single-file-core 1.5.129 → 1.5.130

package/core/index.js

@@ -31,6 +31,7 @@ const DEBUG = false;
 const Set = globalThis.Set;
 const Map = globalThis.Map;
 const JSON = globalThis.JSON;
+const URL = globalThis.URL;
 
 let util;
 
@@ -160,7 +161,7 @@ const STAGES = [{
 		{ action: "cleanupPage" }
 	],
 	parallel: [
-		{ option: "enableMaff", action: "insertMAFFMetaData" },
+		{ option: "readMaffMetadata", action: "readMAFFMetaData" },
 		{ action: "setDocInfo" }
 	]
 }, {
@@ -421,6 +422,9 @@ const SHADOWROOT_DELEGATES_FOCUS = "shadowrootdelegatesfocus";
 const SHADOWROOT_CLONABLE = "shadowrootclonable";
 const SHADOWROOT_SERIALIZABLE = "shadowrootserializable";
 const SCRIPT_OPTIONS = "data-single-file-options";
+const JAVASCRIPT_URI_PROTOCOL = "javascript:";
+const DISABLED_SCRIPT_URI = "javascript:void(0)";
+const SCRIPT_URI_ATTRIBUTE_NAMES = ["href", "src", "action", "formaction", "data"];
 const UTF8_CHARSET = "utf-8";
 const TAINTED_CANVAS_WARNING_MESSAGE = "SingleFile: canvas elements tainted by a cross-origin resource, dropped from the page:";
 
@@ -448,7 +452,7 @@ class Processor {
 	initialize() {
 		this.options.saveDate = new Date();
 		this.options.saveUrl = this.options.url;
-		if (this.options.enableMaff) {
+		if (this.options.readMaffMetadata) {
 			this.maffMetaDataPromise = this.batchRequest.addURL(util.resolveURL("index.rdf", this.options.baseURI || this.options.url), { expectedType: "document" });
 		}
 		this.maxResources = this.batchRequest.getMaxResources();
@@ -497,7 +501,7 @@ class Processor {
 		}
 		this.workStyleElement = this.doc.createElement("style");
 		this.doc.body.appendChild(this.workStyleElement);
-		this.onEventAttributeNames = getOnEventAttributeNames(this.doc);
+		this.onEventAttributeNames = new Set(getOnEventAttributeNames(this.doc));
 	}
 
 	finalize() {
@@ -676,7 +680,7 @@ class Processor {
 			optionsElement.type = "application/json";
 			optionsElement.setAttribute(SCRIPT_OPTIONS, "");
 			optionsElement.textContent = JSON.stringify({
-				saveUrl: this.options.url,
+				saveUrl: this.options.saveUrl,
 				saveDate: this.options.saveDate.getTime(),
 				visitDate: (this.options.visitDate || this.options.saveDate).getTime(),
 				filenameTemplate: this.options.filenameTemplate,
@@ -852,18 +856,16 @@ class Processor {
 	}
 
 	removeEmbedScripts() {
-		const JAVASCRIPT_URI_PREFIX = "javascript:";
-		const DISABLED_SCRIPT = "javascript:void(0)";
-		this.onEventAttributeNames.forEach(attributeName => this.doc.querySelectorAll("[" + attributeName + "]").forEach(element => element.removeAttribute(attributeName)));
-		this.doc.querySelectorAll("[href]").forEach(element => {
-			if (element.href && element.href.match && element.href.trim().startsWith(JAVASCRIPT_URI_PREFIX)) {
-				element.setAttribute("href", DISABLED_SCRIPT);
-			}
-		});
-		this.doc.querySelectorAll("[src]").forEach(element => {
-			if (element.src && element.src.trim().startsWith(JAVASCRIPT_URI_PREFIX)) {
-				element.setAttribute("src", DISABLED_SCRIPT);
-			}
+		this.doc.querySelectorAll("*").forEach(element => {
+			Array.from(element.attributes).forEach(attribute => {
+				const localName = attribute.localName || attribute.name;
+				const attributeName = localName.toLowerCase();
+				if (this.onEventAttributeNames.has(attributeName)) {
+					element.removeAttributeNS(attribute.namespaceURI, localName);
+				} else if (SCRIPT_URI_ATTRIBUTE_NAMES.includes(attributeName) && isScriptURI(attribute.value)) {
+					element.setAttributeNS(attribute.namespaceURI, attribute.name, DISABLED_SCRIPT_URI);
+				}
+			});
 		});
 		const scriptElements = this.doc.querySelectorAll("script:not([type=\"application/ld+json\"]):not([" + SCRIPT_OPTIONS + "])");
 		this.stats.set("discarded", "scripts", scriptElements.length);
@@ -1647,7 +1649,7 @@ class Processor {
 		this.doc.documentElement.style.removeProperty("-sf-min-height");
 	}
 
-	async insertMAFFMetaData() {
+	async readMAFFMetaData() {
 		const maffMetaData = await this.maffMetaDataPromise;
 		if (maffMetaData && maffMetaData.content) {
 			const NAMESPACE_RDF = "http://www.w3.org/1999/02/22-rdf-syntax-ns#";
@@ -1655,7 +1657,10 @@ class Processor {
 			const originalURLElement = maffDoc.querySelector("RDF > Description > originalurl");
 			const archiveTimeElement = maffDoc.querySelector("RDF > Description > archivetime");
 			if (originalURLElement) {
-				this.options.saveUrl = originalURLElement.getAttributeNS(NAMESPACE_RDF, "resource");
+				const value = originalURLElement.getAttributeNS(NAMESPACE_RDF, "resource");
+				if (value) {
+					this.options.saveUrl = value;
+				}
 			}
 			if (archiveTimeElement) {
 				const value = archiveTimeElement.getAttributeNS(NAMESPACE_RDF, "resource");
@@ -1709,6 +1714,14 @@ function normalizeURL(url) {
 	}
 }
 
+function isScriptURI(value) {
+	try {
+		return new URL(value).protocol == JAVASCRIPT_URI_PROTOCOL;
+	} catch {
+		return false;
+	}
+}
+
 function getOnEventAttributeNames(doc) {
 	const element = doc.body || doc.createElement("div");
 	const attributeNames = [];

package/core/infobar.js

@@ -141,28 +141,28 @@ const INFOBAR_STYLES = `
 
 @keyframes flash {
   0%, 100% {
-	background-color: #737373;
+    background-color: #737373;
   }
   50% {
-	background-color: #dd6a00;
+    background-color: #dd6a00;
   }
 }
 
 @keyframes ripple {
   0% {
-	transform: scale(1);
-	opacity: 1;
+    transform: scale(1);
+    opacity: 1;
   }
   45%, 100% {
-	transform: scale(2);
-	opacity: 0;
+    transform: scale(2);
+    opacity: 0;
   }
 }
 
 @media (prefers-reduced-motion: reduce) {
   .infobar,
   .infobar:not(:focus-within):not(.infobar-focus)::after {
-	animation-name: none;
+    animation-name: none;
   }
 }
 

package/core/lib/processor-helper-inline.js

@@ -562,7 +562,7 @@ function getProcessorHelperClass(utilInstance) {
 		}
 
 		setMetaCSP(metaElement) {
-			metaElement.content = "default-src 'none'; font-src 'self' data:; img-src 'self' data:; style-src 'unsafe-inline'; media-src 'self' data:; script-src 'unsafe-inline' data:; object-src 'self' data:; frame-src 'self' data:;";
+			metaElement.content = "default-src 'none'; font-src 'self' data:; img-src 'self' data:; style-src 'unsafe-inline'; media-src 'self' data:; script-src 'unsafe-inline' data:; object-src 'self' data:; frame-src 'self' data:; form-action 'none'; base-uri 'none';";
 		}
 
 		removeUnusedStylesheets(doc) {

package/core/lib/processor-helper.js

@@ -488,7 +488,7 @@ function getProcessorHelperClass(utilInstance) {
 		}
 
 		setMetaCSP(metaElement) {
-			metaElement.content = "default-src 'none'; connect-src 'self' data: blob:; font-src 'self' data: blob:; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline' data: blob:; frame-src 'self' data: blob:; media-src 'self' data: blob:; script-src 'self' 'unsafe-inline' data: blob:; object-src 'self' data: blob:;";
+			metaElement.content = "default-src 'none'; connect-src 'self' data: blob:; font-src 'self' data: blob:; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline' data: blob:; frame-src 'self' data: blob:; media-src 'self' data: blob:; script-src 'self' 'unsafe-inline' data: blob:; object-src 'self' data: blob:; form-action 'none'; base-uri 'none';";
 		}
 
 		removeUnusedStylesheets() {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "single-file-core",
-	"version": "1.5.129",
+	"version": "1.5.130",
 	"description": "SingleFile Core",
 	"author": "Gildas Lormeau",
 	"license": "AGPL-3.0-or-later",

package/processors/compression/compression.js

@@ -132,7 +132,8 @@ export {
 	process,
 	createArchive,
 	escapeHTML,
-	PROCESS_OPTION_NAMES
+	PROCESS_OPTION_NAMES,
+	DEFAULT_MAX_APPENDED_DATA_LENGTH
 };
 
 async function process(pageData, options, lastModDate = new Date()) {

package/single-file.js

@@ -91,7 +91,7 @@ async function getPageData(options = {}, initOptions, doc, win) {
 	}
 	options.doc = doc;
 	options.win = win;
-	options.insertCanonicalLink = true;
+	options.insertCanonicalLink = options.insertCanonicalLink === undefined ? true : options.insertCanonicalLink;
 
 	const externalOnProgress = options.onprogress;
 	options.onprogress = async event => {

package/test/capture/canonical-link.js

@@ -0,0 +1,50 @@
+import { capture, html } from "./common.js";
+
+const PAGE_URL = "https://example.com/page.html";
+const FILE_URL = "file:///tmp/page.html";
+const PAGE = html("<h1>page</h1>");
+
+const resources = {
+	[PAGE_URL]: { body: PAGE },
+	[FILE_URL]: { body: PAGE }
+};
+
+let failed = false;
+
+// insertCanonicalLink was forced to true in single-file.js after the options were merged, so it read
+// as an option in three places and could be set from none: the CLI flag was written, measured doing
+// nothing, and removed again rather than shipped. It now defaults to true instead of being forced,
+// which is what makes the flag and the extension config key mean anything.
+{
+	const content = await capture(resources, { url: PAGE_URL, content: PAGE });
+	check("a canonical link is inserted by default", content.includes("rel=\"canonical\""), true);
+}
+
+{
+	const content = await capture(resources, { url: PAGE_URL, content: PAGE, insertCanonicalLink: false });
+	check("insertCanonicalLink false suppresses it", content.includes("rel=\"canonical\""), false);
+}
+
+{
+	const content = await capture(resources, { url: PAGE_URL, content: PAGE, insertCanonicalLink: true });
+	check("insertCanonicalLink true keeps it", content.includes("rel=\"canonical\""), true);
+}
+
+// The href guard is the reason the option is safe to default on: a page saved from disk has no
+// canonical URL to point at, and the element is skipped rather than written with a file: href.
+{
+	const content = await capture(resources, { url: FILE_URL, content: PAGE });
+	check("a page saved from file: gets no canonical link", content.includes("rel=\"canonical\""), false);
+}
+
+if (failed) {
+	console.log("FAILED");
+	Deno.exit(1);
+}
+console.log("OK");
+
+function check(label, actual, expected) {
+	const ok = actual === expected;
+	console.log(`${ok ? "PASS" : "FAIL"} ${label}: ${actual}${ok ? "" : " (expected " + expected + ")"}`);
+	failed ||= !ok;
+}

package/test/capture/dom.js

@@ -3,7 +3,7 @@
 // reads globalThis.window, then calls init() and new MutationObserver(init) at module scope. That
 // hook belongs to the page world and does nothing useful here; it only has to load without throwing.
 // Import this module first and import single-file.js dynamically, the way common.js does.
-import { DOMParser, Document } from "jsr:@b-fuze/deno-dom@0.1.56";
+import { DOMParser, Document, Element } from "jsr:@b-fuze/deno-dom@0.1.56";
 
 globalThis.DOMParser = DOMParser;
 globalThis.Document = Document;
@@ -12,3 +12,15 @@ globalThis.MutationObserver = class {
 	observe() { }
 	disconnect() { }
 };
+
+// deno-dom implements neither of these, so removeEmbedScripts throws here and nowhere else. Mapping
+// them onto the qualified-name methods is faithful for what deno-dom can represent, which is only
+// null-namespace attributes: it drops the prefix of xlink:href and lowercases nothing, so the
+// namespaced and mixed-case cases cannot be written as a fixture at all. Those are covered by the
+// browser suite in single-file-cli, which drives a real DOM.
+Element.prototype.setAttributeNS = function (namespaceURI, qualifiedName, value) {
+	this.setAttribute(qualifiedName, value);
+};
+Element.prototype.removeAttributeNS = function (namespaceURI, localName) {
+	this.removeAttribute(localName);
+};

package/test/capture/maff-metadata.js

@@ -0,0 +1,205 @@
+import "./dom.js";
+
+// core/util.js captures globalThis.DOMParser when it loads, and deno-dom throws on "text/xml", so
+// the MAFF metadata could not be parsed here at all. This substitutes a stub for that one mime type,
+// installed before common.js imports core, the same ordering constraint dom.js itself documents.
+//
+// What the stub stands for and what it does not. The two defects fixed alongside this suite are both
+// about what core does with what the parser HANDS BACK — an attribute that came back null, and which
+// of two almost-identical option fields gets written out — so a stub returning null or a string
+// covers them faithfully. It does NOT cover the parse: that `RDF > Description > originalurl` matches
+// `<RDF:RDF><RDF:Description><MAF:originalurl>` by local name, and that getAttributeNS resolves the
+// RDF prefix, are properties of a real XML DOM that only a browser suite can confirm.
+const XML_DOCUMENTS = new Map();
+const NativeDOMParser = globalThis.DOMParser;
+
+class StubXMLDocument {
+	constructor(values) {
+		this.values = values;
+	}
+	// undefined means the element is absent, null means it is present with no RDF:resource attribute
+	querySelector(selector) {
+		const localName = selector.split(">").pop().trim();
+		const value = this.values[localName];
+		return value === undefined ? null : { getAttributeNS: () => value };
+	}
+}
+
+globalThis.DOMParser = class {
+	parseFromString(content, mimeType) {
+		if (mimeType == "text/xml") {
+			return new StubXMLDocument(XML_DOCUMENTS.get(content) || {});
+		}
+		return new NativeDOMParser().parseFromString(content, mimeType);
+	}
+};
+
+const { capture, frameData, html, WIN_ID_ATTRIBUTE_NAME } = await import("./common.js");
+
+const PAGE_URL = "https://example.com/page.html";
+const RDF_URL = "https://example.com/index.rdf";
+const FRAME_URL = "https://example.com/frame-dir/frame.html";
+const FRAME_RDF_URL = "https://example.com/frame-dir/index.rdf";
+const ORIGINAL_URL = "https://original.example/real.html";
+const ARCHIVE_TIME = "Mon, 01 Jan 2024 10:20:30 GMT";
+const ARCHIVE_TIME_MS = new Date(ARCHIVE_TIME).getTime();
+const COMPLETE = { originalurl: ORIGINAL_URL, archivetime: ARCHIVE_TIME };
+const PAGE = html("<h1>page</h1>");
+const FRAME_PAGE = html("<h1>frame</h1>");
+const HOST_PAGE = html("<h1>host</h1><iframe src=\"" + FRAME_URL + "\" " + WIN_ID_ATTRIBUTE_NAME + "=\"0.1\"></iframe>");
+
+// The canonical link would be the obvious place to read the recovered url, but deno-dom reflects
+// neither the href nor the type property, so core's `element.href = ...` leaves no attribute behind.
+// Two observables survive that: the SingleFile comment, which core builds from options.saveUrl, and
+// the embedded options block, which is where the second defect lives.
+const OPTIONS_BLOCK = /<script data-single-file-options[^>]*>([^<]*)<\/script>/;
+
+let fixtureIndex = 0;
+
+function rdf(values) {
+	const content = "<?xml version=\"1.0\"?><!-- fixture " + (fixtureIndex++) + " -->";
+	XML_DOCUMENTS.set(content, values);
+	return content;
+}
+
+class CountingResources extends Map {
+	constructor(entries) {
+		super(entries);
+		this.counts = new Map();
+	}
+	get(key) {
+		this.counts.set(key, (this.counts.get(key) || 0) + 1);
+		return super.get(key);
+	}
+	countOf(key) {
+		return this.counts.get(key) || 0;
+	}
+}
+
+function resources(rdfContent) {
+	const entries = [
+		[PAGE_URL, { body: PAGE }],
+		[FRAME_URL, { body: FRAME_PAGE }]
+	];
+	if (rdfContent !== undefined) {
+		entries.push([RDF_URL, { body: rdfContent, contentType: "text/xml" }]);
+	}
+	return new CountingResources(entries);
+}
+
+function commentURL(content) {
+	const match = content.match(/ url: ([^\n]*)/);
+	return match && match[1].trim();
+}
+
+function embeddedOptions(content) {
+	const match = content.match(OPTIONS_BLOCK);
+	return match && JSON.parse(match[1]);
+}
+
+let failed = false;
+
+// readMaffMetadata is the new name of enableMaff, which was implemented in core and set by nothing:
+// no CLI flag, no config key, no UI anywhere. That is what made renaming it free, and exposing it is
+// what made the two defects below reachable by a user.
+{
+	const map = resources(rdf(COMPLETE));
+	const content = await capture(map, { url: PAGE_URL, content: PAGE, insertSingleFileComment: true });
+	check("index.rdf is not requested when the option is off", map.countOf(RDF_URL), 0);
+	check("the page url is saved when the option is off", commentURL(content), PAGE_URL);
+}
+
+{
+	const map = resources(rdf(COMPLETE));
+	const content = await capture(map, { url: PAGE_URL, content: PAGE, readMaffMetadata: true, insertSingleFileComment: true });
+	check("index.rdf is requested when the option is on", map.countOf(RDF_URL), 1);
+	check("the original url is recovered", commentURL(content), ORIGINAL_URL);
+}
+
+// THE CRASH. An originalurl with no RDF:resource made getAttributeNS return null, saveUrl became
+// null, and the canonical link then called .match() on it and failed the whole capture with a
+// TypeError. The archivetime branch beside it had always guarded its own value, so the two halves of
+// one method disagreed with each other.
+{
+	let threw = false;
+	let content = "";
+	try {
+		content = await capture(resources(rdf({ originalurl: null, archivetime: ARCHIVE_TIME })), {
+			url: PAGE_URL,
+			content: PAGE,
+			readMaffMetadata: true,
+			insertSingleFileComment: true
+		});
+	} catch {
+		threw = true;
+	}
+	check("an originalurl with no resource attribute does not fail the capture", threw, false);
+	check("and the page url is kept", commentURL(content), PAGE_URL);
+}
+
+{
+	const content = await capture(resources(rdf({ originalurl: ORIGINAL_URL, archivetime: null })), {
+		url: PAGE_URL,
+		content: PAGE,
+		readMaffMetadata: true,
+		insertSingleFileComment: true
+	});
+	check("an archivetime with no resource attribute is tolerated", commentURL(content), ORIGINAL_URL);
+}
+
+{
+	const content = await capture(resources(), { url: PAGE_URL, content: PAGE, readMaffMetadata: true, insertSingleFileComment: true });
+	check("a missing index.rdf leaves the page url in place", commentURL(content), PAGE_URL);
+}
+
+// THE INCONSISTENCY. saveFilenameTemplateData wrote saveUrl from options.url, one line above writing
+// saveDate from the value MAFF had just recovered, so the embedded block paired the archive's date
+// with the extracted copy's path, and a recompute in the editor resolved {url-*} against the wrong
+// one. options.saveUrl and options.url are identical on every other code path, which is what let it
+// sit unnoticed.
+{
+	const content = await capture(resources(rdf(COMPLETE)), {
+		url: PAGE_URL,
+		content: PAGE,
+		readMaffMetadata: true,
+		saveFilenameTemplateData: true
+	});
+	const embedded = embeddedOptions(content);
+	check("the embedded options block exists", Boolean(embedded), true);
+	if (embedded) {
+		check("the embedded saveUrl is the recovered one", embedded.saveUrl, ORIGINAL_URL);
+		check("the embedded saveDate is the recovered one", embedded.saveDate, ARCHIVE_TIME_MS);
+	}
+}
+
+{
+	const content = await capture(resources(rdf(COMPLETE)), { url: PAGE_URL, content: PAGE, saveFilenameTemplateData: true });
+	const embedded = embeddedOptions(content);
+	check("the embedded saveUrl is the page url when the option is off", embedded && embedded.saveUrl, PAGE_URL);
+}
+
+// Only the root document reaches Processor.initialize, because Runner.run guards that call with
+// `if (this.root)`. That guard is the whole reason a page with twenty frames does not make twenty
+// pointless index.rdf requests, and nothing else pins it. Note initializeProcessor resets a list of
+// root-only options for frames and readMaffMetadata is deliberately NOT in it: next to this guard
+// such a reset is dead code, which is exactly what adding one and watching nothing change proved.
+{
+	const map = resources(rdf(COMPLETE));
+	const frames = [frameData("0.1", FRAME_URL, FRAME_PAGE)];
+	const content = await capture(map, { url: PAGE_URL, content: HOST_PAGE, frames, readMaffMetadata: true });
+	check("the root asks for its index.rdf", map.countOf(RDF_URL), 1);
+	check("a frame does not ask for one of its own", map.countOf(FRAME_RDF_URL), 0);
+	check("the frame is still captured", content.includes("frame"), true);
+}
+
+if (failed) {
+	console.log("FAILED");
+	Deno.exit(1);
+}
+console.log("OK");
+
+function check(label, actual, expected) {
+	const ok = actual === expected;
+	console.log(`${ok ? "PASS" : "FAIL"} ${label}: ${actual}${ok ? "" : " (expected " + expected + ")"}`);
+	failed ||= !ok;
+}

package/test/capture/script-uri-sanitization.js

@@ -0,0 +1,82 @@
+import { capture, html } from "./common.js";
+
+const PAGE_URL = "https://example.com/page.html";
+
+// blockScripts is what removeEmbedScripts is wired to, and it is the option every save turns on to
+// promise that the saved page holds no script. These fixtures are the ways a javascript: URL used to
+// survive that promise.
+const BLOCK = { blockScripts: true };
+
+// The sanitizer used to read the resolved IDL property, element.href and element.src, and rewrite the
+// attribute only when the property was a string starting with "javascript:". That missed every SVG
+// link, because SVGAElement.href is an SVGAnimatedString and the guard skipped it, and it never
+// looked at form submission targets at all. Each of these executed on one click in a saved page.
+const VECTORS = [
+	["svg link", "<svg xmlns=\"http://www.w3.org/2000/svg\"><a id=\"target\" href=\"javascript:alert(1)\"><rect/></a></svg>"],
+	["form action", "<form action=\"javascript:alert(1)\"><input type=\"submit\"></form>"],
+	["button formaction", "<form><button formaction=\"javascript:alert(1)\">go</button></form>"],
+	["image input formaction", "<form><input type=\"image\" formaction=\"javascript:alert(1)\"></form>"],
+	["object data", "<object data=\"javascript:alert(1)\"></object>"],
+	["anchor href", "<a href=\"javascript:alert(1)\">go</a>"],
+	["iframe src", "<iframe src=\"javascript:alert(1)\"></iframe>"]
+];
+
+let failed = false;
+
+for (const [label, body] of VECTORS) {
+	const content = await capture({}, { url: PAGE_URL, content: html(body), ...BLOCK });
+	check(`${label} is neutralized`, content.includes("javascript:alert"), false);
+}
+
+// The URL parser decides what a javascript: URL is, so the obfuscations it folds away have to be
+// folded away here too: leading whitespace is stripped, a tab inside the scheme is removed, and the
+// scheme is compared case-insensitively.
+const OBFUSCATIONS = [
+	["leading whitespace and mixed case", "  \tJaVaScRiPt:alert(1)"],
+	["tab inside the scheme", "ja&#9;vascript:alert(1)"],
+	["newline before the scheme", "&#10;javascript:alert(1)"],
+	["uppercase scheme", "JAVASCRIPT:alert(1)"]
+];
+
+for (const [label, value] of OBFUSCATIONS) {
+	const content = await capture({}, { url: PAGE_URL, content: html(`<a href="${value}">go</a>`), ...BLOCK });
+	check(`${label} is neutralized`, content.includes("alert(1)"), false);
+}
+
+// The control. A space inside the scheme is not a javascript: URL, and neither is a relative path, so
+// a sanitizer that rewrote either would be matching on text rather than on what the URL parser says.
+// Neither href survives as written, because resolveHrefs makes both absolute afterwards; what the
+// control asserts is that the sanitizer did not claim them.
+{
+	const content = await capture({}, { url: PAGE_URL, content: html("<a href=\"java script:alert(1)\">go</a><a href=\"page.html\">go</a>"), ...BLOCK });
+	check("a space inside the scheme is not treated as a script URI", content.includes("javascript:void(0)"), false);
+	check("a relative href is not treated as a script URI", content.includes("page.html"), true);
+}
+
+// The other half of removeEmbedScripts, kept here so that a rewrite of the attribute walk cannot drop
+// it silently. Only the script elements can be checked from here: the event handler attribute names
+// come from enumerating the on* IDL properties of an element, and deno-dom implements none of them,
+// so the set is empty in this harness and a handler fixture would pass whatever the code did. The
+// browser suite in single-file-cli covers the handlers.
+{
+	const scripts = await capture({}, { url: PAGE_URL, content: html("<script>alert(1)</script><svg xmlns=\"http://www.w3.org/2000/svg\"><script>alert(2)</script></svg>"), ...BLOCK });
+	check("html and svg script elements are removed", scripts.includes("alert("), false);
+}
+
+// The option still has to be an option: with blockScripts off none of this is rewritten.
+{
+	const content = await capture({}, { url: PAGE_URL, content: html("<a href=\"javascript:alert(1)\">go</a>") });
+	check("nothing is rewritten with blockScripts off", content.includes("javascript:alert(1)"), true);
+}
+
+if (failed) {
+	console.log("FAILED");
+	Deno.exit(1);
+}
+console.log("OK");
+
+function check(label, actual, expected) {
+	const ok = actual === expected;
+	console.log(`${ok ? "PASS" : "FAIL"} ${label}: ${actual}${ok ? "" : " (expected " + expected + ")"}`);
+	failed ||= !ok;
+}

package/test/sfz-harness/pages-archive.js

@@ -249,8 +249,8 @@ async function makePage(seed, { url, title, originalUrls }) {
 
 // a page archive holding, on purpose, nothing the packager's own writer would produce by default:
 // a directory record, a name that needs the language encoding flag, a stored entry beside one
-// deflated at the highest level, unix ownership, an extra field zip.js does not interpret, and
-// dates outside the one the packager pins on its writer
+// deflated at the highest level, unix ownership, a non-default version-made-by spec byte, an
+// extra field zip.js does not interpret, and dates outside the one the packager pins on its writer
 async function makeMetadataPage() {
 	const zipWriter = new ZipWriter(new Uint8ArrayWriter(), { lastModDate: SOURCE_DATE });
 	await zipWriter.add("folder/", null, { directory: true, comment: "a folder" });
@@ -261,6 +261,9 @@ async function makeMetadataPage() {
 		lastAccessDate: SOURCE_DATE,
 		internalFileAttributes: 1,
 		msDosCompatible: false,
+		// only the high byte is rewritten to host Unix, so the 0x32 spec byte survives and the
+		// copied value differs from the 0x0300 both writers land on by default
+		versionMadeBy: 0x0332,
 		unixMode: 0o100755,
 		uid: 501,
 		gid: 20,