@ai-matrx/print 0.8.7 → 0.8.8

package/dist/document.js

@@ -87,6 +87,206 @@ function contentColumnWidths(b, n, avail, measure, pad = 10) {
 
 // src/document/math.ts
 import { listIslands, tokenizeSource } from "@ai-matrx/content-ir/source";
+
+// src/safe-html.ts
+import { fromHtml } from "hast-util-from-html";
+import { defaultSchema, sanitize } from "hast-util-sanitize";
+import { toHtml } from "hast-util-to-html";
+var STRIP_WITH_CONTENT = [
+  "script",
+  "style",
+  "noscript",
+  "template",
+  "iframe",
+  "object",
+  "embed",
+  "textarea",
+  "select",
+  "head",
+  "title"
+];
+var FORBIDDEN_TAGS = [
+  ...STRIP_WITH_CONTENT,
+  "form",
+  "meta",
+  "base",
+  "link",
+  "frame",
+  "frameset",
+  "applet",
+  "button",
+  "svg",
+  "math"
+];
+var baseAttributes = defaultSchema.attributes ?? {};
+var SAFE_HTML_SCHEMA = {
+  ...defaultSchema,
+  tagNames: (defaultSchema.tagNames ?? []).filter((t) => !FORBIDDEN_TAGS.includes(t)),
+  strip: STRIP_WITH_CONTENT,
+  // Authored anchors keep their names; the GitHub `user-content-` rewrite
+  // would also break `<label for>` → `<input id>` pairs.
+  clobberPrefix: "",
+  clobber: []
+};
+var PRINT_CLASS = /^(?:(?:matrx|print|code|doc|language)-[\w-]*|inline-code|is-checked)$/;
+function withPrintClasses(defs = []) {
+  let found = false;
+  const out = defs.map((d) => {
+    if (Array.isArray(d) && d[0] === "className") {
+      found = true;
+      return [...d, PRINT_CLASS];
+    }
+    return d;
+  });
+  return found ? out : [...out, ["className", PRINT_CLASS]];
+}
+var printAttributes = Object.fromEntries(
+  Object.entries(baseAttributes).map(([tag, defs]) => [tag, withPrintClasses(defs)])
+);
+var cellAlign = ["style", /^text-align:\s*(?:left|center|right);?$/];
+var PRINT_HTML_SCHEMA = {
+  ...SAFE_HTML_SCHEMA,
+  tagNames: [
+    .../* @__PURE__ */ new Set([...SAFE_HTML_SCHEMA.tagNames ?? [], "section", "figure", "figcaption", "label"])
+  ],
+  attributes: {
+    ...printAttributes,
+    "*": [
+      ...baseAttributes["*"] ?? [],
+      ["className", PRINT_CLASS],
+      "role",
+      "ariaLabel",
+      "ariaHidden",
+      "dataLabel",
+      "dataLanguage",
+      "dataArtifactType"
+    ],
+    // Table-cell alignment is the one inline style the converter writes.
+    td: withPrintClasses([...baseAttributes["td"] ?? [], [...cellAlign]]),
+    th: withPrintClasses([...baseAttributes["th"] ?? [], [...cellAlign]]),
+    // The flashcard flip is a checkbox + label pair (GitHub forces `disabled`).
+    input: withPrintClasses([["type", "checkbox"], "checked"]),
+    label: withPrintClasses(["htmlFor"])
+  },
+  required: { input: { type: "checkbox" } },
+  protocols: {
+    ...defaultSchema.protocols,
+    href: [...defaultSchema.protocols?.href ?? [], "tel"],
+    // Embedded images (`data:image/png;base64,…`) — an <img> never runs script.
+    src: [...defaultSchema.protocols?.src ?? [], "data"]
+  }
+};
+function sanitizeHtmlFragment(html, schema = SAFE_HTML_SCHEMA) {
+  if (!html) return "";
+  const tree = sanitize(fromHtml(html, { fragment: true }), schema);
+  return toHtml(tree, { characterReferences: { useNamedReferences: true } });
+}
+var MATHML_TAGS = [
+  "math",
+  "maction",
+  "annotation",
+  "menclose",
+  "merror",
+  "mfrac",
+  "mglyph",
+  "mi",
+  "mlabeledtr",
+  "mmultiscripts",
+  "mn",
+  "mo",
+  "mover",
+  "mpadded",
+  "mphantom",
+  "mprescripts",
+  "none",
+  "mroot",
+  "mrow",
+  "ms",
+  "mspace",
+  "msqrt",
+  "mstyle",
+  "msub",
+  "msubsup",
+  "msup",
+  "mtable",
+  "mtd",
+  "mtext",
+  "mtr",
+  "munder",
+  "munderover",
+  "semantics"
+];
+var MATHML_ATTRIBUTES = [
+  "xmlns",
+  "display",
+  "displaystyle",
+  "mathvariant",
+  "mathsize",
+  "mathcolor",
+  "mathbackground",
+  "scriptlevel",
+  "dir",
+  "fence",
+  "form",
+  "largeop",
+  "lspace",
+  "rspace",
+  "movablelimits",
+  "separator",
+  "stretchy",
+  "symmetric",
+  "maxsize",
+  "minsize",
+  "accent",
+  "accentunder",
+  "align",
+  "columnalign",
+  "rowalign",
+  "columnspacing",
+  "rowspacing",
+  "columnlines",
+  "rowlines",
+  "frame",
+  "framespacing",
+  "equalrows",
+  "equalcolumns",
+  "linethickness",
+  "numalign",
+  "denomalign",
+  "bevelled",
+  "notation",
+  "width",
+  "height",
+  "depth",
+  "voffset",
+  "lquote",
+  "rquote",
+  "columnspan",
+  "rowspan",
+  "encoding",
+  "open",
+  "close",
+  "separators",
+  "actiontype",
+  "selection",
+  "mslinebreak",
+  "linebreak",
+  "indentalign",
+  "data*"
+];
+var MATHML_SCHEMA = {
+  tagNames: MATHML_TAGS,
+  attributes: { "*": MATHML_ATTRIBUTES },
+  strip: ["script", "style"],
+  clobberPrefix: "",
+  clobber: [],
+  protocols: {}
+};
+function sanitizeMathml(mathml) {
+  return sanitizeHtmlFragment(mathml, MATHML_SCHEMA);
+}
+
+// src/document/math.ts
 var MATH_OPEN = "\uE100";
 var MATH_CLOSE = "\uE101";
 var MATH_TOKEN_RE = /\uE100(\d+)\uE101/g;
@@ -153,10 +353,10 @@ async function typesetMathSpans(spans) {
       const mathml = mj.mml(s.tex, s.display);
       const err = /<merror[\s\S]*?<mtext[^>]*>([\s\S]*?)<\/mtext>/.exec(mathml);
       if (err) {
-        out.set(key, { mathml, error: decodeXml(err[1]) });
+        out.set(key, { mathml: sanitizeMathml(mathml), error: decodeXml(err[1]) });
         continue;
       }
-      const entry = { mathml: mathml.replace(/\n\s*/g, "") };
+      const entry = { mathml: sanitizeMathml(mathml.replace(/\n\s*/g, "")) };
       if (s.display) {
         const svg = mj.svg(s.tex, true);
         entry.svg = svg;
@@ -3354,7 +3554,7 @@ function coverHtml(s, x) {
     s.title ?? ""
   )}</h1>${s.subtitle ? `<p class="doc-cover-subtitle">${escapeHtml(s.subtitle)}</p>` : ""}${s.author ? `<p class="doc-cover-author">${escapeHtml(s.author)}</p>` : ""}${s.date ? `<p class="doc-cover-date">${escapeHtml(s.date)}</p>` : ""}</section>`;
 }
-var cssString = (s) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, " ")}"`;
+var cssString = (s) => `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, " ").replace(/</g, "\\3C ").replace(/>/g, "\\3E ")}"`;
 function marginContent(template, s) {
   if (!template) return "none";
   return templateParts(template, s).map((p) => "field" in p ? `counter(${p.field})` : cssString(p.text)).join(" ");
@@ -4884,6 +5084,7 @@ function looksLikeJson(body) {
     return false;
   }
 }
+var ALLOWED_TAGS = new Set(PRINT_HTML_SCHEMA.tagNames ?? []);
 var LINK_URL = String.raw`((?:[^()\s]|\([^()\s]*\))+)(?:\s+"[^"]*")?`;
 var IMAGE_RE = new RegExp(String.raw`!\[([^\]]*)\]\(` + LINK_URL + String.raw`\)`, "g");
 var LINK_RE = new RegExp(String.raw`\[([^\]]+)\]\(` + LINK_URL + String.raw`\)`, "g");