makiri 0.2.0 → 0.4.0

data/ext/makiri/xml/mkr_xml_chars.c

@@ -0,0 +1,195 @@
+/* mkr_xml_chars.c - XML Char validation + character/entity reference expansion.
+ *
+ * Ruby-free. §9.1: only the 5 predefined entities (lt gt amp apos quot) and
+ * numeric character references (&#nn; / &#xhh;) are expanded; any other &name;
+ * is an undefined entity (SyntaxError) - there is no DTD, so no entity can be
+ * defined, which makes billion-laughs structurally impossible. §9.2: every
+ * resulting codepoint (literal or from a numeric reference) must be an XML 1.0
+ * Char; control characters / surrogates / out-of-range are rejected. The input
+ * is already valid UTF-8 (§2.1).
+ *
+ * All input reads go through the bounded reader (core mkr_span_t) and the
+ * strict core decoder (mkr_utf8_decode1) - an out-of-bounds read is
+ * structurally impossible, not a per-site convention; all output goes through
+ * the bounded writer (mkr_spanbuf_t). The lint (raw_scan_call /
+ * raw_cursor_member) keeps it that way.
+ */
+#include "mkr_xml.h"
+#include "mkr_xml_node.h"
+#include "../core/mkr_core.h"   /* mkr_span_t + mkr_utf8_decode1 */
+
+#include <string.h>
+
+int
+mkr_xml_is_char(uint32_t c)
+{
+    /* XML 1.0 §2.2 Char: #x9 | #xA | #xD | [#x20-#xD7FF] |
+     *                     [#xE000-#xFFFD] | [#x10000-#x10FFFF] */
+    return c == 0x9u || c == 0xAu || c == 0xDu
+        || (c >= 0x20u    && c <= 0xD7FFu)
+        || (c >= 0xE000u  && c <= 0xFFFDu)
+        || (c >= 0x10000u && c <= 0x10FFFFu);
+}
+
+/* Validate that [src, src+len) is entirely XML 1.0 Char, with NO entity/reference
+ * recognition (for comment/CDATA/PI content, where '&' and '<' are literal). 0 if
+ * all valid, -1 on the first malformed UTF-8 or non-Char (caller raises SYNTAX).
+ * The strict decode (truncation / bad continuation / overlong / surrogate /
+ * out-of-range -> 0) is the core mkr_utf8_decode1 - self-contained, not trusting
+ * the caller, even if some future caller feeds unvalidated bytes. */
+int
+mkr_xml_validate_chars(const char *src, uint32_t len)
+{
+    mkr_span_t s = mkr_span(src, len);
+    while (mkr_span_left(&s) > 0) {
+        uint32_t cp;
+        int bl = mkr_utf8_decode1_span(&s, &cp);
+        if (bl == 0 || !mkr_xml_is_char(cp)) return -1;
+        mkr_span_skip(&s, (size_t)bl);
+    }
+    return 0;
+}
+
+/* XML 1.0 §2.3 NameStartChar / NameChar (the full Unicode sets, not just ASCII).
+ * Element/attribute QNames and PI targets are validated against these so an
+ * ill-formed name never reaches the DOM (§9.2b). */
+int
+mkr_xml_is_name_start(uint32_t c)
+{
+    return c == ':' || (c >= 'A' && c <= 'Z') || c == '_' || (c >= 'a' && c <= 'z')
+        || (c >= 0xC0u    && c <= 0xD6u)    || (c >= 0xD8u   && c <= 0xF6u)
+        || (c >= 0xF8u    && c <= 0x2FFu)   || (c >= 0x370u  && c <= 0x37Du)
+        || (c >= 0x37Fu   && c <= 0x1FFFu)  || (c >= 0x200Cu && c <= 0x200Du)
+        || (c >= 0x2070u  && c <= 0x218Fu)  || (c >= 0x2C00u && c <= 0x2FEFu)
+        || (c >= 0x3001u  && c <= 0xD7FFu)  || (c >= 0xF900u && c <= 0xFDCFu)
+        || (c >= 0xFDF0u  && c <= 0xFFFDu)  || (c >= 0x10000u && c <= 0xEFFFFu);
+}
+
+int
+mkr_xml_is_name_char(uint32_t c)
+{
+    return mkr_xml_is_name_start(c) || c == '-' || c == '.' || (c >= '0' && c <= '9')
+        || c == 0xB7u || (c >= 0x300u && c <= 0x36Fu) || (c >= 0x203Fu && c <= 0x2040u);
+}
+
+static int
+utf8_encode(uint32_t cp, char *out)
+{
+    if (cp < 0x80u)    { out[0] = (char)cp; return 1; }
+    if (cp < 0x800u)   { out[0] = (char)(0xC0u | (cp >> 6));
+                         out[1] = (char)(0x80u | (cp & 0x3Fu)); return 2; }
+    if (cp < 0x10000u) { out[0] = (char)(0xE0u | (cp >> 12));
+                         out[1] = (char)(0x80u | ((cp >> 6) & 0x3Fu));
+                         out[2] = (char)(0x80u | (cp & 0x3Fu)); return 3; }
+    out[0] = (char)(0xF0u | (cp >> 18));
+    out[1] = (char)(0x80u | ((cp >> 12) & 0x3Fu));
+    out[2] = (char)(0x80u | ((cp >> 6) & 0x3Fu));
+    out[3] = (char)(0x80u | (cp & 0x3Fu));
+    return 4;
+}
+
+/* Expand references in [src, src+len) and validate XML Char. Output is never
+ * longer than the input (every &...; reference is >= 4 chars and yields <= 4
+ * bytes), so a buffer of `len` bytes suffices - and the bounded arena writer
+ * (mkr_xml_arena_spanbuf + core mkr_spanbuf) enforces that bound rather than
+ * trusting it (a write past it fails closed instead of overrunning the arena).
+ * Returns the arena slice and sets *out_len;
+ * returns NULL on an undefined entity / bad reference / non-XML-Char (sets
+ * *status = MKR_XML_ERR_SYNTAX) or arena OOM/LIMIT. */
+const char *
+mkr_xml_expand(mkr_xml_doc_t *doc, const char *src, uint32_t len,
+               mkr_xml_expand_mode_t mode, uint32_t *out_len, mkr_xml_status_t *status)
+{
+    /* Fail-closed contract guards: this is a public primitive (mkr_xml.h), so it
+     * must not dereference a NULL output or document even though the in-tree
+     * callers always pass real ones. out_len/status are required outputs (a NULL
+     * leaves no channel to report through -> return NULL); a len>0 expansion
+     * needs a real doc + source. All are programming errors, never recoverable
+     * input. */
+    if (out_len == NULL || status == NULL) return NULL;
+    if (len == 0) { *out_len = 0; return ""; }
+    if (doc == NULL || src == NULL) { *status = MKR_XML_ERR_INTERNAL; return NULL; }
+
+    /* All output goes through the bounded writer, so no code below can overrun
+     * the buffer - a write that would exceed `len` is refused and latches ok=0. */
+    mkr_spanbuf_t b = mkr_xml_arena_spanbuf(doc, len);
+    if (!b.ok) { *status = doc->oom; return NULL; } /* backing alloc failed */
+    mkr_span_t s = mkr_span(src, len);
+
+    while (mkr_span_left(&s) > 0) {
+        if (mkr_span_peek(&s) != '&') {
+            uint32_t cp;
+            int bl = mkr_utf8_decode1_span(&s, &cp);
+            if (bl == 0 || !mkr_xml_is_char(cp)) { *status = MKR_XML_ERR_SYNTAX; return NULL; }
+            /* §3.3.3: in an attribute value a *literal* TAB/LF/CR normalizes to a
+             * space (reference-derived whitespace is preserved - see below). */
+            if (mode == MKR_XML_EXPAND_ATTR
+                && (cp == 0x9u || cp == 0xAu || cp == 0xDu)) {
+                mkr_spanbuf_putc(&b, ' ');
+                mkr_span_skip(&s, (size_t)bl);
+                continue;
+            }
+            mkr_spanbuf_write(&b, mkr_span_mark(&s), (size_t)bl);
+            mkr_span_skip(&s, (size_t)bl);
+            continue;
+        }
+
+        /* a reference: '&' ... ';' */
+        mkr_span_skip(&s, 1); /* past '&' */
+        if (mkr_span_peek(&s) == '#') {             /* numeric character reference */
+            mkr_span_skip(&s, 1);
+            int hex = 0;
+            /* §4.1: the hex marker is a lowercase 'x' only - "&#X58;" is not-wf
+             * (an uppercase 'X' is not a decimal digit either, so it is rejected
+             * as "no digits" below). */
+            if (mkr_span_peek(&s) == 'x') { hex = 1; mkr_span_skip(&s, 1); }
+            uint32_t base = hex ? 16u : 10u;
+            uint32_t cp = 0;
+            int ndigits = 0;
+            for (;;) {
+                int d = mkr_span_peek(&s);
+                if (d < 0 || d == ';') break;
+                uint32_t dig;
+                if (d >= '0' && d <= '9')              dig = (uint32_t)(d - '0');
+                else if (hex && d >= 'a' && d <= 'f')  dig = (uint32_t)(d - 'a' + 10);
+                else if (hex && d >= 'A' && d <= 'F')  dig = (uint32_t)(d - 'A' + 10);
+                else { *status = MKR_XML_ERR_SYNTAX; return NULL; }
+                /* check BEFORE the multiply-add so a giant &#999...; can never wrap
+                 * uint32_t into the valid range and be falsely accepted. */
+                if (cp > (0x10FFFFu - dig) / base) { *status = MKR_XML_ERR_SYNTAX; return NULL; }
+                cp = cp * base + dig;
+                ndigits++;
+                mkr_span_skip(&s, 1);
+            }
+            if (mkr_span_peek(&s) != ';' || ndigits == 0) { *status = MKR_XML_ERR_SYNTAX; return NULL; } /* no ';' / no digits */
+            mkr_span_skip(&s, 1); /* past ';' */
+            if (!mkr_xml_is_char(cp)) { *status = MKR_XML_ERR_SYNTAX; return NULL; }
+            /* encode into a safe 4-byte local, then hand the exact length to the
+             * bounded writer (the encode itself can never overrun `enc`). */
+            char enc[4];
+            mkr_spanbuf_write(&b, enc, (size_t)utf8_encode(cp, enc));
+        } else {                                    /* named entity */
+            size_t nlen;
+            if (!mkr_span_find(&s, ';', &nlen)) { *status = MKR_XML_ERR_SYNTAX; return NULL; } /* unterminated */
+            const char *ns = mkr_span_mark(&s);
+            mkr_span_skip(&s, nlen + 1); /* name + ';' */
+            char ch;
+            if      (mkr_bytes_eq(ns, nlen, "lt",   2)) ch = '<';
+            else if (mkr_bytes_eq(ns, nlen, "gt",   2)) ch = '>';
+            else if (mkr_bytes_eq(ns, nlen, "amp",  3)) ch = '&';
+            else if (mkr_bytes_eq(ns, nlen, "apos", 4)) ch = '\'';
+            else if (mkr_bytes_eq(ns, nlen, "quot", 4)) ch = '"';
+            else { *status = MKR_XML_ERR_SYNTAX; return NULL; } /* undefined entity */
+            mkr_spanbuf_putc(&b, ch);
+        }
+    }
+
+    /* By construction the buffer was never overrun; finish returns NULL if a
+     * write was refused (the "output <= input" invariant broke - our bug). The
+     * backing alloc was already checked at init, so a NULL here means a refused
+     * write: fail closed rather than return a truncated expansion. */
+    const char *out = mkr_spanbuf_finish(&b);
+    if (out == NULL) { *status = MKR_XML_ERR_INTERNAL; return NULL; }
+    *out_len = (uint32_t)b.pos;
+    return out;
+}

data/ext/makiri/xml/mkr_xml_index.c

@@ -0,0 +1,169 @@
+/* Element-name index for the XML arena (see mkr_xml_index.h). Open-addressing
+ * hash keyed by (local name + namespace URI); each entry holds the
+ * document-ordered elements with that name. Two tree passes: count elements to
+ * size the table, then fill in document order. Heap-allocated (not the arena),
+ * freed on invalidate. OOM fails closed (NULL -> caller walks the tree). */
+
+#include "mkr_xml_index.h"
+#include "../core/mkr_core.h"
+
+#include <stdlib.h>
+#include <string.h>
+
+typedef struct {
+  const char     *local;      /* borrowed from the first element (arena-stable) */
+  const char     *ns_uri;     /* may be NULL (no namespace) */
+  uint32_t        local_len;
+  uint32_t        ns_uri_len;
+  mkr_xml_node_t **nodes;      /* document order */
+  size_t          count, cap;
+} mkr_xml_index_entry_t;
+
+struct mkr_xml_name_index {
+  mkr_xml_index_entry_t *buckets;
+  size_t                 cap;   /* power of two; 0 only for an empty document */
+};
+
+/* FNV-1a over the local name then the namespace URI. */
+static uint64_t
+key_hash(const char *local, size_t local_len, const char *ns_uri, size_t ns_uri_len)
+{
+  uint64_t h = 1469598103934665603ULL;
+  for (size_t i = 0; i < local_len; i++)  { h ^= (unsigned char)local[i];  h *= 1099511628211ULL; }
+  h ^= 0xff; h *= 1099511628211ULL;  /* separator so "ab"+"" != "a"+"b" */
+  for (size_t i = 0; i < ns_uri_len; i++) { h ^= (unsigned char)ns_uri[i]; h *= 1099511628211ULL; }
+  return h;
+}
+
+static int
+key_eq(const mkr_xml_index_entry_t *e, const char *local, size_t local_len,
+       const char *ns_uri, size_t ns_uri_len)
+{
+  if (e->local_len != local_len || e->ns_uri_len != ns_uri_len) return 0;
+  if (local_len && memcmp(e->local, local, local_len) != 0) return 0;
+  if (ns_uri_len && memcmp(e->ns_uri, ns_uri, ns_uri_len) != 0) return 0;
+  return 1;
+}
+
+
+/* Find the entry for the key, or the empty slot to create it (open addressing,
+ * power-of-two mask). The table is sized so it never fills (load < 0.5). */
+static mkr_xml_index_entry_t *
+slot_for(mkr_xml_name_index_t *idx, const char *local, size_t local_len,
+         const char *ns_uri, size_t ns_uri_len)
+{
+  size_t mask = idx->cap - 1;
+  size_t i = (size_t)key_hash(local, local_len, ns_uri, ns_uri_len) & mask;
+  for (;;) {
+    mkr_xml_index_entry_t *e = &idx->buckets[i];
+    if (e->local == NULL && e->count == 0) return e;            /* empty */
+    if (key_eq(e, local, local_len, ns_uri, ns_uri_len)) return e;
+    i = (i + 1) & mask;
+  }
+}
+
+/* Append +node+ to its key's bucket, creating the entry if new. 0 / -1 (OOM). */
+static int
+index_push(mkr_xml_name_index_t *idx, mkr_xml_node_t *node)
+{
+  mkr_xml_index_entry_t *e =
+      slot_for(idx, node->local, node->local_len, node->ns_uri, node->ns_uri_len);
+  if (e->local == NULL && e->count == 0) {       /* fresh entry: borrow the key */
+    e->local = node->local;          e->local_len = node->local_len;
+    e->ns_uri = node->ns_uri;        e->ns_uri_len = node->ns_uri_len;
+  }
+  if (mkr_grow_reserve((void **)&e->nodes, &e->cap, e->count + 1, sizeof(*e->nodes)) != MKR_OK) {
+    return -1;  /* grows geometrically + overflow-safely internally */
+  }
+  e->nodes[e->count++] = node;
+  return 0;
+}
+
+/* Count elements (document order is irrelevant here) to size the table. */
+static size_t
+count_elements(mkr_xml_node_t *root)
+{
+  size_t n = 0;
+  for (mkr_xml_node_t *cur = root; cur != NULL; cur = mkr_xml_preorder_next(root, cur)) {
+    if (cur->type == MKR_XML_NODE_TYPE_ELEMENT) n++;
+  }
+  return n;
+}
+
+static mkr_xml_name_index_t *
+build(mkr_xml_doc_t *doc)
+{
+  mkr_xml_node_t *root = doc->doc_node;
+  if (root == NULL) return NULL;
+
+  mkr_xml_name_index_t *idx = (mkr_xml_name_index_t *)mkr_callocarray(1, sizeof(*idx));
+  if (idx == NULL) return NULL;
+
+  size_t n = count_elements(root);
+  /* Size for load factor < 0.5 (2n+1 slots). The overflow-checked sizer fails
+   * closed - unlike the old next_pow2, which saturated to a too-small table on
+   * overflow, where open addressing could never find a free slot. */
+  size_t want;
+  if (!mkr_size_mul(n, 2, &want) || !mkr_size_add(want, 1, &want)
+      || !mkr_pow2_ceil(want, &idx->cap)) { free(idx); return NULL; }
+  if (idx->cap < 8) idx->cap = 8;              /* small floor */
+  idx->buckets = (mkr_xml_index_entry_t *)mkr_callocarray(idx->cap, sizeof(*idx->buckets));
+  if (idx->buckets == NULL) { free(idx); return NULL; }
+
+  /* Fill pass: pre-order (document order), elements only. */
+  for (mkr_xml_node_t *cur = root; cur != NULL; cur = mkr_xml_preorder_next(root, cur)) {
+    if (cur->type == MKR_XML_NODE_TYPE_ELEMENT) {
+      if (index_push(idx, cur) != 0) { mkr_xml_name_index_free(idx); return NULL; }
+    }
+  }
+  return idx;
+}
+
+mkr_xml_name_index_t *
+mkr_xml_name_index_get(mkr_xml_doc_t *doc)
+{
+  if (doc == NULL) return NULL;
+  if (doc->name_index != NULL) return (mkr_xml_name_index_t *)doc->name_index;
+  mkr_xml_name_index_t *idx = build(doc);
+  doc->name_index = idx;          /* NULL on OOM: caller walks, retries next time */
+  return idx;
+}
+
+void
+mkr_xml_name_index_free(mkr_xml_name_index_t *idx)
+{
+  if (idx == NULL) return;
+  if (idx->buckets != NULL) {
+    for (size_t i = 0; i < idx->cap; i++) free(idx->buckets[i].nodes);
+    free(idx->buckets);
+  }
+  free(idx);
+}
+
+void
+mkr_xml_name_index_invalidate(mkr_xml_doc_t *doc)
+{
+  if (doc == NULL || doc->name_index == NULL) return;
+  mkr_xml_name_index_free((mkr_xml_name_index_t *)doc->name_index);
+  doc->name_index = NULL;
+}
+
+mkr_xml_node_t *const *
+mkr_xml_name_index_lookup(const mkr_xml_name_index_t *idx,
+                          const char *local, size_t local_len,
+                          const char *ns_uri, size_t ns_uri_len, size_t *out_count)
+{
+  if (out_count != NULL) *out_count = 0;
+  if (idx == NULL || idx->cap == 0 || local == NULL) return NULL;
+  size_t mask = idx->cap - 1;
+  size_t i = (size_t)key_hash(local, local_len, ns_uri, ns_uri_len) & mask;
+  for (;;) {
+    const mkr_xml_index_entry_t *e = &idx->buckets[i];
+    if (e->local == NULL && e->count == 0) return NULL;          /* miss */
+    if (key_eq(e, local, local_len, ns_uri, ns_uri_len)) {
+      if (out_count != NULL) *out_count = e->count;
+      return e->nodes;
+    }
+    i = (i + 1) & mask;
+  }
+}

data/ext/makiri/xml/mkr_xml_index.h

@@ -0,0 +1,48 @@
+#ifndef MKR_XML_INDEX_H
+#define MKR_XML_INDEX_H
+
+#include "mkr_xml_node.h"
+#include <stddef.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * Element-name index for the XML arena: maps each (local name + namespace URI)
+ * to the document-ordered list of elements bearing it, so a document-rooted
+ * descendant name test (//entry, css("entry")) is answered from the bucket
+ * instead of walking the whole tree. The HTML side has the analogous tag-id
+ * index; XML element names are arbitrary strings, so this is keyed by the name
+ * bytes (borrowed from the arena, stable until the next mutation).
+ *
+ * Lazily built and cached on the document; dropped by
+ * mkr_xml_name_index_invalidate from the single XML mutation hook (the same
+ * discipline as the HTML attr/text indices). Build OOM fails closed: the getter
+ * returns NULL and the caller walks the tree.
+ */
+typedef struct mkr_xml_name_index mkr_xml_name_index_t;
+
+/* The document's element-name index, built and cached on first call. Returns
+ * NULL on OOM (caller falls back to a tree walk). */
+mkr_xml_name_index_t *mkr_xml_name_index_get(mkr_xml_doc_t *doc);
+
+/* Drop the cached index after a structural mutation (no-op when unbuilt). */
+void mkr_xml_name_index_invalidate(mkr_xml_doc_t *doc);
+
+/* Free an index directly (used by mkr_xml_doc_destroy via the invalidate hook). */
+void mkr_xml_name_index_free(mkr_xml_name_index_t *idx);
+
+/* The document-ordered elements with local name +local+ and namespace URI
+ * +ns_uri+ (ns_uri == NULL / ns_uri_len == 0 means the no-namespace bucket).
+ * Returns the borrowed bucket and sets *out_count, or NULL with *out_count 0. */
+mkr_xml_node_t *const *mkr_xml_name_index_lookup(const mkr_xml_name_index_t *idx,
+                                                 const char *local, size_t local_len,
+                                                 const char *ns_uri, size_t ns_uri_len,
+                                                 size_t *out_count);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* MKR_XML_INDEX_H */