@astryxdesign/core 0.6.2 → 0.6.3-canary.039a67e

package/dist/utils/interactionOverlay.stylex.js

@@ -10,6 +10,11 @@
  * @output Exports reusable background-color and background-image state styles
  * @position Internal styling utility for interactive core surfaces
  *
+ * Every surface that paints a press composes one of these (or carries its own
+ * `:active` rule), so a change to how the system answers a press is made here
+ * once. `pressedBackgroundColor` is the press without the hover, for controls
+ * whose hover is a colour or nothing.
+ *
  * Keep the enabled guard outside the individual states. StyleX assigns an
  * extra priority bucket (and generated selector specificity) to media-nested
  * rules. Repeating `:active` inside the hover-capable branch gives hover and
@@ -38,5 +43,9 @@ export const interactionOverlayStyles = {
   backgroundImageOnNeutral: {
     kKwaWg: "x14bno8m xzmimnh x1otsd3y xo3fi6e",
     $$css: true
+  },
+  pressedBackgroundColor: {
+    kWkggS: "x1anq1lc",
+    $$css: true
   }
 };

package/dist/utils/safeUrl.d.ts

@@ -0,0 +1,11 @@
+/** Return a normalized navigation URL, or null for a blocked scheme. */
+export declare function sanitizeUrl(url: string): string | null;
+/** Inspect a navigation string without changing the value used by its sink. */
+export declare function isSafeUrl(url: string): boolean;
+/**
+ * Inspect React Router paths, Next.js URL objects, and URL instances without
+ * serializing or replacing the object handed to the router. Search/query/hash
+ * are route-relative data, not schemes. Absent destinations remain absent.
+ */
+export declare function isSafeDestination(destination: unknown): boolean;
+//# sourceMappingURL=safeUrl.d.ts.map

package/dist/utils/safeUrl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safeUrl.d.ts","sourceRoot":"","sources":["../../src/utils/safeUrl.ts"],"names":[],"mappings":"AAcA,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWtD;AAED,+EAA+E;AAC/E,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE9C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,OAAO,GAAG,OAAO,CA8C/D"}

package/dist/utils/safeUrl.js

@@ -0,0 +1,78 @@
+// Copyright (c) Meta Platforms, Inc. and affiliates.
+
+/**
+ * @file safeUrl.ts
+ * @input Navigation strings or supported structured router destinations
+ * @output The shared blocked-scheme decision, without rewriting accepted inputs
+ * @position Core navigation policy; embedded-resource policy is separate
+ */
+
+function normalizeUrl(url) {
+  // eslint-disable-next-line no-control-regex -- inspect schemes without browser-ignored controls
+  return url.replace(/[\x00-\x1f\x7f]/g, '').trim();
+}
+
+/** Return a normalized navigation URL, or null for a blocked scheme. */
+export function sanitizeUrl(url) {
+  const normalized = normalizeUrl(url);
+  const lower = normalized.toLowerCase();
+  if (lower.startsWith('javascript:') || lower.startsWith('vbscript:') || lower.startsWith('data:text/html')) {
+    return null;
+  }
+  return normalized;
+}
+
+/** Inspect a navigation string without changing the value used by its sink. */
+export function isSafeUrl(url) {
+  return sanitizeUrl(url) !== null;
+}
+
+/**
+ * Inspect React Router paths, Next.js URL objects, and URL instances without
+ * serializing or replacing the object handed to the router. Search/query/hash
+ * are route-relative data, not schemes. Absent destinations remain absent.
+ */
+export function isSafeDestination(destination) {
+  if (destination == null) {
+    return true;
+  }
+  if (typeof destination === 'string') {
+    return isSafeUrl(destination);
+  }
+  if (typeof destination !== 'object') {
+    return false;
+  }
+  const {
+    pathname,
+    href,
+    protocol,
+    host,
+    hostname
+  } = destination;
+  for (const field of [pathname, href, protocol, host, hostname]) {
+    if (field != null && typeof field !== 'string') {
+      return false;
+    }
+  }
+  if (typeof pathname === 'string' && !isSafeUrl(pathname)) {
+    return false;
+  }
+  if (typeof href === 'string' && !isSafeUrl(href)) {
+    return false;
+  }
+  if (typeof protocol === 'string' && protocol !== '') {
+    // URL-object formatters accept a protocol with or without its colon and
+    // can assemble a data media type from the host and pathname fields.
+    const normalizedProtocol = normalizeUrl(protocol);
+    const prefix = normalizedProtocol.endsWith(':') ? normalizedProtocol : `${normalizedProtocol}:`;
+    if (!isSafeUrl(prefix)) {
+      return false;
+    }
+    const body = host || hostname || '';
+    const path = typeof pathname === 'string' ? pathname : '';
+    if (!isSafeUrl(`${prefix}${body}${path}`)) {
+      return false;
+    }
+  }
+  return true;
+}