Initial commit

This commit is contained in:
Patrick Marsceill
2017-03-09 13:16:08 -05:00
commit b7b0d0d7bf
4147 changed files with 401224 additions and 0 deletions

View File

@@ -0,0 +1,67 @@
# function-url-scheme-whitelist
Specify a whitelist of allowed url schemes.
```css
a { background-image: url('http://www.example.com/file.jpg'); }
/** ↑
* This url scheme */
```
A [url scheme](https://url.spec.whatwg.org/#syntax-url-scheme) consists of alphanumeric, `+`, `-`, and `.` characters. It can appear at the start of a url and is followed by `:`.
This rule treats url schemes as case insensitive (`https` and `HTTPS` are the same).
This rule ignores url arguments without an existing url scheme.
This rule ignores url arguments with variables or variable interpolation (`$sass`, `@less`, `--custom-property`, `#{$var}`, `@{var}`, `$(var)`).
## Options
`array|string`: `["array", "of", "schemes"]|"scheme"`
Given:
```js
["https", "data"]
```
The following patterns are considered warnings:
```css
a { background-image: url('http://www.example.com/file.jpg'); }
```
```css
a { background-image: url('ftp://www.example.com/file.jpg'); }
```
The following patterns are *not* considered warnings:
```css
a { background-image: url('https://www.example.com/file.jpg'); }
```
```css
a { background-image: url('HTTPS://www.example.com/file.jpg'); }
```
```css
a { background-image: url('data:image/gif;base64,R0lGODlhAQABAIAAAAUEBAAAACwAAAAAAQABAAACAkQBADs='); }
```
```css
a { background-image: url('example.com/file.jpg'); }
```
```css
a { background-image: url('/example.com/file.jpg'); }
```
```css
a { background-image: url('//example.com/file.jpg'); }
```
```css
a { background-image: url('./path/to/file.jpg'); }
```

View File

@@ -0,0 +1,73 @@
"use strict"
const containsString = require("../../utils/containsString")
const functionArgumentsSearch = require("../../utils/functionArgumentsSearch")
const isStandardSyntaxUrl = require("../../utils/isStandardSyntaxUrl")
const report = require("../../utils/report")
const ruleMessages = require("../../utils/ruleMessages")
const validateOptions = require("../../utils/validateOptions")
const _ = require("lodash")
const parse = require("url").parse
const ruleName = "function-url-scheme-whitelist"
const messages = ruleMessages(ruleName, {
rejected: scheme => `Unexpected url scheme "${scheme}:"`,
})
const rule = function (whitelist) {
return (root, result) => {
const validOptions = validateOptions(result, ruleName, {
actual: whitelist,
possible: [_.isString],
})
if (!validOptions) {
return
}
root.walkDecls(function (decl) {
functionArgumentsSearch(decl.toString().toLowerCase(), "url", (args, index) => {
const unspacedUrlString = _.trim(args, " ")
if (!isStandardSyntaxUrl(unspacedUrlString)) {
return
}
const urlString = _.trim(unspacedUrlString, "'\"")
const url = parse(urlString)
if (url.protocol === null) {
return
}
const scheme = url.protocol.toLowerCase().slice(0, -1) // strip trailing `:`
// The URL spec does not require a scheme to be followed by `//`, but checking
// for it allows this rule to differentiate <scheme>:<hostname> urls from
// <hostname>:<port> urls. `data:` scheme urls are an exception to this rule.
const slashIndex = url.protocol.length
const expectedSlashes = urlString.slice(slashIndex, slashIndex + 2)
const isSchemeLessUrl = expectedSlashes !== "//" && scheme !== "data"
if (isSchemeLessUrl) {
return
}
const whitelistLowerCase = typeof whitelist === "string" ? whitelist.toLowerCase() : whitelist.join("|").toLowerCase().split("|")
if (containsString(scheme, whitelistLowerCase)) {
return
}
report({
message: messages.rejected(scheme),
node: decl,
index,
result,
ruleName,
})
})
})
}
}
rule.ruleName = ruleName
rule.messages = messages
module.exports = rule