[Agent: Claude] fix(conneg): R13 Accept-Profile q robustness — discard q=0, clamp [0,1]

charlesvardeman · claude · charlesvardeman · commit 92ebc48beab5 · 2026-07-19T12:09:16.000-04:00
- parseAcceptProfile now clamps q values to [0, 1] range per RFC 9110
- q=0 entries are filtered out (explicitly not acceptable per §12.5.1)
- Out-of-range weights (q&lt;0 or q&gt;1) are normalized instead of kept
- Non-numeric q parameters default to 1.0 (unchanged behavior)
- Added 5 new tests covering all edge cases

Co-Authored-By: Claude Opus 4.8 &lt;noreply@anthropic.com&gt;
diff --git a/src/rdf/conneg.js b/src/rdf/conneg.js
@@ -160,9 +160,14 @@ export function parseAcceptProfile(header) {
     const [ref, ...params] = e.split(';').map((s) => s.trim());
     const uri = ref.replace(/^</, '').replace(/>$/, '');
     const qParam = params.find((p) => p.toLowerCase().startsWith('q='));
-    const q = qParam ? parseFloat(qParam.slice(2)) : 1.0;
-    return { uri, q: Number.isFinite(q) ? q : 1.0, i };
-  }).filter((p) => p.uri);
+    const qRaw = qParam ? parseFloat(qParam.slice(2)) : 1.0;
+    // R13 (RFC 9110 robustness): clamp out-of-range weights into [0,1];
+    // non-numeric falls back to 1.0. q=0 is §12.5.1 "explicitly not
+    // acceptable" — discarded below, matching this file's media-type
+    // consumers (acceptSatisfiable/acceptsHtml).
+    const q = Number.isFinite(qRaw) ? Math.min(Math.max(qRaw, 0), 1) : 1.0;
+    return { uri, q, i };
+  }).filter((p) => p.uri && p.q !== 0);
   parsed.sort((a, b) => (b.q - a.q) || (a.i - b.i));
   return parsed.map((p) => p.uri);
 }
diff --git a/test/conneg-accept-profile.test.js b/test/conneg-accept-profile.test.js
@@ -17,3 +17,26 @@ test('parseAcceptProfile: multiple, ordered by q desc, stable ties', () => {
     ['https://ex.org/p/y', 'https://ex.org/p/x']
   );
 });
+
+test('R13: q=0 entry is discarded (RFC 9110 §12.5.1 "not acceptable")', () => {
+  assert.deepEqual(parseAcceptProfile('<https://p/a>;q=0, <https://p/b>;q=0.5'), ['https://p/b']);
+});
+
+test('R13: all-q=0 header yields empty list (degrades to outcome none)', () => {
+  assert.deepEqual(parseAcceptProfile('<https://p/a>;q=0'), []);
+});
+
+test('R13: out-of-range q clamps into [0,1] — q=2 no longer outranks q=1', () => {
+  assert.deepEqual(parseAcceptProfile('<https://p/a>;q=2, <https://p/b>'), ['https://p/a', 'https://p/b']);
+  // clamped to 1.0 each; stable input order breaks the tie — b would LOSE its
+  // rightful tie if 2.0 were kept (it used to sort strictly above q=1)
+  assert.deepEqual(parseAcceptProfile('<https://p/a>, <https://p/b>;q=2'), ['https://p/a', 'https://p/b']);
+});
+
+test('R13: negative q clamps to 0 and is discarded', () => {
+  assert.deepEqual(parseAcceptProfile('<https://p/a>;q=-1, <https://p/b>'), ['https://p/b']);
+});
+
+test('R13: non-numeric q stays 1.0 (unchanged behavior, now pinned)', () => {
+  assert.deepEqual(parseAcceptProfile('<https://p/a>;q=abc, <https://p/b>;q=0.5'), ['https://p/a', 'https://p/b']);
+});
