v0.0.162

Follow-ups from the v0.0.161 reviews: the fake-auth overlay rule reads more of the CSS without letting a doubtful selector hide a cover, the integrity rules read past the 4,096th attribute, the collected signal no longer keeps its page alive, and the special-use IPv6 policy covers ISATAP, 5f00::/16 and 100:0:0:1::/64.

Fixed

• The collected scriptSrcs, fingerprint and anchors signal fields are copied out of the page, so a crawl no longer keeps each page's HTML alive through them (#1565)
• integrity/fake-auth-overlay follows a browser on case, quirks mode and invalid selector lists (follow-ups of #1535). Selectors and attribute values were lower-cased with JavaScript toLowerCase, which folds the Kelvin sign U+212A to k, so [type="K"] (Kelvin) hid a cover whose frame has type=k that a browser draws; the fold is now ASCII only. A page with no doctype is in quirks mode, where a class and an id compare without case, so .cover{...} .COVER{position:static} no longer reads as a decoy that does not apply there. A selector list with a certain, browser-independent syntax error (.cover, !!, an empty part, a doubled combinator, a bad identifier, a bad attribute flag or value such as [x=y q]) is dropped whole, as every browser does, at the top level, in @media and nested, for a decoy rule (it no longer hides a cover) and for a cover rule; a part that may be valid in some engine (an unknown or engine-prefixed pseudo name such as :-moz-any-link or ::-moz-selection, a named namespace after @namespace, the s flag, an unterminated bracket) keeps the rule, read as undecided (it can report a cover as a lone signal, and cannot hide one); :is() and :where() forgive an invalid argument and are not checked. A selector that writes a class with a CSS escape and its optional space (.\63 over) was read as a descendant combinator and missed; it is read as one class. Limits that remain, stated exactly: a legacy doctype that triggers quirks mode is read as standards mode; a pseudo-class newer than the check's list is read as undecided, and :nth-child() and :lang() arguments are not checked; rules of unknown applicability (an @media that is not all or screen, @supports, @container, @scope, an ancestor part, a pseudo-class) cannot disable a decided cover, @layer order is not modelled, and a <style> with a media or type that keeps it from applying is read as applying. The rule's catalog text is unchanged. (#1566, refs #1535)
• The integrity rules read a control's href and cues past the 4,096th attribute, and integrity/obfuscated-script says when a link was cut (follow-ups of #1538). A link padded with about 20 KB of valueless attributes in front of its href or aria-label was counted in controlsUnread but its href and cue were not read. A second pass now reads the attributes past the 4,096th for href and the cue and label names, charged to the page's attribute budget; a control the budget cannot cover is still counted. An aria-labelledby with more than 16,000 leading spaces before its id was silently not read: the ids are now read from the first non-space character, and an id left past the 16,000-character slice is counted in controlsUnread. integrity/obfuscated-script at info ("single signal") now names the controls and templates the scan left unread and carries details.scanTruncated, as integrity/brand-impersonation does; its message text changes only on such a page. The documented visit limit is unchanged and exact: the aria-labelledby target reads stop after 300,000 visits plus at most 255, and the budget edge, a cached target re-read after it and the test hook's default are now pinned by tests. (#1559, refs #1538)
• The connect-time egress guard now refuses ISATAP literals that embed a private IPv4 address (::5efe:10.0.0.1), matching the policy classifier (#1577).
• The policy classifier now treats 100:0:0:1::/64 (the RFC 9780 dummy prefix) and 5f00::/16 (SRv6) as special-use, and no longer rejects the globally reachable anycast and AS112 exceptions inside 2001::/23 (2001:1::1 to 2001:1::3, 2001:3::/32, 2001:4:112::/48) or 192.0.0.9 and 192.0.0.10. NAT64 and 6to4 addresses stay non-public for policy even when they embed a public IPv4 (they are translation space, and the connect-time guard judges the embedded address on purpose), and a malformed IPv6 string is now non-public (fail closed). The docs now say Teredo and the other IETF assignments are 2001::/23 (#1572).