single-file-core 1.5.115 → 1.5.116

package/core/helper.js

@@ -496,17 +496,22 @@ function getStylesheetsContent(styleSheets, adoptedStyleSheetsCache = new Map())
 function getResourcesInfo(win, doc, element, options, data, elementHidden, computedStyle) {
 	const tagName = element.tagName && element.tagName.toUpperCase();
 	if (tagName == "CANVAS") {
+		const canvasComputedStyle = computedStyle || getComputedStyle(win, element);
+		const canvasData = {
+			backgroundColor: canvasComputedStyle && canvasComputedStyle.getPropertyValue("background-color")
+		};
 		try {
-			data.canvases.push({
-				dataURI: element.toDataURL("image/png"),
-				backgroundColor: computedStyle.getPropertyValue("background-color")
-			});
-			element.setAttribute(CANVAS_ATTRIBUTE_NAME, data.canvases.length - 1);
-			data.markedElements.push(element);
+			canvasData.dataURI = element.toDataURL("image/png");
 			// eslint-disable-next-line no-unused-vars
 		} catch (error) {
-			// ignored
+			// a canvas painted with a cross-origin resource is tainted and toDataURL throws for the
+			// whole element, its own drawing included. The entry is pushed and the element marked
+			// anyway: the loss is then counted and reported instead of being silent, and an
+			// out-of-page fallback re-rendering the element has something to find it by
 		}
+		data.canvases.push(canvasData);
+		element.setAttribute(CANVAS_ATTRIBUTE_NAME, data.canvases.length - 1);
+		data.markedElements.push(element);
 	}
 	if (tagName == "IMG") {
 		const imageData = {

package/core/index.js

@@ -422,6 +422,7 @@ const SHADOWROOT_CLONABLE = "shadowrootclonable";
 const SHADOWROOT_SERIALIZABLE = "shadowrootserializable";
 const SCRIPT_OPTIONS = "data-single-file-options";
 const UTF8_CHARSET = "utf-8";
+const TAINTED_CANVAS_WARNING_MESSAGE = "SingleFile: canvas elements tainted by a cross-origin resource, dropped from the page:";
 
 class Processor {
 	constructor(options, processorHelper, batchRequest) {
@@ -1055,20 +1056,29 @@ class Processor {
 
 	replaceCanvasElements() {
 		if (this.options.canvases) {
+			let discardedCount = 0;
 			this.doc.querySelectorAll("canvas").forEach(canvasElement => {
 				const attributeValue = canvasElement.getAttribute(util.CANVAS_ATTRIBUTE_NAME);
 				if (attributeValue) {
 					const canvasData = this.options.canvases[Number(attributeValue)];
 					if (canvasData) {
-						const backgroundStyle = {};
-						if (canvasData.backgroundColor) {
-							backgroundStyle["background-color"] = canvasData.backgroundColor;
+						if (canvasData.dataURI) {
+							const backgroundStyle = {};
+							if (canvasData.backgroundColor) {
+								backgroundStyle["background-color"] = canvasData.backgroundColor;
+							}
+							this.processorHelper.setBackgroundImage(canvasElement, "url(" + canvasData.dataURI + ")", backgroundStyle);
+							this.stats.add("processed", "canvas", 1);
+						} else {
+							discardedCount++;
+							this.stats.add("discarded", "canvas", 1);
 						}
-						this.processorHelper.setBackgroundImage(canvasElement, "url(" + canvasData.dataURI + ")", backgroundStyle);
-						this.stats.add("processed", "canvas", 1);
 					}
 				}
 			});
+			if (discardedCount) {
+				warn(TAINTED_CANVAS_WARNING_MESSAGE, discardedCount);
+			}
 		}
 	}
 
@@ -1726,6 +1736,10 @@ function log(...args) {
 	console.log("S-File <core>   ", ...args); // eslint-disable-line no-console
 }
 
+function warn(...args) {
+	console.warn("S-File <core>   ", ...args); // eslint-disable-line no-console
+}
+
 // -----
 // Stats
 // -----

package/core/lib/processor-helper-common.js

@@ -102,9 +102,10 @@ class ProcessorHelperCommon {
 			["image, feImage", "xlink:href"],
 			["image, feImage", "href"]
 		];
-		if (options.blockImages) {
-			doc.querySelectorAll("svg").forEach(element => element.remove());
-		}
+		// an inline svg is document content, not a fetched resource: blocking images empties the
+		// references it makes outwards (image, feImage and use are all processed below) and leaves
+		// the markup itself alone. Removing it deleted JS-drawn charts, inline icons, and the
+		// <defs> holding gradients and filters that CSS applies to ordinary HTML elements
 		let resourcePromises = processAttributeArgs.map(([selector, attributeName, removeElementIfMissing, processDuplicates]) =>
 			this.processAttribute(doc, doc.querySelectorAll(selector), attributeName, baseURI, options, "image", resources, removeElementIfMissing, batchRequest, styles, processDuplicates)
 		);
@@ -136,9 +137,12 @@ class ProcessorHelperCommon {
 				resourceElement.setAttribute("data-sf-original-href", originalResourceURL);
 			}
 			let resourceURL = normalizeURL(originalResourceURL);
-			if (!options.blockImages) {
-				if (testValidPath(resourceURL) && !testIgnoredPath(resourceURL)) {
-					resourceElement.setAttribute(attributeName, util.EMPTY_RESOURCE);
+			// a reference into the page itself costs no request, so blocking images must not empty
+			// it: normalizeURL drops the fragment, which leaves a bare "#symbol" as the empty path
+			// below and a same-document URL matching options.url
+			if (testValidPath(resourceURL) && !testIgnoredPath(resourceURL)) {
+				resourceElement.setAttribute(attributeName, util.EMPTY_RESOURCE);
+				if (!options.blockImages) {
 					try {
 						resourceURL = util.resolveURL(resourceURL, baseURI);
 						// eslint-disable-next-line no-unused-vars
@@ -172,11 +176,9 @@ class ProcessorHelperCommon {
 							}
 						}
 					}
-				} else if (resourceURL == options.url) {
-					resourceElement.setAttribute(attributeName, originalResourceURL.substring(resourceURL.length));
 				}
-			} else {
-				resourceElement.setAttribute(attributeName, util.EMPTY_RESOURCE);
+			} else if (resourceURL == options.url) {
+				resourceElement.setAttribute(attributeName, originalResourceURL.substring(resourceURL.length));
 			}
 		}));
 	}
@@ -255,6 +257,17 @@ class ProcessorHelperCommon {
 		}));
 	}
 
+	// a video or an audio element gets the attribute REMOVED rather than emptied: util.EMPTY_RESOURCE
+	// is inert on an image but not on a media element, which would attempt the load, fail, and sit
+	// in an error state where removing the attribute leaves the poster showing cleanly
+	setAttributeEmpty(resourceElement, attributeName, expectedType) {
+		if (expectedType == "video" || expectedType == "audio") {
+			resourceElement.removeAttribute(attributeName);
+		} else {
+			resourceElement.setAttribute(attributeName, util.EMPTY_RESOURCE);
+		}
+	}
+
 	setBackgroundImage(element, url, style) {
 		element.style.setProperty("background-blend-mode", "normal", "important");
 		element.style.setProperty("background-clip", "content-box", "important");
@@ -382,12 +395,7 @@ class ProcessorHelperCommon {
 	}
 
 	async removeAlternativeFonts(doc, stylesheets, fonts, fontTests) {
-		const fontsDetails = {
-			fonts: new Map(),
-			medias: new Map(),
-			supports: new Map(),
-			layers: new Map()
-		};
+		const fontsDetails = this.createFontsDetailsInfo();
 		const stats = { rules: { processed: 0, discarded: 0 }, fonts: { processed: 0, discarded: 0 } };
 		let sheetIndex = 0;
 		stylesheets.forEach(stylesheetInfo => {
@@ -446,7 +454,18 @@ class ProcessorHelperCommon {
 				const key = this.getFontKey(ruleData);
 				const fontInfo = fontsDetails.fonts.get(key);
 				if (fontInfo) {
-					await this.processFontFaceRule(ruleData, fontInfo, fonts, fontTests, stats);
+					// a face declaring the same descriptors and the same sources as one already kept
+					// cannot change what that one did, and its sources are embedded a second time. A
+					// stylesheet reached from two <link> elements, or imported by two sheets, repeats
+					// every face it carries. The test is made before the await: the sources are read
+					// as they stand for both rules, and processing them is what would interleave
+					const ruleKey = key + " " + this.getPropertyValue(ruleData, "src");
+					if (fontsDetails.emittedFonts.has(ruleKey)) {
+						removedRules.push(cssRule);
+					} else {
+						fontsDetails.emittedFonts.add(ruleKey);
+						await this.processFontFaceRule(ruleData, fontInfo, fonts, fontTests, stats);
+					}
 				} else {
 					removedRules.push(cssRule);
 				}
@@ -504,7 +523,12 @@ class ProcessorHelperCommon {
 			fonts: new Map(),
 			medias: new Map(),
 			supports: new Map(),
-			layers: new Map()
+			layers: new Map(),
+			// the faces already emitted in this cascade context, so a second declaration of one of
+			// them can be dropped instead of embedding the same bytes again. Each media, supports
+			// and layer block gets its own info, so only rules that apply under the same conditions
+			// are ever compared
+			emittedFonts: new Set()
 		};
 	}
 

package/core/lib/processor-helper-inline.js

@@ -348,7 +348,7 @@ function getProcessorHelperClass(utilInstance) {
 					delete resourceElement.dataset.singleFileOriginURL;
 					if (!expectedType || !options["block" + expectedType.charAt(0).toUpperCase() + expectedType.substring(1) + "s"]) {
 						if (!testIgnoredPath(resourceURL)) {
-							setAttributeEmpty(resourceElement, attributeName, expectedType);
+							this.setAttributeEmpty(resourceElement, attributeName, expectedType);
 							if (testValidPath(resourceURL)) {
 								try {
 									resourceURL = util.resolveURL(resourceURL, baseURI);
@@ -435,18 +435,10 @@ function getProcessorHelperClass(utilInstance) {
 							}
 						}
 					} else {
-						setAttributeEmpty(resourceElement, attributeName, expectedType);
+						this.setAttributeEmpty(resourceElement, attributeName, expectedType);
 					}
 				}
 			}));
-
-			function setAttributeEmpty(resourceElement, attributeName, expectedType) {
-				if (expectedType == "video" || expectedType == "audio") {
-					resourceElement.removeAttribute(attributeName);
-				} else {
-					resourceElement.setAttribute(attributeName, util.EMPTY_RESOURCE);
-				}
-			}
 		}
 
 		async processImageSrcset(resourceURL, srcsetValue, resources, batchRequest) {

package/core/lib/processor-helper.js

@@ -106,11 +106,16 @@ function getProcessorHelperClass(utilInstance) {
 				linkElement.setAttribute("type", "text/css");
 				const name = "stylesheet_" + resources.stylesheets.size + ".css";
 				linkElement.setAttribute("href", name);
-				let { content } = options.inlineStylesheets.get(stylesheetRefIndex);
-				const stylesheet = cssTree.parse(content, { context: "stylesheet", parseCustomProperty: true });
-				this.replacePseudoClassDefined(stylesheet);
-				content = this.generateStylesheetContent(stylesheet, options);
-				resources.stylesheets.set(resources.stylesheets.size, { name, content });
+				// the shared copy is generated from the stylesheet of the element the duplicates were
+				// folded into, not from the text that was captured: that text still names the resources
+				// by their addresses in the original page, which resolve to nothing once the page is
+				// inside the archive
+				const { styleElement, content } = options.inlineStylesheets.get(stylesheetRefIndex);
+				const sharedEntry = entries.find(([key]) => key.element == styleElement);
+				const stylesheet = sharedEntry
+					? sharedEntry[1].stylesheet
+					: cssTree.parse(content, { context: "stylesheet", parseCustomProperty: true });
+				resources.stylesheets.set(resources.stylesheets.size, { name, content: this.generateStylesheetContent(stylesheet, options) });
 				linkElements.set(stylesheetRefIndex, linkElement);
 			});
 			for (const [key, stylesheetInfo] of entries) {
@@ -151,7 +156,7 @@ function getProcessorHelperClass(utilInstance) {
 			}
 		}
 
-		async resolveImportURLs(stylesheetInfo, baseURI, options, workStylesheet, resources, stylesheets) {
+		async resolveImportURLs(stylesheetInfo, baseURI, options, workStylesheet, resources, stylesheets, importedStyleSheets = new Set()) {
 			const stylesheet = stylesheetInfo.stylesheet;
 			const scoped = stylesheetInfo.scoped;
 			this.resolveStylesheetURLs(stylesheet, baseURI, workStylesheet);
@@ -168,7 +173,10 @@ function getProcessorHelperClass(utilInstance) {
 						} catch (error) {
 							// ignored
 						}
-						if (testValidURL(resourceURL)) {
+						// a sheet already open higher in this import chain must not be entered again: the
+						// ancestors are carried down the branch, not accumulated across the whole document,
+						// so two sibling imports of one sheet are still both resolved
+						if (testValidURL(resourceURL) && !importedStyleSheets.has(resourceURL)) {
 							const mediaQueryListNode = cssTree.find(node, node => node.type == "MediaQueryList");
 							let mediaText, layerName, supportsCondition;
 							if (mediaQueryListNode) {
@@ -198,12 +206,19 @@ function getProcessorHelperClass(utilInstance) {
 									layerName,
 									supportsCondition
 								};
+								const requestedURL = resourceURL;
 								const content = await this.getStylesheetContent(resourceURL, options);
 								stylesheetInfo.url = resourceURL = content.resourceURL;
 								content.data = getUpdatedResourceContent(resourceURL, options) || content.data;
 								stylesheetInfo.stylesheet = cssTree.parse(content.data, { context: "stylesheet", parseCustomProperty: true });
 								stylesheet = stylesheetInfo.stylesheet;
-								await this.resolveImportURLs(stylesheetInfo, resourceURL, options, workStylesheet, resources, stylesheets);
+								const ancestorStyleSheets = new Set(importedStyleSheets);
+								// both identities of the sheet are remembered: a redirect makes the URL that was
+								// requested and the URL that answered differ, and an import of either one is the
+								// same cycle
+								ancestorStyleSheets.add(requestedURL);
+								ancestorStyleSheets.add(resourceURL);
+								await this.resolveImportURLs(stylesheetInfo, resourceURL, options, workStylesheet, resources, stylesheets, ancestorStyleSheets);
 								stylesheets.set({ urlNode }, stylesheetInfo);
 							}
 							urlNode.importedChildren = stylesheet.children;
@@ -319,7 +334,7 @@ function getProcessorHelperClass(utilInstance) {
 					delete resourceElement.dataset.singleFileOriginURL;
 					if (!expectedType || !options["block" + expectedType.charAt(0).toUpperCase() + expectedType.substring(1) + "s"]) {
 						if (!testIgnoredPath(resourceURL)) {
-							setAttributeEmpty(resourceElement, attributeName, expectedType);
+							this.setAttributeEmpty(resourceElement, attributeName, expectedType);
 							if (testValidPath(resourceURL)) {
 								try {
 									resourceURL = util.resolveURL(resourceURL, baseURI);
@@ -373,18 +388,10 @@ function getProcessorHelperClass(utilInstance) {
 							}
 						}
 					} else {
-						setAttributeEmpty(resourceElement, attributeName, expectedType);
+						this.setAttributeEmpty(resourceElement, attributeName, expectedType);
 					}
 				}
 			}));
-
-			function setAttributeEmpty(resourceElement, attributeName, expectedType) {
-				if (expectedType == "video" || expectedType == "audio") {
-					resourceElement.removeAttribute(attributeName);
-				} else {
-					resourceElement.setAttribute(attributeName, util.EMPTY_RESOURCE);
-				}
-			}
 		}
 
 		async processImageSrcset(resourceURL, srcsetValue, resources, batchRequest) {

package/doc/singlefile-archive.md

@@ -198,12 +198,54 @@ Notes on composition:
 
 ### 2.1 The charset rule
 
-The HTML face declares `<meta charset=utf-8>` when universal mode is off, and a
-single-byte charset when it is on — `windows-1252` in the reference writer. The
-declaration MUST appear within the first 1024 bytes of the file so the parser's
-encoding prescan finds it. The prescan reads exactly that many bytes and does not
-resume, so the whole `<meta>` tag has to fit: one that straddles the boundary is not
-seen, and the parser falls back to its default encoding.
+The HTML face declares `<meta charset=utf-8>` when universal mode is off. When
+universal mode is on it declares a single-byte charset instead — `windows-1252` in the
+reference writer. The declaration MUST appear within the first 1024 bytes of the file
+so the parser's encoding prescan finds it. That bound is the HTML standard's own
+authoring rule. The prescan it serves is weaker than the rule suggests: the standard
+makes it optional, and only *encourages* scanning the first 1024 bytes. Treat the
+number as a ceiling to write under, never as a budget a parser promises to read. The
+whole `<meta>` tag has to fit: one that straddles the boundary is not seen, and the
+parser falls back to its default encoding. Meeting the declaration later, during
+tokenization, does not rescue the file. The parser does not resume the prescan. It
+re-navigates the document under the new encoding instead, and a writer must not rely
+on that.
+
+The declaration decides the decoding only when nothing outranks it. Three things do,
+each returning an encoding with the standard's *certain* confidence, all of them ahead
+of the prescan: a byte order mark, a user's explicit encoding override, and a charset
+stated by the transport layer, which over HTTP means a `Content-Type` header carrying
+its own `charset`. Any of the three replaces the declared charset, the parsed text is
+then not what the writer encoded, and the region cannot be recovered from it. This is
+the one precondition universal mode has that the file cannot satisfy from within
+itself.
+
+Where it bites is narrower than that makes it sound, because the parsed text is the
+last rung, not the first. The bootstrap reads the file's raw bytes whenever it can
+(§4.1), and raw bytes carry no encoding; universal extraction is the fallback for when
+they are out of reach. Taking the three in turn:
+
+- A **transport charset** exists only over HTTP, and over HTTP the raw read is what
+  runs — the bootstrap requests its own URL and takes the response as bytes, which no
+  `Content-Type` can reinterpret. It reaches universal extraction only in a double
+  failure: the response has to defeat the raw read, through a network or CORS failure
+  or a non-200 status, *and* state a charset of its own.
+- A **BOM** is the writer's own doing. It is why universal and PNG variants never carry
+  one (§3.1): the reference writer emits a BOM for the plain variant only
+  (`includeBOM`), where nothing depends on the declared charset.
+- A **user override** is the one no software can prevent, and the rarest.
+
+On `file:` URLs the bootstrap goes straight to page-text extraction, since no raw read
+is available there (§4.1) — but there is also no transport layer, so the first of the
+three cannot arise on the very path that depends on the charset most.
+
+The failure is safe rather than silent, which is why the precondition is worth stating
+at all. Decoded under the wrong charset the reconstructed bytes are wrong, the payload
+checksum does not match, and the extractor MUST fail to the error message (§4.5)
+instead of displaying a corrupt page. A reader MAY tell the case apart from ordinary
+corruption by comparing the encoding the document was actually decoded with —
+`document.characterSet` in a browser — against the declared one, and say so in the
+error message. Nothing requires it, and the MUST is unaffected either way.
 
 Universal mode works in two parts, and the charset carries the first. The archive
 bytes themselves are recovered *from the parsed page text*: the browser decoded
@@ -267,7 +309,7 @@ face adds, then the regions the PNG face adds.
 
 | Region | Producer | Present | Contents |
 |---|---|---|---|
-| `html-prologue` | HTML | HTML face | Doctype, the root element start tag, an optional implementation-defined comment, `<meta charset>`, title, optional head elements (canonical link, `robots` meta, viewport, Content-Security-Policy), minimal CSS, `<body hidden>`, wait/error messages, optional table of contents, optional text body (§4.6). In the plain variant an optional UTF-8 BOM MAY precede the doctype (`includeBOM`); universal and PNG variants never carry one. In the PNG variants the region is split: everything through `<body hidden>` is the data of the `tEXt "PNG"` chunk, while the messages, the optional table of contents and the optional text body follow the `tEXt "ZIP"` chunk header; the doctype and the leading comment are dropped. |
+| `html-prologue` | HTML | HTML face | Doctype, the root element start tag, an optional implementation-defined comment, `<meta charset>`, title, optional head elements (canonical link, `robots` meta, viewport, Content-Security-Policy), minimal CSS, `<body hidden>`, wait/error messages, optional table of contents, optional text body (§4.6). The leading comment, the title, the canonical link and the text body are withheld when a password is set (§5.6). In the plain variant an optional UTF-8 BOM MAY precede the doctype (`includeBOM`); universal and PNG variants never carry one. In the PNG variants the region is split: everything through `<body hidden>` is the data of the `tEXt "PNG"` chunk, while the messages, the optional table of contents and the optional text body follow the `tEXt "ZIP"` chunk header; the doctype and the leading comment are dropped. |
 | `bootstrap` | HTML | HTML face | One inline `<script>`: the embedded ZIP reader, the extractor, the display routine, and the content-acquisition logic (§4.1). The wrapper start tag that opens the ZIP region follows it, directly or after a relocated `extra-data`. |
 | `<!--` / `-->` | HTML | HTML face | The wrapper tag pair hiding a binary region from the HTML parser — comment tags by default, another pair when the hidden bytes contain `-->` (§5.1). Drawn at each opening and closing position. The close tag is absent when appended data is prevented (`preventAppendedData`, or the `<plaintext>` wrapper which cannot close): no markup follows the archive and the wrapper runs to end-of-file. That does not mean the file ends at the EOCD — the PNG face's tail still follows, inside the wrapper, where it parses as text (§5.1). |
 | `zip-entries` | ZIP | always | The archive's local file headers and entry data, written by the ZIP writer. The central directory of an archive written by the reference writer lists `index.html` (the page) first, then `manifest.json` (a JSON description of the archive: original URL, title, save time, resource-to-URL map — informative; the page displays without it), then the resources; the *physical* order of the local headers inside the region is not guaranteed to match, and readers MUST NOT rely on either order — entries are addressed by name (§7.1). |
@@ -307,7 +349,12 @@ change.
 The HTML parser consumes the whole file as one document. Its encoding prescan finds
 the `<meta charset>` declaration within the first 1024 bytes (§2.1) and the file is
 decoded as a single text; every binary region therefore also exists as characters in
-the parsed document, which is what universal mode exploits (§4.5).
+the parsed document, which is what universal mode exploits (§4.5). This holds only
+while the declaration is what decides the decoding: a BOM, a user override or a
+transport-layer charset outranks it, and universal extraction then fails its checksum
+rather than recovering anything (§2.1). The acquisition order below keeps that off the
+common path — the raw bytes are read in preference to the parsed text wherever they
+can be, and no encoding applies to them.
 
 The binary regions are kept out of the rendered page by the wrapper tags. The
 default wrapper is an HTML comment, and the HTML standard defines exactly which
@@ -494,8 +541,10 @@ decoded image is exactly that image.
 
 The last reader is the format's own: the extraction path of universal mode, used
 when the raw bytes are unreachable (§4.1). Its input is not the file but the *parsed
-document* — the characters the HTML parser produced — and its output is the exact
-ZIP region, byte for byte.
+document* — the characters the HTML parser produced — and its output is the ZIP
+region reconstructed byte for byte, with one deliberate exception: the two bytes of
+the EOCD comment-length field, which the payload does not describe and the extractor
+always writes as zero (step 2 below, and the row in §7.4).
 
 It works in three steps:
 
@@ -968,6 +1017,24 @@ The payload itself is a sequence of little-endian 32-bit words — checksum, rec
 range length, newline count, then the codes packed 16 per word, least-significant pair
 first — raw-deflated and base64-encoded with the standard alphabet and padding.
 
+Those word widths cap what the payload can describe. A writer MUST NOT use universal
+mode for a ZIP region of 2^32 bytes or more, since the length field cannot express it.
+The cap is not enforced by the wire format itself: a writer that ignores it stores the
+length modulo 2^32 and produces a file that looks well-formed, and the mismatch
+surfaces only when a reader verifies the field (§4.5). The reference writer is in that
+position — it assigns the length into a `Uint32Array`, where the truncation is silent
+— and reaches the cap in no saved page. This bound and zip64 (§5.7) are separate
+things: zip64 is reachable at any archive size through the 65535-entry trigger and
+stays compatible with universal mode, and it is only a region large enough to need
+zip64's 64-bit *offsets* that runs past what the payload can describe.
+
+An engine limit binds long before the format's. The extractor holds the region as one
+JavaScript string, and the maximum string length is engine-specific: V8 caps it at
+2^29 − 24 characters, 536870888, measured on V8 15.0.245. A universal-mode archive
+whose ZIP region approaches half a gigabyte is therefore already unreadable in Chrome,
+Edge and Node, whatever the payload declares. Other engines set the limit elsewhere.
+The practical ceiling on universal mode is this one, not the 4 GiB above.
+
 ### 5.6 Password scope
 
 A password encrypts the *contents* of ZIP entries with AES, and nothing else. A reader
@@ -982,15 +1049,18 @@ gets no protection beyond that. Four consequences follow:
 - **Entry metadata is never encrypted.** Names, uncompressed sizes and dates remain
   readable in the central directory, so the resource list of an encrypted archive is
   public. This is standard ZIP behavior, not a property of this format; §7 restates it.
-- **What the writer withholds instead.** Three things are not forced into the clear by
-  the format and so are withheld when a password is set: the entry comments, which
-  would otherwise publish every resource's source URL (§4.2); the `<title>` element's
-  text, whose value `manifest.json` carries as an encrypted entry, leaving an empty
-  `<title></title>` in the prologue; and the optional
-  text body, which repeats the whole page text outside the archive (§4.6). Unlike the
-  PNG and PDF faces, none of the three is load-bearing for a reader, so a writer that
-  emits them in a password-protected archive publishes what the password is meant to
-  cover for no gain.
+- **What the writer withholds instead.** Five things are not forced into the clear by
+  the format, and so are withheld when a password is set. Three of them state a URL:
+  the entry comments, which publish every resource's source URL (§4.2), and two
+  prologue fields carrying the address the page was saved from — the provenance
+  comment an implementation may write there, and the canonical `<link>` among the head
+  elements (§3.1). The other two are the `<title>` element's text, leaving an empty
+  `<title></title>` in the prologue, and the optional text body, which repeats the
+  whole page text outside the archive (§4.6). Nothing is lost by leaving any of them
+  out: `manifest.json` holds the page URL, the title and the resource-URL map, and it
+  is an encrypted entry like the rest. Unlike the PNG and PDF faces, none of the five
+  is load-bearing for a reader, so a writer that emits them in a password-protected
+  archive publishes what the password is meant to cover for no gain.
 
 Encrypted entries are stamped AE-2, so their CRC-32 field is zero (§5.4). `page.pdf`
 stays unencrypted, so in a password-protected archive its checksum is the only one a
@@ -1018,6 +1088,12 @@ first by both Info-ZIP and the reference reader, the central directory offset in
 zip64 record points at the injected record, and extraction produces the same page as
 the non-zip64 build.
 
+zip64 does not conflict with universal mode. Its commonest trigger, 65535 entries or
+more, is reached at any archive size, and §4.5 gives the offset arithmetic for a
+recovered region whose EOCD fields are sentinels. What universal mode cannot carry is
+a ZIP region of 2^32 bytes or more, which the recovery payload's 32-bit length field
+cannot express (§5.5) — a size bound, not a zip64 one.
+
 ## 6. Writer algorithm
 
 This section specifies the reference writer's build order. It is normative in the
@@ -1049,9 +1125,11 @@ pages can stop at the first row; the files it produces are accepted by every rea
 2. **HTML prologue.** With the HTML face, emit the doctype (omitted under the PNG
    face, which owns the start of the file), the root element start tag, any comment the
    implementation adds, the `<meta charset>` required by §2.1, the head elements (the
-   `<title>` among them, unless a password is set (§5.6)), the CSS and `<body hidden>`,
+   `<title>` and the canonical link among them), the CSS and `<body hidden>`,
    the wait and error messages, the optional table of contents and text body, and the
-   bootstrap script. With the PNG face the head of this region,
+   bootstrap script. With a password, five of those are left out: the comment, the
+   title, the canonical link, the text body and the entry comments of step 6 (§5.6).
+   With the PNG face the head of this region,
    through `<body hidden>`, is the data of the `tEXt "PNG"` chunk and the remainder is
    emitted after the `tEXt "ZIP"` chunk header in step 12; with the PDF face the
    region is interrupted by step 3 as well.
@@ -1259,10 +1337,13 @@ alongside it.
   Software that displays either MUST do so in a sandboxed context, and MUST NOT run
   the bootstrap in a privileged one. The format's own display path replaces the
   document with the extracted page, which is not an isolation boundary by itself.
-- **A password protects entry contents only** (§5.6). Entry names, sizes, dates and
-  source URLs stay readable, and the PNG, PDF and text-body faces render the page
-  regardless. Software MUST NOT present a password-protected archive as an encrypted
-  document.
+- **A password protects entry contents only** (§5.6). Entry names, sizes and dates
+  stay readable in the central directory, and a name commonly states the resource's
+  filename. The PNG and PDF faces render the page regardless. A conforming writer
+  withholds the five fields of §5.6, the source URLs among them, but a reader MUST NOT
+  read their absence as protection: nothing in the format stops a writer from emitting
+  any of them, so an archive of unknown provenance may state every URL in the clear.
+  Software MUST NOT present a password-protected archive as an encrypted document.
 - **Sniffing disagrees with itself on these files.** `file(1)` reports HTML, PNG, PDF
   or "data" depending on the variant (§8.1), so a server that guesses the media type
   from content may serve a saved page as an image. Software that serves SingleFile
@@ -1285,7 +1366,7 @@ only if it affects the bytes the page is built from:
 | A `tEXt` chunk CRC does not match, or a chunk holds bytes PNG does not permit (§4.4) | Irrelevant to extraction; a reader of the archive MAY ignore both |
 | `page.pdf` is present but its data does not begin with `%PDF-` | Not an error. The entry is data like any other |
 | `index.html` is present without `manifest.json` | **MUST** still extract (§7.1) |
-| More than one node carries the `sfz-data` identifier | **MUST NOT** extract either silently. A conforming writer emits one (§5.1), so a second is a payload that escaped its wrapper — most often a nested archive written by a writer that emitted a face bare. Both candidates extract cleanly and check out, and the checksums say nothing about which one the file was built around |
+| More than one candidate carries the `sfz-data` identifier once §4.5's tie-break has been applied | **MUST NOT** extract either silently. The tie-break comes first and settles the ordinary pairing: an id-bearing element that is one of §5.1's wrapper rungs wins over a comment, and one that is not a rung loses to it, since the `id` is then something else in the page. What this row forbids is what the tie-break does not reach — two elements, or two comments, or an element and a comment that both survive it. A conforming writer emits one candidate (§5.1), so a second is a payload that escaped its wrapper, most often a nested archive written by a writer that emitted a face bare. Both extract cleanly and check out, and the checksums say nothing about which one the file was built around |
 | The recovered region (universal mode) disagrees with the same bytes read directly, in the EOCD's two comment-length bytes only | Expected, not an error. A recovered region always declares a zero-length comment (§4.5), so it differs here from any archive written in the declared form (§4.2). Compare the two only up to those bytes |
 | The recovered region (universal mode) disagrees with the same bytes read directly, anywhere else | The file is not well-formed, whichever side is at fault, and a reader that has both MUST NOT silently merge them or pick per entry. Prefer the direct read — it is the writer's own output, where the recovered region is a reconstruction of it — and surface the disagreement rather than displaying either as intact |
 
@@ -1485,6 +1566,7 @@ predicts.
 | August 2026 | Core 1.5.110: a PDF or PNG face whose payload names every rung is dropped instead of written bare (§5.1). Found by nesting an archive inside itself as both faces: the fifth level exhausts the ladder, and readers then extracted the fourth level's archive — checksums intact, no way to tell (§7.4) |
 | August 2026 | Core 1.5.110: a PNG face leaving the comment rung on its checksum resumes the rung search instead of taking the next rung untested (§5.1). Taking it put a payload holding `</script>` on the script rung, where its own bytes closed the wrapper 93 bytes in and left the image data, the chunk framing and the whole ZIP region to the parser |
 | August 2026 | Core 1.5.110: `<svg><![CDATA[` joins the ladder above `<plaintext>` (§5.1) — the one rung whose terminator, `]]>`, real payloads rarely carry. It gives a payload naming every element rung somewhere to go that does not cost the appended-data placement, and moves the self-nesting limit from the fifth level to the sixth |
+| August 2026 | Core 1.5.115: password-protected archives withhold the provenance comment and the canonical link as well (§5.6). Both wrote the page's own URL into the prologue, beside the title that was already withheld, so the address the archive was saved from stayed in the clear |
 
 This document was itself revised in August 2026, against core 1.5.108, after several
 independent reviews. One of them was a reader built from this specification alone, with
@@ -1506,3 +1588,18 @@ document; the limits of the reconstructed-`page.pdf` CRC check (§4.5); the dura
 ranking of the faces (§1.1); what each face costs a writer (§6); and the silent loss of
 the other faces to a pipeline that repacks the file (§7.2). One review found a live
 defect rather than a documentation one, the non-monotone retry step recorded above.
+
+A later pass found four places where the document contradicted itself or the standard
+it cites: §7.3 stated that source URLs stay readable under a password while §5.6 said
+the writer withholds them, §4.5 called the recovered region exact while excluding two
+bytes from it, §7.4 rejected a duplicate identifier that §4.5 resolves by tie-break,
+and §2.1 described the HTML encoding prescan as mandatory and 1024 bytes wide when the
+standard makes it optional and only encourages that bound. None of the four changes
+what a writer emits or a reader accepts.
+
+The same pass added the two boundaries universal mode had left unstated: that it
+recovers the region only where the declared charset is what decided the decoding, a
+BOM, a user override and a transport-layer charset all outranking it — narrow in
+practice, since the raw read comes first and no encoding applies to it (§2.1) — and that
+the recovery payload's 32-bit length field caps the region below 2^32 bytes, with
+engine string limits binding well before that (§5.5).