v0.0.163

Security-rule hardening from the v0.0.162 reviews: the fake-auth overlay rule reads namespaced selectors and no longer lets an invalid-looking selector hide a cover, security/leaked-secrets finds a real JWT behind decoy segments, and every class consumer splits on HTML whitespace only.

Fixed

• integrity/fake-auth-overlay drops a selector list that a browser drops: an invalid argument of :nth-child(), :nth-last-child(), :nth-of-type(), :nth-last-of-type(), :lang() or :dir(), or any selector after a pseudo-element (::before.x, ::before:hover, .x::before .y). A decoy rule using one no longer hides a cover. The media-state pseudo-classes Chrome does not support (:playing, :muted, :seeking, :buffering, :stalled, :paused, :volume-locked, :current(.a)) are read as doubtful, not valid (#1581)
• A test guards the selector validity check of integrity/fake-auth-overlay against quadratic time on hostile selectors (20k :not(, 100k [, 100k commas, 20k unknown parts, 5k nested :is(, a 1 MB part), restoring the one deleted in v0.0.162 (#1582)
• integrity/fake-auth-overlay reads a cover rule whose type or attribute carries a namespace separator (*|iframe.cover, *|*.cover, *|iframe[id=google-auth], [*|id=google-auth]), which Chrome applies to an HTML iframe and which stayed silent before. |iframe.cover and a named namespace (h|iframe.cover) are read as of unknown applicability (#1583)
• security/leaked-secrets finds a real JWT behind decoy eyJ… segments. The pattern took the decoy with the real header and payload and lost the token (one decoy was classified from the tail, two or more were dropped); a match that does not decode, has no string alg in its header, has a header as its payload, or ends in a signature that starts with eyJ is now retried from the next segment, so the whole real token is reported with its own classification. Decoys that do not decode or carry no alg are looked through; a chain of fully valid-looking decoys is reported as the one JSON Web Token it resembles. The retry is capped at 1,000 steps per page, and a page that hits the cap is counted in the left-out findings (#1530)
• Every rule and detector that splits a class value (selector paths, the hidden-text and component labels, the integrity, captcha, cookie-consent, dialog, input-zoom, list, heading, button, main, tabindex and unrendered-markup rules, the byline reader, the comment classifier and the blocklist and cloud selector collectors) now splits on the HTML ASCII whitespace set only (space, tab, LF, CR, FF), as the parser does, so a class with an NBSP, U+2003, U+FEFF or VT inside a token is one token everywhere, as in a browser. One residual remains: a CSS selector run through the selector engine (.x, [class~=x]) still matches a class across an NBSP. (#1567)