single-file-core 1.5.114 → 1.5.115

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "single-file-core",
-  "version": "1.5.114",
+  "version": "1.5.115",
   "description": "SingleFile Core",
   "author": "Gildas Lormeau",
   "license": "AGPL-3.0-or-later",

package/processors/compression/compression.js

@@ -573,8 +573,11 @@ function getStartHTMLArray(pageData, options, lastModDate, startTag = "") {
 	const html = bom + doctype + documentStart;
 	// the comment carries the page URL, whose length is unbounded: it is emitted after the
 	// declaration of the character encoding, and after the embedded PDF when there is one, so
-	// that neither the encoding declaration nor the PDF header leaves the first 1024 bytes
-	const comment = pageData.comment && !options.embeddedImage ? "<!--" + pageData.comment + "-->" : "";
+	// that neither the encoding declaration nor the PDF header leaves the first 1024 bytes.
+	// it is left out of a password-protected archive, like the title below: the same URL is
+	// in manifest.json, which is encrypted, so emitting it here would publish what the
+	// password is meant to cover
+	const comment = pageData.comment && !options.embeddedImage && !options.password ? "<!--" + pageData.comment + "-->" : "";
 	const htmlHeadData = getHTMLHeadData(pageData, options);
 	let htmlArray, pdfEntry;
 	if (options.embeddedPdf) {
@@ -618,7 +621,9 @@ function getHTMLHeadData(pageData, options) {
 	// is encrypted, so emitting it here would publish what the password is meant to cover
 	const title = options.password ? "" : getPageTitle(pageData);
 	pageContent += "<title>" + title + "</title>";
-	if (options.insertCanonicalLink) {
+	// the canonical link publishes the URL the archive was saved from, for the same reason
+	// the title above is left out of a password-protected archive
+	if (options.insertCanonicalLink && !options.password) {
 		pageContent += "<link rel=canonical href=\"" + options.url + "\">";
 	}
 	if (options.insertMetaNoIndex) {

package/test/sfz-harness/format-rules.js

@@ -37,20 +37,36 @@ function imageResource(url) {
 }
 
 {
-	const options = makeOptions({ password: "secret" });
+	const options = makeOptions({ password: "secret", insertCanonicalLink: true, url: "https://example.com/secret-page" });
 	const pageData = makePageData(2, 4 * 1024);
 	pageData.title = TITLE;
+	pageData.comment = "\n url: https://example.com/secret-page \n";
 	pageData.resources.images.push(imageResource("https://example.com/secret-image.png"));
 	const { bytes } = await runProcess(pageData, options);
 	const text = decodeText(bytes);
 	check("title withheld from a protected archive", text.includes("<title></title>"), true);
 	check("resource url absent from a protected archive", text.includes("secret-image.png"), false);
+	// the wrapper ladder hides the zip data in a comment of its own, so only the text
+	// of the SingleFile comment tells whether it was written
+	check("comment withheld from a protected archive", text.includes("<!--\n url:"), false);
+	check("canonical link withheld from a protected archive", text.includes("<link rel=canonical"), false);
+	check("page url absent from a protected archive", text.includes("secret-page"), false);
 	const zipReader = new ZipReader(new BlobReader(new Blob([bytes])));
 	const entries = await zipReader.getEntries();
 	await zipReader.close();
 	check("entry comments empty in a protected archive", entries.every(entry => !entry.comment), true);
 }
 
+{
+	const options = makeOptions({ insertCanonicalLink: true, url: "https://example.com/page" });
+	const pageData = makePageData(9, 4 * 1024);
+	pageData.comment = "\n url: https://example.com/page \n";
+	const { bytes } = await runProcess(pageData, options);
+	const text = decodeText(bytes);
+	check("comment written without a password", text.includes("<!--\n url: https://example.com/page \n-->"), true);
+	check("canonical link written without a password", text.includes("<link rel=canonical href=\"https://example.com/page\">"), true);
+}
+
 {
 	const options = makeOptions({ insertTextBody: true });
 	const pageData = makePageData(7, 4 * 1024);