turva-llms-txt-validator 0.3.20 → 0.3.21

package/README.md

@@ -137,10 +137,10 @@ For vulnerability reporting and supported versions, see [SECURITY.md](https://gi
 GitHub Actions publishes every version from 0.1.3 on with npm trusted publishing, and each one carries a provenance attestation. To check one, install it in an empty directory and ask npm to verify the signatures. Replace the version with the one you want to check.
 
 ```sh
-mkdir verify-llms && cd verify-llms && npm init -y && npm install turva-llms-txt-validator@0.3.20 --ignore-scripts && npm audit signatures
+mkdir verify-llms && cd verify-llms && npm init -y && npm install turva-llms-txt-validator@0.3.21 --ignore-scripts && npm audit signatures
 ```
 
-`npm audit signatures` checks the registry signature and the provenance attestation of each installed package that has one. The attestation of this package names three things to compare with what you expect: the repository `github.com/erekola/llms-txt-validator`, the workflow file `.github/workflows/publish.yml` and the commit that produced the tarball. The npm version page shows them under Provenance. Tag `v0.3.20` must point at that same commit, and `gh api repos/erekola/llms-txt-validator/commits/v0.3.20 --jq .sha` prints it. A mismatch is a reason not to use that version. Provenance proves where a release was built and from which commit. It does not prove that the code is safe, so reading the source and the dependencies stays your job.
+`npm audit signatures` checks the registry signature and the provenance attestation of each installed package that has one. The attestation of this package names three things to compare with what you expect: the repository `github.com/erekola/llms-txt-validator`, the workflow file `.github/workflows/publish.yml` and the commit that produced the tarball. The npm version page shows them under Provenance. Tag `v0.3.21` must point at that same commit, and `gh api repos/erekola/llms-txt-validator/commits/v0.3.21 --jq .sha` prints it. A mismatch is a reason not to use that version. Provenance proves where a release was built and from which commit. It does not prove that the code is safe, so reading the source and the dependencies stays your job.
 
 ## Hosted version and source
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "turva-llms-txt-validator",
-  "version": "0.3.20",
+  "version": "0.3.21",
   "description": "Validate a site's llms.txt structure: eight checks as pass/warn/fail plus two llms.txt v2 discovery checks that read pass or info and never move the summary, JSON output. Same checks as the hosted validator at turva.dev/llms-txt-validator.",
   "type": "module",
   "main": "./src/index.mjs",

package/src/index.mjs

@@ -546,15 +546,15 @@ function isSetextH1(line, next) {
 // "[a]: url" over a run of "=" warning as a second H1 although 0.3.18 passed them.
 const HTML_BLOCK_START = /^ {0,3}<(?:[A-Za-z][A-Za-z0-9-]*(?:[\s\/>]|$)|\/[A-Za-z][A-Za-z0-9-]*(?:[\s>]|$)|!--|\?|![A-Za-z]|!\[CDATA\[)/;
 const LINK_REF_DEF = /^ {0,3}\[[^\]]+\]:/;
-// HTML blocks of CommonMark types 1 to 5 end at a marker, not at a blank line: <pre>, <script>,
-// <style> and <textarea> at "</...>", "<!--" at "-->", "<?" at "?>", "<!X" at ">" and "<![CDATA[" at
-// "]]>". Each entry is [start, end]; the end marker is looked for after the start on the same line.
+// HTML blocks of CommonMark types 1 to 5 end at a marker, not at a blank line. The end markers are plain substrings matched case-insensitively, as CommonMark defines them, and not a tag regexp (CodeQL js/bad-tag-filter): type 2 ends at "-->" only, never at "--!>".
+// Entry is [start, ends]: </pre>, </script>, </style>, </textarea> after <pre> and kin, "-->" after "<!--", "?>" after "<?", "]]>" after "<![CDATA[", ">" after "<!X"; the marker is looked for after the start on the same line.
+function hasRawEnd(s, ends) { const t = s.toLowerCase(); return ends.some((e) => t.includes(e)); }
 const RAW_HTML_BLOCKS = [
-  [/^ {0,3}<(?:pre|script|style|textarea)(?:[ \t>]|$)/i, /<\/(?:pre|script|style|textarea)>/i],
-  [/^ {0,3}<!--/, /-->/],
-  [/^ {0,3}<\?/, /\?>/],
-  [/^ {0,3}<!\[CDATA\[/, /\]\]>/],
-  [/^ {0,3}<![A-Za-z]/, />/]
+  [/^ {0,3}<(?:pre|script|style|textarea)(?:[ \t>]|$)/i, ['</pre>', '</script>', '</style>', '</textarea>']],
+  [/^ {0,3}<!--/, ['-->']],
+  [/^ {0,3}<\?/, ['?>']],
+  [/^ {0,3}<!\[CDATA\[/, [']]>']],
+  [/^ {0,3}<![A-Za-z]/, ['>']]
 ];
 function startsOtherBlock(line) {
   return /^ {0,3}([-*_])(?:[ \t]*\1){2,}[ \t]*$/.test(line)
@@ -603,12 +603,12 @@ function laterSetextH1(lines, fenced) {
     blankBefore = false;
     if (/^ {0,3}>/.test(l)) quoteCtx = true;
     if (rawEnd) {
-      if (rawEnd.test(l)) { rawEnd = null; rawDone = true; }
+      if (hasRawEnd(l, rawEnd)) { rawEnd = null; rawDone = true; }
     } else {
       if (HTML_BLOCK_START.test(l) || LINK_REF_DEF.test(l)) htmlCtx = true;
       for (const [start, end] of RAW_HTML_BLOCKS) {
         const m = start.exec(l);
-        if (m) { if (!end.test(l.slice(m[0].length))) rawEnd = end; break; }
+        if (m) { if (!hasRawEnd(l.slice(m[0].length), end)) rawEnd = end; break; }
       }
     }
     if (!open && !listCtx && !quoteCtx && !htmlCtx && indented) continue;