@bendyline/squisq 2.1.0 → 2.2.0

package/dist/{chunk-66QO7XFB.js → chunk-ACZOVWX3.js}

@@ -5,14 +5,14 @@ import {
   quoteAttrValue,
   splitKeyValueToken,
   tokenizeAttrTokens
-} from "./chunk-R2YZTCLO.js";
+} from "./chunk-ZQKZSJAX.js";
 import {
   resolveIcon
-} from "./chunk-DBS6RIFL.js";
+} from "./chunk-7N4G32LG.js";
 import {
   parseFrontmatter,
   parseHtmlToNodes
-} from "./chunk-AMIR72JP.js";
+} from "./chunk-BCCXTMN5.js";
 
 // src/markdown/convert.ts
 function convertPosition(pos) {
@@ -923,15 +923,26 @@ function inlineToMdast(node) {
       return { type: "text", value: "" };
   }
 }
+function escapeHtmlText(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function nodeTreeText(node) {
+  if (!node || typeof node !== "object") return "";
+  const candidate = node;
+  if (typeof candidate.value === "string") return candidate.value;
+  if (Array.isArray(candidate.children)) return candidate.children.map(nodeTreeText).join("");
+  return "";
+}
 function definitionListToHtml(list) {
   let html = "<dl>\n";
   for (const child of list.children) {
     if (child.type === "definitionTerm") {
-      const text = child.children.map((c) => c.value ?? "").join("");
-      html += `  <dt>${text}</dt>
+      const text = (child.children ?? []).map(nodeTreeText).join("");
+      html += `  <dt>${escapeHtmlText(text)}</dt>
 `;
     } else if (child.type === "definitionDescription") {
-      html += `  <dd>...</dd>
+      const text = (child.children ?? []).map(nodeTreeText).join(" ").trim();
+      html += `  <dd>${escapeHtmlText(text)}</dd>
 `;
     }
   }
@@ -939,6 +950,98 @@ function definitionListToHtml(list) {
   return html;
 }
 
+// src/markdown/limits.ts
+var DEFAULT_MARKDOWN_SAFETY_LIMITS = Object.freeze({
+  maxSourceBytes: 16 * 1024 * 1024,
+  maxNodes: 25e4,
+  maxDepth: 128,
+  maxTableCells: 1e5
+});
+var MarkdownLimitError = class extends RangeError {
+  constructor(code, message) {
+    super(message);
+    this.name = "MarkdownLimitError";
+    this.code = code;
+  }
+};
+function assertMarkdownSourceWithinLimits(source, limits) {
+  if (limits === false) return;
+  const resolved = resolveMarkdownSafetyLimits(limits);
+  if (utf8ByteLength(source, resolved.maxSourceBytes) > resolved.maxSourceBytes) {
+    throw new MarkdownLimitError(
+      "SOURCE_BYTES",
+      `Markdown source exceeds the ${resolved.maxSourceBytes}-byte safety limit`
+    );
+  }
+}
+function assertMarkdownDocumentWithinLimits(document, limits, signal) {
+  if (limits === false) return;
+  const resolved = resolveMarkdownSafetyLimits(limits);
+  const stack = [{ value: document, depth: 0 }];
+  let nodes = 0;
+  let tableCells = 0;
+  while (stack.length > 0) {
+    if ((nodes & 1023) === 0) signal?.throwIfAborted();
+    const current = stack.pop();
+    if (!current.value || typeof current.value !== "object") continue;
+    const node = current.value;
+    if (typeof node.type !== "string") continue;
+    nodes += 1;
+    if (nodes > resolved.maxNodes) {
+      throw new MarkdownLimitError(
+        "NODES",
+        `Markdown document exceeds the ${resolved.maxNodes}-node safety limit`
+      );
+    }
+    if (current.depth > resolved.maxDepth) {
+      throw new MarkdownLimitError(
+        "DEPTH",
+        `Markdown document exceeds the ${resolved.maxDepth}-level nesting safety limit`
+      );
+    }
+    if (node.type === "tableCell" && ++tableCells > resolved.maxTableCells) {
+      throw new MarkdownLimitError(
+        "TABLE_CELLS",
+        `Markdown document exceeds the ${resolved.maxTableCells}-table-cell safety limit`
+      );
+    }
+    pushChildren(stack, node.children, current.depth + 1);
+    pushChildren(stack, node.htmlChildren, current.depth + 1);
+  }
+}
+function resolveMarkdownSafetyLimits(limits) {
+  const resolved = { ...DEFAULT_MARKDOWN_SAFETY_LIMITS, ...limits };
+  for (const [name, value] of Object.entries(resolved)) {
+    if (!Number.isSafeInteger(value) || value < 0) {
+      throw new RangeError(`${name} must be a non-negative safe integer`);
+    }
+  }
+  return resolved;
+}
+function pushChildren(stack, children, depth) {
+  if (!Array.isArray(children)) return;
+  for (let index = children.length - 1; index >= 0; index--) {
+    stack.push({ value: children[index], depth });
+  }
+}
+function utf8ByteLength(value, stopAfter) {
+  let bytes = 0;
+  for (let index = 0; index < value.length; index++) {
+    const code = value.charCodeAt(index);
+    if (code < 128) bytes += 1;
+    else if (code < 2048) bytes += 2;
+    else if (code >= 55296 && code <= 56319 && index + 1 < value.length) {
+      const next = value.charCodeAt(index + 1);
+      if (next >= 56320 && next <= 57343) {
+        bytes += 4;
+        index += 1;
+      } else bytes += 3;
+    } else bytes += 3;
+    if (bytes > stopAfter) return bytes;
+  }
+  return bytes;
+}
+
 // src/markdown/parse.ts
 import { unified } from "unified";
 import remarkParse from "remark-parse";
@@ -948,6 +1051,8 @@ import remarkDirective from "remark-directive";
 import remarkFrontmatter from "remark-frontmatter";
 var defaultProcessor;
 function parseMarkdown(markdown, options) {
+  options?.signal?.throwIfAborted();
+  assertMarkdownSourceWithinLimits(markdown, options?.limits);
   const useDefaults = !options || options.gfm !== false && options.math !== false && options.directive !== false && options.frontmatter !== false;
   let processor;
   if (useDefaults) {
@@ -974,6 +1079,7 @@ function parseMarkdown(markdown, options) {
   const doc = fromMdast(mdastTree, {
     parseHtml: options?.parseHtml
   });
+  assertMarkdownDocumentWithinLimits(doc, options?.limits, options?.signal);
   if (options?.frontmatter !== false) {
     const yamlNode = mdastTree.children?.find((n) => n.type === "yaml");
     if (yamlNode?.value) {
@@ -991,6 +1097,10 @@ export {
   serializePandocAttributes,
   fromMdast,
   toMdast,
+  DEFAULT_MARKDOWN_SAFETY_LIMITS,
+  MarkdownLimitError,
+  assertMarkdownSourceWithinLimits,
+  assertMarkdownDocumentWithinLimits,
+  resolveMarkdownSafetyLimits,
   parseMarkdown
 };
-//# sourceMappingURL=chunk-66QO7XFB.js.map

package/dist/{chunk-5J4HKRJF.js → chunk-BAOV476U.js}

@@ -212,4 +212,3 @@ export {
   cloneData,
   cloneAndFreezeData
 };
-//# sourceMappingURL=chunk-5J4HKRJF.js.map