Add bin and edit workflow

bin/gems/html-proofer-5.0.10/lib/html_proofer/check/scripts.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module HTMLProofer
+  class Check
+    class Scripts < HTMLProofer::Check
+      def run
+        @html.css("script").each do |node|
+          @script = create_element(node)
+
+          next if @script.ignore?
+          next unless @script.content.strip.empty?
+
+          # does the script exist?
+          if missing_src?
+            add_failure("script is empty and has no src attribute", element: @script)
+          elsif @script.url.protocol_relative?
+            add_failure(
+              "script link #{@script.url} is a protocol-relative URL, use explicit https:// instead",
+              element: @script,
+            )
+          elsif @script.url.remote?
+            add_to_external_urls(@script.url, @script.line)
+            check_sri if @runner.check_sri?
+          elsif !@script.url.exists?
+            add_failure(
+              "internal script reference #{@script.src} does not exist",
+              element: @script,
+            )
+          end
+        end
+
+        external_urls
+      end
+
+      def missing_src?
+        @script.node["src"].nil?
+      end
+
+      def check_sri
+        if blank?(@script.node["integrity"]) && blank?(@script.node["crossorigin"])
+          add_failure(
+            "SRI and CORS not provided in: #{@script.url.raw_attribute}",
+            element: @script,
+          )
+        elsif blank?(@script.node["integrity"])
+          add_failure(
+            "Integrity is missing in: #{@script.url.raw_attribute}",
+            element: @script,
+          )
+        elsif blank?(@script.node["crossorigin"])
+          add_failure(
+            "CORS not provided for external resource in: #{@script.url.raw_attribute}",
+            element: @script,
+          )
+        end
+      end
+    end
+  end
+end