svg_conform 0.2.4 → 0.2.7

data/lib/svg_conform/sax_validation_handler.rb

@@ -41,8 +41,13 @@ module SvgConform
   class SaxValidationHandler < Leptris::XML::SAX::Document
     attr_reader :result, :context
 
-    def initialize(profile)
+    def initialize(profile, source: nil, source_path: nil,
+                   source_serialized: false)
       @profile = profile
+      @source = source
+      @source_path = source_path
+      @source_serialized = source_serialized
+      @source_validated = false
       @element_stack = [] # Track parent-child hierarchy
       @path_stack = [] # Current element path
       @position_counters = [] # Stack of sibling counters per level
@@ -65,6 +70,7 @@ module SvgConform
 
     # SAX Event: Document start
     def start_document
+      run_source_validation
       # No need to reset state - each validation has fresh requirement instances
       # Initialize root level counters
       @position_counters.push({})
@@ -124,6 +130,7 @@ module SvgConform
 
     # SAX Event: Document complete
     def end_document
+      run_source_validation
       # Run deferred validation
       @deferred_requirements.each do |req|
         req.validate_sax_complete(@context)
@@ -145,6 +152,7 @@ module SvgConform
 
     # Handle parse errors
     def add_parse_error(error)
+      run_source_validation
       @context.add_error(
         node: nil,
         message: "Parse error: #{error.message}",
@@ -160,6 +168,16 @@ module SvgConform
 
     private
 
+    # Source hooks run once, before any element dispatch
+    def run_source_validation
+      return if @source_validated
+
+      @source_validated = true
+      @requirements.each do |req|
+        req.validate_source(@source, @context)
+      end
+    end
+
     def create_incomplete_result
       # Return result even if parsing incomplete
       ValidationResult.new(nil, @profile, @context)
@@ -180,6 +198,9 @@ module SvgConform
                                     trackers[:structural_invalidity_tracker])
       context.instance_variable_set(:@reference_manifest,
                                     trackers[:reference_manifest])
+      context.instance_variable_set(:@source, @source)
+      context.instance_variable_set(:@source_path, @source_path)
+      context.instance_variable_set(:@source_serialized, @source_serialized)
       context.instance_variable_set(:@fixes, [])
       context.instance_variable_set(:@state_registry, {})
       context

data/lib/svg_conform/validation/css2_core_grammar.rb

@@ -0,0 +1,359 @@
+# frozen_string_literal: true
+
+require "strscan"
+
+module SvgConform
+  module Validation
+    # Syntax-only tokenizer and parser for the CSS 2 core grammar that SVG 1.1
+    # requires (https://www.w3.org/TR/2008/REC-CSS2-20080411/grammar.html).
+    #
+    # It checks tokens, block nesting, rulesets and declarations. It does not
+    # know property names, value semantics or rendering. Pure Ruby; no I/O.
+    module Css2CoreGrammar
+      Token = Struct.new(:type, :value, :line, :column)
+      Error = Struct.new(:message, :line, :column) do
+        def to_s
+          "#{message} (line #{line}, column #{column})"
+        end
+      end
+
+      # Outcome of a parse: +errors+ is empty when the input is valid.
+      class Result
+        attr_reader :errors
+
+        def initialize(errors)
+          @errors = errors.freeze
+        end
+
+        def valid?
+          errors.empty?
+        end
+      end
+
+      NONASCII = '[^\x00-\x7F]'
+      UNICODE = '\\\\[0-9a-fA-F]{1,6}(?:\r\n|[ \n\r\t\f])?'
+      ESCAPE = "(?:#{UNICODE}|\\\\[^\\n\\r\\f0-9a-fA-F])".freeze
+      NMSTART = "(?:[_a-zA-Z]|#{NONASCII}|#{ESCAPE})".freeze
+      NMCHAR = "(?:[_a-zA-Z0-9-]|#{NONASCII}|#{ESCAPE})".freeze
+      IDENT_SRC = "-?#{NMSTART}#{NMCHAR}*".freeze
+      NUM_SRC = '(?:[0-9]+|[0-9]*\.[0-9]+)'
+      NL = '(?:\n|\r\n|\r|\f)'
+      STRING_BODY = lambda do |quote|
+        "#{quote}(?:[^\\n\\r\\f\\\\#{quote}]|\\\\#{NL}|#{ESCAPE})*"
+      end
+
+      IDENT = /#{IDENT_SRC}/o
+      PATTERNS = [
+        [:s, /[ \t\r\n\f]+/],
+        [:comment, %r{/\*[^*]*\*+(?:[^/*][^*]*\*+)*/}],
+        [:cdo, /<!--/],
+        [:cdc, /-->/],
+        [:includes, /~=/],
+        [:dashmatch, /\|=/],
+        [:string, /#{STRING_BODY.call('"')}"|#{STRING_BODY.call("'")}'/],
+        [:bad_string, /#{STRING_BODY.call('"')}|#{STRING_BODY.call("'")}/],
+        [:hash, /\##{NMCHAR}+/o],
+        [:atkeyword, /@#{IDENT_SRC}/o],
+        [:uri, /url\([ \t\r\n\f]*(?:#{STRING_BODY.call('"')}"|#{STRING_BODY.call("'")}'|(?:[!#$%&*-~]|#{NONASCII}|#{ESCAPE})*)[ \t\r\n\f]*\)/io],
+        [:unicode_range, /u\+[0-9a-f?]{1,6}(?:-[0-9a-f]{1,6})?/i],
+        [:function, /#{IDENT_SRC}\(/o],
+        [:dimension, /#{NUM_SRC}#{IDENT_SRC}/o],
+        [:percentage, /#{NUM_SRC}%/],
+        [:number, /#{NUM_SRC}/],
+        [:ident, /#{IDENT_SRC}/o],
+      ].freeze
+
+      # Characters that are their own token types.
+      PUNCTUATION = %w[; { } ( ) [ ] :].freeze
+      ANY_TYPES = %i[ident number percentage dimension string delim uri hash
+                     unicode_range includes dashmatch].freeze
+      SKIPPED_TOP_LEVEL = %i[s cdo cdc].freeze
+      CLOSERS = { "(" => ")", "[" => "]" }.freeze
+
+      module_function
+
+      # Tokenize CSS text. Comments are dropped; unterminated comments and
+      # strings surface as :bad_comment / :bad_string tokens.
+      # @return [Array<Token>]
+      def tokenize(text)
+        scanner = StringScanner.new(text.to_s)
+        tokens = []
+        line = 1
+        line_start = 0
+        until scanner.eos?
+          pos = scanner.pos
+          type, value = next_token(scanner)
+          column = pos - line_start + 1
+          tokens << Token.new(type, value, line, column) unless type == :comment
+          value.scan(/\r\n|[\n\r\f]/) { line += 1 }
+          nl = value.rindex(/[\n\r\f]/)
+          line_start = pos + nl + 1 if nl
+        end
+        tokens
+      end
+
+      # Parse a style sheet (style element content or external sheet).
+      # @return [Result]
+      def parse_stylesheet(text)
+        Parser.new(tokenize(text)).stylesheet
+      end
+
+      # Parse the content of a style attribute: a declaration list without
+      # braces.
+      # @return [Result]
+      def parse_declarations(text)
+        Parser.new(tokenize(text)).declaration_list
+      end
+
+      def next_token(scanner)
+        PATTERNS.each do |type, regex|
+          value = scanner.scan(regex)
+          return [type, value] if value
+        end
+        return [:bad_comment, scanner.scan(%r{/\*.*}m)] if scanner.check(%r{/\*})
+
+        char = scanner.getch
+        [PUNCTUATION.include?(char) ? char : :delim, char]
+      end
+      private_class_method :next_token
+
+      # Recursive-descent parser over the token list (CSS 2.1 Appendix G.1).
+      class Parser
+        def initialize(tokens)
+          @tokens = tokens
+          @pos = 0
+          @errors = []
+        end
+
+        def stylesheet
+          until eof?
+            token = peek
+            if SKIPPED_TOP_LEVEL.include?(token.type)
+              advance
+            else
+              statement
+            end
+          end
+          Result.new(@errors)
+        end
+
+        def declaration_list
+          skip_space
+          declarations_until(nil)
+          Result.new(@errors)
+        end
+
+        private
+
+        def eof?
+          @pos >= @tokens.length
+        end
+
+        def peek
+          @tokens[@pos]
+        end
+
+        def advance
+          token = @tokens[@pos]
+          @pos += 1
+          token
+        end
+
+        def skip_space
+          advance while !eof? && peek.type == :s
+        end
+
+        def type?(type)
+          !eof? && peek.type == type
+        end
+
+        def error(message, token = peek || @tokens.last)
+          @errors << Error.new(message, token&.line || 1, token&.column || 1)
+        end
+
+        def statement
+          if type?(:atkeyword)
+            at_rule
+          else
+            ruleset
+          end
+        end
+
+        def at_rule
+          advance
+          skip_space
+          until eof? || type?("{") || type?(";")
+            break unless any?
+          end
+          if type?("{")
+            block
+          elsif type?(";")
+            advance
+          else
+            error("at-rule is missing ';' or a block")
+          end
+          skip_space
+        end
+
+        # selector? '{' declarations '}'
+        def ruleset
+          start = peek
+          until eof? || type?("{")
+            unless any?
+              error("unexpected #{describe(peek)} in selector")
+              advance
+            end
+          end
+          return error("selector is missing a '{' block", start) if eof?
+
+          advance
+          skip_space
+          declarations_until("}")
+          if type?("}")
+            advance
+          else
+            error("ruleset is missing '}'", start)
+          end
+          skip_space
+        end
+
+        def declarations_until(closer)
+          loop do
+            skip_space
+            break if eof? || (closer && type?(closer))
+
+            if type?(";")
+              advance
+              next
+            end
+            declaration(closer)
+            skip_space
+            break if eof? || (closer && type?(closer))
+
+            if type?(";")
+              advance
+            else
+              error("expected ';' after declaration, found #{describe(peek)}")
+              recover(closer)
+            end
+          end
+        end
+
+        # property ':' S* value
+        def declaration(closer)
+          unless type?(:ident)
+            error("expected a property name, found #{describe(peek)}")
+            return recover(closer)
+          end
+          advance
+          skip_space
+          unless type?(":")
+            error("expected ':' after property name")
+            return recover(closer)
+          end
+          advance
+          skip_space
+          value(closer)
+        end
+
+        def value(closer)
+          first = peek
+          count = 0
+          until eof? || type?(";") || (closer && type?(closer))
+            if type?("{")
+              block
+            elsif type?(:atkeyword)
+              advance
+              skip_space
+            elsif !any?
+              error("unexpected #{describe(peek)} in declaration value")
+              advance
+            end
+            count += 1
+          end
+          error("declaration has no value", first) if count.zero?
+        end
+
+        # Skip to the next ';' or the closing delimiter.
+        def recover(closer)
+          advance until eof? || type?(";") || (closer && type?(closer))
+        end
+
+        # '{' S* [any | block | ATKEYWORD S* | ';' S*]* '}' S*
+        def block
+          open = advance
+          skip_space
+          loop do
+            if eof?
+              error("block opened here is missing '}'", open)
+              return
+            end
+            break if type?("}")
+
+            if type?("{")
+              block
+            elsif type?(:atkeyword) || type?(";")
+              advance
+              skip_space
+            elsif !any?
+              error("unexpected #{describe(peek)} in block")
+              advance
+            end
+          end
+          advance
+          skip_space
+        end
+
+        # Consumes one `any` production (plus trailing space). Returns false
+        # without consuming when the next token is not an `any` start.
+        def any?
+          return false if eof?
+
+          token = peek
+          if ANY_TYPES.include?(token.type) || token.type == ":"
+            advance
+          elsif token.type == :function
+            advance
+            skip_space
+            group(")", token)
+          elsif CLOSERS.key?(token.type)
+            advance
+            skip_space
+            group(CLOSERS[token.type], token)
+          elsif token.type == :bad_string
+            error("unterminated string", token)
+            advance
+          elsif token.type == :bad_comment
+            error("unterminated comment", token)
+            advance
+          else
+            return false
+          end
+          skip_space
+          true
+        end
+
+        def group(closer, opener)
+          loop do
+            if eof?
+              error("'#{opener.value}' is missing '#{closer}'", opener)
+              return
+            end
+            break if type?(closer)
+            next if any?
+
+            error("unexpected #{describe(peek)} inside '#{opener.value}'")
+            advance
+          end
+          advance
+        end
+
+        def describe(token)
+          return "end of input" unless token
+
+          "'#{token.value.to_s.strip[0, 20]}'"
+        end
+      end
+    end
+  end
+end

data/lib/svg_conform/validation/css_references.rb

@@ -0,0 +1,122 @@
+# frozen_string_literal: true
+
+require_relative "css2_core_grammar"
+
+module SvgConform
+  module Validation
+    # Finds the url() and @import references in CSS by tokenizing it, so that
+    # identifier escapes (+u\72l(+, +@\69mport+) are decoded before the name is
+    # compared and url-like text inside strings or comments is ignored.
+    module CssReferences
+      Reference = Struct.new(:url, :import)
+      # A declared property (name) or a @keyframes rule (keyframes: true)
+      Feature = Struct.new(:name, :keyframes) do
+        def description
+          keyframes ? "CSS rule '@#{name}'" : "CSS property '#{name}'"
+        end
+      end
+
+      ESCAPE = /\\(?:(?<hex>\h{1,6})(?:\r\n|[ \t\r\n\f])?|(?<char>[^\n\r\f]))/m
+      LINE_CONTINUATION = /\\(?:\r\n|[\n\r\f])/
+
+      module_function
+
+      # @return [Array<Reference>] in source order; +import+ is true for
+      #   references that are the target of an @import rule
+      def extract(css)
+        tokens = Css2CoreGrammar.tokenize(css)
+        references = []
+        import_pending = false
+        index = 0
+        while index < tokens.size
+          token = tokens[index]
+          case token.type
+          when :s then nil
+          when :atkeyword
+            import_pending = decode(token.value).casecmp?("@import")
+          when :string
+            references << Reference.new(unquote(token.value), true) if import_pending
+            import_pending = false
+          when :uri
+            references << Reference.new(uri_value(token.value), import_pending)
+            import_pending = false
+          when :function
+            if decode(token.value.chomp("(")).casecmp?("url")
+              url, index = function_url(tokens, index + 1)
+              references << Reference.new(url, import_pending)
+            end
+            import_pending = false
+          else
+            import_pending = false
+          end
+          index += 1
+        end
+        references.reject { |reference| reference.url.nil? || reference.url.empty? }
+      end
+
+      # Property names declared in +css+ (a style attribute or style sheet),
+      # plus @keyframes rules, with escapes decoded.
+      # @return [Array<Feature>]
+      def declarations(css)
+        tokens = Css2CoreGrammar.tokenize(css).reject { |token| token.type == :s }
+        tokens.each_with_index.filter_map do |token, index|
+          if token.type == :atkeyword
+            keyframes_feature(token)
+          elsif property_at?(tokens, index)
+            Feature.new(decode(token.value), false)
+          end
+        end
+      end
+
+      # An identifier followed by ":" that starts a declaration
+      def property_at?(tokens, index)
+        return false unless tokens[index].type == :ident && tokens[index + 1]&.type == ":"
+
+        index.zero? || ["{", ";"].include?(tokens[index - 1].value)
+      end
+
+      def keyframes_feature(token)
+        name = decode(token.value).delete_prefix("@")
+        return unless name.downcase.sub(/\A-[a-z]+-/, "") == "keyframes"
+
+        Feature.new(name, true)
+      end
+
+      def decode(text)
+        text.gsub(LINE_CONTINUATION, "").gsub(ESCAPE) do
+          match = Regexp.last_match
+          match[:hex] ? codepoint(match[:hex].hex) : match[:char]
+        end
+      end
+
+      def codepoint(number)
+        return "�" if number.zero? || number > 0x10FFFF || number.between?(0xD800, 0xDFFF)
+
+        [number].pack("U")
+      end
+
+      def unquote(string)
+        decode(string[1..].chomp(string[0]))
+      end
+
+      def uri_value(token)
+        inner = token.sub(/\Aurl\(/i, "").delete_suffix(")").strip
+        inner.start_with?('"', "'") ? unquote(inner) : decode(inner)
+      end
+
+      # Tokens after an escaped "url(" up to the closing parenthesis.
+      # @return [Array(String, Integer)] the url and the index of its last token
+      def function_url(tokens, index)
+        index += 1 while tokens[index]&.type == :s
+        return [unquote(tokens[index].value), index] if tokens[index]&.type == :string
+
+        parts = []
+        while (token = tokens[index]) && token.value != ")"
+          parts << token.value unless token.type == :s
+          index += 1
+        end
+        [decode(parts.join), index]
+      end
+    end
+  end
+end

data/lib/svg_conform/validation/error_tracker.rb

@@ -18,13 +18,38 @@ module SvgConform
       end
 
       # Add an error to the context
+      #
+      # A declared severity of :warning is a quality advisory (see
+      # TextAsPathRequirement) and must surface as a warning, not an error:
+      # otherwise schema-valid documents are reported as corrupt by consumers
+      # that log result.errors (metanorma, metanorma-pdfa#106). Other
+      # severities keep their existing routing: :validity_error stays out of
+      # the main error bucket, and :info remains in errors because the style
+      # remediation flow consumes it there.
       def add_error(node:, message:, rule: nil, requirement: nil,
                      requirement_id: nil, severity: nil, fix: nil, data: {})
         # Support both old rule system and new requirements system
         rule_or_requirement = requirement || rule
 
-        error = ::SvgConform::Errors::ValidationIssue.new(
-          type: :error,
+        if severity == :warning
+          warning = ::SvgConform::Errors::ValidationIssue.new(
+            type: :warning,
+            rule: rule_or_requirement,
+            node: node,
+            message: message,
+            fix: fix,
+            data: data,
+            requirement_id: requirement_id,
+            severity: severity,
+          )
+          @warnings << warning
+          return warning
+        end
+
+        type, bucket = severity_bucket(severity)
+
+        issue = ::SvgConform::Errors::ValidationIssue.new(
+          type: type,
           rule: rule_or_requirement,
           node: node,
           message: message,
@@ -34,14 +59,18 @@ module SvgConform
           severity: severity,
         )
 
-        # Handle special severity types
-        if severity == :validity_error
-          @validity_errors << error
+        bucket << issue
+        issue
+      end
+
+      # Map a declared severity to the issue type and tracker bucket
+      def severity_bucket(severity)
+        case severity
+        when :validity_error
+          [:error, @validity_errors]
         else
-          @errors << error
+          [:error, @errors]
         end
-
-        error
       end
 
       # Add a warning to the context
@@ -58,7 +87,8 @@ module SvgConform
       end
 
       # Add an informational notice to the context
-      def add_notice(rule:, node:, message:, fix: nil, data: {}, type: :info)
+      def add_notice(rule:, node:, message:, fix: nil, data: {}, type: :info,
+                     requirement_id: nil)
         notice = ::SvgConform::Errors::ValidationIssue.new(
           type: type,
           rule: rule,
@@ -66,6 +96,7 @@ module SvgConform
           message: message,
           fix: fix,
           data: data,
+          requirement_id: requirement_id,
         )
         @infos << notice
         notice