lighthouse 9.6.7 → 10.0.0-dev.20230209

package/lighthouse-core/audits/dobetterweb/js-libraries.js

@@ -1,88 +0,0 @@
-/**
- * @license Copyright 2017 The Lighthouse Authors. All Rights Reserved.
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
- * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
- */
-
-/**
- * @fileoverview Diagnostic audit that lists all JavaScript libraries detected on the page
- */
-
-'use strict';
-
-const Audit = require('../audit.js');
-const i18n = require('../../lib/i18n/i18n.js');
-
-const UIStrings = {
-  /** Title of a Lighthouse audit that provides detail on the Javascript libraries that are used on the page. */
-  title: 'Detected JavaScript libraries',
-  /** Description of a Lighthouse audit that tells the user what this audit is detecting. This is displayed after a user expands the section to see more. No character length limits. */
-  description: 'All front-end JavaScript libraries detected on the page. [Learn more](https://web.dev/js-libraries/).',
-  /** Label for a column in a data table; entries will be the version numbers of the detected Javascript libraries.  */
-  columnVersion: 'Version',
-};
-
-const str_ = i18n.createMessageInstanceIdFn(__filename, UIStrings);
-
-class JsLibrariesAudit extends Audit {
-  /**
-   * @return {LH.Audit.Meta}
-   */
-  static get meta() {
-    return {
-      id: 'js-libraries',
-      title: str_(UIStrings.title),
-      scoreDisplayMode: Audit.SCORING_MODES.INFORMATIVE,
-      description: str_(UIStrings.description),
-      requiredArtifacts: ['Stacks'],
-    };
-  }
-
-  /**
-   * @param {LH.Artifacts} artifacts
-   * @return {LH.Audit.Product}
-   */
-  static audit(artifacts) {
-    const libDetails = artifacts.Stacks
-      .filter(stack => stack.detector === 'js')
-      // Don't show the fast paths in the table.
-      .filter(stack => !stack.id.endsWith('-fast'))
-      .map(stack => ({
-        name: stack.name,
-        version: stack.version,
-        npm: stack.npm,
-      }));
-
-    /** @type {LH.Audit.Details.Table['headings']} */
-    const headings = [
-      {key: 'name', itemType: 'text', text: str_(i18n.UIStrings.columnName)},
-      {key: 'version', itemType: 'text', text: str_(UIStrings.columnVersion)},
-    ];
-    const details = Audit.makeTableDetails(headings, libDetails, {});
-
-    const debugData = {
-      type: /** @type {const} */ ('debugdata'),
-      stacks: artifacts.Stacks.map(stack => {
-        return {
-          id: stack.id,
-          version: stack.version,
-        };
-      }),
-    };
-
-    if (!libDetails.length) {
-      return {score: null, notApplicable: true};
-    }
-
-    return {
-      score: 1, // Always pass for now.
-      details: {
-        ...details,
-        debugData,
-      },
-    };
-  }
-}
-
-module.exports = JsLibrariesAudit;
-module.exports.UIStrings = UIStrings;

package/lighthouse-core/audits/dobetterweb/no-document-write.js

@@ -1,85 +0,0 @@
-/**
- * @license Copyright 2016 The Lighthouse Authors. All Rights Reserved.
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
- * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
- */
-
-/**
- * @fileoverview Audit a page to see if it's using document.write(). document.write() has terrible performance characteristics.
- *
- * *Intervention*
- * There is a Chrome intervention for the API: https://developers.google.com/web/updates/2016/08/removing-document-write
- * The intervention appears to only be enabled when the user is on a slow connnection. https://chromestatus.com/features#document.write
- * When it's enabled, _some_ calls to document.write() will just not do anything. They're just no-ops.
- *  - "some" == mostly third-party situations. src: https://cs.chromium.org/chromium/src/third_party/blink/renderer/core/script/document_write_intervention.cc?l=109&rcl=61a806621861e9abc07b3a57a6f2edae188d1742
- * If this happens, there will be an error message in the console. src: https://cs.chromium.org/chromium/src/third_party/blink/renderer/core/script/document_write_intervention.cc?l=51-61&rcl=61a806621861e9abc07b3a57a6f2edae188d1742
- *  - Lighthouse doesn't report here on that situation, though it'll show up in `errors-in-console`
- * The intervention may also not block the .write() (because the connection wasn't slow),
- * but it will emit a console warning.
- *  - Lighthouse will also report that here, as the .write() call succeeded.
- * Demo URL: https://output.jsbin.com/qopijux/quiet
- *
- * *This Audit*
- * This audit reports on document.write() calls which the intervention didn't stop.
- * (They worked as intended). If that happens, the browser emits a verbose-level violation
- * console message (hidden by default) that says:
- *     "Parser was blocked due to document.write(<script>)". src: https://cs.chromium.org/chromium/src/third_party/blink/renderer/core/frame/performance_monitor.cc?l=294-300&rcl=40b90cafad9f219e0845879ed8648bdcc96116dc
- */
-
-'use strict';
-
-const ViolationAudit = require('../violation-audit.js');
-const i18n = require('../../lib/i18n/i18n.js');
-
-const UIStrings = {
-  /** Title of a Lighthouse audit that provides detail on the page's use of the `document.write` API. This descriptive title is shown to users when the page does not use `document.write`. */
-  title: 'Avoids `document.write()`',
-  /** Title of a Lighthouse audit that provides detail on the page's use of the `document.write` API. This imperative title is shown to users when the page does use `document.write`. */
-  failureTitle: 'Avoid `document.write()`',
-  /** Description of a Lighthouse audit that tells the user why they should avoid `document.write`. This is displayed after a user expands the section to see more. No character length limits. 'Learn More' becomes link text to additional documentation. */
-  description: 'For users on slow connections, external scripts dynamically injected via ' +
-      '`document.write()` can delay page load by tens of seconds. ' +
-      '[Learn more](https://web.dev/no-document-write/).',
-};
-
-const str_ = i18n.createMessageInstanceIdFn(__filename, UIStrings);
-
-class NoDocWriteAudit extends ViolationAudit {
-  /**
-   * @return {LH.Audit.Meta}
-   */
-  static get meta() {
-    return {
-      id: 'no-document-write',
-      title: str_(UIStrings.title),
-      failureTitle: str_(UIStrings.failureTitle),
-      description: str_(UIStrings.description),
-      requiredArtifacts: ['ConsoleMessages', 'SourceMaps', 'ScriptElements'],
-    };
-  }
-
-  /**
-   * @param {LH.Artifacts} artifacts
-   * @param {LH.Audit.Context} context
-   * @return {Promise<LH.Audit.Product>}
-   */
-  static async audit(artifacts, context) {
-    const results =
-      await ViolationAudit.getViolationResults(artifacts, context, /document\.write/);
-
-    /** @type {LH.Audit.Details.Table['headings']} */
-    const headings = [
-      {key: 'source', itemType: 'source-location', text: str_(i18n.UIStrings.columnSource)},
-    ];
-    // TODO(bckenny): see TODO in geolocation-on-start
-    const details = ViolationAudit.makeTableDetails(headings, results);
-
-    return {
-      score: Number(results.length === 0),
-      details,
-    };
-  }
-}
-
-module.exports = NoDocWriteAudit;
-module.exports.UIStrings = UIStrings;

package/lighthouse-core/audits/dobetterweb/no-vulnerable-libraries.js

@@ -1,225 +0,0 @@
-/**
- * @license Copyright 2017 The Lighthouse Authors. All Rights Reserved.
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
- * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
- */
-
-/**
- * @fileoverview Audits a page to make sure there are no JS libraries with
- * known vulnerabilities being used. Checks against a vulnerability db
- * provided by Snyk.io and checked in locally as third-party/snyk/snapshot.json
- */
-
-'use strict';
-
-const Audit = require('../audit.js');
-const Sentry = require('../../lib/sentry.js');
-const semver = require('semver');
-const snykDatabase = require('../../../third-party/snyk/snapshot.json');
-const i18n = require('../../lib/i18n/i18n.js');
-
-const UIStrings = {
-  /** Title of a Lighthouse audit that provides detail on Javascript libraries the page uses. This descriptive title is shown to users when all Javascript libraries are free of known security vulnerabilities. */
-  title: 'Avoids front-end JavaScript libraries' +
-    ' with known security vulnerabilities',
-  /** Title of a Lighthouse audit that provides detail on Javascript libraries the page uses. This descriptive title is shown to users when some detected Javascript libraries have known security vulnerabilities. */
-  failureTitle: 'Includes front-end JavaScript libraries' +
-    ' with known security vulnerabilities',
-  /** Description of a Lighthouse audit that tells the user why they should be concerned about the third party Javascript libraries that they use. This is displayed after a user expands the section to see more. No character length limits. 'Learn More' becomes link text to additional documentation. */
-  description: 'Some third-party scripts may contain known security vulnerabilities ' +
-    'that are easily identified and exploited by attackers. ' +
-    '[Learn more](https://web.dev/no-vulnerable-libraries/).',
-  /** [ICU Syntax] Label for the audit identifying the number of vulnerable Javascript libraries found. */
-  displayValue: `{itemCount, plural,
-    =1 {1 vulnerability detected}
-    other {# vulnerabilities detected}
-    }`,
-  /** Label for a column in a data table; entries will be the version numbers of the Javascript libraries found.  */
-  columnVersion: 'Library Version',
-  /** Label for a column in a data table; entries will be the counts of JavaScript-library vulnerabilities found.  */
-  columnVuln: 'Vulnerability Count',
-  /** Label for a column in a data table; entries will be the severity of the vulnerabilities found within a Javascript library. */
-  columnSeverity: 'Highest Severity',
-};
-
-const str_ = i18n.createMessageInstanceIdFn(__filename, UIStrings);
-
-const SEMVER_REGEX = /^(\d+\.\d+\.\d+)[^-0-9]+/;
-
-/** @type {Record<string, LH.IcuMessage>} */
-const severityStringsMap = {
-  'low': str_(i18n.UIStrings.itemSeverityLow),
-  'medium': str_(i18n.UIStrings.itemSeverityMedium),
-  'high': str_(i18n.UIStrings.itemSeverityHigh),
-};
-
-/** @typedef {{npm: Object<string, Array<{id: string, severity: string, semver: {vulnerable: Array<string>}}>>}} SnykDB */
-/** @typedef {{severity: LH.IcuMessage, numericSeverity: number, library: string, url: string}} Vulnerability */
-
-class NoVulnerableLibrariesAudit extends Audit {
-  /**
-   * @return {LH.Audit.Meta}
-   */
-  static get meta() {
-    return {
-      id: 'no-vulnerable-libraries',
-      title: str_(UIStrings.title),
-      failureTitle: str_(UIStrings.failureTitle),
-      description: str_(UIStrings.description),
-      requiredArtifacts: ['Stacks'],
-    };
-  }
-
-  /**
-   * @return {SnykDB}
-   */
-  static get snykDB() {
-    return snykDatabase;
-  }
-
-  /**
-   * @return {Object<string, number>}
-   */
-  static get severityMap() {
-    return {
-      high: 3,
-      medium: 2,
-      low: 1,
-    };
-  }
-
-  /**
-   * Attempts to normalize the version.
-   * @param {string|undefined} version
-   * @return {string|undefined}
-   */
-  static normalizeVersion(version) {
-    if (!version) return version;
-    if (semver.valid(version)) return version;
-
-    // converts 1.5 -> 1.5.0
-    if (/^\d+\.\d+$/.test(version)) return `${version}.0`;
-    // converts 1.0.0a-bunch-of-crap -> 1.0.0
-    const versionMatch = version.match(SEMVER_REGEX);
-    if (versionMatch) return versionMatch[1];
-    // leave everything else untouched
-    return version;
-  }
-
-  /**
-   * @param {string} normalizedVersion
-   * @param {LH.Artifacts.DetectedStack} lib
-   * @param {SnykDB} snykDB
-   * @return {Array<Vulnerability>}
-   */
-  static getVulnerabilities(normalizedVersion, lib, snykDB) {
-    if (!lib.npm || !snykDB.npm[lib.npm]) {
-      return [];
-    }
-
-    // Verify the version is well-formed first
-    try {
-      semver.satisfies(normalizedVersion, '*');
-    } catch (err) {
-      err.pkgName = lib.npm;
-      // Report the failure and skip this library if the version was ill-specified
-      Sentry.captureException(err, {level: 'warning'});
-      return [];
-    }
-
-    // Match the vulnerability candidates from snyk against the version we see in the page
-    const vulnCandidatesForLib = snykDB.npm[lib.npm];
-    const matchingVulns = vulnCandidatesForLib.filter(vulnCandidate => {
-      // Each snyk vulnerability comes with an array of semver ranges
-      // The page is vulnerable if any of the ranges match.
-      const hasMatchingVersion = vulnCandidate.semver.vulnerable.some(vulnSemverRange =>
-        semver.satisfies(normalizedVersion, vulnSemverRange)
-      );
-      return hasMatchingVersion;
-    });
-
-    const vulns = matchingVulns.map(vuln => {
-      return {
-        severity: severityStringsMap[vuln.severity],
-        numericSeverity: this.severityMap[vuln.severity],
-        library: `${lib.name}@${normalizedVersion}`,
-        url: 'https://snyk.io/vuln/' + vuln.id,
-      };
-    });
-
-    return vulns;
-  }
-
-  /**
-   * @param {Array<Vulnerability>} vulnerabilities
-   * @return {LH.IcuMessage}
-   */
-  static highestSeverity(vulnerabilities) {
-    const sortedVulns = vulnerabilities
-      .sort((a, b) => b.numericSeverity - a.numericSeverity);
-    return sortedVulns[0].severity;
-  }
-
-  /**
-   * @param {LH.Artifacts} artifacts
-   * @return {LH.Audit.Product}
-   */
-  static audit(artifacts) {
-    const foundLibraries = artifacts.Stacks.filter(stack => stack.detector === 'js');
-    const snykDB = NoVulnerableLibrariesAudit.snykDB;
-
-    if (!foundLibraries.length) {
-      return {
-        score: 1,
-      };
-    }
-
-    let totalVulns = 0;
-    /** @type {Array<{highestSeverity: LH.IcuMessage, vulnCount: number, detectedLib: LH.Audit.Details.LinkValue}>} */
-    const vulnerabilityResults = [];
-
-    for (const lib of foundLibraries) {
-      const version = this.normalizeVersion(lib.version) || '';
-      const vulns = this.getVulnerabilities(version, lib, snykDB);
-      const vulnCount = vulns.length;
-      totalVulns += vulnCount;
-
-      let highestSeverity;
-      if (vulns.length > 0) {
-        highestSeverity = this.highestSeverity(vulns);
-
-        vulnerabilityResults.push({
-          highestSeverity,
-          vulnCount,
-          detectedLib: {
-            text: lib.name + '@' + version,
-            url: `https://snyk.io/vuln/npm:${lib.npm}?lh=${version}&utm_source=lighthouse&utm_medium=ref&utm_campaign=audit`,
-            type: 'link',
-          },
-        });
-      }
-    }
-
-    let displayValue;
-    if (totalVulns > 0) {
-      displayValue = str_(UIStrings.displayValue, {itemCount: totalVulns});
-    }
-
-    /** @type {LH.Audit.Details.Table['headings']} */
-    const headings = [
-      {key: 'detectedLib', itemType: 'link', text: str_(UIStrings.columnVersion)},
-      {key: 'vulnCount', itemType: 'text', text: str_(UIStrings.columnVuln)},
-      {key: 'highestSeverity', itemType: 'text', text: str_(UIStrings.columnSeverity)},
-    ];
-    const details = Audit.makeTableDetails(headings, vulnerabilityResults, {});
-
-    return {
-      score: Number(totalVulns === 0),
-      displayValue,
-      details,
-    };
-  }
-}
-
-module.exports = NoVulnerableLibrariesAudit;
-module.exports.UIStrings = UIStrings;

package/lighthouse-core/audits/dobetterweb/notification-on-start.js

@@ -1,69 +0,0 @@
-/**
- * @license Copyright 2016 The Lighthouse Authors. All Rights Reserved.
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
- * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
- */
-
-/**
- * @fileoverview Audits a page to see if it is requesting usage of the notification API on
- * page load. This is often a sign of poor user experience because it lacks context.
- */
-
-'use strict';
-
-const ViolationAudit = require('../violation-audit.js');
-const i18n = require('../../lib/i18n/i18n.js');
-
-const UIStrings = {
-  /** Title of a Lighthouse audit that provides detail on the page's notification permission requests. This descriptive title is shown to users when the page does not ask for notification permission on load. */
-  title: 'Avoids requesting the notification permission on page load',
-  /** Title of a Lighthouse audit that provides detail on the page's notification permission requests. This descriptive title is shown to users when the page does ask for notification permission on load. */
-  failureTitle: 'Requests the notification permission on page load',
-  /** Description of a Lighthouse audit that tells the user why they should not ask for notification permission on load. This is displayed after a user expands the section to see more. No character length limits. 'Learn More' becomes link text to additional documentation. */
-  description: 'Users are mistrustful of or confused by sites that request to send ' +
-      'notifications without context. Consider tying the request to user gestures ' +
-      'instead. [Learn more](https://web.dev/notification-on-start/).',
-};
-
-const str_ = i18n.createMessageInstanceIdFn(__filename, UIStrings);
-
-class NotificationOnStart extends ViolationAudit {
-  /**
-   * @return {LH.Audit.Meta}
-   */
-  static get meta() {
-    return {
-      id: 'notification-on-start',
-      title: str_(UIStrings.title),
-      failureTitle: str_(UIStrings.failureTitle),
-      description: str_(UIStrings.description),
-      supportedModes: ['navigation'],
-      requiredArtifacts: ['ConsoleMessages', 'SourceMaps', 'ScriptElements'],
-    };
-  }
-
-  /**
-   * @param {LH.Artifacts} artifacts
-   * @param {LH.Audit.Context} context
-   * @return {Promise<LH.Audit.Product>}
-   */
-  static async audit(artifacts, context) {
-    const results =
-      await ViolationAudit.getViolationResults(artifacts, context, /notification permission/);
-
-    /** @type {LH.Audit.Details.Table['headings']} */
-    const headings = [
-      {key: 'source', itemType: 'source-location', text: str_(i18n.UIStrings.columnSource)},
-    ];
-    // TODO(bckenny): see TODO in geolocation-on-start
-    const details = ViolationAudit.makeTableDetails(headings, results);
-
-    return {
-      score: Number(results.length === 0),
-      details,
-    };
-  }
-}
-
-module.exports = NotificationOnStart;
-module.exports.UIStrings = UIStrings;

package/lighthouse-core/audits/dobetterweb/password-inputs-can-be-pasted-into.js

@@ -1,66 +0,0 @@
-/**
- * @license Copyright 2016 The Lighthouse Authors. All Rights Reserved.
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
- * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
- */
-'use strict';
-
-const Audit = require('../audit.js');
-const i18n = require('../../lib/i18n/i18n.js');
-
-const UIStrings = {
-  /** Title of a Lighthouse audit that provides detail on the ability to paste into password fields. This descriptive title is shown to users when the page allows pasting of content into password fields. */
-  title: 'Allows users to paste into password fields',
-  /** Title of a Lighthouse audit that provides detail on the ability to paste into password fields. This descriptive title is shown to users when the page does not allow pasting of content into password fields. */
-  failureTitle: 'Prevents users to paste into password fields',
-  /** Description of a Lighthouse audit that tells the user why they should allow pasting of content into password fields. This is displayed after a user expands the section to see more. No character length limits. 'Learn More' becomes link text to additional documentation. */
-  description: 'Preventing password pasting undermines good security policy. ' +
-      '[Learn more](https://web.dev/password-inputs-can-be-pasted-into/).',
-};
-
-const str_ = i18n.createMessageInstanceIdFn(__filename, UIStrings);
-
-class PasswordInputsCanBePastedIntoAudit extends Audit {
-  /**
-   * @return {LH.Audit.Meta}
-   */
-  static get meta() {
-    return {
-      id: 'password-inputs-can-be-pasted-into',
-      title: str_(UIStrings.title),
-      failureTitle: str_(UIStrings.failureTitle),
-      description: str_(UIStrings.description),
-      requiredArtifacts: ['PasswordInputsWithPreventedPaste'],
-    };
-  }
-
-  /**
-   * @param {LH.Artifacts} artifacts
-   * @return {LH.Audit.Product}
-   */
-  static audit(artifacts) {
-    const passwordInputsWithPreventedPaste = artifacts.PasswordInputsWithPreventedPaste;
-
-    /** @type {LH.Audit.Details.Table['items']} */
-    const items = [];
-
-    passwordInputsWithPreventedPaste.forEach(input => {
-      items.push({
-        node: Audit.makeNodeItem(input.node),
-      });
-    });
-
-    /** @type {LH.Audit.Details.Table['headings']} */
-    const headings = [
-      {key: 'node', itemType: 'node', text: str_(i18n.UIStrings.columnFailingElem)},
-    ];
-
-    return {
-      score: Number(passwordInputsWithPreventedPaste.length === 0),
-      details: Audit.makeTableDetails(headings, items),
-    };
-  }
-}
-
-module.exports = PasswordInputsCanBePastedIntoAudit;
-module.exports.UIStrings = UIStrings;