@agent-native/core 0.176.1 → 0.176.2-nightly-20260831185956

package/corpus/templates/slides/app/lib/sanitize-slide-html.ts

@@ -311,13 +311,144 @@ function cleanNode(
   return out;
 }
 
+/**
+ * Elements whose unclosed start tag swallows the rest of the document in a real
+ * parser. `embed` is deliberately absent: it is void, so it never has a closing
+ * tag and requiring one would truncate every slide that contains a valid one.
+ */
+const SWALLOWING_ELEMENTS = /^(script|style|textarea|iframe|object|svg|math)$/i;
+
+/** Elements whose children the HTML parser reads as text rather than markup. */
+const RAW_TEXT_ELEMENTS = /^(script|style|textarea|title)$/i;
+
+/**
+ * Start-tag positions in `html`, skipping comments and anything inside a quoted
+ * attribute value.
+ *
+ * Scanning the serialized string with a bare regex cannot tell a tag from text:
+ * `<p title="Use <style> here">` reads as a `<style>` start tag, and truncating
+ * there drops the rest of a perfectly valid slide.
+ */
+function startTagPositions(
+  html: string,
+): { name: string; index: number; end: number }[] {
+  const found: { name: string; index: number; end: number }[] = [];
+  for (let i = 0; i < html.length; i++) {
+    if (html[i] !== "<") continue;
+    if (html.startsWith("<!--", i)) {
+      const end = html.indexOf("-->", i + 4);
+      i = end === -1 ? html.length : end + 2;
+      continue;
+    }
+    const name = /^<([a-z][a-z0-9-]*)/i.exec(html.slice(i, i + 32))?.[1];
+    // Walk to this tag's `>`, stepping over quoted values so a `<` or `>`
+    // inside one is not read as markup.
+    let cursor = i + 1;
+    let quote = "";
+    while (cursor < html.length) {
+      const char = html[cursor];
+      if (quote) {
+        if (char === quote) quote = "";
+      } else if (char === '"' || char === "'") {
+        quote = char;
+      } else if (char === ">") {
+        break;
+      }
+      cursor++;
+    }
+    if (!name) {
+      i = cursor;
+      continue;
+    }
+    const lower = name.toLowerCase();
+    found.push({ name: lower, index: i, end: cursor });
+    if (RAW_TEXT_ELEMENTS.test(lower)) {
+      // A raw-text element's body is text, not markup — `content: "<script>"`
+      // inside a stylesheet is a CSS string, and reading it as a start tag
+      // truncated everything after it. Skip to the close tag; no close tag is
+      // the unclosed case the caller is looking for, and everything past it is
+      // swallowed anyway, so there is nothing further to find.
+      const closing = new RegExp(`</\\s*${lower}\\s*>`, "i").exec(
+        html.slice(cursor),
+      );
+      if (!closing) return found;
+      i = cursor + closing.index + closing[0].length - 1;
+      continue;
+    }
+    i = cursor;
+  }
+  return found;
+}
+
+/**
+ * Truncates at the first swallowing element that never closes.
+ *
+ * The regex path has to drop the remainder to agree with `cleanNode`. It must
+ * check for the closing tag to do that: the sweep used to match any of these
+ * tags and cut to the end of the string unconditionally, which ate the
+ * sanitized `<style>` block the pass above it had just emitted — and every
+ * heading and paragraph after it. A deck with one stylesheet rendered as an
+ * empty slide on the SSR'd share and present pages.
+ */
+function dropFromFirstUnclosedRawText(html: string): string {
+  for (const { name, index } of startTagPositions(html)) {
+    if (!SWALLOWING_ELEMENTS.test(name)) continue;
+    const closing = new RegExp(`</\\s*${name}\\s*>`, "i");
+    if (!closing.test(html.slice(index))) return html.slice(0, index);
+  }
+  return html;
+}
+
+/**
+ * Rewrites `/` attribute separators inside start tags as spaces.
+ *
+ * `/` is a legal separator between attributes, so `<img src="x"/onerror="…">`
+ * is an image with a live handler — and every attribute scrub below is anchored
+ * on whitespace, so none of them matched it. Normalizing here rather than
+ * widening each scrub to `[\s/]+` is what keeps a legitimate value intact: a
+ * URL like `https://cdn.example/onerror=logo.png` lives inside quotes, and this
+ * only touches separators outside them.
+ */
+function normalizeTagAttributeSeparators(html: string): string {
+  const tags = startTagPositions(html);
+  if (!tags.length) return html;
+  let out = "";
+  let copied = 0;
+  for (const { index, end } of tags) {
+    // Start after the tag name so `</p>` and the opening `<` are untouched.
+    const nameEnd = /^<[a-z][a-z0-9-]*/i.exec(html.slice(index, end))?.[0]
+      .length;
+    if (nameEnd === undefined) continue;
+    const from = index + nameEnd;
+    let region = "";
+    let quote = "";
+    for (let i = from; i < end; i++) {
+      const char = html[i];
+      if (quote) {
+        if (char === quote) quote = "";
+        region += char;
+      } else if (char === '"' || char === "'") {
+        quote = char;
+        region += char;
+      } else if (char === "/") {
+        region += " ";
+      } else {
+        region += char;
+      }
+    }
+    out += html.slice(copied, from) + region;
+    copied = end;
+  }
+  return out + html.slice(copied);
+}
+
 function sanitizeHtmlString(
   html: string,
   scopeSelector?: string,
   allowBlobImages = false,
 ): string {
   return (
-    html
+    normalizeTagAttributeSeparators(html)
       .replace(/<style\b[^>]*>([\s\S]*?)<\/\s*style\s*>/gi, (_match, css) => {
         const safeCss = sanitizeStyleSheet(String(css), scopeSelector);
         return safeCss
@@ -335,10 +466,7 @@ function sanitizeHtmlString(
       // twin runs instead of cleanNode(). An unclosed raw-text or embedding
       // element swallows the rest of the document in a real parser, so dropping
       // the remainder is what keeps this path agreeing with the DOM path.
-      .replace(
-        /<(script|style|textarea|iframe|object|embed|svg|math)\b[\s\S]*$/i,
-        "",
-      )
+      .replace(/[\s\S]*/, dropFromFirstUnclosedRawText)
       .replace(
         /<(script|iframe|object|embed|form|input|button|select|textarea|meta|base|link|svg|math)\b[^>]*\/?>/gi,
         "",