leptris 1.9.375.0 → 1.9.377.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fa27f3dd652c356d4b8b939f40aba24b30866302e3d4c3cfb7fa62c032de7415
-  data.tar.gz: fe4921f2e63255893c97cb83bbfa845a2fe92c023c7b1a2a900794e183b30ba8
+  metadata.gz: eaa5ce5dfd171e7a4931f40dcd4ec8e901bd4895f20776df74daee75595e2294
+  data.tar.gz: d843a2dac00c737e4e203ea1375f0575fd1df0ec2b854ad0134e87bfcad3493f
 SHA512:
-  metadata.gz: e67786d718aa5a26dcb59e67cbd8144f0de8b4c0327ee64ec6a58d0ff89e2bd1512bb54e480e2c649252011361e77f6d811afdaf7ce6f070aa4d77a940fea7f9
-  data.tar.gz: 879fe1f675823fb7f8bd880f005abc0f1287b1f9ebd48f63bcf914d3bf326a7dc5b125071738cecb3e8228f1965c361c813c3a6d7ac474cc34ae0324d0d72f1e
+  metadata.gz: 3d81ecd1df498f7fd65db0531affc0a61ab9df1f79123a19b05759c77d0a64c91299e771a2b314347a3565a3f721b63685b01723f7afa21e40063eb94a2c0774
+  data.tar.gz: 1aa12f5eaad5f1566a9cc2b070f09db64433714ced23cdac8c16a1d34056b2f43748b45fecdbc8c590a1084e694cd8ec38549af406e8e68aee9e69d9203edec1

data/Rakefile

@@ -8,7 +8,7 @@ RSpec::Core::RakeTask.new(:spec)
 # Pin for `rake compile` and the platform-gem builds. Keep in lockstep
 # with .github/workflows/build.yml (which calls `rake compile`) and the
 # CHANGELOG when libleptris releases.
-LIBLEPTRIS_VERSION = "1.9.375"
+LIBLEPTRIS_VERSION = "1.9.377"
 # Vendored alongside libleptris for fn:normalize-unicode (TODO
 # .restructure/20): built per platform with a RELOCATABLE @rpath
 # install name, loaded by ffi.rb before libleptris so the

data/lib/leptris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Leptris
-  VERSION = "1.9.375.0"
+  VERSION = "1.9.377.0"
 end

data/vendor-src/README.md

@@ -1,7 +1,7 @@
 Sources vendored in this gem (recompile rights; the ruby
 variant builds them at install via extconf.rb):
 
-- libleptris v1.9.375
+- libleptris v1.9.377
 - utf8proc v2.11.0
 
 Rebuild by hand:

data/vendor-src/libleptris/CHANGELOG.md

@@ -1,5 +1,66 @@
 ## [Unreleased]
 
+## [1.9.377] - 2026-10-20
+
+### Added
+
+- **html: verdict parity 1508 to 1532 of 1555 (PR #1797).** Five
+  emission slices, each grounded in html5lib's parser/tokenizer
+  source and gated by the #1771 corpus harness with zero want=clean
+  regressions: misplaced in-body caption/col/…/tr and `<frame>`
+  (unexpected-start-tag-ignored) plus the stray `</p>` phase codes;
+  after-html/after-body/after-frameset character codes
+  (expected-eof-but-got-char, unexpected-char-after-body,
+  unexpected-char-after-frameset); unterminated-comment tokenizer
+  codes (eof-in-comment, eof-in-comment-double-dash);
+  plaintext-at-EOF and the `</` tokenizer EOF codes; and a
+  phase-aware depth-0 stray-end-tag branch covering raw-text names,
+  void elements and menuitem (end-tag-after-implied-root before
+  html, after-body/-frameset/after-html variants, otherwise
+  unexpected-end-tag). Tree parity stays 1555/1555; the verdict
+  floor rose from 1508 to 1532.
+
+
+## [1.9.376] - 2026-10-20
+
+### Fixed
+
+- **serialize: decoded entity-shaped text is escaped
+  unconditionally (leptris-ruby#515, PR #1793).** Parse expands
+  entities into text (named references that survive under
+  `KEEP_ENTITY_REFS` become `ENTITY_REF` nodes), but both text
+  emitters kept an entity lookahead that re-emitted decoded data
+  verbatim: `&#x41;` reparsed as `A`, and `&lt;UK&gt;` minted a
+  `<UK>` element that swallowed siblings. Every `&` in text is now
+  escaped; `ENTITY_REF` nodes still serialize as markup.
+- **parse: strict loads validate the effective encoding
+  (leptris-ruby#514, PR #1793).** Non-RECOVER parses reject
+  invalid UTF-8 under XML 1.0 §4.3.3 (RFC 3629 strictness:
+  overlongs, surrogates, >U+10FFFF, truncation are fatal), for
+  documents that are UTF-8 by declaration or default. A declared
+  non-UTF-8 encoding is exempt (legacy encodings still transcode
+  through the iconv lane), and RECOVER keeps the #1660
+  best-effort-tree contract. The ASCII fast path scans
+  word-at-a-time (~14 GB/s, ~0.2% of a full parse).
+
+### Added
+
+- **html: verdict parity 1446 to 1508 of 1555 (PR #1794).** Seven
+  emission slices, each grounded in html5lib's source and gated by
+  the #1771 corpus harness with zero want=clean regressions:
+  depth-0 stray raw-text end tags (`</script>`, `</style>`, …);
+  later `<html>` tokens (non-html-root); the end-tag-too-early
+  family (heading mismatch, implied-end crossings, and the same
+  rule on li/dd/dt/p implied closes); after-body/frameset phase
+  codes; InBody frameset, duplicate body/head, and AfterHead
+  out-of-my-head tags; select/table/foreign codes
+  (unexpected-input-in-select, hidden-input-in-table,
+  unexpected-html-element-in-foreign-content); and tokenizer
+  need-space-after-doctype. Tree parity stays 1555/1555; the
+  verdict floor rose from 1409 to 1508.
+
+
+
 ## [1.9.375] - 2026-10-20
 
 ### Added

data/vendor-src/libleptris/CMakeLists.txt

@@ -3,7 +3,7 @@
 cmake_minimum_required(VERSION 3.20)
 
 project(leptris
-    VERSION 1.9.375
+    VERSION 1.9.377
     DESCRIPTION "Fast XML parser and XPath evaluator in pure C"
     LANGUAGES C CXX
 )

data/vendor-src/libleptris/src/include/leptris.h

@@ -838,6 +838,11 @@ LEPTRIS_API LeptrisStatus leptris_document_set_root_ex(
 /**
  * Parse XML string into document
  *
+ * Encoding: the input must be valid in its effective encoding. With
+ * no XML declaration (or a UTF-8/US-ASCII one) that is UTF-8 (XML
+ * 1.0 §4.3.3) and invalid byte sequences are a fatal load error. A
+ * declared legacy encoding is transcoded to UTF-8 before parsing.
+ *
  * @param xml XML string (must be valid UTF-8)
  * @param length Length of XML string in bytes
  * @param status Output status code (can be NULL)
@@ -979,6 +984,11 @@ LEPTRIS_API int leptris_rng_error_line(LeptrisRelaxNG rng, size_t i);
 LEPTRIS_API int leptris_rng_error_column(LeptrisRelaxNG rng, size_t i);
 
 
+/* Parse with explicit flags. Strict (non-RECOVER) parses validate
+ * the input against its effective encoding (see leptris_parse_string);
+ * RECOVER keeps the best-effort #1660 contract and skips the fatal
+ * encoding check. A declared non-UTF-8 encoding is exempt from UTF-8
+ * validation and passes through raw in this lane. */
 LEPTRIS_API LeptrisDocument leptris_parse_string_flags(const char* xml,
                                                     size_t length,
                                                     LeptrisParseFlags flags,

data/vendor-src/libleptris/src/leptris/flat/direct_parse.c

@@ -43,6 +43,7 @@
 #include <string.h>
 #include <stdlib.h>
 #include <stdio.h>
+#include <stdint.h>
 
 /* File-scope externs: engine config TLS defined in core.c (declared
  * in leptris_internal.h; this TU reads it without the umbrella) and
@@ -3415,6 +3416,123 @@ static struct leptris_document* dp_il_try(const char* xml, size_t len,
     return d;
 }
 
+/* ---- Load-time encoding validation (leptris-ruby#514) ----
+ *
+ * XML 1.0 §4.3.3: a document without a declaration is UTF-8; a
+ * declared non-UTF-8 encoding is exempt (its bytes are legitimately
+ * not UTF-8 — leptris_parse_string transcodes declared legacy
+ * encodings through iconv before they reach this funnel). Structural
+ * UTF-8 (RFC 3629) is strict: overlongs, surrogates, >U+10FFFF and
+ * truncated sequences are fatal, matching libxml2's load-time
+ * "Invalid bytes in character encoding". */
+
+static int dp_ascii_case_eq(const char* a, const char* b, size_t n) {
+    for (size_t i = 0; i < n; i++) {
+        char x = a[i];
+        char y = b[i];
+        if (x >= 'A' && x <= 'Z') x += 32;
+        if (y >= 'A' && y <= 'Z') y += 32;
+        if (x != y) return 0;
+    }
+    return 1;
+}
+
+/* 1 when the XML declaration names an encoding other than UTF-8 /
+ * US-ASCII. No (or unreadable) declaration -> 0, the UTF-8 default. */
+static int dp_declares_non_utf8(const char* s, size_t len) {
+    size_t i = 0;
+    if (len >= 3 && (unsigned char)s[0] == 0xEF &&
+        (unsigned char)s[1] == 0xBB && (unsigned char)s[2] == 0xBF) {
+        i = 3;
+    }
+    if (len - i < 5 || memcmp(s + i, "<?xml", 5) != 0) return 0;
+    if (len - i > 5) {
+        char c = s[i + 5];
+        if (c != ' ' && c != '\t' && c != '\r' && c != '\n' && c != '?')
+            return 0;
+    }
+    size_t j = i + 5;
+    size_t end = j;
+    while (end + 1 < len && !(s[end] == '?' && s[end + 1] == '>')) end++;
+    if (end + 1 >= len) return 0;
+    while (j < end) {
+        if (end - j >= 8 && memcmp(s + j, "encoding", 8) == 0 &&
+            (j == i + 5 || s[j - 1] == ' ' || s[j - 1] == '\t' ||
+             s[j - 1] == '\r' || s[j - 1] == '\n')) {
+            size_t k = j + 8;
+            while (k < end && (s[k] == ' ' || s[k] == '\t' ||
+                               s[k] == '\r' || s[k] == '\n')) k++;
+            if (k < end && s[k] == '=') {
+                k++;
+                while (k < end && (s[k] == ' ' || s[k] == '\t' ||
+                                   s[k] == '\r' || s[k] == '\n')) k++;
+                if (k < end && (s[k] == '"' || s[k] == '\'')) {
+                    char q = s[k++];
+                    size_t v = k;
+                    while (k < end && s[k] != q) k++;
+                    size_t vl = k - v;
+                    if (vl == 5 && dp_ascii_case_eq(s + v, "UTF-8", 5)) return 0;
+                    if (vl == 4 && dp_ascii_case_eq(s + v, "UTF8", 4)) return 0;
+                    if (vl == 8 && dp_ascii_case_eq(s + v, "US-ASCII", 8))
+                        return 0;
+                    return 1;
+                }
+            }
+        }
+        j++;
+    }
+    return 0;
+}
+
+static int dp_utf8_valid(const char* s, size_t len) {
+    const unsigned char* p = (const unsigned char*)s;
+    size_t i = 0;
+    /* ASCII fast path: 8 bytes per iteration. The DFA below runs
+     * only when a high byte is present; ordinary documents pay one
+     * memory-bandwidth pass. */
+    while (i + 8 <= len) {
+        uint64_t w;
+        memcpy(&w, p + i, 8);
+        if (w & UINT64_C(0x8080808080808080)) break;
+        i += 8;
+    }
+    while (i < len && p[i] < 0x80) i++;
+    while (i < len) {
+        unsigned c = p[i];
+        if (c < 0x80) {
+            i++;
+            continue;
+        }
+        size_t n;
+        unsigned lo = 0x80;
+        unsigned hi = 0xBF;
+        if (c >= 0xC2 && c <= 0xDF) {
+            n = 1;
+        } else if (c >= 0xE0 && c <= 0xEF) {
+            n = 2;
+            if (c == 0xE0) lo = 0xA0;
+            else if (c == 0xED) hi = 0x9F;
+        } else if (c >= 0xF0 && c <= 0xF4) {
+            n = 3;
+            if (c == 0xF0) lo = 0x90;
+            else if (c == 0xF4) hi = 0x8F;
+        } else {
+            return 0;
+        }
+        if (len - i <= n) return 0;
+        if (p[i + 1] < lo || p[i + 1] > hi) return 0;
+        for (size_t k = 2; k <= n; k++) {
+            if (p[i + k] < 0x80 || p[i + k] > 0xBF) return 0;
+        }
+        i += n + 1;
+    }
+    return 1;
+}
+
+static int dp_input_encoding_ok(const char* s, size_t len) {
+    return dp_declares_non_utf8(s, len) || dp_utf8_valid(s, len);
+}
+
 /* Public: copy the input then parse (standard path).
  *
  * The copy and the arena-sizing pre-scan are ONE fused SIMD pass
@@ -3424,6 +3542,7 @@ static struct leptris_document* dp_il_try(const char* xml, size_t len,
  * arena holds only nodes and strings. */
 struct leptris_document* direct_parse(const char* xml, size_t len) {
     if (!xml || len == 0) return NULL;
+    if (!dp_input_encoding_ok(xml, len)) return NULL;
     {
         struct leptris_document* d = dp_il_try(xml, len, 0, 0, 0);
         if (d) return d;
@@ -3435,6 +3554,12 @@ struct leptris_document* direct_parse(const char* xml, size_t len) {
 struct leptris_document* direct_parse_flags(const char* xml, size_t len,
                                            unsigned parse_flags) {
     if (!xml || len == 0) return NULL;
+    /* RECOVER keeps the #1660 best-effort contract (never NULL for
+     * malformed input); the fatal encoding check is strict-lane. */
+    if (!(parse_flags & LEPTRIS_PARSE_RECOVER) &&
+        !dp_input_encoding_ok(xml, len)) {
+        return NULL;
+    }
     /* The interleaved lane has no recovery support (#1660) — RECOVER
      * parses take the default lane. */
     if (!(parse_flags & LEPTRIS_PARSE_RECOVER)) {
@@ -3462,6 +3587,7 @@ struct leptris_document* direct_parse_flags(const char* xml, size_t len,
 /* Public: parse a caller-owned writable buffer without copying. */
 struct leptris_document* direct_parse_inplace(char* buf, size_t len) {
     if (!buf || len == 0) return NULL;
+    if (!dp_input_encoding_ok(buf, len)) return NULL;
     buf[len] = '\0';  /* Ensure NUL termination */
     return direct_parse_internal(buf, len, 0, 0, 0, 0, 0, 0);
 }

data/vendor-src/libleptris/src/leptris/html/html_parse.c

@@ -2767,6 +2767,9 @@ typedef struct {
      * switch, so the divert stays armed. Re-armed by each
      * </body>/</html> token. */
     int after_body_done;
+    /* Verdict bookkeeping only (never gates tree placement): the
+     * AfterBody startTagOther error has fired for this phase. */
+    int after_body_diag_done;
     /* #659 two-mode split: leptris_parse_html_string is the WHATWG
      * engine (full "in head" set: script/style/noscript/template
      * ... lift into the implied head); the new
@@ -3299,6 +3302,53 @@ static int h_is_formatting(const char* n) {
     return h_fmt4_lut[h_tag_id(n)];
 }
 
+/* Raw-text tokenizer targets. In body they have no dedicated end-tag
+ * handler: html5lib's endTagOther walks the stack and reports
+ * unexpected-end-tag at the first special node, so every such token
+ * reaching the generic walk is stray (the tokenizer consumes the
+ * matching terminator when the element is actually open). */
+static int h_is_rawtext_name(const char* n) {
+    return strcmp(n, "script") == 0 || strcmp(n, "style") == 0 ||
+           strcmp(n, "title") == 0 || strcmp(n, "textarea") == 0 ||
+           strcmp(n, "xmp") == 0 || strcmp(n, "iframe") == 0 ||
+           strcmp(n, "noembed") == 0 || strcmp(n, "noframes") == 0;
+}
+
+/* html5lib generateImpliedEndTags set (§13.2.4.5): closing a block
+ * or list item may pop these silently; anything else above the
+ * target makes the close "too early". */
+static int h_is_implied_end_name(const char* n) {
+    return strcmp(n, "p") == 0 || strcmp(n, "li") == 0 ||
+           strcmp(n, "dd") == 0 || strcmp(n, "dt") == 0 ||
+           strcmp(n, "option") == 0 || strcmp(n, "optgroup") == 0 ||
+           strcmp(n, "rb") == 0 || strcmp(n, "rt") == 0 ||
+           strcmp(n, "rtc") == 0 || strcmp(n, "rp") == 0;
+}
+
+/* End tags html5lib implements with endTagBlock / endTagListItem /
+ * endTagAppletMarqueeObject — the handlers that raise
+ * end-tag-too-early when the target is not the current node after
+ * implied-end generation. */
+static int h_is_tooearly_target(const char* n) {
+    return strcmp(n, "p") == 0 || strcmp(n, "li") == 0 ||
+           strcmp(n, "dd") == 0 || strcmp(n, "dt") == 0 ||
+           strcmp(n, "applet") == 0 || strcmp(n, "marquee") == 0 ||
+           strcmp(n, "object") == 0 ||
+           strcmp(n, "address") == 0 || strcmp(n, "article") == 0 ||
+           strcmp(n, "aside") == 0 || strcmp(n, "blockquote") == 0 ||
+           strcmp(n, "button") == 0 || strcmp(n, "center") == 0 ||
+           strcmp(n, "details") == 0 || strcmp(n, "dialog") == 0 ||
+           strcmp(n, "dir") == 0 || strcmp(n, "div") == 0 ||
+           strcmp(n, "dl") == 0 || strcmp(n, "fieldset") == 0 ||
+           strcmp(n, "figcaption") == 0 || strcmp(n, "figure") == 0 ||
+           strcmp(n, "footer") == 0 || strcmp(n, "header") == 0 ||
+           strcmp(n, "hgroup") == 0 || strcmp(n, "listing") == 0 ||
+           strcmp(n, "main") == 0 || strcmp(n, "menu") == 0 ||
+           strcmp(n, "nav") == 0 || strcmp(n, "ol") == 0 ||
+           strcmp(n, "pre") == 0 || strcmp(n, "section") == 0 ||
+           strcmp(n, "summary") == 0 || strcmp(n, "ul") == 0;
+}
+
 /* WHATWG "special" category (13.2.4.2) — the adoption agency's
  * furthest-block candidates. */
 /* Generated tag classifier (#1218 hot path): one first-char
@@ -3985,6 +4035,13 @@ static void h_append(HBuilder* b, LeptrisNodeRef n) {
                 if (*q != ' ' && *q != '\t' && *q != '\n' &&
                     *q != '\r') { ws = 0; break; }
         if (!ws) {
+            /* AfterFrameset processCharacters reports
+             * unexpected-char-after-frameset; the after-</html>
+             * flavor is reported by the expected-eof block below. */
+            if (!b->after_html)
+                h_diag(b, "unexpected-char-after-frameset",
+                       b->err_line_memo_off,
+                       "characters after </frameset>");
             /* Every whitespace character inserts, every
              * non-whitespace one drops (tests2:7: " te st" ->
              * "  "). Filter in place, like after-frameset. */
@@ -4007,7 +4064,20 @@ static void h_append(HBuilder* b, LeptrisNodeRef n) {
             for (const char* q = tt; *q; q++)
                 if (*q != ' ' && *q != '\t' && *q != '\n' &&
                     *q != '\r') { nonws = 1; break; }
-        if (nonws) b->after_body_done = 1;
+        if (nonws) {
+            b->after_body_done = 1;
+            /* AfterAfterBody/AfterAfterFrameset processCharacters
+             * report expected-eof-but-got-char; AfterBody reports
+             * unexpected-char-after-body (tests2:55, tests19:41). */
+            if (b->after_html)
+                h_diag(b, "expected-eof-but-got-char",
+                       b->err_line_memo_off,
+                       "characters after </html>");
+            else
+                h_diag(b, "unexpected-char-after-body",
+                       b->err_line_memo_off,
+                       "characters after </body>");
+        }
     }
     /* Doc-start mixed run: the ws prefix is "before html"
      * whitespace and drops (doctype01:31, tests19:79). Tightest
@@ -4133,6 +4203,17 @@ static void h_append(HBuilder* b, LeptrisNodeRef n) {
             b->open_ns[b->depth - 2] == H_NS_HTML &&
             b->open_id[b->depth - 2] == h_id_table)
             tbl_ctx = 1;
+        /* InTable startTagInput with type=hidden: html5lib reports
+         * unexpected-hidden-input-in-table and inserts AT the spot
+         * (no fostering — h_fosterable exempts it, tests7:16-20). */
+        if (b->whatwg_foster && tbl_ctx && b->input_hidden_tag &&
+            leptris_node_get_type(n) == LEPTRIS_NODE_TYPE_ELEMENT &&
+            h_tag_id(leptris_element_name((LeptrisElement)n)) ==
+                h_id_input) {
+            h_diag(b, "unexpected-hidden-input-in-table",
+                   b->err_line_memo_off,
+                   "hidden input inserted in table context");
+        }
         /* #659 foster (WHATWG only): text/elements in table context
          * go before the nearest open table in ITS parent. */
         if (b->whatwg_foster && tbl_ctx && h_fosterable(b, n)) {
@@ -5736,12 +5817,25 @@ static LeptrisDocument html_parse_shared(
                 size_t clen = cclose
                                   ? (size_t)(ce - cs)
                                   : (size_t)(end - cs);
-                if (!cclose)
+                if (!cclose) {
+                    /* Tokenizer EOF states: a trailing "--" is
+                     * comment-end-double-dash (tests2:59), anything
+                     * else is a plain eof-in-comment (tests2:35/43). */
+                    if (b.whatwg) {
+                        int dd = clen >= 2 && cs[clen - 1] == '-' &&
+                                 cs[clen - 2] == '-';
+                        h_diag(&b,
+                               dd ? "eof-in-comment-double-dash"
+                                  : "eof-in-comment",
+                               (size_t)(end - b.input_base),
+                               "comment reaches end of input");
+                    }
                     /* Unterminated at EOF: html5lib drops the
                      * trailing dash run (tests2:59: <!--x-- keeps
                      * data "x"). */
                     while (clen > 0 && cs[clen - 1] == '-')
                         clen--;
+                }
                 p = cclose ? ce + cclose : end;
                 LeptrisCommentNode* c = leptris_comment_create(
                     cs, clen, b.pool);
@@ -5851,6 +5945,13 @@ static LeptrisDocument html_parse_shared(
                 }
                 if (is_dt) {
                     q += 7;
+                    /* Tokenizer: need-space-after-doctype when the
+                     * keyword is not followed by whitespace
+                     * (doctype01:3, tests2:26-28). */
+                    if (b.whatwg && q < end && *q != '>' && !h_is_ws(*q))
+                        h_diag(&b, "need-space-after-doctype",
+                               (size_t)(q - b.input_base),
+                               "no space after <!doctype");
                     while (q < end && h_is_ws(*q)) q++;
                     const char* nstart = q;
                     while (q < end && !h_is_ws(*q) && *q != '>') q++;
@@ -6043,6 +6144,18 @@ static LeptrisDocument html_parse_shared(
             {
                 const char* ns2 = p + 2;
                 if (b.whatwg && ns2 >= end) {
+                    /* Tokenizer: EOF in the tag-open state emits
+                     * expected-closing-tag-but-got-eof and the two
+                     * characters as text (tests1:38); in the
+                     * initial mode that text also reports the
+                     * missing doctype. */
+                    h_diag(&b, "expected-closing-tag-but-got-eof",
+                           (size_t)(p - b.input_base),
+                           "end tag at end of input");
+                    if (!b.left_initial && !doc->doctype)
+                        h_diag(&b, "expected-doctype-but-got-chars",
+                               (size_t)(p - b.input_base),
+                               "characters in the initial mode");
                     if (text < p) {
                         LeptrisTextNode* t =
                             h_text_node(&b, text, p);
@@ -6191,6 +6304,41 @@ static LeptrisDocument html_parse_shared(
                 text = p;
                 continue;
             }
+            /* Stray end tags with no open stack. The raw-text family
+             * completes during start-tag handling; void elements and
+             * menuitem have no in-body end handler. html5lib's
+             * endTagOther reports by phase: before-html is
+             * end-tag-after-implied-root; AfterBody/AfterFrameset
+             * and AfterAfter* have their own codes; InHead/InBody/
+             * AfterHead report unexpected-end-tag. */
+            if (b.whatwg && nlen && b.depth == 0) {
+                char rn[16];
+                size_t rl = nlen < sizeof(rn) - 1 ? nlen : sizeof(rn) - 1;
+                for (size_t i = 0; i < rl; i++) rn[i] = h_lower(ns[i]);
+                rn[rl] = 0;
+                int stray = h_is_rawtext_name(rn) ||
+                            (h_is_void(rn) && strcmp(rn, "br") != 0) ||
+                            strcmp(rn, "menuitem") == 0;
+                if (stray) {
+                    const char* code = "unexpected-end-tag";
+                    if (b.after_html)
+                        code = "expected-eof-but-got-end-tag";
+                    else if (b.after_body)
+                        code = "unexpected-end-tag-after-body";
+                    else if (b.frameset && b.after_frameset)
+                        code = "unexpected-end-tag-after-frameset";
+                    else if (b.frameset)
+                        code = "unexpected-end-tag-in-frameset";
+                    else if (!b.top_tail && !b.head_tag_seen &&
+                             !b.body_seen && !b.body_tag_seen)
+                        code = "end-tag-after-implied-root";
+                    h_diag(&b, code, (size_t)(p - b.input_base),
+                           "</%s> has no matching open element", rn);
+                    p = q;
+                    text = p;
+                    continue;
+                }
+            }
             if (nlen && (b.depth > 0 ||
                          (b.whatwg &&
                           ((nlen == 4 &&
@@ -6206,6 +6354,19 @@ static LeptrisDocument html_parse_shared(
                 for (size_t i = 0; i < cl; i++)
                     lname[i] = h_lower(ns[i]);
                 lname[cl] = 0;
+                /* InBody endTagOther: a VOID element has no end
+                 * handler, so a stray end tag reports
+                 * unexpected-end-tag (tests25:15-20: </keygen>).
+                 * </br> is endTagBr and acts as <br> above. */
+                if (b.whatwg && h_is_void(lname) &&
+                    strcmp(lname, "br") != 0) {
+                    h_diag(&b, "unexpected-end-tag",
+                           (size_t)(p - b.input_base),
+                           "</%s> is a void element", lname);
+                    p = q;
+                    text = p;
+                    continue;
+                }
                 if (!h_is_void(lname)) {
                     if (b.whatwg &&
                         strcmp(lname, "menuitem") == 0) {
@@ -6274,6 +6435,29 @@ static LeptrisDocument html_parse_shared(
                             const char* hn =
                                 leptris_element_name(b.open[d - 1]);
                             if (hn && h_is_heading(hn)) {
+                                /* html5lib endTagHeading: after the
+                                 * implied-end pass, a current
+                                 * heading of a different name makes
+                                 * the close too early (tests19:24:
+                                 * </h2> over an open h3), and so
+                                 * does a non-implied element above
+                                 * the heading. */
+                                int early = strcmp(hn, lname) != 0;
+                                for (size_t k = d; k < b.depth; k++) {
+                                    const char* an2 = leptris_element_name(
+                                        b.open[k]);
+                                    if (an2 &&
+                                        b.open_ns[k] == H_NS_HTML &&
+                                        !h_is_implied_end_name(an2)) {
+                                        early = 1;
+                                        break;
+                                    }
+                                }
+                                if (early)
+                                    h_diag(&b, "end-tag-too-early",
+                                           (size_t)(p - b.input_base),
+                                           "</%s> closes <%s> early",
+                                           lname, hn);
                                 h_pop_to(&b, d - 1);
                             /* Old-suite rule (tests1:21/91):
                              * </table> also closes open
@@ -6314,7 +6498,23 @@ static LeptrisDocument html_parse_shared(
                             text = p;
                             continue;
                         }
+                        /* No heading in scope: html5lib still checks
+                         * the current node, which is never the token
+                         * (tests19:23: </h3> after <p>). */
+                        h_diag(&b, "end-tag-too-early",
+                               (size_t)(p - b.input_base),
+                               "</%s> with no open heading", lname);
                     }
+                    /* InHead/AfterHead endTagOther: a </p> before
+                     * body content is dropped with unexpected-end-tag
+                     * and inserts nothing (tests19:3). */
+                    if (b.whatwg && strcmp(lname, "p") == 0 &&
+                        !b.body_seen && (b.head_tag_seen ||
+                                         b.head_end_seen) &&
+                        !b.frameset && !b.after_body && !b.after_html)
+                        h_diag(&b, "unexpected-end-tag",
+                               (size_t)(p - b.input_base),
+                               "</p> outside the body phase");
                     /* #659 13.2.6.4.17: </p> with no p in button
                      * scope inserts an EMPTY <p> and closes it
                      * (tests1:29) — the stray tag still leaves a
@@ -6342,6 +6542,13 @@ static LeptrisDocument html_parse_shared(
                                 break;
                         }
                         if (!p_open) {
+                            /* InBody endTagP: no p in button scope
+                             * is a parse error even though the
+                             * empty p is still inserted
+                             * (tests2:60). */
+                            h_diag(&b, "unexpected-end-tag",
+                                   (size_t)(p - b.input_base),
+                                   "</p> with no p in scope");
                             LeptrisElement pe =
                                 h_open_element(&b, "p");
                             (void)pe;
@@ -6623,7 +6830,14 @@ static LeptrisDocument html_parse_shared(
                                             strcmp(lname, "dd") == 0 ||
                                             strcmp(lname, "dt") == 0) &&
                                            (h_ieq_raw(on, "ul") ||
-                                            h_ieq_raw(on, "ol")));
+                                            h_ieq_raw(on, "ol"))) ||
+                                          /* html5lib endTagOther: a
+                                           * raw-text name has no
+                                           * in-body handler, so the
+                                           * walk errors at the first
+                                           * special node. */
+                                          (h_is_rawtext_name(lname) &&
+                                           h_is_special_ww(on));
                             }
                             if (fenced) {
                                 /* #1771: html5lib's walk reports
@@ -6677,6 +6891,27 @@ static LeptrisDocument html_parse_shared(
                                     (int)(d - 1) <= ti)
                                     break;
                             }
+                            /* html5lib endTagBlock / endTagListItem /
+                             * endTagAppletMarqueeObject: after the
+                             * implied-end pass, a non-implied element
+                             * above the target makes the close too
+                             * early (tests3:11: </pre> over <div>). */
+                            if (b.whatwg && b.open_ns[d - 1] == H_NS_HTML &&
+                                h_is_tooearly_target(lname)) {
+                                for (size_t k = d; k < b.depth; k++) {
+                                    const char* an2 =
+                                        leptris_element_name(b.open[k]);
+                                    if (an2 &&
+                                        b.open_ns[k] == H_NS_HTML &&
+                                        !h_is_implied_end_name(an2)) {
+                                        h_diag(&b, "end-tag-too-early",
+                                               (size_t)(p - b.input_base),
+                                               "</%s> closes over <%s>",
+                                               lname, an2);
+                                        break;
+                                    }
+                                }
+                            }
                             h_pop_to(&b, d - 1);
                             /* Old-suite </table> rule: closes
                              * formatting BELOW the table - only
@@ -6977,6 +7212,47 @@ static LeptrisDocument html_parse_shared(
         while (q < end && !h_is_ws(*q) && *q != '>' && *q != '/') q++;
         size_t nlen = (size_t)(q - ns);
         char* name = h_pooled_lower(b.pool, ns, nlen);
+        if (name && b.whatwg && strcmp(name, "html") != 0) {
+            if (b.after_html &&
+                !(b.frameset && strcmp(name, "noframes") == 0)) {
+                /* AfterAfterBody / AfterAfterFrameset startTagOther
+                 * (only html — and noframes in the frameset flavor —
+                 * is accepted). */
+                h_diag(&b, "expected-eof-but-got-start-tag",
+                       (size_t)(p - b.input_base),
+                       "<%s> after </html>", name);
+            } else if (b.after_body && !b.after_body_done &&
+                       !b.frameset && !b.after_body_diag_done) {
+                /* AfterBody startTagOther: the first non-html start
+                 * tag after </body> errors and moves the phase back
+                 * to in-body (tests15:4/6, tests9:21, tests10:20).
+                 * Bookkeeping is diagnostic-only: after_body_done
+                 * also gates comment placement. */
+                h_diag(&b, "unexpected-start-tag-after-body",
+                       (size_t)(p - b.input_base),
+                       "<%s> after </body>", name);
+                b.after_body_diag_done = 1;
+            }
+            /* AfterHead startTagFromHead: a head-only start tag in
+             * the window after </head> and before body content is
+             * processed in head but reported out-of-my-head
+             * (tests7:3/4). */
+            if (b.head_end_seen && !b.body_seen && !b.body_tag_seen &&
+                !b.frameset && !b.after_body &&
+                (strcmp(name, "base") == 0 ||
+                 strcmp(name, "basefont") == 0 ||
+                 strcmp(name, "bgsound") == 0 ||
+                 strcmp(name, "link") == 0 ||
+                 strcmp(name, "meta") == 0 ||
+                 strcmp(name, "noframes") == 0 ||
+                 strcmp(name, "script") == 0 ||
+                 strcmp(name, "style") == 0 ||
+                 strcmp(name, "title") == 0)) {
+                h_diag(&b, "unexpected-start-tag-out-of-my-head",
+                       (size_t)(p - b.input_base),
+                       "<%s> after </head>", name);
+            }
+        }
         if (!name) goto done;
         /* #659 (13.2.6.4.7): <image> is renamed <img> and
          * reprocessed (tests1:90). */
@@ -7070,6 +7346,13 @@ static LeptrisDocument html_parse_shared(
                 if (t) h_append(&b, (LeptrisNodeRef)t);
             }
             if (strcmp(name, "body") == 0) {
+                /* InBody startTagBody always reports
+                 * unexpected-start-tag for a second <body>
+                 * (tests2:16); the first one is the phase entry. */
+                if (b.whatwg && (b.body_tag_seen || b.body_seen))
+                    h_diag(&b, "unexpected-start-tag",
+                           (size_t)(p - b.input_base),
+                           "<body> after the body exists");
                 b.body_tag_seen = 1;
                 if (b.whatwg) b.frameset_ok = 0;
                 /* Only the FIRST structural <body> marks the
@@ -7081,6 +7364,15 @@ static LeptrisDocument html_parse_shared(
                     b.lift_boundary = b.top_tail;
                 }
             } else {
+                /* InBody/AfterHead startTagHead: any <head> after
+                 * the head phase started is an unexpected start tag
+                 * (tests6:1: </head> <head>). */
+                if (b.whatwg &&
+                    (b.head_tag_seen || b.head_end_seen ||
+                     b.body_tag_seen || b.body_seen))
+                    h_diag(&b, "unexpected-start-tag",
+                           (size_t)(p - b.input_base),
+                           "<head> after the head phase");
                 /* Before-head ends here: later comments are head
                  * content; earlier ones stay html-prefix children. */
                 b.head_tag_seen = 1;
@@ -7109,18 +7401,18 @@ static LeptrisDocument html_parse_shared(
             /* frameset is NOT in the 13.2.6.5 breakout list: inside
              * foreign content it is a plain foreign element
              * (plain-text-unsafe:16-23). */
-            /* #1771: html5lib's verdict — a <frameset> token that
-             * reaches the body phase after body content is
-             * unexpected-start-tag whether it then converts or is
-             * ignored (webkit01:51); head-phase converters and
-             * in-template framesets stay clean. body_seen is not
-             * set by the frameset token itself (it is in the
-             * head-only list), so it reads PRIOR content only. */
-            if (b.body_seen && !b.frameset &&
+            /* #1771: html5lib's InBody startTagFrameset always
+             * reports unexpected-start-tag — the frameset either
+             * converts (body element absent, frameset-ok set) or is
+             * ignored. frameset_ok==0 marks the InBody phase: any
+             * body tag/content (or a frameset-ok-clearing start)
+             * has already been seen. AfterHead converters keep
+             * frameset_ok==1 and stay clean (webkit01:51). */
+            if (!b.frameset_ok && !b.frameset &&
                 h_template_idx(&b) < 0)
                 h_diag(&b, "unexpected-start-tag",
                        (size_t)(p - b.input_base),
-                       "frameset after body content");
+                       "frameset in the body phase");
             /* depth<=1: at most the (explicit or synthesized) html
              * element is open; frameset-ok is the spec gate and the
              * body is removed wholesale when it converts. */
@@ -7195,6 +7487,20 @@ static LeptrisDocument html_parse_shared(
             strcmp(name, "frame") != 0 &&
             strcmp(name, "noframes") != 0 &&
             strcmp(name, "html") != 0) {
+            /* html5lib phase verdicts for the dropped token (the
+             * after-</html> flavor is emitted at the start-tag
+             * dispatch): AfterFrameset names its own code; inside an
+             * open frameset it is InFrameset's. */
+            if (!b.after_html) {
+                if (b.after_frameset)
+                    h_diag(&b, "unexpected-start-tag-after-frameset",
+                           (size_t)(p - b.input_base),
+                           "<%s> after </frameset>", name);
+                else
+                    h_diag(&b, "unexpected-start-tag-in-frameset",
+                           (size_t)(p - b.input_base),
+                           "<%s> inside <frameset>", name);
+            }
             if (text < p) {
                 LeptrisTextNode* t = h_text_node(&b, text, p);
                 if (t) {
@@ -7329,6 +7635,12 @@ static LeptrisDocument html_parse_shared(
             (strcmp(name, "input") == 0 ||
              strcmp(name, "keygen") == 0 ||
              strcmp(name, "textarea") == 0)) {
+            /* InSelect startTagInput (shared by input/keygen/
+             * textarea) reports before popping the select
+             * (tests7:14). */
+            h_diag(&b, "unexpected-input-in-select",
+                   (size_t)(p - b.input_base),
+                   "<%s> inside <select>", name);
             for (size_t d2 = b.depth; d2 > 0; d2--)
                 if (strcmp(leptris_element_name(b.open[d2 - 1]),
                            "select") == 0) {
@@ -7383,6 +7695,17 @@ static LeptrisDocument html_parse_shared(
             continue;
         }
 
+        /* html5lib startTagHtml: an <html> token processed once the
+         * html/head/body phases exist is not the first start tag —
+         * parse error non-html-root, then the attributes merge onto
+         * the root (tests14:3/4/6, tests19:37/38/88, tests2:52-54). */
+        if (b.whatwg && strcmp(name, "html") == 0 &&
+            (b.html_seen || b.head_tag_seen || b.body_tag_seen ||
+             b.after_body || b.body_seen)) {
+            h_diag(&b, "non-html-root",
+                   (size_t)(p - b.input_base),
+                   "<html> after the root element exists");
+        }
         /* 13.2.6.3: an <html> start tag inside content (never
          * seen yet, deep in a table/foreign subtree) merges attrs
          * and is ignored - no element (domjs-unsafe:36:
@@ -7460,6 +7783,13 @@ static LeptrisDocument html_parse_shared(
                 }
             }
             if (!tbl_ctx) {
+                /* InBody startTagMisplaced: caption/col/colgroup/
+                 * head/tbody/td/tfoot/th/thead/tr in body is a
+                 * parse error and the token is ignored
+                 * (tests25:7 <body><col>A). */
+                h_diag(&b, "unexpected-start-tag-ignored",
+                       (size_t)(p - b.input_base),
+                       "<%s> ignored in the body phase", name);
                 /* The TOKEN is ignored - surrounding character
                  * tokens keep flowing into body (the html-merge
                  * flush pattern). */
@@ -7478,6 +7808,20 @@ static LeptrisDocument html_parse_shared(
          * an ignored <frameset> vanishes). */
         if (b.whatwg && strcmp(name, "frame") == 0 &&
             (!b.frameset || b.after_frameset)) {
+            /* InBody reports the frame as a misplaced start tag
+             * (tests25:10); the after-</frameset> phase names its
+             * own code (the after-</html> phase is reported at the
+             * start-tag dispatch). */
+            if (!b.after_html) {
+                if (!b.frameset)
+                    h_diag(&b, "unexpected-start-tag-ignored",
+                           (size_t)(p - b.input_base),
+                           "<frame> ignored in the body phase");
+                else
+                    h_diag(&b, "unexpected-start-tag-after-frameset",
+                           (size_t)(p - b.input_base),
+                           "<frame> after </frameset>");
+            }
             while (q < end && *q != '>') q++;
             p = (q < end) ? q + 1 : end;
             text = p;
@@ -7502,7 +7846,13 @@ static LeptrisDocument html_parse_shared(
                 if (h_is_breakout(name) ||
                     (strcmp(name, "font") == 0 && h_font_break(q, end))) {
                     /* Breakout: pop the foreign scope, reprocess
-                     * under HTML rules below. */
+                     * under HTML rules below. html5lib's foreign
+                     * startTagOther reports the HTML element as
+                     * unexpected in foreign content
+                     * (tests9:15, tests10:14). */
+                    h_diag(&b, "unexpected-html-element-in-foreign-content",
+                           (size_t)(p - b.input_base),
+                           "<%s> breaks out of foreign content", name);
                     while (b.depth > 0 &&
                            b.open_ns[b.depth - 1] != H_NS_HTML &&
                            !h_is_int_point(&b, b.depth - 1))
@@ -7520,6 +7870,12 @@ static LeptrisDocument html_parse_shared(
         /* Implied end tags this start tag triggers (HTML rules
          * only — foreign content has none). */
         if (elem_ns == H_NS_HTML) {
+            /* html5lib startTagListItem/startTagBlock: an implied
+             * close whose target is buried under a non-implied
+             * element (div, article, ...) reports end-tag-too-early
+             * on this START tag (tests2:11, tests3:20). One per
+             * token, like the reference walk. */
+            const char* implied_early = NULL;
             /* WHATWG: a dd/dt start closes the NEAREST open dd/dt
              * in default scope — sibling definition items even
              * with content in between (13.2.6.4.7, tests19:30:
@@ -7529,6 +7885,15 @@ static LeptrisDocument html_parse_shared(
                 for (size_t d = b.depth; d > 0; d--) {
                     uint8_t oid = b.open_id[d - 1];
                     if (oid == h_id_dd || oid == h_id_dt) {
+                        for (size_t k = d; k < b.depth; k++) {
+                            const char* an2 =
+                                leptris_element_name(b.open[k]);
+                            if (an2 && b.open_ns[k] == H_NS_HTML &&
+                                !h_is_implied_end_name(an2)) {
+                                implied_early = an2;
+                                break;
+                            }
+                        }
                         b.depth = d - 1;
                         break;
                     }
@@ -7550,6 +7915,17 @@ static LeptrisDocument html_parse_shared(
                     if ((tid == h_id_li && oid == h_id_li) ||
                         (tid != h_id_li &&
                          (oid == h_id_dd || oid == h_id_dt))) {
+                        if (!implied_early) {
+                            for (size_t k = d; k < b.depth; k++) {
+                                const char* an2 =
+                                    leptris_element_name(b.open[k]);
+                                if (an2 && b.open_ns[k] == H_NS_HTML &&
+                                    !h_is_implied_end_name(an2)) {
+                                    implied_early = an2;
+                                    break;
+                                }
+                            }
+                        }
                         b.depth = d - 1;
                         break;
                     }
@@ -7570,6 +7946,17 @@ static LeptrisDocument html_parse_shared(
                 for (size_t d = b.depth; d > 0; d--) {
                     uint8_t oid = b.open_id[d - 1];
                     if (oid == h_id_p) {
+                        if (!implied_early) {
+                            for (size_t k = d; k < b.depth; k++) {
+                                const char* an2 =
+                                    leptris_element_name(b.open[k]);
+                                if (an2 && b.open_ns[k] == H_NS_HTML &&
+                                    !h_is_implied_end_name(an2)) {
+                                    implied_early = an2;
+                                    break;
+                                }
+                            }
+                        }
                         b.depth = d - 1;
                         break;
                     }
@@ -7578,6 +7965,10 @@ static LeptrisDocument html_parse_shared(
                         break;
                 }
             }
+            if (b.whatwg && implied_early)
+                h_diag(&b, "end-tag-too-early",
+                       (size_t)(p - b.input_base),
+                       "implied close crosses <%s>", implied_early);
             uint8_t tmpl_last_popped = H_ID_UNKNOWN;
             while (b.depth > 0) {
                 uint8_t oid = b.open_id[b.depth - 1];
@@ -8250,6 +8641,13 @@ static LeptrisDocument html_parse_shared(
                        "input",
                        name);
             }
+            /* PLAINTEXT has no close form: it is still open at
+             * EOF, so InBody processEOF reports the unclosed
+             * element (tests18:2-7, tests19:6). */
+            if (b.whatwg && cq >= end && strcmp(name, "plaintext") == 0)
+                h_diag(&b, "expected-closing-tag-but-got-eof",
+                       (size_t)(end - b.input_base),
+                       "plaintext reaches end of input");
             b.depth--;   /* the raw element is complete */
             text = p;
             continue;

data/vendor-src/libleptris/src/leptris/serialize/serialize.c

@@ -203,10 +203,12 @@ int buffer_has_error(SerializeBuffer* buf) {
 
 
 /* Inline escaped-text emitter (TODO 194d): writes into a caller-
- * reserved worst-case buffer (6 bytes per input byte), preserving
- * the entity semantics of the previous per-run walkers — entity
- * references emit as-is (text mode), bare & escapes, quotes are
- * ordinary in text mode and escaped in attribute mode. */
+ * reserved worst-case buffer (6 bytes per input byte). Every '&' is
+ * escaped — entity references are parse-time markup and either
+ * already decoded into the text (predefined/char refs) or carried as
+ * ENTITY_REF nodes; a decoded text value shaped like "&" is
+ * data, not markup (leptris-ruby#515). Quotes are ordinary in text
+ * mode and escaped in attribute mode. */
 /* Escape-class table (serialize endgame): the run scan was 3-4
  * compares per byte — the dominant serializer cost at 57% of the
  * text-heavy profile. One indexed load + one test per byte, the
@@ -300,23 +302,9 @@ static char* emit_escaped_inline(char* out, const char* content,
         }
 
         if (content[i] == '&') {
-            size_t j = i + 1;
-            int found_semicolon = 0;
-            while (j < len && j < i + 12) {
-                if (content[j] == ';') { found_semicolon = 1; break; }
-                if (!isalnum((unsigned char)content[j]) && content[j] != '#' && content[j] != '-') break;
-                j++;
-            }
-            if (!attr_mode && found_semicolon && j > i + 1) {
-                size_t n = j - i + 1;
-                memcpy(out, &content[i], n);
-                out += n;
-                i = j + 1;
-            } else {
-                memcpy(out, "&amp;", 5);
-                out += 5;
-                i++;
-            }
+            memcpy(out, "&amp;", 5);
+            out += 5;
+            i++;
             continue;
         }
         if (content[i] == '<') { memcpy(out, "&lt;", 4); out += 4; }
@@ -716,8 +704,8 @@ void serialize_text_internal(LeptrisTextNode* text, SerializeBuffer* buf) {
     }
 
     /* Run-batched (TODO 194b): bulk-append ordinary bytes up to the
-     * next special character; the entity lookahead only runs at '&'.
-     * Quotes and apostrophes are ordinary in text content. */
+     * next special character. Quotes and apostrophes are ordinary in
+     * text content. */
     size_t i = 0;
     while (i < content_len) {
         size_t run = i;
@@ -733,26 +721,10 @@ void serialize_text_internal(LeptrisTextNode* text, SerializeBuffer* buf) {
         }
 
         if (content[i] == '&') {
-            /* Look ahead for ';' to detect entity reference */
-            size_t j = i + 1;
-            int found_semicolon = 0;
-            while (j < text->content_len && j < i + 12) {
-                if (content[j] == ';') {
-                    found_semicolon = 1;
-                    break;
-                }
-                if (!isalnum((unsigned char)content[j]) && content[j] != '#' && content[j] != '-') {
-                    break;
-                }
-                j++;
-            }
-            if (found_semicolon && j > i + 1) {
-                buffer_append_len(buf, &content[i], j - i + 1);
-                i = j + 1;
-            } else {
-                buffer_append_len(buf, "&amp;", 5);
-                i++;
-            }
+            /* Always escape: decoded text is data. Named references
+             * that survived parsing live in ENTITY_REF nodes. */
+            buffer_append_len(buf, "&amp;", 5);
+            i++;
             continue;
         }
 

data/vendor-src/libleptris/test/html/test_html5lib.cpp

@@ -977,9 +977,27 @@ TEST(Html5LibCorpus, ErrorVerdictParity) {
     for (size_t i = 0; i < failures.size() && i < 20; i++)
         printf("  VERDICT %s\n", failures[i].c_str());
     EXPECT_GT(total, (size_t)1500);
-    /* Verdict-parity floor — set at the slice-2 baseline
-     * (1409/1555; was 190 before the #1771 emission slices —
-     * the doctype-less initial-mode family, trailing chars, EOF with
-     * open elements; slice 3 adds the raw-text EOF variants). Only raises. */
-    EXPECT_GE(parity, (size_t)1409);
+    /* Verdict-parity floor — main measured 1446/1555 before these
+     * slices (1409 was the slice-2 baseline; was 190 before the
+     * #1771 emission slices). Raw-text stray end tags add 12 depth-0
+     * cases; non-html-root adds the 9 later-<html> cases; the
+     * end-tag-too-early slices add heading name mismatches, block
+     * closes over non-implied elements, and the same rule on the
+     * implied close of li/dd/dt/p start tags; the after-body and
+     * frameset phase slices add the AfterBody/AfterFrameset/
+     * AfterAfter* start-tag codes; the start-tag phase slice adds
+     * InBody frameset, duplicate body/head, and AfterHead
+     * out-of-my-head tags; the select/table/foreign slice adds
+     * unexpected-input-in-select, hidden-input-in-table, and
+     * unexpected-html-element-in-foreign-content; the tokenizer
+     * slice adds need-space-after-doctype; the misplaced-tag slice
+     * adds in-body caption/col/…/tr and frame (ignored), plus the
+     * stray </p> phase codes; the character-phase slice adds
+     * expected-eof-but-got-char and unexpected-char-after-body/
+     * -frameset; the tokenizer EOF slice adds eof-in-comment and
+     * eof-in-comment-double-dash; the plaintext/EOF slice adds the
+     * plaintext open-at-EOF and the "</" tokenizer EOF codes; the
+     * stray-end-tag slice makes the depth-0 branch phase-aware for
+     * raw-text, void and menuitem names. Only raises. */
+    EXPECT_GE(parity, (size_t)1532);
 }

data/vendor-src/libleptris/test/parser/test_encoding.cpp

@@ -257,6 +257,93 @@ TEST(EncodingEdgeCases, EmptyXmlElementRoundTrips) {
     leptris_document_free(doc);
 }
 
+/* leptris-ruby#514: strict load validates the input against the
+ * effective encoding. Without a declaration (or with a UTF-8 one)
+ * the entity is UTF-8 in XML 1.0; invalid byte sequences are a
+ * fatal load error, matching libxml2's "Invalid bytes in character
+ * encoding". A declared non-UTF-8 encoding is exempt — those bytes
+ * are legitimately not UTF-8. */
+TEST(EncodingUtf8Strict, RejectsInvalidBytesWithoutDeclaration) {
+    const char bad[] = "<r>\xC3\x28</r>";
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisDocument doc = leptris_parse_string(bad, sizeof(bad) - 1, &st);
+    EXPECT_EQ(doc, nullptr);
+    EXPECT_EQ(st, LEPTRIS_ERROR_PARSE);
+}
+
+TEST(EncodingUtf8Strict, RejectsInvalidBytesWithUtf8Declaration) {
+    const char bad[] =
+        "<?xml version=\"1.0\" encoding=\"UTF-8\"?><r>\xC3\x28</r>";
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisDocument doc = leptris_parse_string(bad, sizeof(bad) - 1, &st);
+    EXPECT_EQ(doc, nullptr);
+    EXPECT_EQ(st, LEPTRIS_ERROR_PARSE);
+
+    const char bad_lower[] =
+        "<?xml version='1.0' encoding='utf-8'?><r>\xC3\x28</r>";
+    LeptrisDocument doc2 = leptris_parse_string(
+        bad_lower, sizeof(bad_lower) - 1, &st);
+    EXPECT_EQ(doc2, nullptr);
+}
+
+TEST(EncodingUtf8Strict, RejectsEveryInvalidSequenceClass) {
+    struct { const char* xml; size_t len; } cases[] = {
+        {"<r>\xC0\x80</r>", 0},            /* overlong NUL */
+        {"<r>\xED\xA0\x80</r>", 0},        /* surrogate U+D800 */
+        {"<r>\xF5\x80\x80\x80</r>", 0},    /* > U+10FFFF */
+        {"<r>\x80</r>", 0},                /* lone continuation */
+        {"<r>abc\xC3", 0},                 /* truncated at EOF */
+        {"<r a='\xC3\x28'/>", 0},          /* invalid in attribute */
+    };
+    for (auto& c : cases) {
+        size_t len = c.len ? c.len : std::strlen(c.xml);
+        LeptrisStatus st = LEPTRIS_OK;
+        LeptrisDocument doc = leptris_parse_string(c.xml, len, &st);
+        EXPECT_EQ(doc, nullptr) << "accepted invalid bytes";
+        if (doc) leptris_document_free(doc);
+    }
+}
+
+TEST(EncodingUtf8Strict, AcceptsValidMultibyte) {
+    const char xml[] = "<r>caf\xC3\xA9 \xE4\xB8\xAD \xF0\x9F\x98\x80</r>";
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisDocument doc = leptris_parse_string(xml, std::strlen(xml), &st);
+    ASSERT_NE(doc, nullptr);
+    EXPECT_STREQ(leptris_element_text(leptris_document_root(doc)),
+                 "caf\xC3\xA9 \xE4\xB8\xAD \xF0\x9F\x98\x80");
+    leptris_document_free(doc);
+}
+
+TEST(EncodingUtf8Strict, DeclaredNonUtf8IsExempt) {
+    /* ISO-8859-1 0xE9 is not valid UTF-8 but is valid in the
+     * declared encoding: the load must not reject it. Depending on
+     * the iconv build it either transcodes to UTF-8 ("café") or
+     * passes the raw declared byte through — both are documented
+     * shapes (#514); only the bogus UTF-8 rejection would fail. */
+    const char xml[] =
+        "<?xml version='1.0' encoding='ISO-8859-1'?><r>caf\xE9</r>";
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisDocument doc = leptris_parse_string(xml, sizeof(xml) - 1, &st);
+    ASSERT_NE(doc, nullptr);
+    const char* text = leptris_element_text(leptris_document_root(doc));
+    ASSERT_NE(text, nullptr);
+    EXPECT_TRUE(std::string(text) == "caf\xC3\xA9" ||
+                std::string(text) == "caf\xE9")
+        << "unexpected content byte(s)";
+    leptris_document_free(doc);
+}
+
+TEST(EncodingUtf8Strict, RecoverLaneKeepsBestEffortTree) {
+    /* #1660: RECOVER never returns NULL for malformed input; the
+     * encoding check must not break that contract. */
+    const char bad[] = "<r>\xC3\x28</r>";
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisDocument doc = leptris_parse_string_flags(
+        bad, sizeof(bad) - 1, LEPTRIS_PARSE_RECOVER, &st);
+    ASSERT_NE(doc, nullptr);
+    leptris_document_free(doc);
+}
+
 }  // namespace
 
 /* Issue #613: with_encoding on declared ISO-8859-1 must deliver

data/vendor-src/libleptris/test/serializer/test_serialize.cpp

@@ -39,6 +39,71 @@ TEST(SerializeRoundTrip, EscapesBareAmpersandInText) {
     leptris_document_free(doc);
 }
 
+TEST(SerializeRoundTrip, EscapesEntityShapedTextUnconditionally) {
+    // leptris-ruby#515: parse decodes entities into text; a decoded
+    // text value that LOOKS like an entity reference ("&",
+    // "&", "<UK>") must still escape its '&' on output.
+    // The old serializer passed entity-shaped runs through verbatim,
+    // so the next parse produced a different value (A -> A,
+    // &lt;UK&gt; -> a literal <UK> start tag).
+    struct { const char* xml; const char* want; const char* want_text; } cases[] = {
+        {"<r>a &amp;#x26; b</r>", "<r>a &amp;#x26; b</r>", "a &#x26; b"},
+        {"<r>a &amp;amp; b</r>", "<r>a &amp;amp; b</r>", "a &amp; b"},
+        {"<r>a &amp;lt;UK&amp;gt; b</r>", "<r>a &amp;lt;UK&amp;gt; b</r>",
+         "a &lt;UK&gt; b"},
+        {"<r>a &amp;#x41; b</r>", "<r>a &amp;#x41; b</r>", "a &#x41; b"},
+        // Attribute forces the non-fused text emitter; the first four
+        // cases take the fused <name>text</name> fast path.
+        {"<r k='v'>a &amp;#x26; b</r>", "<r k=\"v\">a &amp;#x26; b</r>",
+         "a &#x26; b"},
+    };
+    for (auto& c : cases) {
+        LeptrisStatus st = LEPTRIS_OK;
+        LeptrisDocument doc = leptris_parse_string(c.xml, std::strlen(c.xml), &st);
+        ASSERT_NE(doc, nullptr) << c.xml;
+        char* serialized = leptris_document_serialize(doc, nullptr);
+        ASSERT_NE(serialized, nullptr) << c.xml;
+        EXPECT_STREQ(serialized, c.want) << c.xml;
+
+        // The emitted bytes must reparse to the same string value.
+        LeptrisDocument again = leptris_parse_string(
+            serialized, std::strlen(serialized), &st);
+        ASSERT_NE(again, nullptr) << serialized;
+        LeptrisElement root = leptris_document_root(again);
+        ASSERT_NE(root, nullptr) << serialized;
+        const char* content = leptris_element_text(root);
+        ASSERT_NE(content, nullptr) << serialized;
+        EXPECT_STREQ(content, c.want_text) << c.xml;
+        if (std::string(c.xml).find("UK") != std::string::npos) {
+            // No <UK> element may have been minted.
+            EXPECT_EQ(leptris_element_first_child(root, "UK"), nullptr) << c.xml;
+        }
+
+        leptris_document_free(again);
+        leptris_free_string(serialized);
+        leptris_document_free(doc);
+    }
+}
+
+TEST(SerializeRoundTrip, KeepsEntityRefNodesUnescaped) {
+    // KEEP_ENTITY_REFS stores named references as ENTITY_REF nodes;
+    // those still serialize as &name; (they are markup, not text).
+    const char xml[] =
+        "<!DOCTYPE r [<!ENTITY foo \"x\">]><r>a &foo; b</r>";
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisDocument doc = leptris_parse_string_flags(
+        xml, std::strlen(xml), LEPTRIS_PARSE_KEEP_ENTITY_REFS, &st);
+    ASSERT_NE(doc, nullptr);
+    char* serialized = leptris_document_serialize(doc, nullptr);
+    ASSERT_NE(serialized, nullptr);
+    EXPECT_NE(std::string(serialized).find("&foo;"), std::string::npos)
+        << serialized;
+    EXPECT_EQ(std::string(serialized).find("&amp;foo;"), std::string::npos)
+        << serialized;
+    leptris_free_string(serialized);
+    leptris_document_free(doc);
+}
+
 TEST(SerializeRoundTrip, GrowsBufferForHugeTextContent) {
     // Regression for TODO 08: buffer_ensure_capacity must grow without
     // integer overflow or silent realloc-failure corruption.

data/vendor-src/libleptris/vcpkg.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/microsoft/vcpkg/master/scripts/vcpkg.schema.json",
   "name": "leptris",
-  "version": "1.9.375",
+  "version": "1.9.377",
   "description": "High-performance XML parser and XPath 1.0 engine in C (libleptris)",
   "homepage": "https://github.com/leptris/leptris",
   "license": "MIT",

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: leptris
 version: !ruby/object:Gem::Version
-  version: 1.9.375.0
+  version: 1.9.377.0
 platform: ruby
 authors:
 - Ribose Inc.