lighthouse 9.6.8 → 10.0.0-dev.20230210

package/lighthouse-core/audits/dobetterweb/no-vulnerable-libraries.js

@@ -1,225 +0,0 @@
-/**
- * @license Copyright 2017 The Lighthouse Authors. All Rights Reserved.
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
- * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
- */
-
-/**
- * @fileoverview Audits a page to make sure there are no JS libraries with
- * known vulnerabilities being used. Checks against a vulnerability db
- * provided by Snyk.io and checked in locally as third-party/snyk/snapshot.json
- */
-
-'use strict';
-
-const Audit = require('../audit.js');
-const Sentry = require('../../lib/sentry.js');
-const semver = require('semver');
-const snykDatabase = require('../../../third-party/snyk/snapshot.json');
-const i18n = require('../../lib/i18n/i18n.js');
-
-const UIStrings = {
-  /** Title of a Lighthouse audit that provides detail on Javascript libraries the page uses. This descriptive title is shown to users when all Javascript libraries are free of known security vulnerabilities. */
-  title: 'Avoids front-end JavaScript libraries' +
-    ' with known security vulnerabilities',
-  /** Title of a Lighthouse audit that provides detail on Javascript libraries the page uses. This descriptive title is shown to users when some detected Javascript libraries have known security vulnerabilities. */
-  failureTitle: 'Includes front-end JavaScript libraries' +
-    ' with known security vulnerabilities',
-  /** Description of a Lighthouse audit that tells the user why they should be concerned about the third party Javascript libraries that they use. This is displayed after a user expands the section to see more. No character length limits. 'Learn More' becomes link text to additional documentation. */
-  description: 'Some third-party scripts may contain known security vulnerabilities ' +
-    'that are easily identified and exploited by attackers. ' +
-    '[Learn more](https://web.dev/no-vulnerable-libraries/).',
-  /** [ICU Syntax] Label for the audit identifying the number of vulnerable Javascript libraries found. */
-  displayValue: `{itemCount, plural,
-    =1 {1 vulnerability detected}
-    other {# vulnerabilities detected}
-    }`,
-  /** Label for a column in a data table; entries will be the version numbers of the Javascript libraries found.  */
-  columnVersion: 'Library Version',
-  /** Label for a column in a data table; entries will be the counts of JavaScript-library vulnerabilities found.  */
-  columnVuln: 'Vulnerability Count',
-  /** Label for a column in a data table; entries will be the severity of the vulnerabilities found within a Javascript library. */
-  columnSeverity: 'Highest Severity',
-};
-
-const str_ = i18n.createMessageInstanceIdFn(__filename, UIStrings);
-
-const SEMVER_REGEX = /^(\d+\.\d+\.\d+)[^-0-9]+/;
-
-/** @type {Record<string, LH.IcuMessage>} */
-const severityStringsMap = {
-  'low': str_(i18n.UIStrings.itemSeverityLow),
-  'medium': str_(i18n.UIStrings.itemSeverityMedium),
-  'high': str_(i18n.UIStrings.itemSeverityHigh),
-};
-
-/** @typedef {{npm: Object<string, Array<{id: string, severity: string, semver: {vulnerable: Array<string>}}>>}} SnykDB */
-/** @typedef {{severity: LH.IcuMessage, numericSeverity: number, library: string, url: string}} Vulnerability */
-
-class NoVulnerableLibrariesAudit extends Audit {
-  /**
-   * @return {LH.Audit.Meta}
-   */
-  static get meta() {
-    return {
-      id: 'no-vulnerable-libraries',
-      title: str_(UIStrings.title),
-      failureTitle: str_(UIStrings.failureTitle),
-      description: str_(UIStrings.description),
-      requiredArtifacts: ['Stacks'],
-    };
-  }
-
-  /**
-   * @return {SnykDB}
-   */
-  static get snykDB() {
-    return snykDatabase;
-  }
-
-  /**
-   * @return {Object<string, number>}
-   */
-  static get severityMap() {
-    return {
-      high: 3,
-      medium: 2,
-      low: 1,
-    };
-  }
-
-  /**
-   * Attempts to normalize the version.
-   * @param {string|undefined} version
-   * @return {string|undefined}
-   */
-  static normalizeVersion(version) {
-    if (!version) return version;
-    if (semver.valid(version)) return version;
-
-    // converts 1.5 -> 1.5.0
-    if (/^\d+\.\d+$/.test(version)) return `${version}.0`;
-    // converts 1.0.0a-bunch-of-crap -> 1.0.0
-    const versionMatch = version.match(SEMVER_REGEX);
-    if (versionMatch) return versionMatch[1];
-    // leave everything else untouched
-    return version;
-  }
-
-  /**
-   * @param {string} normalizedVersion
-   * @param {LH.Artifacts.DetectedStack} lib
-   * @param {SnykDB} snykDB
-   * @return {Array<Vulnerability>}
-   */
-  static getVulnerabilities(normalizedVersion, lib, snykDB) {
-    if (!lib.npm || !snykDB.npm[lib.npm]) {
-      return [];
-    }
-
-    // Verify the version is well-formed first
-    try {
-      semver.satisfies(normalizedVersion, '*');
-    } catch (err) {
-      err.pkgName = lib.npm;
-      // Report the failure and skip this library if the version was ill-specified
-      Sentry.captureException(err, {level: 'warning'});
-      return [];
-    }
-
-    // Match the vulnerability candidates from snyk against the version we see in the page
-    const vulnCandidatesForLib = snykDB.npm[lib.npm];
-    const matchingVulns = vulnCandidatesForLib.filter(vulnCandidate => {
-      // Each snyk vulnerability comes with an array of semver ranges
-      // The page is vulnerable if any of the ranges match.
-      const hasMatchingVersion = vulnCandidate.semver.vulnerable.some(vulnSemverRange =>
-        semver.satisfies(normalizedVersion, vulnSemverRange)
-      );
-      return hasMatchingVersion;
-    });
-
-    const vulns = matchingVulns.map(vuln => {
-      return {
-        severity: severityStringsMap[vuln.severity],
-        numericSeverity: this.severityMap[vuln.severity],
-        library: `${lib.name}@${normalizedVersion}`,
-        url: 'https://snyk.io/vuln/' + vuln.id,
-      };
-    });
-
-    return vulns;
-  }
-
-  /**
-   * @param {Array<Vulnerability>} vulnerabilities
-   * @return {LH.IcuMessage}
-   */
-  static highestSeverity(vulnerabilities) {
-    const sortedVulns = vulnerabilities
-      .sort((a, b) => b.numericSeverity - a.numericSeverity);
-    return sortedVulns[0].severity;
-  }
-
-  /**
-   * @param {LH.Artifacts} artifacts
-   * @return {LH.Audit.Product}
-   */
-  static audit(artifacts) {
-    const foundLibraries = artifacts.Stacks.filter(stack => stack.detector === 'js');
-    const snykDB = NoVulnerableLibrariesAudit.snykDB;
-
-    if (!foundLibraries.length) {
-      return {
-        score: 1,
-      };
-    }
-
-    let totalVulns = 0;
-    /** @type {Array<{highestSeverity: LH.IcuMessage, vulnCount: number, detectedLib: LH.Audit.Details.LinkValue}>} */
-    const vulnerabilityResults = [];
-
-    for (const lib of foundLibraries) {
-      const version = this.normalizeVersion(lib.version) || '';
-      const vulns = this.getVulnerabilities(version, lib, snykDB);
-      const vulnCount = vulns.length;
-      totalVulns += vulnCount;
-
-      let highestSeverity;
-      if (vulns.length > 0) {
-        highestSeverity = this.highestSeverity(vulns);
-
-        vulnerabilityResults.push({
-          highestSeverity,
-          vulnCount,
-          detectedLib: {
-            text: lib.name + '@' + version,
-            url: `https://snyk.io/vuln/npm:${lib.npm}?lh=${version}&utm_source=lighthouse&utm_medium=ref&utm_campaign=audit`,
-            type: 'link',
-          },
-        });
-      }
-    }
-
-    let displayValue;
-    if (totalVulns > 0) {
-      displayValue = str_(UIStrings.displayValue, {itemCount: totalVulns});
-    }
-
-    /** @type {LH.Audit.Details.Table['headings']} */
-    const headings = [
-      {key: 'detectedLib', itemType: 'link', text: str_(UIStrings.columnVersion)},
-      {key: 'vulnCount', itemType: 'text', text: str_(UIStrings.columnVuln)},
-      {key: 'highestSeverity', itemType: 'text', text: str_(UIStrings.columnSeverity)},
-    ];
-    const details = Audit.makeTableDetails(headings, vulnerabilityResults, {});
-
-    return {
-      score: Number(totalVulns === 0),
-      displayValue,
-      details,
-    };
-  }
-}
-
-module.exports = NoVulnerableLibrariesAudit;
-module.exports.UIStrings = UIStrings;

package/lighthouse-core/audits/dobetterweb/notification-on-start.js

@@ -1,69 +0,0 @@
-/**
- * @license Copyright 2016 The Lighthouse Authors. All Rights Reserved.
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
- * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
- */
-
-/**
- * @fileoverview Audits a page to see if it is requesting usage of the notification API on
- * page load. This is often a sign of poor user experience because it lacks context.
- */
-
-'use strict';
-
-const ViolationAudit = require('../violation-audit.js');
-const i18n = require('../../lib/i18n/i18n.js');
-
-const UIStrings = {
-  /** Title of a Lighthouse audit that provides detail on the page's notification permission requests. This descriptive title is shown to users when the page does not ask for notification permission on load. */
-  title: 'Avoids requesting the notification permission on page load',
-  /** Title of a Lighthouse audit that provides detail on the page's notification permission requests. This descriptive title is shown to users when the page does ask for notification permission on load. */
-  failureTitle: 'Requests the notification permission on page load',
-  /** Description of a Lighthouse audit that tells the user why they should not ask for notification permission on load. This is displayed after a user expands the section to see more. No character length limits. 'Learn More' becomes link text to additional documentation. */
-  description: 'Users are mistrustful of or confused by sites that request to send ' +
-      'notifications without context. Consider tying the request to user gestures ' +
-      'instead. [Learn more](https://web.dev/notification-on-start/).',
-};
-
-const str_ = i18n.createMessageInstanceIdFn(__filename, UIStrings);
-
-class NotificationOnStart extends ViolationAudit {
-  /**
-   * @return {LH.Audit.Meta}
-   */
-  static get meta() {
-    return {
-      id: 'notification-on-start',
-      title: str_(UIStrings.title),
-      failureTitle: str_(UIStrings.failureTitle),
-      description: str_(UIStrings.description),
-      supportedModes: ['navigation'],
-      requiredArtifacts: ['ConsoleMessages', 'SourceMaps', 'ScriptElements'],
-    };
-  }
-
-  /**
-   * @param {LH.Artifacts} artifacts
-   * @param {LH.Audit.Context} context
-   * @return {Promise<LH.Audit.Product>}
-   */
-  static async audit(artifacts, context) {
-    const results =
-      await ViolationAudit.getViolationResults(artifacts, context, /notification permission/);
-
-    /** @type {LH.Audit.Details.Table['headings']} */
-    const headings = [
-      {key: 'source', itemType: 'source-location', text: str_(i18n.UIStrings.columnSource)},
-    ];
-    // TODO(bckenny): see TODO in geolocation-on-start
-    const details = ViolationAudit.makeTableDetails(headings, results);
-
-    return {
-      score: Number(results.length === 0),
-      details,
-    };
-  }
-}
-
-module.exports = NotificationOnStart;
-module.exports.UIStrings = UIStrings;

package/lighthouse-core/audits/dobetterweb/password-inputs-can-be-pasted-into.js

@@ -1,66 +0,0 @@
-/**
- * @license Copyright 2016 The Lighthouse Authors. All Rights Reserved.
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
- * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
- */
-'use strict';
-
-const Audit = require('../audit.js');
-const i18n = require('../../lib/i18n/i18n.js');
-
-const UIStrings = {
-  /** Title of a Lighthouse audit that provides detail on the ability to paste into password fields. This descriptive title is shown to users when the page allows pasting of content into password fields. */
-  title: 'Allows users to paste into password fields',
-  /** Title of a Lighthouse audit that provides detail on the ability to paste into password fields. This descriptive title is shown to users when the page does not allow pasting of content into password fields. */
-  failureTitle: 'Prevents users to paste into password fields',
-  /** Description of a Lighthouse audit that tells the user why they should allow pasting of content into password fields. This is displayed after a user expands the section to see more. No character length limits. 'Learn More' becomes link text to additional documentation. */
-  description: 'Preventing password pasting undermines good security policy. ' +
-      '[Learn more](https://web.dev/password-inputs-can-be-pasted-into/).',
-};
-
-const str_ = i18n.createMessageInstanceIdFn(__filename, UIStrings);
-
-class PasswordInputsCanBePastedIntoAudit extends Audit {
-  /**
-   * @return {LH.Audit.Meta}
-   */
-  static get meta() {
-    return {
-      id: 'password-inputs-can-be-pasted-into',
-      title: str_(UIStrings.title),
-      failureTitle: str_(UIStrings.failureTitle),
-      description: str_(UIStrings.description),
-      requiredArtifacts: ['PasswordInputsWithPreventedPaste'],
-    };
-  }
-
-  /**
-   * @param {LH.Artifacts} artifacts
-   * @return {LH.Audit.Product}
-   */
-  static audit(artifacts) {
-    const passwordInputsWithPreventedPaste = artifacts.PasswordInputsWithPreventedPaste;
-
-    /** @type {LH.Audit.Details.Table['items']} */
-    const items = [];
-
-    passwordInputsWithPreventedPaste.forEach(input => {
-      items.push({
-        node: Audit.makeNodeItem(input.node),
-      });
-    });
-
-    /** @type {LH.Audit.Details.Table['headings']} */
-    const headings = [
-      {key: 'node', itemType: 'node', text: str_(i18n.UIStrings.columnFailingElem)},
-    ];
-
-    return {
-      score: Number(passwordInputsWithPreventedPaste.length === 0),
-      details: Audit.makeTableDetails(headings, items),
-    };
-  }
-}
-
-module.exports = PasswordInputsCanBePastedIntoAudit;
-module.exports.UIStrings = UIStrings;

package/lighthouse-core/audits/dobetterweb/uses-http2.js

@@ -1,258 +0,0 @@
-/**
- * @license Copyright 2016 The Lighthouse Authors. All Rights Reserved.
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
- * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
- */
-'use strict';
-
-/**
- * @fileoverview Audit a page to ensure that resource loaded over its own
- * origin are over the http/2 protocol.
- */
-
-/** @typedef {import('../../lib/dependency-graph/simulator/simulator')} Simulator */
-/** @typedef {import('../../lib/dependency-graph/base-node.js').Node} Node */
-
-const Audit = require('../audit.js');
-const ThirdParty = require('../../lib/third-party-web.js');
-const URL = require('../../lib/url-shim.js');
-const ByteEfficiencyAudit = require('../byte-efficiency/byte-efficiency-audit.js');
-const Interactive = require('../../computed/metrics/lantern-interactive.js');
-const NetworkRequest = require('../../lib/network-request.js');
-const NetworkRecords = require('../../computed/network-records.js');
-const LoadSimulator = require('../../computed/load-simulator.js');
-const PageDependencyGraph = require('../../computed/page-dependency-graph.js');
-const i18n = require('../../lib/i18n/i18n.js');
-
-const UIStrings = {
-  /** Imperative title of a Lighthouse audit that tells the user to enable HTTP/2. This is displayed in a list of audit titles that Lighthouse generates. */
-  title: 'Use HTTP/2',
-  /** Description of a Lighthouse audit that tells the user why they should use HTTP/2. This is displayed after a user expands the section to see more. No character length limits. 'Learn More' becomes link text to additional documentation. */
-  description: 'HTTP/2 offers many benefits over HTTP/1.1, including binary headers and ' +
-      'multiplexing. [Learn more](https://web.dev/uses-http2/).',
-  /** [ICU Syntax] Label identifying the number of network requests that were not served with HTTP/2. */
-  displayValue: `{itemCount, plural,
-    =1 {1 request not served via HTTP/2}
-    other {# requests not served via HTTP/2}
-    }`,
-  /**  Label for a column in a data table; entries in the column will be the HTTP Protocol used to make a network request. */
-  columnProtocol: 'Protocol',
-};
-
-const str_ = i18n.createMessageInstanceIdFn(__filename, UIStrings);
-
-/** @type {Set<LH.Artifacts.NetworkRequest['resourceType']>} */
-const STATIC_RESOURCE_TYPES = new Set([
-  NetworkRequest.TYPES.Document,
-  NetworkRequest.TYPES.Font,
-  NetworkRequest.TYPES.Image,
-  NetworkRequest.TYPES.Stylesheet,
-  NetworkRequest.TYPES.Script,
-  NetworkRequest.TYPES.Media,
-]);
-
-class UsesHTTP2Audit extends Audit {
-  /**
-   * @return {LH.Audit.Meta}
-   */
-  static get meta() {
-    return {
-      id: 'uses-http2',
-      title: str_(UIStrings.title),
-      description: str_(UIStrings.description),
-      scoreDisplayMode: Audit.SCORING_MODES.NUMERIC,
-      supportedModes: ['timespan', 'navigation'],
-      requiredArtifacts: ['URL', 'devtoolsLogs', 'traces', 'GatherContext'],
-    };
-  }
-
-  /**
-   * Computes the estimated effect all results being converted to use http/2, the max of:
-   *
-   * - end time of the last long task in the provided graph
-   * - end time of the last node in the graph
-   *
-   * @param {Array<{url: string}>} results
-   * @param {Node} graph
-   * @param {Simulator} simulator
-   * @return {number}
-   */
-  static computeWasteWithTTIGraph(results, graph, simulator) {
-    const beforeLabel = `uses-http2-before`;
-    const afterLabel = `uses-http2-after`;
-    const flexibleOrdering = true;
-
-    const urlsToChange = new Set(results.map(result => result.url));
-    const simulationBefore = simulator.simulate(graph, {label: beforeLabel, flexibleOrdering});
-
-    // Update all the protocols to reflect implementing our recommendations
-    /** @type {Map<string, string>} */
-    const originalProtocols = new Map();
-    graph.traverse(node => {
-      if (node.type !== 'network') return;
-      if (!urlsToChange.has(node.record.url)) return;
-
-      originalProtocols.set(node.record.requestId, node.record.protocol);
-      node.record.protocol = 'h2';
-    });
-
-    const simulationAfter = simulator.simulate(graph, {label: afterLabel, flexibleOrdering});
-
-    // Restore the original protocol after we've done our simulation
-    graph.traverse(node => {
-      if (node.type !== 'network') return;
-      const originalProtocol = originalProtocols.get(node.record.requestId);
-      if (originalProtocol === undefined) return;
-      node.record.protocol = originalProtocol;
-    });
-
-    const savingsOnOverallLoad = simulationBefore.timeInMs - simulationAfter.timeInMs;
-    const savingsOnTTI = Interactive.getLastLongTaskEndTime(simulationBefore.nodeTimings) -
-      Interactive.getLastLongTaskEndTime(simulationAfter.nodeTimings);
-    const savings = Math.max(savingsOnTTI, savingsOnOverallLoad);
-
-    // Round waste to nearest 10ms
-    return Math.round(Math.max(savings, 0) / 10) * 10;
-  }
-
-  /**
-   * Determines whether a network request is a "static resource" that would benefit from H2 multiplexing.
-   * XHRs, tracking pixels, etc generally don't benefit as much because they aren't requested en-masse
-   * for the same origin at the exact same time.
-   *
-   * @param {LH.Artifacts.NetworkRequest} networkRequest
-   * @return {boolean}
-   */
-  static isStaticAsset(networkRequest) {
-    if (!STATIC_RESOURCE_TYPES.has(networkRequest.resourceType)) return false;
-
-    // Resources from third-parties that are less than 100 bytes are usually tracking pixels, not actual resources.
-    // They can masquerade as static types though (gifs, documents, etc)
-    if (networkRequest.resourceSize < 100) {
-      const entity = ThirdParty.getEntity(networkRequest.url);
-      if (entity) return false;
-    }
-
-    return true;
-  }
-
-  /**
-   * Determine the set of resources that aren't HTTP/2 but should be.
-   * We're a little conservative about what we surface for a few reasons:
-   *
-   *    - The simulator approximation of HTTP/2 is a little more generous than reality.
-   *    - There's a bit of debate surrounding HTTP/2 due to its worse performance in environments with high packet loss.**
-   *    - It's something that you'd have absolutely zero control over with a third-party (can't defer to fix it for example).
-   *
-   * Therefore, we only surface requests that were...
-   *
-   *    - Served over HTTP/1.1 or earlier
-   *    - Served over an origin that serves at least 6 static asset requests
-   *      (if there aren't more requests than browser's max/host, multiplexing isn't as big a deal)
-   *    - Not served on localhost (h2 is a pain to deal with locally & and CI)
-   *
-   * ** = https://news.ycombinator.com/item?id=19086639
-   *      https://www.twilio.com/blog/2017/10/http2-issues.html
-   *      https://www.cachefly.com/http-2-is-not-a-magic-bullet/
-   *
-   * @param {Array<LH.Artifacts.NetworkRequest>} networkRecords
-   * @return {Array<{url: string, protocol: string}>}
-   */
-  static determineNonHttp2Resources(networkRecords) {
-    /** @type {Array<{url: string, protocol: string}>} */
-    const nonHttp2Resources = [];
-
-    /** @type {Set<string>} */
-    const seenURLs = new Set();
-    /** @type {Map<string, Array<LH.Artifacts.NetworkRequest>>} */
-    const groupedByOrigin = new Map();
-    for (const record of networkRecords) {
-      if (!UsesHTTP2Audit.isStaticAsset(record)) continue;
-      if (URL.isLikeLocalhost(record.parsedURL.host)) continue;
-      const existing = groupedByOrigin.get(record.parsedURL.securityOrigin) || [];
-      existing.push(record);
-      groupedByOrigin.set(record.parsedURL.securityOrigin, existing);
-    }
-
-    for (const record of networkRecords) {
-      // Skip duplicates.
-      if (seenURLs.has(record.url)) continue;
-      // Check if record is not served through the service worker, servicer worker uses http/1.1 as a protocol.
-      // These can generate false positives (bug: https://github.com/GoogleChrome/lighthouse/issues/7158).
-      if (record.fetchedViaServiceWorker) continue;
-      // Test the protocol to see if it was http/1.1.
-      const isOldHttp = /HTTP\/[01][.\d]?/i.test(record.protocol);
-      if (!isOldHttp) continue;
-      // Check if the origin has enough requests to bother flagging.
-      const group = groupedByOrigin.get(record.parsedURL.securityOrigin) || [];
-      if (group.length < 6) continue;
-
-      seenURLs.add(record.url);
-      nonHttp2Resources.push({protocol: record.protocol, url: record.url});
-    }
-
-    return nonHttp2Resources;
-  }
-
-  /**
-   * @param {LH.Artifacts} artifacts
-   * @param {LH.Audit.Context} context
-   * @return {Promise<LH.Audit.Product>}
-   */
-  static async audit(artifacts, context) {
-    const trace = artifacts.traces[Audit.DEFAULT_PASS];
-    const devtoolsLog = artifacts.devtoolsLogs[Audit.DEFAULT_PASS];
-    const networkRecords = await NetworkRecords.request(devtoolsLog, context);
-    const resources = UsesHTTP2Audit.determineNonHttp2Resources(networkRecords);
-
-    let displayValue;
-    if (resources.length > 0) {
-      displayValue = str_(UIStrings.displayValue, {itemCount: resources.length});
-    }
-
-    // TODO: Compute actual savings for timespan mode.
-    if (artifacts.GatherContext.gatherMode === 'timespan') {
-      /** @type {LH.Audit.Details.Table['headings']} */
-      const headings = [
-        {key: 'url', itemType: 'url', text: str_(i18n.UIStrings.columnURL)},
-        {key: 'protocol', itemType: 'text', text: str_(UIStrings.columnProtocol)},
-      ];
-
-      const details = Audit.makeTableDetails(headings, resources);
-
-      return {
-        displayValue,
-        score: resources.length ? 0 : 1,
-        details,
-      };
-    }
-
-    const settings = context?.settings || {};
-    const simulatorOptions = {
-      devtoolsLog,
-      settings,
-    };
-    const graph = await PageDependencyGraph.request({trace, devtoolsLog}, context);
-    const simulator = await LoadSimulator.request(simulatorOptions, context);
-    const wastedMs = UsesHTTP2Audit.computeWasteWithTTIGraph(resources, graph, simulator);
-
-    /** @type {LH.Audit.Details.Opportunity['headings']} */
-    const headings = [
-      {key: 'url', valueType: 'url', label: str_(i18n.UIStrings.columnURL)},
-      {key: 'protocol', valueType: 'text', label: str_(UIStrings.columnProtocol)},
-    ];
-
-    const details = Audit.makeOpportunityDetails(headings, resources, wastedMs);
-
-    return {
-      displayValue,
-      numericValue: wastedMs,
-      numericUnit: 'millisecond',
-      score: ByteEfficiencyAudit.scoreForWastedMs(wastedMs),
-      details,
-    };
-  }
-}
-
-module.exports = UsesHTTP2Audit;
-module.exports.UIStrings = UIStrings;