@ai-ecoverse/slicc-browsers 1.18.19 → 1.18.20

package/guard-vectors.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "setVersion": "1.18.19",
+  "setVersion": "1.18.20",
   "sources": [
     {
       "repo": "ai-ecoverse/slicc-cli",
@@ -1200,7 +1200,7 @@
           }
         },
         "eventsRedacted": {
-          "means": "protected error-page recover: every discovery event for the tab shows, decoded as often as it takes, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
+          "means": "protected error-page recover: every discovery event for the tab shows, decoded as often as it takes and without the characters the URL parser ignores, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, with a title that names the protected host, if at all, only as that bare origin, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
           "requires": ["discovery"],
           "check": {
             "result": "errorPage",
@@ -1349,7 +1349,7 @@
           }
         },
         "eventsRedacted": {
-          "means": "protected error-page recover (query): every discovery event for the tab shows, decoded as often as it takes, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
+          "means": "protected error-page recover (query): every discovery event for the tab shows, decoded as often as it takes and without the characters the URL parser ignores, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, with a title that names the protected host, if at all, only as that bare origin, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
           "requires": ["discovery"],
           "check": {
             "result": "errorPage",
@@ -1498,7 +1498,7 @@
           }
         },
         "eventsRedacted": {
-          "means": "protected error-page recover (fragment): every discovery event for the tab shows, decoded as often as it takes, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
+          "means": "protected error-page recover (fragment): every discovery event for the tab shows, decoded as often as it takes and without the characters the URL parser ignores, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, with a title that names the protected host, if at all, only as that bare origin, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
           "requires": ["discovery"],
           "check": {
             "result": "errorPage",
@@ -1646,7 +1646,7 @@
           }
         },
         "eventsRedacted": {
-          "means": "protected error-page restore: every discovery event for the tab shows, decoded as often as it takes, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
+          "means": "protected error-page restore: every discovery event for the tab shows, decoded as often as it takes and without the characters the URL parser ignores, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, with a title that names the protected host, if at all, only as that bare origin, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
           "requires": ["discovery"],
           "check": {
             "result": "errorPage",
@@ -1827,7 +1827,7 @@
           }
         },
         "eventsRedacted": {
-          "means": "protected error-page sticky: every discovery event for the tab shows, decoded as often as it takes, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
+          "means": "protected error-page sticky: every discovery event for the tab shows, decoded as often as it takes and without the characters the URL parser ignores, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, with a title that names the protected host, if at all, only as that bare origin, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
           "requires": ["discovery"],
           "check": {
             "result": "errorPage",
@@ -2020,7 +2020,7 @@
           }
         },
         "eventsRedacted": {
-          "means": "protected error-page sticky (query): every discovery event for the tab shows, decoded as often as it takes, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
+          "means": "protected error-page sticky (query): every discovery event for the tab shows, decoded as often as it takes and without the characters the URL parser ignores, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, with a title that names the protected host, if at all, only as that bare origin, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
           "requires": ["discovery"],
           "check": {
             "result": "errorPage",
@@ -2213,7 +2213,7 @@
           }
         },
         "eventsRedacted": {
-          "means": "protected error-page sticky (fragment): every discovery event for the tab shows, decoded as often as it takes, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
+          "means": "protected error-page sticky (fragment): every discovery event for the tab shows, decoded as often as it takes and without the characters the URL parser ignores, the failed URL's origin only, a masked or absent url, or a url off the protected host, wrappers such as blob: unwrapped, that names no other origin on that host, with a title that names the protected host, if at all, only as that bare origin, and no url or title carries the failed URL, its path, query or fragment; no discovery event for another or no target carries the row's tag; reporting no event for the tab also passes",
           "requires": ["discovery"],
           "check": {
             "result": "errorPage",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-browsers",
-  "version": "1.18.19",
+  "version": "1.18.20",
   "description": "SLICC's shared browser catalog, JSON schemas and discovery conformance corpus",
   "type": "module",
   "license": "Apache-2.0",
@@ -79,7 +79,7 @@
     "test:unit:guard": "mkdir -p coverage/unit && node --experimental-vm-modules --no-warnings --experimental-test-coverage --test --test-concurrency=1 --test-coverage-include=guard-runner.mjs --test-coverage-include=guard-driver.mjs --test-coverage-include=fixture-server.mjs --test-coverage-include=fixture-client.mjs --test-coverage-include=observer-target.mjs --test-coverage-include=frame-read.mjs --test-coverage-include=bfcache-restore.mjs --test-coverage-include=protected-error-page.mjs --test-coverage-include=unparseable-url.mjs --test-coverage-include=scripts/browser-runner.mjs --test-coverage-include=scripts/validate.mjs --test-reporter=lcov --test-reporter-destination=coverage/unit/guard.lcov test/unit/guard-*.test.mjs && slicc-diff-cover coverage/unit/guard.lcov"
   },
   "devDependencies": {
-    "@ai-ecoverse/slicc-cdp": "1.42.3",
+    "@ai-ecoverse/slicc-cdp": "1.42.4",
     "@ai-ecoverse/slicc-shared-web": "2.13.6",
     "@biomejs/biome": "2.6.2",
     "ajv": "8.20.0",

package/protected-error-page.mjs

@@ -59,11 +59,27 @@ const plain = (value) =>
       String.fromCharCode(Number.parseInt(hex, 16))
     )
   );
-const layers = (value) => {
-  const out = [lower(value)];
-  for (let next = plain(out[0]); next !== out.at(-1); next = plain(next)) out.push(next);
-  return out;
-};
+const utf8 = (value) =>
+  lower(
+    value.replace(/(?:%[0-9a-f]{2})+/gi, (run) =>
+      new TextDecoder().decode(
+        Uint8Array.from(run.slice(1).split('%'), (hex) => Number.parseInt(hex, 16))
+      )
+    )
+  );
+const ignored = (form) => form.replace(/[\t\n\r]/g, '');
+const readings = (value) =>
+  [
+    [(form) => form, plain],
+    [ignored, plain],
+    [ignored, utf8],
+  ].map(([read, decode]) => {
+    const out = [read(lower(value))];
+    for (let next = read(decode(out[0])); next !== out.at(-1); next = read(decode(next)))
+      out.push(next);
+    return out;
+  });
+const layers = (value) => readings(value).flat();
 const unschemed = (value) => value.replace(/^[a-z][a-z\d+.-]*:\/\//, '');
 
 const encoded = (url) =>
@@ -101,25 +117,38 @@ function discoveryRules({ failedURL, tag, trigger }) {
   const { failed, leaks, names, carries } = failureRules({ failedURL, tag });
   const { origin, host, hostname } = failed;
   const named = [hostname, host, origin];
-  const cleanTitle = (title) => !leaks(title) && (!names(title) || named.includes(lower(title)));
+  const cleanTitle = ({ title, url }) =>
+    !leaks(title) &&
+    (!names(title) ||
+      named.includes(lower(title)) ||
+      (!layers(url).includes(origin) && referenced(title)));
   const ownTitle = ({ url, title }) =>
     plain(title) !== '' && [plain(url), unschemed(plain(url))].includes(plain(title));
   const inner = (u) => (u && !u.host ? inner(parseURL(u.pathname)) : u);
   const onHost = (u) => u?.hostname.replace(/\.$/, '') === hostname;
-  const references = (form) =>
-    Array.from(
-      form.matchAll(/(?:[a-z][a-z\d+.-]*:)+[\\/]*[^\\/?#&\s]*|[\\/]{2}[^\\/?#&\s]*/g),
-      ([ref]) => inner(parseURL(ref, /^[\\/]/.test(ref) ? origin : undefined))
+  const pattern = /(?:[a-z][a-z\d+.-]*:)+[\\/]*[^\\/?#&\s]*|[\\/]{2}[^\\/?#&\s]*/g;
+  const spaced = (form) => Array.from(form, (c) => (c > ' ' ? c : ' ')).join('');
+  const resolve = (ref) => inner(parseURL(ref, /^[\\/]/.test(ref) ? origin : undefined));
+  const fine = (text) =>
+    Array.from(text.matchAll(pattern), ([ref]) => resolve(ref)).every(
+      (u) => !onHost(u) || u.origin === origin
     );
   const exact = (form) =>
-    form === origin ||
-    (!onHost(inner(parseURL(form))) &&
-      references(form).every((u) => !onHost(u) || u.origin === origin));
+    form === origin || (!onHost(inner(parseURL(form))) && fine(form) && fine(spaced(form)));
+  const only = (ref, at, text) =>
+    parseURL(ref, /^[\\/]/.test(ref) ? origin : undefined)?.href === `${origin}/` &&
+    !/[\\/?#]/.test(text[at + ref.length] ?? '');
+  const bare = (form) =>
+    !spaced(form)
+      .replace(pattern, (ref, at, text) => (only(ref, at, text) ? ref.replace(hostname, ' ') : ref))
+      .includes(hostname);
+  const referenced = (title) =>
+    layers(title).every(exact) && readings(title).every((read) => bare(read.at(-1)));
   const cleanURL = (url) => !leaks(url) && layers(url).every(exact);
   const home = parseURL(trigger)?.href;
   const clean = (info) => {
-    if (parseURL(info.url)?.href === home) return ownTitle(info) || cleanTitle(info.title);
-    return cleanURL(info.url) && (cleanTitle(info.title) || (ownTitle(info) && !leaks(info.title)));
+    if (parseURL(info.url)?.href === home) return ownTitle(info) || cleanTitle(info);
+    return cleanURL(info.url) && (cleanTitle(info) || (ownTitle(info) && !leaks(info.title)));
   };
   return { clean, carries };
 }