@slicedearth/whoisleuth-cli 2.2.0 → 2.4.0

package/lib/static-html-analysis.mjs

@@ -1,21 +1,18 @@
-// One bounded tokenization pass over the already-captured homepage body. The
-// parse5 tokenizer applies HTML tokenization rules without constructing a DOM,
-// so deeply nested hostile markup cannot create an unbounded element tree.
-// Only normalized start-tag markup and capped script indicators are retained.
-import { Tokenizer, TokenizerMode } from 'parse5';
+// One bounded native HTML parse over the already-captured homepage body.
+// Consumers share element/attribute evidence instead of reparsing reconstructed
+// markup. Only bounded transient projections leave this module, never a DOM.
+import { htmlTreeEvents, isHtmlElement, parseBoundedHtml, MAX_STATIC_HTML_CHARS, MAX_STATIC_HTML_TAGS, MAX_STATIC_HTML_TREE_EVENTS, } from "./bounded-html-document.mjs";
 import { MAX_CSP_META_POLICIES, MAX_RESPONSE_POLICY_HEADER_BYTES, } from "./response-policy.mjs";
+import { MAX_FAVICON_BYTES, MAX_FAVICON_CANDIDATES } from "./outbound-request-bounds.mjs";
 import { MAX_PAGE_PUBLICATION_DECLARATIONS, MAX_PAGE_PUBLICATION_META_ELEMENTS, MAX_PAGE_PUBLICATION_ROBOTS_DIRECTIVES, } from "./homepage-metadata-contract.mjs";
-const MAX_STATIC_HTML_CHARS = 300_000;
-const MAX_STATIC_HTML_TAGS = 8_192;
-const MAX_STATIC_STRUCTURE_TOKENS = 4_096;
-const MAX_TECHNOLOGY_TAGS = 2_048;
+const MAX_STATIC_STRUCTURE_TOKENS = MAX_STATIC_HTML_TREE_EVENTS;
 const MAX_TAG_LENGTH = 4_096;
 const MAX_ATTRIBUTES_PER_TAG = 128;
 const MAX_SCRIPT_ELEMENTS = 64;
 const MAX_SCRIPT_REFERENCE_LENGTH = 2_048;
 const MAX_SCRIPT_MEDIA_TYPE_LENGTH = 120;
-const MAX_INLINE_SCRIPT_CHARS = 32_768;
 const MAX_INLINE_SCRIPT_TOTAL_CHARS = 65_536;
+const MAX_INLINE_SCRIPT_CHARS = MAX_INLINE_SCRIPT_TOTAL_CHARS;
 const MAX_STATIC_VISIBLE_TEXT_CHARS = MAX_STATIC_HTML_CHARS;
 const MAX_STATIC_FORMS = 50;
 const MAX_STATIC_INPUTS = 500;
@@ -39,29 +36,11 @@ const PAYMENT_AUTOCOMPLETE_TOKENS = new Set([
     'transaction-currency',
     'transaction-amount',
 ]);
-const RAW_TEXT_MODES = Object.freeze({
-    iframe: TokenizerMode.RAWTEXT,
-    noembed: TokenizerMode.RAWTEXT,
-    noframes: TokenizerMode.RAWTEXT,
-    script: TokenizerMode.SCRIPT_DATA,
-    style: TokenizerMode.RAWTEXT,
-    template: TokenizerMode.RAWTEXT,
-    textarea: TokenizerMode.RCDATA,
-    title: TokenizerMode.RCDATA,
-    xmp: TokenizerMode.RAWTEXT,
-});
 const VOID_TAGS = new Set([
     'area', 'base', 'br', 'col', 'embed', 'hr', 'img', 'input', 'link', 'meta',
     'param', 'source', 'track', 'wbr',
 ]);
-const NON_VISIBLE_TEXT_TAGS = new Set(['script', 'style', 'template']);
-const HEAD_CONTEXT_TAGS = new Set([
-    'html', 'head', 'base', 'basefont', 'bgsound', 'link', 'meta', 'title',
-    'noscript', 'noframes', 'style', 'template', 'script',
-]);
-const IMPLICIT_HEAD_TEXT_TAGS = new Set([
-    'title', 'noscript', 'noframes', 'style', 'template', 'script',
-]);
+const NON_VISIBLE_TEXT_TAGS = new Set(['head', 'script', 'style', 'template', 'noscript', 'iframe', 'noembed', 'noframes']);
 const ROBOTS_DIRECTIVES = new Set([
     'all', 'follow', 'index', 'max-image-preview', 'max-snippet', 'max-video-preview',
     'noarchive', 'nocache', 'nofollow', 'noimageindex', 'noindex', 'none', 'nositelinkssearchbox',
@@ -73,7 +52,7 @@ const JAVASCRIPT_MEDIA_TYPES = new Set([
     'text/javascript1.1', 'text/javascript1.2', 'text/javascript1.3', 'text/javascript1.4',
     'text/javascript1.5', 'text/jscript', 'text/livescript', 'text/x-ecmascript', 'text/x-javascript',
 ]);
-function attributeValue(attributes, name, maximumLength = MAX_FORM_ATTRIBUTE_LENGTH) {
+function attributeValue(attributes, name, maximumLength = MAX_FORM_ATTRIBUTE_LENGTH, lowercase = true) {
     const attribute = attributes
         .slice(0, MAX_ATTRIBUTES_PER_TAG)
         .find((candidate) => candidate.name.toLowerCase() === name);
@@ -84,7 +63,7 @@ function attributeValue(attributes, name, maximumLength = MAX_FORM_ATTRIBUTE_LEN
     }
     return {
         present: true,
-        value: attribute.value.trim().toLowerCase(),
+        value: lowercase ? attribute.value.trim().toLowerCase() : attribute.value.trim(),
         truncated: attributes.length > MAX_ATTRIBUTES_PER_TAG,
     };
 }
@@ -116,8 +95,8 @@ function formMethod(attributes) {
         truncated: method.truncated,
     };
 }
-function formAction(attributes, baseUrl) {
-    const action = attributeValue(attributes, 'action');
+function formAction(attributes, resolutionBase, documentOrigin) {
+    const action = attributeValue(attributes, 'action', MAX_FORM_ATTRIBUTE_LENGTH, false);
     if (!action.present && action.truncated) {
         return { relationship: 'unclassified', cleartext: false, truncated: true };
     }
@@ -127,16 +106,16 @@ function formAction(attributes, baseUrl) {
     if (action.value === null) {
         return { relationship: 'unclassified', cleartext: false, truncated: true };
     }
-    if (!baseUrl) {
+    if (!resolutionBase || !documentOrigin) {
         return { relationship: 'unclassified', cleartext: false, truncated: action.truncated };
     }
     try {
-        const parsed = new URL(action.value, baseUrl);
+        const parsed = new URL(action.value, resolutionBase);
         if (!['http:', 'https:'].includes(parsed.protocol) || parsed.username || parsed.password || !parsed.hostname) {
             return { relationship: 'unclassified', cleartext: false, truncated: action.truncated };
         }
         return {
-            relationship: parsed.origin === baseUrl.origin ? 'sameOrigin' : 'external',
+            relationship: parsed.origin === documentOrigin ? 'sameOrigin' : 'external',
             cleartext: parsed.protocol === 'http:',
             truncated: action.truncated,
         };
@@ -218,29 +197,18 @@ function stylesheetCandidate(attributes) {
         truncated: rel.truncated || href.truncated || disabled.truncated || media.truncated,
     };
 }
-function serializedStartTag(tagName, attributes) {
-    let serialized = `<${tagName.toLowerCase()}`;
-    let limitReached = attributes.length > MAX_ATTRIBUTES_PER_TAG;
-    for (const attribute of attributes.slice(0, MAX_ATTRIBUTES_PER_TAG)) {
-        const candidate = ` ${attribute.name.toLowerCase()}="${attribute.value.toLowerCase()}"`;
-        if (serialized.length + candidate.length + 1 > MAX_TAG_LENGTH) {
-            limitReached = true;
-            break;
-        }
-        serialized += candidate;
-    }
-    return {
-        markup: serialized.length + 1 <= MAX_TAG_LENGTH ? `${serialized}>` : null,
-        limitReached,
-    };
-}
 function analyzeStaticHtml(value, options = {}) {
-    const supplied = typeof value === 'string' ? value : '';
-    const inputLimitReached = supplied.length > MAX_STATIC_HTML_CHARS;
-    const html = supplied.slice(0, MAX_STATIC_HTML_CHARS);
-    const baseUrl = safeBaseUrl(options.baseUrl);
+    const parsed = parseBoundedHtml(value);
+    const { inputLimitReached } = parsed;
+    const documentUrl = safeBaseUrl(options.baseUrl);
+    let effectiveBaseUrl = documentUrl;
+    let baseHrefState = 'absent';
     const includeVisibleText = options.includeVisibleText === true;
-    const markup = [];
+    const elements = [];
+    const iconLinks = [];
+    const iconCounts = [0, 0];
+    const tokens = [];
+    const elementStack = [];
     const visibleTextParts = [];
     const structureTokens = [];
     const scripts = [];
@@ -296,11 +264,10 @@ function analyzeStaticHtml(value, options = {}) {
     };
     const robotDirectives = new Set();
     const twitterCardTypes = new Set();
-    let tokenizer;
     let activeInlineScript = null;
     let tagsExamined = 0;
     let inlineCharactersExamined = 0;
-    let tagLimitReached = false;
+    let tagLimitReached = parsed.constructionLimitReached;
     let structureLimitReached = false;
     let scriptLimitReached = false;
     let inlineLimitReached = false;
@@ -308,20 +275,28 @@ function analyzeStaticHtml(value, options = {}) {
     let cspMetaLimitReached = false;
     let publicationMetaElements = 0;
     let robotDirectiveTokens = 0;
-    let publicationTagLimitReached = false;
+    let publicationTagLimitReached = parsed.constructionLimitReached;
     let insideExplicitHead = false;
-    let implicitHeadTextDepth = 0;
-    let headScopeClosed = false;
-    let bodyContentStarted = false;
+    let insideHead = false;
     let scriptElementSeen = false;
     let nonVisibleTextDepth = 0;
     let visibleTextCharacters = 0;
+    let titleDepth = 0;
+    let titleCharacters = 0;
+    const titleParts = [];
+    const pendingFormActions = [];
+    function appendTitle(chars) {
+        if (titleDepth === 0 || !chars || titleCharacters >= 201)
+            return;
+        const retained = chars.slice(0, 201 - titleCharacters);
+        titleParts.push(retained);
+        titleCharacters += retained.length;
+    }
     function appendInlineScript(chars) {
         if (!activeInlineScript || !chars)
             return;
-        const perScriptRemaining = MAX_INLINE_SCRIPT_CHARS - activeInlineScript.inlineContent.length;
         const totalRemaining = MAX_INLINE_SCRIPT_TOTAL_CHARS - inlineCharactersExamined;
-        const retainedLength = Math.max(0, Math.min(chars.length, perScriptRemaining, totalRemaining));
+        const retainedLength = Math.max(0, Math.min(chars.length, totalRemaining));
         if (retainedLength > 0) {
             activeInlineScript.inlineContent += chars.slice(0, retainedLength);
             inlineCharactersExamined += retainedLength;
@@ -348,32 +323,118 @@ function analyzeStaticHtml(value, options = {}) {
         if (retainedLength < chars.length)
             visibleTextLimitReached = true;
     }
-    const handler = {
-        onStartTag(token) {
-            const tagName = token.tagName.toLowerCase();
-            const rawTextMode = RAW_TEXT_MODES[tagName];
-            if (!token.selfClosing && rawTextMode !== undefined)
-                tokenizer.state = rawTextMode;
-            if (!token.selfClosing && NON_VISIBLE_TEXT_TAGS.has(tagName))
-                nonVisibleTextDepth += 1;
-            if (tagsExamined >= MAX_STATIC_HTML_TAGS) {
-                tagLimitReached = true;
-                publicationTagLimitReached = true;
+    function appendToken(token) {
+        if (tokens.length >= MAX_STATIC_STRUCTURE_TOKENS)
+            structureLimitReached = true;
+        else
+            tokens.push(token);
+    }
+    for (const event of htmlTreeEvents(parsed.document)) {
+        if (event.kind === 'text') {
+            appendInlineScript(event.text);
+            appendTitle(event.text);
+            appendVisibleText(event.text);
+            if (nonVisibleTextDepth === 0)
+                appendToken({ kind: 'text', value: event.text });
+            continue;
+        }
+        const node = event.element;
+        const tagName = node.tagName.toLowerCase();
+        const htmlElement = isHtmlElement(node);
+        if (event.kind === 'end') {
+            elementStack.pop();
+            if (tagName === 'script')
                 activeInlineScript = null;
-                return;
+            if (htmlElement && tagName === 'title')
+                titleDepth = 0;
+            if (htmlElement && tagName === 'head') {
+                insideHead = false;
+                insideExplicitHead = false;
+            }
+            if (!htmlElement || !VOID_TAGS.has(tagName)) {
+                appendStructureToken(`/${tagName}`);
+                appendToken({ kind: 'end', name: tagName });
+            }
+            if (NON_VISIBLE_TEXT_TAGS.has(tagName))
+                nonVisibleTextDepth -= 1;
+            continue;
+        }
+        {
+            const token = { attrs: node.attrs };
+            if (NON_VISIBLE_TEXT_TAGS.has(tagName))
+                nonVisibleTextDepth += 1;
+            if (node.sourceCodeLocation?.startTag)
+                tagsExamined += 1;
+            appendStructureToken(htmlElement && VOID_TAGS.has(tagName) ? `${tagName}/` : tagName);
+            if (htmlElement && tagName === 'head') {
+                insideHead = true;
+                insideExplicitHead = Boolean(node.sourceCodeLocation?.startTag);
             }
-            tagsExamined += 1;
-            appendStructureToken(token.selfClosing || VOID_TAGS.has(tagName) ? `${tagName}/` : tagName);
-            if (tagName === 'head')
-                insideExplicitHead = true;
-            if (tagName === 'body' || (!insideExplicitHead && !HEAD_CONTEXT_TAGS.has(tagName))) {
-                bodyContentStarted = true;
-                headScopeClosed = true;
+            const inPublicationHead = insideHead;
+            const attributes = [];
+            let attributeLength = 0;
+            for (const attribute of node.attrs) {
+                attributeLength += attribute.name.length + attribute.value.length;
+                if (attributes.length >= MAX_ATTRIBUTES_PER_TAG || attributeLength > MAX_TAG_LENGTH)
+                    break;
+                attributes.push({ name: attribute.name, value: attribute.value });
+            }
+            const element = {
+                name: tagName, html: htmlElement, attributes,
+                attributesTruncated: attributes.length !== node.attrs.length,
+                parent: elementStack.at(-1) ?? null, inHead: insideHead,
+            };
+            elementStack.push(elements.length);
+            elements.push(element);
+            appendToken({ kind: 'start', element });
+            // Foreign drawing attributes are not HTML technology, form or resource
+            // inputs. Their per-element omission still reaches fingerprinting, but
+            // must not make unrelated HTML evidence incomplete.
+            if (htmlElement && element.attributesTruncated)
+                tagLimitReached = true;
+            if (!htmlElement)
+                continue;
+            if (tagName === 'link') {
+                const rel = node.attrs.find((attribute) => attribute.name === 'rel')?.value;
+                const href = node.attrs.find((attribute) => attribute.name === 'href')?.value.trim();
+                if (rel && rel.length <= 128 && href) {
+                    const relations = rel.toLowerCase().split(/[\t\n\f\r ]+/u);
+                    const priority = relations.includes('icon') ? 0
+                        : relations.some((relation) => ['apple-touch-icon', 'apple-touch-icon-precomposed'].includes(relation)) ? 1 : null;
+                    // Inline image bytes have their own bound; the general 4 KiB
+                    // attribute projection must not silently discard supported icons.
+                    const maxHref = /^data:/iu.test(href) ? MAX_FAVICON_BYTES * 3 + 128 : 2048;
+                    if (priority !== null && iconCounts[priority] < MAX_FAVICON_CANDIDATES && href.length <= maxHref) {
+                        iconLinks.push({ href, priority });
+                        iconCounts[priority] += 1;
+                    }
+                }
             }
-            if (!insideExplicitHead && !headScopeClosed && !token.selfClosing && IMPLICIT_HEAD_TEXT_TAGS.has(tagName)) {
-                implicitHeadTextDepth += 1;
+            // The first document base applies even when it appears in the body;
+            // publication metadata's separate head-only policy does not govern URLs.
+            if (tagName === 'base' && baseHrefState === 'absent') {
+                const href = attributeValue(token.attrs, 'href', MAX_FORM_ATTRIBUTE_LENGTH, false);
+                if (href.truncated && !href.present) {
+                    effectiveBaseUrl = documentUrl;
+                    baseHrefState = 'invalid';
+                }
+                else if (href.present) {
+                    try {
+                        const parsed = href.value !== null && documentUrl ? new URL(href.value, documentUrl) : null;
+                        if (!parsed || !['http:', 'https:'].includes(parsed.protocol) || parsed.username || parsed.password || !parsed.hostname) {
+                            throw new Error('Invalid document base URL.');
+                        }
+                        effectiveBaseUrl = parsed;
+                        baseHrefState = 'valid';
+                    }
+                    catch {
+                        effectiveBaseUrl = documentUrl;
+                        baseHrefState = 'invalid';
+                    }
+                }
             }
-            const inPublicationHead = insideExplicitHead || (!headScopeClosed && !bodyContentStarted && HEAD_CONTEXT_TAGS.has(tagName));
+            if (tagName === 'title' && titleParts.length === 0)
+                titleDepth = 1;
             if (/^h[1-6]$/u.test(tagName)) {
                 const key = tagName;
                 publicationMetadata.headings[key] += 1;
@@ -414,10 +475,10 @@ function analyzeStaticHtml(value, options = {}) {
                 if (candidate.candidate)
                     publicationMetadata.renderBlockingCandidates.stylesheet += 1;
             }
-            if (tagName === 'meta' && insideExplicitHead) {
+            if (tagName === 'meta' && insideHead) {
                 const httpEquiv = attributeValue(token.attrs, 'http-equiv', 64);
                 if (httpEquiv.value === 'content-security-policy') {
-                    const content = attributeValue(token.attrs, 'content', MAX_RESPONSE_POLICY_HEADER_BYTES);
+                    const content = attributeValue(token.attrs, 'content', MAX_RESPONSE_POLICY_HEADER_BYTES, false);
                     if (content.value === null || !content.value) {
                         cspMetaLimitReached = cspMetaLimitReached || content.present || content.truncated;
                     }
@@ -548,16 +609,6 @@ function analyzeStaticHtml(value, options = {}) {
                     }
                 }
             }
-            if (markup.length < MAX_TECHNOLOGY_TAGS) {
-                const serialized = serializedStartTag(tagName, token.attrs);
-                if (serialized.limitReached)
-                    tagLimitReached = true;
-                if (serialized.markup)
-                    markup.push(serialized.markup);
-            }
-            else {
-                tagLimitReached = true;
-            }
             if (tagName === 'form') {
                 if (forms.formsObserved >= MAX_STATIC_FORMS) {
                     forms.truncated = true;
@@ -566,11 +617,8 @@ function analyzeStaticHtml(value, options = {}) {
                     forms.formsObserved += 1;
                     const method = formMethod(token.attrs);
                     forms.methods[method.value] += 1;
-                    const action = formAction(token.attrs, baseUrl);
-                    forms.actions[action.relationship] += 1;
-                    if (action.cleartext)
-                        forms.actions.cleartext += 1;
-                    if (method.truncated || action.truncated)
+                    pendingFormActions.push(token.attrs);
+                    if (method.truncated || token.attrs.length > MAX_ATTRIBUTES_PER_TAG)
                         forms.truncated = true;
                 }
             }
@@ -591,13 +639,13 @@ function analyzeStaticHtml(value, options = {}) {
             }
             if (tagName !== 'script') {
                 activeInlineScript = null;
-                return;
+                continue;
             }
             scriptElementSeen = true;
             if (scripts.length >= MAX_SCRIPT_ELEMENTS) {
                 scriptLimitReached = true;
                 activeInlineScript = null;
-                return;
+                continue;
             }
             const reference = scriptReference(token.attrs);
             const script = {
@@ -607,49 +655,18 @@ function analyzeStaticHtml(value, options = {}) {
             };
             scripts.push(script);
             activeInlineScript = reference ? null : script;
-        },
-        onEndTag(token) {
-            const tagName = token.tagName.toLowerCase();
-            if (tagName === 'script')
-                activeInlineScript = null;
-            if (tagName === 'head') {
-                insideExplicitHead = false;
-                headScopeClosed = true;
-            }
-            if (!insideExplicitHead && IMPLICIT_HEAD_TEXT_TAGS.has(tagName) && implicitHeadTextDepth > 0) {
-                implicitHeadTextDepth -= 1;
-            }
-            if (!VOID_TAGS.has(tagName))
-                appendStructureToken(`/${tagName}`);
-            if (NON_VISIBLE_TEXT_TAGS.has(tagName) && nonVisibleTextDepth > 0)
-                nonVisibleTextDepth -= 1;
-        },
-        onCharacter(token) {
-            if (!insideExplicitHead && !headScopeClosed && implicitHeadTextDepth === 0 && token.chars.trim()) {
-                bodyContentStarted = true;
-                headScopeClosed = true;
-            }
-            appendInlineScript(token.chars);
-            appendVisibleText(token.chars);
-        },
-        onNullCharacter(token) {
-            if (!insideExplicitHead && !headScopeClosed && implicitHeadTextDepth === 0) {
-                bodyContentStarted = true;
-                headScopeClosed = true;
-            }
-            appendInlineScript(token.chars);
-            appendVisibleText(token.chars);
-        },
-        onWhitespaceCharacter(token) {
-            appendInlineScript(token.chars);
-            appendVisibleText(token.chars);
-        },
-        onComment() { },
-        onDoctype() { },
-        onEof() { },
-    };
-    tokenizer = new Tokenizer({ sourceCodeLocationInfo: false }, handler);
-    tokenizer.write(html, true);
+        }
+    }
+    for (const attributes of pendingFormActions) {
+        const action = formAction(attributes, effectiveBaseUrl, documentUrl?.origin ?? null);
+        forms.actions[action.relationship] += 1;
+        if (action.cleartext)
+            forms.actions.cleartext += 1;
+        if (action.truncated)
+            forms.truncated = true;
+    }
+    if (baseHrefState === 'invalid')
+        forms.truncated = true;
     publicationMetadata.truncated = publicationMetadata.truncated || inputLimitReached || publicationTagLimitReached;
     publicationMetadata.documentTruncated = inputLimitReached || publicationTagLimitReached;
     if (publicationMetadata.documentTruncated) {
@@ -671,7 +688,17 @@ function analyzeStaticHtml(value, options = {}) {
     publicationMetadata.renderBlockingCandidates.total = publicationMetadata.renderBlockingCandidates.script
         + publicationMetadata.renderBlockingCandidates.stylesheet;
     return {
-        markup: markup.join('\n'),
+        title: (() => {
+            const value = titleParts.join('').replace(CONTROL_CHARACTER_RE_GLOBAL, ' ').replace(/\ufffd/gu, ' ').replace(/\s+/gu, ' ').trim();
+            if (!value)
+                return null;
+            return value.length > 200 ? `${value.slice(0, 199)}…` : value;
+        })(),
+        effectiveBaseUrl: effectiveBaseUrl?.toString() ?? null,
+        baseHrefState,
+        elements,
+        iconLinks: iconLinks.sort((left, right) => left.priority - right.priority).slice(0, MAX_FAVICON_CANDIDATES),
+        tokens,
         visibleText: visibleTextParts.join('').replace(CONTROL_CHARACTER_RE_GLOBAL, ' ').replace(/\s+/gu, ' '),
         structureTokens,
         scripts,
@@ -689,4 +716,4 @@ function analyzeStaticHtml(value, options = {}) {
         inlineCharactersExamined,
     };
 }
-export { MAX_ATTRIBUTES_PER_TAG, MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_SCRIPT_ELEMENTS, MAX_SCRIPT_MEDIA_TYPE_LENGTH, MAX_STATIC_FORMS, MAX_STATIC_HTML_CHARS, MAX_STATIC_INPUTS, MAX_STATIC_PUBLICATION_META_ELEMENTS, MAX_STATIC_PUBLICATION_DECLARATIONS, MAX_STATIC_ROBOTS_DIRECTIVES, MAX_STATIC_HTML_TAGS, MAX_STATIC_STRUCTURE_TOKENS, MAX_STATIC_VISIBLE_TEXT_CHARS, MAX_TAG_LENGTH, MAX_TECHNOLOGY_TAGS, analyzeStaticHtml, };
+export { MAX_ATTRIBUTES_PER_TAG, MAX_INLINE_SCRIPT_CHARS, MAX_INLINE_SCRIPT_TOTAL_CHARS, MAX_SCRIPT_ELEMENTS, MAX_SCRIPT_MEDIA_TYPE_LENGTH, MAX_STATIC_FORMS, MAX_STATIC_HTML_CHARS, MAX_STATIC_INPUTS, MAX_STATIC_PUBLICATION_META_ELEMENTS, MAX_STATIC_PUBLICATION_DECLARATIONS, MAX_STATIC_ROBOTS_DIRECTIVES, MAX_STATIC_HTML_TAGS, MAX_STATIC_STRUCTURE_TOKENS, MAX_STATIC_VISIBLE_TEXT_CHARS, MAX_TAG_LENGTH, analyzeStaticHtml, };

package/lib/structured-data-identity.mjs

@@ -290,6 +290,7 @@ function analyzeStructuredDataIdentity(input = {}) {
     }
     const truncated = input.sourceTruncated === true
         || htmlAnalysis.inputLimitReached
+        || htmlAnalysis.tagLimitReached
         || htmlAnalysis.scriptLimitReached
         || htmlAnalysis.inlineLimitReached
         || limitReached;

package/lib/technology-markup.mjs

@@ -0,0 +1,100 @@
+const CONTROL_RE = /[\u0000-\u001f\u007f]/u;
+export function attributeValue(element, name) {
+    return element.attributes.find((attribute) => attribute.name === name)?.value.toLowerCase() ?? '';
+}
+export function hasAttributes(element, ...names) {
+    return element.attributes.some((attribute) => names.includes(attribute.name));
+}
+function httpUrl(value, base) {
+    if (typeof value !== 'string' || value.length > 2048 || CONTROL_RE.test(value) || !value.trim())
+        return null;
+    try {
+        const url = new URL(value, base);
+        return ['http:', 'https:'].includes(url.protocol) && !url.username && !url.password ? url : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function createTechnologyMarkupContext(analysis, effectiveBaseUrl, documentOrigin) {
+    const elements = analysis.elements.filter((element) => element.html && element.name !== 'template');
+    const documentUrl = httpUrl(documentOrigin);
+    const suppliedBase = effectiveBaseUrl ?? analysis.effectiveBaseUrl;
+    const base = httpUrl(suppliedBase) ?? documentUrl;
+    // A reserved base permits legacy minimised relative references without
+    // attributing an absolute external URL to an unknown document origin.
+    const resolutionBase = base ?? new URL('https://document.invalid/');
+    const references = (element, names) => (element.attributes.flatMap((attribute) => {
+        if (!names.includes(attribute.name))
+            return [];
+        if (attribute.value.trim().startsWith('#'))
+            return [];
+        const url = httpUrl(attribute.value, resolutionBase);
+        if (!url)
+            return [];
+        const relative = !/^(?:[a-z][a-z0-9+.-]*:|\/\/)/iu.test(attribute.value.trim());
+        const embedded = documentUrl
+            ? url.origin !== documentUrl.origin
+            : Boolean(base || suppliedBase || documentOrigin) || !relative;
+        return [{ url, embedded }];
+    }));
+    const resources = [];
+    const navigation = [];
+    for (const element of elements) {
+        switch (element.name) {
+            case 'script':
+            case 'img':
+            case 'iframe':
+            case 'frame':
+            case 'source':
+            case 'audio':
+            case 'embed':
+                resources.push(...references(element, ['src']));
+                break;
+            case 'video':
+                resources.push(...references(element, ['src', 'poster']));
+                break;
+            case 'link': {
+                const relations = attributeValue(element, 'rel').trim().split(/\s+/u);
+                // Existing minimised inputs retain a link reference without its rel.
+                // Explicit document metadata or navigation relations are not assets.
+                if (!hasAttributes(element, 'rel') || relations.some((relation) => ['stylesheet', 'preload', 'modulepreload', 'icon'].includes(relation))) {
+                    resources.push(...references(element, ['href']));
+                }
+                break;
+            }
+            case 'object':
+                resources.push(...references(element, ['data']));
+                break;
+            case 'input':
+                if (attributeValue(element, 'type') === 'image')
+                    resources.push(...references(element, ['src']));
+                break;
+            case 'a':
+            case 'area':
+                navigation.push(...references(element, ['href']));
+                break;
+        }
+    }
+    return { elements, resources, navigation };
+}
+export function elementMarker(matches, reviewMarkup) {
+    return { matches: ({ elements }) => elements.some(matches), reviewMarkup };
+}
+export function resourceMarker(matches, reviewPath) {
+    const sharedOrigin = reviewPath.startsWith('https://');
+    return {
+        matches: ({ resources }) => resources.some(({ url }) => matches(url)),
+        embedded: ({ resources }) => sharedOrigin || !resources.some(({ url, embedded }) => !embedded && matches(url)),
+        reviewMarkup: `<link href="${reviewPath}">`,
+        embeddedReviewMarkup: `<link href="${sharedOrigin ? reviewPath : `https://embedded.invalid${reviewPath}`}">`,
+    };
+}
+export function navigationMarker(matches, reviewPath) {
+    return {
+        matches: ({ navigation }) => navigation.some(({ url }) => matches(url)),
+        embedded: ({ navigation }) => !navigation.some(({ url, embedded }) => !embedded && matches(url)),
+        reviewMarkup: `<a href="${reviewPath}"></a>`,
+        embeddedReviewMarkup: `<a href="https://embedded.invalid/${reviewPath}"></a>`,
+    };
+}