From 7c3be7f58b60d4c3568a52fe28d99d6bd08f84ca Mon Sep 17 00:00:00 2001 From: Johan Lindh Date: Sat, 29 Aug 2026 18:38:02 +0200 Subject: [PATCH] chore: drop direct golang.org/x/net dependency --- go.mod | 1 - go.sum | 2 -- lib/htmlio/AI.md | 6 ++--- lib/htmlio/writehtml_test.go | 46 +++++++++--------------------------- 4 files changed, 14 insertions(+), 41 deletions(-) diff --git a/go.mod b/go.mod index 63bc232f..af2e2e9e 100644 --- a/go.mod +++ b/go.mod @@ -8,7 +8,6 @@ require ( github.com/linkdata/jq v0.6.0 github.com/linkdata/secureheaders v1.5.0 github.com/linkdata/staticserve v1.1.8 - golang.org/x/net v0.58.0 ) require github.com/petermattis/goid v0.0.0-20260330135022-df67b199bc81 // indirect diff --git a/go.sum b/go.sum index f0ccaad4..39d5a26d 100644 --- a/go.sum +++ b/go.sum @@ -11,5 +11,3 @@ github.com/linkdata/staticserve v1.1.8/go.mod h1:uOUrHkbNEkVXWvuw7gk0ydm39r9Y1Re github.com/petermattis/goid v0.0.0-20250813065127-a731cc31b4fe/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4= github.com/petermattis/goid v0.0.0-20260330135022-df67b199bc81 h1:WDsQxOJDy0N1VRAjXLpi8sCEZRSGarLWQevDxpTBRrM= github.com/petermattis/goid v0.0.0-20260330135022-df67b199bc81/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4= -golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= -golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= diff --git a/lib/htmlio/AI.md b/lib/htmlio/AI.md index 440a76cf..0356fc9c 100644 --- a/lib/htmlio/AI.md +++ b/lib/htmlio/AI.md @@ -51,6 +51,6 @@ already trusted must be escaped before conversion to `template.HTML`. ## Verification Run `go test -race ./lib/htmlio` and `go test ./lib/htmlio` from the module root. -Keep table and fuzz coverage for escaping, CR/NUL behavior, DOM-parsed values, -void elements, textarea/pre leading newlines, positive/zero/invalid Jids, and -Writer-error propagation. +Keep table and fuzz coverage for escaping, CR/NUL behavior, modeled DOM +attribute values, void elements, textarea/pre leading newlines, +positive/zero/invalid Jids, and Writer-error propagation. diff --git a/lib/htmlio/writehtml_test.go b/lib/htmlio/writehtml_test.go index 5da7f02b..59b16458 100644 --- a/lib/htmlio/writehtml_test.go +++ b/lib/htmlio/writehtml_test.go @@ -9,7 +9,6 @@ import ( "github.com/linkdata/jaws/lib/htmlio" "github.com/linkdata/jaws/lib/jid" - xhtml "golang.org/x/net/html" ) func Test_WriteHTMLInner(t *testing.T) { @@ -458,38 +457,9 @@ func normalizeCR(s string) string { return strings.ReplaceAll(s, "\r", "\n") } -func parsedAttr(t *testing.T, source, name string) string { - t.Helper() - doc, err := xhtml.Parse(strings.NewReader(source)) - if err != nil { - t.Fatal(err) - } - var findAttr func(*xhtml.Node) (string, bool) - findAttr = func(node *xhtml.Node) (string, bool) { - if node.Type == xhtml.ElementNode { - for _, attr := range node.Attr { - if attr.Key == name { - return attr.Val, true - } - } - } - for child := node.FirstChild; child != nil; child = child.NextSibling { - if value, ok := findAttr(child); ok { - return value, true - } - } - return "", false - } - if value, ok := findAttr(doc); ok { - return value - } - t.Fatalf("attribute %q not found in parsed source %q", name, source) - return "" -} - -// TestAttr_DOMValue verifies the DOM attribute value exposed by an HTML -// parser. Carriage returns round-trip, while U+0000 is deliberately -// canonicalized to the U+FFFD value required by HTML parsing. +// TestAttr_DOMValue models the attribute value exposed by an HTML parser. +// Carriage returns round-trip, while U+0000 is deliberately canonicalized to +// the U+FFFD value required by HTML parsing. func TestAttr_DOMValue(t *testing.T) { values := []string{ "", "plain", "a\rb", "a\r\nb", "\rlead", "trail\r", "x\ry\rz", @@ -501,9 +471,15 @@ func TestAttr_DOMValue(t *testing.T) { if strings.IndexByte(src, 0) >= 0 { t.Fatalf("Attr(%q) = %q, contains raw NUL", value, src) } - got := parsedAttr(t, "
", "data-x") + const prefix = `data-x="` + if len(src) <= len(prefix) || !strings.HasPrefix(src, prefix) || !strings.HasSuffix(src, `"`) { + t.Fatalf("Attr(%q) = %q, want a quoted data-x attribute", value, src) + } + // Attr's fixed quoted shape is checked above; model browser input + // preprocessing before character-reference decoding for its value. + got := html.UnescapeString(normalizeCR(src[len(prefix) : len(src)-1])) if want := strings.ReplaceAll(value, "\x00", "\uFFFD"); got != want { - t.Errorf("attribute value %q parsed as %q, want %q (source %q)", value, got, want, src) + t.Errorf("attribute value %q decoded as %q, want %q (source %q)", value, got, want, src) } } }