@abyss-project/spotlight 1.0.14 → 1.0.17

package/dist/index.js

@@ -93,4 +93,7 @@ AbyssSpotlightCore.config = {
     baseURL: DEFAULT_BASE_URL,
     abyssUserAnonymousIdentifier: '',
 };
-AbyssSpotlightCore.axios = axios_1.default.create({ baseURL: _a.config.baseURL });
+AbyssSpotlightCore.axios = axios_1.default.create({
+    baseURL: _a.config.baseURL,
+    withCredentials: true,
+});

package/dist/types/interface/api/requests/project-presentation.request.d.ts

@@ -3,6 +3,7 @@ export interface IUpsertProjectPresentationParams {
 }
 export interface IUpsertProjectPresentationBody {
     content: string;
+    customCss?: string;
 }
 export interface IGetProjectPresentationParams {
     projectId: string;

package/dist/types/interface/models/project-presentation.model.d.ts

@@ -4,6 +4,7 @@ export interface IProjectPresentation {
     id?: string;
     type: ProjectPresentationType;
     content: string;
+    customCss?: string;
     projectId: string;
     updatedAt?: Date;
     createdAt?: Date;

package/dist/utils/css-sanitizer.utils.d.ts

@@ -0,0 +1,2 @@
+export declare const sanitizeCss: (css: string) => string;
+export declare const isValidCss: (css: string) => boolean;

package/dist/utils/css-sanitizer.utils.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isValidCss = exports.sanitizeCss = void 0;
+const sanitizeCss = (css) => {
+    if (!css) {
+        return '';
+    }
+    let sanitized = css;
+    sanitized = sanitized.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '');
+    sanitized = sanitized.replace(/<\/style>/gi, '');
+    sanitized = sanitized.replace(/javascript:/gi, '');
+    sanitized = sanitized.replace(/\bon\w+\s*=/gi, '');
+    sanitized = sanitized.replace(/expression\s*\(/gi, '');
+    sanitized = sanitized.replace(/@import\s+.*javascript:/gi, '');
+    sanitized = sanitized.replace(/behavior\s*:/gi, '/* behavior: */');
+    sanitized = sanitized.replace(/-moz-binding\s*:/gi, '/* -moz-binding: */');
+    return sanitized.trim();
+};
+exports.sanitizeCss = sanitizeCss;
+const isValidCss = (css) => {
+    if (!css) {
+        return true;
+    }
+    const suspiciousPatterns = [
+        /<script/i,
+        /<\/script>/i,
+        /javascript:/i,
+        /on\w+=/i,
+        /expression\(/i,
+    ];
+    return !suspiciousPatterns.some((pattern) => pattern.test(css));
+};
+exports.isValidCss = isValidCss;

package/dist/utils/index.d.ts

@@ -1 +1,2 @@
 export * from './error.utils';
+export * from './css-sanitizer.utils';

package/dist/utils/index.js

@@ -15,3 +15,4 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./error.utils"), exports);
+__exportStar(require("./css-sanitizer.utils"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abyss-project/spotlight",
-  "version": "1.0.14",
+  "version": "1.0.17",
   "description": "Core package to interact with Abyss-Spotlight",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",