Rule: Don't insert static CSS into the DOM

[joethei]

A common snippet I see in the plugin onload is something like this:

const styleSheet = document.createElement('link');
styleSheet.rel = 'stylesheet';
styleSheet.href = this.app.vault.adapter.getResourcePath(`${this.manifest.dir}/styles.css`);
document.head.appendChild(styleSheet);

Which makes no sense, since Obsidian already handles that, so it's probably generated by an LLM.

Or also, most often found in modals:

const style = document.createElement('style');
style.textContent = `Some CSS here`;
document.head.appendChild(style);

Both of these usually also have no cleanup function.

[saberzero1]

Do we want to flag any instance of style tag injection? Or allow it if accompanied with the associated cleanup function?

[joethei]

Any injection with static CSS.
Sometimes they inject variables into the CSS, which would be fine.

The missing cleanup function can be a separate rule that can be implemented later.