From 8b9300775c4ce1d3418fcb4410c6104657d5ba77 Mon Sep 17 00:00:00 2001
From: mrbobbytables <mrbobbytables@users.noreply.github.com>
Date: Thu, 8 Oct 2026 06:36:38 -0500
Subject: [PATCH] test: cover the CSS scanners' unterminated-string fallback
 arms

PR #1176 added string-literal skipping to the image-set() argument
walker and stripCssComments in scripts/lib/svg-active-content.mjs, each
with a close === -1 fallback that scans to the end of the fragment.
Neither arm had a test: coverage reported regions 414 and 463 uncovered.

Pin both arms: an unterminated string inside image-set() does not hide
the complete argument before it, and an unterminated CSS string copied
verbatim keeps a /* opener literal so a later url() is still reported.

scripts/lib/svg-active-content.mjs is now at its known floor: the only
uncovered region left is the documented-unreachable ?? '' fallback.

Closes #1197
Refs #1194

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: mrbobbytables <mrbobbytables@users.noreply.github.com>
---
 tests/svg-active-content.test.mjs | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/tests/svg-active-content.test.mjs b/tests/svg-active-content.test.mjs
index 9ea34e58..f306257d 100644
--- a/tests/svg-active-content.test.mjs
+++ b/tests/svg-active-content.test.mjs
@@ -1209,6 +1209,19 @@ test('an unclosed image-set() is read to the end rather than skipped', () => {
   ]);
 });
 
+test('an unterminated string inside image-set() does not hide earlier arguments', () => {
+  // The argument walk skips quoted strings as units; a string with no closing
+  // quote runs to the end of the fragment. The complete argument before it
+  // must still be collected and reported.
+  const svg =
+    '<svg xmlns="http://www.w3.org/2000/svg"><style>' +
+    'rect{cursor:image-set("https://evil.example/kept.png" 1x, "unterminated' +
+    '</style></svg>';
+  assert.deepEqual(findRemoteReferences(svg), [
+    'references a remote resource in a <style> block: https://evil.example/kept.png',
+  ]);
+});
+
 test('a parenthesis inside an image-set() string does not close the list', () => {
   const svg =
     '<svg xmlns="http://www.w3.org/2000/svg"><style>' +
@@ -1308,6 +1321,20 @@ test('an unterminated CSS comment runs to the end of the block', () => {
   ]);
 });
 
+test('an unterminated CSS string does not hide a later remote reference', () => {
+  // The comment stripper copies a quoted string as a unit; one with no
+  // closing quote is copied verbatim to the end of the fragment, so a `/*`
+  // opener inside it stays literal and the url() after it is still seen.
+  const svg =
+    '<svg xmlns="http://www.w3.org/2000/svg"><style>' +
+    'rect::before{content:"unterminated /* ' +
+    'url(https://evil.example/after-string.png)' +
+    '</style></svg>';
+  assert.deepEqual(findRemoteReferences(svg), [
+    'references a remote resource in a <style> block: https://evil.example/after-string.png',
+  ]);
+});
+
 test('a comment is replaced by a separator, not deleted', () => {
   // Deleting it would fuse the text either side into a `url(` token the
   // browser never sees, inventing a finding out of inert text.