abqari 1.2.0 → 1.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b9d5e9a272de668ea9e75b33d47fd252c9a46413c6873c15d077a938f3817004
-  data.tar.gz: 0d55679d1de17c940765b5a04c81e15980e1929a590fab878b36e65fdc877195
+  metadata.gz: 1e61ca715dce737000acb0b0f08033cb7dc92d469c0553481d3bbaf6aec1276a
+  data.tar.gz: 3e5bf6cae00b055c9a6bd66fed47217b3a2a32f7f5ddc299e1e92200b23b82ed
 SHA512:
-  metadata.gz: 27ecd3e0f352ce9970cd85256badd8973bcd950092fa67cd56de2f9820862eef89740b3995d8c3e7f692259a9f50d49da1d41e3a76d7912c0873d650b46d101a
-  data.tar.gz: 77b4d04a24911bf1705cb074ce4515bd130ee5db2340e1c988c81a5a707c54014bf5a62cc94ca1d83139747d7c87595a3c7c2607a79ae9b2f953c926b7f16d43
+  metadata.gz: 81e34727adb75ca47e012b73579158fd2a203bda6fe517a1d138b4cee563c4bb54d75926ed6597aa0df826861abe68cc7a36321c24701e3469b2cc4ec6854619
+  data.tar.gz: b9f6b8ecf943c8fa60048cf2e0bbe7a64b0b8e27592125d7b62bf47bb0eeee4d318b34583129220dd002b72e7bb6427808e79ec61d08b3316095a9553c7f0dbf

data/CHANGELOG.md

@@ -9,6 +9,69 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 _Nothing yet._
 
+## [1.3.1] — 2026-10-20
+
+Upgrade to correct CSP-audit parsing, HTML text extraction and importer
+escaping. This patch also removes the regex patterns flagged by CodeQL.
+
+### Changed
+
+- HTML5 parsing uses `nokolexbor`, one runtime dependency with no
+  transitive runtime gems. The clean-container CI matrix validates its
+  precompiled packages on Ruby 3.3, 3.4 and 4.0.
+- Workshop rendering tests keep an upcoming fixture in memory instead
+  of expiring when the example workshop dates pass.
+
+### Fixed
+
+- **CSP audits could miss browser-valid inline scripts and handlers.**
+  Regex parsing skipped whitespace in closing tags and unquoted
+  attributes, and could change script contents while removing comments.
+  HTML5 parsing now preserves browser hash input, decodes attributes
+  once and ignores inert template contents. Audit tests use the same
+  tag rules, including uppercase and comment edge cases.
+- **Excerpts and reading statistics now read HTML as HTML.** Quoted
+  delimiters, entities, comments and non-visible script/style/template
+  content are handled by a parser rather than a stripping regex.
+  Extracted text still requires normal template escaping.
+- **Imported titles retain quotes, backslashes and Unicode YAML line
+  breaks without changing the frontmatter structure.** Escaping is a
+  single literal-replacement pass, with round-trip regression coverage.
+- **HTML rewrites and CSS minification avoid overlapping whitespace
+  matches.** Image and bundle URL rewrites retain their output while
+  regex matching no longer needs to reconsider delimiter whitespace.
+
+## [1.3.0] — 2026-10-11
+
+If CI runs `bin/audit --strict`, run `bin/audit` locally before
+upgrading: a new Security check can fail an audit that passed on
+1.2.0. Every finding is inline code that is already blocked on any host
+that enforces the site's CSP, so the fix is in the site, not the
+policy.
+
+### Added
+
+- **`bin/audit` now fails on inline code the site's own CSP would
+  block.** The generated policy has `style-src 'self'` and pins inline
+  scripts by hash, so a template that adds `style="…"`, a `<style>`
+  block, an `onclick=`, or an unhashed `<script>` breaks on any host
+  that enforces the CSP. It hid because nothing local enforces it: the
+  dev server doesn't apply `_headers`, the page renders, and the
+  browser only logs a console error. One site had 52 inline
+  `style="--ratio: …"` attributes that would have collapsed every photo
+  pane the moment its CSP went live.
+
+  The new **Security** category (`Audit::Csp`) checks every page
+  against the CSP in the built `_headers`, so a `headers:` override or
+  `csp:` extension is what's checked. It reports one error per page per
+  kind of inline code, with an example and how to fix it. It follows
+  the spec: hashes, `'unsafe-inline'` (ignored once a hash or nonce is
+  present), `'unsafe-hashes'` for attributes, the `-elem`/`-attr`
+  directives and the `default-src` fallback. `bin/audit --strict` fails
+  on these, so a site that passed yesterday can fail today; every
+  finding is code that is already broken wherever the policy is
+  applied.
+
 ## [1.2.0] — 2026-10-11
 
 Upgrade if you serve the generated CSP: Chrome has been blocking
@@ -1110,7 +1173,9 @@ run a real working author / publisher site.
   commonmarker ≥ 2.4 ships precompiled 4.0 binaries, which is what
   the `~> 2.4` floor bought.
 
-[Unreleased]: https://github.com/grantrayner/abqari/compare/v1.2.0...HEAD
+[Unreleased]: https://github.com/grantrayner/abqari/compare/v1.3.1...HEAD
+[1.3.1]: https://github.com/grantrayner/abqari/compare/v1.3.0...v1.3.1
+[1.3.0]: https://github.com/grantrayner/abqari/compare/v1.2.0...v1.3.0
 [1.2.0]: https://github.com/grantrayner/abqari/compare/v1.1.2...v1.2.0
 [1.1.2]: https://github.com/grantrayner/abqari/compare/v1.1.1...v1.1.2
 [1.1.1]: https://github.com/grantrayner/abqari/compare/v1.1.0...v1.1.1

data/README.md

@@ -11,7 +11,7 @@ optional overrides), while the engine — layouts, themes, helpers, asset
 pipeline — lives in the dependency. Forking the engine is also
 supported for users who want to own all the code.
 
-> **Status:** v1.2.0 — see
+> **Status:** v1.3.1 — see
 > [CHANGELOG.md](https://github.com/grantrayner/abqari/blob/main/CHANGELOG.md).
 > Distributed via RubyGems (`gem install abqari`) and as a Bundler
 > path/git source. The API follows [semver](https://semver.org/) from
@@ -38,10 +38,12 @@ Reporting a vulnerability:
 
 ## Design principles
 
-1. **Minimal dependencies.** Seven small runtime gems — three
-   (`commonmarker`, `erubi`, `ruby-vips`) do the work on every build;
-   the rest cover syntax highlighting, the dev server, and CSV/Base64
-   handling. Content importing needs one more (`reverse_markdown`),
+1. **Minimal dependencies.** Eight runtime gems cover Markdown,
+   auto-escaped templates, images, HTML5 parsing, syntax highlighting,
+   the dev server, and CSV/Base64 handling. `nokolexbor` reads HTML for
+   CSP audits and text extraction, with no transitive runtime dependencies
+   and precompiled packages for the supported desktop/Linux platforms.
+   Content importing needs one more (`reverse_markdown`),
    deliberately left out of the runtime set so a normal install doesn't
    pull in nokogiri for a feature it never uses.
 2. **Ruby-first.** ERB templates, real Ruby in views.
@@ -174,7 +176,7 @@ Test that it worked:
 abqari version
 ```
 
-You should see a version number, e.g. `abqari 1.2.0`. If you get
+You should see a version number, e.g. `abqari 1.3.1`. If you get
 `command not found`, see [Troubleshooting](#troubleshooting) below.
 
 ### Step 3 — Create your first site
@@ -460,7 +462,7 @@ Edit `Gemfile`:
 ```ruby
 source 'https://rubygems.org'
 
-gem 'abqari', '~> 1.2'
+gem 'abqari', '~> 1.3'
 
 group :development do
   gem 'listen', '~> 3.8'    # optional, for the dev-server file watcher
@@ -470,7 +472,7 @@ end
 Or — pin to a git ref while tracking pre-release work:
 
 ```ruby
-gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.2.0'
+gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.3.1'
 ```
 
 Install the libvips C library once (hard dep for the image pipeline):
@@ -947,6 +949,11 @@ and on `Abqari::RenderContext`, available everywhere ERB runs.
 | `reading_time(text, wpm:)` | `reading_time(post.body)` → `"4 min read"` |
 | `slugify(text)` | `slugify('Hello World!')` → `"hello-world"` |
 
+`excerpt`, `word_count` and `reading_time` parse HTML and decode entities;
+comments and script/style/template contents do not count as visible text.
+An excerpt is plain text, not sanitized HTML. Render it with `<%= excerpt(...) %>`
+so template auto-escaping remains in force.
+
 **Time**
 
 | Helper | Example |
@@ -2331,6 +2338,7 @@ Rebuilds the site, walks the output, and writes a markdown report to `audit/<YYY
 | **Privacy** | External resource loads (URLs not on the site host) |
 | **Dependencies** | Outdated gems via `bundle outdated`, CVEs via `bundle-audit` (if installed) |
 | **Content** | Posts without descriptions, single-use tags, `series_position` problems that break prev/next silently (non-Integer, duplicate, or missing) |
+| **Security** | Inline code the built `_headers` CSP would block: `style="…"` attributes, `<style>` blocks, `on…=` handlers, and inline scripts whose hash isn't in `script-src`. Errors, because the page breaks on any host that enforces the policy |
 
 The report opens with a summary table, a **Suggested fixes** code block listing every `bundle update <gem>` command needed to clear the dependency findings, and then groups findings by category with severity (`error`, `warn`, `info`) and a suggestion where applicable. Reports accumulate in `audit/` — useful to commit so you have a diffable history of site quality over time.
 
@@ -2365,7 +2373,7 @@ GitHub Dependabot does three things abqari's audit does **not**:
 
 What `bin/audit` does that Dependabot doesn't:
 
-- **Same report covers links, SEO, accessibility, privacy, and content.** Dependabot only watches dependencies.
+- **Same report covers links, SEO, accessibility, privacy, content, and the CSP.** Dependabot only watches dependencies.
 - **Uses the same `ruby-advisory-db`** Dependabot's Ruby ecosystem coverage uses, just at a single point in time.
 - **Outputs to git-trackable markdown.** A diffable `audit/` history of every check you've run.
 
@@ -2558,14 +2566,14 @@ bin/audit                  # verify nothing regressed
 ```
 
 `abqari new` scaffolds the Gemfile pinned to the current major.minor
-(`gem 'abqari', '~> 1.2'` as of this release). Bundler reads that as
-`>= 1.2, < 2.0`, so `bundle update abqari` takes minor and patch
+(`gem 'abqari', '~> 1.3'` as of this release). Bundler reads that as
+`>= 1.3, < 2.0`, so `bundle update abqari` takes minor and patch
 releases but never a major one, which is the release that can need
 changes to your site. To track a fork or an unreleased branch
 instead, swap the line for a git source:
 
 ```ruby
-gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.2.0'
+gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.3.1'
 ```
 
 The cadence: read [CHANGELOG.md](https://github.com/grantrayner/abqari/blob/main/CHANGELOG.md) before each upgrade,

data/lib/abqari/audit/csp.rb

@@ -0,0 +1,173 @@
+# frozen_string_literal: true
+
+require 'base64'
+require 'digest'
+require_relative '../html'
+
+module Abqari
+  class Audit
+    # CSP rule. Checks every page's inline code against the
+    # Content-Security-Policy the same build wrote to `_headers`: inline
+    # `<script>` and `<style>` blocks, `style="…"` attributes and `on…=`
+    # event handlers.
+    #
+    # The policy is strict on purpose (`style-src 'self'`, scripts pinned
+    # by hash), so anything a template adds inline is blocked wherever
+    # the CSP is enforced — and nothing else notices. The dev server
+    # doesn't apply `_headers`, the page still renders, and the browser
+    # only logs a console error. One site carried 52 inline
+    # `style="--ratio: …"` attributes that would have collapsed every
+    # photo pane, and the engine's own speculation-rules block shipped in
+    # 1.1.x allowed only by a keyword Chrome ignores.
+    #
+    # Reads the BUILT `_headers`, not the engine's defaults, so a
+    # `headers:` override or `csp:` extension in site.yml is what gets
+    # checked. Error-severity: on a host that enforces the policy the
+    # page is broken. A site on a host that ignores `_headers` (GitHub
+    # Pages) will see these too; the code is still blocked the day the
+    # policy is applied.
+    class Csp < Rule
+      # Script types the browser executes, so CSP governs them. Any other
+      # `type` is a data block (JSON-LD, templates) and CSP ignores it.
+      EXECUTABLE_TYPES = %w[
+        text/javascript application/javascript application/ecmascript text/ecmascript
+        module importmap speculationrules
+      ].freeze
+      HASH_ALGORITHMS = { 'sha256' => Digest::SHA256, 'sha384' => Digest::SHA384, 'sha512' => Digest::SHA512 }.freeze
+
+      # Most specific directive first, as browsers resolve them.
+      DIRECTIVES = {
+        script:     %w[script-src-elem script-src default-src],
+        script_attr: %w[script-src-attr script-src default-src],
+        style:      %w[style-src-elem style-src default-src],
+        style_attr: %w[style-src-attr style-src default-src]
+      }.freeze
+
+      LABELS = {
+        script:      'inline <script>',
+        script_attr: 'inline event handler',
+        style:       '<style> block',
+        style_attr:  'style attribute'
+      }.freeze
+
+      ADVICE = {
+        script:      'Move it to a file under app/assets/js/, or add its sha256 to the CSP. ' \
+                     'For the engine\'s own scripts, upgrade abqari and re-copy the CSP.',
+        script_attr: 'Attach the handler from a script file with addEventListener instead.',
+        style:       'Move the rules into app/assets/css/site.css.',
+        style_attr:  'Move the styles into app/assets/css/site.css as a class, or a data ' \
+                     'attribute matched by an attribute selector for per-element values.'
+      }.freeze
+
+      def run
+        policies = csp_policies
+        return if policies.empty?
+
+        html_files.each do |file|
+          url = page_url(file)
+          applicable = policies.select { |prefix, _| url.start_with?(prefix) }.map(&:last)
+          next if applicable.empty?
+
+          check_page(url, File.read(file, encoding: 'UTF-8'), applicable)
+        end
+      end
+
+      private
+
+      # `[[path_prefix, { directive => [sources] }]]` for every CSP rule in
+      # the built `_headers`. More than one can apply to a page; the
+      # browser enforces all of them, so inline code has to pass each.
+      def csp_policies
+        path = File.join(@site.output_dir, '_headers')
+        return [] unless File.file?(path)
+
+        HeadersFile.parse(File.read(path, encoding: 'UTF-8'))
+                   .select { |rule| rule['name'].casecmp?('Content-Security-Policy') }
+                   .map { |rule| [rule['path'].delete_suffix('*'), parse_policy(rule['value'])] }
+      end
+
+      def parse_policy(value)
+        value.split(';').each_with_object({}) do |directive, policy|
+          name, *sources = directive.strip.split(/\s+/)
+          policy[name.downcase] = sources if name
+        end
+      end
+
+      def check_page(url, html, policies)
+        blocked = Hash.new { |h, k| h[k] = [] }
+        inline_code(html).each do |kind, content, type|
+          policy = policies.find { |pol| !allowed?(pol, kind, content, type) }
+          blocked[kind] << [content, policy] if policy
+        end
+
+        blocked.each do |kind, hits|
+          content, policy = hits.first
+          directive = DIRECTIVES[kind].find { |d| policy.key?(d) }
+          count = hits.size
+          add(category: 'security', severity: 'error', location: url,
+              message: "#{count} #{LABELS[kind]}#{'s' unless count == 1} blocked by the CSP " \
+                       "(#{directive} #{policy[directive].join(' ')}), e.g. #{example(kind, content)}",
+              suggestion: ADVICE[kind])
+        end
+      end
+
+      # Each piece of inline code as `[kind, content, script_type]`, where
+      # content is exactly what the browser hashes.
+      def inline_code(html)
+        code = []
+        Html.document(html).css('*').each do |node|
+          next if node.ancestors.any? { |parent| parent.name == 'template' }
+
+          if node.name == 'script' && !node.key?('src')
+            type = node['type']&.strip&.downcase
+            if type.nil? || type.empty? || EXECUTABLE_TYPES.include?(type)
+              code << [:script, node.content, type]
+            end
+          elsif node.name == 'style'
+            code << [:style, node.content]
+          end
+
+          # The parser already decodes attributes once, as the browser
+          # does. Decoding again changes the bytes used for CSP hashes.
+          node.attributes.each do |name, attribute|
+            next unless name == 'style' || name.match?(/\Aon[a-z]+\z/)
+
+            code << [name == 'style' ? :style_attr : :script_attr, attribute.value]
+          end
+        end
+        code
+      end
+
+      # Mirrors the CSP spec's inline checks: a hash or nonce in the list
+      # switches `'unsafe-inline'` off; attribute hashes count only with
+      # `'unsafe-hashes'`. `'inline-speculation-rules'` is honoured only
+      # when the list has no hash or nonce: Chrome reports a block allowed
+      # by nothing but the keyword as a violation once hashes are present.
+      def allowed?(policy, kind, content, type = nil)
+        directive = DIRECTIVES[kind].find { |d| policy.key?(d) }
+        return true unless directive
+
+        sources = policy[directive]
+        hashed = sources.any? { |s| s.match?(/\A'(sha256|sha384|sha512|nonce)-/i) }
+        hashed ||= kind == :script && sources.include?("'strict-dynamic'")
+        return true if sources.include?("'unsafe-inline'") && !hashed
+        return true if type == 'speculationrules' && sources.include?("'inline-speculation-rules'") && !hashed
+        return false if %i[style_attr script_attr].include?(kind) && !sources.include?("'unsafe-hashes'")
+
+        HASH_ALGORITHMS.any? do |alg, digest|
+          sources.include?("'#{alg}-#{Base64.strict_encode64(digest.digest(content))}'")
+        end
+      end
+
+      def example(kind, content)
+        snippet = content.strip.gsub(/\s+/, ' ')
+        snippet = "#{snippet[0, 60]}…" if snippet.length > 60
+        case kind
+        when :style_attr  then %(style="#{snippet}")
+        when :script_attr then %(handler "#{snippet}")
+        else %(`#{snippet}`)
+        end
+      end
+    end
+  end
+end

data/lib/abqari/audit.rb

@@ -12,6 +12,7 @@ require_relative 'audit/privacy'
 require_relative 'audit/performance'
 require_relative 'audit/dependencies'
 require_relative 'audit/content'
+require_relative 'audit/csp'
 
 module Abqari
   # Site audit orchestrator. Each check lives in its own rule class
@@ -36,14 +37,15 @@ module Abqari
       'privacy' => 'Privacy',
       'perf'    => 'Performance',
       'deps'    => 'Dependencies',
-      'content' => 'Content'
+      'content' => 'Content',
+      'security' => 'Security'
     }.freeze
 
     # Rule classes, in execution order. Order matters only for the
     # output report — findings are grouped by category, not insertion
     # order — but Links first keeps the report scan-friendly: errors
     # appear before warnings.
-    RULES = [Links, SEO, A11y, Privacy, Performance, Dependencies, Content].freeze
+    RULES = [Links, SEO, A11y, Privacy, Performance, Dependencies, Content, Csp].freeze
 
     attr_reader :findings
 

data/lib/abqari/cli/headers.rb

@@ -47,21 +47,8 @@ module Abqari
         true
       end
 
-      # `_headers` blocks: an unindented path line, then indented
-      # `Name: value` lines. Same shape HeadersFile writes, for both the
-      # generated policy and a `headers:` override in site.yml.
       def parse(text)
-        path = nil
-        text.each_line.with_object([]) do |line, rules|
-          next if line.strip.empty? || line.lstrip.start_with?('#')
-
-          if line.match?(/\A\S/)
-            path = line.strip
-          elsif path
-            name, value = line.strip.split(/:\s*/, 2)
-            rules << { 'path' => path, 'name' => name, 'value' => value.to_s } unless name.to_s.empty?
-          end
-        end
+        HeadersFile.parse(text)
       end
 
       private

data/lib/abqari/headers_file.rb

@@ -31,6 +31,24 @@ module Abqari
       'Strict-Transport-Security' => 'max-age=31536000; includeSubDomains'
     }.freeze
 
+    # A `_headers` file as `{ 'path', 'name', 'value' }` rules: an
+    # unindented path line, then indented `Name: value` lines. The shape
+    # `build` writes, for both the generated policy and a `headers:`
+    # override. Read back by `abqari headers` and the CSP audit.
+    def self.parse(text)
+      path = nil
+      text.each_line.with_object([]) do |line, rules|
+        next if line.strip.empty? || line.lstrip.start_with?('#')
+
+        if line.match?(/\A\S/)
+          path = line.strip
+        elsif path
+          name, value = line.strip.split(/:\s*/, 2)
+          rules << { 'path' => path, 'name' => name, 'value' => value.to_s } unless name.to_s.empty?
+        end
+      end
+    end
+
     def initialize(site)
       @site = site
     end

data/lib/abqari/helpers.rb

@@ -5,6 +5,7 @@ require 'date'
 require 'json'
 require 'time'
 require 'uri'
+require_relative 'html'
 
 module Abqari
   module Helpers
@@ -161,7 +162,7 @@ end
     # `data-heading-content`, so each heading silently added several
     # phantom "words" to the structured data search engines read.
     def word_count(text)
-      text.to_s.gsub(/<[^>]+>/, ' ').scan(/\S+/).length
+      Html.text(text, separator: ' ').scan(/\S+/).length
     end
 
     # Format a date or time. Default format is "1 January 2026"
@@ -224,7 +225,7 @@ end
     end
 
     def excerpt(text, words: 50, omission: '…')
-      stripped = text.to_s.gsub(/<[^>]+>/, '').strip
+      stripped = Html.text(text).strip
       arr = stripped.split(/\s+/)
       return stripped if arr.length <= words
 
@@ -232,7 +233,7 @@ end
     end
 
     def reading_time(text, wpm: 200)
-      stripped = text.to_s.gsub(/<[^>]+>/, '')
+      stripped = Html.text(text)
       word_count = stripped.split(/\s+/).length
       # Clamp wpm to ≥1 (a `wpm: 0` would divide to Infinity → FloatDomainError)
       # and the result to ≥1 minute (empty text shouldn't read "0 min read").

data/lib/abqari/html.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require 'nokolexbor'
+
+module Abqari
+  # HTML must be read with the same tag, comment and attribute rules as
+  # the browser. Regex stripping can change script hash input or hide an
+  # executable tag. Lexbor also keeps this work out of Ruby's regex engine.
+  module Html
+    module_function
+
+    def document(html)
+      Nokolexbor::HTML(html.to_s)
+    end
+
+    def fragment(html)
+      Nokolexbor::DocumentFragment.parse(html.to_s)
+    end
+
+    # Plain text, never trusted HTML. Callers must still escape it when
+    # rendering (the normal <%= interpolation does this automatically).
+    # Non-visible code and comments must not inflate reading estimates.
+    def text(html, separator: '')
+      tree = fragment(html)
+      tree.css('script, style, template').each(&:remove)
+      tree.xpath('.//text()').map(&:content).join(separator)
+    end
+  end
+end

data/lib/abqari/image_pipeline.rb

@@ -173,7 +173,9 @@ module Abqari
     def post_process_html(html, page: nil)
       return html unless enabled?
 
-      html.gsub(/<img\s+([^>]*?)>/m) do |match|
+      # Whitespace belongs to the delimiter, not to the attributes.
+      # Possessive quantifiers prevent overlapping backtracking paths.
+      html.gsub(/<img\s++([^>]*+)>/m) do |match|
         attrs = ::Regexp.last_match(1)
         src = attrs[/src="([^"]+)"/, 1]
         next match unless src

data/lib/abqari/importers/base.rb

@@ -285,7 +285,7 @@ module Abqari
         # been written straight through, turning one mapping entry into
         # two. Importer input is a third-party export, so this is
         # attacker-shaped. Escape them into their YAML forms instead.
-        if str.match?(/[\x00-\x1F\x7F]/)
+        if str.match?(/[\u0000-\u001F\u007F-\u009F\u2028\u2029]/)
           return %("#{escape_yaml_double_quoted(str)}")
         end
 
@@ -301,13 +301,18 @@ module Abqari
       # quotes, then the control characters that have named escapes,
       # then anything else remaining as \uXXXX.
       def escape_yaml_double_quoted(str)
-        str
-          .gsub('\\', '\\\\\\\\')
-          .gsub('"', '\\"')
-          .gsub("\n", '\\n')
-          .gsub("\r", '\\r')
-          .gsub("\t", '\\t')
-          .gsub(/[\x00-\x1F\x7F]/) { |c| format('\\u%04X', c.ord) }
+        # A block returns literal replacement bytes: String#gsub's
+        # replacement-string backslash rules cannot reinterpret them.
+        str.gsub(/[\\"\u0000-\u001F\u007F-\u009F\u2028\u2029]/) do |char|
+          case char
+          when '\\' then '\\\\'
+          when '"'  then '\\"'
+          when "\n" then '\\n'
+          when "\r" then '\\r'
+          when "\t" then '\\t'
+          else format('\\u%04X', char.ord)
+          end
+        end
       end
 
       def block_array(key, items)

data/lib/abqari/minifier.rb

@@ -121,7 +121,8 @@ module Abqari
 
       minified = stripped
                  .gsub(/\s+/, ' ')
-                 .gsub(/\s*([{};,>])\s*/, '\1')
+                 # The previous pass leaves at most one ASCII space.
+                 .gsub(/ ?([{};,>]) ?/, '\1')
                  .gsub(';}', '}')
       minified = trim(minified)
 

data/lib/abqari/renderer.rb

@@ -810,7 +810,7 @@ module Abqari
     def rewrite_bundle_urls(html, page)
       base = page.url
 
-      html.gsub(/(<(?:img|a)\s+[^>]*?(?:src|href)=")([^"]+)/) do
+      html.gsub(/(<(?:img|a)\s++[^>]*?(?:src|href)=")([^"]+)/) do
         prefix = ::Regexp.last_match(1)
         url    = ::Regexp.last_match(2)
 

data/lib/abqari/version.rb

@@ -14,5 +14,5 @@
 #
 # Keep this file dependency-free.
 module Abqari
-  VERSION = '1.2.0'
+  VERSION = '1.3.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: abqari
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.3.1
 platform: ruby
 authors:
 - Grant Rayner
@@ -65,6 +65,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.13'
+- !ruby/object:Gem::Dependency
+  name: nokolexbor
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.8.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.8.0
 - !ruby/object:Gem::Dependency
   name: rouge
   requirement: !ruby/object:Gem::Requirement
@@ -220,6 +234,7 @@ files:
 - lib/abqari/audit.rb
 - lib/abqari/audit/a11y.rb
 - lib/abqari/audit/content.rb
+- lib/abqari/audit/csp.rb
 - lib/abqari/audit/dependencies.rb
 - lib/abqari/audit/links.rb
 - lib/abqari/audit/performance.rb
@@ -238,6 +253,7 @@ files:
 - lib/abqari/headers_file.rb
 - lib/abqari/helpers.rb
 - lib/abqari/hooks.rb
+- lib/abqari/html.rb
 - lib/abqari/http_safe.rb
 - lib/abqari/image_pipeline.rb
 - lib/abqari/importers.rb