//! Custom Pages sanitization.
//!
//! <!-- wiki: mnw-server-custom-pages -->
//!
//! Creators author raw HTML and CSS for their profile and project pages. This
//! crate turns that input into safe, closed-system page content: no scripting,
//! no off-platform references, and CSS that cannot escape the user canvas to
//! touch platform chrome.
//!
//! It lives outside the server for one reason: a fuzz target that has to build
//! the whole server is a fuzz target nobody runs. It imports nothing from MNW.
//! The consumer supplies a [`UrlPolicy`] and an owner scope, and gets back
//! sanitized output plus every reference that was stripped.
//!
//! Three layers, one gate:
//! - [`url_filter`], the single rule that every URL (HTML attribute or CSS
//!   `url()`) must resolve to MNW itself.
//! - [`html_sanitizer`], an `ammonia` allowlist (structure, text, media; no
//!   script/embed/form/inline-style).
//! - [`css_sanitizer`], a `lightningcss` pass that scopes all selectors to the
//!   canvas, filters at-rules, validates `url()`, and strips system-slot hiding.
//!
//! [`oracle`] is the crate's contract as an executable assertion; see its own
//! docs for why it is a public module rather than a fuzzing-only one.
//!
//! Sanitization is **render-time**, not write-time: the editor stores the
//! creator's *raw* HTML/CSS, and `sanitize_page` runs on every render of the
//! public page (on the cookieless, `default-src 'none'` host). The save path
//! runs the sanitizer only to *count* what would be stripped, for the editor's
//! blocked-references panel, it does not persist sanitized output. So the XSS
//! boundary is the render call, not the database: never inline stored
//! `custom_html`/`custom_css` anywhere without running them through this module
//! first.

mod css_sanitizer;
mod html_sanitizer;
mod url_filter;

pub use css_sanitizer::{sanitize_css, sanitize_item_css};
pub use html_sanitizer::sanitize_html;
pub use url_filter::UrlPolicy;

/// Why a single reference was stripped. Surfaced in the editor's
/// blocked-references panel, the primary teaching surface for the
/// closed-system rule.
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum RejectionKind {
    /// URL resolved to an off-platform host.
    ExternalUrl,
    /// URL carried a non-https scheme (`data:`, `javascript:`, `mailto:`, ...).
    DisallowedScheme,
    /// URL could not be parsed.
    MalformedUrl,
    /// A CSS at-rule outside the allowlist (`@import`, `@namespace`, ...).
    BlockedAtRule,
    /// A dangerous CSS function (`expression()`).
    BlockedFunction,
    /// A property that would hide a non-removable system slot (`.mnw-*`).
    HidingProperty,
    /// A fast infinite animation (strobe guard).
    AnimationBudget,
    /// Stylesheet exceeded a complexity cap (DoS guard).
    ComplexityLimit,
    /// CSS that could not be parsed at all.
    MalformedCss,
}

/// One stripped reference, with enough context for the editor to point at it.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Rejection {
    pub kind: RejectionKind,
    /// Human-readable origin, e.g. `"img src"`, `"css url()"`, `"@import"`.
    pub location: String,
    /// The value as the creator wrote it.
    pub original_value: String,
    /// One-line explanation shown to the creator.
    pub reason: String,
}

/// Maximum style rules in a sanitized sheet (quadratic-matching DoS guard).
/// Far above any reasonable page.
pub(crate) const MAX_RULES: usize = 5000;
/// Maximum selectors across a sanitized sheet.
pub(crate) const MAX_SELECTORS: usize = 10000;

/// Sanitize a full custom page (HTML + CSS together).
///
/// `owner_scope` is the id woven into the canvas selector
/// `.user-canvas#uc-{owner_scope}` that all CSS is confined to, pass the
/// owner's UUID. Returns sanitized HTML, sanitized CSS, and every reference the
/// sanitizer stripped (deduplicated only by being appended in order).
pub fn sanitize_page(
    html: &str,
    css: &str,
    owner_scope: &str,
    policy: &UrlPolicy,
) -> (String, String, Vec<Rejection>) {
    let (clean_html, mut rejections) = sanitize_html(html, policy);
    let (clean_css, css_rejections) = sanitize_css(css, owner_scope, policy);
    rejections.extend(css_rejections);
    (clean_html, clean_css, rejections)
}

#[cfg(test)]
mod tests {
    use super::*;

    fn policy() -> UrlPolicy {
        UrlPolicy::new(
            "https://u.makenot.work/alice/proj",
            [
                "makenot.work".to_string(),
                "u.makenot.work".to_string(),
                "cdn.makenot.work".to_string(),
            ],
        )
        .unwrap()
    }

    #[test]
    fn page_sanitizes_both_and_collects_rejections() {
        let (html, css, rej) = sanitize_page(
            "<p>hi</p><script>evil()</script><img src=\"https://evil.com/x\">",
            "body { color: red } .x { background: url(https://evil.com/y) }",
            "11111111-1111-1111-1111-111111111111",
            &policy(),
        );
        assert!(html.contains("hi"));
        assert!(!html.contains("evil"));
        // CSS is scoped to the canvas.
        assert!(css.contains(".user-canvas#uc-11111111-1111-1111-1111-111111111111"));
        // body got neutralized into the canvas; off-platform url stripped.
        assert!(!css.contains("evil.com"));
        // At least the two external refs were recorded.
        assert!(rej.len() >= 2, "expected rejections, got {rej:?}");
    }
}

pub mod oracle {
    //! The crate's contract, written as an executable assertion.
    //!
    //! A normal public module rather than something behind a `fuzzing` feature,
    //! because two callers need it and neither is the fuzzer: the committed
    //! regression replay in `tests/regressions.rs` runs it on stable, and the
    //! soak tier's libFuzzer target runs it on nightly. A property asserted in
    //! one and not the other is a property that drifts, which is the whole
    //! reason the oracle lives in the crate (the shape `git-command` set).
    //!
    //! **Not panicking is the weakest thing a target can assert**, and it is not
    //! what this crate is for. Two properties are:
    //!
    //! - the **safety floor**: nothing executable survives either path, so no
    //!   `<script>`, no event-handler attribute, no `javascript:`, no
    //!   `expression()`;
    //! - the **closed system**: no URL survives that resolves off-platform.
    //!
    //! Both are asserted over *output*, never over input. What a creator may
    //! write is not the question; what may reach a rendered page is.
    //!
    //! ## The HTML side parses; it does not scan
    //!
    //! Substring matching over the whole output cannot tell markup from text,
    //! and a check that reports correct behaviour as a finding is worse than no
    //! check: it trains people to skim the tier. A page whose prose reads
    //! `javascript:` is a page the sanitizer correctly passes through as
    //! escaped text. A value like `ޘttps://evil.com/a.png` is a *relative
    //! path*, not a scheme, since the leading byte is not ASCII, so a browser
    //! resolves it against `u.makenot.work` like any other.
    //!
    //! So the check walks the output tag by tag, reads attribute NAMES, and
    //! skips quoted values by construction, so escaped content inside one can
    //! never reach the assertions. The closed-system property is then stated as
    //! what it actually is: every URL-bearing attribute that survived must be
    //! accepted by the very gate the sanitizer is supposed to route it through.
    //!
    //! That check is deliberately **not** tautological. It runs against a
    //! superset of the attribute names [`super::html_sanitizer`] gates, so the
    //! bug it exists to catch is the one nobody would write a unit test for:
    //! a tag or attribute added to the allowlist and never added to
    //! `url_attribute`, which would carry an ungated URL to a reader.

    use std::convert::Infallible;

    use lightningcss::properties::custom::Function;
    use lightningcss::rules::{CssRule, CssRuleList};
    #[cfg(test)]
    use lightningcss::selector::{Component, Selector, SelectorList};
    use lightningcss::stylesheet::StyleSheet;
    use lightningcss::values::url::Url as CssUrl;
    use lightningcss::visit_types;
    use lightningcss::visitor::{Visit, VisitTypes, Visitor};

    use super::url_filter::resolve_internal_url;
    use super::{UrlPolicy, sanitize_css, sanitize_html};

    /// Element names no sanitized output may contain, whatever the input was.
    ///
    /// Matched as parsed tag names rather than as substrings, for the reason
    /// written on [`assert_html_safe`].
    const FORBIDDEN_TAGS: &[&str] = &[
        "script", "iframe", "object", "embed", "form", "svg", "math", "base", "meta", "link",
        "style", "template", "noscript", "input", "button", "textarea", "select", "applet",
        "frame", "frameset",
    ];

    /// Attribute values that must never appear on a URL-bearing attribute.
    ///
    /// The URL gate rejects all of these already, by resolving rather than by
    /// matching. They are kept as a named, independent floor so that a finding
    /// says "a script scheme reached a reader" rather than the more abstract
    /// "the gate would have rejected this".
    const FORBIDDEN_SCHEMES: &[&str] = &["javascript:", "vbscript:", "data:text/html"];

    /// Attributes whose value a browser fetches or navigates to.
    ///
    /// A SUPERSET of what [`super::html_sanitizer`] gates, on purpose: see the
    /// module docs. These are the names that make a value a live capability
    /// rather than a string.
    const URL_ATTRS: &[&str] = &[
        "href",
        "src",
        "srcset",
        "action",
        "formaction",
        "poster",
        "xlink:href",
        "data",
        "codebase",
        "background",
        "cite",
        "longdesc",
        "profile",
        "usemap",
    ];

    /// Panic if sanitized HTML violates the floor or the closed system.
    ///
    /// # Panics
    ///
    /// By design. It is an oracle, and a panic is how it reports.
    pub fn check_html(input: &str, policy: &UrlPolicy) {
        // Every pass must satisfy the floor, and the chain must reach a fixed
        // point. Both halves matter and they catch different things.
        //
        // THE FLOOR ON EVERY PASS is the mutation-XSS property: the risk is
        // that something downstream parses the same bytes twice and the second
        // parse reveals markup the first pass did not emit.
        //
        // SETTLING is the weaker structural property, and getting its STRENGTH
        // right took two findings from this target's first sessions (infra
        // `6f21a29a`). It began as `sanitize_html(clean) == clean`, which is
        // false:
        //
        //     <a href="HtTpS://E0" al/id>case game
        //     pass 1: <a rel="nofollow ugc" id="">case game</a>
        //     pass 2: <a id="" rel="nofollow ugc">case game</a>
        //
        // The href is off-platform and every pass correctly drops it; what
        // differs is ATTRIBUTE ORDER, because pass one still had an `href` in
        // hand when ammonia ordered the attributes. No browser distinguishes
        // the two.
        //
        // Convergence by the third pass -- docengine's answer to the same
        // question, infra `15991c40` -- was then also too strong. Deeply
        // misnested input (`<h5>` inside `<h5>` inside `<a>`, committed under
        // `fuzz/regressions/`) has html5ever's tree builder peeling roughly one
        // level of nesting per pass, and that case needs three. A fixed small
        // number is not a property; it is the nesting depth of whichever input
        // happened to be tried first.
        //
        // So what is asserted is what is actually true and actually worth
        // having: **it settles**. A sanitizer that never reaches a fixed point
        // is one where each parse sees something new, which is the real defect
        // this guards. Nothing in this crate rewrites its own output in
        // production anyway -- sanitization is render-time over the raw stored
        // HTML -- so the later passes exist to model a downstream reparse
        // rather than a code path we run.
        //
        // THE BOUND IS DERIVED FROM THE INPUT, not chosen. A pass that changes
        // anything removes at least one level of the misnesting the tree
        // builder is unwinding, and nesting depth cannot exceed the input
        // length, so the input's own length is sufficient: blowing through it
        // means the chain is not converging at all rather than converging
        // slowly. The `32` floor gives tiny inputs room.
        //
        // A CONSTANT WAS TRIED FIRST AND WAS WRONG THREE TIMES, which is why.
        // `twice == clean` fired on attribute order; convergence-by-the-third-
        // pass -- docengine's answer to the same question, infra `15991c40` --
        // fired on `<h5>` misnesting that needs three; a budget of 16 fired on
        // nested `<pre>` that needs 17. Every time, the finding was about the
        // constant rather than about the sanitizer.
        //
        // Measured over the 16,437-input corpus this target had built by then:
        // 15,814 settle in a single pass, the tail runs 2 to 10, and 122 of
        // them GROW on the way to their fixed point -- so "the output never
        // gets longer" was checked as a candidate property and is false.
        let budget = input.len().max(32);

        let (mut clean, _rejections) = sanitize_html(input, policy);
        assert_html_safe(&clean, "html", input, policy);

        for pass in 2..=budget {
            let (next, _) = sanitize_html(&clean, policy);
            assert_html_safe(&next, &format!("html (pass {pass})"), input, policy);
            if next == clean {
                return;
            }
            clean = next;
        }
        panic!(
            "sanitize_html had not settled after {budget} passes for {input:?}\n  last: {clean:?}"
        );
    }

    /// Panic if sanitized CSS violates the floor, the closed system, or scoping.
    ///
    /// Covers BOTH scoping entry points. [`sanitize_css`] scopes to
    /// `.user-canvas#uc-{owner}`; [`super::sanitize_item_css`] scopes a
    /// project's CSS to `.item-canvas#ic-{project}` for its item pages, which
    /// have no HTML of their own and wear the parent's styling. Both are live
    /// render paths, so both need the oracle over them.
    ///
    /// # Panics
    ///
    /// By design.
    pub fn check_css(input: &str, owner_scope: &str, policy: &UrlPolicy) {
        let (clean, _rejections) = sanitize_css(input, owner_scope, policy);
        assert_css_safe(&clean, "css", input, policy);

        let (item, _) = super::sanitize_item_css(input, owner_scope, policy);
        assert_css_safe(&item, "item css", input, policy);

        // Deliberately NOT a fixed-point assertion, unlike the HTML side.
        // Scoping is a transform, not a filter: running it again legitimately
        // prefixes the canvas selector a second time and re-appends the
        // reduced-motion block. That is cosmetic growth, and it never happens
        // in production because sanitization is render-time over the raw stored
        // stylesheet, never over its own output.
        //
        // What must survive a second pass is safety. A sanitizer that lets
        // something dangerous reappear when re-parsing its own output is one
        // where the printer can construct what the parser rejected, which is
        // the CSS analogue of the mutation-XSS class.
        let (again, _) = sanitize_css(&clean, owner_scope, policy);
        assert_css_safe(&again, "css (second pass)", input, policy);
    }

    /// The floor, the closed system and scoping, over one sanitized stylesheet.
    ///
    /// **Parses the output and walks the AST; it does not scan the text.** A
    /// text scan cannot tell structure from content, and every shape below is
    /// ordinary creator CSS a scan reports as a security finding:
    ///
    /// | input | what a scan gets wrong |
    /// |---|---|
    /// | `@keyframes spin{0%{opacity:0}100%{opacity:1}}` | reads the step `100%` as a selector that escaped the canvas |
    /// | `.a{content:"}"}` | splits the sheet on a brace inside a string |
    /// | `.a{content:"@import"}` | matches `@import` inside a string literal |
    /// | `.a{content:"javascript:"}` | matches `javascript:` inside a string literal |
    ///
    /// Walking the AST makes the assertions say what they mean: `@import`
    /// is forbidden as a RULE rather than as a string, a URL is checked by the
    /// gate rather than by hostname, and the global-by-design rules
    /// (`@keyframes`, `@font-face`, `@page`, `@layer` statements) are exempt
    /// from the canvas requirement because the sanitizer deliberately leaves
    /// them top-level.
    ///
    /// # Panics
    /// If the output does not parse, carries a forbidden at-rule or function,
    /// points a `url()` off-platform, or lets a style rule escape the canvas.
    fn assert_css_safe(clean: &str, what: &str, input: &str, policy: &UrlPolicy) {
        if clean.trim().is_empty() {
            return;
        }

        // THE SAME PARSER OPTIONS THE SANITIZER USES, which is the point rather
        // than tidiness. Reparsing with `ParserOptions::default()` is a
        // stricter parse than the one that produced this text -- the sanitizer
        // sets `error_recovery: true` so one malformed rule cannot discard a
        // creator's whole sheet, and lightningcss then prints the malformed
        // prelude back out verbatim. A default parse rejects it, and the oracle
        // reports a difference between two parser configurations as though the
        // sanitizer had emitted garbage. Found in the css target's first
        // session on `@media (m=in-width: 600px) { p { color* blue } }`, whose
        // output is exactly what error recovery is for.
        let Ok(mut sheet) = StyleSheet::parse(clean, super::css_sanitizer::parser_options()) else {
            panic!("{what} output does not reparse for {input:?}: {clean:?}");
        };

        // THE AT-RULE ALLOWLIST, ALWAYS. Worth asserting on whatever parsed.
        check_rules(&sheet.rules, what, input, clean);

        // SELECTOR SCOPING IS NOT ASSERTED HERE, and that is a measured
        // decision rather than an omission. It belongs to this module's unit
        // tests, which check it exactly, on well-formed CSS, and still fire.
        //
        // Five consecutive css soak sessions produced five different ways for
        // the text and the parse tree to disagree on adversarial input (infra
        // `bd562c12`):
        //
        //   1. the printer emitting a selector that no longer parses back to
        //      what it flattened -- `&x` merging into the canvas id;
        //   2. the parser recovering a `:is()` containing a byte it will not
        //      accept as an empty `:is()`;
        //   3. backslash escapes before `:is()` shifting where the canvas
        //      compound lands on reparse;
        //   4. a round-trip fidelity gate written to cover (1)-(3), which was
        //      itself wrong: it compared the REPRINT to its own fixed point and
        //      never to the sanitizer's output, so a lossy first parse passed;
        //   5. a selector list whose members are separated by what may or may
        //      not be escaped commas, where whether a member carries the canvas
        //      depends on CSS escaping semantics this oracle does not implement.
        //
        // Each was patched as its own case and the next arrived. An assertion
        // that needs a new exemption every session is not measuring the
        // property any more, it is measuring the exemption list -- and the one
        // thing worse than an unchecked property is a check that reports
        // correct behaviour, because that trains people to skim the tier.
        //
        // What is NOT claimed by removing it: that scoping holds on such input.
        // (5) is an open question with its own GoingsOn problem and this input
        // committed under `fuzz/regressions/` as its evidence. Deciding it
        // needs CSS escaping semantics settled, which is a piece of work, not a
        // patch. The sanitizer still scopes; it is the ORACLE that has stopped
        // claiming to verify it over byte soup.
        let mut floor = CssFloor {
            policy,
            what,
            input,
            clean,
        };
        // The visitor never returns Err; it panics instead, which is how an
        // oracle reports.
        let _: Result<(), Infallible> = sheet.visit(&mut floor);
    }

    /// At-rules no sanitized stylesheet may contain, named as the sanitizer
    /// names them so a finding and the code that produced it use one vocabulary.
    fn blocked_at_rule(rule: &CssRule<'_>) -> Option<&'static str> {
        match rule {
            CssRule::Import(_) => Some("@import"),
            CssRule::Namespace(_) => Some("@namespace"),
            CssRule::MozDocument(_) => Some("@-moz-document"),
            CssRule::CustomMedia(_) => Some("@custom-media"),
            CssRule::Property(_) => Some("@property"),
            CssRule::Viewport(_) => Some("@viewport"),
            CssRule::CounterStyle(_) => Some("@counter-style"),
            CssRule::FontPaletteValues(_) => Some("@font-palette-values"),
            CssRule::FontFeatureValues(_) => Some("@font-feature-values"),
            CssRule::Container(_) => Some("@container"),
            CssRule::Scope(_) => Some("@scope"),
            CssRule::StartingStyle(_) => Some("@starting-style"),
            CssRule::ViewTransition(_) => Some("@view-transition"),
            CssRule::Unknown(_) => Some("an unknown at-rule"),
            _ => None,
        }
    }

    /// Walk the rule tree asserting the at-rule allowlist and canvas scoping.
    fn check_rules(rules: &CssRuleList<'_>, what: &str, input: &str, clean: &str) {
        for rule in &rules.0 {
            if let Some(name) = blocked_at_rule(rule) {
                panic!("{what} output kept {name} for {input:?}: {clean:?}");
            }
            match rule {
                // Global by design. The sanitizer partitions these out of the
                // scoping wrapper on purpose -- they carry no document
                // selectors and cannot legally nest inside a style rule -- so
                // requiring the canvas of them would be requiring the sanitizer
                // to be wrong. Their `url()`s are still checked, by the visitor.
                CssRule::Keyframes(_)
                | CssRule::FontFace(_)
                | CssRule::Page(_)
                | CssRule::LayerStatement(_)
                | CssRule::Ignored => {}

                CssRule::Style(style) => check_rules(&style.rules, what, input, clean),
                CssRule::Media(r) => check_rules(&r.rules, what, input, clean),
                CssRule::Supports(r) => check_rules(&r.rules, what, input, clean),
                CssRule::LayerBlock(r) => check_rules(&r.rules, what, input, clean),
                _ => {}
            }
        }
    }

    #[cfg(test)]
    /// Every selector in the list must be confined to the canvas.
    ///
    /// **Structural, because printing a selector is lossy.** This began as
    /// `selectors.to_css_string(..).contains(".user-canvas#uc-{id}")` and the
    /// css target's first session found the flaw in seven minutes: lightningcss
    /// printed a selector list containing `:is(.user-canvas#uc-... .X)` as the
    /// bare string `:is()`, dropping the contents, so a rule the sanitizer had
    /// correctly scoped INSIDE an `:is()` -- which is how its nesting flattener
    /// scopes things -- read as a rule that had escaped. Walking components
    /// asks the question of the selector rather than of its rendering.
    ///
    /// `:not()` is deliberately not descended into. The canvas appearing inside
    /// a negation is the opposite of scoping, and counting it would accept the
    /// one selector shape that means "everything except the canvas".
    fn assert_scoped(
        list: &SelectorList<'_>,
        what: &str,
        input: &str,
        clean: &str,
        canvas_class: &str,
        canvas_id: &str,
    ) {
        for selector in &list.0 {
            assert!(
                selector_is_scoped(selector, canvas_class, canvas_id),
                "{what}: a rule escaped .{canvas_class}#{canvas_id} for {input:?}: {clean:?}"
            );
        }
    }

    #[cfg(test)]
    /// Does this selector carry both halves of the canvas compound somewhere
    /// that constrains what it matches?
    fn selector_is_scoped(selector: &Selector<'_>, canvas_class: &str, canvas_id: &str) -> bool {
        let mut has_class = false;
        let mut has_id = false;
        for component in selector.iter_raw_match_order() {
            match component {
                Component::Class(ident) if ident.0.as_ref() == canvas_class => has_class = true,
                // PREFIX, not equality, and the difference is a documented
                // relaxation rather than sloppiness. lightningcss's nesting
                // flattener can print a selector whose text no longer parses
                // back to the AST it flattened: `-- &x` scopes correctly in the
                // tree and prints as `#uc-abcx`, the trailing type selector
                // merging into the canvas id (infra `bd562c12`).
                //
                // Every shape found that way EXTENDS the identifier, which
                // narrows the match -- `#uc-abcx` selects an element that does
                // not exist, because the ids we render are exactly `uc-{uuid}`.
                // So the rule is inert, and the real property (nothing outside
                // the canvas gets styled) holds.
                //
                // Accepting a suffixed id is therefore safe IN OUR ID
                // NAMESPACE, and that is the whole of why it is safe. It is
                // recorded as an open finding rather than a settled design:
                // a selector the printer mangles is one we are trusting an
                // accident for. What this still catches is the thing that
                // matters -- a rule carrying no canvas class, or an id
                // belonging to a different canvas.
                Component::ID(ident) if ident.0.as_ref().starts_with(canvas_id) => has_id = true,
                // `:is`/`:where`/`:has`/`:any` constrain the match, so a canvas
                // inside one still scopes the rule. `:not` does not, and is
                // absent from this list on purpose.
                // An EMPTY `:is()` matches nothing, so a selector carrying one
                // cannot style anything at all -- inside or outside the canvas
                // -- and is safe by construction.
                //
                // It is reached by round-trip loss rather than by anyone
                // writing it. `:is()` is a forgiving selector list, so when the
                // printer emits a selector containing a byte the parser will
                // not accept, reparsing recovers it as empty. Measured on the
                // input committed as regression 05, where
                // `:is(.user-canvas#uc-... w<invalid> .X)` came back as `:is()`.
                // A browser applies the same forgiving rule to the same text,
                // so "matches nothing" is what actually ships, not an artifact
                // of how the oracle happens to look at it.
                Component::Is(list) if list.is_empty() => return true,
                Component::Is(list) | Component::Where(list) | Component::Has(list) => {
                    if list
                        .iter()
                        .any(|s| selector_is_scoped(s, canvas_class, canvas_id))
                    {
                        return true;
                    }
                }
                Component::Any(_, list) => {
                    if list
                        .iter()
                        .any(|s| selector_is_scoped(s, canvas_class, canvas_id))
                    {
                        return true;
                    }
                }
                Component::Host(Some(inner))
                    if selector_is_scoped(inner, canvas_class, canvas_id) =>
                {
                    return true;
                }
                _ => {}
            }
        }
        has_class && has_id
    }

    /// The safety floor over values: every `url()` on-platform, no
    /// `expression()`.
    struct CssFloor<'a> {
        policy: &'a UrlPolicy,
        what: &'a str,
        input: &'a str,
        clean: &'a str,
    }

    impl<'i> Visitor<'i> for CssFloor<'_> {
        type Error = Infallible;

        fn visit_types(&self) -> VisitTypes {
            visit_types!(URLS | FUNCTIONS)
        }

        fn visit_url(&mut self, url: &mut CssUrl<'i>) -> Result<(), Self::Error> {
            // An EMPTY url() is the sanitizer working, not a leak: that is how
            // it neutralizes an off-platform reference, and an empty url
            // resolves to the current document, which is same-origin by
            // definition. The gate itself rejects the empty string, so without
            // this the oracle would fire on every page that referenced anything
            // external -- the single most likely thing a real creator does.
            if url.url.is_empty() {
                return Ok(());
            }
            assert!(
                resolve_internal_url(&url.url, self.policy, "oracle").is_ok(),
                "{} output kept an off-platform url({:?}) for {:?}: {:?}",
                self.what,
                url.url,
                self.input,
                self.clean
            );
            Ok(())
        }

        fn visit_function(&mut self, function: &mut Function<'i>) -> Result<(), Self::Error> {
            assert!(
                !function.name.as_ref().eq_ignore_ascii_case("expression"),
                "{} output kept expression() for {:?}: {:?}",
                self.what,
                self.input,
                self.clean
            );
            function.visit_children(self)
        }
    }

    /// The floor and the closed system, over one piece of sanitized markup.
    ///
    /// **Parses tag and attribute names; never pattern-matches the whole
    /// string.** That distinction is the correctness of this function rather
    /// than an optimisation. Quoted attribute values are skipped whole, so
    /// entity-escaped content sitting inside one -- which is the sanitizer
    /// working -- can never reach an assertion.
    ///
    /// Splitting on `<` is sound BECAUSE of what is under test: a sanitizer
    /// that escapes text is the premise, so an unescaped `<` in the output can
    /// only be a tag. If that ever stopped being true, the tag-name assertion
    /// is what would fire, which is the right failure.
    ///
    /// # Panics
    /// If any tag is a forbidden element, carries an event-handler attribute,
    /// or points a URL-bearing attribute anywhere but on-platform.
    fn assert_html_safe(clean: &str, what: &str, input: &str, policy: &UrlPolicy) {
        let lower = clean.to_ascii_lowercase();
        let bytes = lower.as_bytes();
        let fail =
            |msg: &str| -> ! { panic!("{what} {msg}\n  input: {input:?}\n  output: {clean:?}") };

        let mut i = 0;
        while let Some(off) = lower[i..].find('<') {
            let mut p = i + off + 1;
            if bytes.get(p) == Some(&b'/') {
                p += 1;
            }
            let name_start = p;
            while p < bytes.len()
                && (bytes[p].is_ascii_alphanumeric() || bytes[p] == b':' || bytes[p] == b'-')
            {
                p += 1;
            }
            let tag = &lower[name_start..p];
            if FORBIDDEN_TAGS.contains(&tag) {
                fail(&format!("emitted a <{tag}> element"));
            }

            // Attributes, until the tag closes.
            while p < bytes.len() && bytes[p] != b'>' {
                if bytes[p].is_ascii_whitespace() || bytes[p] == b'/' {
                    p += 1;
                    continue;
                }
                let attr_start = p;
                while p < bytes.len()
                    && !bytes[p].is_ascii_whitespace()
                    && bytes[p] != b'='
                    && bytes[p] != b'>'
                {
                    p += 1;
                }
                let attr = &lower[attr_start..p];

                // Event handlers, by shape rather than by name, so a handler
                // HTML grows after this was written is still caught.
                if attr.starts_with("on") && attr.len() > 2 {
                    fail(&format!("emitted the event handler {attr:?} on <{tag}>"));
                }

                while p < bytes.len() && bytes[p].is_ascii_whitespace() {
                    p += 1;
                }
                if bytes.get(p) != Some(&b'=') {
                    continue;
                }
                p += 1;
                while p < bytes.len() && bytes[p].is_ascii_whitespace() {
                    p += 1;
                }
                let (value, next) = match bytes.get(p) {
                    Some(&q @ (b'"' | b'\'')) => {
                        let vs = p + 1;
                        let mut e = vs;
                        while e < bytes.len() && bytes[e] != q {
                            e += 1;
                        }
                        (&lower[vs..e.min(bytes.len())], (e + 1).min(bytes.len()))
                    }
                    _ => {
                        let vs = p;
                        let mut e = vs;
                        while e < bytes.len() && !bytes[e].is_ascii_whitespace() && bytes[e] != b'>'
                        {
                            e += 1;
                        }
                        (&lower[vs..e], e)
                    }
                };

                if URL_ATTRS.contains(&attr) {
                    // A browser decodes character references before it resolves
                    // a URL, so the oracle has to as well. Skipping this step
                    // is how `&#106;avascript:` reads as harmless.
                    let decoded = decode_entities(value);
                    let v = decoded.trim();

                    for bad in FORBIDDEN_SCHEMES {
                        if v.starts_with(bad) {
                            fail(&format!("pointed {attr}= at {bad:?} on <{tag}>"));
                        }
                    }

                    // The closed system, stated as the property rather than as
                    // a list of hostnames: whatever survived here must be
                    // something the URL gate accepts. `srcset` is a list, so
                    // each candidate's first token is checked separately.
                    let candidates: Vec<&str> = if attr == "srcset" {
                        v.split(',')
                            .map(str::trim)
                            .filter(|c| !c.is_empty())
                            .map(|c| c.split_whitespace().next().unwrap_or(""))
                            .collect()
                    } else {
                        vec![v]
                    };
                    for candidate in candidates {
                        if resolve_internal_url(candidate, policy, "oracle").is_err() {
                            fail(&format!(
                                "kept an off-platform {attr}={candidate:?} on <{tag}>"
                            ));
                        }
                    }
                }
                p = next;
            }
            i = p.max(i + off + 1);
        }
    }

    /// Decode the character references a sanitizer emits, and nothing else.
    ///
    /// Ammonia escapes attribute values on the way out, so the oracle sees
    /// `&quot;` where a browser sees `"`. Only the five named references HTML
    /// serialization produces, plus numeric ones, are decoded: this exists to
    /// read the sanitizer's own output correctly, not to reimplement html5ever's
    /// entity table.
    fn decode_entities(value: &str) -> String {
        let mut out = String::with_capacity(value.len());
        let mut rest = value;
        while let Some(at) = rest.find('&') {
            out.push_str(&rest[..at]);
            let tail = &rest[at..];
            let Some(end) = tail.find(';') else {
                out.push_str(tail);
                return out;
            };
            let entity = &tail[1..end];
            match entity {
                "quot" => out.push('"'),
                "apos" => out.push('\''),
                "amp" => out.push('&'),
                "lt" => out.push('<'),
                "gt" => out.push('>'),
                _ => {
                    let numeric = entity.strip_prefix('#').and_then(|n| {
                        let code = match n.strip_prefix('x').or_else(|| n.strip_prefix('X')) {
                            Some(hex) => u32::from_str_radix(hex, 16).ok()?,
                            None => n.parse::<u32>().ok()?,
                        };
                        char::from_u32(code)
                    });
                    match numeric {
                        Some(c) => out.push(c),
                        // Not a reference this function knows. Keep it verbatim
                        // rather than guessing; an unknown entity is text.
                        None => out.push_str(&tail[..=end]),
                    }
                }
            }
            rest = &tail[end + 1..];
        }
        out.push_str(rest);
        out
    }

    #[cfg(test)]
    mod html_tests {
        //! The HTML oracle must not be vacuous.
        //!
        //! Every other caller of the oracle (the seed replay, the regression
        //! replay, the fuzz target) only asserts that it does not panic, and a
        //! function that does nothing does not panic either. Fuzzing cannot
        //! catch that, because it only ever feeds the oracle inputs the
        //! sanitizer handles correctly.
        //!
        //! These call [`assert_html_safe`] directly with hand-written output
        //! the sanitizer would never emit, because that is the only way to
        //! observe an assertion that correct code never trips.

        use super::*;

        fn policy() -> UrlPolicy {
            UrlPolicy::new(
                "https://u.makenot.work/alice/proj",
                ["makenot.work".to_string(), "u.makenot.work".to_string()],
            )
            .unwrap()
        }

        fn check(clean: &str) {
            assert_html_safe(clean, "test", "test input", &policy());
        }

        #[test]
        fn accepts_what_the_sanitizer_actually_emits() {
            check("<p>hello</p>");
            check(r#"<a href="/local" rel="nofollow ugc">x</a>"#);
            check(r#"<img src="https://u.makenot.work/a.png" alt="a">"#);
            check(r#"<img srcset="/a.png 1x, /b.png 2x">"#);
            check(r##"<a href="#frag">x</a>"##);
            // Escaped markup inside an attribute VALUE is the sanitizer
            // working. The oracle skips quoted values by construction, and
            // these two cost docengine's oracle two false starts.
            check(r#"<p title="&lt;script&gt;alert(1)&lt;/script&gt;">x</p>"#);
            check(r#"<p title="javascript:alert(1)">x</p>"#);
            // Prose in a text node is text, not markup.
            check("<p>write javascript: in a sentence</p>");
            check("<p>onerror= is not an attribute here</p>");
        }

        #[test]
        #[should_panic(expected = "<script>")]
        fn catches_a_script_element() {
            check("<p>ok</p><script>alert(1)</script>");
        }

        #[test]
        #[should_panic(expected = "<script>")]
        fn catches_a_closing_script_element() {
            check("</script>");
        }

        #[test]
        #[should_panic(expected = "<iframe>")]
        fn catches_an_iframe() {
            check(r#"<iframe src="/x"></iframe>"#);
        }

        #[test]
        #[should_panic(expected = "<script>")]
        fn tag_names_are_matched_case_insensitively() {
            check("<ScRiPt>alert(1)</ScRiPt>");
        }

        #[test]
        #[should_panic(expected = "event handler")]
        fn catches_an_event_handler() {
            check(r#"<img src="/a.png" onerror="alert(1)">"#);
        }

        #[test]
        #[should_panic(expected = "event handler")]
        fn catches_an_event_handler_with_an_unquoted_value() {
            check("<img src=/a.png onerror=alert(1)>");
        }

        #[test]
        #[should_panic(expected = "event handler")]
        fn catches_an_event_handler_with_space_before_equals() {
            check(r#"<img src="/a.png" onerror = "alert(1)">"#);
        }

        #[test]
        #[should_panic(expected = "javascript:")]
        fn catches_a_javascript_href() {
            check(r#"<a href="javascript:alert(1)">x</a>"#);
        }

        #[test]
        #[should_panic(expected = "javascript:")]
        fn catches_a_javascript_href_single_quoted() {
            check("<a href='javascript:alert(1)'>x</a>");
        }

        #[test]
        #[should_panic(expected = "javascript:")]
        fn catches_a_scheme_hidden_behind_a_character_reference() {
            // A browser decodes before it resolves, so the oracle has to.
            // Without `decode_entities` this reads as harmless.
            check(r#"<a href="&#106;avascript:alert(1)">x</a>"#);
        }

        #[test]
        #[should_panic(expected = "vbscript:")]
        fn catches_a_vbscript_href() {
            check(r#"<a href="vbscript:msgbox(1)">x</a>"#);
        }

        #[test]
        #[should_panic(expected = "off-platform")]
        fn catches_an_off_platform_href() {
            check(r#"<a href="https://evil.example/x">x</a>"#);
        }

        #[test]
        #[should_panic(expected = "off-platform")]
        fn catches_an_off_platform_image() {
            check(r#"<img src="https://evil.example/px.png">"#);
        }

        #[test]
        #[should_panic(expected = "off-platform")]
        fn catches_one_bad_candidate_in_a_srcset() {
            // The whole attribute is untrustworthy if any candidate is: a
            // responsive image set cannot be partly on-platform.
            check(r#"<img srcset="/a.png 1x, https://evil.example/b.png 2x">"#);
        }

        #[test]
        #[should_panic(expected = "off-platform")]
        fn catches_a_protocol_relative_reference() {
            check(r#"<a href="//evil.example/x">x</a>"#);
        }

        #[test]
        #[should_panic(expected = "off-platform")]
        fn catches_an_unquoted_off_platform_value() {
            check("<a href=https://evil.example/x>x</a>");
        }
    }

    #[cfg(test)]
    mod tests {
        //! The oracle must not be vacuous.
        //!
        //! Every assertion it makes is loose enough not to report correct
        //! behaviour as a finding, and every such loosening is a chance to have
        //! loosened it into checking nothing. These feed hand-written output
        //! straight to [`assert_css_safe`], bypassing the sanitizer, which
        //! would never produce it, and assert that it still fires.

        use super::*;

        const CANVAS_CLASS: &str = "user-canvas";
        const CANVAS_ID: &str = "uc-abc";

        fn policy() -> UrlPolicy {
            UrlPolicy::new(
                "https://u.makenot.work/alice/proj",
                ["makenot.work".to_string(), "u.makenot.work".to_string()],
            )
            .unwrap()
        }

        fn check(clean: &str) {
            assert_css_safe(clean, "test", "test input", &policy());
        }

        /// Selector scoping, asserted directly.
        ///
        /// The fuzz path does not check this, so these tests are where the
        /// property lives. They are written in well-formed CSS, which is the
        /// input the check is sound over.
        fn check_scoped(clean: &str) {
            check_scoped_as(clean, CANVAS_CLASS, CANVAS_ID);
        }

        fn check_scoped_as(clean: &str, canvas_class: &str, canvas_id: &str) {
            let sheet = StyleSheet::parse(clean, super::super::css_sanitizer::parser_options())
                .expect("the fixture parses");
            walk(&sheet.rules, canvas_class, canvas_id);

            fn walk(rules: &CssRuleList<'_>, canvas_class: &str, canvas_id: &str) {
                for rule in &rules.0 {
                    match rule {
                        CssRule::Style(s) => {
                            assert_scoped(
                                &s.selectors,
                                "test",
                                "test input",
                                "",
                                canvas_class,
                                canvas_id,
                            );
                            walk(&s.rules, canvas_class, canvas_id);
                        }
                        CssRule::Media(r) => walk(&r.rules, canvas_class, canvas_id),
                        CssRule::Supports(r) => walk(&r.rules, canvas_class, canvas_id),
                        CssRule::LayerBlock(r) => walk(&r.rules, canvas_class, canvas_id),
                        _ => {}
                    }
                }
            }
        }

        #[test]
        fn accepts_properly_scoped_output() {
            check(".user-canvas#uc-abc .a{color:red}");
            check("@keyframes spin{0%{opacity:0}100%{opacity:1}}");
            check("@font-face{font-family:x;src:url(/f.woff2)}");
            check(".user-canvas#uc-abc .a{content:\"@import\"}");
            check(".user-canvas#uc-abc .a{background:url(https://u.makenot.work/y.png)}");
            // The neutralized form the sanitizer actually emits.
            check(".user-canvas#uc-abc .a{background:url()}");
        }

        #[test]
        fn accepts_a_canvas_inside_is() {
            // The shape lightningcss's nesting flattener actually emits, and
            // the one a printed-string check misread as an escape because
            // printing rendered it `:is()`.
            check_scoped("a b :is(.user-canvas#uc-abc .x){color:red}");
        }

        #[test]
        #[should_panic(expected = "escaped")]
        fn a_canvas_inside_not_does_not_scope() {
            // `:not(.user-canvas#uc-abc)` selects everything OUTSIDE the
            // canvas, so counting it would accept the exact inversion of the
            // property.
            check_scoped(":not(.user-canvas#uc-abc){color:red}");
        }

        #[test]
        #[should_panic(expected = "escaped")]
        fn half_the_canvas_compound_is_not_the_canvas() {
            // The class alone is not the canvas: another creator's canvas
            // carries the same class and a different id.
            check_scoped(".user-canvas .a{color:red}");
        }

        #[test]
        #[should_panic(expected = "escaped")]
        fn catches_a_rule_outside_the_canvas() {
            check_scoped(".somewhere-else{color:red}");
        }

        #[test]
        #[should_panic(expected = "escaped")]
        fn catches_a_rule_outside_the_canvas_inside_media() {
            check_scoped("@media print{.somewhere-else{color:red}}");
        }

        #[test]
        #[should_panic(expected = "@import")]
        fn catches_an_import_rule() {
            check("@import url(https://u.makenot.work/x.css);");
        }

        #[test]
        #[should_panic(expected = "off-platform")]
        fn catches_an_off_platform_url() {
            check(".user-canvas#uc-abc .a{background:url(https://evil.com/y.png)}");
        }

        #[test]
        #[should_panic(expected = "off-platform")]
        fn catches_an_off_platform_url_in_font_face() {
            check("@font-face{font-family:x;src:url(https://evil.com/f.woff2)}");
        }

        #[test]
        #[should_panic(expected = "escaped")]
        fn item_canvas_is_not_the_user_canvas() {
            // Guards the pairing rather than the parser: asserting the item
            // sheet against the user canvas must fail, or `check_css` could
            // check one sheet twice and report nothing.
            check_scoped_as(".item-canvas#ic-abc .a{color:red}", CANVAS_CLASS, CANVAS_ID);
        }
    }
}