svg_conform 0.2.4 → 0.2.6

data/spec/svg_conform/requirements/svg_1_1_document_requirement_spec.rb

@@ -0,0 +1,141 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+# Path is fixed by the card; the cop expects svg11_ instead of svg_1_1_.
+RSpec.describe SvgConform::Requirements::Svg11DocumentRequirement do # rubocop:disable RSpec/SpecFilePathFormat
+  let(:svg_ns) { 'xmlns="http://www.w3.org/2000/svg"' }
+  let(:profile_path) { "config/profiles/svg_1_1_full_static.yml" }
+
+  def requirement_for(rule)
+    SvgConform::Profile.load_from_file(profile_path).requirements.find do |req|
+      req.respond_to?(:rule) && req.rule == rule
+    end
+  end
+
+  def run(rule, xml, mode: :sax, serialized: false)
+    requirement = requirement_for(rule)
+    profile = SvgConform::Profile.new(name: "t", requirements: [requirement])
+    if mode == :dom
+      profile.validate(SvgConform::Document.from_content(xml)).errors
+    else
+      SvgConform::SaxDocument.from_content(xml, source_serialized: serialized)
+        .validate_with_profile(profile).errors
+    end
+  end
+
+  def doc(attrs: 'version="1.1"', body: '<rect width="1" height="1"/>', prolog: "")
+    %(<?xml version="1.0"?>\n#{prolog}<svg #{svg_ns} #{attrs}>#{body}</svg>)
+  end
+
+  it "defines one entry per matrix row with its own id and citation" do
+    entries = SvgConform::Profile.load_from_file(profile_path).requirements
+      .grep(described_class)
+    expect(entries.map(&:rule)).to eq(described_class::RULES)
+    expect(entries.map(&:id)).to eq(
+      %w[svg11.document.xml svg11.document.root svg11.document.version
+         svg11.document.grammar svg11.document.css2
+         svg11.document.xml_stylesheet],
+    )
+    expect(entries.map(&:citation_uri)).to all(start_with("https://www.w3.org/TR/"))
+  end
+
+  it "is registered in Requirements.all" do
+    expect(SvgConform::Requirements.all).to include(described_class)
+  end
+
+  it "rejects an unknown rule" do
+    requirement = described_class.new(id: "x", rule: "nope")
+    context = SvgConform::ValidationContext.new(nil, nil, source: "<svg/>")
+    expect { requirement.validate_source("<svg/>", context) }
+      .to raise_error(ArgumentError, /unknown rule/)
+  end
+
+  %i[sax dom].each do |mode|
+    context "when validating in #{mode} mode" do
+      it "accepts a valid document in every rule" do
+        described_class::RULES.each do |rule|
+          expect(run(rule, doc, mode: mode)).to be_empty, "rule #{rule}"
+        end
+      end
+
+      it "flags a wrong root namespace" do
+        errors = run("root", doc.sub(svg_ns, 'xmlns="http://example.com/x"'), mode: mode)
+        expect(errors.map(&:requirement_id)).to eq(["svg11.document.root"])
+      end
+
+      it "flags a wrong or missing version" do
+        expect(run("version", doc(attrs: 'version="1.0"'), mode: mode).size).to eq(1)
+        expect(run("version", doc(attrs: ""), mode: mode).size).to eq(1)
+      end
+
+      it "flags DTD content-model and attribute violations" do
+        model = run("grammar", doc(body: "<rect><g/></rect>"), mode: mode)
+        attribute = run("grammar", doc(body: '<rect width="1" height="1" bogus="1"/>'), mode: mode)
+        expect(model.map(&:requirement_id)).to all(eq("svg11.document.grammar"))
+        expect(model).not_to be_empty
+        expect(attribute).not_to be_empty
+      end
+
+      it "does not follow an external entity" do
+        xml = "<?xml version=\"1.0\"?>\n<!DOCTYPE svg [<!ENTITY x SYSTEM \"file:///etc/passwd\">]>\n<svg #{svg_ns} version=\"1.1\"><title>&x;</title></svg>"
+        errors = run("grammar", xml, mode: mode)
+        expect(errors.map(&:message).join).to include("external")
+        expect(errors.map(&:message).join).not_to include("root:")
+      end
+
+      it "flags CSS grammar errors in style attributes and style elements" do
+        attr = run("css2", doc(body: '<rect width="1" height="1" style="fill: {red"/>'), mode: mode)
+        sheet = run("css2", doc(body: "<style>rect { fill: red </style>"), mode: mode)
+        expect(attr.size).to be >= 1
+        expect(sheet.size).to be >= 1
+      end
+
+      it "accepts valid CSS and skips non-CSS style types" do
+        css = "<style>rect { fill: red }</style><style type=\"text/x-other\">{{</style>"
+        expect(run("css2", doc(body: css), mode: mode)).to be_empty
+      end
+
+      it "treats text/css media types case-insensitively" do
+        upper = run("css2", doc(body: '<style type="TEXT/CSS">rect { fill: red </style>'), mode: mode)
+        mixed = run("css2", doc(body: '<style type="Text/Css">rect { fill: red </style>'), mode: mode)
+        pi = %(<?xml-stylesheet href="a.css" type="TEXT/CSS"?>\n)
+        expect(upper.size).to be >= 1
+        expect(mixed.size).to be >= 1
+        expect(run("xml_stylesheet", doc(prolog: pi), mode: mode)).to be_empty
+      end
+
+      it "validates xml-stylesheet pseudo-attributes" do
+        good = doc(prolog: %(<?xml-stylesheet href="a.css" type="text/css"?>\n))
+        no_href = doc(prolog: %(<?xml-stylesheet type="text/css"?>\n))
+        bad_type = doc(prolog: %(<?xml-stylesheet href="a.xsl" type="text/xsl"?>\n))
+        garbled = doc(prolog: %(<?xml-stylesheet href=a.css?>\n))
+        expect(run("xml_stylesheet", good, mode: mode)).to be_empty
+        [no_href, bad_type, garbled].each do |xml|
+          expect(run("xml_stylesheet", xml, mode: mode).map(&:requirement_id))
+            .to eq(["svg11.document.xml_stylesheet"])
+        end
+      end
+    end
+  end
+
+  it "reports malformed XML through SAX" do
+    errors = run("xml", "<svg #{svg_ns}><rect></svg>")
+    expect(errors.map(&:requirement_id)).to include("svg11.document.xml")
+  end
+
+  it "cannot prove declaration claims for a re-serialized source" do
+    errors = run("xml", doc, serialized: true)
+    expect(errors.map(&:requirement_id)).to eq(["svg11.document.xml"])
+    expect(errors.first.message).to include("cannot be proved")
+    expect(run("xml", doc, serialized: false)).to be_empty
+  end
+
+  it "reports the same through a DOM node and a serialized SAX source" do
+    node = SvgConform::Document.from_content(doc).moxml_document
+    dom = SvgConform::Document.from_node(node)
+    profile = SvgConform::Profile.new(name: "t", requirements: [requirement_for("xml")])
+    expect(profile.validate(dom).errors.map(&:requirement_id))
+      .to eq(["svg11.document.xml"])
+  end
+end

data/spec/svg_conform/validation/css2_core_grammar_spec.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "svg_conform/validation/css2_core_grammar"
+
+RSpec.describe SvgConform::Validation::Css2CoreGrammar do
+  describe ".tokenize" do
+    def types(css)
+      described_class.tokenize(css).map(&:type)
+    end
+
+    it "classifies the CSS 2 token kinds" do
+      css = 'a:hover #id 10 50% 2em url(x.png) rgb( "s" U+0-7F ~= |= @page <!-- -->'
+      expect(types(css).reject { |t| t == :s }).to eq(
+        [:ident, ":", :ident, :hash, :number, :percentage, :dimension, :uri, :function, :string,
+         :unicode_range, :includes, :dashmatch, :atkeyword, :cdo, :cdc],
+      )
+    end
+
+    it "drops comments and tracks line and column" do
+      tokens = described_class.tokenize("a /* c\n */ b")
+      expect(tokens.map(&:value)).to eq(["a", " ", " ", "b"])
+      expect(tokens.last.line).to eq(2)
+      expect(tokens.last.column).to eq(5)
+    end
+
+    it "flags unterminated strings and comments" do
+      expect(types('"abc')).to eq([:bad_string])
+      expect(types("/* abc")).to eq([:bad_comment])
+    end
+
+    it "accepts escapes in identifiers" do
+      expect(types('\66 ill')).to eq([:ident])
+    end
+  end
+
+  describe ".parse_stylesheet" do
+    valid = {
+      "empty sheet" => "",
+      "comments and CDO/CDC" => "<!-- /* x */ a { fill: red } -->",
+      "multiple selectors" => "rect, circle.a > path[x=\"1\"]:first-child { fill: #fff }",
+      "empty declaration slots" => "a { ; fill: red;; stroke: blue; }",
+      "functions and !important" => "a { fill: rgb(1, 2, 3) !important; stroke: url(#g) }",
+      "empty ruleset" => "a { }",
+      "@import" => '@import url("x.css") screen;',
+      "@media with nested rules" => "@media print { a { x: y } b { x: y } }",
+      "@font-face" => '@font-face { font-family: "F"; src: url(f.woff) }',
+      "unknown at-rule block" => "@foo bar { baz { qux: 1 } }",
+      "selector-less ruleset" => "{ fill: red }",
+    }
+
+    valid.each do |name, css|
+      it "accepts #{name}" do
+        expect(described_class.parse_stylesheet(css)).to be_valid
+      end
+    end
+
+    invalid = {
+      "missing colon" => ["a { fill red }", /expected ':'/],
+      "missing value" => ["a { fill: }", /no value/],
+      "missing property" => ["a { : red }", /property name/],
+      "unclosed ruleset" => ["a { fill: red", /missing '}'/],
+      "unclosed string" => ["a { fill: \"red }", /unterminated string/],
+      "unclosed comment" => ["a { fill: red } /* x", /unterminated comment/],
+      "unclosed function" => ["a { fill: rgb(1,2 }", /missing '\)'/],
+      "selector without block" => ["a b", /missing a '\{' block/],
+      "unterminated at-rule" => ["@import url(x.css)", /at-rule/],
+      "stray closing brace" => ["a { fill: red } }", /unexpected '\}'/],
+    }
+
+    invalid.each do |name, (css, message)|
+      it "rejects #{name}" do
+        result = described_class.parse_stylesheet(css)
+        expect(result).not_to be_valid
+        expect(result.errors.map(&:message).join("\n")).to match(message)
+      end
+    end
+
+    it "reports the position of the first error" do
+      error = described_class.parse_stylesheet("a { fill: red }\nb { fill blue }")
+        .errors.first
+      expect(error.line).to eq(2)
+      expect(error.to_s).to include("line 2")
+    end
+  end
+
+  describe ".parse_declarations" do
+    it "accepts a style attribute value" do
+      css = "fill:red; stroke : url(#a) ; stroke-width:2px;"
+      expect(described_class.parse_declarations(css)).to be_valid
+    end
+
+    it "accepts an empty value and stray semicolons" do
+      expect(described_class.parse_declarations("")).to be_valid
+      expect(described_class.parse_declarations(" ; ;")).to be_valid
+    end
+
+    it "rejects a declaration without a colon" do
+      result = described_class.parse_declarations("fill red")
+      expect(result).not_to be_valid
+    end
+
+    it "rejects a stray closing brace in a declaration list" do
+      result = described_class.parse_declarations("fill:red } stroke:blue")
+      expect(result).not_to be_valid
+    end
+
+    it "rejects a ruleset where a declaration list is expected" do
+      expect(described_class.parse_declarations("a { fill: red }")).not_to be_valid
+    end
+
+    it "does not judge property names or values" do
+      expect(described_class.parse_declarations("bogus-prop: nonsense 12qq")).to be_valid
+    end
+  end
+end

data/spec/svg_conform/validation/svg_1_1_document_conformance_spec.rb

@@ -0,0 +1,144 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "digest"
+require "yaml"
+require "tmpdir"
+require "svg_conform/validation/svg_1_1_document_conformance"
+
+# Path is fixed by the card; the cop expects svg11_ instead of svg_1_1_.
+RSpec.describe SvgConform::Validation::Svg11DocumentConformance do # rubocop:disable RSpec/SpecFilePathFormat
+  subject(:conformance) { described_class.new }
+
+  let(:ns) { %(xmlns="http://www.w3.org/2000/svg" version="1.1") }
+  let(:dtd_path) { described_class::DTD_PATH }
+
+  def svg(body, attrs = ns)
+    %(<?xml version="1.0"?>\n<svg #{attrs}>#{body}</svg>)
+  end
+
+  # Library selection record (card 03, "Open implementation question").
+  # Probes: valid document, invalid content model, external-entity attempt,
+  # Appendix G.2 foreign content, run offline against the vendored flat DTD.
+  #
+  #   Moxml/Leptris 1.9.381 (Leptris::XML::DTD): parses the DTD but ignores
+  #   conditional sections whose keyword is a parameter entity
+  #   (<![%svg-structure.module;[ ... ]]>), so no SVG element is declared and
+  #   every probe, including the invalid ones, reports valid. Rejected.
+  #   Nokogiri 1.19 (libxml2 2.13, Ruby >= 3.1 with 1.16/1.18): all four
+  #   probes behave correctly offline, in-process, with NONET and no entity
+  #   loading. Selected.
+  describe "library probes" do
+    let(:flat_dtd) { File.read(dtd_path) }
+
+    it "records that Leptris cannot enforce the flat DTD" do
+      require "leptris"
+      handle = Leptris::XML::DTD.parse(flat_dtd)
+      invalid = Leptris::XML.parse(%(<svg #{ns}><rect width="1" height="1"><g/></rect></svg>))
+
+      expect(handle.validate(invalid)).to be_empty
+    end
+
+    it "probe 1: Nokogiri accepts a valid document" do
+      expect(conformance.validate(svg(%(<rect width="1" height="1"/>))).issues).to be_empty
+    end
+
+    it "probe 2: Nokogiri rejects an invalid content model" do
+      result = conformance.validate(svg(%(<rect width="1" height="1"><g/></rect>)))
+
+      expect(result.issues.map(&:kind)).to eq([:dtd])
+      expect(result.issues.first.message).to include("rect content does not follow the DTD")
+    end
+
+    it "probe 3: an external entity attempt is rejected without reading the file" do
+      Dir.mktmpdir do |dir|
+        secret = File.join(dir, "secret.txt")
+        File.write(secret, "SECRET-MARKER")
+        source = %(<?xml version="1.0"?><!DOCTYPE svg [<!ENTITY x SYSTEM "file://#{secret}">]>) +
+          %(<svg #{ns}><title>&x;</title></svg>)
+
+        result = conformance.validate(source)
+
+        expect(result.issues.map(&:kind)).to eq([:external_entity])
+        expect(result.transformed).to be_nil
+      end
+    end
+
+    it "probe 4: foreign content validates after the Appendix G.2 transform" do
+      source = svg(%(<f:thing f:a="1"><g/></f:thing><metadata><f:m/></metadata>),
+                   %(#{ns} xmlns:f="urn:foreign"))
+
+      expect(conformance.validate(source).issues).to be_empty
+    end
+  end
+
+  describe "#validate" do
+    it "reports a missing required attribute" do
+      result = conformance.validate(svg(%(<rect height="1"/>)))
+
+      expect(result.issues.first.message).to include("Element rect does not carry attribute width")
+    end
+
+    it "reports an undeclared attribute" do
+      result = conformance.validate(svg(%(<rect width="1" height="1" bogus="x"/>)))
+
+      expect(result.issues.first.message).to include("No declaration for attribute bogus")
+    end
+
+    it "reports malformed XML" do
+      result = conformance.validate(svg(%(<rect width="1" height="1">)))
+
+      expect(result.issues.first.kind).to eq(:malformed_xml)
+    end
+
+    it "reports a document element outside the SVG namespace" do
+      result = conformance.validate(%(<svg xmlns="urn:other" version="1.1"/>))
+
+      expect(result.issues.map(&:kind)).to eq([:no_svg_root])
+    end
+
+    it "validates xlink attributes under any prefix" do
+      source = svg(%(<defs><g id="a"/></defs><use xlink:href="#a"/>),
+                   %(#{ns} xmlns:xl="http://www.w3.org/1999/xlink"))
+      source = source.sub("xlink:href", "xl:href")
+
+      expect(conformance.validate(source).issues).to be_empty
+    end
+
+    it "validates prefixed SVG elements" do
+      source = %(<s:svg xmlns:s="http://www.w3.org/2000/svg" version="1.1"><s:rect width="1" height="1"/></s:svg>)
+
+      expect(conformance.validate(source).issues).to be_empty
+    end
+
+    it "expands internal entities before validating" do
+      source = %(<?xml version="1.0"?><!DOCTYPE svg [<!ENTITY w "5">]><svg #{ns}><rect width="&w;" height="1"/></svg>)
+
+      expect(conformance.validate(source).issues).to be_empty
+    end
+
+    it "never modifies the caller's source" do
+      source = svg(%(<f:x xmlns:f="urn:f"/><rect width="1" height="1"/>)).freeze
+
+      expect { conformance.validate(source) }.not_to raise_error
+      expect(source).to include("<f:x")
+    end
+
+    it "keeps the Appendix G.2 copy free of foreign content" do
+      copy = conformance.validate(svg(%(<f:x xmlns:f="urn:f"/>), %(#{ns} f2:a="1" xmlns:f2="urn:f"))).transformed
+
+      expect(copy).not_to include("f:x")
+      expect(copy).not_to include("f2:a")
+      expect(copy).to include(%(xmlns:xlink="http://www.w3.org/1999/xlink"))
+    end
+  end
+
+  describe "vendored DTD" do
+    it "matches the manifest checksum" do
+      entry = YAML.safe_load_file(described_class::MANIFEST_PATH, permitted_classes: [Date])["files"].first
+
+      expect(Digest::SHA256.file(dtd_path).hexdigest).to eq(entry["sha256"])
+      expect(entry["source_url"]).to start_with("https://www.w3.org/")
+    end
+  end
+end

data/spec/svg_conform/validation_context_source_plumbing_spec.rb

@@ -0,0 +1,122 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "tmpdir"
+
+RSpec.describe SvgConform::ValidationContext, "#source" do
+  let(:source) do
+    <<~XML
+      <?xml version="1.0" encoding="UTF-8"?>
+      <!-- exact bytes -->
+      <?xml-stylesheet href="a.css" type="text/css"?>
+      <svg xmlns="http://www.w3.org/2000/svg" version="1.1"><rect width="1" height="1"/></svg>
+    XML
+  end
+
+  let(:recorder_class) do
+    Class.new(SvgConform::Requirements::BaseRequirement) do
+      attr_accessor :calls
+
+      def validate_source(source, context)
+        (@calls ||= []) << {
+          source: source, path: context.source_path,
+          serialized: context.source_serialized?, order: :source
+        }
+      end
+
+      def validate_sax_element(_element, _context)
+        (@calls ||= []) << { order: :element }
+      end
+
+      def check(_node, _context)
+        (@calls ||= []) << { order: :element }
+      end
+    end
+  end
+
+  let(:requirement) { recorder_class.new(id: "rec") }
+  let(:profile) { SvgConform::Profile.new(name: "rec", requirements: [requirement]) }
+
+  def sources_seen
+    requirement.calls.select { |c| c[:order] == :source }
+  end
+
+  it "keeps the BaseRequirement hook a no-op" do
+    base = SvgConform::Requirements::BaseRequirement.new(id: "b")
+    expect(base.validate_source("x", nil)).to be_nil
+  end
+
+  it "stores source and path on ValidationContext" do
+    ctx = described_class.new(nil, nil, source: "s",
+                                        source_path: "p.svg")
+    expect([ctx.source, ctx.source_path, ctx.source_serialized?])
+      .to eq(["s", "p.svg", false])
+    expect(described_class.new(nil, nil).source).to be_nil
+  end
+
+  it "retains exact content in Document for string and file inputs" do
+    Dir.mktmpdir do |dir|
+      path = File.join(dir, "a.svg")
+      File.write(path, source)
+      expect(SvgConform::Document.from_content(source).source).to eq(source)
+      from_file = SvgConform::Document.from_file(path)
+      expect(from_file.source).to eq(source)
+      expect(from_file.source_serialized?).to be(false)
+    end
+  end
+
+  it "marks Document.from_node source as serialized" do
+    node = SvgConform::Document.from_content(source).moxml_document
+    doc = SvgConform::Document.from_node(node)
+    expect(doc.source_serialized?).to be(true)
+    expect(doc.source).to include("<svg")
+  end
+
+  it "passes SaxDocument content into the handler" do
+    SvgConform::SaxDocument.from_content(source).validate_with_profile(profile)
+    expect(sources_seen.size).to eq(1)
+    expect(sources_seen.first).to include(source: source, path: nil,
+                                          serialized: false)
+  end
+
+  it "calls validate_source exactly once, before elements, in DOM and SAX" do
+    profile.validate(SvgConform::Document.from_content(source))
+    dom_orders = requirement.calls.map { |c| c[:order] }
+    expect(dom_orders.first).to eq(:source)
+    expect(dom_orders.count(:source)).to eq(1)
+
+    requirement.calls = []
+    SvgConform::SaxDocument.from_content(source).validate_with_profile(profile)
+    sax_orders = requirement.calls.map { |c| c[:order] }
+    expect(sax_orders.first).to eq(:source)
+    expect(sax_orders.count(:source)).to eq(1)
+  end
+
+  it "gives file entry points identical source and path in both modes" do
+    Dir.mktmpdir do |dir|
+      path = File.join(dir, "a.svg")
+      File.write(path, source)
+
+      profile.validate_file(path)
+      sax = sources_seen.first
+      requirement.calls = []
+      profile.validate(SvgConform::Document.from_file(path))
+      dom = sources_seen.first
+
+      expect(sax).to include(source: source, path: path, serialized: false)
+      expect(dom).to eq(sax)
+    end
+  end
+
+  it "flags serialized source for DOM built from a node" do
+    node = SvgConform::Document.from_content(source).moxml_document
+    profile.validate(SvgConform::Document.from_node(node))
+    expect(sources_seen.first[:serialized]).to be(true)
+  end
+
+  it "still runs source validation when SAX parsing fails" do
+    SvgConform::SaxDocument.from_content("<svg><unclosed>")
+      .validate_with_profile(profile)
+    expect(sources_seen.size).to eq(1)
+  end
+end

data/spec/svg_conform/validation_context_spec.rb

@@ -258,6 +258,45 @@ RSpec.describe SvgConform::ValidationContext do
 
       expect(context.infos.first.message).to eq("test notice")
     end
+
+    it "stores an explicit requirement ID on the info issue" do
+      context.add_notice(rule: nil, node: Object.new, message: "n",
+                         requirement_id: "my_requirement")
+
+      expect(context.infos.first.requirement_id).to eq("my_requirement")
+    end
+
+    it "keeps existing calls working without a requirement ID" do
+      context.add_notice(rule: Struct.new(:id).new("test_rule"),
+                         node: Object.new, message: "n")
+
+      expect(context.infos.first.requirement_id).to eq("test_rule")
+    end
+  end
+
+  describe "#add_external_reference_notice" do
+    let(:reference) do
+      SvgConform::References::ReferenceClassifier.classify(
+        "https://example.com/x", element_name: "a", attribute_name: "href"
+      )
+    end
+
+    it "stores the explicit requirement ID and JSON-safe data" do
+      context.add_external_reference_notice(node: Object.new,
+                                            reference: reference,
+                                            requirement_id: "link_validation")
+
+      info = context.infos.first
+      expect(info.requirement_id).to eq("link_validation")
+      expect(info.data[:reference][:value]).to eq("https://example.com/x")
+    end
+
+    it "keeps existing calls working" do
+      context.add_external_reference_notice(node: Object.new,
+                                            reference: reference)
+
+      expect(context.infos.size).to eq(1)
+    end
   end
 
   describe "#has_errors?" do