Commit 643ec5791dc for php.net
commit 643ec5791dc053613fc27b99d3bce8f2e2346edd
Merge: e783539fe58 fa825cb8a05
Author: Alexandre Daubois <alex.daubois@gmail.com>
Date: Mon Sep 14 11:02:43 2026 +0200
Merge branch 'PHP-8.5'
* PHP-8.5:
lexbor: Merge upstream memory safety fixes 8a14bc0 and f67ce4b
diff --cc ext/lexbor/patches/0001-Expose-line-and-column-information-for-use-in-PHP.patch
index b9c4cda7a03,9aec14cca5d..6bc4929e9b0
--- a/ext/lexbor/patches/0001-Expose-line-and-column-information-for-use-in-PHP.patch
+++ b/ext/lexbor/patches/0001-Expose-line-and-column-information-for-use-in-PHP.patch
@@@ -1,7 -1,7 +1,7 @@@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Sat, 26 Aug 2023 15:08:59 +0200
- Subject: [PATCH 01/13] Expose line and column information for use in PHP
-Subject: [PATCH 01/12] Expose line and column information for use in PHP
++Subject: [PATCH 01/15] Expose line and column information for use in PHP
---
source/lexbor/dom/interfaces/node.h | 2 ++
diff --cc ext/lexbor/patches/0002-Track-implied-added-nodes-for-options-use-in-PHP.patch
index 84868e209e7,9f4da029446..29bc4b12adc
--- a/ext/lexbor/patches/0002-Track-implied-added-nodes-for-options-use-in-PHP.patch
+++ b/ext/lexbor/patches/0002-Track-implied-added-nodes-for-options-use-in-PHP.patch
@@@ -1,7 -1,7 +1,7 @@@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Mon, 14 Aug 2023 20:18:51 +0200
- Subject: [PATCH 02/13] Track implied added nodes for options use in PHP
-Subject: [PATCH 02/12] Track implied added nodes for options use in PHP
++Subject: [PATCH 02/15] Track implied added nodes for options use in PHP
---
source/lexbor/html/tree.h | 3 +++
diff --cc ext/lexbor/patches/0003-Patch-utilities-and-data-structure-to-be-able-to-gen.patch
index 35750437667,fe7068d9bda..286fd2e16fd
--- a/ext/lexbor/patches/0003-Patch-utilities-and-data-structure-to-be-able-to-gen.patch
+++ b/ext/lexbor/patches/0003-Patch-utilities-and-data-structure-to-be-able-to-gen.patch
@@@ -1,7 -1,7 +1,7 @@@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Thu, 24 Aug 2023 22:57:48 +0200
- Subject: [PATCH 03/13] Patch utilities and data structure to be able to
-Subject: [PATCH 03/12] Patch utilities and data structure to be able to
++Subject: [PATCH 03/15] Patch utilities and data structure to be able to
generate smaller lookup tables
Changed the generation script to check if everything fits in 32-bits.
diff --cc ext/lexbor/patches/0004-Remove-unused-upper-case-tag-static-data.patch
index 029c0ff6933,35482388531..34b58217aa6
--- a/ext/lexbor/patches/0004-Remove-unused-upper-case-tag-static-data.patch
+++ b/ext/lexbor/patches/0004-Remove-unused-upper-case-tag-static-data.patch
@@@ -1,7 -1,7 +1,7 @@@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Wed, 29 Nov 2023 21:26:47 +0100
- Subject: [PATCH 04/13] Remove unused upper case tag static data
-Subject: [PATCH 04/12] Remove unused upper case tag static data
++Subject: [PATCH 04/15] Remove unused upper case tag static data
---
source/lexbor/tag/res.h | 2 ++
diff --cc ext/lexbor/patches/0005-Shrink-size-of-static-binary-search-tree.patch
index a8771beea0f,8e9b9524104..0c88f603172
--- a/ext/lexbor/patches/0005-Shrink-size-of-static-binary-search-tree.patch
+++ b/ext/lexbor/patches/0005-Shrink-size-of-static-binary-search-tree.patch
@@@ -1,7 -1,7 +1,7 @@@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Wed, 29 Nov 2023 21:29:31 +0100
- Subject: [PATCH 05/13] Shrink size of static binary search tree
-Subject: [PATCH 05/12] Shrink size of static binary search tree
++Subject: [PATCH 05/15] Shrink size of static binary search tree
This also makes it more efficient on the data cache.
---
diff --cc ext/lexbor/patches/0006-Patch-out-unused-CSS-style-code.patch
index a81d614575c,0f4e4cd8661..3e31f792588
--- a/ext/lexbor/patches/0006-Patch-out-unused-CSS-style-code.patch
+++ b/ext/lexbor/patches/0006-Patch-out-unused-CSS-style-code.patch
@@@ -1,7 -1,7 +1,7 @@@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Sun, 7 Jan 2024 21:59:28 +0100
- Subject: [PATCH 06/13] Patch out unused CSS style code
-Subject: [PATCH 06/12] Patch out unused CSS style code
++Subject: [PATCH 06/15] Patch out unused CSS style code
---
source/lexbor/css/rule.h | 2 ++
diff --cc ext/lexbor/patches/0007-Add-lxb_url_is_special-to-the-public-API-362.patch
index c49cf53628b,00000000000..505cb66844c
mode 100644,000000..100644
--- a/ext/lexbor/patches/0007-Add-lxb_url_is_special-to-the-public-API-362.patch
+++ b/ext/lexbor/patches/0007-Add-lxb_url_is_special-to-the-public-API-362.patch
@@@ -1,44 -1,0 +1,44 @@@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?M=C3=A1t=C3=A9=20Kocsis?= <kocsismate@woohoolabs.com>
+Date: Sun, 17 May 2026 22:17:14 +0200
- Subject: [PATCH 07/13] Add lxb_url_is_special() to the public API (#362)
++Subject: [PATCH 07/15] Add lxb_url_is_special() to the public API (#362)
+
+As https://wiki.php.net/rfc/uri_followup#uri_type_detection relies on this information.
+---
+ source/lexbor/url/url.c | 2 +-
+ source/lexbor/url/url.h | 9 +++++++++
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/source/lexbor/url/url.c b/source/lexbor/url/url.c
+index 5a11434..a5b323f 100644
+--- a/source/lexbor/url/url.c
++++ b/source/lexbor/url/url.c
+@@ -860,7 +860,7 @@ lxb_url_is_url_codepoint(lxb_codepoint_t cp)
+ return lxb_url_codepoint_alphanumeric[(lxb_char_t) cp] != 0xFF;
+ }
+
+-lxb_inline bool
++bool
+ lxb_url_is_special(const lxb_url_t *url)
+ {
+ return url->scheme.type != LXB_URL_SCHEMEL_TYPE__UNKNOWN;
+diff --git a/source/lexbor/url/url.h b/source/lexbor/url/url.h
+index 4ed3f32..6cc6f10 100644
+--- a/source/lexbor/url/url.h
++++ b/source/lexbor/url/url.h
+@@ -763,6 +763,15 @@ LXB_API lxb_status_t
+ lxb_url_search_params_serialize(lxb_url_search_params_t *search_params,
+ lexbor_callback_f cb, void *ctx);
+
++/**
++ * Returns whether the URL is special.
++ *
++ * @param[in] lxb_url_t *. Cannot be NULL.
++ * @return true if URL is special, false otherwise.
++ */
++LXB_API bool
++lxb_url_is_special(const lxb_url_t *url);
++
+ /*
+ * Inline functions.
+ */
diff --cc ext/lexbor/patches/0008-URL-fixed-setters-for-empty-hosts.patch
index c8c8e93686d,44f0f918458..1a6b8278a11
--- a/ext/lexbor/patches/0008-URL-fixed-setters-for-empty-hosts.patch
+++ b/ext/lexbor/patches/0008-URL-fixed-setters-for-empty-hosts.patch
@@@ -1,7 -1,7 +1,7 @@@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Alexander Borisov <lex.borisov@gmail.com>
Date: Fri, 26 Jun 2026 18:55:56 +0300
- Subject: [PATCH 08/13] URL: fixed setters for empty hosts.
-Subject: [PATCH 07/12] URL: fixed setters for empty hosts.
++Subject: [PATCH 08/15] URL: fixed setters for empty hosts.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
diff --cc ext/lexbor/patches/0009-URL-fixed-uninitialized-memory-in-the-path-buffer-gr.patch
index d95503378be,df1f6a1c2ac..0b942644bf8
--- a/ext/lexbor/patches/0009-URL-fixed-uninitialized-memory-in-the-path-buffer-gr.patch
+++ b/ext/lexbor/patches/0009-URL-fixed-uninitialized-memory-in-the-path-buffer-gr.patch
@@@ -1,7 -1,7 +1,7 @@@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Alexander Borisov <lex.borisov@gmail.com>
Date: Fri, 5 Jun 2026 22:13:32 +0300
- Subject: [PATCH 09/13] URL: fixed uninitialized memory in the path buffer
-Subject: [PATCH 08/12] URL: fixed uninitialized memory in the path buffer
++Subject: [PATCH 09/15] URL: fixed uninitialized memory in the path buffer
growth.
When a path was long enough to outgrow the on-stack buffer, the first
diff --cc ext/lexbor/patches/0010-Fix-parsing-for-URL-containing-empty-host-and-userin.patch
index 624943a4924,9abcd37fe3f..4ab6177f9a2
--- a/ext/lexbor/patches/0010-Fix-parsing-for-URL-containing-empty-host-and-userin.patch
+++ b/ext/lexbor/patches/0010-Fix-parsing-for-URL-containing-empty-host-and-userin.patch
@@@ -1,7 -1,7 +1,7 @@@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1t=C3=A9=20Kocsis?= <kocsismate@woohoolabs.com>
Date: Thu, 9 Jul 2026 21:51:05 +0200
- Subject: [PATCH 10/13] Fix parsing for URL containing empty host and userinfo
-Subject: [PATCH 09/12] Fix parsing for URL containing empty host and userinfo
++Subject: [PATCH 10/15] Fix parsing for URL containing empty host and userinfo
The returned error code (LXB_URL_ERROR_TYPE_INVALID_CREDENTIALS) apparently contradicts the specification:
diff --cc ext/lexbor/patches/0011-Percent-encode-the-caret-in-the-path.patch
index f971dc39cff,48777d5de6d..0a07b7095fd
--- a/ext/lexbor/patches/0011-Percent-encode-the-caret-in-the-path.patch
+++ b/ext/lexbor/patches/0011-Percent-encode-the-caret-in-the-path.patch
@@@ -1,7 -1,7 +1,7 @@@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1t=C3=A9=20Kocsis?= <kocsismate@woohoolabs.com>
Date: Fri, 10 Jul 2026 22:31:16 +0200
- Subject: [PATCH 11/13] Percent-encode the caret in the path
-Subject: [PATCH 10/12] Percent-encode the caret in the path
++Subject: [PATCH 11/15] Percent-encode the caret in the path
The caret (^) is part of the path percent-encode set:
diff --cc ext/lexbor/patches/0012-URL-added-public-IPv6-parser.patch
index a005dd13491,00000000000..42cd11a6729
mode 100644,000000..100644
--- a/ext/lexbor/patches/0012-URL-added-public-IPv6-parser.patch
+++ b/ext/lexbor/patches/0012-URL-added-public-IPv6-parser.patch
@@@ -1,320 -1,0 +1,320 @@@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Alexander Borisov <lex.borisov@gmail.com>
+Date: Wed, 12 Aug 2026 23:29:20 +0300
- Subject: [PATCH 12/13] URL: added public IPv6 parser.
++Subject: [PATCH 12/15] URL: added public IPv6 parser.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Added lxb_url_parse_host_ipv6() — a public entry point to the IPv6
+parser from the WHATWG specification:
+https://url.spec.whatwg.org/#concept-ipv6-parser
+
+The address is accepted both with and without the surrounding square
+brackets: "::1" and "[::1]" give the same result.
+
+https://github.com/lexbor/lexbor/pull/402
+
+The API was requested in #402 for use by php/php-src#22268.
+
+Suggested-by: Máté Kocsis (@kocsismate)
+---
+ source/lexbor/url/url.c | 42 +++++++
+ source/lexbor/url/url.h | 26 ++++
+ test/lexbor/url/parse_host_ipv6.c | 190 ++++++++++++++++++++++++++++++
+ 3 files changed, 258 insertions(+)
+ create mode 100644 test/lexbor/url/parse_host_ipv6.c
+
+diff --git a/source/lexbor/url/url.c b/source/lexbor/url/url.c
+index 8099c12..7487762 100644
+--- a/source/lexbor/url/url.c
++++ b/source/lexbor/url/url.c
+@@ -3752,6 +3752,46 @@ lxb_url_is_ipv4(lxb_url_parser_t *parser, const lxb_char_t *data,
+ return status != LXB_STATUS_ERROR;
+ }
+
++lxb_status_t
++lxb_url_parse_host_ipv6(lxb_url_parser_t *parser, const lxb_char_t *data,
++ size_t length, uint16_t *ipv6)
++{
++ lxb_status_t status;
++ lxb_url_parser_t self_parser;
++
++ if (parser == NULL) {
++ parser = &self_parser;
++
++ parser->log = NULL;
++ parser->idna = NULL;
++ parser->buffer = NULL;
++ }
++
++ if (data < data + length && *data == '[') {
++ if (data[length - 1] != ']') {
++ (void) lxb_url_log_append(parser, &data[length - 1],
++ LXB_URL_ERROR_TYPE_IPV6_UNCLOSED);
++
++ status = LXB_STATUS_ERROR_UNEXPECTED_DATA;
++
++ goto done;
++ }
++
++ data += 1;
++ length -= 2;
++ }
++
++ status = lxb_url_ipv6_parse(parser, data, data + length, ipv6);
++
++done:
++
++ if (parser == &self_parser) {
++ lxb_url_parser_destroy(parser, false);
++ }
++
++ return status;
++}
++
+ static lxb_status_t
+ lxb_url_ipv6_parse(lxb_url_parser_t *parser, const lxb_char_t *data,
+ const lxb_char_t *end, uint16_t *ipv6)
+@@ -3763,6 +3803,8 @@ lxb_url_ipv6_parse(lxb_url_parser_t *parser, const lxb_char_t *data,
+ const lxb_char_t *p;
+ lxb_url_error_type_t err_type;
+
++ memset(ipv6, 0x00, sizeof(uint16_t) * 8);
++
+ piece = ipv6;
+ compress = NULL;
+ p = data;
+diff --git a/source/lexbor/url/url.h b/source/lexbor/url/url.h
+index 6cc6f10..aa50485 100644
+--- a/source/lexbor/url/url.h
++++ b/source/lexbor/url/url.h
+@@ -321,6 +321,32 @@ lxb_url_parse_basic(lxb_url_parser_t *parser, lxb_url_t *url,
+ const lxb_char_t *data, size_t length,
+ lxb_url_state_t override_state, lxb_encoding_t encoding);
+
++/*
++ * IPv6 parser.
++ *
++ * This function is an implementation of IPv6 parsing according to the WHATWG
++ * specification.
++ * https://url.spec.whatwg.org/#concept-ipv6-parser
++ *
++ * The address can be passed both with and without the surrounding square
++ * brackets: "::1" and "[::1]" give the same result. If the opening bracket is
++ * present, the closing one is required.
++ *
++ * The output buffer is zeroed by the function, there is no need to prepare it.
++ * Use the lxb_url_serialize_host_ipv6() function to serialize the result.
++ *
++ * @param[in] lxb_url_parser_t *. Can be NULL.
++ * @param[in] Pointer to the beginning of the data. Not NULL.
++ * @param[in] Length of the data. Can be 0.
++ * @param[out] Buffer for eight (uint16_t[8]) IPv6 pieces. Not NULL. The value
++ * is meaningful only if LXB_STATUS_OK is returned.
++ *
++ * @return LXB_STATUS_OK if successful, otherwise an error status value.
++ */
++LXB_API lxb_status_t
++lxb_url_parse_host_ipv6(lxb_url_parser_t *parser, const lxb_char_t *data,
++ size_t length, uint16_t *ipv6);
++
+ /*
+ * Erase URL.
+ *
+diff --git a/test/lexbor/url/parse_host_ipv6.c b/test/lexbor/url/parse_host_ipv6.c
+new file mode 100644
+index 0000000..bbf5293
+--- /dev/null
++++ b/test/lexbor/url/parse_host_ipv6.c
+@@ -0,0 +1,190 @@
++/*
++ * Copyright (C) 2026 Alexander Borisov
++ *
++ * Author: Alexander Borisov <borisov@lexbor.com>
++ */
++
++#include <unit/test.h>
++#include <lexbor/url/url.h>
++
++
++typedef struct {
++ const lxb_char_t *input;
++ size_t length;
++ uint16_t ipv6[8];
++}
++ipv6_success_t;
++
++typedef struct {
++ const lxb_char_t *input;
++ lxb_url_error_type_t error;
++}
++ipv6_failure_t;
++
++
++static const ipv6_success_t success_entries[] = {
++ {
++ (const lxb_char_t *) "::",
++ sizeof("::") - 1,
++ {0, 0, 0, 0, 0, 0, 0, 0}
++ },
++ {
++ (const lxb_char_t *) "::1",
++ sizeof("::1") - 1,
++ {0, 0, 0, 0, 0, 0, 0, 1}
++ },
++ {
++ (const lxb_char_t *) "[::1]",
++ sizeof("[::1]") - 1,
++ {0, 0, 0, 0, 0, 0, 0, 1}
++ },
++ {
++ (const lxb_char_t *) "1:2:3:4:5:6:7:8",
++ sizeof("1:2:3:4:5:6:7:8") - 1,
++ {1, 2, 3, 4, 5, 6, 7, 8}
++ },
++ {
++ (const lxb_char_t *) "2001:db8::ff00:42:8329",
++ sizeof("2001:db8::ff00:42:8329") - 1,
++ {0x2001, 0x0db8, 0, 0, 0, 0xff00, 0x0042, 0x8329}
++ },
++ {
++ (const lxb_char_t *) "::ffff:192.0.2.1",
++ sizeof("::ffff:192.0.2.1") - 1,
++ {0, 0, 0, 0, 0, 0xffff, 0xc000, 0x0201}
++ },
++ {
++ (const lxb_char_t *) "[::1]ignored",
++ 5,
++ {0, 0, 0, 0, 0, 0, 0, 1}
++ }
++};
++
++static const ipv6_failure_t failure_entries[] = {
++ {
++ (const lxb_char_t *) "",
++ LXB_URL_ERROR_TYPE_IPV6_TOO_FEW_PIECES
++ },
++ {
++ (const lxb_char_t *) "[::1",
++ LXB_URL_ERROR_TYPE_IPV6_UNCLOSED
++ },
++ {
++ (const lxb_char_t *) ":",
++ LXB_URL_ERROR_TYPE_IPV6_INVALID_COMPRESSION
++ },
++ {
++ (const lxb_char_t *) "1::2::3",
++ LXB_URL_ERROR_TYPE_IPV6_MULTIPLE_COMPRESSION
++ },
++ {
++ (const lxb_char_t *) "1:2:3:4:5:6:7:8:9",
++ LXB_URL_ERROR_TYPE_IPV6_TOO_MANY_PIECES
++ },
++ {
++ (const lxb_char_t *) "1:2:3:4:5:6:7",
++ LXB_URL_ERROR_TYPE_IPV6_TOO_FEW_PIECES
++ },
++ {
++ (const lxb_char_t *) "1:2:3:4:5:6:7:g",
++ LXB_URL_ERROR_TYPE_IPV6_INVALID_CODE_POINT
++ },
++ {
++ (const lxb_char_t *) "1:2:3:4:5:6:7:1.2.3.4",
++ LXB_URL_ERROR_TYPE_IPV4_IN_IPV6_TOO_MANY_PIECES
++ },
++ {
++ (const lxb_char_t *) "::ffff:.1.2.3",
++ LXB_URL_ERROR_TYPE_IPV4_IN_IPV6_INVALID_CODE_POINT
++ },
++ {
++ (const lxb_char_t *) "::ffff:192.0.2.256",
++ LXB_URL_ERROR_TYPE_IPV4_IN_IPV6_OUT_OF_RANGE_PART
++ },
++ {
++ (const lxb_char_t *) "::ffff:192.0.2",
++ LXB_URL_ERROR_TYPE_IPV4_IN_IPV6_TOO_FEW_PARTS
++ }
++};
++
++
++TEST_BEGIN(parse_success)
++{
++ size_t length;
++ lxb_status_t status;
++ uint16_t ipv6[8];
++
++ length = sizeof(success_entries) / sizeof(ipv6_success_t);
++
++ for (size_t i = 0; i < length; i++) {
++ memset(ipv6, 0xff, sizeof(ipv6));
++
++ status = lxb_url_parse_host_ipv6(NULL, success_entries[i].input,
++ success_entries[i].length, ipv6);
++ test_eq(status, LXB_STATUS_OK);
++
++ for (size_t j = 0; j < 8; j++) {
++ test_eq_u_short(ipv6[j], success_entries[i].ipv6[j]);
++ }
++ }
++}
++TEST_END
++
++TEST_BEGIN(parse_failure)
++{
++ size_t length;
++ lxb_status_t status;
++ lxb_url_parser_t parser;
++ lexbor_plog_entry_t *error;
++
++ status = lxb_url_parser_init(&parser, NULL);
++ test_eq(status, LXB_STATUS_OK);
++
++ length = sizeof(failure_entries) / sizeof(ipv6_failure_t);
++
++ for (size_t i = 0; i < length; i++) {
++ status = lxb_url_parse_host_ipv6(
++ &parser, failure_entries[i].input,
++ strlen((const char *) failure_entries[i].input),
++ (uint16_t[8]) {0});
++
++ test_eq(status, LXB_STATUS_ERROR_UNEXPECTED_DATA);
++ test_ne(parser.log, NULL);
++ test_eq_size(lexbor_plog_length(parser.log), 1UL);
++
++ error = lexbor_array_obj_get(&parser.log->list, 0);
++ test_ne(error, NULL);
++ test_eq(error->id, failure_entries[i].error);
++
++ lxb_url_parser_clean(&parser);
++ }
++
++ lxb_url_parser_memory_destroy(&parser);
++ lxb_url_parser_destroy(&parser, false);
++}
++TEST_END
++
++TEST_BEGIN(parse_failure_without_parser)
++{
++ lxb_status_t status;
++ uint16_t ipv6[8];
++
++ static const lexbor_str_t input = lexbor_str("::ffff:192.0.2.256");
++
++ status = lxb_url_parse_host_ipv6(NULL, input.data, input.length, ipv6);
++ test_eq(status, LXB_STATUS_ERROR_UNEXPECTED_DATA);
++}
++TEST_END
++
++int
++main(int argc, const char *argv[])
++{
++ TEST_INIT();
++
++ TEST_ADD(parse_success);
++ TEST_ADD(parse_failure);
++ TEST_ADD(parse_failure_without_parser);
++
++ TEST_RUN("lexbor/url/parse_host_ipv6");
++ TEST_RELEASE();
++}
diff --cc ext/lexbor/patches/0013-URL-added-public-percent-encoder-API.patch
index c5d11c8f64f,00000000000..edefe14ebc0
mode 100644,000000..100644
--- a/ext/lexbor/patches/0013-URL-added-public-percent-encoder-API.patch
+++ b/ext/lexbor/patches/0013-URL-added-public-percent-encoder-API.patch
@@@ -1,626 -1,0 +1,626 @@@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Alexander Borisov <lex.borisov@gmail.com>
+Date: Thu, 13 Aug 2026 23:29:16 +0300
- Subject: [PATCH 13/13] URL: added public percent-encoder API.
++Subject: [PATCH 13/15] URL: added public percent-encoder API.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Added public entry points to the percent-encoder from the WHATWG
+specification:
+https://url.spec.whatwg.org/#percent-encoded-bytes
+
+ lxb_url_percent_encode_utf_8()
+ lxb_url_percent_encode_encoding()
+ lxb_url_get_percent_encoding_map()
+
+Both encoders take a caller-supplied table of 256 entries indexed by byte
+value, where each entry is a bit mask of lxb_url_map_type_t values, so the
+percent-encode sets can be adjusted without patching the library.
+lxb_url_get_percent_encoding_map() returns the built-in table for callers
+that need only the sets defined by the specification.
+
+https://github.com/lexbor/lexbor/pull/404
+
+The API was requested in #404 for use by PHP:
+https://wiki.php.net/rfc/uri_followup#percent-encoding_support
+
+Based-on-patch-by: Máté Kocsis (@kocsismate)
+---
+ source/lexbor/url/url.c | 93 ++++++++-----
+ source/lexbor/url/url.h | 96 +++++++++++++
+ test/lexbor/url/percent_encode.c | 228 +++++++++++++++++++++++++++++++
+ 3 files changed, 380 insertions(+), 37 deletions(-)
+ create mode 100644 test/lexbor/url/percent_encode.c
+
+diff --git a/source/lexbor/url/url.c b/source/lexbor/url/url.c
+index 7487762..69d9196 100644
+--- a/source/lexbor/url/url.c
++++ b/source/lexbor/url/url.c
+@@ -27,20 +27,6 @@
+ #define LXB_URL_BUFFER_NUM_SIZE 128
+
+
+-typedef enum {
+- LXB_URL_MAP_UNDEF = 0x00,
+- LXB_URL_MAP_C0 = 0x01,
+- LXB_URL_MAP_FRAGMENT = 0x02,
+- LXB_URL_MAP_QUERY = 0x04,
+- LXB_URL_MAP_SPECIAL_QUERY = 0x08,
+- LXB_URL_MAP_PATH = 0x10,
+- LXB_URL_MAP_USERINFO = 0x20,
+- LXB_URL_MAP_COMPONENT = 0x40,
+- LXB_URL_MAP_X_WWW_FORM = 0x80,
+- LXB_URL_MAP_ALL = 0xff
+-}
+-lxb_url_map_type_t;
+-
+ typedef enum {
+ LXB_URL_HOST_OPT_UNDEF = 0 << 0,
+ LXB_URL_HOST_OPT_NOT_SPECIAL = 1 << 0,
+@@ -563,7 +549,7 @@ lxb_url_path_fix_windows_drive(lxb_url_t *url, lxb_char_t *sbuf,
+ static lxb_status_t
+ lxb_url_percent_encode_after_encoding(const lxb_char_t *data,
+ const lxb_char_t *end, lexbor_str_t *str,
+- lexbor_mraw_t *mraw,
++ lexbor_mraw_t *mraw, const uint8_t *url_map,
+ const lxb_encoding_data_t *encoding,
+ lxb_url_map_type_t enmap,
+ bool space_as_plus);
+@@ -571,7 +557,7 @@ lxb_url_percent_encode_after_encoding(const lxb_char_t *data,
+ static lxb_status_t
+ lxb_url_percent_encode_after_utf_8(const lxb_char_t *data,
+ const lxb_char_t *end, lexbor_str_t *str,
+- lexbor_mraw_t *mraw,
++ lexbor_mraw_t *mraw, const uint8_t *url_map,
+ lxb_url_map_type_t enmap,
+ bool space_as_plus);
+
+@@ -1757,9 +1743,9 @@ again:
+ tmp = (pswd != NULL) ? pswd - 1 : p;
+
+ if (tmp > begin) {
+- status = lxb_url_percent_encode_after_utf_8(begin, tmp,
+- &url->username, url->mraw,
+- LXB_URL_MAP_USERINFO, false);
++ status = lxb_url_percent_encode_after_utf_8(begin,
++ tmp, &url->username, url->mraw, lxb_url_map,
++ LXB_URL_MAP_USERINFO, false);
+ if (status != LXB_STATUS_OK) {
+ lxb_url_parse_return(orig_data, buf, status);
+ }
+@@ -1768,8 +1754,8 @@ again:
+
+ if (pswd != NULL && p > pswd) {
+ status = lxb_url_percent_encode_after_utf_8(pswd, p,
+- &url->password, url->mraw,
+- LXB_URL_MAP_USERINFO, false);
++ &url->password, url->mraw, lxb_url_map,
++ LXB_URL_MAP_USERINFO, false);
+ if (status != LXB_STATUS_OK) {
+ lxb_url_parse_return(orig_data, buf, status);
+ }
+@@ -2319,8 +2305,8 @@ again:
+ if (p >= end) {
+ tmp_str.data = NULL;
+
+- status = lxb_url_percent_encode_after_utf_8(begin, p,
+- &tmp_str, url->mraw,
++ status = lxb_url_percent_encode_after_utf_8(begin, p, &tmp_str,
++ url->mraw, lxb_url_map,
+ LXB_URL_MAP_C0, false);
+ if (status != LXB_STATUS_OK) {
+ lxb_url_parse_return(orig_data, buf, status);
+@@ -2336,8 +2322,8 @@ again:
+ if (c == '#' || c == '?') {
+ tmp_str.data = NULL;
+
+- status = lxb_url_percent_encode_after_utf_8(begin, p,
+- &tmp_str, url->mraw,
++ status = lxb_url_percent_encode_after_utf_8(begin, p, &tmp_str,
++ url->mraw, lxb_url_map,
+ LXB_URL_MAP_C0, false);
+ if (status != LXB_STATUS_OK) {
+ lxb_url_parse_return(orig_data, buf, status);
+@@ -2407,7 +2393,8 @@ again:
+
+ status = lxb_url_percent_encode_after_encoding(begin, p,
+ &url->query,
+- url->mraw, enc,
++ url->mraw,
++ lxb_url_map, enc,
+ map_type, false);
+ if (status != LXB_STATUS_OK) {
+ lxb_url_parse_return(orig_data, buf, status);
+@@ -2461,7 +2448,7 @@ again:
+ }
+
+ status = lxb_url_percent_encode_after_utf_8(begin, p, &url->fragment,
+- url->mraw,
++ url->mraw, lxb_url_map,
+ LXB_URL_MAP_FRAGMENT, false);
+ lxb_url_parse_return(orig_data, buf, status);
+
+@@ -3161,10 +3148,23 @@ lxb_url_scheme_find(const lxb_char_t *data, size_t length)
+ return &lxb_url_scheme_res[LXB_URL_SCHEMEL_TYPE__UNKNOWN];
+ }
+
++lxb_status_t
++lxb_url_percent_encode_encoding(const lxb_char_t *data, size_t length,
++ lexbor_str_t *str, lexbor_mraw_t *mraw,
++ const uint8_t *url_map,
++ const lxb_encoding_data_t *encoding,
++ lxb_url_map_type_t enmap,
++ bool space_as_plus)
++{
++ return lxb_url_percent_encode_after_encoding(data, data + length, str, mraw,
++ url_map, encoding, enmap,
++ space_as_plus);
++}
++
+ static lxb_status_t
+ lxb_url_percent_encode_after_encoding(const lxb_char_t *data,
+ const lxb_char_t *end, lexbor_str_t *str,
+- lexbor_mraw_t *mraw,
++ lexbor_mraw_t *mraw, const uint8_t *url_map,
+ const lxb_encoding_data_t *encoding,
+ lxb_url_map_type_t enmap,
+ bool space_as_plus)
+@@ -3182,7 +3182,8 @@ lxb_url_percent_encode_after_encoding(const lxb_char_t *data,
+
+ if (encoding->encoding == LXB_ENCODING_UTF_8) {
+ return lxb_url_percent_encode_after_utf_8(data, end, str, mraw,
+- enmap, space_as_plus);
++ url_map, enmap,
++ space_as_plus);
+ }
+
+ lxb_url_encoding_init(encoding, &encode);
+@@ -3193,7 +3194,7 @@ lxb_url_percent_encode_after_encoding(const lxb_char_t *data,
+ /* Only valid for UTF-8. */
+
+ while (p < end) {
+- if (lxb_url_map[*p++] & enmap) {
++ if (url_map[*p++] & enmap) {
+ length += 2;
+ }
+ }
+@@ -3249,7 +3250,7 @@ lxb_url_percent_encode_after_encoding(const lxb_char_t *data,
+ return LXB_STATUS_ERROR_MEMORY_ALLOCATION;
+ }
+ }
+- else if (lxb_url_map[c] & enmap) {
++ else if (url_map[c] & enmap) {
+ percent[1] = lexbor_str_res_char_to_two_hex_value[c][0];
+ percent[2] = lexbor_str_res_char_to_two_hex_value[c][1];
+
+@@ -3280,10 +3281,20 @@ lxb_url_percent_encode_after_encoding(const lxb_char_t *data,
+ return LXB_STATUS_OK;
+ }
+
++lxb_status_t
++lxb_url_percent_encode_utf_8(const lxb_char_t *data, size_t length,
++ lexbor_str_t *str, lexbor_mraw_t *mraw,
++ const uint8_t *url_map, lxb_url_map_type_t enmap,
++ bool space_as_plus)
++{
++ return lxb_url_percent_encode_after_utf_8(data, data + length, str, mraw,
++ url_map, enmap, space_as_plus);
++}
++
+ static lxb_status_t
+ lxb_url_percent_encode_after_utf_8(const lxb_char_t *data,
+ const lxb_char_t *end, lexbor_str_t *str,
+- lexbor_mraw_t *mraw,
++ lexbor_mraw_t *mraw, const uint8_t *url_map,
+ lxb_url_map_type_t enmap,
+ bool space_as_plus)
+ {
+@@ -3298,7 +3309,7 @@ lxb_url_percent_encode_after_utf_8(const lxb_char_t *data,
+ /* Only valid for UTF-8. */
+
+ while (p < end) {
+- if (lxb_url_map[*p++] & enmap) {
++ if (url_map[*p++] & enmap) {
+ length += 2;
+ }
+ }
+@@ -3317,7 +3328,7 @@ lxb_url_percent_encode_after_utf_8(const lxb_char_t *data,
+ if (space_as_plus && c == ' ') {
+ *pd++ = '+';
+ }
+- else if (lxb_url_map[c] & enmap) {
++ else if (url_map[c] & enmap) {
+ *pd++ = '%';
+ *pd++ = lexbor_str_res_char_to_two_hex_value[c][0];
+ *pd++ = lexbor_str_res_char_to_two_hex_value[c][1];
+@@ -3335,6 +3346,12 @@ lxb_url_percent_encode_after_utf_8(const lxb_char_t *data,
+ return LXB_STATUS_OK;
+ }
+
++const uint8_t *
++lxb_url_get_percent_encoding_map(void)
++{
++ return lxb_url_map;
++}
++
+ static lxb_status_t
+ lxb_url_host_parse(lxb_url_parser_t *parser, const lxb_char_t *data,
+ const lxb_char_t *end, lxb_url_host_t *host,
+@@ -4065,7 +4082,7 @@ lxb_url_opaque_host_parse(lxb_url_parser_t *parser, const lxb_char_t *data,
+ host->type = LXB_URL_HOST_TYPE_OPAQUE;
+
+ return lxb_url_percent_encode_after_utf_8(data, end, &host->u.opaque, mraw,
+- LXB_URL_MAP_C0, false);
++ lxb_url_map, LXB_URL_MAP_C0, false);
+ }
+
+ static lxb_status_t
+@@ -4344,7 +4361,8 @@ lxb_url_api_username_set(lxb_url_t *url,
+
+ return lxb_url_percent_encode_after_utf_8(username, username + length,
+ &url->username, url->mraw,
+- LXB_URL_MAP_USERINFO, false);
++ lxb_url_map, LXB_URL_MAP_USERINFO,
++ false);
+ }
+
+ lxb_status_t
+@@ -4364,7 +4382,8 @@ lxb_url_api_password_set(lxb_url_t *url,
+
+ return lxb_url_percent_encode_after_utf_8(password, password + length,
+ &url->password, url->mraw,
+- LXB_URL_MAP_USERINFO, false);
++ lxb_url_map, LXB_URL_MAP_USERINFO,
++ false);
+ }
+
+ lxb_status_t
+diff --git a/source/lexbor/url/url.h b/source/lexbor/url/url.h
+index aa50485..d2c9308 100644
+--- a/source/lexbor/url/url.h
++++ b/source/lexbor/url/url.h
+@@ -81,6 +81,20 @@ typedef enum {
+ }
+ lxb_url_state_t;
+
++typedef enum {
++ LXB_URL_MAP_UNDEF = 0x00,
++ LXB_URL_MAP_C0 = 0x01,
++ LXB_URL_MAP_FRAGMENT = 0x02,
++ LXB_URL_MAP_QUERY = 0x04,
++ LXB_URL_MAP_SPECIAL_QUERY = 0x08,
++ LXB_URL_MAP_PATH = 0x10,
++ LXB_URL_MAP_USERINFO = 0x20,
++ LXB_URL_MAP_COMPONENT = 0x40,
++ LXB_URL_MAP_X_WWW_FORM = 0x80,
++ LXB_URL_MAP_ALL = 0xff
++}
++lxb_url_map_type_t;
++
+ /*
+ * New values can only be added downwards.
+ * Before LXB_URL_SCHEMEL_TYPE__LAST_ENTRY.
+@@ -347,6 +361,88 @@ LXB_API lxb_status_t
+ lxb_url_parse_host_ipv6(lxb_url_parser_t *parser, const lxb_char_t *data,
+ size_t length, uint16_t *ipv6);
+
++/*
++ * UTF-8 percent-encoder.
++ *
++ * Percent-encodes bytes from data according to url_map and appends the result
++ * to str. A byte is encoded as "%HH" when the result of
++ * (url_map[byte] & enmap) is non-zero. Uppercase hexadecimal digits are used.
++ * If space_as_plus is true, U+0020 SPACE is encoded as '+' before the map is
++ * checked.
++ *
++ * The input is expected to be valid UTF-8; the function does not validate it.
++ *
++ * @param[in] Pointer to UTF-8 data. Not NULL.
++ * @param[in] Length of data. Can be 0.
++ * @param[in, out] Output string. Can be uninitialized (data = NULL). Encoded
++ * data is appended to any existing content. Not NULL.
++ * @param[in] Memory object used to allocate or resize the output string. Not
++ * NULL.
++ * @param[in] Table of 256 entries indexed by input byte, each entry is a bit
++ * mask of lxb_url_map_type_t values. Not NULL.
++ * @param[in] Mask selecting the bytes to percent-encode.
++ * @param[in] Replace U+0020 SPACE with '+' if true.
++ *
++ * @return LXB_STATUS_OK if successful, otherwise an error status value.
++ */
++LXB_API lxb_status_t
++lxb_url_percent_encode_utf_8(const lxb_char_t *data, size_t length,
++ lexbor_str_t *str, lexbor_mraw_t *mraw,
++ const uint8_t *url_map, lxb_url_map_type_t enmap,
++ bool space_as_plus);
++
++/*
++ * Percent-encode after encoding.
++ *
++ * Converts valid UTF-8 data to the specified encoding and appends the
++ * percent-encoded result to str. Each encoded byte for which
++ * (url_map[byte] & enmap) is non-zero is written as "%HH" using uppercase
++ * hexadecimal digits. If a code point cannot be represented in the target
++ * encoding, its percent-encoded numeric character reference is appended.
++ *
++ * If encoding is UTF-8, no conversion is performed. If space_as_plus is true,
++ * an encoded U+0020 SPACE is replaced with '+' before the map is checked.
++ * The input is expected to be valid UTF-8; the function does not validate it.
++ *
++ * @param[in] Pointer to UTF-8 data. Not NULL.
++ * @param[in] Length of data. Can be 0.
++ * @param[in, out] Output string. Can be uninitialized (data = NULL). Encoded
++ * data is appended to any existing content. Not NULL.
++ * @param[in] Memory object used to allocate or resize the output string. Not
++ * NULL.
++ * @param[in] Table of 256 entries indexed by encoded byte, each entry is a bit
++ * mask of lxb_url_map_type_t values. Not NULL.
++ * @param[in] Target encoding. Not NULL.
++ * @param[in] Mask selecting the bytes to percent-encode.
++ * @param[in] Replace an encoded U+0020 SPACE with '+' if true.
++ *
++ * @return LXB_STATUS_OK if successful, otherwise an error status value.
++ */
++LXB_API lxb_status_t
++lxb_url_percent_encode_encoding(const lxb_char_t *data, size_t length,
++ lexbor_str_t *str, lexbor_mraw_t *mraw,
++ const uint8_t *url_map,
++ const lxb_encoding_data_t *encoding,
++ lxb_url_map_type_t enmap,
++ bool space_as_plus);
++
++/*
++ * Get the URL percent-encoding map.
++ *
++ * Returns the built-in lookup table for the percent-encode sets defined by the
++ * URL specification. The table contains 256 entries indexed by byte value.
++ * Each entry is a bit mask of the lxb_url_map_type_t sets in which the byte
++ * must be percent-encoded.
++ *
++ * The returned map can be passed to lxb_url_percent_encode_utf_8() or
++ * lxb_url_percent_encode_encoding(). It has static storage duration and must
++ * not be modified or freed.
++ *
++ * @return Pointer to a read-only table of 256 entries. Never NULL.
++ */
++LXB_API const uint8_t *
++lxb_url_get_percent_encoding_map(void);
++
+ /*
+ * Erase URL.
+ *
+diff --git a/test/lexbor/url/percent_encode.c b/test/lexbor/url/percent_encode.c
+new file mode 100644
+index 0000000..361e22e
+--- /dev/null
++++ b/test/lexbor/url/percent_encode.c
+@@ -0,0 +1,228 @@
++/*
++ * Copyright (C) 2026 Alexander Borisov
++ *
++ * Author: Alexander Borisov <borisov@lexbor.com>
++ */
++
++#include <unit/test.h>
++#include <lexbor/url/url.h>
++
++
++typedef struct {
++ const lexbor_str_t input;
++ const lexbor_str_t output;
++ lxb_encoding_t encoding;
++ lxb_url_map_type_t enmap;
++ bool space_as_plus;
++ const uint8_t *url_map;
++ const lexbor_str_t initial;
++}
++percent_encode_entry_t;
++
++
++static const uint8_t custom_url_map[256] = {
++ ['a'] = LXB_URL_MAP_QUERY,
++ ['b'] = LXB_URL_MAP_PATH
++};
++
++static const percent_encode_entry_t entries[] = {
++ {
++ lexbor_str(""),
++ lexbor_str(""),
++ LXB_ENCODING_UTF_8,
++ LXB_URL_MAP_COMPONENT,
++ false,
++ NULL,
++ lexbor_str("")
++ },
++ {
++ lexbor_str("AZaz09-._~!*'()"),
++ lexbor_str("AZaz09-._~!*'()"),
++ LXB_ENCODING_UTF_8,
++ LXB_URL_MAP_COMPONENT,
++ false,
++ NULL,
++ lexbor_str("")
++ },
++ {
++ lexbor_str("\x00" "A /?\xC3\xA9"),
++ lexbor_str("%00A%20%2F%3F%C3%A9"),
++ LXB_ENCODING_UTF_8,
++ LXB_URL_MAP_COMPONENT,
++ false,
++ NULL,
++ lexbor_str("")
++ },
++ {
++ lexbor_str("A b"),
++ lexbor_str("prefix:A+b"),
++ LXB_ENCODING_UTF_8,
++ LXB_URL_MAP_COMPONENT,
++ true,
++ NULL,
++ lexbor_str("prefix:")
++ },
++ {
++ lexbor_str("\xE2\x89\xA1\xE2\x80\xBD"),
++ lexbor_str("%E2%89%A1%E2%80%BD"),
++ LXB_ENCODING_UTF_8,
++ LXB_URL_MAP_SPECIAL_QUERY,
++ false,
++ NULL,
++ lexbor_str("")
++ },
++ {
++ lexbor_str("\xE2\x89\xA1"),
++ lexbor_str("%81%DF"),
++ LXB_ENCODING_SHIFT_JIS,
++ LXB_URL_MAP_SPECIAL_QUERY,
++ false,
++ NULL,
++ lexbor_str("")
++ },
++ {
++ lexbor_str("\xE2\x80\xBD"),
++ lexbor_str("%26%238253%3B"),
++ LXB_ENCODING_SHIFT_JIS,
++ LXB_URL_MAP_SPECIAL_QUERY,
++ false,
++ NULL,
++ lexbor_str("")
++ },
++ {
++ lexbor_str("1+1 \xE2\x89\xA1 2%20\xE2\x80\xBD"),
++ lexbor_str("1+1%20%81%DF%202%20%26%238253%3B"),
++ LXB_ENCODING_SHIFT_JIS,
++ LXB_URL_MAP_SPECIAL_QUERY,
++ false,
++ NULL,
++ lexbor_str("")
++ },
++ {
++ lexbor_str("\xC2\xA5"),
++ lexbor_str("%1B(J\\%1B(B"),
++ LXB_ENCODING_ISO_2022_JP,
++ LXB_URL_MAP_SPECIAL_QUERY,
++ false,
++ NULL,
++ lexbor_str("")
++ },
++ {
++ lexbor_str("caf\xC3\xA9"),
++ lexbor_str("caf%E9"),
++ LXB_ENCODING_WINDOWS_1252,
++ LXB_URL_MAP_COMPONENT,
++ false,
++ NULL,
++ lexbor_str("")
++ },
++ {
++ lexbor_str("\xD0\xAF"),
++ lexbor_str("%DF"),
++ LXB_ENCODING_WINDOWS_1251,
++ LXB_URL_MAP_COMPONENT,
++ false,
++ NULL,
++ lexbor_str("")
++ },
++ {
++ lexbor_str("\xE4\xB8\xAD\xE6\x96\x87"),
++ lexbor_str("%A4%A4%A4%E5"),
++ LXB_ENCODING_BIG5,
++ LXB_URL_MAP_COMPONENT,
++ false,
++ NULL,
++ lexbor_str("")
++ },
++ {
++ lexbor_str("a b+c~"),
++ lexbor_str("a+b%2Bc%7E"),
++ LXB_ENCODING_UTF_8,
++ LXB_URL_MAP_X_WWW_FORM,
++ true,
++ NULL,
++ lexbor_str("")
++ },
++ {
++ lexbor_str("abc"),
++ lexbor_str("%61bc"),
++ LXB_ENCODING_UTF_8,
++ LXB_URL_MAP_QUERY,
++ false,
++ custom_url_map,
++ lexbor_str("")
++ }
++};
++
++
++TEST_BEGIN(percent_encode)
++{
++ size_t length;
++ lxb_char_t *data;
++ lxb_status_t status;
++ lexbor_mraw_t mraw;
++ lexbor_str_t str;
++ const uint8_t *url_map, *default_url_map;
++ const lxb_encoding_data_t *encoding;
++ const percent_encode_entry_t *entry;
++
++ status = lexbor_mraw_init(&mraw, 1024);
++ test_eq(status, LXB_STATUS_OK);
++
++ default_url_map = lxb_url_get_percent_encoding_map();
++ test_ne(default_url_map, NULL);
++
++ length = sizeof(entries) / sizeof(percent_encode_entry_t);
++
++ for (size_t i = 0; i < length; i++) {
++ entry = &entries[i];
++ encoding = lxb_encoding_data(entry->encoding);
++ test_ne(encoding, NULL);
++
++ str = (lexbor_str_t) {0};
++
++ if (entry->initial.length != 0) {
++ data = lexbor_str_init_append(&str, &mraw, entry->initial.data,
++ entry->initial.length);
++ test_ne(data, NULL);
++ }
++
++ url_map = entry->url_map;
++ if (url_map == NULL) {
++ url_map = default_url_map;
++ }
++
++ status = lxb_url_percent_encode_encoding(entry->input.data,
++ entry->input.length,
++ &str, &mraw, url_map, encoding,
++ entry->enmap,
++ entry->space_as_plus);
++ test_eq(status, LXB_STATUS_OK);
++
++ if (str.length != entry->output.length
++ || memcmp(str.data, entry->output.data, str.length) != 0)
++ {
++ TEST_PRINTLN("Percent-encode entry %zu (%s)", i + 1,
++ encoding->name);
++ }
++
++ test_eq_str_n(str.data, str.length, entry->output.data,
++ entry->output.length);
++
++ lexbor_str_destroy(&str, &mraw, false);
++ }
++
++ lexbor_mraw_destroy(&mraw, false);
++}
++TEST_END
++
++int
++main(int argc, const char *argv[])
++{
++ TEST_INIT();
++
++ TEST_ADD(percent_encode);
++
++ TEST_RUN("lexbor/url/percent_encode");
++ TEST_RELEASE();
++}
diff --cc ext/lexbor/patches/0014-CSS-fixed-heap-buffer-overflow-in-lexbor-contains-pa.patch
index 00000000000,3928daa7eab..05e049118c9
mode 000000,100644..100644
--- a/ext/lexbor/patches/0014-CSS-fixed-heap-buffer-overflow-in-lexbor-contains-pa.patch
+++ b/ext/lexbor/patches/0014-CSS-fixed-heap-buffer-overflow-in-lexbor-contains-pa.patch
@@@ -1,0 -1,35 +1,35 @@@
+ From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+ From: Alexander Borisov <lex.borisov@gmail.com>
+ Date: Fri, 5 Jun 2026 22:34:23 +0300
-Subject: [PATCH 11/12] CSS: fixed heap buffer overflow in :lexbor-contains()
++Subject: [PATCH 14/15] CSS: fixed heap buffer overflow in :lexbor-contains()
+ parsing.
+
+ The contains string buffer was allocated by the size of the string
+ structure instead of the content length, so any value longer than
+ that overflowed the buffer.
+
+ Per report from Xiansheng Cao (@HMF2021)
+ ---
+ source/lexbor/css/selectors/pseudo_state.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+ diff --git a/source/lexbor/css/selectors/pseudo_state.c b/source/lexbor/css/selectors/pseudo_state.c
+ index 263ca52..2321ddf 100644
+ --- a/source/lexbor/css/selectors/pseudo_state.c
+ +++ b/source/lexbor/css/selectors/pseudo_state.c
+ @@ -227,13 +227,12 @@ again:
+ contains->insensitive = false;
+ str = &contains->str;
+
+ - str->data = lexbor_mraw_alloc(parser->memory->mraw,
+ - sizeof(lexbor_str_t));
+ + str->data = lexbor_mraw_alloc(parser->memory->mraw, length + 1);
+ if (str->data == NULL) {
+ return lxb_css_parser_memory_fail(parser);
+ }
+
+ - memcpy(str->data, data, length + 1);
+ + memcpy(str->data, data, length);
+
+ str->length = length;
+ str->data[length] = '\0';
diff --cc ext/lexbor/patches/0015-Encoding-fixed-buffer-overflows-in-malformed-decode-.patch
index 00000000000,32f3aff4ee7..31c3f5f95f9
mode 000000,100644..100644
--- a/ext/lexbor/patches/0015-Encoding-fixed-buffer-overflows-in-malformed-decode-.patch
+++ b/ext/lexbor/patches/0015-Encoding-fixed-buffer-overflows-in-malformed-decode-.patch
@@@ -1,0 -1,97 +1,97 @@@
+ From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+ From: Alexander Borisov <lex.borisov@gmail.com>
+ Date: Wed, 10 Jun 2026 19:50:10 +0300
-Subject: [PATCH 12/12] Encoding: fixed buffer overflows in malformed decode
++Subject: [PATCH 15/15] Encoding: fixed buffer overflows in malformed decode
+ replay.
+
+ Fixed out-of-bounds writes in buffering decoders when replacement output
+ fills the caller-provided codepoint buffer and decoder replay continues in
+ the same call.
+
+ Affected decoders:
+ - GB18030 malformed third/fourth byte replay.
+ - ISO-2022-JP malformed escape replay.
+ - UTF-16BE/LE invalid surrogate replay.
+
+ Per report from @hurric9-droid on GitHub.
+ ---
+ source/lexbor/encoding/decode.c | 37 +++++++++++++++++++++++++++++----
+ 1 file changed, 33 insertions(+), 4 deletions(-)
+
+ diff --git a/source/lexbor/encoding/decode.c b/source/lexbor/encoding/decode.c
+ index 3e48971..05c4b9b 100644
+ --- a/source/lexbor/encoding/decode.c
+ +++ b/source/lexbor/encoding/decode.c
+ @@ -912,6 +912,13 @@ lxb_encoding_decode_iso_2022_jp(lxb_encoding_decode_t *ctx,
+ }
+ LXB_ENCODING_DECODE_ERROR_END();
+
+ + if (ctx->buffer_used >= ctx->buffer_length) {
+ + iso->prepand = iso->lead;
+ + iso->lead = 0x00;
+ +
+ + return LXB_STATUS_SMALL_BUFFER;
+ + }
+ +
+ byte = iso->lead;
+ iso->lead = 0x00;
+
+ @@ -1279,6 +1286,12 @@ lxb_encoding_decode_utf_16(lxb_encoding_decode_t *ctx, bool is_be,
+ }
+ LXB_ENCODING_DECODE_ERROR_END();
+
+ + if (ctx->buffer_used >= ctx->buffer_length) {
+ + ctx->u.lead = lead + 0x01;
+ +
+ + return LXB_STATUS_SMALL_BUFFER;
+ + }
+ +
+ goto lead_state;
+ }
+
+ @@ -1723,6 +1736,13 @@ lxb_encoding_decode_gb18030(lxb_encoding_decode_t *ctx,
+ }
+ LXB_ENCODING_DECODE_ERROR_END();
+
+ + if (ctx->buffer_used >= ctx->buffer_length) {
+ + ctx->prepend = true;
+ + ctx->u.gb18030.first = second;
+ +
+ + return LXB_STATUS_SMALL_BUFFER;
+ + }
+ +
+ first = second;
+
+ goto prepend_first;
+ @@ -1756,11 +1776,8 @@ lxb_encoding_decode_gb18030(lxb_encoding_decode_t *ctx,
+ }
+ LXB_ENCODING_DECODE_ERROR_END();
+
+ - LXB_ENCODING_DECODE_APPEND_WO_CHECK(ctx, second);
+ -
+ - if (ctx->buffer_used == ctx->buffer_length) {
+ + if (ctx->buffer_used >= ctx->buffer_length) {
+ ctx->prepend = true;
+ - ctx->have_error = true;
+
+ /* First is a fake for trigger */
+ ctx->u.gb18030.first = 0x01;
+ @@ -1770,6 +1787,18 @@ lxb_encoding_decode_gb18030(lxb_encoding_decode_t *ctx,
+ return LXB_STATUS_SMALL_BUFFER;
+ }
+
+ + LXB_ENCODING_DECODE_APPEND_WO_CHECK(ctx, second);
+ +
+ + if (ctx->buffer_used >= ctx->buffer_length) {
+ + ctx->prepend = true;
+ +
+ + ctx->u.gb18030.first = third;
+ + ctx->u.gb18030.second = 0x00;
+ + ctx->u.gb18030.third = 0x00;
+ +
+ + return LXB_STATUS_SMALL_BUFFER;
+ + }
+ +
+ first = third;
+
+ goto prepend_first;