[fabianekc]

What changes

DPP-SEC-021 ("HTML view uses no device functions") failed for HTML views built with Angular: zone.js in their polyfills tests whether navigator.geolocation exists and wraps getCurrentPosition and watchPosition, without calling them. The check found .geolocation and reported a use of the location.

device_features: forbidden now follows the definition in CRITERIA-FORMAT.md of dpp-criteria (DPP-SEC-021 version 2):

• JsTokens splits a script into tokens, as far as needed to tell code from comments, string, template and regular expression literals. Text that cannot be read as JavaScript raises an error; a script cut after 2 MB may end inside a token.
• DeviceUses looks in the tokens for uses: calls of device methods and of methods of device interfaces, reading navigator.connection, permission requests, new with device classes, listeners for device events, transport: ['sms']. Testing whether an interface exists, replacing its methods and passing it to a function together with the names of its members (the zone.js pattern) are not a use.
• References after which a use may follow that only running the script would show are doubts: a device method read without a call, an interface stored or passed on in another way, an event name passed to another function than addEventListener or on. Without a use, doubts give a warning ("no use of functions of the reader's device was found, but the HTML view may use them: …").
• If a script cannot be read as JavaScript, the previous search for names is the fallback; every name found is a doubt.
• HtmlCheck reports uses as before (one violation message) and, without a use, the doubts as a warning. Findings name the call instead of the name found, e.g. location (.getCurrentPosition() in inline script 1).

The markup part is unchanged. Scripts without any of the names are not tokenized, so pages without device interfaces cost no more than before.

Effect

Of the example passports of the listed services, one HTML view fails DPP-SEC-021 today only because of zone.js; it passes with this change. All other results stay the same. DPP-SEC-021 is proposed and does not count in "N of M".

Tests

• Test vectors under test/fixtures/files/html/DPP-SEC-021/: new valid ones (a polyfill that hooks into the location interface, feature detection, names in comments and strings), a new invalid one (the same polyfill next to a real call under another name) and a new warning/ directory (method read without a call, interface stored, event name passed to a function, script that cannot be read). With the previous check the new valid vectors fail.
• test/services/js_tokens_test.rb and test/services/device_uses_test.rb.
• The existing tests are unchanged except for the expected wording of the findings, which now name the call, and the minimum numbers of test vectors.
• JsTokens was compared token by token with a standard JavaScript parser on 78 scripts (about 5.8 million tokens: zone.js 0.8 to 0.15, Angular, React, Vue, jQuery, TypeScript, Leaflet, OpenLayers, MapLibre, Mapbox GL, highlight.js and others): no difference. Cut at random places, the tokens up to the cut stay the same.
• The full suite runs in the image.