html-validate 10.7.0 → 10.8.0

package/dist/cjs/tsdoc-metadata.json

@@ -5,7 +5,7 @@
   "toolPackages": [
     {
       "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.55.2"
+      "packageVersion": "7.56.3"
     }
   ]
 }

package/dist/esm/browser.js

@@ -1,5 +1,5 @@
 export { H as HtmlValidate, c as compatibilityCheck, e as esmResolver } from './core-browser.js';
-export { A as Attribute, f as Config, e as ConfigError, C as ConfigLoader, D as DOMNode, r as DOMTokenList, u as DOMTree, w as DynamicValue, _ as EventHandler, H as HtmlElement, M as MetaCopyableProperty, F as MetaTable, y as NestedError, N as NodeClosed, x as NodeType, P as Parser, R as Reporter, m as ResolvedConfig, I as Rule, z as SchemaValidationError, o as Severity, S as StaticConfigLoader, J as TextClassification, G as TextContent, T as TextNode, U as UserError, V as Validator, W as WrappedError, K as ariaNaming, L as classifyNodeText, p as configPresets, q as defineConfig, X as definePlugin, B as isUserError, O as keywordPatternMatcher, Y as ruleExists, Q as sliceLocation, s as staticResolver, v as version, Z as walk } from './core.js';
+export { A as Attribute, f as Config, e as ConfigError, C as ConfigLoader, D as DOMNode, m as DOMTokenList, o as DOMTree, p as DynamicValue, q as EventHandler, H as HtmlElement, M as MetaCopyableProperty, r as MetaTable, N as NestedError, s as NodeClosed, u as NodeType, P as Parser, R as Reporter, w as ResolvedConfig, x as Rule, y as SchemaValidationError, z as Severity, S as StaticConfigLoader, T as TextClassification, B as TextContent, F as TextNode, U as UserError, V as Validator, W as WrappedError, G as ariaNaming, I as classifyNodeText, J as configPresets, K as defineConfig, L as definePlugin, O as isUserError, Q as keywordPatternMatcher, X as ruleExists, Y as sliceLocation, Z as staticResolver, v as version, _ as walk } from './core.js';
 export { d as defineMetadata, m as metadataHelper } from './meta-helper.js';
 import 'ajv';
 import './elements.js';

package/dist/esm/cli.js

@@ -1,5 +1,5 @@
-import { l as legacyRequire, F as FileSystemConfigLoader, e as esmResolver, H as HtmlValidate } from './core-nodejs.js';
-import { h as getFormatter$1, U as UserError, j as ensureError, k as deepmerge, l as ignore, R as Reporter, $ as engines } from './core.js';
+import { l as legacyRequire, F as FileSystemConfigLoader, H as HtmlValidate, e as esmResolver } from './core-nodejs.js';
+import { U as UserError, h as ensureError, j as getFormatter$1, k as deepmerge, l as ignore, R as Reporter, $ as engines } from './core.js';
 import path$1 from 'node:path/posix';
 import fs from 'node:fs';
 import path from 'node:path';

package/dist/esm/core-browser.js

@@ -1,4 +1,4 @@
-import { S as StaticConfigLoader, n as normalizeSource, t as transformSource, E as Engine, P as Parser, a as transformSourceSync, b as transformFilename, c as transformFilenameSync, R as Reporter, d as configurationSchema, i as isThenable, U as UserError, C as ConfigLoader, g as compatibilityCheckImpl, v as version } from './core.js';
+import { S as StaticConfigLoader, t as transformSource, E as Engine, P as Parser, a as transformSourceSync, b as transformFilename, c as transformFilenameSync, R as Reporter, d as configurationSchema, i as isThenable, U as UserError, C as ConfigLoader, n as normalizeSource, g as compatibilityCheckImpl, v as version } from './core.js';
 
 function isSourceHooks(value) {
   if (!value || typeof value === "string") {

package/dist/esm/core-nodejs.js

@@ -1,5 +1,5 @@
 import fs, { existsSync } from 'node:fs';
-import { S as StaticConfigLoader, n as normalizeSource, t as transformSource, E as Engine, P as Parser, a as transformSourceSync, b as transformFilename, c as transformFilenameSync, R as Reporter, d as configurationSchema, i as isThenable, U as UserError, C as ConfigLoader, e as ConfigError, f as Config, g as compatibilityCheckImpl, v as version } from './core.js';
+import { S as StaticConfigLoader, t as transformSource, E as Engine, P as Parser, a as transformSourceSync, b as transformFilename, c as transformFilenameSync, R as Reporter, d as configurationSchema, i as isThenable, U as UserError, C as ConfigLoader, n as normalizeSource, e as ConfigError, f as Config, g as compatibilityCheckImpl, v as version } from './core.js';
 import path from 'node:path';
 import fs$1 from 'node:fs/promises';
 import { pathToFileURL } from 'node:url';

package/dist/esm/core.js

@@ -3999,7 +3999,7 @@ class Rule {
   }
 }
 
-const defaults$z = {
+const defaults$A = {
   allowExternal: true,
   allowRelative: true,
   allowAbsolute: true,
@@ -4043,7 +4043,7 @@ class AllowedLinks extends Rule {
   allowRelative;
   allowAbsolute;
   constructor(options) {
-    super({ ...defaults$z, ...options });
+    super({ ...defaults$A, ...options });
     this.allowExternal = parseAllow(this.options.allowExternal);
     this.allowRelative = parseAllow(this.options.allowRelative);
     this.allowAbsolute = parseAllow(this.options.allowAbsolute);
@@ -4211,7 +4211,7 @@ class AllowedLinks extends Rule {
   }
 }
 
-const defaults$y = {
+const defaults$z = {
   accessible: true
 };
 function findByTarget(target, siblings) {
@@ -4241,7 +4241,7 @@ function getDescription$1(context) {
 }
 class AreaAlt extends Rule {
   constructor(options) {
-    super({ ...defaults$y, ...options });
+    super({ ...defaults$z, ...options });
   }
   static schema() {
     return {
@@ -4320,7 +4320,7 @@ class AriaHiddenBody extends Rule {
   }
 }
 
-const defaults$x = {
+const defaults$y = {
   allowAnyNamable: false,
   elements: {
     include: null,
@@ -4368,7 +4368,7 @@ function isValidUsage(target, meta) {
 }
 class AriaLabelMisuse extends Rule {
   constructor(options) {
-    super({ ...defaults$x, ...options });
+    super({ ...defaults$y, ...options });
   }
   static schema() {
     return {
@@ -4537,14 +4537,14 @@ class CaseStyle {
   }
 }
 
-const defaults$w = {
+const defaults$x = {
   style: "lowercase",
   ignoreForeign: true
 };
 class AttrCase extends Rule {
   style;
   constructor(options) {
-    super({ ...defaults$w, ...options });
+    super({ ...defaults$x, ...options });
     this.style = new CaseStyle(this.options.style, "attr-case");
   }
   static schema() {
@@ -4949,7 +4949,7 @@ class AttrDelimiter extends Rule {
 }
 
 const DEFAULT_PATTERN = "[a-z0-9-:]+";
-const defaults$v = {
+const defaults$w = {
   pattern: DEFAULT_PATTERN,
   ignoreForeign: true
 };
@@ -4982,7 +4982,7 @@ function generateDescription(name, pattern) {
 class AttrPattern extends Rule {
   pattern;
   constructor(options) {
-    super({ ...defaults$v, ...options });
+    super({ ...defaults$w, ...options });
     this.pattern = generateRegexp(this.options.pattern);
   }
   static schema() {
@@ -5029,7 +5029,7 @@ class AttrPattern extends Rule {
   }
 }
 
-const defaults$u = {
+const defaults$v = {
   style: "auto",
   unquoted: false
 };
@@ -5095,7 +5095,7 @@ class AttrQuotes extends Rule {
     };
   }
   constructor(options) {
-    super({ ...defaults$u, ...options });
+    super({ ...defaults$v, ...options });
     this.style = parseStyle$3(this.options.style);
   }
   setup() {
@@ -5251,13 +5251,13 @@ class AttributeAllowedValues extends Rule {
   }
 }
 
-const defaults$t = {
+const defaults$u = {
   style: "omit"
 };
 class AttributeBooleanStyle extends Rule {
   hasInvalidStyle;
   constructor(options) {
-    super({ ...defaults$t, ...options });
+    super({ ...defaults$u, ...options });
     this.hasInvalidStyle = parseStyle$2(this.options.style);
   }
   static schema() {
@@ -5327,13 +5327,13 @@ function reportMessage$1(attr, style) {
   return "";
 }
 
-const defaults$s = {
+const defaults$t = {
   style: "omit"
 };
 class AttributeEmptyStyle extends Rule {
   hasInvalidStyle;
   constructor(options) {
-    super({ ...defaults$s, ...options });
+    super({ ...defaults$t, ...options });
     this.hasInvalidStyle = parseStyle$1(this.options.style);
   }
   static schema() {
@@ -5450,6 +5450,122 @@ class AttributeMisuse extends Rule {
   }
 }
 
+const defaults$s = {
+  preferred: void 0
+};
+function isPasswordInput(event) {
+  const { target } = event;
+  if (!target.is("input")) {
+    return false;
+  }
+  const type = target.getAttribute("type");
+  return type?.value?.toString().toLowerCase() === "password";
+}
+function isGroupingToken(token) {
+  return token.startsWith("section-") || token === "shipping" || token === "billing";
+}
+class AutocompletePassword extends Rule {
+  preferred;
+  constructor(options) {
+    super({ ...defaults$s, ...options });
+    this.preferred = options.preferred?.toLowerCase();
+  }
+  static schema() {
+    return {
+      preferred: {
+        type: "string"
+      }
+    };
+  }
+  documentation(context) {
+    const url = "https://html-validate.org/rules/autocomplete-password.html";
+    switch (context.kind) {
+      case "preferred-mismatch":
+        return {
+          description: [
+            `\`<input type="password">\` should use \`autocomplete="${context.preferred}"\`.`,
+            "",
+            `The configured preferred autocomplete value is \`"${context.preferred}"\` but the element uses \`"${context.value}"\`.`
+          ].join("\n"),
+          url
+        };
+      case "off":
+      case "missing":
+      default: {
+        const error = context.kind === "off" ? '`<input type="password">` should not use `autocomplete="off"`.' : '`<input type="password">` must have the `autocomplete` attribute.';
+        return {
+          description: [
+            error,
+            "",
+            "Browsers and password managers often ignore the absence of autocomplete and autofill password fields anyway, which can lead to unexpected behavior where users unknowingly submit autofilled passwords for unrelated fields.",
+            "",
+            "Use one of the following values:",
+            "",
+            '- `autocomplete="new-password"` for password creation forms',
+            '- `autocomplete="current-password"` for login forms'
+          ].join("\n"),
+          url
+        };
+      }
+    }
+  }
+  setup() {
+    this.on("tag:ready", isPasswordInput, (event) => {
+      const { preferred } = this;
+      const { target } = event;
+      const autocomplete = target.getAttribute("autocomplete");
+      if (!autocomplete) {
+        const context = { kind: "missing" };
+        this.report({
+          node: target,
+          message: '<input type="password"> is missing required "autocomplete" attribute',
+          location: target.location,
+          context
+        });
+        return;
+      }
+      if (autocomplete.isDynamic || !autocomplete.value) {
+        return;
+      }
+      const raw = autocomplete.value.toString().toLowerCase();
+      const tokens = new DOMTokenList(raw, autocomplete.valueLocation);
+      const index = tokens.findIndex((token) => !isGroupingToken(token));
+      const value = tokens.item(index);
+      const location = tokens.location(index);
+      if (!value) {
+        return;
+      }
+      if (value === "off") {
+        const context = { kind: "off" };
+        this.report({
+          node: target,
+          message: '<input type="password"> should not use autocomplete="off"',
+          /* eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- location must be present if value is */
+          location,
+          context
+        });
+        return;
+      }
+      if (preferred) {
+        if (value !== preferred) {
+          const context = {
+            kind: "preferred-mismatch",
+            value,
+            preferred
+          };
+          this.report({
+            node: target,
+            message: `<input type="password"> should use autocomplete="${preferred}"`,
+            /* eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- location must be present if value is */
+            location,
+            context
+          });
+        }
+      }
+    });
+  }
+}
+
 const patternNamesValues = [
   "kebabcase",
   "camelcase",
@@ -9746,9 +9862,7 @@ const fieldNameGroup = {
   nickname: "text",
   username: "username",
   "new-password": "password",
-  // eslint-disable-line sonarjs/no-hardcoded-passwords -- false positive, it is not used as a password
   "current-password": "password",
-  // eslint-disable-line sonarjs/no-hardcoded-passwords -- false positive, it is not used as a password
   "one-time-code": "password",
   "organization-title": "text",
   organization: "text",
@@ -10790,6 +10904,7 @@ const bundledRules = {
   "attribute-boolean-style": AttributeBooleanStyle,
   "attribute-empty-style": AttributeEmptyStyle,
   "attribute-misuse": AttributeMisuse,
+  "autocomplete-password": AutocompletePassword,
   "class-pattern": ClassPattern,
   "close-attr": CloseAttr,
   "close-order": CloseOrder,
@@ -11155,6 +11270,7 @@ const config$1 = {
     "attribute-boolean-style": "error",
     "attribute-empty-style": "error",
     "attribute-misuse": "error",
+    "autocomplete-password": "error",
     "close-attr": "error",
     "close-order": "error",
     deprecated: "error",
@@ -12169,7 +12285,7 @@ class EventHandler {
 }
 
 const name = "html-validate";
-const version = "10.7.0";
+const version = "10.8.0";
 const bugs = "https://gitlab.com/html-validate/html-validate/issues/new";
 
 function freeze(src) {
@@ -14589,5 +14705,5 @@ const engines = {
 
 var workerPath = "./jest-worker.js";
 
-export { engines as $, Attribute as A, isUserError as B, ConfigLoader as C, DOMNode as D, Engine as E, MetaTable as F, TextContent$1 as G, HtmlElement as H, Rule as I, TextClassification as J, ariaNaming as K, classifyNodeText as L, MetaCopyableProperty as M, NodeClosed as N, keywordPatternMatcher as O, Parser as P, sliceLocation as Q, Reporter as R, StaticConfigLoader as S, TextNode as T, UserError as U, Validator as V, WrappedError as W, definePlugin as X, ruleExists as Y, walk as Z, EventHandler as _, transformSourceSync as a, workerPath as a0, codeframe as a1, name as a2, bugs as a3, transformFilename as b, transformFilenameSync as c, configurationSchema as d, ConfigError as e, Config as f, compatibilityCheckImpl as g, getFormatter as h, isThenable as i, ensureError as j, deepmerge as k, ignore as l, ResolvedConfig as m, normalizeSource as n, Severity as o, presets as p, defineConfig as q, DOMTokenList as r, staticResolver as s, transformSource as t, DOMTree as u, version as v, DynamicValue as w, NodeType as x, NestedError as y, SchemaValidationError as z };
+export { engines as $, Attribute as A, TextContent$1 as B, ConfigLoader as C, DOMNode as D, Engine as E, TextNode as F, ariaNaming as G, HtmlElement as H, classifyNodeText as I, presets as J, defineConfig as K, definePlugin as L, MetaCopyableProperty as M, NestedError as N, isUserError as O, Parser as P, keywordPatternMatcher as Q, Reporter as R, StaticConfigLoader as S, TextClassification as T, UserError as U, Validator as V, WrappedError as W, ruleExists as X, sliceLocation as Y, staticResolver as Z, walk as _, transformSourceSync as a, workerPath as a0, codeframe as a1, name as a2, bugs as a3, transformFilename as b, transformFilenameSync as c, configurationSchema as d, ConfigError as e, Config as f, compatibilityCheckImpl as g, ensureError as h, isThenable as i, getFormatter as j, deepmerge as k, ignore as l, DOMTokenList as m, normalizeSource as n, DOMTree as o, DynamicValue as p, EventHandler as q, MetaTable as r, NodeClosed as s, transformSource as t, NodeType as u, version as v, ResolvedConfig as w, Rule as x, SchemaValidationError as y, Severity as z };
 //# sourceMappingURL=core.js.map