agent-sanitizer 2.64.0 → 2.64.2

package/src/url-attributes.mjs

@@ -0,0 +1,76 @@
+/**
+ * The attributes a browser resolves as URLs: the one table every Layer-3 URL
+ * read (and Layer 2's data: resource count) goes through; its test partitions
+ * the HTML Standard's URL attributes between it and an exempt list. `property`
+ * is the hast spelling; `elements` null means any element; a "form" or
+ * "refresh" `context` is also flagged for leaving the origin; `fetched` is a
+ * load nobody decides on, except on `notFetchedOn`. Rows state only where they
+ * differ from {@link DEFAULTS}.
+ */
+
+/**
+ * @typedef {{
+ *   attribute: string,
+ *   property: string,
+ *   grammar: "url" | "urls" | "srcset" | "refresh" | "css",
+ *   elements: readonly string[] | null,
+ *   context: "resource" | "form" | "refresh",
+ *   fetched: boolean,
+ *   notFetchedOn: readonly string[],
+ * }} UrlAttribute
+ */
+
+const DEFAULTS = Object.freeze({
+  grammar: "url",
+  elements: null,
+  context: "resource",
+  fetched: true,
+  notFetchedOn: [],
+});
+
+/** @type {readonly UrlAttribute[]} */
+export const URL_ATTRIBUTES = Object.freeze(
+  /** @type {Array<Partial<UrlAttribute> & { attribute: string, property: string }>} */ ([
+    { attribute: "src", property: "src" },
+    // A link waits for a click; `<base>` only re-bases relative URLs.
+    {
+      attribute: "href",
+      property: "href",
+      notFetchedOn: ["a", "area", "base"],
+    },
+    { attribute: "xlink:href", property: "xLinkHref", notFetchedOn: ["a"] },
+    { attribute: "background", property: "background" },
+    { attribute: "srcset", property: "srcSet", grammar: "srcset" },
+    {
+      attribute: "imagesrcset",
+      property: "imageSrcSet",
+      grammar: "srcset",
+      elements: ["link"],
+    },
+    { attribute: "ping", property: "ping", grammar: "urls" },
+    { attribute: "action", property: "action", context: "form" },
+    { attribute: "formaction", property: "formAction", context: "form" },
+    { attribute: "data", property: "data", elements: ["object"] },
+    { attribute: "poster", property: "poster", elements: ["video"] },
+    {
+      attribute: "cite",
+      property: "cite",
+      elements: ["blockquote", "del", "ins", "q"],
+      fetched: false,
+    },
+    {
+      attribute: "longdesc",
+      property: "longDesc",
+      elements: ["img", "iframe", "frame"],
+      fetched: false,
+    },
+    {
+      attribute: "content",
+      property: "content",
+      grammar: "refresh",
+      elements: ["meta"],
+      context: "refresh",
+    },
+    { attribute: "style", property: "style", grammar: "css" },
+  ]).map((row) => Object.freeze({ ...DEFAULTS, ...row })),
+);

package/src/vendor/gfm-autolink-literal.mjs

@@ -1,81 +1,52 @@
 /**
- * GFM autolink literals for micromark, vendored from
- * `micromark-extension-gfm-autolink-literal@2.1.0` (MIT, (c) 2020 Titus
- * Wormer). The licence is in `LICENSE-THIRD-PARTY` at the repository root.
+ * GENERATED by scripts/gen-gfm-autolink.mjs at install, pack and build time;
+ * git-ignored, never committed — DO NOT EDIT.
  *
- * WHY A COPY. `previousUnbalanced` below decides whether an autolink literal
- * may start at this position, and upstream answers it by walking back over
- * every event the document has produced so far. It memoizes only the "no"
- * answer, so one unclosed `[` — a JSON array is the everyday shape, since its
- * `]` is the last byte — makes the answer "yes" for the rest of the document
- * and costs one full walk per word character. 172 KB of prose behind a single
- * `[` took 20.2s to parse; the same text takes 0.17s here. Layer 3 reads its
- * URLs off this parse, so the cost lands on every `detectExfil` call.
- *
- * WHAT CHANGED. One function. `previousUnbalanced` now also records where the
- * walk stopped, and a later walk resumes from that index rather than re-reading
- * the run before it. The record is used only while `events[index]` still holds
- * the same token, so a resolver that splices events invalidates it and the walk
- * falls back to reading everything. Nothing else in this file differs from
- * upstream — diff it against the published package to confirm.
- *
- * WHY NOT A PATCH. A `pnpm` patch fixes this repository's own installs and the
- * plugin bundle built from them, and reaches no consumer of the published npm
- * package (see the npm-consumer gap in the project history). A copy under
- * `src/` ships.
- *
- * WHEN TO DELETE IT. When a published release of the upstream package carries
- * an equivalent fix: drop this file and the assembly in `./gfm.mjs`, and go
- * back to `remark-gfm`. `test/gfm-autolink-parity.test.mjs` pins the behaviour
- * either way.
+ * `micromark-extension-gfm-autolink-literal@2.1.0`'s `lib/syntax.js` (MIT, (c) 2020
+ * Titus Wormer; licence in LICENSE-THIRD-PARTY) with the one-function
+ * `previousUnbalanced` performance fix from
+ * `scripts/patches/micromark-extension-gfm-autolink-literal@2.1.0.patch`. The
+ * generator's header says why it is patched and when to delete it.
  */
-
 /**
  * @import {Code, ConstructRecord, Event, Extension, Previous, State, TokenizeContext, Tokenizer} from 'micromark-util-types'
  */
 
-import {
-  asciiAlpha,
-  asciiAlphanumeric,
-  asciiControl,
-  markdownLineEndingOrSpace,
-  unicodePunctuation,
-  unicodeWhitespace,
-} from "micromark-util-character";
+import { asciiAlpha, asciiAlphanumeric, asciiControl, markdownLineEndingOrSpace, unicodePunctuation, unicodeWhitespace } from 'micromark-util-character';
 const wwwPrefix = {
   tokenize: tokenizeWwwPrefix,
-  partial: true,
+  partial: true
 };
 const domain = {
   tokenize: tokenizeDomain,
-  partial: true,
+  partial: true
 };
 const path = {
   tokenize: tokenizePath,
-  partial: true,
+  partial: true
 };
 const trail = {
   tokenize: tokenizeTrail,
-  partial: true,
+  partial: true
 };
 const emailDomainDotTrail = {
   tokenize: tokenizeEmailDomainDotTrail,
-  partial: true,
+  partial: true
 };
 const wwwAutolink = {
-  name: "wwwAutolink",
+  name: 'wwwAutolink',
   tokenize: tokenizeWwwAutolink,
-  previous: previousWww,
+  previous: previousWww
 };
 const protocolAutolink = {
-  name: "protocolAutolink",
+  name: 'protocolAutolink',
   tokenize: tokenizeProtocolAutolink,
-  previous: previousProtocol,
+  previous: previousProtocol
 };
 const emailAutolink = {
-  name: "emailAutolink",
+  name: 'emailAutolink',
   tokenize: tokenizeEmailAutolink,
-  previous: previousEmail,
+  previous: previousEmail
 };
 
 /** @type {ConstructRecord} */
@@ -91,7 +62,7 @@ const text = {};
  */
 export function gfmAutolinkLiteral() {
   return {
-    text,
+    text
   };
 }
 
@@ -102,8 +73,7 @@ let code = 48;
 while (code < 123) {
   text[code] = emailAutolink;
   code++;
-  if (code === 58) code = 65;
-  else if (code === 91) code = 97;
+  if (code === 58) code = 65;else if (code === 91) code = 97;
 }
 text[43] = emailAutolink;
 text[45] = emailAutolink;
@@ -150,15 +120,11 @@ function tokenizeEmailAutolink(effects, ok, nok) {
    * @type {State}
    */
   function start(code) {
-    if (
-      !gfmAtext(code) ||
-      !previousEmail.call(self, self.previous) ||
-      previousUnbalanced(self.events)
-    ) {
+    if (!gfmAtext(code) || !previousEmail.call(self, self.previous) || previousUnbalanced(self.events)) {
       return nok(code);
     }
-    effects.enter("literalAutolink");
-    effects.enter("literalAutolinkEmail");
+    effects.enter('literalAutolink');
+    effects.enter('literalAutolinkEmail');
     return atext(code);
   }
 
@@ -201,11 +167,7 @@ function tokenizeEmailAutolink(effects, ok, nok) {
   function emailDomain(code) {
     // Dot followed by alphanumerical (not `-` or `_`).
     if (code === 46) {
-      return effects.check(
-        emailDomainDotTrail,
-        emailDomainAfter,
-        emailDomainDot,
-      )(code);
+      return effects.check(emailDomainDotTrail, emailDomainAfter, emailDomainDot)(code);
     }
 
     // Alphanumerical, `-`, and `_`.
@@ -254,8 +216,8 @@ function tokenizeEmailAutolink(effects, ok, nok) {
     // Domain must not be empty, must include a dot, and must end in alphabetical.
     // Source: <https://github.com/github/cmark-gfm/blob/ef1cfcb/extensions/autolink.c#L332>.
     if (data && dot && asciiAlpha(self.previous)) {
-      effects.exit("literalAutolinkEmail");
-      effects.exit("literalAutolink");
+      effects.exit('literalAutolinkEmail');
+      effects.exit('literalAutolink');
       return ok(code);
     }
     return nok(code);
@@ -288,22 +250,14 @@ function tokenizeWwwAutolink(effects, ok, nok) {
    * @type {State}
    */
   function wwwStart(code) {
-    if (
-      (code !== 87 && code !== 119) ||
-      !previousWww.call(self, self.previous) ||
-      previousUnbalanced(self.events)
-    ) {
+    if (code !== 87 && code !== 119 || !previousWww.call(self, self.previous) || previousUnbalanced(self.events)) {
       return nok(code);
     }
-    effects.enter("literalAutolink");
-    effects.enter("literalAutolinkWww");
+    effects.enter('literalAutolink');
+    effects.enter('literalAutolinkWww');
     // Note: we *check*, so we can discard the `www.` we parsed.
     // If it worked, we consider it as a part of the domain.
-    return effects.check(
-      wwwPrefix,
-      effects.attempt(domain, effects.attempt(path, wwwAfter), nok),
-      nok,
-    )(code);
+    return effects.check(wwwPrefix, effects.attempt(domain, effects.attempt(path, wwwAfter), nok), nok)(code);
   }
 
   /**
@@ -317,8 +271,8 @@ function tokenizeWwwAutolink(effects, ok, nok) {
    * @type {State}
    */
   function wwwAfter(code) {
-    effects.exit("literalAutolinkWww");
-    effects.exit("literalAutolink");
+    effects.exit('literalAutolinkWww');
+    effects.exit('literalAutolink');
     return ok(code);
   }
 }
@@ -336,7 +290,7 @@ function tokenizeWwwAutolink(effects, ok, nok) {
  */
 function tokenizeProtocolAutolink(effects, ok, nok) {
   const self = this;
-  let buffer = "";
+  let buffer = '';
   let seen = false;
   return protocolStart;
 
@@ -351,13 +305,9 @@ function tokenizeProtocolAutolink(effects, ok, nok) {
    * @type {State}
    */
   function protocolStart(code) {
-    if (
-      (code === 72 || code === 104) &&
-      previousProtocol.call(self, self.previous) &&
-      !previousUnbalanced(self.events)
-    ) {
-      effects.enter("literalAutolink");
-      effects.enter("literalAutolinkHttp");
+    if ((code === 72 || code === 104) && previousProtocol.call(self, self.previous) && !previousUnbalanced(self.events)) {
+      effects.enter('literalAutolink');
+      effects.enter('literalAutolinkHttp');
       buffer += String.fromCodePoint(code);
       effects.consume(code);
       return protocolPrefixInside;
@@ -385,7 +335,7 @@ function tokenizeProtocolAutolink(effects, ok, nok) {
     }
     if (code === 58) {
       const protocol = buffer.toLowerCase();
-      if (protocol === "http" || protocol === "https") {
+      if (protocol === 'http' || protocol === 'https') {
         effects.consume(code);
         return protocolSlashesInside;
       }
@@ -428,17 +378,7 @@ function tokenizeProtocolAutolink(effects, ok, nok) {
   function afterProtocol(code) {
     // To do: this is different from `markdown-rs`:
     // https://github.com/wooorm/markdown-rs/blob/b3a921c761309ae00a51fe348d8a43adbc54b518/src/construct/gfm_autolink_literal.rs#L172-L182
-    return code === null ||
-      asciiControl(code) ||
-      markdownLineEndingOrSpace(code) ||
-      unicodeWhitespace(code) ||
-      unicodePunctuation(code)
-      ? nok(code)
-      : effects.attempt(
-          domain,
-          effects.attempt(path, protocolAfter),
-          nok,
-        )(code);
+    return code === null || asciiControl(code) || markdownLineEndingOrSpace(code) || unicodeWhitespace(code) || unicodePunctuation(code) ? nok(code) : effects.attempt(domain, effects.attempt(path, protocolAfter), nok)(code);
   }
 
   /**
@@ -452,8 +392,8 @@ function tokenizeProtocolAutolink(effects, ok, nok) {
    * @type {State}
    */
   function protocolAfter(code) {
-    effects.exit("literalAutolinkHttp");
-    effects.exit("literalAutolink");
+    effects.exit('literalAutolinkHttp');
+    effects.exit('literalAutolink');
     return ok(code);
   }
 }
@@ -556,12 +496,7 @@ function tokenizeDomain(effects, ok, nok) {
     // Instead of some new production for Unicode alphanumerics, markdown
     // already has that for Unicode punctuation and whitespace, so use those.
     // Source: <https://github.com/github/cmark-gfm/blob/ef1cfcb/extensions/autolink.c#L12>.
-    if (
-      code === null ||
-      markdownLineEndingOrSpace(code) ||
-      unicodeWhitespace(code) ||
-      (code !== 45 && unicodePunctuation(code))
-    ) {
+    if (code === null || markdownLineEndingOrSpace(code) || unicodeWhitespace(code) || code !== 45 && unicodePunctuation(code)) {
       return domainAfter(code);
     }
     seen = true;
@@ -656,30 +591,10 @@ function tokenizePath(effects, ok) {
     // Check whether this trailing punctuation marker is optionally
     // followed by more trailing markers, and then followed
     // by an end.
-    if (
-      code === 33 ||
-      code === 34 ||
-      code === 38 ||
-      code === 39 ||
-      code === 41 ||
-      code === 42 ||
-      code === 44 ||
-      code === 46 ||
-      code === 58 ||
-      code === 59 ||
-      code === 60 ||
-      code === 63 ||
-      code === 93 ||
-      code === 95 ||
-      code === 126
-    ) {
+    if (code === 33 || code === 34 || code === 38 || code === 39 || code === 41 || code === 42 || code === 44 || code === 46 || code === 58 || code === 59 || code === 60 || code === 63 || code === 93 || code === 95 || code === 126) {
       return effects.check(trail, ok, pathAtPunctuation)(code);
     }
-    if (
-      code === null ||
-      markdownLineEndingOrSpace(code) ||
-      unicodeWhitespace(code)
-    ) {
+    if (code === null || markdownLineEndingOrSpace(code) || unicodeWhitespace(code)) {
       return ok(code);
     }
     effects.consume(code);
@@ -736,20 +651,7 @@ function tokenizeTrail(effects, ok, nok) {
    */
   function trail(code) {
     // Regular trailing punctuation.
-    if (
-      code === 33 ||
-      code === 34 ||
-      code === 39 ||
-      code === 41 ||
-      code === 42 ||
-      code === 44 ||
-      code === 46 ||
-      code === 58 ||
-      code === 59 ||
-      code === 63 ||
-      code === 95 ||
-      code === 126
-    ) {
+    if (code === 33 || code === 34 || code === 39 || code === 41 || code === 42 || code === 44 || code === 46 || code === 58 || code === 59 || code === 63 || code === 95 || code === 126) {
       effects.consume(code);
       return trail;
     }
@@ -770,13 +672,10 @@ function tokenizeTrail(effects, ok, nok) {
       return trailBracketAfter;
     }
     if (
-      // `<` is an end.
-      code === 60 ||
-      // So is whitespace.
-      code === null ||
-      markdownLineEndingOrSpace(code) ||
-      unicodeWhitespace(code)
-    ) {
+    // `<` is an end.
+    code === 60 ||
+    // So is whitespace.
+    code === null || markdownLineEndingOrSpace(code) || unicodeWhitespace(code)) {
       return ok(code);
     }
     return nok(code);
@@ -798,13 +697,7 @@ function tokenizeTrail(effects, ok, nok) {
   function trailBracketAfter(code) {
     // Whitespace or something that could start a resource or reference is the end.
     // Switch back to trail otherwise.
-    if (
-      code === null ||
-      code === 40 ||
-      code === 91 ||
-      markdownLineEndingOrSpace(code) ||
-      unicodeWhitespace(code)
-    ) {
+    if (code === null || code === 40 || code === 91 || markdownLineEndingOrSpace(code) || unicodeWhitespace(code)) {
       return ok(code);
     }
     return trail(code);
@@ -908,16 +801,7 @@ function tokenizeEmailDomainDotTrail(effects, ok, nok) {
  * @type {Previous}
  */
 function previousWww(code) {
-  return (
-    code === null ||
-    code === 40 ||
-    code === 42 ||
-    code === 95 ||
-    code === 91 ||
-    code === 93 ||
-    code === 126 ||
-    markdownLineEndingOrSpace(code)
-  );
+  return code === null || code === 40 || code === 42 || code === 95 || code === 91 || code === 93 || code === 126 || markdownLineEndingOrSpace(code);
 }
 
 /**
@@ -947,13 +831,7 @@ function previousEmail(code) {
  * @returns {boolean}
  */
 function gfmAtext(code) {
-  return (
-    code === 43 ||
-    code === 45 ||
-    code === 46 ||
-    code === 95 ||
-    asciiAlphanumeric(code)
-  );
+  return code === 43 || code === 45 || code === 46 || code === 95 || asciiAlphanumeric(code);
 }
 
 /**
@@ -965,10 +843,7 @@ function previousUnbalanced(events) {
   let result = false;
   while (index--) {
     const token = events[index][1];
-    if (
-      (token.type === "labelLink" || token.type === "labelImage") &&
-      !token._balanced
-    ) {
+    if ((token.type === 'labelLink' || token.type === 'labelImage') && !token._balanced) {
       result = true;
       break;
     }

package/types/css-syntax-data.d.mts

@@ -0,0 +1,6 @@
+/** GENERATED by scripts/gen-css-syntax.mjs — DO NOT EDIT (mdn-data, CC0). */
+/** @type {{ types: Record<string, string>, properties: Record<string, string> }} */
+export const CSS_SYNTAX: {
+    types: Record<string, string>;
+    properties: Record<string, string>;
+};

package/types/html-tree-adapter.d.mts

@@ -21,3 +21,49 @@ export function createTreeAdapter(): {
  * @returns {any}
  */
 export function parseHtmlFragment(html: string): any;
+/**
+ * `fromParse5(tree, { file })`, recursing at most `chunkDepth` levels at a time.
+ *
+ * Every node a multiple of `chunkDepth` levels down is converted on its own,
+ * deepest first, and then stands in its parent's `childNodes` as a placeholder
+ * text node carrying the converted subtree's position — the one thing about a
+ * child its parent's conversion reads (an unclosed element ends where its last
+ * child does). One walk then swaps each placeholder for its subtree. The result
+ * is the tree a single `fromParse5` call returns, which
+ * `html-tree-adapter.test` holds it to — except that an element the converter
+ * would take for a template with no content to take (see
+ * {@link CONVERTS_AS_TEMPLATE}) converts as an ordinary element instead of
+ * throwing.
+ *
+ * Mutates `tree`: {@link parseHtmlFragment} owns the parse and drops it after.
+ * @param {any} tree
+ * @param {VFile} file
+ * @param {number} [chunkDepth]
+ * @returns {any}
+ */
+export function fromParse5Bounded(tree: any, file: VFile, chunkDepth?: number): any;
+/**
+ * How many levels of the tree one `fromParse5` call converts.
+ *
+ * WHY IT EXISTS — `hast-util-from-parse5` converts by recursion, three frames
+ * (`one` → `all` → `element`) per level, so how deep a tree it survives is
+ * whatever stack is left, and that depends on the JIT tier: a cold call's
+ * interpreted frames are bigger than an optimized one's. ~2500 nested elements
+ * overflowed on the first call in a process and converted fine on a later one,
+ * so the same document came back withheld or sanitized depending on what had
+ * run before it. 128 levels still convert cold on a 100 KB stack, a tenth of
+ * Node's default.
+ */
+export const CONVERT_DEPTH: 128;
+/**
+ * The deepest a node may sit below the fragment root; a deeper parse throws, so
+ * the caller fails closed on it.
+ *
+ * Conversion no longer limits depth (see {@link CONVERT_DEPTH}), so this is the
+ * one place that does, and it answers the same way at every JIT tier. No real
+ * document comes near it — Blink's parser flattens anything nested past 512 —
+ * and what lies past it is built to cost: parse5's scope checks walk the
+ * open-element stack per tag, so parsing is quadratic in depth.
+ */
+export const MAX_HTML_DEPTH: 4096;
+import { VFile } from "vfile";

package/types/html.d.mts

@@ -1,15 +1,18 @@
 /**
+ * True when an inline style hides its element's text, read as a block box
+ * with nothing inherited.
  * @param {string} styleStr
  * @returns {boolean}
  */
 export function isHiddenStyle(styleStr: string): boolean;
 /**
- * True for an element a rendered page would not show: `hidden` attribute or a
- * hiding inline style. Works on both hast nodes and parseHtmlTag results.
+ * True for an element a rendered page would not show (`hidden` or a hiding
+ * inline style, in element context). Takes hast nodes and parseHtmlTag results.
  * @param {any} node
+ * @param {any} [parent] the element's parent, when known
  * @returns {boolean}
  */
-export function isHiddenElement(node: any): boolean;
+export function isHiddenElement(node: any, parent?: any): boolean;
 /**
  * @param {string} htmlValue
  * @returns {string | null}
@@ -119,10 +122,9 @@ export function checkExfilUrl(url: string, options?: {
  */
 export function urlHost(url: string): string;
 /**
- * Layer 3: report data-exfil-shaped URLs in markdown links/images/definitions
- * and HTML attributes (src/href/background/srcset/ping, form action/formaction,
- * meta-refresh). Detection only — the text is never modified; the caller
- * surfaces the threats as a warning.
+ * Layer 3: report data-exfil-shaped URLs among the ones {@link collectUrls}
+ * reads. Detection only — the text is never modified; the caller surfaces the
+ * threats as a warning.
  *
  * `autoFetched` marks a threat that needs no deliberate act to fire — a
  * rendered image, a stylesheet, a form target, a meta refresh — as opposed to a
@@ -161,6 +163,40 @@ export const REPORTED_TAGS: Set<string>;
 export const HIDDEN_PLACEHOLDER: "[hidden HTML removed";
 export const COMMENT_PLACEHOLDER: "[HTML comment removed";
 export const DATA_URI_LENGTH_THRESHOLD: 4096;
+export type StyleDeclaration = {
+    property: string;
+    value: any;
+    important: boolean;
+    index: number;
+};
+/**
+ * `winnerOf`: the declaration applied (its own, a shorthand's or `all`'s);
+ * `nodeOf`/`textOf`: its value when it is the property's OWN (else null/"");
+ * `exhausted`: a lookup ran out of {@link VALIDATION_BUDGET}.
+ */
+export type Cascade = {
+    winnerOf: (property: string) => StyleDeclaration | null;
+    nodeOf: (property: string) => any;
+    textOf: (property: string) => string;
+    exhausted: boolean;
+};
+export type InheritedHide = "font-size" | "visibility" | "color" | "text-indent";
+/**
+ * `color` and a concrete `-webkit-text-fill-color` (`textFill`) inherit
+ * SEPARATELY, so a child's `color` does not undo an inherited transparent fill.
+ */
+export type ColorState = {
+    color: string;
+    textFill: string;
+    backdrop: string;
+    imageLayer: boolean;
+    paintedVisible: boolean;
+};
+export type RegionState = {
+    kinds: Set<InheritedHide>;
+    color: ColorState;
+};
+export type RegionVerdict = "hidden" | "neutral" | "visible" | "mixed";
 export type CollectedUrl = {
     url: string;
     isImage: boolean;

package/types/url-attributes.d.mts

@@ -0,0 +1,11 @@
+/** @type {readonly UrlAttribute[]} */
+export const URL_ATTRIBUTES: readonly UrlAttribute[];
+export type UrlAttribute = {
+    attribute: string;
+    property: string;
+    grammar: "url" | "urls" | "srcset" | "refresh" | "css";
+    elements: readonly string[] | null;
+    context: "resource" | "form" | "refresh";
+    fetched: boolean;
+    notFetchedOn: readonly string[];
+};