@emasoft/svg-matrix 1.0.30 → 1.0.31

package/src/svg-rendering-context.js

@@ -120,11 +120,23 @@ export class SVGRenderingContext {
    * @param {Map} defsMap - Map of definitions (gradients, markers, clipPaths, etc.)
    */
   constructor(element, inherited = {}, defsMap = null) {
+    // Validate element parameter - Why: prevent crashes from null/undefined element
+    if (!element) {
+      throw new Error("SVGRenderingContext: element parameter is required");
+    }
+
+    // Validate inherited parameter - Why: ensure we can safely spread it
+    if (inherited !== null && typeof inherited !== "object") {
+      throw new Error(
+        "SVGRenderingContext: inherited must be an object or null",
+      );
+    }
+
     this.element = element;
     this.defsMap = defsMap || new Map();
 
     // Extract all properties with inheritance
-    this.properties = this._extractProperties(element, inherited);
+    this.properties = this._extractProperties(element, inherited || {});
 
     // Parse stroke-dasharray into array
     this.dashArray = this._parseDashArray(this.properties["stroke-dasharray"]);
@@ -157,6 +169,11 @@ export class SVGRenderingContext {
    * @private
    */
   _extractProperties(element, inherited) {
+    // Validate inherited is an object - Why: prevent spreading non-objects
+    if (typeof inherited !== "object" || inherited === null) {
+      throw new Error("_extractProperties: inherited must be an object");
+    }
+
     const props = { ...SVG_DEFAULTS, ...inherited };
 
     // Get attributes from element
@@ -206,6 +223,9 @@ export class SVGRenderingContext {
 
     const declarations = style.split(";");
     for (const decl of declarations) {
+      // Validate declaration has a colon - Why: prevent crashes on malformed CSS
+      if (!decl.includes(":")) continue;
+
       const [prop, value] = decl.split(":").map((s) => s.trim());
       if (prop && value) {
         props[prop] = value;
@@ -225,7 +245,24 @@ export class SVGRenderingContext {
       .toString()
       .split(/[\s,]+/)
       .filter((s) => s);
-    const values = parts.map((s) => D(parseFloat(s)));
+
+    // Validate each value is a valid number - Why: prevent NaN values in array
+    const values = [];
+    for (const part of parts) {
+      const num = parseFloat(part);
+      if (isNaN(num) || !isFinite(num)) {
+        throw new Error(`_parseDashArray: invalid dash value '${part}'`);
+      }
+      // Validate non-negative - Why: SVG spec requires non-negative dash values
+      if (num < 0) {
+        throw new Error(
+          `_parseDashArray: dash values must be non-negative, got ${num}`,
+        );
+      }
+      values.push(D(num));
+    }
+
+    if (values.length === 0) return null;
 
     // Per SVG spec, if odd number of values, duplicate the array
     if (values.length % 2 === 1) {
@@ -332,6 +369,33 @@ export class SVGRenderingContext {
    * @returns {Object} Expanded bounding box
    */
   expandBBoxForStroke(bbox) {
+    // Validate bbox parameter - Why: prevent crashes from missing properties
+    if (!bbox || typeof bbox !== "object") {
+      throw new Error("expandBBoxForStroke: bbox must be an object");
+    }
+    // Use 'in' operator to check for properties - Why: allow 0 values which are falsy but valid
+    if (
+      !("x" in bbox) ||
+      !("y" in bbox) ||
+      !("width" in bbox) ||
+      !("height" in bbox)
+    ) {
+      throw new Error(
+        "expandBBoxForStroke: bbox must have x, y, width, height properties",
+      );
+    }
+    // Validate bbox properties are Decimal-like - Why: prevent crashes from calling Decimal methods on numbers
+    if (
+      typeof bbox.x.minus !== "function" ||
+      typeof bbox.y.minus !== "function" ||
+      typeof bbox.width.plus !== "function" ||
+      typeof bbox.height.plus !== "function"
+    ) {
+      throw new Error(
+        "expandBBoxForStroke: bbox properties must be Decimal instances",
+      );
+    }
+
     if (!this.hasStroke) return bbox;
 
     const extent = this.getStrokeExtent();
@@ -354,15 +418,54 @@ export class SVGRenderingContext {
    * @returns {Object} Expanded bounding box
    */
   expandBBoxForMarkers(bbox, markerSizes = null) {
+    // Validate bbox parameter - Why: prevent crashes from missing properties
+    if (!bbox || typeof bbox !== "object") {
+      throw new Error("expandBBoxForMarkers: bbox must be an object");
+    }
+    // Use 'in' operator to check for properties - Why: allow 0 values which are falsy but valid
+    if (
+      !("x" in bbox) ||
+      !("y" in bbox) ||
+      !("width" in bbox) ||
+      !("height" in bbox)
+    ) {
+      throw new Error(
+        "expandBBoxForMarkers: bbox must have x, y, width, height properties",
+      );
+    }
+    // Validate bbox properties are Decimal-like - Why: prevent crashes from calling Decimal methods on numbers
+    if (
+      typeof bbox.x.minus !== "function" ||
+      typeof bbox.y.minus !== "function" ||
+      typeof bbox.width.plus !== "function" ||
+      typeof bbox.height.plus !== "function"
+    ) {
+      throw new Error(
+        "expandBBoxForMarkers: bbox properties must be Decimal instances",
+      );
+    }
+
     if (!this.hasMarkers) return bbox;
 
     // If marker sizes provided, use them; otherwise estimate from marker definitions
     let maxMarkerSize = D(0);
 
     if (markerSizes) {
+      // Validate markerSizes is an object - Why: prevent crashes when accessing properties
+      if (typeof markerSizes !== "object") {
+        throw new Error("expandBBoxForMarkers: markerSizes must be an object");
+      }
+
       const sizes = [markerSizes.start, markerSizes.mid, markerSizes.end]
-        .filter((s) => s)
-        .map((s) => D(s));
+        .filter((s) => s !== null && s !== undefined)
+        .map((s) => {
+          const num = typeof s === "number" ? s : parseFloat(s);
+          if (isNaN(num) || !isFinite(num)) {
+            throw new Error(`expandBBoxForMarkers: invalid marker size '${s}'`);
+          }
+          return D(num);
+        });
+
       if (sizes.length > 0) {
         maxMarkerSize = Decimal.max(...sizes);
       }
@@ -393,6 +496,33 @@ export class SVGRenderingContext {
    * @returns {Object} Expanded bounding box
    */
   expandBBoxForFilter(bbox, filterDef = null) {
+    // Validate bbox parameter - Why: prevent crashes from missing properties
+    if (!bbox || typeof bbox !== "object") {
+      throw new Error("expandBBoxForFilter: bbox must be an object");
+    }
+    // Use 'in' operator to check for properties - Why: allow 0 values which are falsy but valid
+    if (
+      !("x" in bbox) ||
+      !("y" in bbox) ||
+      !("width" in bbox) ||
+      !("height" in bbox)
+    ) {
+      throw new Error(
+        "expandBBoxForFilter: bbox must have x, y, width, height properties",
+      );
+    }
+    // Validate bbox properties are Decimal-like - Why: prevent crashes from calling Decimal methods on numbers
+    if (
+      typeof bbox.x.minus !== "function" ||
+      typeof bbox.y.minus !== "function" ||
+      typeof bbox.width.times !== "function" ||
+      typeof bbox.height.times !== "function"
+    ) {
+      throw new Error(
+        "expandBBoxForFilter: bbox properties must be Decimal instances",
+      );
+    }
+
     const filterRef = this.properties.filter;
     if (!filterRef || filterRef === "none") return bbox;
 
@@ -403,8 +533,29 @@ export class SVGRenderingContext {
 
     // If filter definition provided with explicit bounds, use those
     if (filterDef) {
-      if (filterDef.x !== undefined) extentX = D(filterDef.x).abs();
-      if (filterDef.y !== undefined) extentY = D(filterDef.y).abs();
+      // Validate filterDef is an object - Why: prevent crashes when accessing properties
+      if (typeof filterDef !== "object") {
+        throw new Error("expandBBoxForFilter: filterDef must be an object");
+      }
+
+      if (filterDef.x !== undefined) {
+        const xVal = parseFloat(filterDef.x);
+        if (isNaN(xVal) || !isFinite(xVal)) {
+          throw new Error(
+            `expandBBoxForFilter: invalid filterDef.x value '${filterDef.x}'`,
+          );
+        }
+        extentX = D(xVal).abs();
+      }
+      if (filterDef.y !== undefined) {
+        const yVal = parseFloat(filterDef.y);
+        if (isNaN(yVal) || !isFinite(yVal)) {
+          throw new Error(
+            `expandBBoxForFilter: invalid filterDef.y value '${filterDef.y}'`,
+          );
+        }
+        extentY = D(yVal).abs();
+      }
     }
 
     return {
@@ -423,6 +574,36 @@ export class SVGRenderingContext {
    * @returns {Object} Full rendered bounding box
    */
   getRenderedBBox(geometryBBox, options = {}) {
+    // Validate geometryBBox parameter - Why: prevent crashes from missing properties
+    if (!geometryBBox || typeof geometryBBox !== "object") {
+      throw new Error("getRenderedBBox: geometryBBox must be an object");
+    }
+    // Use 'in' operator to check for properties - Why: allow 0 values which are falsy but valid
+    if (
+      !("x" in geometryBBox) ||
+      !("y" in geometryBBox) ||
+      !("width" in geometryBBox) ||
+      !("height" in geometryBBox)
+    ) {
+      throw new Error(
+        "getRenderedBBox: geometryBBox must have x, y, width, height properties",
+      );
+    }
+    // Validate geometryBBox properties are Decimal-like - Why: prevent crashes from calling Decimal methods on numbers
+    if (
+      typeof geometryBBox.x.minus !== "function" ||
+      typeof geometryBBox.y.minus !== "function"
+    ) {
+      throw new Error(
+        "getRenderedBBox: geometryBBox properties must be Decimal instances",
+      );
+    }
+
+    // Validate options parameter - Why: prevent crashes when accessing properties
+    if (options !== null && typeof options !== "object") {
+      throw new Error("getRenderedBBox: options must be an object or null");
+    }
+
     let bbox = { ...geometryBBox };
 
     // Expand for stroke
@@ -444,6 +625,14 @@ export class SVGRenderingContext {
    * @returns {Array} Polygon(s) representing the full rendered area
    */
   getFilledArea(polygon) {
+    // Validate polygon parameter - Why: prevent crashes from non-array or empty polygon
+    if (!Array.isArray(polygon)) {
+      throw new Error("getFilledArea: polygon must be an array");
+    }
+    if (polygon.length === 0) {
+      throw new Error("getFilledArea: polygon must not be empty");
+    }
+
     const areas = [];
 
     // Add fill area (if filled)
@@ -484,6 +673,24 @@ export class SVGRenderingContext {
    * @returns {boolean} True if point is inside rendered area
    */
   isPointInRenderedArea(point, polygon) {
+    // Validate point parameter - Why: prevent crashes from missing x, y properties
+    if (!point || typeof point !== "object") {
+      throw new Error("isPointInRenderedArea: point must be an object");
+    }
+    if (point.x === undefined || point.y === undefined) {
+      throw new Error(
+        "isPointInRenderedArea: point must have x and y properties",
+      );
+    }
+
+    // Validate polygon parameter - Why: prevent crashes from non-array or empty polygon
+    if (!Array.isArray(polygon)) {
+      throw new Error("isPointInRenderedArea: polygon must be an array");
+    }
+    if (polygon.length === 0) {
+      throw new Error("isPointInRenderedArea: polygon must not be empty");
+    }
+
     // Check fill area
     if (this.hasFill) {
       const fillRule =
@@ -523,6 +730,13 @@ export class SVGRenderingContext {
    * @returns {Object} {canMerge: boolean, reason: string}
    */
   canMergeWith(other) {
+    // Validate other parameter - Why: prevent crashes from non-SVGRenderingContext instances
+    if (!(other instanceof SVGRenderingContext)) {
+      throw new Error(
+        "canMergeWith: other must be an instance of SVGRenderingContext",
+      );
+    }
+
     // Fill rules must match
     if (this.fillRule !== other.fillRule) {
       return { canMerge: false, reason: "Different fill-rule" };
@@ -608,6 +822,11 @@ export function createRenderingContext(
   inherited = {},
   defsMap = null,
 ) {
+  // Validate parameters - Why: delegate validation to constructor which has proper error messages
+  if (!element) {
+    throw new Error("createRenderingContext: element parameter is required");
+  }
+
   return new SVGRenderingContext(element, inherited, defsMap);
 }
 
@@ -618,6 +837,11 @@ export function createRenderingContext(
  * @returns {Object} Inherited properties
  */
 export function getInheritedProperties(element) {
+  // Validate element parameter - Why: prevent crashes from null/undefined element
+  if (!element) {
+    throw new Error("getInheritedProperties: element parameter is required");
+  }
+
   const inherited = {};
 
   // Inheritable properties per SVG spec
@@ -644,6 +868,11 @@ export function getInheritedProperties(element) {
     "font-weight",
   ];
 
+  // Check if element has parentNode - Why: prevent crashes when accessing parentNode
+  if (!element.parentNode) {
+    return inherited;
+  }
+
   let current = element.parentNode;
   while (current && current.tagName) {
     for (const prop of inheritableProps) {

package/src/svg-toolbox.js

@@ -597,6 +597,10 @@ const levenshteinCache = new Map();
  * @returns {number} Edit distance
  */
 const levenshteinDistance = (a, b) => {
+  // Validate parameters
+  if (typeof a !== "string" || typeof b !== "string") {
+    throw new Error("Both parameters must be strings");
+  }
   // Check cache first
   const key = `${a}|${b}`;
   if (levenshteinCache.has(key)) return levenshteinCache.get(key);
@@ -639,9 +643,12 @@ const resetLevenshteinCache = () => levenshteinCache.clear();
  * @returns {string|null} Closest match or null if none within threshold
  */
 const findClosestMatch = (name, validSet, maxDistance = 2) => {
+  if (!name || typeof name !== "string") return null;
+  if (!validSet || !(validSet instanceof Set) || validSet.size === 0) return null;
+  const validMaxDistance = (typeof maxDistance !== "number" || maxDistance < 0) ? 2 : maxDistance;
   const lower = name.toLowerCase();
   let closest = null;
-  let minDist = maxDistance + 1;
+  let minDist = validMaxDistance + 1;
 
   for (const valid of validSet) {
     const dist = levenshteinDistance(lower, valid.toLowerCase());
@@ -706,6 +713,7 @@ function hasCircularReference(startId, getNextId, maxDepth = 100) {
  * @returns {string} SVG string with proper CDATA sections
  */
 function fixCDATASections(svgString) {
+  if (!svgString || typeof svgString !== "string") return svgString || "";
   // Pattern to find script/style elements marked with data-cdata-pending
   // and fix their CDATA wrapping
   return svgString.replace(
@@ -809,9 +817,15 @@ function isElement(obj) {
  * @returns {string} Formatted string without trailing zeros
  */
 export function formatPrecision(value, precision = DEFAULT_PRECISION) {
+  if (value === null || value === undefined) return "0";
+  let validPrecision = precision;
+  if (typeof precision !== "number" || isNaN(precision) || precision < 0) {
+    validPrecision = DEFAULT_PRECISION;
+  }
+  if (validPrecision > MAX_PRECISION) validPrecision = MAX_PRECISION;
   const d = D(value);
   // Round to precision, then remove trailing zeros
-  const fixed = d.toFixed(precision);
+  const fixed = d.toFixed(validPrecision);
   // Remove trailing zeros after decimal point
   if (fixed.includes(".")) {
     return fixed.replace(/\.?0+$/, "");
@@ -871,6 +885,9 @@ export const OutputFormat = {
  * @returns {string} Input type from InputType enum
  */
 export function detectInputType(input) {
+  if (input === null || input === undefined) {
+    throw new Error("Input cannot be null or undefined");
+  }
   if (typeof input === "string") {
     const trimmed = input.trim();
     if (trimmed.startsWith("<")) {
@@ -2674,6 +2691,11 @@ export const removeViewBox = createOperation((doc, _options = {}) => {
     const w = parseFloat(width);
     const h = parseFloat(height);
 
+    // Validate parsed values are not NaN
+    if (isNaN(w) || isNaN(h) || vb.some((v) => isNaN(v))) {
+      return doc; // Skip if any value is invalid
+    }
+
     // Use epsilon comparison for floating point values to avoid precision issues
     const epsilon = 1e-6;
     if (
@@ -3260,6 +3282,11 @@ export const convertEllipseToCircle = createOperation((doc, _options = {}) => {
     const rx = parseFloat(ellipse.getAttribute("rx") || "0");
     const ry = parseFloat(ellipse.getAttribute("ry") || "0");
 
+    // Validate parsed values are not NaN
+    if (isNaN(rx) || isNaN(ry)) {
+      continue; // Skip if any value is invalid
+    }
+
     if (Math.abs(rx - ry) < 0.001) {
       const circle = new SVGElement("circle", {});
 
@@ -4942,7 +4969,9 @@ function getStopOpacity(stop) {
     }
   }
 
-  return opacity ? parseFloat(opacity) : 1.0;
+  // Parse opacity value and validate it's not NaN
+  const parsedOpacity = opacity ? parseFloat(opacity) : 1.0;
+  return isNaN(parsedOpacity) ? 1.0 : parsedOpacity;
 }
 
 /**
@@ -4952,6 +4981,10 @@ function getStopOpacity(stop) {
  * @returns {string} Hex color string (e.g., "#ff8800")
  */
 function normalizeColor(color) {
+  // Validate color parameter is not null/undefined
+  if (!color || typeof color !== "string") {
+    return "#000000"; // Return default black if invalid
+  }
   const colorValue = color.trim().toLowerCase();
 
   // Already hex format
@@ -5035,11 +5068,15 @@ function interpolateColors(color1, color2, t) {
         hexValue[2] +
         hexValue[2];
     }
-    return [
-      parseInt(hexValue.slice(0, 2), 16),
-      parseInt(hexValue.slice(2, 4), 16),
-      parseInt(hexValue.slice(4, 6), 16),
-    ];
+    // Parse RGB components and validate they're not NaN
+    const r = parseInt(hexValue.slice(0, 2), 16);
+    const g = parseInt(hexValue.slice(2, 4), 16);
+    const b = parseInt(hexValue.slice(4, 6), 16);
+    // Return default black [0, 0, 0] if any component is NaN
+    if (isNaN(r) || isNaN(g) || isNaN(b)) {
+      return [0, 0, 0];
+    }
+    return [r, g, b];
   };
 
   const [r1, g1, b1] = parseHex(color1);

package/src/svg2-polyfills.js

@@ -63,6 +63,9 @@ let useMinifiedPolyfills = true;
  * @param {boolean} minify - True to use minified (default), false for full version
  */
 export function setPolyfillMinification(minify) {
+  if (typeof minify !== 'boolean') {
+    throw new Error('setPolyfillMinification: minify parameter must be a boolean');
+  }
   useMinifiedPolyfills = minify;
 }
 
@@ -83,7 +86,10 @@ export const SVG2_FEATURES = {
  * @returns {{meshGradients: string[], hatches: string[], contextPaint: boolean, autoStartReverse: boolean}} Detected features
  */
 export function detectSVG2Features(doc) {
-  if (!doc) return { meshGradients: [], hatches: [], contextPaint: false, autoStartReverse: false };
+  // WHY: Validate doc is an object before attempting to traverse it
+  if (!doc || typeof doc !== 'object') {
+    return { meshGradients: [], hatches: [], contextPaint: false, autoStartReverse: false };
+  }
 
   const features = {
     meshGradients: [],
@@ -123,7 +129,7 @@ export function detectSVG2Features(doc) {
     }
 
     // Recurse into children
-    if (el.children) {
+    if (el.children && Array.isArray(el.children)) {
       for (const child of el.children) {
         walk(child);
       }
@@ -206,6 +212,24 @@ function generateHatchPolyfillCode() {
  * @returns {string|null} Complete polyfill script or null if none needed
  */
 export function generatePolyfillScript(features) {
+  // WHY: Explicit null check before typeof check prevents null passing as object
+  if (!features || typeof features !== 'object') {
+    throw new Error('generatePolyfillScript: features parameter must be an object');
+  }
+  if (!Array.isArray(features.meshGradients)) {
+    throw new Error('generatePolyfillScript: features.meshGradients must be an array');
+  }
+  if (!Array.isArray(features.hatches)) {
+    throw new Error('generatePolyfillScript: features.hatches must be an array');
+  }
+  // WHY: Validate boolean properties to prevent undefined/wrong type usage
+  if (typeof features.contextPaint !== 'boolean') {
+    throw new Error('generatePolyfillScript: features.contextPaint must be a boolean');
+  }
+  if (typeof features.autoStartReverse !== 'boolean') {
+    throw new Error('generatePolyfillScript: features.autoStartReverse must be a boolean');
+  }
+
   const parts = [];
 
   parts.push('/* SVG 2.0 Polyfills - Generated by svg-matrix */');
@@ -261,17 +285,22 @@ export function injectPolyfills(doc, options = {}) {
   }, [], script);
 
   // Insert script at beginning of SVG (after defs if present, else at start)
-  if (svg.children && svg.children.length > 0) {
-    // Find first non-defs element to insert before
+  if (!Array.isArray(svg.children)) {
+    // Initialize children array if missing
+    svg.children = [];
+  }
+
+  if (svg.children.length > 0) {
+    // Find position after the last defs element to insert the script
     let insertIdx = 0;
     for (let i = 0; i < svg.children.length; i++) {
-      if (svg.children[i].tagName === 'defs') {
-        insertIdx = i + 1;
-        break;
+      // WHY: Optional chaining prevents errors if array contains null/undefined elements
+      if (svg.children[i]?.tagName === 'defs') {
+        insertIdx = i + 1; // Position after this defs (don't break - continue to find last defs)
       }
     }
     svg.children.splice(insertIdx, 0, scriptEl);
-  } else if (svg.children) {
+  } else {
     svg.children.push(scriptEl);
   }
 
@@ -288,11 +317,12 @@ export function removePolyfills(doc) {
   if (!doc) return doc;
 
   const walk = (el) => {
-    if (!el || !el.children) return;
+    if (!el || !el.children || !Array.isArray(el.children)) return;
 
     // Remove script elements that are svg-matrix polyfills
     el.children = el.children.filter(child => {
-      if (child.tagName === 'script') {
+      // WHY: Optional chaining prevents errors if child is null/undefined
+      if (child?.tagName === 'script') {
         const content = child.textContent || '';
         if (content.includes('SVG 2.0 Polyfill') ||
             content.includes('Generated by svg-matrix')) {