makiri 0.12.0-aarch64-linux → 0.12.1-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '080648651b5e8e38a405373a252b0ded69f1e5a672c6e5031e0f31058b09fa80'
-  data.tar.gz: c13624a3a5ed5e94e4d0adc761280e498fbf3e34891ba41d46cfeeed762bcf68
+  metadata.gz: dad06ebaa7e4fa5fec68080e1714a5be6b72dc89172ff5f1f7840d6e73f4cffe
+  data.tar.gz: fe535f36f6d2f28acd4b3bd6c40f2d2f5c1a288affe5dc94ddd22d520c4e8ae7
 SHA512:
-  metadata.gz: ba444c67f4c84cbe0d3a9317ddcfbbf6854daf1c9fa0a020e16e319ac9d8e98e693fa0b245ba8f3abb3bf9e0f7837af77238c7c0d4557d9d268d1b0465bd24cd
-  data.tar.gz: c822e0c488221872b85fc6d8390dea3ee1b72def3c35ae160750102a26115047a84ca0f06df2f0b3ee34b7b3dacc011edbb7c56de27cff93e96fb7e9f9132360
+  metadata.gz: 444bfeb89cb88fe1e3bed19008401e0c8f09043e803722c4dac63c88063a53eaa8a9e097b08f5b11c25f83a76e4d5f7630d99846c4f1c9131feafb72351a17aa
+  data.tar.gz: c296890d6e35f332fb975542d2eebe5dd7b4283cbc3012715c43a37917aa82d40492136fe045ab44362e26572b09b3e1f9dc52b9f059d40d1fa93f3f25d5e11c

data/.github/workflows/css-match.yml

@@ -0,0 +1,180 @@
+name: CSS matcher
+
+# The HTML CSS matcher (`lexbor::css_match`) on its own: it answers every
+# `Node#css` / `#at_css` / `#matches?`, and its failure mode is not a crash
+# but a wrong answer, which the general suites only catch by example. Two
+# checks, both against the OLD engine - Lexbor's own `lxb_selectors`, kept as
+# `lexbor::selectors` for exactly this:
+#
+#   - the randomized differential tests in `lexbor::tests::css_match`, run long
+#     with a fresh seed (MAKIRI_CSS_DIFF_SEED; a failure prints it);
+#   - the cargo-fuzz targets `html_css` (memory safety, and the three entry
+#     points agreeing) and `html_css_diff` (agreement with Lexbor's engine),
+#     with the selector dictionary.
+#
+# A PR that touches the matcher, the Lexbor layer or the pin gets a short run;
+# the nightly one is long. A disagreement on a shape where css_match departs
+# from Lexbor on purpose is not a finding: the departures are listed in
+# `css_match`'s module doc, and both checks leave them out.
+
+on:
+  push:
+    branches: [main, master]
+    paths:
+      - "ext/makiri/rust/src/lexbor/**"
+      - "ext/makiri/rust/fuzz/**"
+      - "ext/makiri/rust/Cargo.toml"
+      - "vendor/lexbor"
+      - ".github/workflows/css-match.yml"
+  pull_request:
+    paths:
+      - "ext/makiri/rust/src/lexbor/**"
+      - "ext/makiri/rust/fuzz/**"
+      - "ext/makiri/rust/Cargo.toml"
+      - "vendor/lexbor"
+      - ".github/workflows/css-match.yml"
+  schedule:
+    - cron: "41 4 * * *"
+  workflow_dispatch:
+
+env:
+  # Short on a push or PR, long on the nightly schedule.
+  LONG: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+
+jobs:
+  differential:
+    name: Randomized differential (vs Lexbor's engine)
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Checkout (with vendored Lexbor submodule)
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Ensure cmake is available
+        uses: lukka/get-cmake@latest
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Install libclang (bindgen, via rb-sys)
+        run: sudo apt-get update && sudo apt-get install -y libclang-dev
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+
+      # build.rs links the vendored Lexbor archive and reads its headers.
+      - name: Compile the extension (builds Lexbor)
+        run: bundle exec rake compile
+
+      # Release: the sweep is the point, and debug is ~10x slower. The seed is
+      # fresh per run, so a long series covers new ground; it is printed here
+      # and in any failure, so a finding reproduces.
+      - name: Run the css_match tests with a fresh seed
+        working-directory: ext/makiri/rust
+        run: |
+          export MAKIRI_CSS_DIFF_SEED=$(printf '0x%x' $(( (GITHUB_RUN_ID * 2654435761 + GITHUB_RUN_ATTEMPT) & 0xffffffffffff )))
+          if [ "$LONG" = true ]; then
+            export MAKIRI_CSS_DIFF_ITERATIONS=1000000
+          else
+            export MAKIRI_CSS_DIFF_ITERATIONS=20000
+          fi
+          echo "MAKIRI_CSS_DIFF_SEED=$MAKIRI_CSS_DIFF_SEED MAKIRI_CSS_DIFF_ITERATIONS=$MAKIRI_CSS_DIFF_ITERATIONS"
+          cargo test --release --no-default-features --features lexbor -- \
+            lexbor::tests::css_match lexbor::tests::selector_cache
+
+  fuzz:
+    name: cargo-fuzz ${{ matrix.target }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [html_css, html_css_diff]
+    steps:
+      - name: Checkout (with vendored Lexbor submodule)
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Ensure cmake is available
+        uses: lukka/get-cmake@latest
+
+      # -Zsanitizer is unstable, and cargo-fuzz needs it.
+      - uses: dtolnay/rust-toolchain@nightly
+
+      - name: Install libclang (bindgen, via rb-sys)
+        run: sudo apt-get update && sudo apt-get install -y libclang-dev
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+
+      - name: Compile the extension (builds Lexbor)
+        run: bundle exec rake compile
+
+      - name: Install cargo-fuzz
+        run: cargo install cargo-fuzz --locked
+
+      - name: Build the fuzz target
+        working-directory: ext/makiri/rust/fuzz
+        run: cargo fuzz build ${{ matrix.target }}
+
+      # As in libfuzzer.yml: nm -u reads 0 on Linux whether or not the binary
+      # is instrumented, so assert on the full symbol table.
+      - name: Assert the target is instrumented
+        working-directory: ext/makiri/rust/fuzz
+        run: |
+          bin=$(ls target/*/release/${{ matrix.target }})
+          reports=$(nm "$bin" | grep -c '__asan_report')
+          echo "$bin: __asan_report symbols = $reports"
+          test "$reports" -gt 0 || { echo "not ASan-instrumented"; exit 1; }
+
+      # Both targets read the same `selector NUL document` input, so each
+      # also starts from the other's corpus (read-only: new units go to the
+      # first directory). The cache prefix is libfuzzer.yml's, so the corpus
+      # accumulated there carries over.
+      - name: Restore the corpus
+        uses: actions/cache@v6
+        with:
+          path: ext/makiri/rust/fuzz/corpus/${{ matrix.target }}
+          key: cargo-fuzz-corpus-${{ matrix.target }}-${{ github.run_id }}
+          restore-keys: |
+            cargo-fuzz-corpus-${{ matrix.target }}-
+
+      - name: Restore the sibling corpus
+        uses: actions/cache/restore@v6
+        with:
+          path: ext/makiri/rust/fuzz/corpus/${{ matrix.target == 'html_css' && 'html_css_diff' || 'html_css' }}
+          key: cargo-fuzz-corpus-${{ matrix.target == 'html_css' && 'html_css_diff' || 'html_css' }}-${{ github.run_id }}
+          restore-keys: |
+            cargo-fuzz-corpus-${{ matrix.target == 'html_css' && 'html_css_diff' || 'html_css' }}-
+
+      # -timeout: html_css_diff runs Lexbor's exhaustively backtracking engine
+      # too; the harness skips inputs it cannot afford, and this is the stop
+      # for one it misjudged.
+      - name: Run cargo-fuzz ${{ matrix.target }}
+        working-directory: ext/makiri/rust/fuzz
+        run: |
+          sibling=${{ matrix.target == 'html_css' && 'html_css_diff' || 'html_css' }}
+          mkdir -p corpus/${{ matrix.target }} corpus/$sibling
+          if [ "$LONG" = true ]; then seconds=3600; else seconds=180; fi
+          cargo fuzz run ${{ matrix.target }} corpus/${{ matrix.target }} corpus/$sibling -- \
+            -max_total_time=$seconds \
+            -max_len=4096 \
+            -timeout=30 \
+            -dict=css.dict \
+            -print_final_stats=1
+
+      - name: Upload reproducers
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: cargo-fuzz-artifacts-${{ matrix.target }}
+          path: ext/makiri/rust/fuzz/artifacts/${{ matrix.target }}
+          retention-days: 30

data/.github/workflows/libfuzzer.yml

@@ -25,7 +25,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: [xml, xpath, xml_xpath, css, html, html_xpath, html_css]
+        # html_css and html_css_diff run in css-match.yml, with the selector
+        # dictionary and a longer budget.
+        target: [xml, xpath, xml_xpath, css, html, html_xpath]
 
     steps:
       - name: Checkout (with vendored Lexbor submodule)

data/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## [0.12.1] - 2026-10-02
+
+### Fixed
+
+* Passing a string literal from a file without
+  `# frozen_string_literal: true` no longer warns "literal string will be
+  frozen in the future" on Ruby 3.4+ (with deprecation warnings enabled).
+* A fragment parsed with a context element from another document
+  (`fragment(context:)`, `DocumentFragment.parse(context:)`) no longer keeps
+  a reference into that document, which could be read after that document was
+  freed.
+* The 10,000-option limit per `<select>` now also counts the options a
+  fragment parsed in a select context receives (`inner_html=` and
+  `outer_html=` on or inside a select, `fragment(context: "select")`).
+  Before, they went uncounted, and inserting them took time quadratic in
+  their number.
+* A String `context:` naming a node that is not an element (`"#text"`,
+  `"!--"`, ...) raises `ArgumentError`.
+
+### Security
+
+* Hardening against Lexbor edge cases in fragment parsing, node copying,
+  element creation and serialization. Serialization is now always Makiri's
+  own walk, which uses no native recursion, so `to_html` / `inner_html` are
+  about 3% slower.
+
 ## [0.12.0] - 2026-10-01
 
 Most changes accept what the DOM allows where 0.11.0 raised. The XML

data/Rakefile

@@ -857,7 +857,9 @@ namespace :fuzz do
   # library and headers (the crate's build.rs links the archive and generates
   # the layout from the headers), which `rake compile` produces - hence the
   # dependency, which is about Lexbor rather than about the bundle.
-  FUZZ_TARGETS = %w[xml xpath xml_xpath css html html_xpath html_css].freeze
+  FUZZ_TARGETS = %w[xml xpath xml_xpath css html html_xpath html_css html_css_diff].freeze
+  # The targets whose input starts with a CSS selector take its dictionary.
+  FUZZ_CSS_DICT = %w[html_css html_css_diff].freeze
 
   # The local mode: TARGETS=css,html_xpath narrows the run to what you touched,
   # and the time is FUZZ_TIME seconds per target (default 60) or FUZZ_BUDGET
@@ -916,8 +918,9 @@ namespace :fuzz do
     env, sanitizer = libfuzzer_invocation
     Dir.chdir("ext/makiri/rust/fuzz") do
       targets.each do |target|
+        dict = FUZZ_CSS_DICT.include?(target) ? ["-dict=css.dict"] : []
         sh env, "cargo", "fuzz", "run", *sanitizer, target, "--",
-           "-max_total_time=#{time}", "-max_len=4096"
+           "-max_total_time=#{time}", "-max_len=4096", *dict
       end
     end
   end

data/lib/makiri/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Makiri
-  VERSION = "0.12.0"
+  VERSION = "0.12.1"
 end

data/script/check_unsafe_boundaries.rb

@@ -31,14 +31,14 @@ RUST = File.join(ROOT, "ext/makiri/rust/src")
 UNSAFE_ISLANDS = {
   "bridge/alloc.rs" => 4,
   "bridge/doc.rs" => 3,
-  "bridge/fragment.rs" => 5,
+  "bridge/fragment.rs" => 6,
   "bridge/gvl.rs" => 5,
   "bridge/html.rs" => 17,
   "bridge/node_set.rs" => 8,
   "bridge/node_wrap.rs" => 1,
   "bridge/ruby.rs" => 18,
   "bridge/stack.rs" => 1,
-  "bridge/string.rs" => 28,
+  "bridge/string.rs" => 29,
   "bridge/typed.rs" => 21,
   "bridge/wrapper.rs" => 19,
   "bridge/xml.rs" => 11,
@@ -56,14 +56,14 @@ UNSAFE_ISLANDS = {
   "lexbor/adapter/arena_bytes.rs" => 14,
   "lexbor/adapter/cross_import.rs" => 2,
   "lexbor/adapter/html/attrs.rs" => 20,
-  "lexbor/adapter/html/build.rs" => 19,
-  "lexbor/adapter/html/mod.rs" => 60,
+  "lexbor/adapter/html/build.rs" => 24,
+  "lexbor/adapter/html/mod.rs" => 62,
   "lexbor/adapter/html/mutate.rs" => 9,
-  "lexbor/adapter/html/serialize.rs" => 9,
+  "lexbor/adapter/html/serialize.rs" => 18,
   "lexbor/adapter/post_parse.rs" => 13,
   "lexbor/adapter/source_loc.rs" => 2,
   "lexbor/adapter/text_index.rs" => 1,
-  "lexbor/adapter/tree_guard.rs" => 8,
+  "lexbor/adapter/tree_guard.rs" => 9,
   "lexbor/chunks.rs" => 2,
   "lexbor/css_engine.rs" => 14,
   "lexbor/css_parser.rs" => 21,
@@ -74,7 +74,7 @@ UNSAFE_ISLANDS = {
   "lexbor/selectors.rs" => 9,
   "lexbor/serialize.rs" => 2,
   "lexbor/stylesheet.rs" => 7,
-  "lexbor/tests.rs" => 14,
+  "lexbor/tests.rs" => 16,
   "lexbor/xpath.rs" => 9,
   "token.rs" => 1,
 }.freeze
@@ -462,7 +462,7 @@ end
 # is generated, so its signature is Lexbor's. A new hand declaration of a
 # header-declared function belongs in build.rs's allowlist instead; one with no
 # header belongs in build.rs's UNDECLARED_EXPORTS as well as here.
-LEXBOR_HAND_DECLS = 4
+LEXBOR_HAND_DECLS = 5
 abi_decls = comments_removed(File.binread(File.join(RUST, "lexbor/abi.rs"))).scan(LEXBOR_DECL).length
 if abi_decls != LEXBOR_HAND_DECLS
   errors << "lexbor/abi.rs hand-declares #{abi_decls} Lexbor functions (expected " \

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: makiri
 version: !ruby/object:Gem::Version
-  version: 0.12.0
+  version: 0.12.1
 platform: aarch64-linux
 authors:
 - takahashim
@@ -64,6 +64,7 @@ extra_rdoc_files: []
 files:
 - ".github/workflows/ci.yml"
 - ".github/workflows/conformance.yml"
+- ".github/workflows/css-match.yml"
 - ".github/workflows/libfuzzer.yml"
 - ".github/workflows/release.yml"
 - ".github/workflows/security.yml"