@bikdotai/bik-component-library 0.0.838-beta.0 → 0.0.838-beta.2

package/dist/esm/helpers/sanitize.d.ts

@@ -0,0 +1,26 @@
+export declare const isAllowedUrl: (url: string | null | undefined, allowed: Set<string>) => string | null;
+export declare const isAllowedLinkUrl: (url?: string | null) => boolean;
+export declare const isAllowedImageUrl: (url?: string | null) => boolean;
+export declare const stripHtmlTags: (input: string | null | undefined) => string;
+/**
+ * Escape CSV/Excel formula injection. Prefixes values starting with a
+ * formula-triggering character (=, +, -, @, tab, CR) with a single quote
+ * so spreadsheet software treats them as literal text.
+ */
+export declare const escapeFormulaInjection: (input: string | null | undefined) => string;
+/**
+ * Render-safe plain text. Strips every tag and returns safe HTML (with
+ * entities). Use at render sinks that must show plain text via innerHTML.
+ * For input onChange, use stripHtmlTags instead.
+ */
+export declare const sanitizePlainText: (input: string | null | undefined) => string;
+/**
+ * Basic rich text. A small formatting allowlist; no style tag/attr, links
+ * restricted to safe protocols.
+ */
+export declare const sanitizeBasicHtml: (input: string | null | undefined) => string;
+/**
+ * Full rich text / inbound email HTML. Allowlist of tags and attributes an
+ * email needs to render; everything else is stripped.
+ */
+export declare const sanitizeEmailHtml: (input: string | null | undefined) => string;

package/dist/esm/helpers/sanitize.js

@@ -0,0 +1,123 @@
+import e from "dompurify";
+const r = () => typeof window < "u", l = /<\/?[^>]+(>|$)/g, a = /* @__PURE__ */ new Set(["https:", "mailto:", "tel:"]), i = /* @__PURE__ */ new Set(["https:", "data:"]), s = (t, o) => {
+  if (!t) return null;
+  try {
+    const n = new URL(t, "https://bik.local");
+    return o.has(n.protocol) ? t : null;
+  } catch {
+    return null;
+  }
+}, A = (t) => s(t, a) !== null, u = (t) => s(t, i) !== null, c = /<\/?[a-zA-Z][a-zA-Z0-9]*(?:\s[^>]*)?\/?>/g, T = (t) => t ? t.replace(c, "") : "", L = /^[=+\-@\t\r]/, h = (t) => t ? L.test(t) ? `'${t}` : t : "", _ = (t) => t ? r() ? e.sanitize(t, {
+  ALLOWED_TAGS: [],
+  ALLOWED_ATTR: [],
+  KEEP_CONTENT: !0
+}) : t.replace(l, "") : "", f = (t) => t ? r() ? e.sanitize(t, {
+  ALLOWED_TAGS: [
+    "p",
+    "br",
+    "b",
+    "strong",
+    "i",
+    "em",
+    "u",
+    "s",
+    "span",
+    "a",
+    "ul",
+    "ol",
+    "li",
+    "blockquote"
+  ],
+  ALLOWED_ATTR: ["href", "target", "rel", "class"],
+  FORBID_TAGS: ["style"],
+  FORBID_ATTR: ["style"],
+  ALLOWED_URI_REGEXP: /^(?:https|mailto|tel):/i
+}) : t.replace(l, "") : "", E = (t) => t ? r() ? e.sanitize(t, {
+  ALLOWED_TAGS: [
+    "p",
+    "br",
+    "div",
+    "span",
+    "strong",
+    "b",
+    "em",
+    "i",
+    "u",
+    "s",
+    "ul",
+    "ol",
+    "li",
+    "blockquote",
+    "h1",
+    "h2",
+    "h3",
+    "h4",
+    "h5",
+    "h6",
+    "a",
+    "img",
+    "table",
+    "thead",
+    "tbody",
+    "tfoot",
+    "tr",
+    "th",
+    "td",
+    "caption",
+    "colgroup",
+    "col",
+    "center",
+    "font",
+    "hr",
+    "pre",
+    "code",
+    "sub",
+    "sup",
+    "small",
+    "big",
+    "figure",
+    "figcaption",
+    "section",
+    "article",
+    "header",
+    "footer",
+    "abbr",
+    "cite",
+    "mark",
+    "del",
+    "ins"
+  ],
+  ALLOWED_ATTR: [
+    "href",
+    "target",
+    "rel",
+    "src",
+    "alt",
+    "title",
+    "width",
+    "height",
+    "style",
+    "class",
+    "align",
+    "valign",
+    "colspan",
+    "rowspan",
+    "cellpadding",
+    "cellspacing",
+    "border",
+    "color",
+    "bgcolor"
+  ],
+  ALLOW_UNKNOWN_PROTOCOLS: !1
+}) : t.replace(l, "") : "";
+export {
+  h as escapeFormulaInjection,
+  u as isAllowedImageUrl,
+  A as isAllowedLinkUrl,
+  s as isAllowedUrl,
+  f as sanitizeBasicHtml,
+  E as sanitizeEmailHtml,
+  _ as sanitizePlainText,
+  T as stripHtmlTags
+};
+//# sourceMappingURL=sanitize.js.map

package/dist/esm/helpers/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sources":["../../../src/helpers/sanitize.ts"],"sourcesContent":["import DOMPurify from 'dompurify';\n\n/**\n * Central HTML/CSS-injection sanitisation for the component library.\n *\n * Two categories:\n *\n * INPUT layer (onChange) — strips tags, keeps plain text:\n *   - stripHtmlTags:          remove every HTML tag, return raw text\n *   - escapeFormulaInjection: prefix CSV-dangerous leading chars with '\n *\n * RENDER layer (dangerouslySetInnerHTML / innerHTML) — DOMPurify-based:\n *   - sanitizePlainText:  ALLOWED_TAGS: [] (for sinks that must show plain text)\n *   - sanitizeBasicHtml:  formatting allowlist (chat bubbles, rich previews)\n *   - sanitizeEmailHtml:  full email allowlist (tables, images, inline style)\n */\n\nconst hasDOM = (): boolean => typeof window !== 'undefined';\n\nconst REGEX_TAG_STRIP = /<\\/?[^>]+(>|$)/g;\n\nconst ALLOWED_LINK_PROTOCOLS = new Set(['https:', 'mailto:', 'tel:']);\nconst ALLOWED_IMG_PROTOCOLS = new Set(['https:', 'data:']);\n\nexport const isAllowedUrl = (\n\turl: string | null | undefined,\n\tallowed: Set<string>,\n): string | null => {\n\tif (!url) return null;\n\ttry {\n\t\tconst parsed = new URL(url, 'https://bik.local');\n\t\treturn allowed.has(parsed.protocol) ? url : null;\n\t} catch {\n\t\treturn null;\n\t}\n};\n\nexport const isAllowedLinkUrl = (url?: string | null): boolean =>\n\tisAllowedUrl(url, ALLOWED_LINK_PROTOCOLS) !== null;\n\nexport const isAllowedImageUrl = (url?: string | null): boolean =>\n\tisAllowedUrl(url, ALLOWED_IMG_PROTOCOLS) !== null;\n\n// ---------------------------------------------------------------------------\n// INPUT layer — for onChange handlers on plain-text inputs\n// ---------------------------------------------------------------------------\n\n/**\n * Strip complete HTML tags from the input, return the raw text content.\n * Uses a regex that only matches tags with both < and >, so partial input\n * like \"<h\" while typing is preserved (no closing >, not a tag yet).\n *\n * \"<h1>Hello</h1>\"  → \"Hello\"\n * \"<h\"              → \"<h\"      (incomplete, kept)\n * \"2 < 3\"           → \"2 < 3\"\n * \"<script>x</script>\" → \"x\"\n */\nconst COMPLETE_TAG = /<\\/?[a-zA-Z][a-zA-Z0-9]*(?:\\s[^>]*)?\\/?>/g;\n\nexport const stripHtmlTags = (input: string | null | undefined): string => {\n\tif (!input) return '';\n\treturn input.replace(COMPLETE_TAG, '');\n};\n\nconst CSV_FORMULA_PREFIX = /^[=+\\-@\\t\\r]/;\n\n/**\n * Escape CSV/Excel formula injection. Prefixes values starting with a\n * formula-triggering character (=, +, -, @, tab, CR) with a single quote\n * so spreadsheet software treats them as literal text.\n */\nexport const escapeFormulaInjection = (\n\tinput: string | null | undefined,\n): string => {\n\tif (!input) return '';\n\treturn CSV_FORMULA_PREFIX.test(input) ? `'${input}` : input;\n};\n\n// ---------------------------------------------------------------------------\n// RENDER layer — for dangerouslySetInnerHTML / innerHTML sinks\n// ---------------------------------------------------------------------------\n\n/**\n * Render-safe plain text. Strips every tag and returns safe HTML (with\n * entities). Use at render sinks that must show plain text via innerHTML.\n * For input onChange, use stripHtmlTags instead.\n */\nexport const sanitizePlainText = (input: string | null | undefined): string => {\n\tif (!input) return '';\n\tif (!hasDOM()) return input.replace(REGEX_TAG_STRIP, '');\n\treturn DOMPurify.sanitize(input, {\n\t\tALLOWED_TAGS: [],\n\t\tALLOWED_ATTR: [],\n\t\tKEEP_CONTENT: true,\n\t});\n};\n\n/**\n * Basic rich text. A small formatting allowlist; no style tag/attr, links\n * restricted to safe protocols.\n */\nexport const sanitizeBasicHtml = (input: string | null | undefined): string => {\n\tif (!input) return '';\n\tif (!hasDOM()) return input.replace(REGEX_TAG_STRIP, '');\n\treturn DOMPurify.sanitize(input, {\n\t\tALLOWED_TAGS: [\n\t\t\t'p',\n\t\t\t'br',\n\t\t\t'b',\n\t\t\t'strong',\n\t\t\t'i',\n\t\t\t'em',\n\t\t\t'u',\n\t\t\t's',\n\t\t\t'span',\n\t\t\t'a',\n\t\t\t'ul',\n\t\t\t'ol',\n\t\t\t'li',\n\t\t\t'blockquote',\n\t\t],\n\t\tALLOWED_ATTR: ['href', 'target', 'rel', 'class'],\n\t\tFORBID_TAGS: ['style'],\n\t\tFORBID_ATTR: ['style'],\n\t\tALLOWED_URI_REGEXP: /^(?:https|mailto|tel):/i,\n\t});\n};\n\n/**\n * Full rich text / inbound email HTML. Allowlist of tags and attributes an\n * email needs to render; everything else is stripped.\n */\nexport const sanitizeEmailHtml = (input: string | null | undefined): string => {\n\tif (!input) return '';\n\tif (!hasDOM()) return input.replace(REGEX_TAG_STRIP, '');\n\treturn DOMPurify.sanitize(input, {\n\t\tALLOWED_TAGS: [\n\t\t\t'p',\n\t\t\t'br',\n\t\t\t'div',\n\t\t\t'span',\n\t\t\t'strong',\n\t\t\t'b',\n\t\t\t'em',\n\t\t\t'i',\n\t\t\t'u',\n\t\t\t's',\n\t\t\t'ul',\n\t\t\t'ol',\n\t\t\t'li',\n\t\t\t'blockquote',\n\t\t\t'h1',\n\t\t\t'h2',\n\t\t\t'h3',\n\t\t\t'h4',\n\t\t\t'h5',\n\t\t\t'h6',\n\t\t\t'a',\n\t\t\t'img',\n\t\t\t'table',\n\t\t\t'thead',\n\t\t\t'tbody',\n\t\t\t'tfoot',\n\t\t\t'tr',\n\t\t\t'th',\n\t\t\t'td',\n\t\t\t'caption',\n\t\t\t'colgroup',\n\t\t\t'col',\n\t\t\t'center',\n\t\t\t'font',\n\t\t\t'hr',\n\t\t\t'pre',\n\t\t\t'code',\n\t\t\t'sub',\n\t\t\t'sup',\n\t\t\t'small',\n\t\t\t'big',\n\t\t\t'figure',\n\t\t\t'figcaption',\n\t\t\t'section',\n\t\t\t'article',\n\t\t\t'header',\n\t\t\t'footer',\n\t\t\t'abbr',\n\t\t\t'cite',\n\t\t\t'mark',\n\t\t\t'del',\n\t\t\t'ins',\n\t\t],\n\t\tALLOWED_ATTR: [\n\t\t\t'href',\n\t\t\t'target',\n\t\t\t'rel',\n\t\t\t'src',\n\t\t\t'alt',\n\t\t\t'title',\n\t\t\t'width',\n\t\t\t'height',\n\t\t\t'style',\n\t\t\t'class',\n\t\t\t'align',\n\t\t\t'valign',\n\t\t\t'colspan',\n\t\t\t'rowspan',\n\t\t\t'cellpadding',\n\t\t\t'cellspacing',\n\t\t\t'border',\n\t\t\t'color',\n\t\t\t'bgcolor',\n\t\t],\n\t\tALLOW_UNKNOWN_PROTOCOLS: false,\n\t});\n};\n"],"names":["hasDOM","REGEX_TAG_STRIP","ALLOWED_LINK_PROTOCOLS","ALLOWED_IMG_PROTOCOLS","isAllowedUrl","url","allowed","parsed","isAllowedLinkUrl","isAllowedImageUrl","COMPLETE_TAG","stripHtmlTags","input","CSV_FORMULA_PREFIX","escapeFormulaInjection","sanitizePlainText","DOMPurify","sanitizeBasicHtml","sanitizeEmailHtml"],"mappings":";AAiBA,MAAMA,IAAS,MAAe,OAAO,SAAW,KAE1CC,IAAkB,mBAElBC,IAAyB,oBAAI,IAAI,CAAC,UAAU,WAAW,MAAM,CAAC,GAC9DC,IAAwB,oBAAI,IAAI,CAAC,UAAU,OAAO,CAAC,GAE5CC,IAAe,CAC3BC,GACAC,MACmB;AACnB,MAAI,CAACD,EAAK,QAAO;AACjB,MAAI;AACH,UAAME,IAAS,IAAI,IAAIF,GAAK,mBAAmB;AAC/C,WAAOC,EAAQ,IAAIC,EAAO,QAAQ,IAAIF,IAAM;AAAA,EAC7C,QAAQ;AACP,WAAO;AAAA,EACR;AACD,GAEaG,IAAmB,CAACH,MAChCD,EAAaC,GAAKH,CAAsB,MAAM,MAElCO,IAAoB,CAACJ,MACjCD,EAAaC,GAAKF,CAAqB,MAAM,MAgBxCO,IAAe,6CAERC,IAAgB,CAACC,MACxBA,IACEA,EAAM,QAAQF,GAAc,EAAE,IADlB,IAIdG,IAAqB,gBAOdC,IAAyB,CACrCF,MAEKA,IACEC,EAAmB,KAAKD,CAAK,IAAI,IAAIA,CAAK,KAAKA,IADnC,IAaPG,IAAoB,CAACH,MAC5BA,IACAZ,EAAA,IACEgB,EAAU,SAASJ,GAAO;AAAA,EAChC,cAAc,CAAA;AAAA,EACd,cAAc,CAAA;AAAA,EACd,cAAc;AAAA,CACd,IALqBA,EAAM,QAAQX,GAAiB,EAAE,IADpC,IAaPgB,IAAoB,CAACL,MAC5BA,IACAZ,EAAA,IACEgB,EAAU,SAASJ,GAAO;AAAA,EAChC,cAAc;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAAA,EAED,cAAc,CAAC,QAAQ,UAAU,OAAO,OAAO;AAAA,EAC/C,aAAa,CAAC,OAAO;AAAA,EACrB,aAAa,CAAC,OAAO;AAAA,EACrB,oBAAoB;AAAA,CACpB,IAtBqBA,EAAM,QAAQX,GAAiB,EAAE,IADpC,IA8BPiB,IAAoB,CAACN,MAC5BA,IACAZ,EAAA,IACEgB,EAAU,SAASJ,GAAO;AAAA,EAChC,cAAc;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAAA,EAED,cAAc;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAAA,EAED,yBAAyB;AAAA,CACzB,IA9EqBA,EAAM,QAAQX,GAAiB,EAAE,IADpC;"}