yrby 0.8.1 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ea4b274bb5d8928c48900e3fe08b1e2b5d93c7e9970fe8ee6d453366e2c2c9be
-  data.tar.gz: 6df2e03ac56e522e1ba854266dd193124514d0fe5f756ad79f1038e4704103b9
+  metadata.gz: cc870d86089bc5373cbac29455b1b7818c4a710b4ca1c8c12eeee2939faa8758
+  data.tar.gz: 66c41fad450c8e71a23a166bc1f0e6a83def6bdcc94c79724bb63d7691a28f16
 SHA512:
-  metadata.gz: e45d38cf54bf43b63a72e0127c89aedd3f5c713a7677afddbdd5c2b4c702af1d755bc1c15fdf22d0f118d9611dc7dd06843efb7ec94cb89d6a898cf6f6d44b30
-  data.tar.gz: 651268d3b107633e104e346840083bcf5b1ecda00ae3d4586ed89cdb235b8bda34df34c6d60fcde23fdd47b18d0439ff9fca5e36683322799fc66d86157923bb
+  metadata.gz: 0725a1a0966f516316041b3d46edcd946783802691d568ed139549fbc120515b809ca368784f23f522bad7e0a4f24abb46951985ff0935627b1733d2e3b47cd3
+  data.tar.gz: 6fcf5914510b36d10fe3bf344725cb151f945c57df95b692cdd5a4344ceeba2e81ed6455a0ec3b4071ae5a9c569de4bc0ae3bea9aa6b40b399594c296fb71a0b

data/CHANGELOG.md

@@ -6,6 +6,96 @@ to follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## yrby-client 0.7.1 - 2026-11-03
+
+### Fixed
+
+- yrby-client: `connect()` restores the presence that `disconnect()` removed,
+  unless the app set or cleared presence in between. Before this, a `renew()`
+  (which document sessions call with a renewed grant) or a manual reconnect
+  left the local awareness state `null`, and y-protocols ignores
+  `setLocalStateField` while it is `null`, so the user stayed invisible to
+  peers until reload.
+
+## [0.9.0] - 2026-11-03
+
+### Experimental
+
+These are new, and they may change in a minor release. See
+[docs/experimental.md](docs/experimental.md).
+
+- Live handles that write to a document from Ruby: `Doc#get_map`,
+  `get_array`, `get_text`, and `get_xml_text` return `Y::Map`, `Y::Array`,
+  `Y::Text`, and `Y::XmlText`. A write is a CRDT edit, so a person editing the
+  same document keeps their change. A handle stays on the shared type it was
+  made for while others edit around it, and releases the GVL like `Doc`.
+  Indexes are Ruby characters, and negative indexes count from the end as in
+  Ruby. `push`, `<<`, and `insert` return the receiver, and `each`
+  without a block an Enumerator, as Ruby's own do.
+- `Doc#edit { }` runs a block that writes to the document and returns the
+  update its writes produced, or nil when it wrote nothing. It is the unit a
+  process saves and sends as it writes.
+- `Y::Lexical` and `Y::Lexxy` write Lexical's node shape: `append_paragraph`,
+  `append_heading`, `append_list`, `append_quote`, `append_code`,
+  `append_markdown`, `insert_paragraph`, `append_text`, `replace_runs`, and
+  `delete_block`.
+  Text takes formatted runs (`bold:`, `italic:`, `code:`, `link:`, and so on).
+  What Ruby writes renders the same as what a person typed. Each helper
+  writes its block in one transaction. `XmlText#push_xml_text` and
+  `insert_xml_text` take the new block's content, and `append` and
+  `replace` write content into a block.
+- `append_markdown` writes a link to a script as plain text.
+- `Y::Anchor`, from `XmlText#anchor`, is a block's identity as a value to
+  store or send. `Doc#block_at` and `Doc#find` resolve it.
+  `relative_position(index)` builds the Yjs caret shape editors put in
+  awareness, and `Text#index_at(position)` resolves one.
+- `Doc#apply_update_changes(update, root)` applies an update and returns the
+  ordinals of the top-level blocks it touched. It reads the blocks and
+  applies the update in one transaction, so another thread's write doesn't
+  show up in the result.
+- `Y::Awareness` builds and reads presence frames, and `Doc#client_id` returns
+  the id a document writes under.
+
+### Changed
+
+- yrby and the renderer crates are on yrs 0.28. yrs 0.28 replaced the number
+  variants of `Any` with `Any::Number(Number::Int | Number::Float)`. Because
+  the crates take yrs types, this is a breaking release for them:
+  `lexical-yjs-html` 0.2.0, `prosemirror-yjs-html` 0.2.0, and
+  `yjs-html-core` 0.2.0 need yrs 0.28.
+
+### Fixed
+
+- The Lexical and ProseMirror renderers (and the `lexical-yjs-html` and
+  `prosemirror-yjs-html` 0.2.1 crates) refuse a link to a script: Lexical
+  sends it to `about:blank` and ProseMirror empties its `href`, as each
+  editor does.
+- A `Timeout`, `Thread#raise`, or `Thread#kill` that arrives during a
+  native call raises once the call returns. Before, Ruby could jump over
+  the extension's Rust frames without running their cleanup.
+
+## yrby-client 0.7.0 - 2026-10-08
+
+This release updates yrby-client only. The gems are unchanged.
+
+### Added
+
+- yrby-client: `<yrby-document>` has a read-only `current` property that
+  returns the `yrby:synced` detail of the bound session, or undefined when
+  nothing is bound. A binding that loads after the event fired can bind from
+  it.
+- yrby-client: `<yrby-document>` has a `retry()` method that acquires the
+  document again after its session blocked or was discarded, without changing
+  whether the page is live. It works from a lease abort handler or right after
+  `session.discard()`, so a binding can replace a broken document with a fresh
+  session. It replaces calling `activate()`, which is internal to the Turbo
+  adapter.
+- yrby-client: `YrbyDocumentElement.consumer` accepts a function that returns
+  a consumer or a promise of one. The element calls it when it first needs a
+  consumer and reuses the result. A function that throws or rejects is called
+  again on the next attempt, and assigning a different value replaces the
+  result.
+
 ## [0.8.1] - 2026-10-03
 
 ### Added

data/Cargo.lock

@@ -13,9 +13,9 @@ dependencies = [
 
 [[package]]
 name = "arc-swap"
-version = "1.8.0"
+version = "1.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51d03449bb8ca2cc2ef70869af31463d1ae5ccc8fa3e334b307203fbf815207e"
+checksum = "380962b3d93b99642e50b9febf72c071e97e8b32d86eae9cf4ef582bb960ae6e"
 dependencies = [
  "rustversion",
 ]
@@ -117,9 +117,9 @@ checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
 [[package]]
 name = "dashmap"
-version = "6.1.0"
+version = "6.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5041cc499144891f3790297212f32a74fb938e5136a14943f338ef9e0ae276cf"
+checksum = "e6361d5c062261c78a176addb82d4c821ae42bed6089de0e12603cd25de2059c"
 dependencies = [
  "cfg-if",
  "crossbeam-utils",
@@ -229,7 +229,7 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
 
 [[package]]
 name = "lexical-yjs-html"
-version = "0.1.4"
+version = "0.2.1"
 dependencies = [
  "serde_json",
  "yjs-html-core",
@@ -308,9 +308,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.21.3"
+version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
 [[package]]
 name = "parking"
@@ -348,7 +348,7 @@ dependencies = [
 
 [[package]]
 name = "prosemirror-yjs-html"
-version = "0.1.5"
+version = "0.2.1"
 dependencies = [
  "serde_json",
  "yjs-html-core",
@@ -400,6 +400,27 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cca7ad6a7e21e72151d56fe2495a259b5670e204c3adac41ee7ef676ea08117a"
 
+[[package]]
+name = "rb-sys-test-helpers"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccc637c53cad6a6b49ad51c5857c64e36bd70c955ffafe9dc9cc5bc9dd0b3b18"
+dependencies = [
+ "rb-sys",
+ "rb-sys-env 0.2.3",
+ "rb-sys-test-helpers-macros",
+]
+
+[[package]]
+name = "rb-sys-test-helpers-macros"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1c1fce35d9ac77a2745e539232fb82a75856675a5daf4ef8b1ca994d89f8b3f"
+dependencies = [
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "redox_syscall"
 version = "0.5.18"
@@ -628,7 +649,7 @@ checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
 [[package]]
 name = "yjs-html-core"
-version = "0.1.3"
+version = "0.2.1"
 dependencies = [
  "serde_json",
  "yrs",
@@ -643,6 +664,7 @@ dependencies = [
  "prosemirror-yjs-html",
  "rb-sys",
  "rb-sys-env 0.1.2",
+ "rb-sys-test-helpers",
  "serde_json",
  "yjs-html-core",
  "yrs",
@@ -650,9 +672,9 @@ dependencies = [
 
 [[package]]
 name = "yrs"
-version = "0.27.2"
+version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccc6a0094c76c87b1b72ca0579bf7aa00f540957182264e6561cbde707c2ce51"
+checksum = "52c70dc8beca8666c77612a96889106ca3cd65318609721f464624ff79685da9"
 dependencies = [
  "arc-swap",
  "async-lock",

data/README.md

@@ -101,6 +101,7 @@ bin/rails generate yrby:install && bin/rails db:migrate
   - [Rendering to HTML](#rendering-to-html)
   - [Protocol codec (module functions)](#protocol-codec-module-functions)
   - [ActionCable Integration](#actioncable-integration)
+- [Experimental: writing from Ruby](#experimental-writing-from-ruby)
 - [Thread Safety](#thread-safety)
   - [Parallelism (GVL release)](#parallelism-gvl-release)
 - [Message Type Constants](#message-type-constants)
@@ -117,7 +118,9 @@ primitives. By default the Ruby side treats a document as opaque CRDT state. It
 applies updates, answers sync handshakes, and records deltas without reading
 the contents, and the browser editor decides what shape the document has. When
 you do need to look inside, `Doc#read_text` and `Doc#read_map` rebuild it in
-Ruby.
+Ruby, and live handles (`Doc#get_map`, `get_array`, `get_text`,
+`get_xml_text`) write to it. The handles are
+[experimental](docs/experimental.md).
 
 ## Durability and delivery
 
@@ -680,7 +683,7 @@ gets blocked at the next reconnect. To avoid that, pair `expires_in:` with
 # app/controllers/posts_controller.rb
 def grant
   @post = current_user.posts.find(params[:id])   # your own authorization, again
-  render json: { grant: @post.collaborative_sgid(:body, expires_in: 10.minutes) }
+  render json: { grant: @post.collaborative_document(:body).grant(expires_in: 10.minutes) }
 end
 ```
 
@@ -744,7 +747,7 @@ up the record from it, so the page decides which document the client gets.
 
 ```erb
 <%# the view picks the document and signs it %>
-<%= tag.div data: { grant: post.collaborative_sgid(:body) } %>
+<%= tag.div data: { grant: post.collaborative_document(:body).grant } %>
 ```
 
 ```ruby
@@ -1074,6 +1077,18 @@ The browser clients manage presence (cursors, selections). The server doesn't
 set or hold presence state, and it relays awareness frames without reading
 them. See `yrby-client` for the client-side awareness API.
 
+## Experimental: writing from Ruby
+
+These APIs are new. They may change in any minor release, and they aren't
+covered by yrby's usual compatibility promise.
+[docs/experimental.md](docs/experimental.md) documents them:
+
+- Live `Y::Map`, `Y::Array`, and `Y::Text` handles that write to a document
+- Writing Lexical rich text from Ruby, with `Y::Lexical` and `Y::Lexxy`
+- Anchors: a block's identity as a value
+- Streaming into a document with `Doc#edit`
+- Editing a record's document from Ruby
+
 ## Thread Safety
 
 You can share a `Doc` across Ruby threads. Puma workers, ActionCable connection

data/ext/yrby/Cargo.toml

@@ -12,7 +12,7 @@ crate-type = ["cdylib"]
 [dependencies]
 magnus = "0.8"
 rb-sys = "0.9"
-yrs = { version = "0.27", features = ["sync"] }
+yrs = { version = "0.28", features = ["sync"] }
 serde_json = "1.0"
 yjs-html-core = { path = "crates/html-core" }
 lexical-yjs-html = { path = "crates/lexical-html" }
@@ -20,3 +20,5 @@ prosemirror-yjs-html = { path = "crates/prosemirror-html" }
 
 [dev-dependencies]
 rb-sys-env = "0.1"
+magnus = { version = "0.8", features = ["embed"] }
+rb-sys-test-helpers = "0.3"

data/ext/yrby/crates/html-core/Cargo.toml

@@ -3,7 +3,7 @@ name = "yjs-html-core"
 description = "Internal core for the lexical-yjs-html and prosemirror-yjs-html renderer crates; depend on those instead"
 repository = "https://github.com/jpcamara/yrby"
 readme = "README.md"
-version = "0.1.3"
+version = "0.2.1"
 edition = "2024"
 rust-version = "1.85"
 authors = ["JP Camara <johnpcamara@gmail.com>"]
@@ -12,5 +12,5 @@ keywords = ["yjs", "crdt", "yrs", "html", "rendering"]
 categories = ["text-processing", "web-programming"]
 
 [dependencies]
-yrs = { version = "0.27", features = ["sync"] }
+yrs = { version = "0.28", features = ["sync"] }
 serde_json = "1.0"

data/ext/yrby/crates/html-core/src/lib.rs

@@ -18,7 +18,7 @@
 //! every binding and caller.
 
 use std::collections::{BTreeMap, BTreeSet, HashMap};
-use yrs::{Any, Out, ReadTxn, Xml};
+use yrs::{Any, Number, Out, ReadTxn, Xml};
 
 /// One piece of renderer output. `Html` is finished markup; `Deferred` is a
 /// callback node whose markup the caller supplies after the render, carrying
@@ -216,12 +216,12 @@ pub fn xml_ref_attr<T: ReadTxn, N: Xml>(txn: &T, node: &N, name: &str) -> Option
 pub fn any_attr_string(any: &Any) -> Option<String> {
     match any {
         Any::String(s) => Some(s.to_string()),
-        Any::Number(n) => Some(if n.fract() == 0.0 {
+        Any::Number(Number::Int(n)) => Some(format!("{n}")),
+        Any::Number(Number::Float(n)) => Some(if n.fract() == 0.0 {
             format!("{}", *n as i64)
         } else {
             format!("{n}")
         }),
-        Any::BigInt(n) => Some(format!("{n}")),
         Any::Bool(b) => Some(if *b { "true" } else { "false" }.to_string()),
         _ => None,
     }
@@ -458,10 +458,41 @@ fn parse_parts(name: &str, parts: &[serde_json::Value]) -> Result<Vec<AttrPart>,
         .collect()
 }
 
+/// The scheme a URL names, lowercased, or `None` for a URL without one (a
+/// path). Browsers ignore whitespace and control characters in a scheme, so
+/// they don't count here either: `java\tscript:` is `javascript`.
+pub fn url_scheme(url: &str) -> Option<String> {
+    let url: String = url
+        .chars()
+        .filter(|c| !c.is_whitespace() && !c.is_control())
+        .collect();
+    let (scheme, _) = url.split_once(':')?;
+    let mut chars = scheme.chars();
+    let starts_with_letter = chars.next().is_some_and(|c| c.is_ascii_alphabetic());
+    let valid = chars.all(|c| c.is_ascii_alphanumeric() || matches!(c, '+' | '.' | '-'));
+    (starts_with_letter && valid).then(|| scheme.to_ascii_lowercase())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    #[test]
+    fn url_scheme_reads_a_scheme_as_a_browser_does() {
+        assert_eq!(url_scheme("https://example.com").as_deref(), Some("https"));
+        assert_eq!(
+            url_scheme("JavaScript:alert(1)").as_deref(),
+            Some("javascript")
+        );
+        assert_eq!(
+            url_scheme(" java\tscript:alert(1)").as_deref(),
+            Some("javascript")
+        );
+        assert_eq!(url_scheme("/docs/a:b"), None);
+        assert_eq!(url_scheme("#top"), None);
+        assert_eq!(url_scheme("example.com"), None);
+    }
+
     #[test]
     fn parses_the_compiled_rule_shape() {
         let rules = Rules::parse(

data/ext/yrby/crates/lexical-html/Cargo.toml

@@ -3,7 +3,7 @@ name = "lexical-yjs-html"
 description = "Render Lexical-shaped yrs documents to HTML, no browser or Node required"
 repository = "https://github.com/jpcamara/yrby"
 readme = "README.md"
-version = "0.1.4"
+version = "0.2.1"
 edition = "2024"
 rust-version = "1.85"
 authors = ["JP Camara <johnpcamara@gmail.com>"]
@@ -12,6 +12,6 @@ keywords = ["yjs", "crdt", "lexical", "html", "yrs"]
 categories = ["text-processing", "web-programming"]
 
 [dependencies]
-yrs = { version = "0.27", features = ["sync"] }
+yrs = { version = "0.28", features = ["sync"] }
 serde_json = "1.0"
-yjs-html-core = { path = "../html-core", version = "0.1.3" }
+yjs-html-core = { path = "../html-core", version = "0.2.1" }

data/ext/yrby/crates/lexical-html/src/lib.rs

@@ -67,8 +67,8 @@ mod readme_examples {}
 pub use yjs_html_core::*;
 use yrs::types::text::YChange;
 use yrs::{
-    Any, GetString, Map, Out, ReadTxn, Text, Xml, XmlElementRef, XmlFragment, XmlFragmentRef,
-    XmlOut, XmlTextRef,
+    Any, GetString, Map, Number, Out, ReadTxn, Text, Xml, XmlElementRef, XmlFragment,
+    XmlFragmentRef, XmlOut, XmlTextRef,
 };
 
 // Lexical text format bitmask (lexical 0.44).
@@ -391,13 +391,11 @@ fn open_block<T: ReadTxn>(
             push_block_children(txn, t, depth, "</tr>", false, stack);
         }
         "tablecell" => {
-            let header = matches!(
-                t.get_attribute(txn, "__headerState"),
-                Some(Out::Any(Any::Number(n))) if n > 0.0
-            ) || matches!(
-                t.get_attribute(txn, "__headerState"),
-                Some(Out::Any(Any::BigInt(n))) if n > 0
-            );
+            let header = match t.get_attribute(txn, "__headerState") {
+                Some(Out::Any(Any::Number(Number::Int(n)))) => n > 0,
+                Some(Out::Any(Any::Number(Number::Float(n)))) => n > 0.0,
+                _ => false,
+            };
             let close = if header {
                 em.push_str("<th>");
                 "</th>"
@@ -562,8 +560,8 @@ fn open_listitem<T: ReadTxn>(
     rules: &Rules,
 ) {
     let value = match t.get_attribute(txn, "__value") {
-        Some(Out::Any(Any::Number(n))) => n as i64,
-        Some(Out::Any(Any::BigInt(n))) => n,
+        Some(Out::Any(Any::Number(Number::Int(n)))) => n,
+        Some(Out::Any(Any::Number(Number::Float(n)))) => n as i64,
         _ => 1,
     };
     let checked = match t.get_attribute(txn, "__checked") {
@@ -669,8 +667,8 @@ fn render_inline<T: ReadTxn>(
                     _ => {
                         is_tab = false;
                         format = match m.get(txn, "__format") {
-                            Some(Out::Any(Any::Number(n))) => n as u32,
-                            Some(Out::Any(Any::BigInt(n))) => n as u32,
+                            Some(Out::Any(Any::Number(Number::Int(n)))) => n as u32,
+                            Some(Out::Any(Any::Number(Number::Float(n)))) => n as u32,
                             _ => 0,
                         };
                         style = match m.get(txn, "__style") {
@@ -796,13 +794,24 @@ fn lexxy_style(style: &str) -> Option<String> {
     if css.is_empty() { None } else { Some(css) }
 }
 
+/// The schemes a link may use, and what an editor shows for any other, as
+/// Lexical's `LinkNode` does: a `javascript:` link would run in the page.
+const LINK_SCHEMES: [&str; 5] = ["http", "https", "mailto", "sms", "tel"];
+
+fn safe_href(url: String) -> String {
+    match url_scheme(&url) {
+        Some(scheme) if !LINK_SCHEMES.contains(&scheme.as_str()) => "about:blank".to_string(),
+        _ => url,
+    }
+}
+
 /// `link` / `autolink`: Lexxy's sanitize keeps only `href` and `title`
 /// (`target`/`rel` are stored in the doc but stripped from exported HTML).
 fn render_link<T: ReadTxn>(txn: &T, t: &XmlTextRef, depth: usize, em: &mut Emitter, rules: &Rules) {
     em.push_str("<a");
     if let Some(url) = str_attr(txn, t, "__url") {
         em.push_str(" href=\"");
-        em.push_str(&escape_attr(&url));
+        em.push_str(&escape_attr(&safe_href(url)));
         em.push('"');
     }
     if let Some(title) = str_attr(txn, t, "__title").filter(|s| !s.is_empty()) {
@@ -981,6 +990,21 @@ pub fn escape_attr(s: &str) -> String {
 #[cfg(test)]
 mod tests {
     use super::*;
+
+    #[test]
+    fn a_link_to_an_unsafe_scheme_goes_nowhere() {
+        assert_eq!(
+            safe_href("https://example.com".into()),
+            "https://example.com"
+        );
+        assert_eq!(safe_href("/docs".into()), "/docs");
+        assert_eq!(
+            safe_href("mailto:a@example.com".into()),
+            "mailto:a@example.com"
+        );
+        assert_eq!(safe_href("javascript:alert(1)".into()), "about:blank");
+        assert_eq!(safe_href(" JAVA\tSCRIPT:alert(1)".into()), "about:blank");
+    }
     use yrs::updates::decoder::Decode;
     use yrs::{Doc, Transact, Update};
 
@@ -1167,8 +1191,14 @@ mod tests {
         let frag = txn.get_xml_fragment("root").unwrap();
         let html = render(&txn, &frag).unwrap();
 
-        assert!(html.contains("rocks"), "marked text survives without a rule: {html}");
-        assert!(!html.contains("<mark"), "no wrapper is invented for it: {html}");
+        assert!(
+            html.contains("rocks"),
+            "marked text survives without a rule: {html}"
+        );
+        assert!(
+            !html.contains("<mark"),
+            "no wrapper is invented for it: {html}"
+        );
         assert!(html.contains("#ruby"), "hashtag text survives: {html}");
     }
 

data/ext/yrby/crates/prosemirror-html/Cargo.toml

@@ -3,7 +3,7 @@ name = "prosemirror-yjs-html"
 description = "Render ProseMirror-shaped yrs documents to HTML, no browser or Node required"
 repository = "https://github.com/jpcamara/yrby"
 readme = "README.md"
-version = "0.1.5"
+version = "0.2.1"
 edition = "2024"
 rust-version = "1.85"
 authors = ["JP Camara <johnpcamara@gmail.com>"]
@@ -12,6 +12,6 @@ keywords = ["yjs", "crdt", "prosemirror", "tiptap", "html"]
 categories = ["text-processing", "web-programming"]
 
 [dependencies]
-yrs = { version = "0.27", features = ["sync"] }
+yrs = { version = "0.28", features = ["sync"] }
 serde_json = "1.0"
-yjs-html-core = { path = "../html-core", version = "0.1.3" }
+yjs-html-core = { path = "../html-core", version = "0.2.1" }

data/ext/yrby/crates/prosemirror-html/src/lib.rs

@@ -52,8 +52,8 @@ pub use yjs_html_core::*;
 use yrs::types::Attrs;
 use yrs::types::text::YChange;
 use yrs::{
-    Any, GetString, Out, ReadTxn, Text, Xml, XmlElementRef, XmlFragment, XmlFragmentRef, XmlOut,
-    XmlTextRef,
+    Any, GetString, Number, Out, ReadTxn, Text, Xml, XmlElementRef, XmlFragment, XmlFragmentRef,
+    XmlOut, XmlTextRef,
 };
 
 // The block tree is walked on a heap stack, so depth can't overflow the
@@ -807,16 +807,25 @@ fn hex_to_rgb(value: &str) -> Option<String> {
     Some(format!("rgb({r}, {g}, {b})"))
 }
 
+/// The schemes a link may use, as Tiptap's link mark allows them. It
+/// renders a link with any other scheme with an empty `href`, since a
+/// `javascript:` link would run in the page.
+const LINK_SCHEMES: [&str; 10] = [
+    "http", "https", "ftp", "ftps", "mailto", "tel", "callto", "sms", "cid", "xmpp",
+];
+
 /// `<a>` with Tiptap's attribute order (target, rel, class, href, title),
 /// skipping any that are absent or null.
 fn link_open(link: &std::collections::HashMap<String, Any>) -> String {
     let mut out = String::from("<a");
     for key in ["target", "rel", "class", "href", "title"] {
         if let Some(Any::String(v)) = link.get(key) {
+            let unsafe_href = key == "href"
+                && url_scheme(v).is_some_and(|scheme| !LINK_SCHEMES.contains(&scheme.as_str()));
             out.push(' ');
             out.push_str(key);
             out.push_str("=\"");
-            out.push_str(&escape_attr(v));
+            out.push_str(&escape_attr(if unsafe_href { "" } else { v }));
             out.push('"');
         }
     }
@@ -874,8 +883,8 @@ fn str_attr<T: ReadTxn>(txn: &T, e: &XmlElementRef, name: &str) -> Option<String
 
 fn num_attr<T: ReadTxn>(txn: &T, e: &XmlElementRef, name: &str) -> Option<i64> {
     match e.get_attribute(txn, name) {
-        Some(Out::Any(Any::Number(n))) => Some(n as i64),
-        Some(Out::Any(Any::BigInt(n))) => Some(n),
+        Some(Out::Any(Any::Number(Number::Int(n)))) => Some(n),
+        Some(Out::Any(Any::Number(Number::Float(n)))) => Some(n as i64),
         _ => None,
     }
 }
@@ -899,6 +908,22 @@ pub fn escape_attr(s: &str) -> String {
 #[cfg(test)]
 mod tests {
     use super::*;
+
+    #[test]
+    fn a_link_to_an_unsafe_scheme_has_an_empty_href() {
+        let link = |href: &str| {
+            link_open(&std::collections::HashMap::from([(
+                "href".to_string(),
+                Any::from(href),
+            )]))
+        };
+        assert_eq!(
+            link("https://example.com"),
+            r#"<a href="https://example.com">"#
+        );
+        assert_eq!(link("ftp://example.com"), r#"<a href="ftp://example.com">"#);
+        assert_eq!(link("javascript:alert(1)"), r#"<a href="">"#);
+    }
     use std::collections::HashMap;
     use std::sync::Arc;
     use yrs::updates::decoder::Decode;