abqari 1.3.0 → 1.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ac44a7f76fcb30cb218104f9e002a0cd958518542912393d7681fceab92abdf0
-  data.tar.gz: 8a0cc5fe35425ca6571dbc76549df5105106bf8ff672f67ea9101c26e48af550
+  metadata.gz: 1e61ca715dce737000acb0b0f08033cb7dc92d469c0553481d3bbaf6aec1276a
+  data.tar.gz: 3e5bf6cae00b055c9a6bd66fed47217b3a2a32f7f5ddc299e1e92200b23b82ed
 SHA512:
-  metadata.gz: 9050a56ac582b3cdb3f4590bf90f6543ee57fa0dd6e1c4b56afc7274a937dfbb805400869d157473019af1a9802da7e88af97e30961f436cbed8a2472f2bb6cb
-  data.tar.gz: db4d7cb9c339676e76cc794b8e205fb0000d50266d8b28ae6a53770b7d701a44fd3664d3f3d2076e3fc78cd2f08745ab442a4abd85a5bcbdbb0ef14586a8f26b
+  metadata.gz: 81e34727adb75ca47e012b73579158fd2a203bda6fe517a1d138b4cee563c4bb54d75926ed6597aa0df826861abe68cc7a36321c24701e3469b2cc4ec6854619
+  data.tar.gz: b9f6b8ecf943c8fa60048cf2e0bbe7a64b0b8e27592125d7b62bf47bb0eeee4d318b34583129220dd002b72e7bb6427808e79ec61d08b3316095a9553c7f0dbf

data/CHANGELOG.md

@@ -9,6 +9,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 _Nothing yet._
 
+## [1.3.1] — 2026-10-20
+
+Upgrade to correct CSP-audit parsing, HTML text extraction and importer
+escaping. This patch also removes the regex patterns flagged by CodeQL.
+
+### Changed
+
+- HTML5 parsing uses `nokolexbor`, one runtime dependency with no
+  transitive runtime gems. The clean-container CI matrix validates its
+  precompiled packages on Ruby 3.3, 3.4 and 4.0.
+- Workshop rendering tests keep an upcoming fixture in memory instead
+  of expiring when the example workshop dates pass.
+
+### Fixed
+
+- **CSP audits could miss browser-valid inline scripts and handlers.**
+  Regex parsing skipped whitespace in closing tags and unquoted
+  attributes, and could change script contents while removing comments.
+  HTML5 parsing now preserves browser hash input, decodes attributes
+  once and ignores inert template contents. Audit tests use the same
+  tag rules, including uppercase and comment edge cases.
+- **Excerpts and reading statistics now read HTML as HTML.** Quoted
+  delimiters, entities, comments and non-visible script/style/template
+  content are handled by a parser rather than a stripping regex.
+  Extracted text still requires normal template escaping.
+- **Imported titles retain quotes, backslashes and Unicode YAML line
+  breaks without changing the frontmatter structure.** Escaping is a
+  single literal-replacement pass, with round-trip regression coverage.
+- **HTML rewrites and CSS minification avoid overlapping whitespace
+  matches.** Image and bundle URL rewrites retain their output while
+  regex matching no longer needs to reconsider delimiter whitespace.
+
 ## [1.3.0] — 2026-10-11
 
 If CI runs `bin/audit --strict`, run `bin/audit` locally before
@@ -1141,7 +1173,8 @@ run a real working author / publisher site.
   commonmarker ≥ 2.4 ships precompiled 4.0 binaries, which is what
   the `~> 2.4` floor bought.
 
-[Unreleased]: https://github.com/grantrayner/abqari/compare/v1.3.0...HEAD
+[Unreleased]: https://github.com/grantrayner/abqari/compare/v1.3.1...HEAD
+[1.3.1]: https://github.com/grantrayner/abqari/compare/v1.3.0...v1.3.1
 [1.3.0]: https://github.com/grantrayner/abqari/compare/v1.2.0...v1.3.0
 [1.2.0]: https://github.com/grantrayner/abqari/compare/v1.1.2...v1.2.0
 [1.1.2]: https://github.com/grantrayner/abqari/compare/v1.1.1...v1.1.2

data/README.md

@@ -11,7 +11,7 @@ optional overrides), while the engine — layouts, themes, helpers, asset
 pipeline — lives in the dependency. Forking the engine is also
 supported for users who want to own all the code.
 
-> **Status:** v1.3.0 — see
+> **Status:** v1.3.1 — see
 > [CHANGELOG.md](https://github.com/grantrayner/abqari/blob/main/CHANGELOG.md).
 > Distributed via RubyGems (`gem install abqari`) and as a Bundler
 > path/git source. The API follows [semver](https://semver.org/) from
@@ -38,10 +38,12 @@ Reporting a vulnerability:
 
 ## Design principles
 
-1. **Minimal dependencies.** Seven small runtime gems — three
-   (`commonmarker`, `erubi`, `ruby-vips`) do the work on every build;
-   the rest cover syntax highlighting, the dev server, and CSV/Base64
-   handling. Content importing needs one more (`reverse_markdown`),
+1. **Minimal dependencies.** Eight runtime gems cover Markdown,
+   auto-escaped templates, images, HTML5 parsing, syntax highlighting,
+   the dev server, and CSV/Base64 handling. `nokolexbor` reads HTML for
+   CSP audits and text extraction, with no transitive runtime dependencies
+   and precompiled packages for the supported desktop/Linux platforms.
+   Content importing needs one more (`reverse_markdown`),
    deliberately left out of the runtime set so a normal install doesn't
    pull in nokogiri for a feature it never uses.
 2. **Ruby-first.** ERB templates, real Ruby in views.
@@ -174,7 +176,7 @@ Test that it worked:
 abqari version
 ```
 
-You should see a version number, e.g. `abqari 1.3.0`. If you get
+You should see a version number, e.g. `abqari 1.3.1`. If you get
 `command not found`, see [Troubleshooting](#troubleshooting) below.
 
 ### Step 3 — Create your first site
@@ -470,7 +472,7 @@ end
 Or — pin to a git ref while tracking pre-release work:
 
 ```ruby
-gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.3.0'
+gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.3.1'
 ```
 
 Install the libvips C library once (hard dep for the image pipeline):
@@ -947,6 +949,11 @@ and on `Abqari::RenderContext`, available everywhere ERB runs.
 | `reading_time(text, wpm:)` | `reading_time(post.body)` → `"4 min read"` |
 | `slugify(text)` | `slugify('Hello World!')` → `"hello-world"` |
 
+`excerpt`, `word_count` and `reading_time` parse HTML and decode entities;
+comments and script/style/template contents do not count as visible text.
+An excerpt is plain text, not sanitized HTML. Render it with `<%= excerpt(...) %>`
+so template auto-escaping remains in force.
+
 **Time**
 
 | Helper | Example |
@@ -2566,7 +2573,7 @@ changes to your site. To track a fork or an unreleased branch
 instead, swap the line for a git source:
 
 ```ruby
-gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.3.0'
+gem 'abqari', git: 'https://github.com/grantrayner/abqari.git', tag: 'v1.3.1'
 ```
 
 The cadence: read [CHANGELOG.md](https://github.com/grantrayner/abqari/blob/main/CHANGELOG.md) before each upgrade,

data/lib/abqari/audit/csp.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
 require 'base64'
-require 'cgi'
 require 'digest'
+require_relative '../html'
 
 module Abqari
   class Audit
@@ -114,35 +114,30 @@ module Abqari
       # Each piece of inline code as `[kind, content, script_type]`, where
       # content is exactly what the browser hashes.
       def inline_code(html)
-        html = html.gsub(/<!--.*?-->/m, '')
         code = []
+        Html.document(html).css('*').each do |node|
+          next if node.ancestors.any? { |parent| parent.name == 'template' }
+
+          if node.name == 'script' && !node.key?('src')
+            type = node['type']&.strip&.downcase
+            if type.nil? || type.empty? || EXECUTABLE_TYPES.include?(type)
+              code << [:script, node.content, type]
+            end
+          elsif node.name == 'style'
+            code << [:style, node.content]
+          end
 
-        html.scan(%r{<script\b([^>]*)>(.*?)</script>}mi).each do |attrs, body|
-          next if attribute(attrs, 'src')
-
-          type = attribute(attrs, 'type')&.strip&.downcase
-          next unless type.nil? || type.empty? || EXECUTABLE_TYPES.include?(type)
+          # The parser already decodes attributes once, as the browser
+          # does. Decoding again changes the bytes used for CSP hashes.
+          node.attributes.each do |name, attribute|
+            next unless name == 'style' || name.match?(/\Aon[a-z]+\z/)
 
-          code << [:script, body, type]
-        end
-        html.scan(%r{<style\b[^>]*>(.*?)</style>}mi).each { |(body)| code << [:style, body] }
-
-        # Attributes, with script and style bodies removed first so a
-        # string inside a script that looks like markup isn't counted.
-        tags_only = html.gsub(%r{<(script|style)\b[^>]*>.*?</\1>}mi, '')
-        tags_only.scan(/<[a-zA-Z][^>]*>/).each do |tag|
-          tag.scan(/\s(on[a-z]+|style)\s*=\s*(?:"([^"]*)"|'([^']*)')/i).each do |name, dq, sq|
-            code << [name.casecmp?('style') ? :style_attr : :script_attr, CGI.unescapeHTML(dq || sq)]
+            code << [name == 'style' ? :style_attr : :script_attr, attribute.value]
           end
         end
         code
       end
 
-      def attribute(attrs, name)
-        match = attrs.match(/\b#{name}\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/i)
-        match && (match[1] || match[2] || match[3])
-      end
-
       # Mirrors the CSP spec's inline checks: a hash or nonce in the list
       # switches `'unsafe-inline'` off; attribute hashes count only with
       # `'unsafe-hashes'`. `'inline-speculation-rules'` is honoured only

data/lib/abqari/helpers.rb

@@ -5,6 +5,7 @@ require 'date'
 require 'json'
 require 'time'
 require 'uri'
+require_relative 'html'
 
 module Abqari
   module Helpers
@@ -161,7 +162,7 @@ end
     # `data-heading-content`, so each heading silently added several
     # phantom "words" to the structured data search engines read.
     def word_count(text)
-      text.to_s.gsub(/<[^>]+>/, ' ').scan(/\S+/).length
+      Html.text(text, separator: ' ').scan(/\S+/).length
     end
 
     # Format a date or time. Default format is "1 January 2026"
@@ -224,7 +225,7 @@ end
     end
 
     def excerpt(text, words: 50, omission: '…')
-      stripped = text.to_s.gsub(/<[^>]+>/, '').strip
+      stripped = Html.text(text).strip
       arr = stripped.split(/\s+/)
       return stripped if arr.length <= words
 
@@ -232,7 +233,7 @@ end
     end
 
     def reading_time(text, wpm: 200)
-      stripped = text.to_s.gsub(/<[^>]+>/, '')
+      stripped = Html.text(text)
       word_count = stripped.split(/\s+/).length
       # Clamp wpm to ≥1 (a `wpm: 0` would divide to Infinity → FloatDomainError)
       # and the result to ≥1 minute (empty text shouldn't read "0 min read").

data/lib/abqari/html.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require 'nokolexbor'
+
+module Abqari
+  # HTML must be read with the same tag, comment and attribute rules as
+  # the browser. Regex stripping can change script hash input or hide an
+  # executable tag. Lexbor also keeps this work out of Ruby's regex engine.
+  module Html
+    module_function
+
+    def document(html)
+      Nokolexbor::HTML(html.to_s)
+    end
+
+    def fragment(html)
+      Nokolexbor::DocumentFragment.parse(html.to_s)
+    end
+
+    # Plain text, never trusted HTML. Callers must still escape it when
+    # rendering (the normal <%= interpolation does this automatically).
+    # Non-visible code and comments must not inflate reading estimates.
+    def text(html, separator: '')
+      tree = fragment(html)
+      tree.css('script, style, template').each(&:remove)
+      tree.xpath('.//text()').map(&:content).join(separator)
+    end
+  end
+end

data/lib/abqari/image_pipeline.rb

@@ -173,7 +173,9 @@ module Abqari
     def post_process_html(html, page: nil)
       return html unless enabled?
 
-      html.gsub(/<img\s+([^>]*?)>/m) do |match|
+      # Whitespace belongs to the delimiter, not to the attributes.
+      # Possessive quantifiers prevent overlapping backtracking paths.
+      html.gsub(/<img\s++([^>]*+)>/m) do |match|
         attrs = ::Regexp.last_match(1)
         src = attrs[/src="([^"]+)"/, 1]
         next match unless src

data/lib/abqari/importers/base.rb

@@ -285,7 +285,7 @@ module Abqari
         # been written straight through, turning one mapping entry into
         # two. Importer input is a third-party export, so this is
         # attacker-shaped. Escape them into their YAML forms instead.
-        if str.match?(/[\x00-\x1F\x7F]/)
+        if str.match?(/[\u0000-\u001F\u007F-\u009F\u2028\u2029]/)
           return %("#{escape_yaml_double_quoted(str)}")
         end
 
@@ -301,13 +301,18 @@ module Abqari
       # quotes, then the control characters that have named escapes,
       # then anything else remaining as \uXXXX.
       def escape_yaml_double_quoted(str)
-        str
-          .gsub('\\', '\\\\\\\\')
-          .gsub('"', '\\"')
-          .gsub("\n", '\\n')
-          .gsub("\r", '\\r')
-          .gsub("\t", '\\t')
-          .gsub(/[\x00-\x1F\x7F]/) { |c| format('\\u%04X', c.ord) }
+        # A block returns literal replacement bytes: String#gsub's
+        # replacement-string backslash rules cannot reinterpret them.
+        str.gsub(/[\\"\u0000-\u001F\u007F-\u009F\u2028\u2029]/) do |char|
+          case char
+          when '\\' then '\\\\'
+          when '"'  then '\\"'
+          when "\n" then '\\n'
+          when "\r" then '\\r'
+          when "\t" then '\\t'
+          else format('\\u%04X', char.ord)
+          end
+        end
       end
 
       def block_array(key, items)

data/lib/abqari/minifier.rb

@@ -121,7 +121,8 @@ module Abqari
 
       minified = stripped
                  .gsub(/\s+/, ' ')
-                 .gsub(/\s*([{};,>])\s*/, '\1')
+                 # The previous pass leaves at most one ASCII space.
+                 .gsub(/ ?([{};,>]) ?/, '\1')
                  .gsub(';}', '}')
       minified = trim(minified)
 

data/lib/abqari/renderer.rb

@@ -810,7 +810,7 @@ module Abqari
     def rewrite_bundle_urls(html, page)
       base = page.url
 
-      html.gsub(/(<(?:img|a)\s+[^>]*?(?:src|href)=")([^"]+)/) do
+      html.gsub(/(<(?:img|a)\s++[^>]*?(?:src|href)=")([^"]+)/) do
         prefix = ::Regexp.last_match(1)
         url    = ::Regexp.last_match(2)
 

data/lib/abqari/version.rb

@@ -14,5 +14,5 @@
 #
 # Keep this file dependency-free.
 module Abqari
-  VERSION = '1.3.0'
+  VERSION = '1.3.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: abqari
 version: !ruby/object:Gem::Version
-  version: 1.3.0
+  version: 1.3.1
 platform: ruby
 authors:
 - Grant Rayner
@@ -65,6 +65,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.13'
+- !ruby/object:Gem::Dependency
+  name: nokolexbor
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.8.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.8.0
 - !ruby/object:Gem::Dependency
   name: rouge
   requirement: !ruby/object:Gem::Requirement
@@ -239,6 +253,7 @@ files:
 - lib/abqari/headers_file.rb
 - lib/abqari/helpers.rb
 - lib/abqari/hooks.rb
+- lib/abqari/html.rb
 - lib/abqari/http_safe.rb
 - lib/abqari/image_pipeline.rb
 - lib/abqari/importers.rb