makiri 0.12.0 → 0.12.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 19309bc1e3663b299aa192c879718ffb75926783690cd1213338c472d7d439fe
-  data.tar.gz: 0a7498c693ec14f659ea75dcd85c02af153fe5c19b172f62ffcaaf3d2c549ab0
+  metadata.gz: 6432135ca3963c17f432c152ede49162c3f1be48e96179b914c971f0b2da1b76
+  data.tar.gz: 2b0478171ee224ea5c29ae19cd0a16a08c3d786e017444241d4bb8f620ecf975
 SHA512:
-  metadata.gz: 2465968a7f276bf2c93b4d0e37928a3d292f05212e37d0148a29b529494a3ef52e51ae2679c478c4b11994ad229fac5e6869f7d169c4293bab68ae791e654a5b
-  data.tar.gz: 1ffe5dd03e3d00914ecf4c6753000a6a82dfc160deb7b0d4b3fa6da93d27dbd082c6e073f63f6d35c2b6ad2ae7f508edb9f011da7cfb50ba70235bd96eea4c50
+  metadata.gz: 8447a816ba507fb6a74ed8e6a5a92deaff6da2453ef29ba6cfe24652ec160b440409ec94b58b4aa89d3d28ab05643086f4dd1bba150339eeff27819d2e3d86d7
+  data.tar.gz: 2a9505ac1b1762cbdbc738645542acbda4bb029e06e5b4befe76f63e39e6e55a9f36a34106dd0fe24d3103d17f020939498373d9c872cb2042d71b23bb0d6513

data/.github/workflows/css-match.yml

@@ -0,0 +1,180 @@
+name: CSS matcher
+
+# The HTML CSS matcher (`lexbor::css_match`) on its own: it answers every
+# `Node#css` / `#at_css` / `#matches?`, and its failure mode is not a crash
+# but a wrong answer, which the general suites only catch by example. Two
+# checks, both against the OLD engine - Lexbor's own `lxb_selectors`, kept as
+# `lexbor::selectors` for exactly this:
+#
+#   - the randomized differential tests in `lexbor::tests::css_match`, run long
+#     with a fresh seed (MAKIRI_CSS_DIFF_SEED; a failure prints it);
+#   - the cargo-fuzz targets `html_css` (memory safety, and the three entry
+#     points agreeing) and `html_css_diff` (agreement with Lexbor's engine),
+#     with the selector dictionary.
+#
+# A PR that touches the matcher, the Lexbor layer or the pin gets a short run;
+# the nightly one is long. A disagreement on a shape where css_match departs
+# from Lexbor on purpose is not a finding: the departures are listed in
+# `css_match`'s module doc, and both checks leave them out.
+
+on:
+  push:
+    branches: [main, master]
+    paths:
+      - "ext/makiri/rust/src/lexbor/**"
+      - "ext/makiri/rust/fuzz/**"
+      - "ext/makiri/rust/Cargo.toml"
+      - "vendor/lexbor"
+      - ".github/workflows/css-match.yml"
+  pull_request:
+    paths:
+      - "ext/makiri/rust/src/lexbor/**"
+      - "ext/makiri/rust/fuzz/**"
+      - "ext/makiri/rust/Cargo.toml"
+      - "vendor/lexbor"
+      - ".github/workflows/css-match.yml"
+  schedule:
+    - cron: "41 4 * * *"
+  workflow_dispatch:
+
+env:
+  # Short on a push or PR, long on the nightly schedule.
+  LONG: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+
+jobs:
+  differential:
+    name: Randomized differential (vs Lexbor's engine)
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Checkout (with vendored Lexbor submodule)
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Ensure cmake is available
+        uses: lukka/get-cmake@latest
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Install libclang (bindgen, via rb-sys)
+        run: sudo apt-get update && sudo apt-get install -y libclang-dev
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+
+      # build.rs links the vendored Lexbor archive and reads its headers.
+      - name: Compile the extension (builds Lexbor)
+        run: bundle exec rake compile
+
+      # Release: the sweep is the point, and debug is ~10x slower. The seed is
+      # fresh per run, so a long series covers new ground; it is printed here
+      # and in any failure, so a finding reproduces.
+      - name: Run the css_match tests with a fresh seed
+        working-directory: ext/makiri/rust
+        run: |
+          export MAKIRI_CSS_DIFF_SEED=$(printf '0x%x' $(( (GITHUB_RUN_ID * 2654435761 + GITHUB_RUN_ATTEMPT) & 0xffffffffffff )))
+          if [ "$LONG" = true ]; then
+            export MAKIRI_CSS_DIFF_ITERATIONS=1000000
+          else
+            export MAKIRI_CSS_DIFF_ITERATIONS=20000
+          fi
+          echo "MAKIRI_CSS_DIFF_SEED=$MAKIRI_CSS_DIFF_SEED MAKIRI_CSS_DIFF_ITERATIONS=$MAKIRI_CSS_DIFF_ITERATIONS"
+          cargo test --release --no-default-features --features lexbor -- \
+            lexbor::tests::css_match lexbor::tests::selector_cache
+
+  fuzz:
+    name: cargo-fuzz ${{ matrix.target }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [html_css, html_css_diff]
+    steps:
+      - name: Checkout (with vendored Lexbor submodule)
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Ensure cmake is available
+        uses: lukka/get-cmake@latest
+
+      # -Zsanitizer is unstable, and cargo-fuzz needs it.
+      - uses: dtolnay/rust-toolchain@nightly
+
+      - name: Install libclang (bindgen, via rb-sys)
+        run: sudo apt-get update && sudo apt-get install -y libclang-dev
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true
+
+      - name: Compile the extension (builds Lexbor)
+        run: bundle exec rake compile
+
+      - name: Install cargo-fuzz
+        run: cargo install cargo-fuzz --locked
+
+      - name: Build the fuzz target
+        working-directory: ext/makiri/rust/fuzz
+        run: cargo fuzz build ${{ matrix.target }}
+
+      # As in libfuzzer.yml: nm -u reads 0 on Linux whether or not the binary
+      # is instrumented, so assert on the full symbol table.
+      - name: Assert the target is instrumented
+        working-directory: ext/makiri/rust/fuzz
+        run: |
+          bin=$(ls target/*/release/${{ matrix.target }})
+          reports=$(nm "$bin" | grep -c '__asan_report')
+          echo "$bin: __asan_report symbols = $reports"
+          test "$reports" -gt 0 || { echo "not ASan-instrumented"; exit 1; }
+
+      # Both targets read the same `selector NUL document` input, so each
+      # also starts from the other's corpus (read-only: new units go to the
+      # first directory). The cache prefix is libfuzzer.yml's, so the corpus
+      # accumulated there carries over.
+      - name: Restore the corpus
+        uses: actions/cache@v6
+        with:
+          path: ext/makiri/rust/fuzz/corpus/${{ matrix.target }}
+          key: cargo-fuzz-corpus-${{ matrix.target }}-${{ github.run_id }}
+          restore-keys: |
+            cargo-fuzz-corpus-${{ matrix.target }}-
+
+      - name: Restore the sibling corpus
+        uses: actions/cache/restore@v6
+        with:
+          path: ext/makiri/rust/fuzz/corpus/${{ matrix.target == 'html_css' && 'html_css_diff' || 'html_css' }}
+          key: cargo-fuzz-corpus-${{ matrix.target == 'html_css' && 'html_css_diff' || 'html_css' }}-${{ github.run_id }}
+          restore-keys: |
+            cargo-fuzz-corpus-${{ matrix.target == 'html_css' && 'html_css_diff' || 'html_css' }}-
+
+      # -timeout: html_css_diff runs Lexbor's exhaustively backtracking engine
+      # too; the harness skips inputs it cannot afford, and this is the stop
+      # for one it misjudged.
+      - name: Run cargo-fuzz ${{ matrix.target }}
+        working-directory: ext/makiri/rust/fuzz
+        run: |
+          sibling=${{ matrix.target == 'html_css' && 'html_css_diff' || 'html_css' }}
+          mkdir -p corpus/${{ matrix.target }} corpus/$sibling
+          if [ "$LONG" = true ]; then seconds=3600; else seconds=180; fi
+          cargo fuzz run ${{ matrix.target }} corpus/${{ matrix.target }} corpus/$sibling -- \
+            -max_total_time=$seconds \
+            -max_len=4096 \
+            -timeout=30 \
+            -dict=css.dict \
+            -print_final_stats=1
+
+      - name: Upload reproducers
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: cargo-fuzz-artifacts-${{ matrix.target }}
+          path: ext/makiri/rust/fuzz/artifacts/${{ matrix.target }}
+          retention-days: 30

data/.github/workflows/libfuzzer.yml

@@ -25,7 +25,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: [xml, xpath, xml_xpath, css, html, html_xpath, html_css]
+        # html_css and html_css_diff run in css-match.yml, with the selector
+        # dictionary and a longer budget.
+        target: [xml, xpath, xml_xpath, css, html, html_xpath]
 
     steps:
       - name: Checkout (with vendored Lexbor submodule)

data/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## [0.12.1] - 2026-10-02
+
+### Fixed
+
+* Passing a string literal from a file without
+  `# frozen_string_literal: true` no longer warns "literal string will be
+  frozen in the future" on Ruby 3.4+ (with deprecation warnings enabled).
+* A fragment parsed with a context element from another document
+  (`fragment(context:)`, `DocumentFragment.parse(context:)`) no longer keeps
+  a reference into that document, which could be read after that document was
+  freed.
+* The 10,000-option limit per `<select>` now also counts the options a
+  fragment parsed in a select context receives (`inner_html=` and
+  `outer_html=` on or inside a select, `fragment(context: "select")`).
+  Before, they went uncounted, and inserting them took time quadratic in
+  their number.
+* A String `context:` naming a node that is not an element (`"#text"`,
+  `"!--"`, ...) raises `ArgumentError`.
+
+### Security
+
+* Hardening against Lexbor edge cases in fragment parsing, node copying,
+  element creation and serialization. Serialization is now always Makiri's
+  own walk, which uses no native recursion, so `to_html` / `inner_html` are
+  about 3% slower.
+
 ## [0.12.0] - 2026-10-01
 
 Most changes accept what the DOM allows where 0.11.0 raised. The XML

data/Rakefile

@@ -857,7 +857,9 @@ namespace :fuzz do
   # library and headers (the crate's build.rs links the archive and generates
   # the layout from the headers), which `rake compile` produces - hence the
   # dependency, which is about Lexbor rather than about the bundle.
-  FUZZ_TARGETS = %w[xml xpath xml_xpath css html html_xpath html_css].freeze
+  FUZZ_TARGETS = %w[xml xpath xml_xpath css html html_xpath html_css html_css_diff].freeze
+  # The targets whose input starts with a CSS selector take its dictionary.
+  FUZZ_CSS_DICT = %w[html_css html_css_diff].freeze
 
   # The local mode: TARGETS=css,html_xpath narrows the run to what you touched,
   # and the time is FUZZ_TIME seconds per target (default 60) or FUZZ_BUDGET
@@ -916,8 +918,9 @@ namespace :fuzz do
     env, sanitizer = libfuzzer_invocation
     Dir.chdir("ext/makiri/rust/fuzz") do
       targets.each do |target|
+        dict = FUZZ_CSS_DICT.include?(target) ? ["-dict=css.dict"] : []
         sh env, "cargo", "fuzz", "run", *sanitizer, target, "--",
-           "-max_total_time=#{time}", "-max_len=4096"
+           "-max_total_time=#{time}", "-max_len=4096", *dict
       end
     end
   end

data/ext/makiri/rust/Cargo.toml

@@ -44,8 +44,9 @@ expect_used = "warn"
 panic = "warn"
 
 [features]
-# Three features, and each names a real optional dependency rather than a step
-# of the C port: a Ruby runtime, a vendored C library, and a test hook.
+# Four features. Three name a real optional dependency rather than a step of
+# the C port - a Ruby runtime, a vendored C library, and a test hook - and the
+# fourth, `css-reference`, a test reference (below).
 #
 # The port's thirty-seven per-file flags are gone. They existed so one C file at
 # a time could be replaced behind an identical ABI; there is no C left to
@@ -68,6 +69,11 @@ lexbor = []
 # `falloc::should_fail` is a const false and the branch disappears.
 alloc-inject = []
 
+# The OLD `lxb_selectors` engine (`lexbor::selectors`) outside `cfg(test)`, as
+# the reference the `html_css_diff` fuzz harness holds `css_match` to. Never
+# part of a build that ships.
+css-reference = ["lexbor"]
+
 [dependencies]
 # Only the `ruby` feature needs these; the engine builds without them, which is
 # what lets Kani and cargo-fuzz compile it. `rb-sys` is magnus's own binding

data/ext/makiri/rust/build.rs

@@ -287,12 +287,15 @@ fn main() {
         .allowlist_function("lxb_css_property_serialize")
         .allowlist_function("lxb_css_property_serialize_name")
         .allowlist_function("lxb_css_selector_serialize_chain")
-        // The HTML serializers `lexbor::serialize` drives through its sink.
-        .allowlist_function("lxb_html_serialize_tree_cb")
-        // One node's own markup: Makiri drives the walk
+        // One node's own markup, plain and pretty: Makiri drives the walk
         // itself (`adapter::html::serialize`), so a <template> writes its
-        // contents and not its own children, as the HTML Standard says.
+        // contents and not its own children, as the HTML Standard says, and
+        // no tree depth grows the native stack.
         .allowlist_function("lxb_html_serialize_cb")
+        .allowlist_function("lxb_html_serialize_pretty_cb")
+        // Lexbor's own walks, which those replaced: the reference the
+        // `serialize_walk` tests compare against, and called nowhere else.
+        .allowlist_function("lxb_html_serialize_tree_cb")
         .allowlist_function("lxb_html_serialize_deep_cb")
         .allowlist_function("lxb_html_serialize_pretty_tree_cb")
         .allowlist_function("lxb_html_serialize_pretty_deep_cb")
@@ -407,6 +410,12 @@ const UNDECLARED_EXPORTS: &[(&str, &str, &str, &str)] = &[
         "lxb_dom_element_t *element, const lxb_char_t *prefix, size_t prefix_len, \
          const lxb_char_t *lname, size_t lname_len",
     ),
+    (
+        "lexbor/ns/ns.c",
+        "LXB_API const lxb_ns_data_t *",
+        "lxb_ns_append",
+        "lexbor_hash_t *hash, const lxb_char_t *link, size_t length",
+    ),
 ];
 
 fn check_undeclared_exports(include: &std::path::Path) {

data/ext/makiri/rust/fuzz/Cargo.toml

@@ -18,7 +18,9 @@ libfuzzer-sys = "0.4"
 [dependencies.makiri_rs]
 path = ".."
 default-features = false
-features = ["lexbor"]
+# `css-reference` adds the OLD CSS engine, the reference `html_css_diff`
+# compares against; it ships in no build of the extension.
+features = ["lexbor", "css-reference"]
 
 [[bin]]
 name = "xml"
@@ -68,3 +70,10 @@ path = "fuzz_targets/html_css.rs"
 test = false
 doc = false
 bench = false
+
+[[bin]]
+name = "html_css_diff"
+path = "fuzz_targets/html_css_diff.rs"
+test = false
+doc = false
+bench = false

data/ext/makiri/rust/fuzz/css.dict

@@ -0,0 +1,77 @@
+# Selector tokens for the HTML CSS targets (html_css, html_css_diff): the
+# input is `selector NUL document`, and byte-level mutation alone rarely keeps
+# a selector parseable long enough to reach the matcher's deep paths.
+sep="\x00"
+c_desc=" "
+c_child=" > "
+c_next=" + "
+c_sub=" ~ "
+c_col=" || "
+comma=", "
+star="*"
+id="#a"
+cls=".a"
+cls2=".b"
+t_div="div"
+t_p="p"
+t_li="li"
+t_ul="ul"
+t_a="a"
+t_span="span"
+t_input="input"
+t_svg="svg"
+t_ns="svg|circle"
+a_has="[a]"
+a_eq="[a=x]"
+a_inc="[a~=x]"
+a_dash="[a|=x]"
+a_pre="[a^=x]"
+a_suf="[a$=x]"
+a_sub="[a*=x]"
+a_i=" i]"
+a_s=" s]"
+p_first=":first-child"
+p_last=":last-child"
+p_only=":only-child"
+p_fot=":first-of-type"
+p_lot=":last-of-type"
+p_oot=":only-of-type"
+p_empty=":empty"
+p_root=":root"
+p_link=":link"
+p_anylink=":any-link"
+p_req=":required"
+p_opt=":optional"
+p_ro=":read-only"
+p_rw=":read-write"
+p_ph=":placeholder-shown"
+p_hover=":hover"
+p_focus=":focus"
+p_checked=":checked"
+p_disabled=":disabled"
+p_enabled=":enabled"
+f_is=":is("
+f_where=":where("
+f_not=":not("
+f_has=":has("
+f_has_child=":has(> "
+f_has_next=":has(+ "
+f_has_sub=":has(~ "
+f_nth=":nth-child("
+f_nthl=":nth-last-child("
+f_nthot=":nth-of-type("
+f_nthlot=":nth-last-of-type("
+anb_odd="odd"
+anb_even="even"
+anb_1="2n+1"
+anb_2="-n+3"
+anb_of=" of "
+close=")"
+h_div="<div class=a id=a>"
+h_p="<p a=x>"
+h_li="<ul><li>"
+h_a="<a href=x>"
+h_input="<input required placeholder=x>"
+h_svg="<svg><circle r=1></svg>"
+h_close="</div>"
+h_quirks="<!doctype html>"

data/ext/makiri/rust/fuzz/fuzz_targets/html_css.rs

@@ -62,23 +62,25 @@ fuzz_target!(|data: &[u8]| {
     // SAFETY: `p` owns the document and outlives every handle made here.
     let root = unsafe { p.raw_doc().as_doc() }.as_node();
     for _ in 0..2 {
-        let checked = selector_cache::with_compiled(&gvl, text.as_bytes(), |groups, scratch| {
+        let answered = selector_cache::with_compiled(&gvl, text.as_bytes(), |groups, scratch| {
             check(root, groups, scratch)
         });
-        if checked.is_err() {
+        // A refusal is the budget doing its job, and each refused query spends
+        // the whole of it: asking again (or the same query a second way) only
+        // multiplies the run, which under ASan went past libFuzzer's timeout.
+        if !matches!(answered, Ok(true)) {
             return;
         }
     }
 });
 
-/// The walking query and the one-candidate query agree (module doc).
-fn check(root: HtmlNode<'_>, groups: Lists<'_>, scratch: &mut Scratch) {
-    let all = select_all(scratch, root, groups);
-    let first = select_first(scratch, root, groups);
-    let Ok(all) = all else {
-        return;
+/// The walking query and the one-candidate query agree (module doc). False
+/// when a query refused, so the caller stops.
+fn check(root: HtmlNode<'_>, groups: Lists<'_>, scratch: &mut Scratch) -> bool {
+    let Ok(all) = select_all(scratch, root, groups) else {
+        return false;
     };
-    if let Ok(first) = first {
+    if let Ok(first) = select_first(scratch, root, groups) {
         assert!(
             first == all.first().copied(),
             "select_first is not the first of select_all"
@@ -90,7 +92,7 @@ fn check(root: HtmlNode<'_>, groups: Lists<'_>, scratch: &mut Scratch) {
         .take(ONE_BY_ONE)
     {
         let Ok(matched) = matches_any(scratch, groups, el) else {
-            return;
+            return false;
         };
         assert_eq!(
             matched,
@@ -98,4 +100,5 @@ fn check(root: HtmlNode<'_>, groups: Lists<'_>, scratch: &mut Scratch) {
             "matches? and css disagree on an element"
         );
     }
+    true
 }