@bendyline/gezel 0.1.0 → 1.0.0

package/dist/svg/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Reduce arbitrary input to a small, inert, presentation-only SVG subset.
+ *
+ * The allowlist deliberately excludes style, links, image/use references,
+ * filters, animation, foreign content, and every event-bearing or namespaced
+ * attribute. The result is suitable for persistence and transport; render it
+ * as an image rather than inserting it into a live HTML DOM.
+ */
+declare function sanitizePresentationSvg(raw: string): string | null;
+
+export { sanitizePresentationSvg };

package/dist/svg/index.js

@@ -0,0 +1,202 @@
+// src/svg/sanitize.ts
+import { DOMParser, XMLSerializer } from "@xmldom/xmldom";
+var SVG_NAMESPACE = "http://www.w3.org/2000/svg";
+var XMLNS_NAMESPACE = "http://www.w3.org/2000/xmlns/";
+var MAX_SVG_BYTES = 1e5;
+var MAX_ELEMENTS = 2048;
+var MAX_DEPTH = 32;
+var MAX_ATTRIBUTE_VALUE = 4096;
+var ALLOWED_ELEMENTS = /* @__PURE__ */ new Set([
+  "svg",
+  "g",
+  "path",
+  "circle",
+  "ellipse",
+  "rect",
+  "line",
+  "polyline",
+  "polygon",
+  "defs",
+  "linearGradient",
+  "radialGradient",
+  "stop",
+  "clipPath",
+  "mask",
+  "title",
+  "desc"
+]);
+var DRAWABLE_ELEMENTS = /* @__PURE__ */ new Set([
+  "path",
+  "circle",
+  "ellipse",
+  "rect",
+  "line",
+  "polyline",
+  "polygon"
+]);
+var ALLOWED_ATTRIBUTES = /* @__PURE__ */ new Set([
+  "xmlns",
+  "viewBox",
+  "preserveAspectRatio",
+  "color",
+  "fill",
+  "fill-opacity",
+  "fill-rule",
+  "stroke",
+  "stroke-width",
+  "stroke-linecap",
+  "stroke-linejoin",
+  "stroke-miterlimit",
+  "stroke-dasharray",
+  "stroke-dashoffset",
+  "stroke-opacity",
+  "clip-rule",
+  "opacity",
+  "transform",
+  "vector-effect",
+  "paint-order",
+  "shape-rendering",
+  "d",
+  "points",
+  "x",
+  "y",
+  "x1",
+  "y1",
+  "x2",
+  "y2",
+  "cx",
+  "cy",
+  "r",
+  "rx",
+  "ry",
+  "width",
+  "height",
+  "offset",
+  "stop-color",
+  "stop-opacity",
+  "clip-path",
+  "mask",
+  "id",
+  "role",
+  "aria-hidden"
+]);
+function extractSvg(raw) {
+  if (!raw || raw.length > MAX_SVG_BYTES) return null;
+  if (/<!DOCTYPE|<!ENTITY/i.test(raw)) return null;
+  const start = raw.search(/<svg(?:\s|>)/);
+  if (start < 0) return null;
+  const end = raw.lastIndexOf("</svg>");
+  if (end < start) return null;
+  return raw.slice(start, end + "</svg>".length);
+}
+function hasUnsafeCharacters(value) {
+  for (const character of value) {
+    const code = character.codePointAt(0) ?? 0;
+    if (code < 32 && code !== 9 && code !== 10 && code !== 13 || code === 127) return true;
+    if (code >= 8234 && code <= 8238) return true;
+    if (code >= 8294 && code <= 8297) return true;
+  }
+  return false;
+}
+function isSafeLocalUrl(value) {
+  return /^url\(#[A-Za-z_][A-Za-z0-9_.:-]*\)$/.test(value.trim());
+}
+function attributeAllowed(element, root, name, value) {
+  if (!ALLOWED_ATTRIBUTES.has(name)) return false;
+  if (value.length > MAX_ATTRIBUTE_VALUE || hasUnsafeCharacters(value)) return false;
+  if (/url\s*\(/i.test(value) && !isSafeLocalUrl(value)) return false;
+  if (name === "id" && !/^[A-Za-z_][A-Za-z0-9_.:-]*$/.test(value)) return false;
+  if (name === "xmlns") {
+    return element === root && value === SVG_NAMESPACE;
+  }
+  return true;
+}
+function sanitizeElement(element, root, depth, state) {
+  state.elements += 1;
+  if (state.elements > MAX_ELEMENTS || depth > MAX_DEPTH) {
+    state.invalid = true;
+    return;
+  }
+  if (element.localName && DRAWABLE_ELEMENTS.has(element.localName)) state.drawableElements += 1;
+  for (let index = element.attributes.length - 1; index >= 0; index -= 1) {
+    const attribute = element.attributes.item(index);
+    if (!attribute) continue;
+    const plainAttribute = !attribute.prefix && !attribute.namespaceURI;
+    const rootXmlns = element === root && attribute.name === "xmlns" && attribute.namespaceURI === XMLNS_NAMESPACE;
+    if (!plainAttribute && !rootXmlns || attribute.name !== attribute.localName || !attributeAllowed(element, root, attribute.localName, attribute.value)) {
+      element.removeAttributeNode(attribute);
+    }
+  }
+  let child = element.firstChild;
+  while (child) {
+    const next = child.nextSibling;
+    if (child.nodeType === 1) {
+      const childElement = child;
+      if (childElement.namespaceURI !== SVG_NAMESPACE || !!childElement.prefix || !childElement.localName || !ALLOWED_ELEMENTS.has(childElement.localName)) {
+        element.removeChild(child);
+      } else {
+        sanitizeElement(childElement, root, depth + 1, state);
+      }
+    } else if (child.nodeType === 3) {
+      const mayContainText = element.localName === "title" || element.localName === "desc";
+      if (!mayContainText && child.nodeValue?.trim()) element.removeChild(child);
+    } else {
+      element.removeChild(child);
+    }
+    child = next;
+  }
+}
+function removeBrokenLocalReferences(root) {
+  const ids = /* @__PURE__ */ new Set();
+  const visit = (element) => {
+    const id = element.getAttribute("id");
+    if (id) {
+      if (ids.has(id)) element.removeAttribute("id");
+      else ids.add(id);
+    }
+    for (let child = element.firstChild; child; child = child.nextSibling) {
+      if (child.nodeType === 1) visit(child);
+    }
+  };
+  visit(root);
+  const validate = (element) => {
+    for (let index = element.attributes.length - 1; index >= 0; index -= 1) {
+      const attribute = element.attributes.item(index);
+      if (!attribute) continue;
+      const match = /^url\(#([A-Za-z_][A-Za-z0-9_.:-]*)\)$/.exec(attribute.value.trim());
+      if (match && !ids.has(match[1])) element.removeAttributeNode(attribute);
+    }
+    for (let child = element.firstChild; child; child = child.nextSibling) {
+      if (child.nodeType === 1) validate(child);
+    }
+  };
+  validate(root);
+}
+function sanitizePresentationSvg(raw) {
+  const candidate = extractSvg(raw);
+  if (!candidate) return null;
+  let document;
+  try {
+    document = new DOMParser({
+      locator: false,
+      onError: (_level, message) => {
+        throw new Error(message);
+      }
+    }).parseFromString(candidate, "image/svg+xml");
+  } catch {
+    return null;
+  }
+  const root = document.documentElement;
+  if (!root || root.localName !== "svg" || root.namespaceURI !== SVG_NAMESPACE || !!root.prefix || root.parentNode !== document) {
+    return null;
+  }
+  const state = { elements: 0, drawableElements: 0, invalid: false };
+  sanitizeElement(root, root, 0, state);
+  if (state.invalid || state.drawableElements === 0) return null;
+  removeBrokenLocalReferences(root);
+  const serialized = new XMLSerializer().serializeToString(root);
+  return serialized.length <= MAX_SVG_BYTES ? serialized : null;
+}
+export {
+  sanitizePresentationSvg
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bendyline/gezel",
-  "version": "0.1.0",
+  "version": "1.0.0",
   "description": "Gezel core: types, schemas, path helpers, agent-markdown parser.",
   "license": "MIT",
   "keywords": [
@@ -60,6 +60,10 @@
     "./checks": {
       "types": "./dist/checks/index.d.ts",
       "import": "./dist/checks/index.js"
+    },
+    "./svg": {
+      "types": "./dist/svg/index.d.ts",
+      "import": "./dist/svg/index.js"
     }
   },
   "files": [
@@ -67,6 +71,7 @@
     "!dist/**/*.map"
   ],
   "dependencies": {
+    "@xmldom/xmldom": "^0.9.10",
     "yaml": "^2.9.0",
     "zod": "^4.4.3"
   },