = new Set(['none', 'unsafeWindow', 'window.close', 'window.focus', 'window.onurlchange']),
+      allGrants = new Set([...apis.all, ...specialGrants]),
       sortedGrants = new Map(Array.from(allGrants, grant => [grant.toLowerCase(), grant]))
 
 export default {
@@ -20,8 +21,9 @@ export default {
             properties: {
                 target: {
                     anyOf: [
-                        { type: 'string', enum: ['all', ...managers] },
-                        { type: 'array', items: { type: 'string', enum: managers }, minItems: 1, uniqueItems: true }
+                        { type: 'string', enum: ['all', ...headers.managers] },
+                        { type: 'array', items: { type: 'string', enum: headers.managers },
+                            minItems: 1, uniqueItems: true }
                     ],
                     description: 'Manager(s) whose grants to validate against (default: all)'
                 },
@@ -51,7 +53,7 @@ export default {
               allowedGrants = new Set(Array.isArray(rawAllowed) ? rawAllowed : [rawAllowed])
         return {
             Program() {
-                const metaEntries = extractMetadata(context.sourceCode),
+                const metaEntries = metadata.extract(context.sourceCode),
                       grantEntries = metaEntries.filter(entry => entry.key == 'grant')
                 for (const grant of grantEntries) {
                     const grantName = grant.value.trim()
@@ -67,9 +69,9 @@ export default {
                         continue
                     }
                     if (!targets.includes('all')
-                        && !targets.some(manager => supportsAPI({ manager, api: grantName }))
+                        && !targets.some(manager => api.supports({ manager, api: grantName }))
                     ) {
-                        const supporting = managers.filter(manager => supportsAPI({ manager, api: grantName }))
+                        const supporting = headers.managers.filter(manager => api.supports({ manager, api: grantName }))
                         context.report({ node: grant.comment, messageId: 'unsupportedGrant',
                             data: { grant: grantName, target: targets.join(', '), supporting: supporting.join(', ') }})
                     }

package/src/rules/no-invalid-headers.js

@@ -1,12 +1,11 @@
-import { managerHeaders, managers, localizedHeaders, validHeaders } from '../data/headers.js'
-
-import { extractMetadata } from '../utils.js'
+import metadata from '../utils/metadata.js'
+import headers from '../data/headers.js'
 
 function parseAllowedPattern(entry) {
     if (typeof entry != 'string' || !entry.startsWith('/')) return null
     const lastSlash = entry.lastIndexOf('/')
     if (lastSlash == 0) return null
-    try { /* eslint-disable-next-line security/detect-non-literal-regexp */
+    try { /* oxlint-disable-next-line security/detect-non-literal-regexp */
         return new RegExp(entry.slice(1, lastSlash), entry.slice(lastSlash +1))
     } catch { return null }
 }
@@ -24,8 +23,9 @@ export default {
             properties: {
                 target: {
                     anyOf: [
-                        { type: 'string', enum: ['all', ...managers] },
-                        { type: 'array', items: { type: 'string', enum: managers }, minItems: 1, uniqueItems: true }
+                        { type: 'string', enum: ['all', ...headers.managers] },
+                        { type: 'array', items: {
+                            type: 'string', enum: headers.managers }, minItems: 1, uniqueItems: true }
                     ],
                     description: 'Manager(s) whose headers to validate against (default: all)'
                 },
@@ -50,8 +50,8 @@ export default {
               allowedList = [options.allowedHeaders ?? []].flat(),
               allowedExact = new Set(),
               allowedRegexes = [],
-              validSet = targets.includes('all') ? validHeaders.get('all')
-                       : new Set(targets.flatMap(target => [...validHeaders.get(target)]))
+              validSet = targets.includes('all') ? headers.valid.get('all')
+                       : new Set(targets.flatMap(target => [...headers.valid.get(target)]))
         for (const entry of allowedList) {
             if (entry instanceof RegExp) allowedRegexes.push(entry)
             else if (typeof entry == 'string') {
@@ -62,13 +62,13 @@ export default {
         }
         return {
             Program() {
-                const metaEntries = extractMetadata(context.sourceCode)
+                const metaEntries = metadata.extract(context.sourceCode)
                 for (const entry of metaEntries) {
                     if (allowedExact.has(entry.key)) continue
                     if (allowedRegexes.some(re => re.test(entry.key))) continue
-                    if (localizedHeaders.includes(entry.key.split(':')[0])) continue
+                    if (headers.localized.includes(entry.key.split(':')[0])) continue
                     if (validSet.has(entry.key)) continue
-                    const supporting = managerHeaders.get(entry.key)
+                    const supporting = headers.manager.get(entry.key)
                     if (supporting)
                         context.report({ node: entry.comment, messageId: 'unsupportedHeader',
                             data: { header: entry.key, target: targets.join(', '), supporting: supporting.join(', ') }})

package/src/rules/no-missing-grants.js

@@ -1,9 +1,7 @@
-import { gmLegacyAPIs, gmModernAPIs, scAPIs } from '../data/apis.js'
+import metadata from '../utils/metadata.js'
+import apis from '../data/apis.js'
 
-import { extractMetadata } from '../utils.js'
-
-const apis = new Set([...gmLegacyAPIs, ...gmModernAPIs, ...scAPIs]),
-      grantlessAPIs = new Set(['GM_info', 'GM.info']) // always available, no grant required
+apis.grantless = new Set(['GM_info', 'GM.info'])
 
 export default {
     meta: {
@@ -19,7 +17,7 @@ export default {
 
     create(context) {
         const usedAPIs = new Map()
-        function record(name, node) { if (apis.has(name) && !usedAPIs.has(name)) usedAPIs.set(name, node) }
+        function record(name, node) { if (apis.all.has(name) && !usedAPIs.has(name)) usedAPIs.set(name, node) }
         return {
             Identifier(node) { record(node.name, node) },
             MemberExpression(node) {
@@ -37,12 +35,12 @@ export default {
             'Program:exit'() {
                 if (!usedAPIs.size) return
                 const declared = new Set(
-                    extractMetadata(context.sourceCode)
+                    metadata.extract(context.sourceCode)
                         .filter(entry => entry.key == 'grant')
                         .map(entry => entry.value.trim())
                 )
                 for (const [api, node] of usedAPIs) {
-                    if (grantlessAPIs.has(api) || declared.has(api)) continue
+                    if (apis.grantless.has(api) || declared.has(api)) continue
                     context.report({ node, messageId: 'missingGrant', data: { api }})
                 }
             }

package/src/rules/no-missing-resources.js

@@ -1,7 +1,9 @@
-import { extractMetadata, resolveTemplate } from '../utils.js'
+import metadata from '../utils/metadata.js'
+import template from '../utils/template.js'
 
-const resourceGetterNames = new Set(['GM_getResourceText', 'GM_getResourceURL']),
-      re = { specialChars: /[.*+?^${}()|[\]\\]/g, whitespace: /\s+/ }
+import regex from '../data/regex.js'
+
+const resourceGetterNames = new Set(['GM_getResourceText', 'GM_getResourceURL'])
 
 export default {
     meta: {
@@ -24,12 +26,12 @@ export default {
             if (arg?.type == 'Literal' && typeof arg.value == 'string')
                 usedRefs.push({ names: [arg.value], pattern: null, node })
             else if (arg?.type == 'TemplateLiteral') {
-                const resolved = resolveTemplate(arg)
+                const resolved = template.resolve(arg)
                 if (resolved) usedRefs.push({ names: resolved, pattern: null, node })
                 else usedRefs.push({
                     names: null,
-                    pattern: new RegExp( // eslint-disable-line security/detect-non-literal-regexp
-                        `^${arg.quasis.map(q => q.value.raw.replace(re.specialChars, '\\$&')).join('.*')}$`),
+                    pattern: new RegExp( // oxlint-disable-line security/detect-non-literal-regexp
+                        `^${arg.quasis.map(q => q.value.raw.replace(regex.specialChars, '\\$&')).join('.*')}$`),
                     node
                 })
             }
@@ -42,9 +44,9 @@ export default {
             'Program:exit'() {
                 if (!usedRefs.length) return
                 const declared = new Set(
-                    extractMetadata(context.sourceCode)
+                    metadata.extract(context.sourceCode)
                         .filter(entry => entry.key == 'resource')
-                        .map(entry => entry.value.trim().split(re.whitespace)[0])
+                        .map(entry => entry.value.trim().split(regex.whitespace.all)[0])
                 )
                 for (const ref of usedRefs) {
                     if (ref.names) {

package/src/rules/no-sensitive-grants.js

@@ -0,0 +1,81 @@
+import apis from '../data/apis.js'
+import headers from '../data/headers.js'
+import regex from '../data/regex.js'
+
+const re = { connect: /^\s*\/\/\s*@connect\s+(\S+)/, grant: /^\s*\/\/\s*@grant\s+(\S+)/ }
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Flags security-sensitive `@grant` values and overbroad `@connect` patterns',
+            category: 'Possible Errors',
+            recommended: false,
+            security: true
+        },
+        defaultOptions: [{ target: 'all', allowedGrants: [], allowBroadConnect: false }],
+        schema: [{
+            type: 'object',
+            properties: {
+                target: {
+                    oneOf: [
+                        { type: 'string', enum: ['all', ...headers.managers], description: 'Single manager (or "all")' },
+                        { type: 'array', items: { type: 'string', enum: headers.managers },
+                            description: 'Multiple managers' }
+                    ],
+                    description: 'Manager(s) whose sensitive-grant set to check against'
+                },
+                allowedGrants: {
+                    oneOf: [
+                        { type: 'string', description: 'Single sensitive grant to allow' },
+                        { type: 'array', items: { type: 'string' }, description: 'Multiple sensitive grants to allow' }
+                    ],
+                    description: 'Sensitive grants to explicitly allow'
+                },
+                allowBroadConnect: { type: 'boolean', description: 'Permit @connect * and wildcard-domain patterns' }
+            },
+            additionalProperties: false
+        }],
+        messages: {
+            sensitiveGrant: '`@grant {{grant}}` is security-sensitive. Review whether it\'s needed'
+                          + ' or add it to `allowedGrants`.',
+            broadConnect:   '`@connect {{pattern}}` allows `GM_xmlhttpRequest` to reach arbitrary hosts.'
+                          + ' Scope it to specific hosts or enable `allowBroadConnect`.'
+        }
+    },
+
+    create(context) {
+        const opts = context.options[0] ?? {},
+              target = opts.target ?? 'all',
+              allowBroadConnect = opts.allowBroadConnect === true,
+              allowed = new Set(typeof opts.allowedGrants == 'string' ? [opts.allowedGrants]
+                      : opts.allowedGrants ?? []),
+              sourceCode = context.sourceCode ?? context.getSourceCode(),
+              managers = target == 'all' ? [...apis.managerSensitive.keys()]
+                       : Array.isArray(target) ? target : [target]
+        const isSensitive = grant => apis.sensitive.has(grant)
+            || managers.some(mgr => apis.managerSensitive.get(mgr)?.has(grant))
+        const report = (line, messageId, data, col, len) => context.report({
+            loc: { start: { line, column: col }, end: { line, column: col + len }}, messageId, data })
+        return {
+            Program() {
+                const match = sourceCode.text.match(regex.meta.block) ; if (!match) return
+                const lines = match[1].split(regex.newline),
+                      baseLine = sourceCode.text.slice(0, match.index).split(regex.newline).length,
+                      lineData = lines.map(line => ({
+                          grant: line.match(re.grant)?.[1],
+                          connect: line.match(re.connect)?.[1]
+                      })),
+                      hasXHR = lineData.some(d => d.grant == 'GM_xmlhttpRequest' || d.grant == 'GM.xmlHttpRequest')
+                for (const [i, { grant, connect }] of lineData.entries()) {
+                    const lineNo = baseLine + i +1,
+                          raw = lines[i] // oxlint-disable-line security/detect-object-injection
+                    if (grant && !allowed.has(grant) && isSensitive(grant))
+                        report(lineNo, 'sensitiveGrant', { grant }, raw.indexOf(grant), grant.length)
+                    if (connect && hasXHR && !allowBroadConnect && headers.broadConnect.has(connect))
+                        report(lineNo, 'broadConnect', { pattern: connect }, raw.indexOf(connect), connect.length)
+                }
+            }
+        }
+    }
+}

package/src/rules/no-unused-grants.js

@@ -1,4 +1,4 @@
-import { extractMetadata } from '../utils.js'
+import metadata from '../utils/metadata.js'
 
 export default {
     meta: {
@@ -30,7 +30,7 @@ export default {
             },
             'Program:exit'() {
                 const sourceCode = context.sourceCode,
-                      metaEntries = extractMetadata(sourceCode),
+                      metaEntries = metadata.extract(sourceCode),
                       grants = metaEntries.filter(entry => entry.key == 'grant')
                 if (!grants.length) return
                 for (const grant of grants) {

package/src/rules/no-unused-resources.js

@@ -1,7 +1,9 @@
-import { extractMetadata, resolveTemplate } from '../utils.js'
+import metadata from '../utils/metadata.js'
+import template from '../utils/template.js'
 
-const resourceGetterNames = new Set(['GM_getResourceText', 'GM_getResourceURL']),
-      re = { specialChars: /[.*+?^${}()|[\]\\]/g, whitespace: /\s+/ }
+import regex from '../data/regex.js'
+
+const resourceGetterNames = new Set(['GM_getResourceText', 'GM_getResourceURL'])
 
 export default {
     meta: {
@@ -25,19 +27,19 @@ export default {
                 if (arg?.type == 'Literal' && typeof arg.value == 'string')
                     usedResources.add(arg.value)
                 else if (arg?.type == 'TemplateLiteral') {
-                    const resolved = resolveTemplate(arg)
+                    const resolved = template.resolve(arg)
                     if (resolved)
                         for (const name of resolved) usedResources.add(name)
-                    else usedPatterns.push(new RegExp( // eslint-disable-line security/detect-non-literal-regexp
-                        `^${arg.quasis.map(quasi => quasi.value.raw.replace(re.specialChars, '\\$&')).join('.*')}$`))
+                    else usedPatterns.push(new RegExp( // oxlint-disable-line security/detect-non-literal-regexp
+                        `^${arg.quasis.map(quasi => quasi.value.raw.replace(regex.specialChars, '\\$&')).join('.*')}$`))
                 }
             },
             'Program:exit'() {
-                const metaEntries = extractMetadata(context.sourceCode),
+                const metaEntries = metadata.extract(context.sourceCode),
                       resources = metaEntries.filter(entry => entry.key == 'resource')
                 if (!resources.length) return
                 for (const res of resources) {
-                    const name = res.value.trim().split(re.whitespace)[0]
+                    const name = res.value.trim().split(regex.whitespace.all)[0]
                     if (usedResources.has(name) || usedPatterns.some(patt => patt.test(name))) continue
                     context.report({ node: res.comment, messageId: 'unusedResource', data: { name }})
                 }

package/src/rules/prefer-gm-add-style.js

@@ -0,0 +1,67 @@
+const re = { appendMethod: /^append(?:Child)?$/ }
+
+function isCreateStyle(node) {
+    return node?.type == 'CallExpression'
+        && node.callee?.property?.name == 'createElement'
+        && node.arguments[0]?.value == 'style'
+}
+function isObjectAssign(node) {
+    return node?.type == 'CallExpression'
+        && node.callee?.type == 'MemberExpression'
+        && node.callee.object?.name == 'Object'
+        && node.callee.property?.name == 'assign'
+}
+
+export default {
+    meta: {
+        type: 'suggestion',
+        docs: {
+            description: 'Prefers `GM_addStyle()` or a shadow root over manual `<style>` injection',
+            category: 'Best Practices'
+        },
+        schema: [],
+        messages: {
+            preferGmAddStyle: 'Use `GM_addStyle()` or inject into a `shadowRoot` '
+                            + 'instead of manually appending a `<style>` element.'
+        }
+    },
+
+    create(context) {
+        const styleElems = new Set(), docAliases = new Set()
+        function isDocumentRef(node) {
+            return node?.type == 'Identifier'
+                && (node.name == 'document' || docAliases.has(node.name))
+        }
+        function isDocumentMember(node) {
+            return node?.type == 'MemberExpression' && isDocumentRef(node.object)
+        }
+        function isStyleTarget(node) {
+            if (isCreateStyle(node)) return true
+            if (node?.type == 'Identifier' && styleElems.has(node.name)
+                || isObjectAssign(node) && isCreateStyle(node.arguments[0])
+                || isObjectAssign(node)
+                    && node.arguments[0]?.type == 'Identifier'
+                    && styleElems.has(node.arguments[0].name)
+            ) return true
+            return false
+        }
+        return {
+            VariableDeclarator(node) {
+                if (node.id.type != 'Identifier') return
+                if (isStyleTarget(node.init))
+                    styleElems.add(node.id.name)
+                if (node.init?.type == 'Identifier' && isDocumentRef(node.init))
+                    docAliases.add(node.id.name)
+            },
+            CallExpression(node) {
+                if (node.callee.type != 'MemberExpression') return
+                const method = node.callee.property.name
+                if (!re.appendMethod.test(method) || !isDocumentMember(node.callee.object))
+                    return
+                for (const arg of node.arguments)
+                    if (isStyleTarget(arg))
+                        context.report({ node: arg, messageId: 'preferGmAddStyle' })
+            }
+        }
+    }
+}

package/src/rules/prefer-match.js

@@ -1,4 +1,4 @@
-import { extractMetadata } from '../utils.js'
+import metadata from '../utils/metadata.js'
 
 export default {
     meta: {
@@ -6,7 +6,8 @@ export default {
         docs: {
             description: 'Prefer @match over @include (see https://developer.chrome.com/docs/extensions/develop/migrate/mv2-deprecation-timeline)',
             category: 'Best Practices',
-            recommended: true
+            recommended: true,
+            security: true
         },
         schema: [],
         messages: { preferMatch: 'Use @match instead of @include.' }
@@ -15,7 +16,7 @@ export default {
     create(context) {
         return {
             Program() {
-                for (const entry of extractMetadata(context.sourceCode))
+                for (const entry of metadata.extract(context.sourceCode))
                     if (entry.key == 'include')
                         context.report({ node: entry.comment, messageId: 'preferMatch' })
             }

package/src/rules/require-homepage-pair.js

@@ -1,12 +1,11 @@
-import { extractMetadata } from '../utils.js'
+import metadata from '../utils/metadata.js'
 
 export default {
     meta: {
         type: 'problem',
         docs: {
             description: 'Require @homepage and @homepageURL to be used together',
-            category: 'Best Practices',
-            recommended: false
+            category: 'Best Practices'
         },
         fixable: 'code',
         schema: [],
@@ -16,7 +15,7 @@ export default {
     create(context) {
         return {
             Program() {
-                const metaEntries = extractMetadata(context.sourceCode),
+                const metaEntries = metadata.extract(context.sourceCode),
                       homepageEntry = metaEntries.find(entry => entry.key == 'homepage'),
                       homepageURLentry = metaEntries.find(entry => entry.key == 'homepageURL')
                 if (homepageEntry && !homepageURLentry)

package/src/rules/require-license-header.js

@@ -0,0 +1,27 @@
+import regex from '../data/regex.js'
+
+export default {
+    meta: {
+        type: 'problem',
+        docs: {
+            description: 'Requires a `@license` metadata field',
+            category: 'Possible Errors',
+            recommended: false
+        },
+        schema: [],
+        messages: {
+            missingLicense: 'No `@license` field found. Add one (e.g. `@license MIT`).'
+        }
+    },
+    create(context) {
+        const sourceCode = context.sourceCode ?? context.getSourceCode()
+        return {
+            Program() {
+                const match = sourceCode.text.match(regex.meta.block)
+                if (!match) return
+                if (!regex.meta.license.test(match[1]))
+                    context.report({ loc: { line: 1, column: 0 }, messageId: 'missingLicense' })
+            }
+        }
+    }
+}