@bagelink/vue 1.15.0 → 1.15.9

package/src/types/index.ts

@@ -66,7 +66,7 @@ export type ExtendedThemeType
 
 export interface OptionObject {
 	label: string
-	value: string | number
+	value: string | number | boolean
 	icon?: IconType
 	[key: string]: any
 }

package/src/utils/index.ts

@@ -39,6 +39,39 @@ export function initials(...strArr: string[]) {
 	return strArr.map(str => str.charAt(0)).join('')
 }
 
+/**
+ * Strip script-capable content from an HTML string so it is safe for v-html.
+ * Removes <script>/<style>/<iframe>/<object>/<embed> elements, on* event
+ * handler attributes, and javascript: / data: URLs in href/src.
+ * Allowlist-free by design — formatting tags (b, i, a, span…) pass through.
+ */
+export function sanitizeHtml(html: string): string {
+	if (!html || typeof document === 'undefined') { return html }
+	const template = document.createElement('template')
+	template.innerHTML = html
+	const walk = (el: Element | DocumentFragment) => {
+		for (const child of Array.from(el.children)) {
+			const tag = child.tagName.toLowerCase()
+			if (['script', 'iframe', 'object', 'embed', 'link', 'meta', 'base', 'form'].includes(tag)) {
+				child.remove()
+				continue
+			}
+			for (const attr of Array.from(child.attributes)) {
+				const name = attr.name.toLowerCase()
+				const value = attr.value.trim().toLowerCase()
+				if (name.startsWith('on')
+					|| ((name === 'href' || name === 'src' || name === 'xlink:href')
+						&& (value.startsWith('javascript:') || value.startsWith('data:')))) {
+					child.removeAttribute(attr.name)
+				}
+			}
+			walk(child)
+		}
+	}
+	walk(template.content)
+	return template.innerHTML
+}
+
 export function useEscape(event: KeyboardEvent, closeModel: () => void) {
 	if (event.key === 'Escape') {
 		closeModel()
@@ -226,8 +259,11 @@ export type { ShowdownConverter, ShowdownOptions } from './showdown'
 
 const URL_REGEX = /^https?:\/\/|^\/\//
 
-export function pathKeyToURL(pathKey?: string | null) {
-	if (pathKey == null || pathKey === '' || URL_REGEX.test(pathKey)) {
+export function pathKeyToURL(pathKey?: string | null): string | undefined {
+	if (pathKey == null || pathKey === '') {
+		return undefined
+	}
+	if (URL_REGEX.test(pathKey)) {
 		return pathKey
 	}
 

package/src/utils/options.ts

@@ -4,7 +4,7 @@ export type { OptionObject }
 
 export type NormalizedOption<T extends Record<string, any> = Record<string, never>> = T & {
 	label: string
-	value: string | number
+	value: string | number | boolean
 	icon?: IconType
 }
 
@@ -18,7 +18,7 @@ export function getOptionLabel(option: Option): string {
 }
 
 /** Extract the primitive value from an option. */
-export function getOptionValue(option?: Option): string | number | undefined {
+export function getOptionValue(option?: Option): string | number | boolean | undefined {
 	if (option == null) { return }
 	if (typeof option === 'object') { return (option as OptionObject).value }
 	return option as string | number

package/src/utils/showdown.ts

@@ -1,3 +1,10 @@
+/**
+ * ⚠️ Security note: `makeHtml()` output is NOT sanitized — raw HTML in the
+ * markdown source passes through. If the markdown can contain user-generated
+ * content, run the result through `sanitizeHtml()` (from utils) before
+ * binding it with v-html.
+ */
+
 /**
  * Showdown configuration options
  */

package/vite.config.ts

@@ -7,7 +7,6 @@ import tsconfigPaths from 'vite-tsconfig-paths'
 
 const indexDir = resolve(import.meta.dirname, 'src')
 
-// @ts-expect-error - rolldown-vite in root workspace causes plugin type mismatch; build is unaffected
 export default defineConfig(() => ({
 	plugins: [
 		tsconfigPaths({ root: indexDir, }),

package/dist/components/Filter.vue.d.ts

@@ -1,30 +0,0 @@
-import { Option } from '..';
-import { QueryConditions } from '../utils/queryFilter';
-declare const _default: <T extends Record<string, any>>(__VLS_props: NonNullable<Awaited<typeof __VLS_setup>>["props"], __VLS_ctx?: __VLS_PrettifyLocal<Pick<NonNullable<Awaited<typeof __VLS_setup>>, "attrs" | "emit" | "slots">>, __VLS_expose?: NonNullable<Awaited<typeof __VLS_setup>>["expose"], __VLS_setup?: Promise<{
-    props: __VLS_PrettifyLocal<Pick<Partial<{}> & Omit<{
-        readonly onSave?: ((value: QueryConditions<T>) => any) | undefined;
-        readonly "onUpdate:modelValue"?: ((value: QueryConditions<T>) => any) | undefined;
-        readonly onChange?: ((value: QueryConditions<T>) => any) | undefined;
-    } & import('vue').VNodeProps & import('vue').AllowedComponentProps & import('vue').ComponentCustomProps, never>, "onChange" | "onUpdate:modelValue" | "onSave"> & ({
-        modelValue?: QueryConditions<T>;
-    } & {
-        fields: Array<{
-            label: string;
-            value: string;
-            type?: "string" | "number" | "boolean" | "date";
-            options?: Option[] | ((query: string) => Promise<Option[]>);
-            multiple?: boolean;
-        }>;
-    }) & Partial<{}>> & import('vue').PublicProps;
-    expose(exposed: import('vue').ShallowUnwrapRef<{}>): void;
-    attrs: any;
-    slots: {};
-    emit: (((evt: "save", value: QueryConditions<T>) => void) & ((evt: "change", value: QueryConditions<T>) => void)) & ((evt: "update:modelValue", value: QueryConditions<T>) => void);
-}>) => import('vue').VNode & {
-    __ctx?: Awaited<typeof __VLS_setup>;
-};
-export default _default;
-type __VLS_PrettifyLocal<T> = {
-    [K in keyof T]: T[K];
-} & {};
-//# sourceMappingURL=Filter.vue.d.ts.map

package/dist/components/Filter.vue.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"Filter.vue.d.ts","sourceRoot":"","sources":["../../src/components/Filter.vue"],"names":[],"mappings":"AAAA,OAqeO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAC3C,OAAO,KAAK,EAAuC,eAAe,EAAE,MAAM,sBAAsB,CAAA;yBAI/E,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC7C,aAAa,WAAW,CAAC,OAAO,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAC9D,YAAY,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,WAAW,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,EAC3G,eAAe,WAAW,CAAC,OAAO,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,EACjE;WAwxBO,mBAAmB,CAAC;;;;;qBAlff,eAAe,CAAC,CAAC,CAAC;;gBA1RtB,KAAK,CAAC;YACb,KAAK,EAAE,MAAM,CAAA;YACb,KAAK,EAAE,MAAM,CAAA;YACb,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAA;YAC/C,OAAO,CAAC,sBAf+B,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,EAe5C;YACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;SAClB,CAAC;oBAswB2F,CAAC,4BAA2B;oBACzG,OAAO,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC,GAAG,IAAI;WAClD,GAAG;;UAEJ,6KAAoC;EAEvC,KACQ,OAAO,KAAK,EAAE,KAAK,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC,OAAO,WAAW,CAAC,CAAA;CAAE;AAnyBzE,wBAmyB4E;AAC5E,KAAK,mBAAmB,CAAC,CAAC,IAAI;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAAG,GAAG,EAAE,CAAC"}

package/dist/components/QueryFilter.vue.d.ts

@@ -1,30 +0,0 @@
-import { Option } from '..';
-import { QueryConditions } from '../utils/queryFilter';
-declare const _default: <T extends Record<string, any>>(__VLS_props: NonNullable<Awaited<typeof __VLS_setup>>["props"], __VLS_ctx?: __VLS_PrettifyLocal<Pick<NonNullable<Awaited<typeof __VLS_setup>>, "attrs" | "emit" | "slots">>, __VLS_expose?: NonNullable<Awaited<typeof __VLS_setup>>["expose"], __VLS_setup?: Promise<{
-    props: __VLS_PrettifyLocal<Pick<Partial<{}> & Omit<{
-        readonly onSave?: ((value: QueryConditions<T>) => any) | undefined;
-        readonly "onUpdate:modelValue"?: ((value: QueryConditions<T>) => any) | undefined;
-        readonly onChange?: ((value: QueryConditions<T>) => any) | undefined;
-    } & import('vue').VNodeProps & import('vue').AllowedComponentProps & import('vue').ComponentCustomProps, never>, "onChange" | "onUpdate:modelValue" | "onSave"> & ({
-        modelValue?: QueryConditions<T>;
-    } & {
-        fields: Array<{
-            label: string;
-            value: string;
-            type?: "string" | "number" | "boolean" | "date";
-            options?: Option[] | ((query: string) => Promise<Option[]>);
-            multiple?: boolean;
-        }>;
-    }) & Partial<{}>> & import('vue').PublicProps;
-    expose(exposed: import('vue').ShallowUnwrapRef<{}>): void;
-    attrs: any;
-    slots: {};
-    emit: (((evt: "save", value: QueryConditions<T>) => void) & ((evt: "change", value: QueryConditions<T>) => void)) & ((evt: "update:modelValue", value: QueryConditions<T>) => void);
-}>) => import('vue').VNode & {
-    __ctx?: Awaited<typeof __VLS_setup>;
-};
-export default _default;
-type __VLS_PrettifyLocal<T> = {
-    [K in keyof T]: T[K];
-} & {};
-//# sourceMappingURL=QueryFilter.vue.d.ts.map

package/dist/components/QueryFilter.vue.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"QueryFilter.vue.d.ts","sourceRoot":"","sources":["../../src/components/QueryFilter.vue"],"names":[],"mappings":"AAAA,OAqeO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAC3C,OAAO,KAAK,EAAuC,eAAe,EAAE,MAAM,sBAAsB,CAAA;yBAI/E,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC7C,aAAa,WAAW,CAAC,OAAO,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAC9D,YAAY,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,WAAW,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,EAC3G,eAAe,WAAW,CAAC,OAAO,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,EACjE;WA0xBO,mBAAmB,CAAC;;;;;qBApff,eAAe,CAAC,CAAC,CAAC;;gBA1RtB,KAAK,CAAC;YACb,KAAK,EAAE,MAAM,CAAA;YACb,KAAK,EAAE,MAAM,CAAA;YACb,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAA;YAC/C,OAAO,CAAC,sBAf+B,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,EAe5C;YACvB,QAAQ,CAAC,EAAE,OAAO,CAAA;SAClB,CAAC;oBAwwB2F,CAAC,4BAA2B;oBACzG,OAAO,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC,GAAG,IAAI;WAClD,GAAG;;UAEJ,6KAAoC;EAEvC,KACQ,OAAO,KAAK,EAAE,KAAK,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC,OAAO,WAAW,CAAC,CAAA;CAAE;AAryBzE,wBAqyB4E;AAC5E,KAAK,mBAAmB,CAAC,CAAC,IAAI;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAAG,GAAG,EAAE,CAAC"}