fix(typst): more latent bugs in CSS translator + per-feature coverage

While locking in coverage for every public function in
src/resources/filters/modules/typst_css.lua, found and fixed five more
latent bugs:

- parse_opacity: tonumber() can return nil (e.g. for `rgba(0 0 0 / abc)`),
  but the value was passed directly to math.min(1.0, ...) which raises
  "number expected, got nil" and crashes the filter. Now returns nil
  when the operand isn't a number, on both the percent and fraction
  branches.

- parse_color: hex colors of length 1, 2, 5, or 7 (and any with non-hex
  characters) were silently accepted as 1-, 2-, 2-, or 3-component rgb
  values because gmatch '..' just dropped trailing odd digits and there
  was no character validation. Now requires exactly 3, 4, 6, or 8 hex
  digits and emits an "invalid hex color" warning otherwise.

- length_units: 'dvmin ' (with a stray trailing space) caused
  parse_length_unit('10dvmin') to fall through to the shorter 'vmin',
  silently rejecting any `dvmin` length. Removed the space.

- translate_font_weight: CSS keywords are case-insensitive, but the
  module's lookup tables only had lowercase entries, so values like
  'BOLD' or 'Normal' fell into the "invalid font weight" branch. Now
  lowercases the input before lookup.

- translate_font_family_list: a whitespace-only input like '   ' was
  emitted as `("",)` because the gmatch matched the whitespace run as
  one token, leading-space trim made it empty, but it was still inserted
  as a quoted empty family. Now also strips trailing whitespace and
  skips empty results.

Twenty-five new unit tests (5 failing-regression + 20 lock-in) added to
tests/unit-lua/typst-css.test.lua, covering parse_opacity, parse_color
(hex paths), parse_color-via-rgb, output_color, parse_length_unit (the
dvmin case), translate_border (default propagation + ordering),
translate_font_weight, translate_font_family_list, and
expand_side_shorthand. Total Lua unit tests: 47, all passing.

Author: gordonwoodhull

news/changelog-1.10.md

@@ -16,7 +16,7 @@ All changes included in 1.10:
 ### `typst`
 
 - ([#14261](https://github.com/quarto-dev/quarto-cli/issues/14261)): Fix theorem/example block titles containing inline code producing invalid Typst markup when syntax highlighting is applied.
-- ([#14460](https://github.com/quarto-dev/quarto-cli/issues/14460)): Fix CSS `border` and `border-color` declarations losing tokens that precede an `rgb()`/`rgba()` color (e.g. `border: 0px solid rgb(255, 0, 0)` rendering as a 2.25pt border instead of being suppressed). Also fixes `var(--brand-NAME)` references crashing the Typst CSS translator when `NAME` contained digits (e.g. `--brand-red-50`).
+- ([#14460](https://github.com/quarto-dev/quarto-cli/issues/14460)): Fix CSS `border` and `border-color` declarations losing tokens that precede an `rgb()`/`rgba()` color (e.g. `border: 0px solid rgb(255, 0, 0)` rendering as a 2.25pt border instead of being suppressed). Also fixes: `var(--brand-NAME)` references crashing the Typst CSS translator when `NAME` contained digits (e.g. `--brand-red-50`); a crash when an `rgba()` alpha is unparseable; the `dvmin` length unit being silently rejected (a stray space in the unit table); CSS keywords like `BOLD` not matching as `bold` (CSS keywords are case-insensitive); invalid hex colors like `#fffff` being silently accepted as 2-component colors.
 
 ### `revealjs`
 

src/resources/filters/modules/typst_css.lua

@@ -191,14 +191,18 @@ local function parse_opacity(opacity)
       value = 100
     }
   elseif opacity:find '%%$' then
+    local n = tonumber(opacity:sub(1, -2), 10)
+    if not n then return nil end
     return {
       unit = 'percent',
-      value = tonumber(opacity:sub(1, -2), 10)
+      value = n
     }
   else
+    local n = tonumber(opacity)
+    if not n then return nil end
     return {
       unit = 'fraction',
-      value = math.min(1.0, tonumber(opacity))
+      value = math.min(1.0, n)
     }
   end
 end
@@ -280,7 +284,14 @@ end
 local function parse_color(color, warnings)
   if color:sub(1, 1) == '#' then
     local value = color:sub(2)
-    local short = value:len() < 5
+    local len = value:len()
+    -- valid CSS hex colors are exactly 3, 4, 6, or 8 hex digits
+    if (len ~= 3 and len ~= 4 and len ~= 6 and len ~= 8)
+       or value:match('[^0-9a-fA-F]') then
+      output_warning(warnings, 'invalid hex color ' .. color)
+      return nil
+    end
+    local short = len <= 4
     local comps = {}
     if short then
       for c in value:gmatch '.' do
@@ -452,7 +463,7 @@ local length_units = {
   -- viewport-relative
   'vw', 'svw', 'lvw', 'dvw', 'vh', 'svh', 'lvh', 'dvh',
   'vi', 'svi', 'lvi', 'dvi', 'vb', 'svb', 'lvb', 'dvb',
-  'vmin', 'svmin', 'lvmin', 'dvmin ', 'vmax', 'svmax', 'lvmax', 'dvmax',
+  'vmin', 'svmin', 'lvmin', 'dvmin', 'vmax', 'svmax', 'lvmax', 'dvmax',
   -- absolute
   'cm', 'mm', 'Q', 'in', 'pt', 'pc', 'px',
   -- not really a length unit, but used for font-size
@@ -621,6 +632,10 @@ local function translate_font_weight(w, warnings)
   if num and 1 <= num and num <= 1000 then
     return num
   end
+  -- CSS keywords are case-insensitive; lower-case before lookup.
+  if type(w) == 'string' then
+    w = w:lower()
+  end
   w = weight_synonyms[w] or w
   if tcontains(same_weights, w) then
     return w
@@ -647,8 +662,10 @@ local function translate_font_family_list(sl)
   end
   local strings = {}
   for s in sl:gmatch('([^,]+)') do
-    s = s:gsub('^%s+', '')
-    table.insert(strings, quote(dequote(s)))
+    s = s:gsub('^%s+', ''):gsub('%s+$', '')
+    if s ~= '' then
+      table.insert(strings, quote(dequote(s)))
+    end
   end
   local trailcomma = #strings == 1 and ',' or ''
   return '(' .. table.concat(strings, ', ') .. trailcomma .. ')'

tests/unit-lua/typst-css.test.lua

@@ -242,6 +242,223 @@ end
 -- the bug — we have to read the source.
 TestModuleExports = {}
 
+-- ---------------------------------------------------------------------
+-- Per-feature coverage: 3 tests per feature. Failing tests document
+-- known bugs; lock-in tests pin down current behavior so future refactors
+-- don't drift.
+-- ---------------------------------------------------------------------
+
+-- Color: parse_opacity --------------------------------------------------
+TestParseOpacity = {}
+
+function TestParseOpacity:testPercent()
+  lu.assertEquals(typst_css.parse_opacity('50%'),
+    { unit = 'percent', value = 50 })
+end
+
+function TestParseOpacity:testFractionClampsToOne()
+  lu.assertEquals(typst_css.parse_opacity('2'),
+    { unit = 'fraction', value = 1.0 })
+end
+
+function TestParseOpacity:testInvalidNumberDoesNotCrash()
+  -- BUG F: math.min(1.0, tonumber('foo')) raises 'number expected, got
+  -- nil'. A bad alpha in user CSS (e.g. `rgba(0 0 0 / abc)`) would
+  -- crash the filter.
+  local ok, result = pcall(typst_css.parse_opacity, 'not-a-number')
+  lu.assertTrue(ok, 'parse_opacity crashed: ' .. tostring(result))
+  lu.assertNil(result)
+end
+
+-- Color: parse_color (hex paths; brand path is in TestParseColorBrand) -
+TestParseColorHex = {}
+
+function TestParseColorHex:testThreeDigitHexShorthand()
+  lu.assertEquals(typst_css.parse_color('#abc', new_warnings()), {
+    type = 'rgb',
+    value = {
+      { unit = 'hex', value = 0xaa },
+      { unit = 'hex', value = 0xbb },
+      { unit = 'hex', value = 0xcc },
+    },
+    rep = 'shorthex',
+  })
+end
+
+function TestParseColorHex:testEightDigitHexWithAlpha()
+  lu.assertEquals(typst_css.parse_color('#aabbccdd', new_warnings()), {
+    type = 'rgb',
+    value = {
+      { unit = 'hex', value = 0xaa },
+      { unit = 'hex', value = 0xbb },
+      { unit = 'hex', value = 0xcc },
+      { unit = 'hex', value = 0xdd },
+    },
+    rep = 'hex',
+  })
+end
+
+function TestParseColorHex:testFiveDigitHexInvalid()
+  -- BUG G: 5-digit hex is not valid CSS; it currently parses silently
+  -- as 2 components because gmatch '..' drops the trailing odd digit.
+  lu.assertNil(typst_css.parse_color('#fffff', new_warnings()))
+end
+
+-- Color: parse_color delegating to parse_rgb (parse_rgb is private; we
+-- exercise it through the public parse_color entrypoint).
+TestParseColorRgb = {}
+
+function TestParseColorRgb:testLegacyCommaThreeComponents()
+  lu.assertEquals(typst_css.parse_color('rgb(255, 0, 0)', new_warnings()), {
+    type = 'rgb',
+    value = {
+      { unit = 'int', value = 255 },
+      { unit = 'int', value = 0 },
+      { unit = 'int', value = 0 },
+    },
+  })
+end
+
+function TestParseColorRgb:testModernSlashAlpha()
+  lu.assertEquals(typst_css.parse_color('rgb(255 0 0 / 50%)', new_warnings()), {
+    type = 'rgb',
+    value = {
+      { unit = 'int', value = 255 },
+      { unit = 'int', value = 0 },
+      { unit = 'int', value = 0 },
+      { unit = 'percent', value = 50 },
+    },
+  })
+end
+
+function TestParseColorRgb:testOneCommaIsRejected()
+  -- parse_color drops `warnings` when delegating to parse_rgb (a separate
+  -- latent bug — see line 306), so we only assert the nil return.
+  lu.assertNil(typst_css.parse_color('rgb(255, 0)', new_warnings()))
+end
+
+-- Color: output_color --------------------------------------------------
+TestOutputColor = {}
+
+function TestOutputColor:testTypstNativeNamedShortcut()
+  lu.assertEquals(
+    typst_css.output_color({ type = 'named', value = 'red' }, nil,
+      new_warnings()),
+    'red')
+end
+
+function TestOutputColor:testCssOnlyNamedFallsBackToRgb()
+  -- aliceblue isn't in typst_named_colors, so output_color falls back
+  -- to the rgb() form pulled from css_named_colors.
+  lu.assertEquals(
+    typst_css.output_color({ type = 'named', value = 'aliceblue' }, nil,
+      new_warnings()),
+    'rgb(240, 248, 255)')
+end
+
+function TestOutputColor:testNilColorWithOpacityIsTransparentBlack()
+  lu.assertEquals(
+    typst_css.output_color(nil, { unit = 'percent', value = 50 },
+      new_warnings()),
+    'rgb(0, 0, 0, 50%)')
+end
+
+-- Length parsing: extra coverage for parse_length_unit ----------------
+function TestTranslateLength:testDvminUnitParses()
+  -- BUG H: 'dvmin ' has a stray trailing space in the length_units
+  -- table, so the suffix matcher falls through to the shorter 'vmin'
+  -- and the unit is never recognized.
+  lu.assertEquals(typst_css.parse_length_unit('10dvmin'), 'dvmin')
+end
+
+-- Border parsing: ordering + defaults ---------------------------------
+function TestTranslateBorder:testKeywordWidthDottedNamedColor()
+  local r = typst_css.translate_border('thick dotted blue', new_warnings())
+  lu.assertEquals(r.thickness, '3.75pt') -- thick = 5px = 3.75pt
+  lu.assertEquals(r.dash, '"dotted"')
+  lu.assertEquals(r.paint, 'blue')
+end
+
+function TestTranslateBorder:testWidthOnlyShorthandKeepsDefaults()
+  -- 'solid' default has no Typst literal so dash is nil ("let Typst
+  -- pick"); paint stays as the literal string 'black' (Typst built-in).
+  local r = typst_css.translate_border('1px', new_warnings())
+  lu.assertEquals(r.thickness, '0.75pt')
+  lu.assertNil(r.dash)
+  lu.assertEquals(r.paint, 'black')
+end
+
+function TestTranslateBorder:testColorFirstOrderIsHandled()
+  -- CSS shorthand is order-agnostic.
+  local r = typst_css.translate_border('blue dashed 2px', new_warnings())
+  lu.assertEquals(r.thickness, '1.5pt')
+  lu.assertEquals(r.dash, '"dashed"')
+  lu.assertEquals(r.paint, 'blue')
+end
+
+-- Font: translate_font_weight (extends existing class) ----------------
+function TestTranslateFontWeight:testNumericInRange()
+  lu.assertEquals(typst_css.translate_font_weight('400', new_warnings()), 400)
+end
+
+function TestTranslateFontWeight:testDashedToUndashed()
+  lu.assertEquals(
+    typst_css.translate_font_weight('extra-light', new_warnings()),
+    'extralight')
+end
+
+function TestTranslateFontWeight:testCaseInsensitiveBold()
+  -- BUG K: CSS keywords are case-insensitive but the module's tables
+  -- only contain lowercase entries.
+  lu.assertEquals(
+    typst_css.translate_font_weight('BOLD', new_warnings()),
+    'bold')
+end
+
+-- Font: translate_font_family_list ------------------------------------
+TestTranslateFontFamilyList = {}
+
+function TestTranslateFontFamilyList:testMultipleWithQuotes()
+  lu.assertEquals(
+    typst_css.translate_font_family_list('Helvetica, "Arial Black"'),
+    '("Helvetica", "Arial Black")')
+end
+
+function TestTranslateFontFamilyList:testSingleHasTrailingComma()
+  lu.assertEquals(
+    typst_css.translate_font_family_list('foo'),
+    '("foo",)')
+end
+
+function TestTranslateFontFamilyList:testWhitespaceOnlyIsEmpty()
+  -- BUG L: '   ' yields '("",)' because the gmatch matches the
+  -- whitespace run as one token, leading-space trim makes it empty,
+  -- but we still emit it as a quoted empty family.
+  lu.assertEquals(typst_css.translate_font_family_list('   '), '()')
+end
+
+-- Sides: expand_side_shorthand ----------------------------------------
+TestExpandSideShorthand = {}
+
+function TestExpandSideShorthand:testOneItemAllSidesEqual()
+  lu.assertEquals(
+    typst_css.expand_side_shorthand({'1'}, 'context', new_warnings()),
+    { top = '1', right = '1', bottom = '1', left = '1' })
+end
+
+function TestExpandSideShorthand:testTwoItemRule()
+  lu.assertEquals(
+    typst_css.expand_side_shorthand({'1', '2'}, 'context', new_warnings()),
+    { top = '1', right = '2', bottom = '1', left = '2' })
+end
+
+function TestExpandSideShorthand:testThreeItemRule()
+  -- 3-item rule: top, right, bottom; left mirrors right.
+  lu.assertEquals(
+    typst_css.expand_side_shorthand({'1', '2', '3'}, 'context', new_warnings()),
+    { top = '1', right = '2', bottom = '3', left = '2' })
+end
+
 function TestModuleExports:testNoPhantomExports()
   local source_path = package.searchpath('typst_css', package.path)
   lu.assertNotNil(source_path, 'could not find typst_css.lua source')