feat(linter): add no base-uri rule

src/linter/rules.rs

@@ -3,6 +3,7 @@ use crate::linter::Rule;
 mod host_source_is_self;
 mod insecure_scheme;
 mod missing_source;
+mod no_base_uri;
 mod no_form_action;
 mod no_upgrade_insecure_requests;
 mod repeated_directive;
@@ -13,6 +14,7 @@ pub fn get_rules() -> Vec<Box<dyn Rule>> {
         Box::new(host_source_is_self::HostSourceIsSelf {}),
         Box::new(insecure_scheme::InsecureScheme {}),
         Box::new(missing_source::MissingSource {}),
+        Box::new(no_base_uri::NoBaseUri {}),
         Box::new(no_form_action::NoFormAction {}),
         Box::new(no_upgrade_insecure_requests::NoUpgradeInsecureRequests {}),
         Box::new(repeated_directive::RepeatedDirective {}),

src/linter/rules/no_base_uri.rs

@@ -0,0 +1,29 @@
+use crate::{
+    linter::{Node, Rule},
+    policy::DirectiveKind,
+    report::{Issue, Report, Severity},
+};
+
+pub struct NoBaseUri {}
+
+impl Rule for NoBaseUri {
+    fn check(&self, _origin: Option<String>, report: &mut Report, node: Node) {
+        let Node::Policy(policy) = node else {
+            return;
+        };
+
+        let has_base_uri = policy
+            .directives
+            .iter()
+            .any(|directive| directive.kind == DirectiveKind::BaseUri);
+
+        if !has_base_uri {
+            report.add_issue(
+                Issue::builder()
+                    .severity(Severity::High)
+                    .description("No 'base-uri' directive found. Either set it to 'none' if you don't need to use <base> or allow specific sources.".to_string())
+                    .build()
+            );
+        }
+    }
+}