single-file-core 1.5.115 → 1.5.117

package/test/sfz-harness/css-property-filter.js

@@ -0,0 +1,85 @@
+// The CSS-removal option runs every declaration through css-tree's lexer and drops the ones it
+// judges invalid. css-tree reports two different failures the same way — a real value mismatch
+// (SyntaxMatchError) and a property it simply has no entry for (SyntaxReferenceError) — so the
+// original `!matchProperty(...).matched` deleted valid declarations whose property is missing from
+// the vendored dictionary. That silently flattened every CSS-defined SVG gradient: stop-opacity was
+// dropped, both stops became opaque, and the gradient rendered as a solid block. It hid for a long
+// time because stop-color survived alongside it — a var() value takes a different branch and is
+// never handed to the lexer at all, so the colour was right and only the fade was gone.
+//
+// The rule this pins: unknown must fail open. A dropped valid declaration breaks rendering; a kept
+// invalid one is ignored by the browser.
+import * as cssTree from "../../vendor/css-tree.js";
+import { isUnsupportedPropertyValue } from "../../modules/css-rules-minifier.js";
+
+// valid declarations whose property the vendored css-tree does not know. Every one of these was
+// deleted before the fix. The SVG paint-server and filter properties are the ones that matter in
+// practice; the last two are here as the moving target — any property newer than the vendored
+// dictionary lands in this bucket, and the list will keep growing
+const MUST_KEEP = [
+	["stop-color", "#2a78d6"],
+	["stop-opacity", ".20"],
+	["stop-opacity", "0"],
+	["flood-color", "red"],
+	["flood-opacity", "0.5"],
+	["lighting-color", "white"],
+	["text-box-trim", "trim-both"],
+	["corner-shape", "squircle"]
+];
+
+// declarations css-tree knows and correctly rejects. These keep the filter honest: the fix must not
+// turn the check off, only stop it firing on properties css-tree has never heard of
+const MUST_DROP = [
+	["margin-trim", "block"],
+	["opacity", "not-a-number"],
+	["color", "12px"]
+];
+
+// properties close enough to the broken ones to be worth stating outright, because they are the
+// reason the bug looked like an SVG quirk rather than a dictionary gap: css-tree does know these,
+// so gradients that used them were unaffected and the failure looked arbitrary
+const KNOWN_GOOD = [
+	["fill-opacity", "0.5"],
+	["stroke-opacity", "0.5"],
+	["fill", "red"],
+	["vector-effect", "non-scaling-stroke"]
+];
+
+let failed = false;
+
+function check(label, actual, expected) {
+	const ok = actual === expected;
+	console.log(`${ok ? "PASS" : "FAIL"} ${label}: ${actual}${ok ? "" : " (expected " + expected + ")"}`);
+	failed ||= !ok;
+}
+
+function isDropped(property, declaration) {
+	return isUnsupportedPropertyValue(property, cssTree.parse(declaration, { context: "value" }));
+}
+
+for (const [property, declaration] of MUST_KEEP) {
+	check(`kept: ${property}: ${declaration}`, isDropped(property, declaration), false);
+}
+
+for (const [property, declaration] of MUST_DROP) {
+	check(`dropped: ${property}: ${declaration}`, isDropped(property, declaration), true);
+}
+
+for (const [property, declaration] of KNOWN_GOOD) {
+	check(`kept: ${property}: ${declaration}`, isDropped(property, declaration), false);
+}
+
+// the distinction the fix rests on. If a css-tree upgrade ever collapses these two error types into
+// one, the predicate above cannot tell "unknown" from "wrong" any more and needs rewriting rather
+// than adjusting
+const unknownProperty = cssTree.lexer.matchProperty("stop-opacity", cssTree.parse("0", { context: "value" }));
+const wrongValue = cssTree.lexer.matchProperty("margin-trim", cssTree.parse("block", { context: "value" }));
+check("unknown property reports SyntaxReferenceError", unknownProperty.error && unknownProperty.error.name, "SyntaxReferenceError");
+check("wrong value reports SyntaxMatchError", wrongValue.error && wrongValue.error.name, "SyntaxMatchError");
+
+if (failed) {
+	console.log("FAILED");
+	Deno.exit(1);
+} else {
+	console.log("PASSED");
+}

package/test/sfz-harness/format-rules.js

@@ -2,7 +2,9 @@ import "./dom-stub.js";
 import { makePageData, makeOptions, runProcess, mulberry32 } from "./common.js";
 import { ZipReader, BlobReader } from "../../vendor/zip/zip.js";
 
-const TITLE = "日本語 — café & <b>";
+// the quote is there because the escaper the title shares with the table of contents encodes
+// it for an attribute value, where it matters, and a title has to round-trip through that too
+const TITLE = "日本語 — café & <b> \"quoted\"";
 const PDF = new TextEncoder().encode("%PDF-1.4\n1 0 obj\n<<>>\nendobj\ntrailer\n<<>>\n%%EOF\n");
 
 let failed = false;
@@ -207,6 +209,34 @@ function countIdentifiers(text) {
 	check("the cdata rung leaves the appended data placement alone", options.preventAppendedData !== true, true);
 }
 
+// the rung a caller names is resolved by its start tag, not by the identity of the array holding
+// it. The option is internal and is normally set from the module's own EXTRA_DATA_TAGS, so an
+// identity match worked by accident; a caller passing an equal pair of its own indexed the regexp
+// table with -1 and threw a bare TypeError out of library internals
+{
+	const options = makeOptions({ extractDataFromPageTags: ["<noframes>", "</noframes>"] });
+	const pageData = makePageData(31, 4 * 1024);
+	let error;
+	try {
+		await runProcess(pageData, options);
+	} catch (caught) {
+		error = caught;
+	}
+	check("a rung named by an equal pair is resolved", error, undefined);
+}
+
+{
+	const options = makeOptions({ extractDataFromPageTags: ["<marquee>", "</marquee>"] });
+	const pageData = makePageData(32, 4 * 1024);
+	let message;
+	try {
+		await runProcess(pageData, options);
+	} catch (error) {
+		message = error.message;
+	}
+	check("a rung that is not in the ladder names itself", message, "Unknown data tags: <marquee>");
+}
+
 // the terminator is the whole test for this rung, so a payload holding it must step past
 {
 	const content = new Uint8Array(4096).fill(0x21);

package/test/sfz-harness/inlined-functions.js

@@ -0,0 +1,82 @@
+/*
+ * Copyright 2010-2026 Gildas Lormeau
+ * contact : gildas.lormeau <at> gmail.com
+ *
+ * This file is part of SingleFile.
+ *
+ *   The code in this file is free software: you can redistribute it and/or
+ *   modify it under the terms of the GNU Affero General Public License
+ *   (GNU AGPL) as published by the Free Software Foundation, either version 3
+ *   of the License, or (at your option) any later version.
+ *
+ *   The code in this file is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero
+ *   General Public License for more details.
+ *
+ *   As additional permission under GNU AGPL version 3 section 7, you may
+ *   distribute UNMODIFIED VERSIONS OF THIS file without the copy of the GNU
+ *   AGPL normally required by section 4, provided you include this license
+ *   notice and a URL through which recipients can access the Corresponding
+ *   Source.
+ */
+
+// `createArchive` builds the script of a self-extracting archive by serializing functions with
+// toString() and pasting the text into the generated page. That page has no module scope, so
+// anything such a function names has to be declared inside it. An import is the trap: it survives
+// bundling, the call still reads correctly in the source, and the archive then fails at runtime
+// with a bare ReferenceError while the page stays blank.
+//
+// It is worse than it looks, because a minifier can hide it. `display` called an imported
+// `getDoctypeString`, and terser inlined that helper into the release bundle, so released
+// archives worked while every unminified build produced archives that threw
+// `ReferenceError: getDoctypeString is not defined` and rendered nothing.
+//
+// The invariant below is what makes that impossible to reintroduce: a module holding an inlined
+// function declares that function and nothing else, so there is no module scope to close over.
+
+const MODULES = [
+	{ path: "../../processors/compression/compression-display.js", functions: ["display"] },
+	{ path: "../../processors/compression/compression-extract.js", functions: ["extract"] },
+	{ path: "../../processors/compression/compression-router.js", functions: ["router"] }
+];
+const TOP_LEVEL_DECLARATION = /^(?:export\s+)?(?:async\s+)?(?:function|const|let|var|class)\s+([A-Za-z_$][\w$]*)/;
+
+let failures = 0;
+
+for (const { path, functions } of MODULES) {
+	const source = await Deno.readTextFile(new URL(path, import.meta.url));
+	const name = path.split("/").pop();
+	const lines = source.split("\n");
+	const imports = lines.filter(line => /^import[\s{]/.test(line) || /^\s*import\s*\(/.test(line));
+	check(name + " imports nothing", imports.length === 0, imports.join(" | "));
+	const declared = [];
+	lines.forEach(line => {
+		if (line === line.trimStart()) {
+			const match = line.match(TOP_LEVEL_DECLARATION);
+			if (match) {
+				declared.push(match[1]);
+			}
+		}
+	});
+	const unexpected = declared.filter(identifier => !functions.includes(identifier));
+	check(name + " declares nothing at module scope but " + functions.join(", "),
+		unexpected.length === 0, unexpected.join(", "));
+}
+
+// the one inlined function that does live beside module scope, in compression.js, states the rule
+// in a comment and binds every global it uses itself; assert that binding is still there
+const compression = await Deno.readTextFile(new URL("../../processors/compression/compression.js", import.meta.url));
+const getContentBody = compression.slice(compression.indexOf("async function getContent()"));
+check("getContent binds its globals locally",
+	/const \{[^}]*\} = globalThis;/.test(getContentBody.slice(0, 2000)));
+
+console.log(failures ? `\n${failures} check(s) FAILED` : "\nall checks passed");
+Deno.exit(failures ? 1 : 0);
+
+function check(label, condition, detail) {
+	if (!condition) {
+		failures++;
+	}
+	console.log((condition ? "PASS" : "FAIL") + " " + label + (condition || !detail ? "" : ": " + detail));
+}