htmlnano 2.1.2 → 2.1.3

package/lib/modules/minifyCss.cjs

@@ -1,73 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.default = minifyCss;
-var _helpers = require("../helpers.cjs");
-const postcssOptions = {
-  // Prevent the following warning from being shown:
-  // > Without `from` option PostCSS could generate wrong source map and will not find Browserslist config.
-  // > Set it to CSS file path or to `undefined` to prevent this warning.
-  from: undefined
-};
-
-/** Minify CSS with cssnano */
-async function minifyCss(tree, options, cssnanoOptions) {
-  const cssnano = await (0, _helpers.optionalImport)('cssnano');
-  const postcss = await (0, _helpers.optionalImport)('postcss');
-  if (!cssnano || !postcss) {
-    return tree;
-  }
-  let promises = [];
-  tree.walk(node => {
-    // Skip SRI, reasons are documented in "minifyJs" module
-    if (node.attrs && 'integrity' in node.attrs) {
-      return node;
-    }
-    if ((0, _helpers.isStyleNode)(node)) {
-      promises.push(processStyleNode(node, cssnanoOptions, cssnano, postcss));
-    } else if (node.attrs && node.attrs.style) {
-      promises.push(processStyleAttr(node, cssnanoOptions, cssnano, postcss));
-    }
-    return node;
-  });
-  return Promise.all(promises).then(() => tree);
-}
-function processStyleNode(styleNode, cssnanoOptions, cssnano, postcss) {
-  let css = (0, _helpers.extractCssFromStyleNode)(styleNode);
-
-  // Improve performance by avoiding calling stripCdata again and again
-  let isCdataWrapped = false;
-  if (css.includes('CDATA')) {
-    const strippedCss = stripCdata(css);
-    isCdataWrapped = css !== strippedCss;
-    css = strippedCss;
-  }
-  return postcss([cssnano(cssnanoOptions)]).process(css, postcssOptions).then(result => {
-    if (isCdataWrapped) {
-      return styleNode.content = ['<![CDATA[' + result + ']]>'];
-    }
-    return styleNode.content = [result.css];
-  });
-}
-function processStyleAttr(node, cssnanoOptions, cssnano, postcss) {
-  // CSS "color: red;" is invalid. Therefore it should be wrapped inside some selector:
-  // a{color: red;}
-  const wrapperStart = 'a{';
-  const wrapperEnd = '}';
-  const wrappedStyle = wrapperStart + (node.attrs.style || '') + wrapperEnd;
-  return postcss([cssnano(cssnanoOptions)]).process(wrappedStyle, postcssOptions).then(result => {
-    const minifiedCss = result.css;
-    // Remove wrapperStart at the start and wrapperEnd at the end of minifiedCss
-    node.attrs.style = minifiedCss.substring(wrapperStart.length, minifiedCss.length - wrapperEnd.length);
-  });
-}
-function stripCdata(css) {
-  const leftStrippedCss = css.replace('<![CDATA[', '');
-  if (leftStrippedCss === css) {
-    return css;
-  }
-  const strippedCss = leftStrippedCss.replace(']]>', '');
-  return leftStrippedCss === strippedCss ? css : strippedCss;
-}

package/lib/modules/minifyCss.mjs

@@ -1,88 +0,0 @@
-import { isStyleNode, extractCssFromStyleNode, optionalImport } from '../helpers.mjs';
-
-const postcssOptions = {
-    // Prevent the following warning from being shown:
-    // > Without `from` option PostCSS could generate wrong source map and will not find Browserslist config.
-    // > Set it to CSS file path or to `undefined` to prevent this warning.
-    from: undefined,
-};
-
-/** Minify CSS with cssnano */
-export default async function minifyCss(tree, options, cssnanoOptions) {
-    const cssnano = await optionalImport('cssnano');
-    const postcss = await optionalImport('postcss');
-
-    if (!cssnano || !postcss) {
-        return tree;
-    }
-
-    let promises = [];
-    tree.walk(node => {
-        // Skip SRI, reasons are documented in "minifyJs" module
-        if (node.attrs && 'integrity' in node.attrs) {
-            return node;
-        }
-
-        if (isStyleNode(node)) {
-            promises.push(processStyleNode(node, cssnanoOptions, cssnano, postcss));
-        } else if (node.attrs && node.attrs.style) {
-            promises.push(processStyleAttr(node, cssnanoOptions, cssnano, postcss));
-        }
-
-        return node;
-    });
-
-    return Promise.all(promises).then(() => tree);
-}
-
-
-function processStyleNode(styleNode, cssnanoOptions, cssnano, postcss) {
-    let css = extractCssFromStyleNode(styleNode);
-
-    // Improve performance by avoiding calling stripCdata again and again
-    let isCdataWrapped = false;
-    if (css.includes('CDATA')) {
-        const strippedCss = stripCdata(css);
-        isCdataWrapped = css !== strippedCss;
-        css = strippedCss;
-    }
-
-    return postcss([cssnano(cssnanoOptions)])
-        .process(css, postcssOptions)
-        .then(result => {
-            if (isCdataWrapped) {
-                return styleNode.content = ['<![CDATA[' + result + ']]>'];
-            }
-            return styleNode.content = [result.css];
-        });
-}
-
-
-function processStyleAttr(node, cssnanoOptions, cssnano, postcss) {
-    // CSS "color: red;" is invalid. Therefore it should be wrapped inside some selector:
-    // a{color: red;}
-    const wrapperStart = 'a{';
-    const wrapperEnd = '}';
-    const wrappedStyle = wrapperStart + (node.attrs.style || '') + wrapperEnd;
-
-    return postcss([cssnano(cssnanoOptions)])
-        .process(wrappedStyle, postcssOptions)
-        .then(result => {
-            const minifiedCss = result.css;
-            // Remove wrapperStart at the start and wrapperEnd at the end of minifiedCss
-            node.attrs.style = minifiedCss.substring(
-                wrapperStart.length,
-                minifiedCss.length - wrapperEnd.length
-            );
-        });
-}
-
-function stripCdata(css) {
-    const leftStrippedCss = css.replace('<![CDATA[', '');
-    if (leftStrippedCss === css) {
-        return css;
-    }
-
-    const strippedCss = leftStrippedCss.replace(']]>', '');
-    return leftStrippedCss === strippedCss ? css : strippedCss;
-}

package/lib/modules/minifyJs.cjs

@@ -1,103 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.default = minifyJs;
-var _helpers = require("../helpers.cjs");
-var _removeRedundantAttributes = require("./removeRedundantAttributes.cjs");
-/** Minify JS with Terser */
-async function minifyJs(tree, options, terserOptions) {
-  const terser = await (0, _helpers.optionalImport)('terser');
-  if (!terser) return tree;
-  let promises = [];
-  tree.walk(node => {
-    const nodeAttrs = node.attrs || {};
-
-    /**
-     * Skip SRI
-     *
-     * If the input <script /> has an SRI attribute, it means that the original <script /> could be trusted,
-     * and should not be altered anymore.
-     *
-     * htmlnano is exactly an MITM that SRI is designed to protect from. If htmlnano or its dependencies get
-     * compromised and introduces malicious code, then it is up to the original SRI to protect the end user.
-     *
-     * So htmlnano will simply skip <script /> that has SRI.
-     * If developers do trust htmlnano, they should generate SRI after htmlnano modify the <script />.
-     */
-    if ('integrity' in nodeAttrs) {
-      return node;
-    }
-    if (node.tag && node.tag === 'script') {
-      const mimeType = nodeAttrs.type || 'text/javascript';
-      if (_removeRedundantAttributes.redundantScriptTypes.has(mimeType) || mimeType === 'module') {
-        promises.push(processScriptNode(node, terserOptions, terser));
-      }
-    }
-    if (node.attrs) {
-      promises = promises.concat(processNodeWithOnAttrs(node, terserOptions, terser));
-    }
-    return node;
-  });
-  return Promise.all(promises).then(() => tree);
-}
-function stripCdata(js) {
-  const leftStrippedJs = js.replace(/\/\/\s*<!\[CDATA\[/, '').replace(/\/\*\s*<!\[CDATA\[\s*\*\//, '');
-  if (leftStrippedJs === js) {
-    return js;
-  }
-  const strippedJs = leftStrippedJs.replace(/\/\/\s*\]\]>/, '').replace(/\/\*\s*\]\]>\s*\*\//, '');
-  return leftStrippedJs === strippedJs ? js : strippedJs;
-}
-function processScriptNode(scriptNode, terserOptions, terser) {
-  let js = (scriptNode.content || []).join('').trim();
-  if (!js) {
-    return scriptNode;
-  }
-
-  // Improve performance by avoiding calling stripCdata again and again
-  let isCdataWrapped = false;
-  if (js.includes('CDATA')) {
-    const strippedJs = stripCdata(js);
-    isCdataWrapped = js !== strippedJs;
-    js = strippedJs;
-  }
-  return terser.minify(js, terserOptions).then(result => {
-    if (result.error) {
-      throw new Error(result.error);
-    }
-    if (result.code === undefined) {
-      return;
-    }
-    let content = result.code;
-    if (isCdataWrapped) {
-      content = '/*<![CDATA[*/' + content + '/*]]>*/';
-    }
-    scriptNode.content = [content];
-  });
-}
-function processNodeWithOnAttrs(node, terserOptions, terser) {
-  const jsWrapperStart = 'a=function(){';
-  const jsWrapperEnd = '};a();';
-  const promises = [];
-  for (const attrName of Object.keys(node.attrs || {})) {
-    if (!(0, _helpers.isEventHandler)(attrName)) {
-      continue;
-    }
-
-    // For example onclick="return false" is valid,
-    // but "return false;" is invalid (error: 'return' outside of function)
-    // Therefore the attribute's code should be wrapped inside function:
-    // "function _(){return false;}"
-    let wrappedJs = jsWrapperStart + node.attrs[attrName] + jsWrapperEnd;
-    let promise = terser.minify(wrappedJs, terserOptions).then(({
-      code
-    }) => {
-      let minifiedJs = code.substring(jsWrapperStart.length, code.length - jsWrapperEnd.length);
-      node.attrs[attrName] = minifiedJs;
-    });
-    promises.push(promise);
-  }
-  return promises;
-}

package/lib/modules/minifyJs.mjs

@@ -1,121 +0,0 @@
-import { isEventHandler, optionalImport } from '../helpers.mjs';
-import { redundantScriptTypes } from './removeRedundantAttributes.mjs';
-
-/** Minify JS with Terser */
-export default async function minifyJs (tree, options, terserOptions) {
-    const terser = await optionalImport('terser');
-
-    if (!terser) return tree;
-
-    let promises = [];
-    tree.walk(node => {
-        const nodeAttrs = node.attrs || {};
-
-        /**
-         * Skip SRI
-         *
-         * If the input <script /> has an SRI attribute, it means that the original <script /> could be trusted,
-         * and should not be altered anymore.
-         *
-         * htmlnano is exactly an MITM that SRI is designed to protect from. If htmlnano or its dependencies get
-         * compromised and introduces malicious code, then it is up to the original SRI to protect the end user.
-         *
-         * So htmlnano will simply skip <script /> that has SRI.
-         * If developers do trust htmlnano, they should generate SRI after htmlnano modify the <script />.
-         */
-        if ('integrity' in nodeAttrs) {
-            return node;
-        }
-
-        if (node.tag && node.tag === 'script') {
-            const mimeType = nodeAttrs.type || 'text/javascript';
-            if (redundantScriptTypes.has(mimeType) || mimeType === 'module') {
-                promises.push(processScriptNode(node, terserOptions, terser));
-            }
-        }
-
-        if (node.attrs) {
-            promises = promises.concat(processNodeWithOnAttrs(node, terserOptions, terser));
-        }
-
-        return node;
-    });
-
-    return Promise.all(promises).then(() => tree);
-}
-
-
-function stripCdata (js) {
-    const leftStrippedJs = js.replace(/\/\/\s*<!\[CDATA\[/, '').replace(/\/\*\s*<!\[CDATA\[\s*\*\//, '');
-    if (leftStrippedJs === js) {
-        return js;
-    }
-
-    const strippedJs = leftStrippedJs.replace(/\/\/\s*\]\]>/, '').replace(/\/\*\s*\]\]>\s*\*\//, '');
-    return leftStrippedJs === strippedJs ? js : strippedJs;
-}
-
-
-function processScriptNode (scriptNode, terserOptions, terser) {
-    let js = (scriptNode.content || []).join('').trim();
-    if (!js) {
-        return scriptNode;
-    }
-
-    // Improve performance by avoiding calling stripCdata again and again
-    let isCdataWrapped = false;
-    if (js.includes('CDATA')) {
-        const strippedJs = stripCdata(js);
-        isCdataWrapped = js !== strippedJs;
-        js = strippedJs;
-    }
-
-    return terser
-        .minify(js, terserOptions)
-        .then(result => {
-            if (result.error) {
-                throw new Error(result.error);
-            }
-            if (result.code === undefined) {
-                return;
-            }
-
-            let content = result.code;
-            if (isCdataWrapped) {
-                content = '/*<![CDATA[*/' + content + '/*]]>*/';
-            }
-
-            scriptNode.content = [content];
-        });
-}
-
-
-function processNodeWithOnAttrs (node, terserOptions, terser) {
-    const jsWrapperStart = 'a=function(){';
-    const jsWrapperEnd = '};a();';
-
-    const promises = [];
-    for (const attrName of Object.keys(node.attrs || {})) {
-        if (!isEventHandler(attrName)) {
-            continue;
-        }
-
-        // For example onclick="return false" is valid,
-        // but "return false;" is invalid (error: 'return' outside of function)
-        // Therefore the attribute's code should be wrapped inside function:
-        // "function _(){return false;}"
-        let wrappedJs = jsWrapperStart + node.attrs[attrName] + jsWrapperEnd;
-        let promise = terser
-            .minify(wrappedJs, terserOptions)
-            .then(({ code }) => {
-                let minifiedJs = code.substring(
-                    jsWrapperStart.length,
-                    code.length - jsWrapperEnd.length
-                );
-                node.attrs[attrName] = minifiedJs;
-            });
-        promises.push(promise);
-    }
-
-    return promises;
-}

package/lib/modules/minifyJson.cjs

@@ -1,24 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.onContent = onContent;
-const rNodeAttrsTypeJson = /(\/|\+)json/;
-function onContent() {
-  return (content, node) => {
-    // Skip SRI, reasons are documented in "minifyJs" module
-    if (node.attrs && 'integrity' in node.attrs) {
-      return content;
-    }
-    if (node.attrs && node.attrs.type && rNodeAttrsTypeJson.test(node.attrs.type)) {
-      try {
-        // cast minified JSON to an array
-        return [JSON.stringify(JSON.parse((content || []).join('')))];
-      } catch (error) {
-        // Invalid JSON
-      }
-    }
-    return content;
-  };
-}

package/lib/modules/minifyJson.mjs

@@ -1,21 +0,0 @@
-const rNodeAttrsTypeJson = /(\/|\+)json/;
-
-export function onContent() {
-    return (content, node) => {
-        // Skip SRI, reasons are documented in "minifyJs" module
-        if (node.attrs && 'integrity' in node.attrs) {
-            return content;
-        }
-
-        if (node.attrs && node.attrs.type && rNodeAttrsTypeJson.test(node.attrs.type)) {
-            try {
-                // cast minified JSON to an array
-                return [JSON.stringify(JSON.parse((content || []).join('')))];
-            } catch (error) {
-                // Invalid JSON
-            }
-        }
-
-        return content;
-    };
-}

package/lib/modules/minifySvg.cjs

@@ -1,37 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.default = minifySvg;
-var _helpers = require("../helpers.cjs");
-/** Minify SVG with SVGO */
-async function minifySvg(tree, options, svgoOptions = {}) {
-  const svgo = await (0, _helpers.optionalImport)('svgo');
-  if (!svgo) return tree;
-  tree.match({
-    tag: 'svg'
-  }, node => {
-    let svgStr = tree.render(node, {
-      closingSingleTag: 'slash',
-      quoteAllAttributes: true
-    });
-    try {
-      const result = svgo.optimize(svgStr, svgoOptions);
-      node.tag = false;
-      node.attrs = {};
-      // result.data is a string, we need to cast it to an array
-      node.content = [result.data];
-      return node;
-    } catch (error) {
-      console.error('htmlnano fails to minify the svg:');
-      console.error(error);
-      if (error.name === 'SvgoParserError') {
-        console.error(error.toString());
-      }
-      // We return the node as-is
-      return node;
-    }
-  });
-  return tree;
-}

package/lib/modules/minifySvg.mjs

@@ -1,30 +0,0 @@
-import { optionalImport } from '../helpers.mjs';
-
-/** Minify SVG with SVGO */
-export default async function minifySvg(tree, options, svgoOptions = {}) {
-    const svgo = await optionalImport('svgo');
-
-    if (!svgo) return tree;
-
-    tree.match({tag: 'svg'}, node => {
-        let svgStr = tree.render(node, { closingSingleTag: 'slash', quoteAllAttributes: true });
-        try {
-            const result = svgo.optimize(svgStr, svgoOptions);
-            node.tag = false;
-            node.attrs = {};
-            // result.data is a string, we need to cast it to an array
-            node.content = [result.data];
-            return node;
-        } catch (error) {
-            console.error('htmlnano fails to minify the svg:');
-            console.error(error);
-            if (error.name === 'SvgoParserError') {
-                console.error(error.toString());
-            }
-            // We return the node as-is
-            return node;
-        }
-    });
-
-    return tree;
-}

package/lib/modules/minifyUrls.cjs

@@ -1,141 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.default = minifyUrls;
-var _helpers = require("../helpers.cjs");
-// Adopts from https://github.com/kangax/html-minifier/blob/51ce10f4daedb1de483ffbcccecc41be1c873da2/src/htmlminifier.js#L209-L221
-const tagsHaveUriValuesForAttributes = new Set(['a', 'area', 'link', 'base', 'object', 'blockquote', 'q', 'del', 'ins', 'form', 'input', 'head', 'audio', 'embed', 'iframe', 'img', 'script', 'track', 'video']);
-const tagsHasHrefAttributes = new Set(['a', 'area', 'link', 'base']);
-const attributesOfImgTagHasUriValues = new Set(['src', 'longdesc', 'usemap']);
-const attributesOfObjectTagHasUriValues = new Set(['classid', 'codebase', 'data', 'usemap']);
-const tagsHasCiteAttributes = new Set(['blockquote', 'q', 'ins', 'del']);
-const tagsHasSrcAttributes = new Set(['audio', 'embed', 'iframe', 'img', 'input', 'script', 'track', 'video',
-/**
- * https://html.spec.whatwg.org/#attr-source-src
- *
- * Although most of browsers recommend not to use "src" in <source>,
- * but technically it does comply with HTML Standard.
- */
-'source']);
-const isUriTypeAttribute = (tag, attr) => {
-  return tagsHasHrefAttributes.has(tag) && attr === 'href' || tag === 'img' && attributesOfImgTagHasUriValues.has(attr) || tag === 'object' && attributesOfObjectTagHasUriValues.has(attr) || tagsHasCiteAttributes.has(tag) && attr === 'cite' || tag === 'form' && attr === 'action' || tag === 'input' && attr === 'usemap' || tag === 'head' && attr === 'profile' || tag === 'script' && attr === 'for' || tagsHasSrcAttributes.has(tag) && attr === 'src';
-};
-const isSrcsetAttribute = (tag, attr) => {
-  return tag === 'source' && attr === 'srcset' || tag === 'img' && attr === 'srcset' || tag === 'link' && attr === 'imagesrcset';
-};
-const processModuleOptions = options => {
-  // FIXME!
-  // relateurl@1.0.0-alpha only supports URL while stable version (0.2.7) only supports string
-  // should convert input into URL instance after relateurl@1 is stable
-  if (typeof options === 'string') return options;
-  if (options instanceof URL) return options.toString();
-  return false;
-};
-const isLinkRelCanonical = ({
-  tag,
-  attrs
-}) => {
-  // Return false early for non-"link" tag
-  if (tag !== 'link') return false;
-  for (const [attrName, attrValue] of Object.entries(attrs)) {
-    if (attrName.toLowerCase() === 'rel' && attrValue === 'canonical') return true;
-  }
-  return false;
-};
-const JAVASCRIPT_URL_PROTOCOL = 'javascript:';
-let relateUrlInstance;
-let STORED_URL_BASE;
-
-/** Convert absolute url into relative url */
-async function minifyUrls(tree, options, moduleOptions) {
-  const RelateUrl = await (0, _helpers.optionalImport)('relateurl');
-  const srcset = await (0, _helpers.optionalImport)('srcset');
-  const terser = await (0, _helpers.optionalImport)('terser');
-  let promises = [];
-  const urlBase = processModuleOptions(moduleOptions);
-
-  // Invalid configuration, return tree directly
-  if (!urlBase) return tree;
-
-  /** Bring up a reusable RelateUrl instances (only once)
-   *
-   * STORED_URL_BASE is used to invalidate RelateUrl instances,
-   * avoiding require.cache acrossing multiple htmlnano instance with different configuration,
-   * e.g. unit tests cases.
-   */
-  if (!relateUrlInstance || STORED_URL_BASE !== urlBase) {
-    if (RelateUrl) {
-      relateUrlInstance = new RelateUrl(urlBase);
-    }
-    STORED_URL_BASE = urlBase;
-  }
-  tree.walk(node => {
-    if (!node.attrs) return node;
-    if (!node.tag) return node;
-    if (!tagsHaveUriValuesForAttributes.has(node.tag)) return node;
-
-    // Prevent link[rel=canonical] being processed
-    // Can't be excluded by isUriTypeAttribute()
-    if (isLinkRelCanonical(node)) return node;
-    for (const [attrName, attrValue] of Object.entries(node.attrs)) {
-      const attrNameLower = attrName.toLowerCase();
-      if (isUriTypeAttribute(node.tag, attrNameLower)) {
-        if (isJavaScriptUrl(attrValue)) {
-          promises.push(minifyJavaScriptUrl(node, attrName, terser));
-        } else {
-          if (relateUrlInstance) {
-            // FIXME!
-            // relateurl@1.0.0-alpha only supports URL while stable version (0.2.7) only supports string
-            // the WHATWG URL API is very strict while attrValue might not be a valid URL
-            // new URL should be used, and relateUrl#relate should be wrapped in try...catch after relateurl@1 is stable
-            node.attrs[attrName] = relateUrlInstance.relate(attrValue);
-          }
-        }
-        continue;
-      }
-      if (isSrcsetAttribute(node.tag, attrNameLower)) {
-        if (srcset) {
-          try {
-            const parsedSrcset = srcset.parseSrcset(attrValue, {
-              strict: true
-            });
-            node.attrs[attrName] = srcset.stringifySrcset(parsedSrcset.map(item => {
-              if (relateUrlInstance) {
-                item.url = relateUrlInstance.relate(item.url);
-              }
-              return item;
-            }));
-          } catch (e) {
-            // srcset will throw an Error for invalid srcset.
-          }
-        }
-        continue;
-      }
-    }
-    return node;
-  });
-  if (promises.length > 0) return Promise.all(promises).then(() => tree);
-  return Promise.resolve(tree);
-}
-function isJavaScriptUrl(url) {
-  return typeof url === 'string' && url.toLowerCase().startsWith(JAVASCRIPT_URL_PROTOCOL);
-}
-const jsWrapperStart = 'function a(){';
-const jsWrapperEnd = '}a();';
-function minifyJavaScriptUrl(node, attrName, terser) {
-  if (!terser) return Promise.resolve();
-  let result = node.attrs[attrName];
-  if (result) {
-    result = jsWrapperStart + result.slice(JAVASCRIPT_URL_PROTOCOL.length) + jsWrapperEnd;
-    return terser.minify(result, {}) // Default Option is good enough
-    .then(({
-      code
-    }) => {
-      const minifiedJs = code.substring(jsWrapperStart.length, code.length - jsWrapperEnd.length);
-      node.attrs[attrName] = JAVASCRIPT_URL_PROTOCOL + minifiedJs;
-    });
-  }
-  return Promise.resolve();
-}