@bendyline/squisq 2.3.2 → 2.3.3

package/dist/{chunk-ZQKZSJAX.js → chunk-2VCNTDNZ.js}

@@ -5,6 +5,249 @@ import {
   normalizeTransitionType
 } from "./chunk-4VOD55SX.js";
 
+// src/markdown/sanitize.ts
+var SAFE_LINK_SCHEMES = /* @__PURE__ */ new Set(["http", "https", "mailto", "tel"]);
+var SAFE_MEDIA_SCHEMES = /* @__PURE__ */ new Set(["http", "https", "blob"]);
+var NEVER_ALLOWED_SCHEMES = /* @__PURE__ */ new Set(["javascript", "vbscript", "data"]);
+var SAFE_DATA_MEDIA_RE = /^data:(?:image\/(?!svg\+xml)[a-z0-9.+-]+|audio\/[a-z0-9.+-]+|video\/[a-z0-9.+-]+);/i;
+var SAFE_TAGS = /* @__PURE__ */ new Set([
+  "a",
+  "abbr",
+  "b",
+  "blockquote",
+  "br",
+  "caption",
+  "cite",
+  "code",
+  "col",
+  "colgroup",
+  "data",
+  "dd",
+  "del",
+  "details",
+  "dfn",
+  "div",
+  "dl",
+  "dt",
+  "em",
+  "figcaption",
+  "figure",
+  "h1",
+  "h2",
+  "h3",
+  "h4",
+  "h5",
+  "h6",
+  "hr",
+  "i",
+  "img",
+  "kbd",
+  "li",
+  "mark",
+  "ol",
+  "p",
+  "pre",
+  "q",
+  "s",
+  "samp",
+  "small",
+  "source",
+  "span",
+  "strong",
+  "sub",
+  "summary",
+  "sup",
+  "table",
+  "tbody",
+  "td",
+  "tfoot",
+  "th",
+  "thead",
+  "time",
+  "tr",
+  "track",
+  "u",
+  "ul",
+  "var",
+  "video",
+  "audio"
+]);
+var DROP_WITH_CONTENT_TAGS = /* @__PURE__ */ new Set([
+  "base",
+  "button",
+  "embed",
+  "form",
+  "iframe",
+  "input",
+  "link",
+  "meta",
+  "object",
+  "option",
+  "script",
+  "select",
+  "style",
+  "svg",
+  "template",
+  "textarea"
+]);
+var GLOBAL_ATTRS = /* @__PURE__ */ new Set(["class", "id", "title", "role"]);
+var TAG_ATTRS = {
+  a: /* @__PURE__ */ new Set(["href", "target", "rel"]),
+  audio: /* @__PURE__ */ new Set(["src", "controls", "preload", "muted", "loop"]),
+  col: /* @__PURE__ */ new Set(["span", "width"]),
+  colgroup: /* @__PURE__ */ new Set(["span"]),
+  data: /* @__PURE__ */ new Set(["value"]),
+  img: /* @__PURE__ */ new Set(["src", "alt", "width", "height", "loading", "decoding"]),
+  li: /* @__PURE__ */ new Set(["value"]),
+  ol: /* @__PURE__ */ new Set(["start", "type"]),
+  q: /* @__PURE__ */ new Set(["cite"]),
+  source: /* @__PURE__ */ new Set(["src", "type", "media"]),
+  td: /* @__PURE__ */ new Set(["colspan", "rowspan", "align"]),
+  th: /* @__PURE__ */ new Set(["colspan", "rowspan", "align", "scope"]),
+  time: /* @__PURE__ */ new Set(["datetime"]),
+  track: /* @__PURE__ */ new Set(["src", "kind", "label", "srclang", "default"]),
+  video: /* @__PURE__ */ new Set([
+    "src",
+    "poster",
+    "width",
+    "height",
+    "controls",
+    "preload",
+    "muted",
+    "loop",
+    "playsinline"
+  ])
+};
+var SAFE_ATTR_NAME_RE = /^[a-z][a-z0-9:_.-]*$/;
+var SAFE_OL_TYPES = /* @__PURE__ */ new Set(["1", "a", "A", "i", "I"]);
+var SAFE_PRELOAD_VALUES = /* @__PURE__ */ new Set(["none", "metadata", "auto"]);
+var SAFE_TRACK_KINDS = /* @__PURE__ */ new Set(["subtitles", "captions", "descriptions", "chapters", "metadata"]);
+function sanitizeUrl(url, kind = "link", options) {
+  if (typeof url !== "string") return null;
+  const trimmed = url.trim();
+  if (!trimmed) return null;
+  const compact = stripUrlSchemeNoise(trimmed);
+  const colon = compact.indexOf(":");
+  const firstPathChar = firstIndexOfAny(compact, ["/", "?", "#"]);
+  const hasScheme = colon >= 0 && (firstPathChar < 0 || colon < firstPathChar);
+  if (!hasScheme) return trimmed;
+  const scheme = compact.slice(0, colon).toLowerCase();
+  if (kind === "media") {
+    if (scheme === "data") return SAFE_DATA_MEDIA_RE.test(compact) ? trimmed : null;
+    return SAFE_MEDIA_SCHEMES.has(scheme) ? trimmed : null;
+  }
+  if (SAFE_LINK_SCHEMES.has(scheme)) return trimmed;
+  if (options?.extraLinkSchemes?.includes(scheme) && !NEVER_ALLOWED_SCHEMES.has(scheme)) {
+    return trimmed;
+  }
+  return null;
+}
+function sanitizeHtmlNodes(nodes) {
+  const out = [];
+  for (const node of nodes) {
+    out.push(...sanitizeHtmlNode(node));
+  }
+  return out;
+}
+function sanitizeHtmlNode(node) {
+  switch (node.type) {
+    case "htmlText":
+      return [node];
+    case "htmlComment":
+      return [];
+    case "htmlElement":
+      return sanitizeHtmlElement(node);
+  }
+}
+function sanitizeHtmlElement(node) {
+  const tag = node.tagName.toLowerCase();
+  if (DROP_WITH_CONTENT_TAGS.has(tag)) return [];
+  const children = sanitizeHtmlNodes(node.children);
+  if (!SAFE_TAGS.has(tag)) return children;
+  return [
+    {
+      type: "htmlElement",
+      tagName: tag,
+      attributes: sanitizeAttrs(tag, node.attributes),
+      children,
+      selfClosing: node.selfClosing
+    }
+  ];
+}
+function sanitizeAttrs(tag, attrs) {
+  const out = {};
+  for (const [rawName, rawValue] of Object.entries(attrs)) {
+    const name = rawName.toLowerCase();
+    if (!isAllowedAttr(tag, name)) continue;
+    const value = String(rawValue);
+    const safeValue = sanitizeAttrValue(tag, name, value);
+    if (safeValue === null) continue;
+    out[name] = safeValue;
+  }
+  if (tag === "a" && out.target === "_blank") {
+    out.rel = ensureRelTokens(out.rel, ["noopener", "noreferrer"]);
+  }
+  return out;
+}
+function isAllowedAttr(tag, name) {
+  if (!SAFE_ATTR_NAME_RE.test(name)) return false;
+  if (name.startsWith("on")) return false;
+  if (name.startsWith("aria-") || name.startsWith("data-")) return true;
+  if (GLOBAL_ATTRS.has(name)) return true;
+  return TAG_ATTRS[tag]?.has(name) ?? false;
+}
+function sanitizeAttrValue(tag, name, value) {
+  if (name === "href") return sanitizeUrl(value, "link");
+  if (name === "src" || name === "poster") return sanitizeUrl(value, "media");
+  if ((name === "width" || name === "height" || name === "span" || name === "colspan" || name === "rowspan" || name === "value") && !isNonNegativeInteger(value)) {
+    return null;
+  }
+  if (name === "start" && !isInteger(value)) return null;
+  if (name === "type" && tag === "ol" && !SAFE_OL_TYPES.has(value)) return null;
+  if (name === "preload" && !SAFE_PRELOAD_VALUES.has(value)) return null;
+  if (name === "kind" && tag === "track" && !SAFE_TRACK_KINDS.has(value)) return null;
+  if (name === "align" && value !== "left" && value !== "right" && value !== "center") return null;
+  if (name === "target")
+    return value === "_blank" || value === "_self" || value === "_parent" || value === "_top" ? value : null;
+  if (name === "rel") return sanitizeRel(value);
+  return value;
+}
+function sanitizeRel(value) {
+  return relTokens(value).join(" ");
+}
+function ensureRelTokens(value, required) {
+  const tokens = new Set(value ? relTokens(value) : []);
+  for (const token of required) tokens.add(token);
+  return Array.from(tokens).join(" ");
+}
+function relTokens(value) {
+  const tokens = value.split(/\s+/).map((token) => token.trim().toLowerCase()).filter(Boolean).filter((token) => /^[a-z0-9_-]+$/.test(token));
+  return Array.from(new Set(tokens));
+}
+function isInteger(value) {
+  return /^-?\d+$/.test(value.trim());
+}
+function isNonNegativeInteger(value) {
+  return /^\d+$/.test(value.trim());
+}
+function firstIndexOfAny(value, needles) {
+  let result = -1;
+  for (const needle of needles) {
+    const index = value.indexOf(needle);
+    if (index >= 0 && (result < 0 || index < result)) result = index;
+  }
+  return result;
+}
+function stripUrlSchemeNoise(value) {
+  let out = "";
+  for (const char of value) {
+    const code = char.charCodeAt(0);
+    if (code <= 32 || code === 127 || char.trim() === "") continue;
+    out += char;
+  }
+  return out;
+}
+
 // src/markdown/annotationCoercion.ts
 var KNOWN_BLOCK_META_KEYS = {
   x: "number",
@@ -275,6 +518,8 @@ function serializeAnnotation(template, params) {
 }
 
 export {
+  sanitizeUrl,
+  sanitizeHtmlNodes,
   KNOWN_BLOCK_META_KEYS,
   BLOCK_META_KEY_DESCRIPTORS,
   coerceAnnotationValues,

package/dist/{chunk-BCHAXKKI.js → chunk-ABP4LAJS.js}

@@ -1,7 +1,7 @@
 import {
   expectedSyllablesAt,
   wordPosAtExpectedSyllables
-} from "./chunk-CKZY6K5R.js";
+} from "./chunk-GQNH7PLN.js";
 
 // src/narration/types.ts
 var DEFAULT_FEATURE_CONFIG = Object.freeze({

package/dist/{chunk-ACZOVWX3.js → chunk-G3JOS25T.js}

@@ -5,7 +5,7 @@ import {
   quoteAttrValue,
   splitKeyValueToken,
   tokenizeAttrTokens
-} from "./chunk-ZQKZSJAX.js";
+} from "./chunk-2VCNTDNZ.js";
 import {
   resolveIcon
 } from "./chunk-7N4G32LG.js";