makiri 0.12.0-aarch64-linux → 0.13.0-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '080648651b5e8e38a405373a252b0ded69f1e5a672c6e5031e0f31058b09fa80'
-  data.tar.gz: c13624a3a5ed5e94e4d0adc761280e498fbf3e34891ba41d46cfeeed762bcf68
+  metadata.gz: c38568d5e92468d6f4da1275cf823cdc615d079c6a0293236ad5c85897647df1
+  data.tar.gz: 33701440893a286012dcdba48d78cd30d69af8d27fff9bc3691603e5e4151900
 SHA512:
-  metadata.gz: ba444c67f4c84cbe0d3a9317ddcfbbf6854daf1c9fa0a020e16e319ac9d8e98e693fa0b245ba8f3abb3bf9e0f7837af77238c7c0d4557d9d268d1b0465bd24cd
-  data.tar.gz: c822e0c488221872b85fc6d8390dea3ee1b72def3c35ae160750102a26115047a84ca0f06df2f0b3ee34b7b3dacc011edbb7c56de27cff93e96fb7e9f9132360
+  metadata.gz: '0586c38ca0fbbac3cc9da9d3147db3d58c2f1380991a06bf412f17d92029023fbfca96289c91b8bfc30a1a25e1a26a8df8e8e5ada81cbfaf62074eae396868d1'
+  data.tar.gz: 85f351046a3e65e9e0c8f8d725b5aa585555f6055798f4d80ace09fe16f8ef28b8f00124ac9ce7de3e5e1047ae0b01cf263636f712818d402600bc0e996b1e9f

data/.github/workflows/css-match.yml

@@ -0,0 +1,180 @@
+name: CSS matcher
+
+# The HTML CSS matcher (`lexbor::css_match`) on its own: it answers every
+# `Node#css` / `#at_css` / `#matches?`, and its failure mode is not a crash
+# but a wrong answer, which the general suites only catch by example. Two
+# checks, both against the OLD engine - Lexbor's own `lxb_selectors`, kept as
+# `lexbor::selectors` for exactly this:
+#
+#   - the randomized differential tests in `lexbor::tests::css_match`, run long
+#     with a fresh seed (MAKIRI_CSS_DIFF_SEED; a failure prints it);
+#   - the cargo-fuzz targets `html_css` (memory safety, and the three entry
+#     points agreeing) and `html_css_diff` (agreement with Lexbor's engine),
+#     with the selector dictionary.
+#
+# A PR that touches the matcher, the Lexbor layer or the pin gets a short run;
+# the nightly one is long. A disagreement on a shape where css_match departs
+# from Lexbor on purpose is not a finding: the departures are listed in
+# `css_match`'s module doc, and both checks leave them out.
+
+on:
+  push:
+    branches: [main, master]
+    paths:
+      - "ext/makiri/rust/src/lexbor/**"
+      - "ext/makiri/rust/fuzz/**"
+      - "ext/makiri/rust/Cargo.toml"
+      - "vendor/lexbor"
+      - ".github/workflows/css-match.yml"
+  pull_request:
+    paths:
+      - "ext/makiri/rust/src/lexbor/**"
+      - "ext/makiri/rust/fuzz/**"
+      - "ext/makiri/rust/Cargo.toml"
+      - "vendor/lexbor"
+      - ".github/workflows/css-match.yml"
+  schedule:
+    - cron: "41 4 * * *"
+  workflow_dispatch:
+
+env:
+  # Short on a push or PR, long on the nightly schedule.
+  LONG: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+
+jobs:
+  differential:
+    name: Randomized differential (vs Lexbor's engine)
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Checkout (with vendored Lexbor submodule)
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Ensure cmake is available
+        uses: lukka/get-cmake@latest
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Install libclang (bindgen, via rb-sys)
+        run: sudo apt-get update && sudo apt-get install -y libclang-dev
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+
+      # build.rs links the vendored Lexbor archive and reads its headers.
+      - name: Compile the extension (builds Lexbor)
+        run: bundle exec rake compile
+
+      # Release: the sweep is the point, and debug is ~10x slower. The seed is
+      # fresh per run, so a long series covers new ground; it is printed here
+      # and in any failure, so a finding reproduces.
+      - name: Run the css_match tests with a fresh seed
+        working-directory: ext/makiri/rust
+        run: |
+          export MAKIRI_CSS_DIFF_SEED=$(printf '0x%x' $(( (GITHUB_RUN_ID * 2654435761 + GITHUB_RUN_ATTEMPT) & 0xffffffffffff )))
+          if [ "$LONG" = true ]; then
+            export MAKIRI_CSS_DIFF_ITERATIONS=1000000
+          else
+            export MAKIRI_CSS_DIFF_ITERATIONS=20000
+          fi
+          echo "MAKIRI_CSS_DIFF_SEED=$MAKIRI_CSS_DIFF_SEED MAKIRI_CSS_DIFF_ITERATIONS=$MAKIRI_CSS_DIFF_ITERATIONS"
+          cargo test --release --no-default-features --features lexbor -- \
+            lexbor::tests::css_match lexbor::tests::selector_cache
+
+  fuzz:
+    name: cargo-fuzz ${{ matrix.target }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [html_css, html_css_diff]
+    steps:
+      - name: Checkout (with vendored Lexbor submodule)
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Ensure cmake is available
+        uses: lukka/get-cmake@latest
+
+      # -Zsanitizer is unstable, and cargo-fuzz needs it.
+      - uses: dtolnay/rust-toolchain@nightly
+
+      - name: Install libclang (bindgen, via rb-sys)
+        run: sudo apt-get update && sudo apt-get install -y libclang-dev
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+
+      - name: Compile the extension (builds Lexbor)
+        run: bundle exec rake compile
+
+      - name: Install cargo-fuzz
+        run: cargo install cargo-fuzz --locked
+
+      - name: Build the fuzz target
+        working-directory: ext/makiri/rust/fuzz
+        run: cargo fuzz build ${{ matrix.target }}
+
+      # As in libfuzzer.yml: nm -u reads 0 on Linux whether or not the binary
+      # is instrumented, so assert on the full symbol table.
+      - name: Assert the target is instrumented
+        working-directory: ext/makiri/rust/fuzz
+        run: |
+          bin=$(ls target/*/release/${{ matrix.target }})
+          reports=$(nm "$bin" | grep -c '__asan_report')
+          echo "$bin: __asan_report symbols = $reports"
+          test "$reports" -gt 0 || { echo "not ASan-instrumented"; exit 1; }
+
+      # Both targets read the same `selector NUL document` input, so each
+      # also starts from the other's corpus (read-only: new units go to the
+      # first directory). The cache prefix is libfuzzer.yml's, so the corpus
+      # accumulated there carries over.
+      - name: Restore the corpus
+        uses: actions/cache@v6
+        with:
+          path: ext/makiri/rust/fuzz/corpus/${{ matrix.target }}
+          key: cargo-fuzz-corpus-${{ matrix.target }}-${{ github.run_id }}
+          restore-keys: |
+            cargo-fuzz-corpus-${{ matrix.target }}-
+
+      - name: Restore the sibling corpus
+        uses: actions/cache/restore@v6
+        with:
+          path: ext/makiri/rust/fuzz/corpus/${{ matrix.target == 'html_css' && 'html_css_diff' || 'html_css' }}
+          key: cargo-fuzz-corpus-${{ matrix.target == 'html_css' && 'html_css_diff' || 'html_css' }}-${{ github.run_id }}
+          restore-keys: |
+            cargo-fuzz-corpus-${{ matrix.target == 'html_css' && 'html_css_diff' || 'html_css' }}-
+
+      # -timeout: html_css_diff runs Lexbor's exhaustively backtracking engine
+      # too; the harness skips inputs it cannot afford, and this is the stop
+      # for one it misjudged.
+      - name: Run cargo-fuzz ${{ matrix.target }}
+        working-directory: ext/makiri/rust/fuzz
+        run: |
+          sibling=${{ matrix.target == 'html_css' && 'html_css_diff' || 'html_css' }}
+          mkdir -p corpus/${{ matrix.target }} corpus/$sibling
+          if [ "$LONG" = true ]; then seconds=3600; else seconds=180; fi
+          cargo fuzz run ${{ matrix.target }} corpus/${{ matrix.target }} corpus/$sibling -- \
+            -max_total_time=$seconds \
+            -max_len=4096 \
+            -timeout=30 \
+            -dict=css.dict \
+            -print_final_stats=1
+
+      - name: Upload reproducers
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: cargo-fuzz-artifacts-${{ matrix.target }}
+          path: ext/makiri/rust/fuzz/artifacts/${{ matrix.target }}
+          retention-days: 30

data/.github/workflows/libfuzzer.yml

@@ -25,7 +25,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: [xml, xpath, xml_xpath, css, html, html_xpath, html_css]
+        # html_css and html_css_diff run in css-match.yml, with the selector
+        # dictionary and a longer budget.
+        target: [xml, xpath, xml_xpath, css, html, html_xpath]
 
     steps:
       - name: Checkout (with vendored Lexbor submodule)

data/CHANGELOG.md

@@ -1,5 +1,55 @@
 # Changelog
 
+## [0.13.0] - 2026-10-03
+
+### Added
+
+* `Document#tree_version` (HTML and XML): an Integer that increases whenever
+  a child list in the document changes - nodes added, removed or replaced,
+  `inner_html=`, `content=`, and both documents when a node moves between
+  them. Attribute changes leave it as it is, so it can key a cache of child
+  lists.
+* `Element#attribute_value_ns(ns, local)` and `#attribute_node_ns(ns, local)`
+  (HTML and XML): the attribute's value or Attr node by namespace and local
+  name, like the DOM's `getAttributeNS` / `getAttributeNodeNS`. `nil` or `""`
+  means no namespace.
+* `Element#set_loose_dom_attribute(name, value)` now works on HTML nodes too.
+  Like the DOM's `setAttribute`, it sets an attribute in no namespace whose
+  name may contain a colon (`v-on:click`).
+
+### Fixed
+
+* HTML documents keep namespace URIs as written. `create_element_ns`,
+  `set_attribute_ns` and `import_node` lower-cased them (`fooNamespace` read
+  back as `foonamespace`), and a differently cased XHTML namespace URI made
+  an HTML element.
+
+## [0.12.1] - 2026-10-02
+
+### Fixed
+
+* Passing a string literal from a file without
+  `# frozen_string_literal: true` no longer warns "literal string will be
+  frozen in the future" on Ruby 3.4+ (with deprecation warnings enabled).
+* A fragment parsed with a context element from another document
+  (`fragment(context:)`, `DocumentFragment.parse(context:)`) no longer keeps
+  a reference into that document, which could be read after that document was
+  freed.
+* The 10,000-option limit per `<select>` now also counts the options a
+  fragment parsed in a select context receives (`inner_html=` and
+  `outer_html=` on or inside a select, `fragment(context: "select")`).
+  Before, they went uncounted, and inserting them took time quadratic in
+  their number.
+* A String `context:` naming a node that is not an element (`"#text"`,
+  `"!--"`, ...) raises `ArgumentError`.
+
+### Security
+
+* Hardening against Lexbor edge cases in fragment parsing, node copying,
+  element creation and serialization. Serialization is now always Makiri's
+  own walk, which uses no native recursion, so `to_html` / `inner_html` are
+  about 3% slower.
+
 ## [0.12.0] - 2026-10-01
 
 Most changes accept what the DOM allows where 0.11.0 raised. The XML

data/README.md

@@ -50,7 +50,7 @@ doc = Makiri::HTML(<<~HTML)
   </body></html>
 HTML
 
-# CSS selectors (Lexbor's selector engine)
+# CSS selectors (Lexbor's selector parser, Makiri's own matcher)
 doc.css("a").map { |a| a["href"] }      # => ["/a", "/b"]
 doc.at_css("p.lead").text               # => "Hello"
 
@@ -184,6 +184,27 @@ and unusually large documents can raise it with `max_bytes:`.
 Makiri::XML(huge_xml, max_bytes: 512 * 1024 * 1024)   # also Makiri::XML::Document.parse(..., max_bytes:)
 ```
 
+### Node identity
+
+Navigating to the same node always gives the same Ruby object, for as long as
+its document is alive. The document keeps every wrapper it has handed out, so
+instance variables, singleton methods and `freeze` set on a node survive
+garbage collection and are there the next time the node is reached.
+
+That makes a node a safe place to keep per-node state, such as a wrapper
+object of your own:
+
+```ruby
+el = doc.at_css("p")
+el.instance_variable_set(:@wrapper, MyElement.new(el))
+doc.at_css("p").instance_variable_get(:@wrapper)   # => the same MyElement
+```
+
+A node created by `clone_node` or `import_node` is a new node with no state.
+`pointer_id` is unique only among live nodes: once a document is freed, a node
+of another document may reuse its value. So key a pointer-based cache per
+document, not across documents.
+
 ## Non-goals (v1.0)
 
 * XSLT, DTD / Schema / RelaxNG validation, XPointer, XInclude.
@@ -224,6 +245,7 @@ See also [`spec/conformance/README.md`](spec/conformance/README.md).
 | XPath 1.0 | XML | `Nokogiri::XML` — differential | `conformance:xpath_xml` |
 | Parsed tree (property-based) | XML | `Nokogiri::XML` — differential | `conformance:xml_pbt` |
 | CSS selectors | XML | `Nokogiri::XML` — differential | `conformance:css_xml` |
+| XML Builder | Ruby DSL | `Nokogiri::XML::Builder` — differential | `conformance:builder` |
 
 ## Requirements
 

data/Rakefile

@@ -857,7 +857,9 @@ namespace :fuzz do
   # library and headers (the crate's build.rs links the archive and generates
   # the layout from the headers), which `rake compile` produces - hence the
   # dependency, which is about Lexbor rather than about the bundle.
-  FUZZ_TARGETS = %w[xml xpath xml_xpath css html html_xpath html_css].freeze
+  FUZZ_TARGETS = %w[xml xpath xml_xpath css html html_xpath html_css html_css_diff].freeze
+  # The targets whose input starts with a CSS selector take its dictionary.
+  FUZZ_CSS_DICT = %w[html_css html_css_diff].freeze
 
   # The local mode: TARGETS=css,html_xpath narrows the run to what you touched,
   # and the time is FUZZ_TIME seconds per target (default 60) or FUZZ_BUDGET
@@ -916,8 +918,9 @@ namespace :fuzz do
     env, sanitizer = libfuzzer_invocation
     Dir.chdir("ext/makiri/rust/fuzz") do
       targets.each do |target|
+        dict = FUZZ_CSS_DICT.include?(target) ? ["-dict=css.dict"] : []
         sh env, "cargo", "fuzz", "run", *sanitizer, target, "--",
-           "-max_total_time=#{time}", "-max_len=4096"
+           "-max_total_time=#{time}", "-max_len=4096", *dict
       end
     end
   end

data/lib/makiri/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Makiri
-  VERSION = "0.12.0"
+  VERSION = "0.13.0"
 end

data/script/check_unsafe_boundaries.rb

@@ -31,14 +31,14 @@ RUST = File.join(ROOT, "ext/makiri/rust/src")
 UNSAFE_ISLANDS = {
   "bridge/alloc.rs" => 4,
   "bridge/doc.rs" => 3,
-  "bridge/fragment.rs" => 5,
+  "bridge/fragment.rs" => 6,
   "bridge/gvl.rs" => 5,
   "bridge/html.rs" => 17,
   "bridge/node_set.rs" => 8,
   "bridge/node_wrap.rs" => 1,
   "bridge/ruby.rs" => 18,
   "bridge/stack.rs" => 1,
-  "bridge/string.rs" => 28,
+  "bridge/string.rs" => 29,
   "bridge/typed.rs" => 21,
   "bridge/wrapper.rs" => 19,
   "bridge/xml.rs" => 11,
@@ -55,15 +55,15 @@ UNSAFE_ISLANDS = {
   "lexbor/abi.rs" => 4,
   "lexbor/adapter/arena_bytes.rs" => 14,
   "lexbor/adapter/cross_import.rs" => 2,
-  "lexbor/adapter/html/attrs.rs" => 20,
-  "lexbor/adapter/html/build.rs" => 19,
-  "lexbor/adapter/html/mod.rs" => 60,
+  "lexbor/adapter/html/attrs.rs" => 23,
+  "lexbor/adapter/html/build.rs" => 25,
+  "lexbor/adapter/html/mod.rs" => 63,
   "lexbor/adapter/html/mutate.rs" => 9,
-  "lexbor/adapter/html/serialize.rs" => 9,
+  "lexbor/adapter/html/serialize.rs" => 18,
   "lexbor/adapter/post_parse.rs" => 13,
   "lexbor/adapter/source_loc.rs" => 2,
   "lexbor/adapter/text_index.rs" => 1,
-  "lexbor/adapter/tree_guard.rs" => 8,
+  "lexbor/adapter/tree_guard.rs" => 9,
   "lexbor/chunks.rs" => 2,
   "lexbor/css_engine.rs" => 14,
   "lexbor/css_parser.rs" => 21,
@@ -74,7 +74,7 @@ UNSAFE_ISLANDS = {
   "lexbor/selectors.rs" => 9,
   "lexbor/serialize.rs" => 2,
   "lexbor/stylesheet.rs" => 7,
-  "lexbor/tests.rs" => 14,
+  "lexbor/tests.rs" => 16,
   "lexbor/xpath.rs" => 9,
   "token.rs" => 1,
 }.freeze
@@ -462,7 +462,7 @@ end
 # is generated, so its signature is Lexbor's. A new hand declaration of a
 # header-declared function belongs in build.rs's allowlist instead; one with no
 # header belongs in build.rs's UNDECLARED_EXPORTS as well as here.
-LEXBOR_HAND_DECLS = 4
+LEXBOR_HAND_DECLS = 5
 abi_decls = comments_removed(File.binread(File.join(RUST, "lexbor/abi.rs"))).scan(LEXBOR_DECL).length
 if abi_decls != LEXBOR_HAND_DECLS
   errors << "lexbor/abi.rs hand-declares #{abi_decls} Lexbor functions (expected " \

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: makiri
 version: !ruby/object:Gem::Version
-  version: 0.12.0
+  version: 0.13.0
 platform: aarch64-linux
 authors:
 - takahashim
@@ -64,6 +64,7 @@ extra_rdoc_files: []
 files:
 - ".github/workflows/ci.yml"
 - ".github/workflows/conformance.yml"
+- ".github/workflows/css-match.yml"
 - ".github/workflows/libfuzzer.yml"
 - ".github/workflows/release.yml"
 - ".github/workflows/security.yml"