moxml 0.5.148 → 0.5.150

data/lib/moxml/adapter/libxml.rb

@@ -7,23 +7,26 @@ require "libxml-ruby"
 module Moxml
   module Adapter
     class Libxml < Base
-      # DOCTYPE prolog sniffer; see parse for the index-then-match
-      # strategy that keeps this off the hot path.
-      DOCTYPE_RE = /<!DOCTYPE\s+([^\s>]+)(?:\s+PUBLIC\s+"([^"]+)"\s+"([^"]+)"|\s+SYSTEM\s+"([^"]+)")?\s*>/i
-      private_constant :DOCTYPE_RE
+      # DOCTYPE prolog scanning is manual (index/char scan): a regex
+      # over hostile prolog text backtracks polynomially on inputs
+      # with repeated <!DOCTYPE prefixes or unterminated subsets
+      # (CodeQL rb/polynomial-redos). See doctype_parts.
+      DOCTYPE_OPEN_SIZE = 9
+      QUOTES = ['"', "'"].freeze
 
       autoload :EntityRefRegistry, "moxml/adapter/libxml/entity_ref_registry"
 
       # Wrapper class to store DOCTYPE information
       class DoctypeWrapper
         attr_reader :native_doc
-        attr_accessor :name, :external_id, :system_id
+        attr_accessor :name, :external_id, :system_id, :internal_subset
 
-        def initialize(doc, name, external_id, system_id)
+        def initialize(doc, name, external_id, system_id, internal_subset = nil)
           @native_doc = doc
           @name = name
           @external_id = external_id
           @system_id = system_id
+          @internal_subset = internal_subset
         end
 
         # Provide native method to match adapter pattern
@@ -32,7 +35,8 @@ module Moxml
         end
 
         def to_xml
-          XmlEmitter.doctype_xml(@name, @external_id, @system_id)
+          XmlEmitter.doctype_xml(@name, @external_id, @system_id,
+                                 @internal_subset)
         end
       end
 
@@ -83,6 +87,108 @@ module Moxml
           false
         end
 
+        def add_sibling_returns_inserted?
+          true
+        end
+
+        # Linear DOCTYPE prolog scanner. Returns
+        # {name:, external_id:, system_id:, internal_subset:} or nil.
+        # Single pass, quote- and bracket-aware: no backtracking, so
+        # hostile prolog text cannot make parsing superlinear.
+        def doctype_parts(source, from = 0)
+          start = source.index("<!DOCTYPE", from)
+          return unless start
+
+          pos = skip_doctype_space(source, start + DOCTYPE_OPEN_SIZE)
+          name_start = pos
+          pos += 1 while pos < source.length &&
+              !" \t\r\n>".include?(source[pos])
+          name = source[name_start...pos]
+          return if name.empty?
+
+          pos = skip_doctype_space(source, pos)
+          external_id = nil
+          system_id = nil
+          keyword = source[pos, 6].to_s.upcase
+          if keyword == "PUBLIC"
+            pos = skip_doctype_space(source, pos + 6)
+            pair = scan_doctype_quoted(source, pos)
+            return unless pair
+
+            external_id, pos = pair
+            pos = skip_doctype_space(source, pos)
+            pair = scan_doctype_quoted(source, pos)
+            return unless pair
+
+            system_id, pos = pair
+          elsif keyword == "SYSTEM"
+            pos = skip_doctype_space(source, pos + 6)
+            pair = scan_doctype_quoted(source, pos)
+            return unless pair
+
+            system_id, pos = pair
+          end
+
+          pos = skip_doctype_space(source, pos)
+          internal_subset = nil
+          if source[pos] == "["
+            subset_start = pos + 1
+            pos = matching_subset_end(source, pos + 1)
+            return unless pos
+
+            internal_subset = source[subset_start...pos]
+            pos += 1
+          end
+
+          pos = skip_doctype_space(source, pos)
+          return unless source[pos] == ">"
+
+          {
+            name: name,
+            external_id: external_id,
+            system_id: system_id,
+            internal_subset: internal_subset,
+          }
+        end
+
+        def skip_doctype_space(source, pos)
+          pos += 1 while pos < source.length &&
+              " \t\r\n".include?(source[pos])
+          pos
+        end
+
+        def scan_doctype_quoted(source, pos)
+          quote = source[pos]
+          return unless QUOTES.include?(quote)
+
+          stop = source.index(quote, pos + 1)
+          return unless stop
+
+          [source[(pos + 1)...stop], stop + 1]
+        end
+
+        # Index just past the closing bracket at nesting depth zero,
+        # or nil when the subset is unterminated.
+        def matching_subset_end(source, pos)
+          depth = 1
+          quote = nil
+          while pos < source.length
+            char = source[pos]
+            if quote
+              quote = nil if char == quote
+            elsif QUOTES.include?(char)
+              quote = char
+            elsif char == "["
+              depth += 1
+            elsif char == "]"
+              depth -= 1
+              return pos if depth.zero?
+            end
+            pos += 1
+          end
+          nil
+        end
+
         def parse(xml, options = {}, _context = nil)
           # LibXML doesn't preserve DOCTYPE during parsing, so we need to extract it manually
           xml_string = if xml.is_a?(String)
@@ -99,19 +205,24 @@ module Moxml
           xml_string = preprocess_entities(xml_string)
 
           # Extract DOCTYPE before parsing. Locate the literal first:
-          # a plain memscan is ~2x cheaper than the regex's literal
-          # prefix scan on doctype-less documents (the common case),
-          # and matching from the found offset keeps captures
-          # identical.
+          # a plain memscan keeps doctype-less documents (the common
+          # case) off the scanner path; the scan itself is linear.
           doctype_idx = xml_string.index("<!DOCTYPE")
-          doctype_match = if doctype_idx
-                            xml_string.match(DOCTYPE_RE, doctype_idx)
-                          end
+          doctype = doctype_idx && doctype_parts(xml_string, doctype_idx)
 
           native_doc = begin
             # Handle both string and file inputs
             parser = ::LibXML::XML::Parser.string(xml_string)
             parser.parse
+          rescue ::ArgumentError => e
+            # Invalid byte sequences raise ArgumentError from Ruby's
+            # encoding checks before libxml sees the bytes; the
+            # facade names them (taxonomy differential, malformed
+            # class).
+            raise Moxml::ParseError.new(
+              e.message,
+              source: xml.is_a?(String) ? xml[0..100] : nil,
+            )
           rescue ::LibXML::XML::Error => e
             if options[:strict]
               line = e.line
@@ -127,16 +238,17 @@ module Moxml
           end
 
           # Store DOCTYPE if found
-          if doctype_match
-            name = doctype_match[1]
-            external_id = doctype_match[2]
-            system_id = doctype_match[3] || doctype_match[4]
+          if doctype
+            name = doctype[:name]
+            external_id = doctype[:external_id]
+            system_id = doctype[:system_id]
 
             doctype_wrapper = DoctypeWrapper.new(
               native_doc,
               name,
               external_id,
               system_id,
+              doctype[:internal_subset],
             )
             attachments.set(native_doc, :doctype, doctype_wrapper)
           end
@@ -672,7 +784,8 @@ module Moxml
           return unless node && sibling
 
           native_node = unpatch_node(node)
-          native_sibling = unpatch_node(sibling)
+          native_sibling = import_for_attachment(native_node,
+                                                 unpatch_node(sibling))
 
           # Special handling for document-level processing instructions
           # When adding a PI as sibling to root element, store it on document
@@ -686,14 +799,35 @@ module Moxml
           end
 
           native_node.prev = native_sibling
+          native_sibling
         end
 
         def add_next_sibling(node, sibling)
           return unless node && sibling
 
           native_node = unpatch_node(node)
-          native_sibling = unpatch_node(sibling)
+          native_sibling = import_for_attachment(native_node,
+                                                 unpatch_node(sibling))
           native_node.next = native_sibling
+          native_sibling
+        end
+
+        # A markup fragment parsed by the facade lives in its own
+        # document; libxml refuses cross-document attachment. Import
+        # (deep-copy) into the target document and hand back the copy —
+        # the caller refreshes its wrapper to this native.
+        def import_for_attachment(native_node, native_sibling)
+          return native_sibling unless
+            native_node.is_a?(::LibXML::XML::Node) &&
+              native_sibling.is_a?(::LibXML::XML::Node)
+
+          target = native_node.doc
+          return native_sibling if target.nil?
+
+          source = native_sibling.doc
+          return native_sibling if source.equal?(target)
+
+          target.import(native_sibling)
         end
 
         def remove(node)
@@ -855,7 +989,8 @@ module Moxml
 
         def processing_instruction_content(node)
           # XML 1.0 §2.6: PI content is verbatim — no entity resolution.
-          unpatch_node(node)&.content
+          # Empty data is the empty string, never nil (uniform Kind face).
+          unpatch_node(node)&.content.to_s
         end
 
         def set_processing_instruction_content(node, content)
@@ -936,12 +1071,12 @@ module Moxml
 
         # libxml-ruby 5.x exposes no external/system ID accessor on
         # the DTD node — the DOCTYPE source text is the only source,
-        # so re-derive from it (same DOCTYPE_RE as the parse path).
+        # so re-derive from it (same linear scanner as the parse path).
         def doctype_external_id(native)
           if native.is_a?(DoctypeWrapper)
             native.external_id
           else
-            native.to_s[DOCTYPE_RE, 2]
+            Libxml.doctype_parts(native.to_s)&.dig(:external_id)
           end
         end
 
@@ -949,7 +1084,7 @@ module Moxml
           if native.is_a?(DoctypeWrapper)
             native.system_id
           else
-            native.to_s[DOCTYPE_RE, 3] || native.to_s[DOCTYPE_RE, 4]
+            Libxml.doctype_parts(native.to_s)&.dig(:system_id)
           end
         end
 
@@ -957,13 +1092,21 @@ module Moxml
           native_node = unpatch_node(node)
           return [] unless native_node
 
+          if empty_default_namespace_binding?(namespaces)
+            return Moxml::XPath.evaluate_natives(native_node, expression,
+                                                namespaces,
+                                                adapter: :libxml)
+          end
+
           # libxml-ruby's Document#find returns EMPTY for relative
           # paths (nokogiri/libxml2 evaluate them fine): a relative
           # expression from the document node is equivalent to the
           # absolute form — the document's only name-testable child
           # is the root — so rewrite instead of losing the match.
+          # Function calls and unions are not name-test paths: a
+          # "/count(...)" rewrite is invalid XPath (scalar arm).
           if native_node.is_a?(::LibXML::XML::Document) &&
-              expression.match?(/\A[A-Za-z_*@]/)
+              relative_name_path?(expression)
             expression = "/#{expression}"
           end
 
@@ -997,6 +1140,16 @@ module Moxml
           results&.first
         end
 
+        # A relative name-test path (the only shape the document-context
+        # rewrite is for): a name/`*`/`@` start, no function call (the
+        # scalar arm), no union.
+        def relative_name_path?(expression)
+          return false unless expression.match?(/\A[A-Za-z_*@]/)
+          return false if expression.match?(/\A[A-Za-z][\w.-]*\s*\(/)
+
+          !expression.include?("|")
+        end
+
         # Shallow duplication: copies the node itself (name, attrs, namespaces)
         # but NOT its descendants (deep duplication composes this).
         # walks the source tree and re-adds children one at a time via
@@ -1019,6 +1172,7 @@ module Moxml
                 node.name,
                 node.external_id,
                 node.system_id,
+                node.internal_subset,
               )
             else
               node

data/lib/moxml/adapter/nokogiri.rb

@@ -58,6 +58,10 @@ module Moxml
           true
         end
 
+        def element_indent_supported?
+          true
+        end
+
         # --- XSLT (Moxml::XSLT contract, libxslt-backed) ---
 
         def xslt_compile(sheet_source)
@@ -646,6 +650,12 @@ module Moxml
         end
 
         def xpath(node, expression, namespaces = nil)
+          if empty_default_namespace_binding?(namespaces)
+            return Moxml::XPath.evaluate_natives(node, expression,
+                                                 namespaces,
+                                                 adapter: :nokogiri)
+          end
+
           # An explicit bindings hash — even EMPTY — makes nokogiri
           # register a prefix context, which disables libxml2's
           # literal xmlns: default-namespace handling. Only pass the

data/lib/moxml/adapter/oga.rb

@@ -28,8 +28,23 @@ module Moxml
           doc.children << element
         end
 
+        # The UTF-8 BOM is an encoding signature, not content (model,
+        # Parsing); Oga otherwise leaves it in the tree as a
+        # document-level text node.
+        def strip_bom(xml)
+          return xml unless xml.is_a?(String)
+
+          if defined?(Encoding) && xml.encoding == Encoding::BINARY
+            xml.byteslice(0, 3) == "\xEF\xBB\xBF".b ? xml.byteslice(3..) : xml
+          elsif xml.start_with?("")
+            xml[1..]
+          else
+            xml
+          end
+        end
+
         def parse(xml, options = {}, _context = nil)
-          processed_xml = preprocess_entities(xml)
+          processed_xml = strip_bom(preprocess_entities(xml))
 
           native_doc = begin
             ::Oga.parse_xml(processed_xml, strict: options[:strict])
@@ -40,6 +55,18 @@ module Moxml
             )
           end
 
+          # Rootless parses (empty or declaration-only input) are
+          # malformed: XML requires exactly one root. Oga returns a
+          # bare document where nokogiri/leptris raise — the facade
+          # names it instead (loudness differential, TODO.sota/01).
+          if options[:strict] && native_doc.respond_to?(:root_node) &&
+              native_doc.children.none?(::Oga::XML::Element)
+            raise Moxml::ParseError.new(
+              "document has no root element",
+              source: xml.is_a?(String) ? xml[0..100] : nil,
+            )
+          end
+
           # Oga parses multiple root elements leniently; the moxml
           # contract requires a single root. to_a because the vendored
           # fork's NodeSet#count ignores its block.
@@ -191,7 +218,15 @@ module Moxml
 
         def namespace(element)
           case element
-          when ::Oga::XML::Element, ::Oga::XML::Attribute
+          when ::Oga::XML::Attribute
+            # Unprefixed attributes are in no namespace, always
+            # (Namespaces 1.0 §5.2). Oga resolves them against the
+            # element's default namespace, which is wrong and makes
+            # bare-name reads miss under a default namespace.
+            return nil if element.namespace_name.nil?
+
+            element.namespace
+          when ::Oga::XML::Element
             element.namespace
           end
         rescue NoMethodError
@@ -235,10 +270,10 @@ module Moxml
         def children(node, **_entity_bearing)
           all_children = []
 
-          if node.is_a?(::Oga::XML::Document)
-            all_children += [node.xml_declaration,
-                             node.doctype].compact
-          end
+          # The XML declaration is document state, not a child node
+          # (model, Object model): it never appears in children listings.
+          # The doctype follows the Nokogiri contract and is listed.
+          all_children << node.doctype if node.is_a?(::Oga::XML::Document) && node.doctype
 
           return all_children unless node.is_a?(::Oga::XML::Node) || node.is_a?(::Oga::XML::Document)
 
@@ -499,7 +534,13 @@ module Moxml
         end
 
         def processing_instruction_content(node)
-          node.text
+          # Oga keeps the target/content separator space inside the
+          # PI's text; the model's content is the data AFTER the
+          # separator. Separator whitespace is parser syntax, and
+          # leaving it in makes canonicalization non-idempotent (the
+          # serializer re-adds the separator each round — TODO.sota/02,
+          # M2).
+          node.text.to_s.sub(/\A\s+/, "")
         end
 
         def set_processing_instruction_content(node, content)
@@ -547,10 +588,31 @@ module Moxml
         end
 
         def xpath(node, expression, namespaces = nil)
+          # oga's engine has no xmlns: default-namespace idiom
+          # (D-01); the reference engine implements it (model,
+          # Names and namespaces).
+          if expression.include?("xmlns:")
+            return Moxml::XPath.evaluate_natives(
+              node, expression, namespaces || {}, adapter: :oga
+            )
+          end
+
           result = node.xpath(expression, {},
                               namespaces: namespaces&.transform_keys(&:to_s))
-          # Adapter contract: Array<native> | scalar
-          result.is_a?(Enumerable) ? result.to_a : result
+          # Adapter contract: Array<native> | scalar. Oga's engine
+          # answers node-sets in evaluation order, not document order
+          # (//* on <r><a><b/></a><c/></r> answers a,c,b); path results
+          # are document-ordered by the model — re-order here
+          # (TODO.sota/02, M3).
+          if result.is_a?(Enumerable)
+            nodes = result.to_a
+            ctx = Context.new(:oga)
+            wrapped = nodes.map { |n| Moxml::Node.wrap(n, ctx) }
+            ordered = Moxml::XPath::Ordering.document_order(wrapped)
+            ordered.map(&:native)
+          else
+            result
+          end
         rescue ::LL::ParserError => e
           raise Moxml::XPathError.new(
             e.message,

data/lib/moxml/adapter/ox.rb

@@ -60,13 +60,28 @@ module Moxml
               assign_parents(doc)
               doc
             end
-          rescue ::Ox::ParseError => e
+          rescue ::Ox::ParseError, ::RuntimeError => e
+            # Ox leaks raw RuntimeErrors from some malformed shapes
+            # (e.g. declaration-only input reaches Element#<<); the
+            # facade names every parse-time engine failure.
             raise Moxml::ParseError.new(
               e.message,
               source: xml.is_a?(String) ? xml[0..100] : nil,
             )
           end
 
+          # Rootless parses (empty or declaration-only input) are
+          # malformed: XML requires exactly one root. Ox answers a
+          # bare document — the facade names it (uniform with the
+          # rexml/oga arms; loudness differential, TODO.sota/01).
+          if options[:strict] && native_doc.is_a?(::Ox::Document) &&
+              native_doc.nodes.none?(::Ox::Element)
+            raise Moxml::ParseError.new(
+              "document has no root element",
+              source: xml.is_a?(String) ? xml[0..100] : nil,
+            )
+          end
+
           ctx = _context || Context.new(context_adapter_name)
           Wrappers::Document.new(native_doc, ctx)
         end
@@ -93,6 +108,14 @@ module Moxml
           end
         end
 
+        # Ox's SAX parser reports text only: CDATA, comments and PIs
+        # are folded into text or dropped (D-10). Subscribing to those
+        # families raises the named error instead of silently answering
+        # an incomplete stream.
+        def sax_event_family_supported?(family)
+          !%i[cdata comment processing_instruction].include?(family)
+        end
+
         def create_document(native_doc = nil)
           attrs = native_doc&.attributes || {}
           ::Ox::Document.new(**attrs)
@@ -627,7 +650,11 @@ module Moxml
         end
 
         def processing_instruction_content(node)
-          node.content.to_s
+          # Ox keeps the target/content separator space inside the
+          # PI content; the model's content is the data AFTER the
+          # separator. Leaving it in makes canonicalization
+          # non-idempotent (TODO.sota/02, M2).
+          node.content.to_s.sub(/\A\s+/, "")
         end
 
         def set_processing_instruction_content(node, content)
@@ -708,6 +735,11 @@ module Moxml
             end)
           when NodeSet
             dedupe_natives(result.to_a.map(&:native))
+          when Moxml::Node
+            # The engine answers a lone node for the context node
+            # (`.`); the adapter contract is a node-set for node
+            # results.
+            [result.native]
           else
             result
           end