html-validate 7.0.0 → 7.1.2

package/dist/cjs/core.js

@@ -1763,7 +1763,7 @@ function stripslashes(value) {
     return value.replace(/\\(.)/g, "$1");
 }
 function escapeSelectorComponent(text) {
-    return text.toString().replace(/([:[\] ])/g, "\\$1");
+    return text.toString().replace(/([^a-z0-9_-])/gi, "\\$1");
 }
 class Matcher {
 }
@@ -2102,6 +2102,7 @@ class HtmlElement extends DOMNode {
         }
         const parts = [];
         let root;
+        /* eslint-disable-next-line @typescript-eslint/no-this-alias */
         for (root = this; root.parent; root = root.parent) {
             /* .. */
         }
@@ -2645,12 +2646,15 @@ class Validator {
         if (value === null || value === undefined) {
             return false;
         }
+        const caseInsensitiveValue = value.toLowerCase();
         return rule.enum.some((entry) => {
             if (entry instanceof RegExp) {
+                /* regular expressions are matched case-sensitive */
                 return !!value.match(entry);
             }
             else {
-                return value === entry;
+                /* strings matched case-insensitive */
+                return caseInsensitiveValue === entry;
             }
         });
     }
@@ -3113,7 +3117,7 @@ var TRANSFORMER_API;
 /** @public */
 const name = "html-validate";
 /** @public */
-const version = "7.0.0";
+const version = "7.1.2";
 /** @public */
 const homepage = "https://html-validate.org";
 /** @public */
@@ -3276,17 +3280,18 @@ class Rule {
      * not `"foo"`.
      *
      * @param keyword - Keyword to match against `include` and `exclude` options.
+     * @param matcher - Optional function to compare items with.
      * @returns `true` if keyword is not present in `include` or is present in
      * `exclude`.
      */
-    isKeywordIgnored(keyword) {
+    isKeywordIgnored(keyword, matcher = (list, it) => list.includes(it)) {
         const { include, exclude } = this.options;
         /* ignore keyword if not present in "include" */
-        if (include && !include.includes(keyword)) {
+        if (include && !matcher(include, keyword)) {
             return true;
         }
         /* ignore keyword if present in "excludes" */
-        if (exclude && exclude.includes(keyword)) {
+        if (exclude && matcher(exclude, keyword)) {
             return true;
         }
         return false;
@@ -3434,7 +3439,7 @@ function ruleDocumentationUrl(filename) {
     return `${homepage}/rules/${normalized}.html`;
 }
 
-const defaults$r = {
+const defaults$s = {
     allowExternal: true,
     allowRelative: true,
     allowAbsolute: true,
@@ -3447,11 +3452,11 @@ const mapping$1 = {
     script: "src",
 };
 const description = {
-    ["external" /* EXTERNAL */]: "External links are not allowed by current configuration.",
-    ["relative-base" /* RELATIVE_BASE */]: "Links relative to <base> are not allowed by current configuration.",
-    ["relative-path" /* RELATIVE_PATH */]: "Relative links are not allowed by current configuration.",
-    ["absolute" /* ABSOLUTE */]: "Absolute links are not allowed by current configuration.",
-    ["anchor" /* ANCHOR */]: null,
+    ["external" /* Style.EXTERNAL */]: "External links are not allowed by current configuration.",
+    ["relative-base" /* Style.RELATIVE_BASE */]: "Links relative to <base> are not allowed by current configuration.",
+    ["relative-path" /* Style.RELATIVE_PATH */]: "Relative links are not allowed by current configuration.",
+    ["absolute" /* Style.ABSOLUTE */]: "Absolute links are not allowed by current configuration.",
+    ["anchor" /* Style.ANCHOR */]: null,
 };
 function parseAllow(value) {
     if (typeof value === "boolean") {
@@ -3478,7 +3483,7 @@ function matchList(value, list) {
 }
 class AllowedLinks extends Rule {
     constructor(options) {
-        super({ ...defaults$r, ...options });
+        super({ ...defaults$s, ...options });
         this.allowExternal = parseAllow(this.options.allowExternal);
         this.allowRelative = parseAllow(this.options.allowRelative);
         this.allowAbsolute = parseAllow(this.options.allowAbsolute);
@@ -3524,19 +3529,19 @@ class AllowedLinks extends Rule {
             const link = event.value.toString();
             const style = this.getStyle(link);
             switch (style) {
-                case "anchor" /* ANCHOR */:
+                case "anchor" /* Style.ANCHOR */:
                     /* anchor links are always allowed by this rule */
                     break;
-                case "absolute" /* ABSOLUTE */:
+                case "absolute" /* Style.ABSOLUTE */:
                     this.handleAbsolute(link, event, style);
                     break;
-                case "external" /* EXTERNAL */:
+                case "external" /* Style.EXTERNAL */:
                     this.handleExternal(link, event, style);
                     break;
-                case "relative-base" /* RELATIVE_BASE */:
+                case "relative-base" /* Style.RELATIVE_BASE */:
                     this.handleRelativeBase(link, event, style);
                     break;
-                case "relative-path" /* RELATIVE_PATH */:
+                case "relative-path" /* Style.RELATIVE_PATH */:
                     this.handleRelativePath(link, event, style);
                     break;
             }
@@ -3554,21 +3559,21 @@ class AllowedLinks extends Rule {
     getStyle(value) {
         /* http://example.net or //example.net */
         if (value.match(/^([a-z]+:)?\/\//g)) {
-            return "external" /* EXTERNAL */;
+            return "external" /* Style.EXTERNAL */;
         }
         switch (value[0]) {
             /* /foo/bar */
             case "/":
-                return "absolute" /* ABSOLUTE */;
+                return "absolute" /* Style.ABSOLUTE */;
             /* ../foo/bar */
             case ".":
-                return "relative-path" /* RELATIVE_PATH */;
+                return "relative-path" /* Style.RELATIVE_PATH */;
             /* #foo */
             case "#":
-                return "anchor" /* ANCHOR */;
+                return "anchor" /* Style.ANCHOR */;
             /* foo/bar */
             default:
-                return "relative-base" /* RELATIVE_BASE */;
+                return "relative-base" /* Style.RELATIVE_BASE */;
         }
     }
     handleAbsolute(target, event, style) {
@@ -3779,13 +3784,13 @@ class CaseStyle {
     }
 }
 
-const defaults$q = {
+const defaults$r = {
     style: "lowercase",
     ignoreForeign: true,
 };
 class AttrCase extends Rule {
     constructor(options) {
-        super({ ...defaults$q, ...options });
+        super({ ...defaults$r, ...options });
         this.style = new CaseStyle(this.options.style, "attr-case");
     }
     static schema() {
@@ -4125,7 +4130,7 @@ class AttrDelimiter extends Rule {
 }
 
 const DEFAULT_PATTERN = "[a-z0-9-:]+";
-const defaults$p = {
+const defaults$q = {
     pattern: DEFAULT_PATTERN,
     ignoreForeign: true,
 };
@@ -4162,7 +4167,7 @@ function generateDescription(name, pattern) {
 }
 class AttrPattern extends Rule {
     constructor(options) {
-        super({ ...defaults$p, ...options });
+        super({ ...defaults$q, ...options });
         this.pattern = generateRegexp(this.options.pattern);
     }
     static schema() {
@@ -4221,20 +4226,56 @@ var QuoteStyle;
     QuoteStyle["SINGLE_QUOTE"] = "'";
     QuoteStyle["DOUBLE_QUOTE"] = "\"";
     QuoteStyle["AUTO_QUOTE"] = "auto";
+    QuoteStyle["ANY_QUOTE"] = "any";
 })(QuoteStyle || (QuoteStyle = {}));
-const defaults$o = {
+const defaults$p = {
     style: "auto",
     unquoted: false,
 };
+function describeError(context) {
+    if (context) {
+        switch (context.error) {
+            case "style":
+                return `Attribute \`${context.attr}\` must use \`${context.expected}\` instead of \`${context.actual}\`.`;
+            case "unquoted":
+                return `Attribute \`${context.attr}\` must not be unquoted.`;
+        }
+    }
+    else {
+        return "This attribute is not quoted properly.";
+    }
+}
+function describeStyle(style, unquoted) {
+    const description = [];
+    switch (style) {
+        case QuoteStyle.AUTO_QUOTE:
+            description.push("- quoted with double quotes `\"` unless the value contains double quotes in which case single quotes `'` should be used instead");
+            break;
+        case QuoteStyle.ANY_QUOTE:
+            description.push("- quoted with single quotes `'`");
+            description.push('- quoted with double quotes `"`');
+            break;
+        case QuoteStyle.SINGLE_QUOTE:
+        case QuoteStyle.DOUBLE_QUOTE: {
+            const name = style === QuoteStyle.SINGLE_QUOTE ? "single" : "double";
+            description.push(`- quoted with ${name} quotes \`${style}\``);
+            break;
+        }
+    }
+    if (unquoted) {
+        description.push("- unquoted (if applicable)");
+    }
+    return `${description.join(" or\n")}\n`;
+}
 class AttrQuotes extends Rule {
     constructor(options) {
-        super({ ...defaults$o, ...options });
+        super({ ...defaults$p, ...options });
         this.style = parseStyle$4(this.options.style);
     }
     static schema() {
         return {
             style: {
-                enum: ["auto", "double", "single"],
+                enum: ["auto", "double", "single", "any"],
                 type: "string",
             },
             unquoted: {
@@ -4242,19 +4283,20 @@ class AttrQuotes extends Rule {
             },
         };
     }
-    documentation() {
-        if (this.options.style === "auto") {
-            return {
-                description: `Attribute values are required to be quoted with doublequotes unless the attribute value itself contains doublequotes in which case singlequotes should be used.`,
-                url: ruleDocumentationUrl("@/rules/attr-quotes.ts"),
-            };
-        }
-        else {
-            return {
-                description: `Attribute values are required to be quoted with ${this.options.style}quotes.`,
-                url: ruleDocumentationUrl("@/rules/attr-quotes.ts"),
-            };
-        }
+    documentation(context) {
+        const { style } = this;
+        const { unquoted } = this.options;
+        const description = [
+            describeError(context),
+            "",
+            "Under the current configuration attributes must be:",
+            "",
+            describeStyle(style, unquoted),
+        ];
+        return {
+            description: description.join("\n"),
+            url: ruleDocumentationUrl("@/rules/attr-quotes.ts"),
+        };
     }
     setup() {
         this.on("attr", (event) => {
@@ -4264,13 +4306,31 @@ class AttrQuotes extends Rule {
             }
             if (!event.quote) {
                 if (this.options.unquoted === false) {
-                    this.report(event.target, `Attribute "${event.key}" using unquoted value`);
+                    const message = `Attribute "${event.key}" using unquoted value`;
+                    const context = {
+                        error: "unquoted",
+                        attr: event.key,
+                    };
+                    this.report(event.target, message, null, context);
                 }
                 return;
             }
+            /* if the style is set to any we skip the rest of the rule as the only
+             * thing that matters is if the "unquoted" options triggers an error or
+             * not */
+            if (this.style === QuoteStyle.ANY_QUOTE) {
+                return;
+            }
             const expected = this.resolveQuotemark(event.value.toString(), this.style);
             if (event.quote !== expected) {
-                this.report(event.target, `Attribute "${event.key}" used ${event.quote} instead of expected ${expected}`);
+                const message = `Attribute "${event.key}" used ${event.quote} instead of expected ${expected}`;
+                const context = {
+                    error: "style",
+                    attr: event.key,
+                    actual: event.quote,
+                    expected,
+                };
+                this.report(event.target, message, null, context);
             }
         });
     }
@@ -4291,6 +4351,8 @@ function parseStyle$4(style) {
             return QuoteStyle.DOUBLE_QUOTE;
         case "single":
             return QuoteStyle.SINGLE_QUOTE;
+        case "any":
+            return QuoteStyle.ANY_QUOTE;
         /* istanbul ignore next: covered by schema validation */
         default:
             throw new ConfigError(`Invalid style "${style}" for "attr-quotes" rule`);
@@ -4393,12 +4455,12 @@ class AttributeAllowedValues extends Rule {
     }
 }
 
-const defaults$n = {
+const defaults$o = {
     style: "omit",
 };
 class AttributeBooleanStyle extends Rule {
     constructor(options) {
-        super({ ...defaults$n, ...options });
+        super({ ...defaults$o, ...options });
         this.hasInvalidStyle = parseStyle$3(this.options.style);
     }
     static schema() {
@@ -4474,12 +4536,12 @@ function reportMessage$1(attr, style) {
     return "";
 }
 
-const defaults$m = {
+const defaults$n = {
     style: "omit",
 };
 class AttributeEmptyStyle extends Rule {
     constructor(options) {
-        super({ ...defaults$m, ...options });
+        super({ ...defaults$n, ...options });
         this.hasInvalidStyle = parseStyle$2(this.options.style);
     }
     static schema() {
@@ -4587,12 +4649,12 @@ function describePattern(pattern) {
     }
 }
 
-const defaults$l = {
+const defaults$m = {
     pattern: "kebabcase",
 };
 class ClassPattern extends Rule {
     constructor(options) {
-        super({ ...defaults$l, ...options });
+        super({ ...defaults$m, ...options });
         this.pattern = parsePattern(this.options.pattern);
     }
     static schema() {
@@ -4701,13 +4763,13 @@ class CloseOrder extends Rule {
     }
 }
 
-const defaults$k = {
+const defaults$l = {
     include: null,
     exclude: null,
 };
 class Deprecated extends Rule {
     constructor(options) {
-        super({ ...defaults$k, ...options });
+        super({ ...defaults$l, ...options });
     }
     static schema() {
         return {
@@ -4870,12 +4932,12 @@ class NoStyleTag$1 extends Rule {
     }
 }
 
-const defaults$j = {
+const defaults$k = {
     style: "uppercase",
 };
 class DoctypeStyle extends Rule {
     constructor(options) {
-        super({ ...defaults$j, ...options });
+        super({ ...defaults$k, ...options });
     }
     static schema() {
         return {
@@ -4907,12 +4969,12 @@ class DoctypeStyle extends Rule {
     }
 }
 
-const defaults$i = {
+const defaults$j = {
     style: "lowercase",
 };
 class ElementCase extends Rule {
     constructor(options) {
-        super({ ...defaults$i, ...options });
+        super({ ...defaults$j, ...options });
         this.style = new CaseStyle(this.options.style, "element-case");
     }
     static schema() {
@@ -4978,14 +5040,14 @@ class ElementCase extends Rule {
     }
 }
 
-const defaults$h = {
+const defaults$i = {
     pattern: "^[a-z][a-z0-9\\-._]*-[a-z0-9\\-._]*$",
     whitelist: [],
     blacklist: [],
 };
 class ElementName extends Rule {
     constructor(options) {
-        super({ ...defaults$h, ...options });
+        super({ ...defaults$i, ...options });
         // eslint-disable-next-line security/detect-non-literal-regexp
         this.pattern = new RegExp(this.options.pattern);
     }
@@ -5026,7 +5088,7 @@ class ElementName extends Rule {
                 ...context.blacklist.map((cur) => `- ${cur}`),
             ];
         }
-        if (context.pattern !== defaults$h.pattern) {
+        if (context.pattern !== defaults$i.pattern) {
             return [
                 `<${context.tagName}> is not a valid element name. This project is configured to only allow names matching the following regular expression:`,
                 "",
@@ -5428,7 +5490,7 @@ class EmptyTitle extends Rule {
     }
 }
 
-const defaults$g = {
+const defaults$h = {
     allowMultipleH1: false,
     minInitialRank: "h1",
     sectioningRoots: ["dialog", '[role="dialog"]'],
@@ -5459,7 +5521,7 @@ function parseMaxInitial(value) {
 }
 class HeadingLevel extends Rule {
     constructor(options) {
-        super({ ...defaults$g, ...options });
+        super({ ...defaults$h, ...options });
         this.stack = [];
         this.minInitialRank = parseMaxInitial(this.options.minInitialRank);
         this.sectionRoots = this.options.sectioningRoots.map((it) => new Pattern(it));
@@ -5617,12 +5679,12 @@ class HeadingLevel extends Rule {
     }
 }
 
-const defaults$f = {
+const defaults$g = {
     pattern: "kebabcase",
 };
 class IdPattern extends Rule {
     constructor(options) {
-        super({ ...defaults$f, ...options });
+        super({ ...defaults$g, ...options });
         this.pattern = parsePattern(this.options.pattern);
     }
     static schema() {
@@ -5973,12 +6035,12 @@ function findLabelByParent(el) {
     return [];
 }
 
-const defaults$e = {
+const defaults$f = {
     maxlength: 70,
 };
 class LongTitle extends Rule {
     constructor(options) {
-        super({ ...defaults$e, ...options });
+        super({ ...defaults$f, ...options });
         this.maxlength = this.options.maxlength;
     }
     static schema() {
@@ -6125,13 +6187,13 @@ class MultipleLabeledControls extends Rule {
     }
 }
 
-const defaults$d = {
+const defaults$e = {
     include: null,
     exclude: null,
 };
 class NoAutoplay extends Rule {
     constructor(options) {
-        super({ ...defaults$d, ...options });
+        super({ ...defaults$e, ...options });
     }
     documentation(context) {
         const tagName = context ? ` on <${context.tagName}>` : "";
@@ -6372,14 +6434,14 @@ Omitted end tags can be ambigious for humans to read and many editors have troub
     }
 }
 
-const defaults$c = {
+const defaults$d = {
     include: null,
     exclude: null,
     allowedProperties: ["display"],
 };
 class NoInlineStyle extends Rule {
     constructor(options) {
-        super({ ...defaults$c, ...options });
+        super({ ...defaults$d, ...options });
     }
     static schema() {
         return {
@@ -6581,7 +6643,7 @@ class NoMultipleMain extends Rule {
     }
 }
 
-const defaults$b = {
+const defaults$c = {
     relaxed: false,
 };
 const textRegexp = /([<>]|&(?![a-zA-Z0-9#]+;))/g;
@@ -6598,7 +6660,7 @@ const replacementTable = {
 };
 class NoRawCharacters extends Rule {
     constructor(options) {
-        super({ ...defaults$b, ...options });
+        super({ ...defaults$c, ...options });
         this.relaxed = this.options.relaxed;
     }
     static schema() {
@@ -6776,13 +6838,13 @@ class NoRedundantRole extends Rule {
 }
 
 const xmlns = /^(.+):.+$/;
-const defaults$a = {
+const defaults$b = {
     ignoreForeign: true,
     ignoreXML: true,
 };
 class NoSelfClosing extends Rule {
     constructor(options) {
-        super({ ...defaults$a, ...options });
+        super({ ...defaults$b, ...options });
     }
     static schema() {
         return {
@@ -6915,13 +6977,13 @@ const replacement = {
     reset: '<button type="reset">',
     image: '<button type="button">',
 };
-const defaults$9 = {
+const defaults$a = {
     include: null,
     exclude: null,
 };
 class PreferButton extends Rule {
     constructor(options) {
-        super({ ...defaults$9, ...options });
+        super({ ...defaults$a, ...options });
     }
     static schema() {
         return {
@@ -6996,7 +7058,7 @@ class PreferButton extends Rule {
     }
 }
 
-const defaults$8 = {
+const defaults$9 = {
     mapping: {
         article: "article",
         banner: "header",
@@ -7026,7 +7088,7 @@ const defaults$8 = {
 };
 class PreferNativeElement extends Rule {
     constructor(options) {
-        super({ ...defaults$8, ...options });
+        super({ ...defaults$9, ...options });
     }
     static schema() {
         return {
@@ -7146,8 +7208,66 @@ class PreferTbody extends Rule {
     }
 }
 
+const defaults$8 = {
+    tags: ["script", "style"],
+};
+class RequireCSPNonce extends Rule {
+    constructor(options) {
+        super({ ...defaults$8, ...options });
+    }
+    static schema() {
+        return {
+            tags: {
+                type: "array",
+                items: {
+                    enum: ["script", "style"],
+                    type: "string",
+                },
+            },
+        };
+    }
+    documentation() {
+        return {
+            description: [
+                "Required Content-Security-Policy (CSP) nonce is missing or empty.",
+                "",
+                "This is set by the `nonce` attribute and must match the `Content-Security-Policy` header.",
+                "For instance, if the header contains `script-src 'nonce-r4nd0m'` the `nonce` attribute must be set to `nonce=\"r4nd0m\">`",
+                "",
+                "The nonce should be unique per each request and set to a cryptography secure random token.",
+                "It is used to prevent cross site scripting (XSS) by preventing malicious actors from injecting scripts onto the page.",
+            ].join("\n"),
+            url: ruleDocumentationUrl("@/rules/require-csp-nonce.ts"),
+        };
+    }
+    setup() {
+        this.on("tag:end", (event) => {
+            var _a;
+            const { tags } = this.options;
+            const node = event.previous;
+            /* ignore other tags */
+            if (!node || !tags.includes(node.tagName)) {
+                return;
+            }
+            /* ignore if nonce is set to non-empty value (or dynamic) */
+            const nonce = (_a = node.getAttribute("nonce")) === null || _a === void 0 ? void 0 : _a.value;
+            if (nonce && nonce !== "") {
+                return;
+            }
+            /* ignore <script src> */
+            if (node.is("script") && node.hasAttribute("src")) {
+                return;
+            }
+            const message = `required CSP nonce is missing`;
+            this.report(node, message, node.location);
+        });
+    }
+}
+
 const defaults$7 = {
     target: "all",
+    include: null,
+    exclude: null,
 };
 const crossorigin = new RegExp("^(\\w+://|//)"); /* e.g. https:// or // */
 const supportSri = {
@@ -7165,6 +7285,32 @@ class RequireSri extends Rule {
                 enum: ["all", "crossorigin"],
                 type: "string",
             },
+            include: {
+                anyOf: [
+                    {
+                        items: {
+                            type: "string",
+                        },
+                        type: "array",
+                    },
+                    {
+                        type: "null",
+                    },
+                ],
+            },
+            exclude: {
+                anyOf: [
+                    {
+                        items: {
+                            type: "string",
+                        },
+                        type: "array",
+                    },
+                    {
+                        type: "null",
+                    },
+                ],
+            },
         };
     }
     documentation() {
@@ -7177,11 +7323,13 @@ class RequireSri extends Rule {
         this.on("tag:end", (event) => {
             /* only handle thats supporting and requires sri */
             const node = event.previous;
-            if (!(this.supportSri(node) && this.needSri(node)))
+            if (!(this.supportSri(node) && this.needSri(node))) {
                 return;
+            }
             /* check if sri attribute is present */
-            if (node.hasAttribute("integrity"))
+            if (node.hasAttribute("integrity")) {
                 return;
+            }
             this.report(node, `SRI "integrity" attribute is required on <${node.tagName}> element`, node.location);
         });
     }
@@ -7189,19 +7337,25 @@ class RequireSri extends Rule {
         return Object.keys(supportSri).includes(node.tagName);
     }
     needSri(node) {
-        if (this.target === "all")
-            return true;
         const attr = this.elementSourceAttr(node);
-        if (!attr || attr.value === null || attr.isDynamic) {
+        if (!attr || attr.value === null || attr.value === "" || attr.isDynamic) {
             return false;
         }
         const url = attr.value.toString();
-        return crossorigin.test(url);
+        if (this.target === "all" || crossorigin.test(url)) {
+            return !this.isIgnored(url);
+        }
+        return false;
     }
     elementSourceAttr(node) {
         const key = supportSri[node.tagName];
         return node.getAttribute(key);
     }
+    isIgnored(url) {
+        return this.isKeywordIgnored(url, (list, it) => {
+            return list.some((pattern) => it.includes(pattern));
+        });
+    }
 }
 
 class ScriptElement extends Rule {
@@ -9999,6 +10153,7 @@ const bundledRules = {
     "prefer-button": PreferButton,
     "prefer-native-element": PreferNativeElement,
     "prefer-tbody": PreferTbody,
+    "require-csp-nonce": RequireCSPNonce,
     "require-sri": RequireSri,
     "script-element": ScriptElement,
     "script-type": ScriptType,