@ai-matrx/print 0.8.7 → 0.8.9

package/dist/markdown.cjs

@@ -67,6 +67,104 @@ function openPrintWindow(htmlDocument, filename = "print", windowFeatures = "wid
 
 // src/markdown.ts
 var import_html_escape2 = require("@ai-matrx/kit/html-escape");
+var import_source = require("@ai-matrx/content-ir/source");
+
+// src/safe-html.ts
+var import_hast_util_from_html = require("hast-util-from-html");
+var import_hast_util_sanitize = require("hast-util-sanitize");
+var import_hast_util_to_html = require("hast-util-to-html");
+var STRIP_WITH_CONTENT = [
+  "script",
+  "style",
+  "noscript",
+  "template",
+  "iframe",
+  "object",
+  "embed",
+  "textarea",
+  "select",
+  "head",
+  "title"
+];
+var FORBIDDEN_TAGS = [
+  ...STRIP_WITH_CONTENT,
+  "form",
+  "meta",
+  "base",
+  "link",
+  "frame",
+  "frameset",
+  "applet",
+  "button",
+  "svg",
+  "math"
+];
+var baseAttributes = import_hast_util_sanitize.defaultSchema.attributes ?? {};
+var SAFE_HTML_SCHEMA = {
+  ...import_hast_util_sanitize.defaultSchema,
+  tagNames: (import_hast_util_sanitize.defaultSchema.tagNames ?? []).filter((t) => !FORBIDDEN_TAGS.includes(t)),
+  strip: STRIP_WITH_CONTENT,
+  // Authored anchors keep their names; the GitHub `user-content-` rewrite
+  // would also break `<label for>` → `<input id>` pairs.
+  clobberPrefix: "",
+  clobber: []
+};
+var PRINT_CLASS = /^(?:(?:matrx|print|code|doc|language)-[\w-]*|inline-code|is-checked)$/;
+function withPrintClasses(defs = []) {
+  let found = false;
+  const out = defs.map((d) => {
+    if (Array.isArray(d) && d[0] === "className") {
+      found = true;
+      return [...d, PRINT_CLASS];
+    }
+    return d;
+  });
+  return found ? out : [...out, ["className", PRINT_CLASS]];
+}
+var printAttributes = Object.fromEntries(
+  Object.entries(baseAttributes).map(([tag, defs]) => [tag, withPrintClasses(defs)])
+);
+var cellAlign = ["style", /^text-align:\s*(?:left|center|right);?$/];
+var PRINT_HTML_SCHEMA = {
+  ...SAFE_HTML_SCHEMA,
+  tagNames: [
+    .../* @__PURE__ */ new Set([...SAFE_HTML_SCHEMA.tagNames ?? [], "section", "figure", "figcaption", "label"])
+  ],
+  attributes: {
+    ...printAttributes,
+    "*": [
+      ...baseAttributes["*"] ?? [],
+      ["className", PRINT_CLASS],
+      "role",
+      "ariaLabel",
+      "ariaHidden",
+      "dataLabel",
+      "dataLanguage",
+      "dataArtifactType"
+    ],
+    // Table-cell alignment is the one inline style the converter writes.
+    td: withPrintClasses([...baseAttributes["td"] ?? [], [...cellAlign]]),
+    th: withPrintClasses([...baseAttributes["th"] ?? [], [...cellAlign]]),
+    // The flashcard flip is a checkbox + label pair (GitHub forces `disabled`).
+    input: withPrintClasses([["type", "checkbox"], "checked"]),
+    label: withPrintClasses(["htmlFor"])
+  },
+  required: { input: { type: "checkbox" } },
+  protocols: {
+    ...import_hast_util_sanitize.defaultSchema.protocols,
+    href: [...import_hast_util_sanitize.defaultSchema.protocols?.href ?? [], "tel"],
+    // Embedded images (`data:image/png;base64,…`) — an <img> never runs script.
+    src: [...import_hast_util_sanitize.defaultSchema.protocols?.src ?? [], "data"]
+  }
+};
+function sanitizeHtmlFragment(html, schema = SAFE_HTML_SCHEMA) {
+  if (!html) return "";
+  const tree = (0, import_hast_util_sanitize.sanitize)((0, import_hast_util_from_html.fromHtml)(html, { fragment: true }), schema);
+  return (0, import_hast_util_to_html.toHtml)(tree, { characterReferences: { useNamedReferences: true } });
+}
+function sanitizePrintHtml(html) {
+  return sanitizeHtmlFragment(html, PRINT_HTML_SCHEMA);
+}
 
 // src/markdown-css.ts
 var MARKDOWN_DOCUMENT_TOKENS_CSS = `:root {
@@ -1407,11 +1505,11 @@ function protectRegions(markdown, g, stash, ctx) {
     text = next;
   }
   text = sanitizeRawTags(text);
-  if (text !== before && !ctx.strippedAnnounced) {
+  if ((text !== before || hasDisallowedTag(text)) && !ctx.strippedAnnounced) {
     ctx.strippedAnnounced = true;
     ctx.options.onNotice?.({
       code: "html-stripped",
-      message: "Unsafe or page-level markup (a <script>, <style>, <head>, an <html>/<body> shell, an on\u2026 event handler, or a javascript: URL) was removed from the rendered copy.",
+      message: "Markup that is not on the safe list (a <script>, <style>, <iframe>, <form>, <object>/<embed>, <meta>, <link>, an on\u2026 event handler, inline style, or a javascript: URL) was removed from the rendered copy.",
       remedy: 'To show a full HTML page, put it in an ```html fence or an <artifact type="html"> block \u2014 it is printed as its source.'
     });
   }
@@ -1423,6 +1521,14 @@ ${stash.block(flashcardsHtml(g, cards, ctx))}
   });
   return text;
 }
+var ALLOWED_TAGS = new Set(PRINT_HTML_SCHEMA.tagNames ?? []);
+function hasDisallowedTag(text) {
+  for (const m of text.matchAll(/<\/?([a-zA-Z][\w:-]*)/g)) {
+    const tag = m[1].toLowerCase();
+    if (tag !== "flashcards" && !ALLOWED_TAGS.has(tag)) return true;
+  }
+  return false;
+}
 var URL_ATTRS = /* @__PURE__ */ new Set(["href", "src", "action", "formaction", "xlink:href", "poster", "background"]);
 function decodeForSchemeCheck(value) {
   return value.replace(/&#x([0-9a-f]+);?/gi, (_m, h) => String.fromCharCode(parseInt(h, 16))).replace(/&#(\d+);?/g, (_m, d) => String.fromCharCode(Number(d))).replace(/&colon;/gi, ":").replace(/[\u0000-\u0020]+/g, "").toLowerCase();
@@ -1471,13 +1577,7 @@ var LINK_RE = new RegExp(String.raw`\[([^\]]+)\]\(` + LINK_URL + String.raw`\)`,
 function convertRules(html, g) {
   return html.replace(/^\s{0,3}#\s*={3,}\s*$/gm, `<hr${cls(g.hr, "matrx-hr-heavy")}>`).replace(/^\s{0,3}\*(?:\s*\*){2,}\s*$/gm, `<hr${cls(g.hr, "matrx-hr-accent")}>`).replace(/^\s{0,3}(?:-\s*){3,}$/gm, `<hr${cls(g.hr)}>`).replace(/^\s{0,3}(?:_\s*){3,}$/gm, `<hr${cls(g.hr)}>`);
 }
-function splitTableRow(row) {
-  let r = row.trim();
-  if (r.startsWith("|")) r = r.slice(1);
-  if (r.endsWith("|") && !r.endsWith("\\|")) r = r.slice(0, -1);
-  return r.split(/(?<!\\)\|/).map((c) => c.trim().replace(/\\\|/g, "|"));
-}
-function cellAlign(separator) {
+function cellAlign2(separator) {
   const s = separator.trim();
   const left = s.startsWith(":");
   const right = s.endsWith(":");
@@ -1486,40 +1586,48 @@ function cellAlign(separator) {
   return "";
 }
 function convertTables(html, g) {
-  const tableRegex = /^(\|.*\|)\s*\n(\|[-\s:|]*\|)\s*\n((?:\|.*\|\s*\n?)*)/gm;
-  return html.replace(
-    tableRegex,
-    (_m, headerRow, separatorRow, bodyRows) => {
-      const headers = splitTableRow(headerRow);
-      const aligns = splitTableRow(separatorRow).map(cellAlign);
-      const rows = bodyRows.trim().split("\n").filter((r) => r.trim()).map(splitTableRow);
-      let t = `<table${cls(g.table)}>
+  const lines = html.split("\n");
+  const out = [];
+  for (let i = 0; i < lines.length; i += 1) {
+    if (!(0, import_source.tableStartsAt)(lines, i)) {
+      out.push(lines[i] ?? "");
+      continue;
+    }
+    const end = (0, import_source.findTableEnd)(lines, i);
+    const cellsOf = (line) => (0, import_source.rowCells)(line).map(import_source.unescapeCellPipes);
+    const headers = cellsOf(lines[i] ?? "");
+    const aligns = (0, import_source.rowCells)(lines[i + 1] ?? "").map(cellAlign2);
+    const rows = lines.slice(i + 2, end).map((line) => {
+      const cells = cellsOf(line);
+      return headers.map((_h, k) => cells[k] ?? "");
+    });
+    let t = `<table${cls(g.table)}>
 <thead${cls(g.thead)}>
 <tr${cls(g.tr)}>
 `;
-      headers.forEach((h, i) => {
-        t += `<th${cls(g.th)}${aligns[i] ?? ""}>${h}</th>
+    headers.forEach((h, k) => {
+      t += `<th${cls(g.th)}${aligns[k] ?? ""}>${h}</th>
 `;
-      });
-      t += "</tr>\n</thead>\n";
-      if (rows.length > 0) {
-        t += `<tbody${cls(g.tbody)}>
+    });
+    t += "</tr>\n</thead>\n";
+    if (rows.length > 0) {
+      t += `<tbody${cls(g.tbody)}>
 `;
-        for (const row of rows) {
-          t += `<tr${cls(g.tr)}>
+      for (const row of rows) {
+        t += `<tr${cls(g.tr)}>
 `;
-          row.forEach((c, i) => {
-            t += `<td${cls(g.td)}${aligns[i] ?? ""}>${c}</td>
+        row.forEach((c, k) => {
+          t += `<td${cls(g.td)}${aligns[k] ?? ""}>${c}</td>
 `;
-          });
-          t += "</tr>\n";
-        }
-        t += "</tbody>\n";
+        });
+        t += "</tr>\n";
       }
-      return `${t}</table>
-`;
+      t += "</tbody>\n";
     }
-  );
+    out.push(`${t}</table>`);
+    i = end - 1;
+  }
+  return out.join("\n");
 }
 function convertLists(html, g) {
   const lines = html.split("\n");
@@ -1605,7 +1713,9 @@ function markdownToHtml(markdown, options = {}) {
     return "";
   }
   const source = scrubTokens(options.includeThinking ? markdown : removeThinkingContent(markdown));
-  return `<div class="matrx-content-container">${documentBody(source, newContext(options))}</div>`;
+  return sanitizePrintHtml(
+    `<div class="matrx-content-container">${documentBody(source, newContext(options))}</div>`
+  );
 }
 function documentBody(markdown, ctx) {
   const g = DOCUMENT_GRAMMAR;
@@ -1675,7 +1785,7 @@ function markdownToArticleHtml(markdown, options = {}) {
     return "";
   }
   const source = scrubTokens(options.includeThinking ? markdown : removeThinkingContent(markdown));
-  return articleBody(source, newContext(options));
+  return sanitizePrintHtml(articleBody(source, newContext(options)));
 }
 function articleBody(markdown, ctx) {
   const g = ARTICLE_GRAMMAR;