html-validate 6.11.0 → 7.1.0

package/dist/cjs/browser.d.ts

@@ -1,2 +1,2 @@
-export { A as AttributeData, $ as AttributeEvent, f as CSSStyleDeclaration, a1 as ConditionalEvent, C as Config, a as ConfigData, b as ConfigError, c as ConfigLoader, J as ConfigReadyEvent, a4 as DOMLoadEvent, a5 as DOMReadyEvent, t as DeferredMessage, a2 as DirectiveEvent, a3 as DoctypeEvent, D as DynamicValue, _ as ElementReadyEvent, I as Event, G as EventCallback, E as EventDump, F as EventHandler, e as HtmlElement, H as HtmlValidate, a7 as ListenEventMap, L as Location, r as Message, l as MetaCopyableProperty, M as MetaData, j as MetaElement, k as MetaTable, i as NestedError, N as NodeClosed, z as Parser, y as Plugin, P as ProcessElementContext, o as Report, q as Reporter, s as Result, R as Rule, m as RuleDocumentation, h as SchemaValidationError, S as Severity, n as Source, K as SourceReadyEvent, d as StaticConfigLoader, Y as TagCloseEvent, X as TagEndEvent, V as TagOpenEvent, Z as TagReadyEvent, Q as TagStartEvent, x as TemplateExtractor, T as TextNode, g as TokenDump, O as TokenEvent, u as TransformContext, w as Transformer, a6 as TriggerEventMap, U as UserError, a0 as WhitespaceEvent, W as WrappedError, p as configPresets, B as ruleExists, v as version } from './core.js';
+export { A as AttributeData, a0 as AttributeEvent, f as CSSStyleDeclaration, a2 as ConditionalEvent, C as Config, a as ConfigData, b as ConfigError, c as ConfigLoader, K as ConfigReadyEvent, a5 as DOMLoadEvent, a6 as DOMReadyEvent, u as DeferredMessage, a3 as DirectiveEvent, a4 as DoctypeEvent, D as DynamicValue, $ as ElementReadyEvent, J as Event, I as EventCallback, E as EventDump, G as EventHandler, e as HtmlElement, H as HtmlValidate, a8 as ListenEventMap, L as Location, s as Message, m as MetaCopyableProperty, M as MetaData, j as MetaDataTable, k as MetaElement, l as MetaTable, i as NestedError, N as NodeClosed, B as Parser, z as Plugin, P as ProcessElementContext, q as Report, r as Reporter, t as Result, R as Rule, n as RuleDocumentation, h as SchemaValidationError, S as Severity, o as Source, O as SourceReadyEvent, d as StaticConfigLoader, Z as TagCloseEvent, Y as TagEndEvent, X as TagOpenEvent, _ as TagReadyEvent, V as TagStartEvent, y as TemplateExtractor, T as TextNode, g as TokenDump, Q as TokenEvent, w as TransformContext, x as Transformer, a7 as TriggerEventMap, U as UserError, a1 as WhitespaceEvent, W as WrappedError, p as configPresets, F as ruleExists, v as version } from './core.js';
 import 'ajv';

package/dist/cjs/core.d.ts

@@ -333,12 +333,13 @@ declare abstract class Rule<ContextType = void, OptionsType = void> {
      * not `"foo"`.
      *
      * @param keyword - Keyword to match against `include` and `exclude` options.
+     * @param matcher - Optional function to compare items with.
      * @returns `true` if keyword is not present in `include` or is present in
      * `exclude`.
      */
     isKeywordIgnored<T extends IncludeExcludeOptions>(this: {
         options: T;
-    }, keyword: string): boolean;
+    }, keyword: string, matcher?: (list: string[], it: string) => boolean): boolean;
     /**
      * Find all tags which has enabled given property.
      */
@@ -1072,6 +1073,9 @@ interface MetaElement extends Omit<MetaData, "deprecatedAttributes" | "requiredA
     tagName: string;
     attributes: Record<string, MetaAttribute>;
 }
+interface MetaDataTable {
+    [tagName: string]: MetaData;
+}
 interface ElementTable {
     [tagName: string]: MetaElement;
 }
@@ -2330,4 +2334,4 @@ declare type Formatter = (results: Result[]) => string;
  */
 declare function getFormatter(name: string): Formatter | null;
 
-export { AttributeEvent as $, AttributeData as A, ruleExists as B, Config as C, DynamicValue as D, EventDump as E, EventHandler as F, EventCallback as G, HtmlValidate as H, Event as I, ConfigReadyEvent as J, SourceReadyEvent as K, Location as L, MetaData as M, NodeClosed as N, TokenEvent as O, ProcessElementContext as P, TagStartEvent as Q, Rule as R, Severity as S, TextNode as T, UserError as U, TagOpenEvent as V, WrappedError as W, TagEndEvent as X, TagCloseEvent as Y, TagReadyEvent as Z, ElementReadyEvent as _, ConfigData as a, WhitespaceEvent as a0, ConditionalEvent as a1, DirectiveEvent as a2, DoctypeEvent as a3, DOMLoadEvent as a4, DOMReadyEvent as a5, TriggerEventMap as a6, ListenEventMap as a7, FileSystemConfigLoader as a8, Formatter as a9, getFormatter as aa, compatibilityCheck as ab, CompatibilityOptions as ac, ConfigError as b, ConfigLoader as c, StaticConfigLoader as d, HtmlElement as e, CSSStyleDeclaration as f, TokenDump as g, SchemaValidationError as h, NestedError as i, MetaElement as j, MetaTable as k, MetaCopyableProperty as l, RuleDocumentation as m, Source as n, Report as o, presets as p, Reporter as q, Message as r, Result as s, DeferredMessage as t, TransformContext as u, version as v, Transformer as w, TemplateExtractor as x, Plugin as y, Parser as z };
+export { ElementReadyEvent as $, AttributeData as A, Parser as B, Config as C, DynamicValue as D, EventDump as E, ruleExists as F, EventHandler as G, HtmlValidate as H, EventCallback as I, Event as J, ConfigReadyEvent as K, Location as L, MetaData as M, NodeClosed as N, SourceReadyEvent as O, ProcessElementContext as P, TokenEvent as Q, Rule as R, Severity as S, TextNode as T, UserError as U, TagStartEvent as V, WrappedError as W, TagOpenEvent as X, TagEndEvent as Y, TagCloseEvent as Z, TagReadyEvent as _, ConfigData as a, AttributeEvent as a0, WhitespaceEvent as a1, ConditionalEvent as a2, DirectiveEvent as a3, DoctypeEvent as a4, DOMLoadEvent as a5, DOMReadyEvent as a6, TriggerEventMap as a7, ListenEventMap as a8, FileSystemConfigLoader as a9, Formatter as aa, getFormatter as ab, compatibilityCheck as ac, CompatibilityOptions as ad, ConfigError as b, ConfigLoader as c, StaticConfigLoader as d, HtmlElement as e, CSSStyleDeclaration as f, TokenDump as g, SchemaValidationError as h, NestedError as i, MetaDataTable as j, MetaElement as k, MetaTable as l, MetaCopyableProperty as m, RuleDocumentation as n, Source as o, presets as p, Report as q, Reporter as r, Message as s, Result as t, DeferredMessage as u, version as v, TransformContext as w, Transformer as x, TemplateExtractor as y, Plugin as z };

package/dist/cjs/core.js

@@ -2102,6 +2102,7 @@ class HtmlElement extends DOMNode {
         }
         const parts = [];
         let root;
+        /* eslint-disable-next-line @typescript-eslint/no-this-alias */
         for (root = this; root.parent; root = root.parent) {
             /* .. */
         }
@@ -3113,7 +3114,7 @@ var TRANSFORMER_API;
 /** @public */
 const name = "html-validate";
 /** @public */
-const version = "6.11.0";
+const version = "7.1.0";
 /** @public */
 const homepage = "https://html-validate.org";
 /** @public */
@@ -3276,17 +3277,18 @@ class Rule {
      * not `"foo"`.
      *
      * @param keyword - Keyword to match against `include` and `exclude` options.
+     * @param matcher - Optional function to compare items with.
      * @returns `true` if keyword is not present in `include` or is present in
      * `exclude`.
      */
-    isKeywordIgnored(keyword) {
+    isKeywordIgnored(keyword, matcher = (list, it) => list.includes(it)) {
         const { include, exclude } = this.options;
         /* ignore keyword if not present in "include" */
-        if (include && !include.includes(keyword)) {
+        if (include && !matcher(include, keyword)) {
             return true;
         }
         /* ignore keyword if present in "excludes" */
-        if (exclude && exclude.includes(keyword)) {
+        if (exclude && matcher(exclude, keyword)) {
             return true;
         }
         return false;
@@ -3434,7 +3436,7 @@ function ruleDocumentationUrl(filename) {
     return `${homepage}/rules/${normalized}.html`;
 }
 
-const defaults$r = {
+const defaults$s = {
     allowExternal: true,
     allowRelative: true,
     allowAbsolute: true,
@@ -3478,7 +3480,7 @@ function matchList(value, list) {
 }
 class AllowedLinks extends Rule {
     constructor(options) {
-        super({ ...defaults$r, ...options });
+        super({ ...defaults$s, ...options });
         this.allowExternal = parseAllow(this.options.allowExternal);
         this.allowRelative = parseAllow(this.options.allowRelative);
         this.allowAbsolute = parseAllow(this.options.allowAbsolute);
@@ -3779,13 +3781,13 @@ class CaseStyle {
     }
 }
 
-const defaults$q = {
+const defaults$r = {
     style: "lowercase",
     ignoreForeign: true,
 };
 class AttrCase extends Rule {
     constructor(options) {
-        super({ ...defaults$q, ...options });
+        super({ ...defaults$r, ...options });
         this.style = new CaseStyle(this.options.style, "attr-case");
     }
     static schema() {
@@ -4125,7 +4127,7 @@ class AttrDelimiter extends Rule {
 }
 
 const DEFAULT_PATTERN = "[a-z0-9-:]+";
-const defaults$p = {
+const defaults$q = {
     pattern: DEFAULT_PATTERN,
     ignoreForeign: true,
 };
@@ -4162,7 +4164,7 @@ function generateDescription(name, pattern) {
 }
 class AttrPattern extends Rule {
     constructor(options) {
-        super({ ...defaults$p, ...options });
+        super({ ...defaults$q, ...options });
         this.pattern = generateRegexp(this.options.pattern);
     }
     static schema() {
@@ -4221,20 +4223,56 @@ var QuoteStyle;
     QuoteStyle["SINGLE_QUOTE"] = "'";
     QuoteStyle["DOUBLE_QUOTE"] = "\"";
     QuoteStyle["AUTO_QUOTE"] = "auto";
+    QuoteStyle["ANY_QUOTE"] = "any";
 })(QuoteStyle || (QuoteStyle = {}));
-const defaults$o = {
+const defaults$p = {
     style: "auto",
     unquoted: false,
 };
+function describeError(context) {
+    if (context) {
+        switch (context.error) {
+            case "style":
+                return `Attribute \`${context.attr}\` must use \`${context.expected}\` instead of \`${context.actual}\`.`;
+            case "unquoted":
+                return `Attribute \`${context.attr}\` must not be unquoted.`;
+        }
+    }
+    else {
+        return "This attribute is not quoted properly.";
+    }
+}
+function describeStyle(style, unquoted) {
+    const description = [];
+    switch (style) {
+        case QuoteStyle.AUTO_QUOTE:
+            description.push("- quoted with double quotes `\"` unless the value contains double quotes in which case single quotes `'` should be used instead");
+            break;
+        case QuoteStyle.ANY_QUOTE:
+            description.push("- quoted with single quotes `'`");
+            description.push('- quoted with double quotes `"`');
+            break;
+        case QuoteStyle.SINGLE_QUOTE:
+        case QuoteStyle.DOUBLE_QUOTE: {
+            const name = style === QuoteStyle.SINGLE_QUOTE ? "single" : "double";
+            description.push(`- quoted with ${name} quotes \`${style}\``);
+            break;
+        }
+    }
+    if (unquoted) {
+        description.push("- unquoted (if applicable)");
+    }
+    return `${description.join(" or\n")}\n`;
+}
 class AttrQuotes extends Rule {
     constructor(options) {
-        super({ ...defaults$o, ...options });
+        super({ ...defaults$p, ...options });
         this.style = parseStyle$4(this.options.style);
     }
     static schema() {
         return {
             style: {
-                enum: ["auto", "double", "single"],
+                enum: ["auto", "double", "single", "any"],
                 type: "string",
             },
             unquoted: {
@@ -4242,19 +4280,20 @@ class AttrQuotes extends Rule {
             },
         };
     }
-    documentation() {
-        if (this.options.style === "auto") {
-            return {
-                description: `Attribute values are required to be quoted with doublequotes unless the attribute value itself contains doublequotes in which case singlequotes should be used.`,
-                url: ruleDocumentationUrl("@/rules/attr-quotes.ts"),
-            };
-        }
-        else {
-            return {
-                description: `Attribute values are required to be quoted with ${this.options.style}quotes.`,
-                url: ruleDocumentationUrl("@/rules/attr-quotes.ts"),
-            };
-        }
+    documentation(context) {
+        const { style } = this;
+        const { unquoted } = this.options;
+        const description = [
+            describeError(context),
+            "",
+            "Under the current configuration attributes must be:",
+            "",
+            describeStyle(style, unquoted),
+        ];
+        return {
+            description: description.join("\n"),
+            url: ruleDocumentationUrl("@/rules/attr-quotes.ts"),
+        };
     }
     setup() {
         this.on("attr", (event) => {
@@ -4264,13 +4303,31 @@ class AttrQuotes extends Rule {
             }
             if (!event.quote) {
                 if (this.options.unquoted === false) {
-                    this.report(event.target, `Attribute "${event.key}" using unquoted value`);
+                    const message = `Attribute "${event.key}" using unquoted value`;
+                    const context = {
+                        error: "unquoted",
+                        attr: event.key,
+                    };
+                    this.report(event.target, message, null, context);
                 }
                 return;
             }
+            /* if the style is set to any we skip the rest of the rule as the only
+             * thing that matters is if the "unquoted" options triggers an error or
+             * not */
+            if (this.style === QuoteStyle.ANY_QUOTE) {
+                return;
+            }
             const expected = this.resolveQuotemark(event.value.toString(), this.style);
             if (event.quote !== expected) {
-                this.report(event.target, `Attribute "${event.key}" used ${event.quote} instead of expected ${expected}`);
+                const message = `Attribute "${event.key}" used ${event.quote} instead of expected ${expected}`;
+                const context = {
+                    error: "style",
+                    attr: event.key,
+                    actual: event.quote,
+                    expected,
+                };
+                this.report(event.target, message, null, context);
             }
         });
     }
@@ -4291,6 +4348,8 @@ function parseStyle$4(style) {
             return QuoteStyle.DOUBLE_QUOTE;
         case "single":
             return QuoteStyle.SINGLE_QUOTE;
+        case "any":
+            return QuoteStyle.ANY_QUOTE;
         /* istanbul ignore next: covered by schema validation */
         default:
             throw new ConfigError(`Invalid style "${style}" for "attr-quotes" rule`);
@@ -4393,12 +4452,12 @@ class AttributeAllowedValues extends Rule {
     }
 }
 
-const defaults$n = {
+const defaults$o = {
     style: "omit",
 };
 class AttributeBooleanStyle extends Rule {
     constructor(options) {
-        super({ ...defaults$n, ...options });
+        super({ ...defaults$o, ...options });
         this.hasInvalidStyle = parseStyle$3(this.options.style);
     }
     static schema() {
@@ -4474,12 +4533,12 @@ function reportMessage$1(attr, style) {
     return "";
 }
 
-const defaults$m = {
+const defaults$n = {
     style: "omit",
 };
 class AttributeEmptyStyle extends Rule {
     constructor(options) {
-        super({ ...defaults$m, ...options });
+        super({ ...defaults$n, ...options });
         this.hasInvalidStyle = parseStyle$2(this.options.style);
     }
     static schema() {
@@ -4587,12 +4646,12 @@ function describePattern(pattern) {
     }
 }
 
-const defaults$l = {
+const defaults$m = {
     pattern: "kebabcase",
 };
 class ClassPattern extends Rule {
     constructor(options) {
-        super({ ...defaults$l, ...options });
+        super({ ...defaults$m, ...options });
         this.pattern = parsePattern(this.options.pattern);
     }
     static schema() {
@@ -4701,13 +4760,13 @@ class CloseOrder extends Rule {
     }
 }
 
-const defaults$k = {
+const defaults$l = {
     include: null,
     exclude: null,
 };
 class Deprecated extends Rule {
     constructor(options) {
-        super({ ...defaults$k, ...options });
+        super({ ...defaults$l, ...options });
     }
     static schema() {
         return {
@@ -4870,12 +4929,12 @@ class NoStyleTag$1 extends Rule {
     }
 }
 
-const defaults$j = {
+const defaults$k = {
     style: "uppercase",
 };
 class DoctypeStyle extends Rule {
     constructor(options) {
-        super({ ...defaults$j, ...options });
+        super({ ...defaults$k, ...options });
     }
     static schema() {
         return {
@@ -4907,12 +4966,12 @@ class DoctypeStyle extends Rule {
     }
 }
 
-const defaults$i = {
+const defaults$j = {
     style: "lowercase",
 };
 class ElementCase extends Rule {
     constructor(options) {
-        super({ ...defaults$i, ...options });
+        super({ ...defaults$j, ...options });
         this.style = new CaseStyle(this.options.style, "element-case");
     }
     static schema() {
@@ -4978,14 +5037,14 @@ class ElementCase extends Rule {
     }
 }
 
-const defaults$h = {
+const defaults$i = {
     pattern: "^[a-z][a-z0-9\\-._]*-[a-z0-9\\-._]*$",
     whitelist: [],
     blacklist: [],
 };
 class ElementName extends Rule {
     constructor(options) {
-        super({ ...defaults$h, ...options });
+        super({ ...defaults$i, ...options });
         // eslint-disable-next-line security/detect-non-literal-regexp
         this.pattern = new RegExp(this.options.pattern);
     }
@@ -5026,7 +5085,7 @@ class ElementName extends Rule {
                 ...context.blacklist.map((cur) => `- ${cur}`),
             ];
         }
-        if (context.pattern !== defaults$h.pattern) {
+        if (context.pattern !== defaults$i.pattern) {
             return [
                 `<${context.tagName}> is not a valid element name. This project is configured to only allow names matching the following regular expression:`,
                 "",
@@ -5428,7 +5487,7 @@ class EmptyTitle extends Rule {
     }
 }
 
-const defaults$g = {
+const defaults$h = {
     allowMultipleH1: false,
     minInitialRank: "h1",
     sectioningRoots: ["dialog", '[role="dialog"]'],
@@ -5459,7 +5518,7 @@ function parseMaxInitial(value) {
 }
 class HeadingLevel extends Rule {
     constructor(options) {
-        super({ ...defaults$g, ...options });
+        super({ ...defaults$h, ...options });
         this.stack = [];
         this.minInitialRank = parseMaxInitial(this.options.minInitialRank);
         this.sectionRoots = this.options.sectioningRoots.map((it) => new Pattern(it));
@@ -5617,12 +5676,12 @@ class HeadingLevel extends Rule {
     }
 }
 
-const defaults$f = {
+const defaults$g = {
     pattern: "kebabcase",
 };
 class IdPattern extends Rule {
     constructor(options) {
-        super({ ...defaults$f, ...options });
+        super({ ...defaults$g, ...options });
         this.pattern = parsePattern(this.options.pattern);
     }
     static schema() {
@@ -5973,12 +6032,12 @@ function findLabelByParent(el) {
     return [];
 }
 
-const defaults$e = {
+const defaults$f = {
     maxlength: 70,
 };
 class LongTitle extends Rule {
     constructor(options) {
-        super({ ...defaults$e, ...options });
+        super({ ...defaults$f, ...options });
         this.maxlength = this.options.maxlength;
     }
     static schema() {
@@ -6125,13 +6184,13 @@ class MultipleLabeledControls extends Rule {
     }
 }
 
-const defaults$d = {
+const defaults$e = {
     include: null,
     exclude: null,
 };
 class NoAutoplay extends Rule {
     constructor(options) {
-        super({ ...defaults$d, ...options });
+        super({ ...defaults$e, ...options });
     }
     documentation(context) {
         const tagName = context ? ` on <${context.tagName}>` : "";
@@ -6372,14 +6431,14 @@ Omitted end tags can be ambigious for humans to read and many editors have troub
     }
 }
 
-const defaults$c = {
+const defaults$d = {
     include: null,
     exclude: null,
     allowedProperties: ["display"],
 };
 class NoInlineStyle extends Rule {
     constructor(options) {
-        super({ ...defaults$c, ...options });
+        super({ ...defaults$d, ...options });
     }
     static schema() {
         return {
@@ -6581,7 +6640,7 @@ class NoMultipleMain extends Rule {
     }
 }
 
-const defaults$b = {
+const defaults$c = {
     relaxed: false,
 };
 const textRegexp = /([<>]|&(?![a-zA-Z0-9#]+;))/g;
@@ -6598,7 +6657,7 @@ const replacementTable = {
 };
 class NoRawCharacters extends Rule {
     constructor(options) {
-        super({ ...defaults$b, ...options });
+        super({ ...defaults$c, ...options });
         this.relaxed = this.options.relaxed;
     }
     static schema() {
@@ -6776,13 +6835,13 @@ class NoRedundantRole extends Rule {
 }
 
 const xmlns = /^(.+):.+$/;
-const defaults$a = {
+const defaults$b = {
     ignoreForeign: true,
     ignoreXML: true,
 };
 class NoSelfClosing extends Rule {
     constructor(options) {
-        super({ ...defaults$a, ...options });
+        super({ ...defaults$b, ...options });
     }
     static schema() {
         return {
@@ -6915,13 +6974,13 @@ const replacement = {
     reset: '<button type="reset">',
     image: '<button type="button">',
 };
-const defaults$9 = {
+const defaults$a = {
     include: null,
     exclude: null,
 };
 class PreferButton extends Rule {
     constructor(options) {
-        super({ ...defaults$9, ...options });
+        super({ ...defaults$a, ...options });
     }
     static schema() {
         return {
@@ -6996,7 +7055,7 @@ class PreferButton extends Rule {
     }
 }
 
-const defaults$8 = {
+const defaults$9 = {
     mapping: {
         article: "article",
         banner: "header",
@@ -7026,7 +7085,7 @@ const defaults$8 = {
 };
 class PreferNativeElement extends Rule {
     constructor(options) {
-        super({ ...defaults$8, ...options });
+        super({ ...defaults$9, ...options });
     }
     static schema() {
         return {
@@ -7146,8 +7205,66 @@ class PreferTbody extends Rule {
     }
 }
 
+const defaults$8 = {
+    tags: ["script", "style"],
+};
+class RequireCSPNonce extends Rule {
+    constructor(options) {
+        super({ ...defaults$8, ...options });
+    }
+    static schema() {
+        return {
+            tags: {
+                type: "array",
+                items: {
+                    enum: ["script", "style"],
+                    type: "string",
+                },
+            },
+        };
+    }
+    documentation() {
+        return {
+            description: [
+                "Required Content-Security-Policy (CSP) nonce is missing or empty.",
+                "",
+                "This is set by the `nonce` attribute and must match the `Content-Security-Policy` header.",
+                "For instance, if the header contains `script-src 'nonce-r4nd0m'` the `nonce` attribute must be set to `nonce=\"r4nd0m\">`",
+                "",
+                "The nonce should be unique per each request and set to a cryptography secure random token.",
+                "It is used to prevent cross site scripting (XSS) by preventing malicious actors from injecting scripts onto the page.",
+            ].join("\n"),
+            url: ruleDocumentationUrl("@/rules/require-csp-nonce.ts"),
+        };
+    }
+    setup() {
+        this.on("tag:end", (event) => {
+            var _a;
+            const { tags } = this.options;
+            const node = event.previous;
+            /* ignore other tags */
+            if (!node || !tags.includes(node.tagName)) {
+                return;
+            }
+            /* ignore if nonce is set to non-empty value (or dynamic) */
+            const nonce = (_a = node.getAttribute("nonce")) === null || _a === void 0 ? void 0 : _a.value;
+            if (nonce && nonce !== "") {
+                return;
+            }
+            /* ignore <script src> */
+            if (node.is("script") && node.hasAttribute("src")) {
+                return;
+            }
+            const message = `required CSP nonce is missing`;
+            this.report(node, message, node.location);
+        });
+    }
+}
+
 const defaults$7 = {
     target: "all",
+    include: null,
+    exclude: null,
 };
 const crossorigin = new RegExp("^(\\w+://|//)"); /* e.g. https:// or // */
 const supportSri = {
@@ -7165,6 +7282,32 @@ class RequireSri extends Rule {
                 enum: ["all", "crossorigin"],
                 type: "string",
             },
+            include: {
+                anyOf: [
+                    {
+                        items: {
+                            type: "string",
+                        },
+                        type: "array",
+                    },
+                    {
+                        type: "null",
+                    },
+                ],
+            },
+            exclude: {
+                anyOf: [
+                    {
+                        items: {
+                            type: "string",
+                        },
+                        type: "array",
+                    },
+                    {
+                        type: "null",
+                    },
+                ],
+            },
         };
     }
     documentation() {
@@ -7177,11 +7320,13 @@ class RequireSri extends Rule {
         this.on("tag:end", (event) => {
             /* only handle thats supporting and requires sri */
             const node = event.previous;
-            if (!(this.supportSri(node) && this.needSri(node)))
+            if (!(this.supportSri(node) && this.needSri(node))) {
                 return;
+            }
             /* check if sri attribute is present */
-            if (node.hasAttribute("integrity"))
+            if (node.hasAttribute("integrity")) {
                 return;
+            }
             this.report(node, `SRI "integrity" attribute is required on <${node.tagName}> element`, node.location);
         });
     }
@@ -7189,19 +7334,25 @@ class RequireSri extends Rule {
         return Object.keys(supportSri).includes(node.tagName);
     }
     needSri(node) {
-        if (this.target === "all")
-            return true;
         const attr = this.elementSourceAttr(node);
-        if (!attr || attr.value === null || attr.isDynamic) {
+        if (!attr || attr.value === null || attr.value === "" || attr.isDynamic) {
             return false;
         }
         const url = attr.value.toString();
-        return crossorigin.test(url);
+        if (this.target === "all" || crossorigin.test(url)) {
+            return !this.isIgnored(url);
+        }
+        return false;
     }
     elementSourceAttr(node) {
         const key = supportSri[node.tagName];
         return node.getAttribute(key);
     }
+    isIgnored(url) {
+        return this.isKeywordIgnored(url, (list, it) => {
+            return list.some((pattern) => it.includes(pattern));
+        });
+    }
 }
 
 class ScriptElement extends Rule {
@@ -9999,6 +10150,7 @@ const bundledRules = {
     "prefer-button": PreferButton,
     "prefer-native-element": PreferNativeElement,
     "prefer-tbody": PreferTbody,
+    "require-csp-nonce": RequireCSPNonce,
     "require-sri": RequireSri,
     "script-element": ScriptElement,
     "script-type": ScriptType,