Security hardening: validate SemVer & --ignore-scripts in Vitest provider install and strip internal DTD subsets in JaCoCo XML #26

Summary

While integrating ub-mode and crapper (CRAP < 10 quality gates) into our autonomous agent security harness, we audited src/crapper/runners.py and src/crapper/coverage.py and identified two hardening opportunities when crapper is invoked by coding agents on third-party repositories:

1. Untrusted version string & lifecycle scripts during @vitest/coverage-v8 auto-install (src/crapper/runners.py, CWE-829):

   • _vitest_version() reads node_modules/vitest/package.json and accepts any string value (isinstance(data.get("version"), str)), passing f"@vitest/coverage-v8@{version}" to npm install --no-save --no-package-lock.
   • Enforce a strict SemVer check (_is_valid_semver) before interpolating version, and pass --ignore-scripts to npm install so lifecycle scripts are not triggered during coverage collection.

2. Internal DTD subset handling in _DOCTYPE regex for JaCoCo XML (src/crapper/coverage.py, CWE-776):

   • _DOCTYPE = re.compile(r"<!DOCTYPE[^>]*>", re.IGNORECASE) stops at the first > inside an internal DTD subset (<!DOCTYPE report [ <!ELEMENT ...> ]>), leaving trailing ]> tokens that cause ET.fromstring() to fail or leave internal entity declarations partially unstripped.
   • Updating _DOCTYPE to re.compile(r"<!DOCTYPE\b(?:[^>\[]|\[[^\]]*\])*>", re.IGNORECASE | re.DOTALL) strips both external and internal DTD subsets cleanly.

We have prepared a minimal, tested patch following /ub-mode principles (CRAP = 1.0 on all touched functions, 48/48 runner & coverage tests passing).