From c2f4737f9e306c98bd750f1360f9d6bd689d7ff4 Mon Sep 17 00:00:00 2001
From: vvvince <vvvince@ofcompute.rs>
Date: Mon, 15 Sep 2025 22:36:34 +0200
Subject: [PATCH] feat(linter): add no base-uri rule

---
 src/linter/rules.rs             |  2 ++
 src/linter/rules/no_base_uri.rs | 29 +++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+)
 create mode 100644 src/linter/rules/no_base_uri.rs

diff --git a/src/linter/rules.rs b/src/linter/rules.rs
index d9b054b..11e8771 100644
--- a/src/linter/rules.rs
+++ b/src/linter/rules.rs
@@ -3,6 +3,7 @@ use crate::linter::Rule;
 mod host_source_is_self;
 mod insecure_scheme;
 mod missing_source;
+mod no_base_uri;
 mod no_form_action;
 mod no_upgrade_insecure_requests;
 mod repeated_directive;
@@ -13,6 +14,7 @@ pub fn get_rules() -> Vec<Box<dyn Rule>> {
         Box::new(host_source_is_self::HostSourceIsSelf {}),
         Box::new(insecure_scheme::InsecureScheme {}),
         Box::new(missing_source::MissingSource {}),
+        Box::new(no_base_uri::NoBaseUri {}),
         Box::new(no_form_action::NoFormAction {}),
         Box::new(no_upgrade_insecure_requests::NoUpgradeInsecureRequests {}),
         Box::new(repeated_directive::RepeatedDirective {}),
diff --git a/src/linter/rules/no_base_uri.rs b/src/linter/rules/no_base_uri.rs
new file mode 100644
index 0000000..f61c31b
--- /dev/null
+++ b/src/linter/rules/no_base_uri.rs
@@ -0,0 +1,29 @@
+use crate::{
+    linter::{Node, Rule},
+    policy::DirectiveKind,
+    report::{Issue, Report, Severity},
+};
+
+pub struct NoBaseUri {}
+
+impl Rule for NoBaseUri {
+    fn check(&self, _origin: Option<String>, report: &mut Report, node: Node) {
+        let Node::Policy(policy) = node else {
+            return;
+        };
+
+        let has_base_uri = policy
+            .directives
+            .iter()
+            .any(|directive| directive.kind == DirectiveKind::BaseUri);
+
+        if !has_base_uri {
+            report.add_issue(
+                Issue::builder()
+                    .severity(Severity::High)
+                    .description("No 'base-uri' directive found. Either set it to 'none' if you don't need to use <base> or allow specific sources.".to_string())
+                    .build()
+            );
+        }
+    }
+}