html-minifier-next 4.11.0 → 4.12.0

package/src/htmlminifier.js

@@ -463,7 +463,7 @@ const cssMinifyCache = new LRU(200);
 
 const trimWhitespace = str => {
   if (!str) return str;
-  // Fast path: if no whitespace at start or end, return early
+  // Fast path: If no whitespace at start or end, return early
   if (!/^[ \n\r\t\f]/.test(str) && !/[ \n\r\t\f]$/.test(str)) {
     return str;
   }
@@ -472,7 +472,7 @@ const trimWhitespace = str => {
 
 function collapseWhitespaceAll(str) {
   if (!str) return str;
-  // Fast path: if there are no common whitespace characters, return early
+  // Fast path: If there are no common whitespace characters, return early
   if (!/[ \n\r\t\f\xA0]/.test(str)) {
     return str;
   }
@@ -840,7 +840,7 @@ async function cleanAttributeValue(tag, attrName, attrValue, options, attrs, min
     return options.minifyCSS(attrValue, 'media');
   } else if (tag === 'iframe' && attrName === 'srcdoc') {
     // Recursively minify HTML content within srcdoc attribute
-    // Fast-path: skip if nothing would change
+    // Fast-path: Skip if nothing would change
     if (!shouldMinifyInnerHTML(options)) {
       return attrValue;
     }
@@ -1227,7 +1227,7 @@ async function normalizeAttr(attr, attrs, tag, options) {
   let attrValue = attr.value;
 
   if (options.decodeEntities && attrValue) {
-    // Fast path: only decode when entities are present
+    // Fast path: Only decode when entities are present
     if (attrValue.indexOf('&') !== -1) {
       attrValue = decodeHTMLStrict(attrValue);
     }
@@ -1272,7 +1272,9 @@ function buildAttr(normalized, hasUnarySlash, options, isLast, uidAttr) {
 
   if (typeof attrValue !== 'undefined' && (!options.removeAttributeQuotes ||
     ~attrValue.indexOf(uidAttr) || !canRemoveAttributeQuotes(attrValue))) {
+    // Determine the appropriate quote character
     if (!options.preventAttributesEscaping) {
+      // Normal mode: choose quotes and escape
       if (typeof options.quoteCharacter === 'undefined') {
         // Count quotes in a single pass instead of two regex operations
         let apos = 0, quot = 0;
@@ -1289,6 +1291,50 @@ function buildAttr(normalized, hasUnarySlash, options, isLast, uidAttr) {
       } else {
         attrValue = attrValue.replace(/'/g, ''');
       }
+    } else {
+      // `preventAttributesEscaping` mode: choose safe quotes but don’t escape
+      // EXCEPT when both quote types are present—then escape to prevent invalid HTML
+      const hasDoubleQuote = attrValue.indexOf('"') !== -1;
+      const hasSingleQuote = attrValue.indexOf("'") !== -1;
+
+      if (hasDoubleQuote && hasSingleQuote) {
+        // Both quote types present: `preventAttributesEscaping` is ignored to ensure valid HTML
+        // Choose the quote type with fewer occurrences and escape the other
+        if (typeof options.quoteCharacter === 'undefined') {
+          let apos = 0, quot = 0;
+          for (let i = 0; i < attrValue.length; i++) {
+            if (attrValue[i] === "'") apos++;
+            else if (attrValue[i] === '"') quot++;
+          }
+          attrQuote = apos < quot ? '\'' : '"';
+        } else {
+          attrQuote = options.quoteCharacter === '\'' ? '\'' : '"';
+        }
+        if (attrQuote === '"') {
+          attrValue = attrValue.replace(/"/g, '&#34;');
+        } else {
+          attrValue = attrValue.replace(/'/g, '&#39;');
+        }
+      } else if (typeof options.quoteCharacter === 'undefined') {
+        // Single or no quote type: Choose safe quote delimiter
+        if (attrQuote === '"' && hasDoubleQuote && !hasSingleQuote) {
+          attrQuote = "'";
+        } else if (attrQuote === "'" && hasSingleQuote && !hasDoubleQuote) {
+          attrQuote = '"';
+        } else if (attrQuote !== '"' && attrQuote !== "'" && attrQuote !== '') {
+          // `attrQuote` is invalid/undefined (not `"`, `'`, or empty string)
+          // Set a safe default based on the value’s content
+          if (hasSingleQuote && !hasDoubleQuote) {
+            attrQuote = '"'; // Value has single quotes, use double quotes as delimiter
+          } else if (hasDoubleQuote && !hasSingleQuote) {
+            attrQuote = "'"; // Value has double quotes, use single quotes as delimiter
+          } else {
+            attrQuote = '"'; // No quotes in value, default to double quotes
+          }
+        }
+      } else {
+        attrQuote = options.quoteCharacter === '\'' ? '\'' : '"';
+      }
     }
     emittedAttrValue = attrQuote + attrValue + attrQuote;
     if (!isLast && !options.removeTagWhitespace) {
@@ -1381,7 +1427,7 @@ const processOptions = (inputOptions) => {
       const lightningCssOptions = typeof option === 'object' ? option : {};
 
       options.minifyCSS = async function (text, type) {
-        // Fast path: nothing to minify
+        // Fast path: Nothing to minify
         if (!text || !text.trim()) {
           return text;
         }
@@ -1473,7 +1519,7 @@ const processOptions = (inputOptions) => {
 
         let jsKey;
         try {
-          // Fast path: avoid invoking Terser for empty/whitespace-only content
+          // Fast path: Avoid invoking Terser for empty/whitespace-only content
           if (!code || !code.trim()) {
             return '';
           }
@@ -1525,9 +1571,18 @@ const processOptions = (inputOptions) => {
         relateUrlOptions = {};
       }
 
+      // Cache RelateURL instance for reuse (expensive to create)
+      const relateUrlInstance = new RelateURL(relateUrlOptions.site || '', relateUrlOptions);
+
       options.minifyURLs = function (text) {
+        // Fast-path: Skip if text doesn’t look like a URL that needs processing
+        // Only process if contains URL-like characters (`/`, `:`, `#`, `?`) or spaces that need encoding
+        if (!/[/:?#\s]/.test(text)) {
+          return text;
+        }
+
         try {
-          return RelateURL.relate(text, relateUrlOptions);
+          return relateUrlInstance.relate(text);
         } catch (err) {
           if (!options.continueOnMinifyError) {
             throw err;
@@ -1553,7 +1608,7 @@ function uniqueId(value) {
 
 const specialContentTags = new Set(['script', 'style']);
 
-async function createSortFns(value, options, uidIgnore, uidAttr) {
+async function createSortFns(value, options, uidIgnore, uidAttr, ignoredMarkupChunks) {
   const attrChains = options.sortAttributes && Object.create(null);
   const classChain = options.sortClassName && new TokenChain();
 
@@ -1567,10 +1622,20 @@ async function createSortFns(value, options, uidIgnore, uidAttr) {
     return !uid || token.indexOf(uid) === -1;
   }
 
-  function shouldSkipUIDs(token) {
+  function shouldKeepToken(token) {
+    // Filter out any HTML comment tokens (UID placeholders)
+    // These are temporary markers created by `htmlmin:ignore` and `ignoreCustomFragments`
+    if (token.startsWith('<!--') && token.endsWith('-->')) {
+      return false;
+    }
     return shouldSkipUID(token, uidIgnore) && shouldSkipUID(token, uidAttr);
   }
 
+  // Pre-compile regex patterns for reuse (performance optimization)
+  // These must be declared before scan() since scan uses them
+  const whitespaceSplitPatternScan = /[ \t\n\f\r]+/;
+  const whitespaceSplitPatternSort = /[ \n\f\r]+/;
+
   async function scan(input) {
     let currentTag, currentType;
     const parser = new HTMLParser(input, {
@@ -1579,12 +1644,14 @@ async function createSortFns(value, options, uidIgnore, uidAttr) {
           if (!attrChains[tag]) {
             attrChains[tag] = new TokenChain();
           }
-          attrChains[tag].add(attrNames(attrs).filter(shouldSkipUIDs));
+          const attrNamesList = attrNames(attrs).filter(shouldKeepToken);
+          attrChains[tag].add(attrNamesList);
         }
         for (let i = 0, len = attrs.length; i < len; i++) {
           const attr = attrs[i];
           if (classChain && attr.value && options.name(attr.name) === 'class') {
-            classChain.add(trimWhitespace(attr.value).split(/[ \t\n\f\r]+/).filter(shouldSkipUIDs));
+            const classes = trimWhitespace(attr.value).split(whitespaceSplitPatternScan).filter(shouldKeepToken);
+            classChain.add(classes);
           } else if (options.processScripts && attr.name.toLowerCase() === 'type') {
             currentTag = tag;
             currentType = attr.value;
@@ -1604,19 +1671,84 @@ async function createSortFns(value, options, uidIgnore, uidAttr) {
         }
       },
       // We never need `nextTag` information in this scan
-      wantsNextTag: false
+      wantsNextTag: false,
+      // Continue on parse errors during analysis pass
+      continueOnParseError: options.continueOnParseError
     });
 
-    await parser.parse();
+    try {
+      await parser.parse();
+    } catch (err) {
+      // If parsing fails during analysis pass, just skip it—we’ll still have
+      // partial frequency data from what we could parse
+      if (!options.continueOnParseError) {
+        throw err;
+      }
+    }
   }
 
-  const log = options.log;
-  options.log = identity;
-  options.sortAttributes = false;
-  options.sortClassName = false;
-  const firstPassOutput = await minifyHTML(value, options);
-  await scan(firstPassOutput);
-  options.log = log;
+  // For the first pass, create a copy of options and disable aggressive minification.
+  // Keep attribute transformations (like `removeStyleLinkTypeAttributes`) for accurate analysis.
+  // This is safe because `createSortFns` is called before custom fragment UID markers (uidAttr) are added.
+  // Note: `htmlmin:ignore` UID markers (uidIgnore) already exist and are expanded for analysis.
+  const firstPassOptions = Object.assign({}, options, {
+    // Disable sorting for the analysis pass
+    sortAttributes: false,
+    sortClassName: false,
+    // Disable aggressive minification that doesn’t affect attribute analysis
+    collapseWhitespace: false,
+    removeAttributeQuotes: false,
+    removeTagWhitespace: false,
+    decodeEntities: false,
+    processScripts: false,
+    // Keep `ignoreCustomFragments` to handle template syntax correctly
+    // This is safe because `createSortFns` is now called before UID markers are added
+    // Continue on parse errors during analysis (e.g., template syntax)
+    continueOnParseError: true,
+    log: identity
+  });
+
+  // Temporarily enable `continueOnParseError` for the `scan()` function call below.
+  // Note: `firstPassOptions` already has `continueOnParseError: true` for the minifyHTML call.
+  const originalContinueOnParseError = options.continueOnParseError;
+  options.continueOnParseError = true;
+
+  // Pre-compile regex patterns for UID replacement and custom fragments
+  const uidReplacePattern = uidIgnore && ignoredMarkupChunks
+    ? new RegExp('<!--' + uidIgnore + '(\\d+)-->', 'g')
+    : null;
+  const customFragmentPattern = options.ignoreCustomFragments && options.ignoreCustomFragments.length > 0
+    ? new RegExp('(' + options.ignoreCustomFragments.map(re => re.source).join('|') + ')', 'g')
+    : null;
+
+  try {
+    // Expand UID tokens back to original content for frequency analysis
+    let expandedValue = value;
+    if (uidReplacePattern) {
+      expandedValue = value.replace(uidReplacePattern, function (match, index) {
+        return ignoredMarkupChunks[+index] || '';
+      });
+      // Reset `lastIndex` for pattern reuse
+      uidReplacePattern.lastIndex = 0;
+    }
+
+    // First pass minification applies attribute transformations
+    // like removeStyleLinkTypeAttributes for accurate frequency analysis
+    const firstPassOutput = await minifyHTML(expandedValue, firstPassOptions);
+
+    // For frequency analysis, we need to remove custom fragments temporarily
+    // because HTML comments in opening tags prevent proper attribute parsing.
+    // We remove them with a space to preserve attribute boundaries.
+    let scanValue = firstPassOutput;
+    if (customFragmentPattern) {
+      scanValue = firstPassOutput.replace(customFragmentPattern, ' ');
+    }
+
+    await scan(scanValue);
+  } finally {
+    // Restore original option
+    options.continueOnParseError = originalContinueOnParseError;
+  }
   if (attrChains) {
     const attrSorters = Object.create(null);
     for (const tag in attrChains) {
@@ -1630,7 +1762,8 @@ async function createSortFns(value, options, uidIgnore, uidAttr) {
         names.forEach(function (name, index) {
           (attrMap[name] || (attrMap[name] = [])).push(attrs[index]);
         });
-        sorter.sort(names).forEach(function (name, index) {
+        const sorted = sorter.sort(names);
+        sorted.forEach(function (name, index) {
           attrs[index] = attrMap[name].shift();
         });
       }
@@ -1638,8 +1771,40 @@ async function createSortFns(value, options, uidIgnore, uidAttr) {
   }
   if (classChain) {
     const sorter = classChain.createSorter();
+    // Memoize `sortClassName` results—class lists often repeat in templates
+    const classNameCache = new LRU(200);
+
     options.sortClassName = function (value) {
-      return sorter.sort(value.split(/[ \n\f\r]+/)).join(' ');
+      // Fast path: Single class (no spaces) needs no sorting
+      if (value.indexOf(' ') === -1) {
+        return value;
+      }
+
+      // Check cache first
+      const cached = classNameCache.get(value);
+      if (cached !== undefined) {
+        return cached;
+      }
+
+      // Expand UID tokens back to original content before sorting
+      // Fast path: Skip if no HTML comments (UID markers) present
+      let expandedValue = value;
+      if (uidReplacePattern && value.indexOf('<!--') !== -1) {
+        expandedValue = value.replace(uidReplacePattern, function (match, index) {
+          return ignoredMarkupChunks[+index] || '';
+        });
+        // Reset `lastIndex` for pattern reuse
+        uidReplacePattern.lastIndex = 0;
+      }
+      const classes = expandedValue.split(whitespaceSplitPatternSort).filter(function(cls) {
+        return cls !== '';
+      });
+      const sorted = sorter.sort(classes);
+      const result = sorted.join(' ');
+
+      // Cache the result
+      classNameCache.set(value, result);
+      return result;
     };
   }
 }
@@ -1680,7 +1845,7 @@ async function minifyHTML(value, options, partialMarkup) {
   const customElementsInput = options.inlineCustomElements ?? [];
   const customElementsArr = Array.isArray(customElementsInput) ? customElementsInput : Array.from(customElementsInput);
   const normalizedCustomElements = customElementsArr.map(name => options.name(name));
-  // Fast path: reuse base Sets if no custom elements
+  // Fast path: Reuse base Sets if no custom elements
   const inlineTextSet = normalizedCustomElements.length
     ? new Set([...inlineElementsToKeepWhitespaceWithin, ...normalizedCustomElements])
     : inlineElementsToKeepWhitespaceWithin;
@@ -1720,6 +1885,13 @@ async function minifyHTML(value, options, partialMarkup) {
     return token;
   });
 
+  // Create sort functions after `htmlmin:ignore` processing but before custom fragment UID markers
+  // This allows proper frequency analysis with access to ignored content via UID tokens
+  if ((options.sortAttributes && typeof options.sortAttributes !== 'function') ||
+    (options.sortClassName && typeof options.sortClassName !== 'function')) {
+    await createSortFns(value, options, uidIgnore, null, ignoredMarkupChunks);
+  }
+
   const customFragments = options.ignoreCustomFragments.map(function (re) {
     return re.source;
   });
@@ -1778,11 +1950,6 @@ async function minifyHTML(value, options, partialMarkup) {
     });
   }
 
-  if ((options.sortAttributes && typeof options.sortAttributes !== 'function') ||
-    (options.sortClassName && typeof options.sortClassName !== 'function')) {
-    await createSortFns(value, options, uidIgnore, uidAttr);
-  }
-
   function _canCollapseWhitespace(tag, attrs) {
     return options.canCollapseWhitespace(tag, attrs, canCollapseWhitespace);
   }

package/src/htmlparser.js

@@ -85,7 +85,7 @@ const preCompiledStackedTags = {
 // Cache for compiled attribute regexes per handler configuration
 const attrRegexCache = new WeakMap();
 
-function attrForHandler(handler) {
+function buildAttrRegex(handler) {
   let pattern = singleAttrIdentifier.source +
     '(?:\\s*(' + joinSingleAttrAssigns(handler) + ')' +
     '[ \\t\\n\\f\\r]*(?:' + singleAttrValues.join('|') + '))?';
@@ -104,6 +104,14 @@ function attrForHandler(handler) {
   return new RegExp('^\\s*' + pattern);
 }
 
+function getAttrRegexForHandler(handler) {
+  let cached = attrRegexCache.get(handler);
+  if (cached) return cached;
+  const compiled = buildAttrRegex(handler);
+  attrRegexCache.set(handler, compiled);
+  return compiled;
+}
+
 function joinSingleAttrAssigns(handler) {
   return singleAttrAssigns.concat(
     handler.customAttrAssign || []
@@ -127,12 +135,8 @@ export class HTMLParser {
     const fullLength = fullHtml.length;
 
     const stack = []; let lastTag;
-    // Use cached attribute regex if available
-    let attribute = attrRegexCache.get(handler);
-    if (!attribute) {
-      attribute = attrForHandler(handler);
-      attrRegexCache.set(handler, attribute);
-    }
+    // Use cached attribute regex for this handler configuration
+    const attribute = getAttrRegexForHandler(handler);
     let prevTag = undefined, nextTag = undefined;
 
     // Index-based parsing