flea-qml 0.0.0-stage → 0.2.0

package/ui/js/MdRun.js

@@ -0,0 +1,300 @@
+.pragma library
+
+// MdRun: hold code/math, then resolve links, images and HTML in one forward scan; links deactivate earlier link openers, while image openers stay active.
+.import "MdUrl.js" as MdUrl
+.import "MdHtml.js" as MdHtml
+.import "MdInline.js" as Md
+.import "MdRefs.js" as Refs
+.import "MdResolve.js" as Res
+.import "MdEmph.js" as Emph
+.import "MdBreak.js" as Brk
+.import "MdEntity.js" as Ent
+.import "MdHold.js" as Hold
+
+var hasOwn = Object.prototype.hasOwnProperty
+// The work gate replaces this no-op to count each frame visited.
+var countFrameStep = function () {}
+
+// The driver: held spans first, then one forward scan; bareText says no container holds the text (its ">" is never a quote mark); fragment says the text starts and ends mid-line (an image's alt text).
+function parseInline(text, dir, defs, numbers, chrome, ink, tokens, cited, literalPlain, bareText, fragment) {
+    var body = MdHtml.documentText(text)
+    // Plain prose returns directly; plain table cells use the bulk escaper before any markup is emitted.
+    if (!/[`$[\]<>\\!*_]| {2}\n|https?:\/\/|www\./.test(body)
+            && (literalPlain ? !/[*_~]|&(?:#(?:[0-9]+|[xX][0-9a-fA-F]+)|[A-Za-z][A-Za-z0-9]*);/.test(body) : !/&[#A-Za-z]/.test(body)))
+        return literalPlain ? Md.escapeHtmlText(body) : body
+    var spans = Md.spanIntervals(body)
+    var out = []
+    var delims = []
+    delims.bottom = 0
+    var citationTokens = {}
+    var frames = []
+    var activeLinks = []
+    // Without usable ink, link brackets are escaped so md4c cannot resolve unvetted targets.
+    var styleLinks = /^#[0-9a-f]{6}([0-9a-f]{2})?$/i.test(String(ink || ""))
+    var chromeOk = /^#[0-9a-f]{6}([0-9a-f]{2})?$/i.test(String(chrome || ""))
+    var styleCache = {}
+    // The span held last, so a repeat reuses its token without slicing.
+    var lastSpan = { start: -1, length: -1, open: -1, kind: "", ref: 0 }
+    // Exact dead flags: the first scan to find no "-->" or ">" ahead proves no later opener can close either, so dense hostile inputs pay once.
+    var dead = { tagDead: -1, commentDead: false }
+    // The HTML links whose opener put the ink on and are not closed yet, so each closer takes off only ink that is on.
+    var inked = { open: 0 }
+    var i = 0
+    var sp = 0
+    var lastQuote = -1
+    // out[0, numbered) holds no citation still to number; imageMark is where the outermost open image's alt text begins, or -1.
+    var numbered = 0
+    var imageMark = -1
+    var imageDepth = -1
+    var line = Ent.lineState(fragment !== true)
+
+    // Join strings, -1-index token references and emphasis marks; inside an emphasis tag or a label a newline is a space, which the renderer would drop.
+    function renderFrom(from, flat, alt) {
+        var parts = []
+        var depth = flat ? 1 : 0
+        for (var k = from; k < out.length; k++) {
+            var piece = out[k]
+            if (typeof piece === "string") {
+                parts.push(depth > 0 && piece === "\n" ? " " : piece)
+                continue
+            }
+            if (typeof piece === "object") {
+                depth -= piece.closes
+                parts.push(piece.before + Emph.literal(piece) + piece.after)
+                depth += piece.opens
+                continue
+            }
+            var tokenIndex = -1 - piece
+            if (alt === true && citationTokens.hasOwnProperty(tokenIndex)) {
+                parts.push("[^" + citationTokens[tokenIndex] + "]")
+                continue
+            }
+            if (citationTokens.hasOwnProperty(tokenIndex))
+                cite(tokenIndex)
+            parts.push(tokens[tokenIndex])
+        }
+        return parts.join("")
+    }
+
+    // The open brackets of a finished paragraph never pair with a later "]", so they stay literal.
+    function endParagraph() {
+        frames.length = 0
+        activeLinks.length = 0
+        imageMark = -1
+    }
+
+    // Number a footnote citation the first time it is read, so its superscript is the next free number.
+    function cite(tokenIndex) {
+        var id = citationTokens[tokenIndex]
+        if (cited !== undefined && numbers[id] === 0) {
+            cited.push(id)
+            numbers[id] = cited.length
+        }
+        tokens[tokenIndex] = "<sup>" + numbers[id] + "</sup>"
+    }
+
+    // Number the citations before out[limit], which a label rendered now would otherwise number ahead of; an image's alt text draws none.
+    function citeBefore(limit) {
+        var to = Math.min(limit, imageMark < 0 ? limit : imageMark)
+        for (; numbered < to; numbered++) {
+            var piece = out[numbered]
+            if (typeof piece === "number" && citationTokens.hasOwnProperty(-1 - piece))
+                cite(-1 - piece)
+        }
+    }
+
+    // The label of the bracket pair opened at out[mark], its emphasis resolved first.
+    function labelHtml(mark, alt) {
+        citeBefore(mark)
+        var from = delims.length
+        while (from > 0 && delims[from - 1].at > mark)
+            from--
+        Emph.process(delims, from)
+        return renderFrom(mark + 1, true, alt)
+    }
+
+    while (i < body.length) {
+        if (sp < spans.length && i === spans[sp]) {
+            var spanTo = spans[sp + 1]
+            var spanLen = spans[sp + 2]
+            var spanKind = spans[sp + 3] === Md.MATH_SPAN ? "math" : ""
+            if (!chromeOk && spanKind === "math") {
+                sp += Md.INTERVAL_STRIDE
+                continue
+            }
+            Hold.hold(body, i, spanTo, spanLen, spanKind, chromeOk ? chrome : null, styleCache, lastSpan, tokens, out)
+            i = spanTo
+            sp += Md.INTERVAL_STRIDE
+            continue
+        }
+        if (sp < spans.length && i > spans[sp]) {
+            sp += Md.INTERVAL_STRIDE
+            continue
+        }
+        var c = body.charAt(i)
+        if (c === "\\" && i + 1 < body.length && Md.isPunct(body.charAt(i + 1))) {
+            out.push("&#" + body.charCodeAt(i + 1) + ";")
+            i += 2
+            continue
+        }
+        if (c === "\n" || (c === "\\" && body.charAt(i + 1) === "\n")) {
+            i = Brk.lineBreak(body, i, out, delims, endParagraph)
+            continue
+        }
+        if (c === "`" || c === "$") {
+            out.push(c)
+            i++
+            continue
+        }
+        if ((c === "*" || c === "_") && Brk.isRuleLine(body, i)) {
+            var ruleEnd = body.indexOf("\n", i)
+            ruleEnd = ruleEnd < 0 ? body.length : ruleEnd
+            out.push(c + c + c)
+            i = ruleEnd
+            continue
+        }
+        if (c === "*" || c === "_") {
+            var mark = Emph.runAt(body, i, out.length)
+            delims.push(mark)
+            out.push(mark)
+            i = mark.end
+            continue
+        }
+        if (c === "!" && body.charAt(i + 1) === "[") {
+            out.push("!")
+            if (imageMark < 0) {
+                imageMark = out.length
+                imageDepth = frames.length
+            }
+            frames.push({ bang: true, mark: out.length, rawStart: i + 2, active: true })
+            out.push("&#91;")
+            i += 2
+            continue
+        }
+        if (c === "[") {
+            if (body.charAt(i + 1) === "^") {
+                var fn = Refs.readFootnoteRef(body, i)
+                if (fn !== null && numbers && hasOwn.call(numbers, fn.id)
+                        && (cited !== undefined || numbers[fn.id] > 0)) {
+                    citationTokens[tokens.length] = fn.id
+                    tokens.push("<sup>" + numbers[fn.id] + "</sup>")
+                    out.push(-1 - (tokens.length - 1))
+                    i = fn.end
+                    continue
+                }
+                out.push("&#91;")
+                i++
+                continue
+            }
+            if (!styleLinks) {
+                frames.push({ bang: false, mark: out.length, rawStart: i + 1,
+                    active: false, passthrough: true })
+                out.push("&#91;")
+                i++
+                continue
+            }
+            var opener = { bang: false, mark: out.length, rawStart: i + 1, active: true }
+            frames.push(opener)
+            activeLinks.push(opener)
+            out.push("&#91;")
+            i++
+            continue
+        }
+        if (c === "]" && frames.length > 0) {
+            var frame = frames.pop()
+            countFrameStep()
+            if (frames.length === imageDepth)
+                imageMark = -1
+            if (!frame.bang && frame.active)
+                activeLinks.pop()
+            if (frame.passthrough) {
+                out.push("&#93;")
+                i++
+                continue
+            }
+            var raw = body.slice(frame.rawStart, i)
+            var j = i + 1
+            var made = null
+            if (frame.active) {
+                var found = Res.readDestination(body, j, raw, defs)
+                if (found !== null) {
+                    // Emphasis inside the label pairs now, so the link or image takes the label's own markup.
+                    made = Res.resolvePair(raw, found.url, frame.bang, dir, ink, tokens, function () {
+                        return labelHtml(frame.mark, frame.bang)
+                    })
+                    j = found.end
+                }
+                if (made !== null && !frame.bang) {
+                    while (activeLinks.length > 0) {
+                        countFrameStep()
+                        activeLinks.pop().active = false
+                    }
+                }
+            }
+            if (made !== null) {
+                out.length = frame.bang ? frame.mark - 1 : frame.mark
+                numbered = Math.min(numbered, out.length)
+                while (delims.length > 0 && delims[delims.length - 1].at >= out.length)
+                    delims.pop()
+                out.push(made)
+                Ent.lineRestart(line, out, made)
+                i = j
+            } else {
+                out.push("&#93;")
+                i++
+            }
+            continue
+        }
+        if (c === "]") {
+            out.push("&#93;")
+            i++
+            continue
+        }
+        if (c === "&") {
+            var spaces = Ent.spaceRunAt(body, i, out, Ent.lineBlank(line, out), fragment !== true)
+            if (spaces !== null) {
+                out.length -= spaces.trim
+                out.push(spaces.text)
+                i = spaces.end
+                continue
+            }
+            // Qt's own table is short and keeps a newline reference, so the character is decoded here.
+            var reference = Ent.referenceAt(body, i)
+            out.push(reference === null ? c : Md.escapeDecodedText(reference.text))
+            i = reference === null ? i + 1 : reference.end
+            continue
+        }
+        if (c === "<") {
+            i = Res.parseAngle(body, i, dir, ink, styleLinks, dead, tokens, out, chrome, inked)
+            continue
+        }
+        if (c === "h" || c === "w") {
+            var bareEnd = Res.bareAt(body, i, ink, styleLinks, tokens, out)
+            if (bareEnd < 0) {
+                out.push(c)
+                i++
+            } else {
+                i = bareEnd
+            }
+            continue
+        }
+        if (c === ">") {
+            // A mark that opens a quote inside a list item stays for the renderer; table cells never hold one.
+            var quoting = !literalPlain && bareText !== true && Brk.quoteMarkAt(body, i, lastQuote)
+            lastQuote = quoting ? i : lastQuote
+            out.push(quoting ? ">" : "&#62;")
+            i++
+            continue
+        }
+        // A table cell's only pipe is an unescaped "\|", so it stays cell text like the bulk escaper writes it.
+        if (c === "|" && literalPlain) {
+            out.push("&#124;")
+            i++
+            continue
+        }
+        out.push(c)
+        i++
+    }
+    Emph.process(delims, delims.bottom)
+    return renderFrom(0, false)
+}

package/ui/js/MdUrl.js

@@ -0,0 +1,226 @@
+.pragma library
+
+// MdUrl: linear URL decoding and image classification, with anchored scans and lexical folder containment.
+.import "Format.js" as Format
+.import "MdEntity.js" as Ent
+
+var MAX_UNICODE_SCALAR = 1114111
+var PERCENT_ESCAPE_LENGTH = 3
+// A target that still changes after this many decodings is refused: no real address nests that deep.
+var MAX_DECODE_PASSES = 8
+
+// An http(s) URL, or a protocol-relative one (which inherits https), loads from the network.
+function isRemoteUrl(url) {
+    return /^(https?:)?\/\//i.test(String(url))
+}
+
+function hostOf(url) {
+    var rest = String(url).replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//, "").replace(/^\/\//, "")
+    var host = rest.split(/[\/?#]/)[0]
+    if (host.indexOf("@") >= 0)
+        host = host.slice(host.lastIndexOf("@") + 1)
+    if (host.charAt(0) === "[" && host.indexOf("]") > 0)
+        return host.slice(0, host.indexOf("]") + 1)
+    var colon = host.indexOf(":")
+    host = colon >= 0 ? host.slice(0, colon) : host
+    return host.length > 0 ? host : String(url)
+}
+
+function dirOf(path) {
+    var text = String(path)
+    var slash = text.lastIndexOf("/")
+    return slash >= 0 ? text.slice(0, slash) : ""
+}
+
+// The board's placeholder, in the text flow where a box cannot go: the host it refused.
+function placeholder(host) {
+    return "Remote image not loaded \u00b7 " + host
+}
+
+// Sample input: "65583;" at index 0 (after "&#") yields U+1002F and the index after ";".
+function numericRef(text, i) {
+    var j = i
+    var base = 10
+    if (text.charAt(j) === "x" || text.charAt(j) === "X") {
+        base = 16
+        j++
+    }
+    var start = j
+    while (j < text.length) {
+        var c = text.charCodeAt(j)
+        var digit = base === 16
+            ? (c >= 48 && c <= 57) || (c >= 65 && c <= 70) || (c >= 97 && c <= 102)
+            : c >= 48 && c <= 57
+        if (!digit)
+            break
+        j++
+    }
+    if (j === start || text.charAt(j) !== ";")
+        return null
+    var code = parseInt(text.slice(start, j), base)
+    if (!(code > 0) || code > MAX_UNICODE_SCALAR)
+        return null
+    return { ch: String.fromCodePoint(code), end: j + 1 }
+}
+
+// Sample input: "caf%C3%A9&#46;png" decodes to "café.png"; malformed UTF-8 percent runs stay literal.
+function canonicalUrl(raw) {
+    var text = String(raw === undefined || raw === null ? "" : raw)
+    var out = ""
+    var i = 0
+    while (i < text.length) {
+        var c = text.charAt(i)
+        if (c === "&" && text.charAt(i + 1) === "#") {
+            var ref = numericRef(text, i + 2)
+            if (ref !== null) {
+                out += ref.ch
+                i = ref.end
+                continue
+            }
+            out += c
+            i++
+        } else if (c === "%" && i + 2 < text.length
+                && /[0-9a-fA-F]/.test(text.charAt(i + 1)) && /[0-9a-fA-F]/.test(text.charAt(i + 2))) {
+            var begin = i
+            do {
+                i += PERCENT_ESCAPE_LENGTH
+            } while (text.charAt(i) === "%" && /^[0-9a-fA-F]{2}$/.test(text.slice(i + 1, i + PERCENT_ESCAPE_LENGTH)))
+            var run = text.slice(begin, i)
+            try {
+                out += decodeURIComponent(run)
+            } catch (e) {
+                out += run
+            }
+        } else {
+            var code = text.charCodeAt(i)
+            // Spaces survive: angle destinations may legally contain them. Tabs, newlines and other controls never do.
+            if (code === 32 || code > 32 && code !== 127)
+                out += c
+            i++
+        }
+    }
+    return out
+}
+
+// Sample: /../docs clamps to /docs for absolute paths; ../pic.png is refused for relative image targets.
+function normalizeSubpath(name, absolute) {
+    var parts = String(name).split("/")
+    var kept = []
+    for (var i = 0; i < parts.length; i++) {
+        var seg = parts[i]
+        if (seg === "" || seg === ".")
+            continue
+        if (seg === "..") {
+            if (kept.length === 0) {
+                if (!absolute)
+                    return null
+            } else {
+                kept.pop()
+            }
+            continue
+        }
+        kept.push(seg)
+    }
+    if (kept.length === 0 && !absolute)
+        return null
+    return kept.join("/")
+}
+
+// Classify images as remote placeholders, local file URLs inside the document folder, or dropped alt text.
+function classifyImage(raw, dir) {
+    var url = String(raw === undefined || raw === null ? "" : raw)
+    if (url.length === 0)
+        return { kind: "dropped" }
+    var seen = canonicalUrl(url)
+    if (seen.length === 0)
+        return { kind: "dropped" }
+    if (isRemoteUrl(seen))
+        return { kind: "remote", host: hostOf(seen) }
+    // data:, file: and every other scheme never reach Qt unexamined.
+    var scheme = /^[a-zA-Z][a-zA-Z0-9+.-]*:/.exec(seen)
+    if (scheme !== null) {
+        if (/^file:/i.test(seen)) {
+            var fp = seen.replace(/^file:\/\//i, "").replace(/^file:/i, "")
+            return localAbsolute(fp, dir)
+        }
+        return { kind: "dropped" }
+    }
+    var name = seen
+    if (name.charAt(0) === "<" && name.charAt(name.length - 1) === ">")
+        name = name.slice(1, -1)
+    if (name.length >= 2 && name.slice(0, 2) === "./")
+        name = name.slice(2)
+    // An absolute path loads only inside the document's folder tree.
+    if (name.charAt(0) === "/" || name.charAt(0) === "\\") {
+        return localAbsolute(name, dir)
+    }
+    if (name.length === 0 || name === "." || name === ".." || name.indexOf("\\") >= 0)
+        return { kind: "dropped" }
+    var collapsed = normalizeSubpath(name)
+    if (collapsed === null)
+        return { kind: "dropped" }
+    return containedLocal(String(dir || "") + "/" + collapsed, dir)
+}
+
+// Sample: /docs/notes/../pic.png resolves inside /docs; /docs/../pic.png is refused.
+function localAbsolute(path, dir) {
+    if (String(path).indexOf("\\") >= 0)
+        return { kind: "dropped" }
+    return containedLocal(path, dir)
+}
+
+// The folder may hold a backslash (legal on Linux); only the reference the document wrote may not.
+function containedLocal(path, dir) {
+    var root = dir === "" ? "/" : String(dir)
+    if (root.charAt(0) !== "/" || String(path).charAt(0) !== "/")
+        return { kind: "dropped" }
+    var base = normalizeSubpath(root, true)
+    var collapsed = normalizeSubpath(path, true)
+    if (base === null || collapsed === null || (base !== "" && collapsed !== base
+            && collapsed.indexOf(base + "/") !== 0))
+        return { kind: "dropped" }
+    return { kind: "local", url: Format.fileUri("/" + collapsed) }
+}
+
+// First srcset candidate classifying local, or its remote flag, else null.
+function srcsetPick(value, dir) {
+    var parts = String(value).split(",")
+    var remote = null
+    for (var i = 0; i < parts.length; i++) {
+        var cand = parts[i].replace(/^\s+|\s+$/g, "").split(/\s+/)[0] || ""
+        if (cand.length === 0)
+            continue
+        var seen = classifyImage(cand, dir)
+        if (seen.kind === "local")
+            return { kind: "local", url: seen.url }
+        if (seen.kind === "remote" && remote === null)
+            remote = seen.host
+    }
+    if (remote !== null)
+        return { kind: "remote", host: remote }
+    return null
+}
+
+// Sample input: " \thttps://a.example/x\n " strips URL padding and embedded tab, CR and LF.
+function strippedTarget(value) {
+    return String(value).replace(/^[\x00-\x20]+|[\x00-\x20]+$/g, "").replace(/[\t\r\n]/g, "")
+}
+
+// Sample input: "java&Tab;script:x" and "&amp;#106;avascript:x" are refused, "https://a.example/?a=1&amp;b=2" and "./x.md" pass.
+function targetAllowed(url) {
+    var seen = String(url)
+    for (var pass = 0; pass <= MAX_DECODE_PASSES; pass++) {
+        var shown = strippedTarget(canonicalUrl(seen))
+        var m = /^[a-zA-Z][a-zA-Z0-9+.-]*:/.exec(shown)
+        if (m !== null) {
+            var scheme = m[0].toLowerCase()
+            if (scheme !== "http:" && scheme !== "https:" && scheme !== "mailto:")
+                return false
+        }
+        var next = Ent.decodeReferences(shown)
+        if (next === seen || next === shown)
+            return true
+        seen = next
+    }
+    return false
+}