Repository navigation
test: kill the surviving mutants in the SVG active content gate - #1793
Conversation
The last full-tree mutation run left 195 surviving mutants in scripts/lib/svg-active-content.mjs. A table-driven vocabulary test now accepts every exported allowlist entry (and rejects root-only attributes off the root), and the gate tests pin the exact wording of each finding, the one-finding error cascade, DOCTYPE stripping byte for byte, processing instruction ordering, encoding declaration boundaries, the css-tree tokenizer branches (escaped url(, nested functions, @import, identifiers that merely end in "import", parenthesized groups) and the residual list when stripping fails. Scoped score for the file: 82.1% to 97.5% (932 killed, 24 survived, 0 without coverage). The survivors are equivalent: sentinel array initialisers, the `/[(@]/` fast path, `close <= 0` on indexOf results, `raw.trim()` before url.decode (which trims), the `end === -1` guard behind sax's own well-formedness error, `parser.resume()` after clearing the error, left-operand `true` on `event.type === 'close'`, and the unreachable `pi` fallthrough in rebuild. Refs cncf#1788 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: mrbobbytables <mrbobbytables@users.noreply.github.com>
✅ Deploy Preview for endusers ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Scanner pass: no findings. The two touched test files ( 🐝 Hive Agent: — hive: agent=scanner backend=copilot model=kimi-k3 copilot=1.0.88 |
![hivecommons-hive[bot]](https://avatars.githubusercontent.com/in/3568013?s=60&v=4){kind=small}
There was a problem hiding this comment.
Read the diff against main at f179016 (two test files, 369 insertions, no source changes) and ran both suites locally after npm ci: TZ=UTC node --test tests/svg-active-content*.test.mjs passes 402/402. The vocabulary file is table-driven off the module's own exported allowlists, so a dropped entry fails a named case, and the root-only attributes are asserted rejected off the root — exactly the mutant classes the body describes. CI's mutation-testing check is green on this head.
The 24 survivors left are explained plausibly in the body (sentinel initialisers, default-equivalent trims, guards behind sax's own well-formedness error); I did not re-run Stryker to confirm each one, so treat the equivalence list as the author's claim, not verified here.
Looks correct to me — a grounded strengthening of the gate's assertions with no production risk. This is a fork branch the hive cannot push to, so it needs a human merge once the in-progress e2e checks finish.
— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.88
…rayDeclaration (#1807) Annotate the 41 surviving mutants that the backlog groups in #1788 verified as equivalent (#1789, #1790, #1793, #1794, #1795) with Stryker disable directives that carry the reason, so they report as Ignored instead of Survived and no longer surface as mutation findings. Exclude the ArrayDeclaration mutator in stryker.config.mjs: every instance that survived on main seeded an accumulator or fallback whose contents are unobservable. Hoist the landscape source URL in DirectoryFreshness into a const so its directive can attach outside the JSX. Document the directive placement rules in CONTRIBUTING. Refs #1788 Signed-off-by: mrbobbytables <mrbobbytables@users.noreply.github.com> Co-authored-by: mrbobbytables <mrbobbytables@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Summary
Group A of #1788: kills the surviving mutants in
scripts/lib/svg-active-content.mjs, the single largest contributor to the full-tree mutation backlog (195 survivors in the last scheduled run). Tests only; no source changes.tests/svg-active-content-vocabulary.test.mjs: table-driven acceptance of every exported allowlist entry (elements, attributes, XHTML, xlink/xml, metadata namespaces) and rejection of root-only attributes off the root, so dropping any entry fails a test.tests/svg-active-content.test.mjs: pins the exact wording of each finding, the one-finding error cascade, DOCTYPE detection and byte-for-byte stripping, processing-instruction ordering, encoding-declaration boundaries, the css-tree tokenizer branches (escapedurl(, nested functions,@import, identifiers that merely end inimport, parenthesized groups) and the full residual list when stripping fails.Mutation score (scoped to the file)
The 24 survivors are equivalent mutants, left without suppression: sentinel array initialisers (
["Stryker was here"]on arrays that are immediately pushed to), the/[(@]/fast path (skipping it only costs tokenizer time),close <= 0vsclose < 0onindexOfresults that cannot be 0 after a token end,raw.trim()beforeurl.decode(which trims itself), theend === -1guard behind sax's own well-formedness error,parser.resume()after the error is already cleared, left-operandtrueonevent.type === 'close', theurl(Function branch always being followed by a String token, and the unreachablepifallthrough inrebuild.Validation
TZ=UTC node --test tests/svg-active-content*.test.mjs: 402 passnpm run test:unit:coverage:check: passnpm run check:format,check:lint,check:duplication,check:unused,check:spelling,check:markdown: passRefs #1788