@broberg/cms-inline-edit 0.6.2 → 0.6.3

package/dist/index.d.cts

@@ -12,6 +12,75 @@
  */
 declare function applyFieldSlice(current: string, original: string, next: string): string;
 
+/**
+ * What kind of address did the editor actually type?
+ *
+ * The reason this is a module and not three lines inside the dialog: the
+ * content scanner (`scripts/scan-schemeless-links.mjs`) has to agree with the
+ * editor about what counts as a doubtful address. Two copies of the rule drift,
+ * and then the scanner reports a clean site the editor is still producing dead
+ * links on.
+ */
+/**
+ * True when the browser will read this address as a path on the CURRENT page.
+ *
+ * `<a href="www.trailmem.com">` is valid HTML: it renders, it is styled, it
+ * lights up on hover. The browser just resolves it relative to the page it sits
+ * on, so it lands on /some/article/www.trailmem.com. Nothing about the markup
+ * looks wrong — only following the link reveals it.
+ *
+ * This DELIBERATELY does not try to decide whether the author meant an external
+ * host. `trailmem.com` and `index.html` are syntactically identical, and a rule
+ * that "fixes" the first breaks the second. It reports doubt; it never rewrites.
+ */
+declare function isSchemeless(raw: string): boolean;
+/**
+ * A bare email address — `name@host.tld`, no scheme, no path.
+ *
+ * Kept deliberately narrow: anything with a slash, a space or a second @ is
+ * not one, so an ordinary URL that happens to contain an @ (userinfo, a query)
+ * is untouched.
+ */
+declare function isBareEmail(raw: string): boolean;
+/** The one-click repair the dialog offers. Never applied on its own. */
+declare function withHttps(raw: string): string;
+/**
+ * Does this address leave the site the editor is standing on?
+ *
+ * Used ONLY to decide how the "open in a new tab" box starts out — and that
+ * starting state is visible in the box itself, so a wrong guess is something
+ * the editor can see and change, not a silent rewrite.
+ */
+declare function isExternalHost(raw: string, currentHost: string): boolean;
+/**
+ * Every link address inside a stored string — HTML anchors and Markdown links.
+ *
+ * Markdown IMAGE syntax is excluded on purpose: a relative image path
+ * (`![foto](uploads/x.jpg)`) is normal and correct, and flagging it would bury
+ * the real findings in noise.
+ */
+declare function extractLinkTargets(text: string): Array<{
+    syntax: "html" | "markdown";
+    value: string;
+}>;
+/**
+ * Schemes that must never reach an `href`.
+ *
+ * `javascript:` in a link is script execution on click, in the SITE's own
+ * origin — which is where the editor's own edit-session token lives in
+ * localStorage. So one editor planting such a link, and any colleague clicking
+ * it, is a token handover. `data:` and `vbscript:` are the same class.
+ *
+ * The package ALREADY refuses these on every other attribute
+ * (preservedLinkAttrs drops `javascript:` values and every `on*` handler) —
+ * href was the one that escaped, because it is emitted separately from the
+ * attributes it sits beside.
+ *
+ * Whitespace and control characters are stripped first: browsers ignore them
+ * inside a scheme, so `java\tscript:` and ` javascript:` both run.
+ */
+declare function isDangerousUrl(raw: string): boolean;
+
 /**
  * Labels for the in-editor UI — the rich-text toolbar (bold/italic/underline
  * tooltips, the visible "colour" + "done" buttons, the emoji tooltip) and the
@@ -184,4 +253,4 @@ declare function setLinkTarget(el: HTMLElement, newTab: boolean): void;
  */
 declare function htmlToMarkdown(html: string): string;
 
-export { type InlineEditLabels, type InlineEditOptions, applyFieldSlice, buildConnectUrl, disconnect, getConnectedToken, htmlToMarkdown, initInlineEdit, positionPopover, renderCurrentRefLine, rescanFields, resolveExistingRef, setLinkTarget };
+export { type InlineEditLabels, type InlineEditOptions, applyFieldSlice, buildConnectUrl, disconnect, extractLinkTargets, getConnectedToken, htmlToMarkdown, initInlineEdit, isBareEmail, isDangerousUrl, isExternalHost, isSchemeless, positionPopover, renderCurrentRefLine, rescanFields, resolveExistingRef, setLinkTarget, withHttps };

package/dist/index.d.ts

@@ -12,6 +12,75 @@
  */
 declare function applyFieldSlice(current: string, original: string, next: string): string;
 
+/**
+ * What kind of address did the editor actually type?
+ *
+ * The reason this is a module and not three lines inside the dialog: the
+ * content scanner (`scripts/scan-schemeless-links.mjs`) has to agree with the
+ * editor about what counts as a doubtful address. Two copies of the rule drift,
+ * and then the scanner reports a clean site the editor is still producing dead
+ * links on.
+ */
+/**
+ * True when the browser will read this address as a path on the CURRENT page.
+ *
+ * `<a href="www.trailmem.com">` is valid HTML: it renders, it is styled, it
+ * lights up on hover. The browser just resolves it relative to the page it sits
+ * on, so it lands on /some/article/www.trailmem.com. Nothing about the markup
+ * looks wrong — only following the link reveals it.
+ *
+ * This DELIBERATELY does not try to decide whether the author meant an external
+ * host. `trailmem.com` and `index.html` are syntactically identical, and a rule
+ * that "fixes" the first breaks the second. It reports doubt; it never rewrites.
+ */
+declare function isSchemeless(raw: string): boolean;
+/**
+ * A bare email address — `name@host.tld`, no scheme, no path.
+ *
+ * Kept deliberately narrow: anything with a slash, a space or a second @ is
+ * not one, so an ordinary URL that happens to contain an @ (userinfo, a query)
+ * is untouched.
+ */
+declare function isBareEmail(raw: string): boolean;
+/** The one-click repair the dialog offers. Never applied on its own. */
+declare function withHttps(raw: string): string;
+/**
+ * Does this address leave the site the editor is standing on?
+ *
+ * Used ONLY to decide how the "open in a new tab" box starts out — and that
+ * starting state is visible in the box itself, so a wrong guess is something
+ * the editor can see and change, not a silent rewrite.
+ */
+declare function isExternalHost(raw: string, currentHost: string): boolean;
+/**
+ * Every link address inside a stored string — HTML anchors and Markdown links.
+ *
+ * Markdown IMAGE syntax is excluded on purpose: a relative image path
+ * (`![foto](uploads/x.jpg)`) is normal and correct, and flagging it would bury
+ * the real findings in noise.
+ */
+declare function extractLinkTargets(text: string): Array<{
+    syntax: "html" | "markdown";
+    value: string;
+}>;
+/**
+ * Schemes that must never reach an `href`.
+ *
+ * `javascript:` in a link is script execution on click, in the SITE's own
+ * origin — which is where the editor's own edit-session token lives in
+ * localStorage. So one editor planting such a link, and any colleague clicking
+ * it, is a token handover. `data:` and `vbscript:` are the same class.
+ *
+ * The package ALREADY refuses these on every other attribute
+ * (preservedLinkAttrs drops `javascript:` values and every `on*` handler) —
+ * href was the one that escaped, because it is emitted separately from the
+ * attributes it sits beside.
+ *
+ * Whitespace and control characters are stripped first: browsers ignore them
+ * inside a scheme, so `java\tscript:` and ` javascript:` both run.
+ */
+declare function isDangerousUrl(raw: string): boolean;
+
 /**
  * Labels for the in-editor UI — the rich-text toolbar (bold/italic/underline
  * tooltips, the visible "colour" + "done" buttons, the emoji tooltip) and the
@@ -184,4 +253,4 @@ declare function setLinkTarget(el: HTMLElement, newTab: boolean): void;
  */
 declare function htmlToMarkdown(html: string): string;
 
-export { type InlineEditLabels, type InlineEditOptions, applyFieldSlice, buildConnectUrl, disconnect, getConnectedToken, htmlToMarkdown, initInlineEdit, positionPopover, renderCurrentRefLine, rescanFields, resolveExistingRef, setLinkTarget };
+export { type InlineEditLabels, type InlineEditOptions, applyFieldSlice, buildConnectUrl, disconnect, extractLinkTargets, getConnectedToken, htmlToMarkdown, initInlineEdit, isBareEmail, isDangerousUrl, isExternalHost, isSchemeless, positionPopover, renderCurrentRefLine, rescanFields, resolveExistingRef, setLinkTarget, withHttps };

package/dist/index.js

@@ -12,6 +12,7 @@ function applyFieldSlice(current, original, next) {
 function isSchemeless(raw) {
   const v = (raw || "").trim();
   if (!v) return false;
+  if (isBareEmail(v)) return false;
   if (/^[a-z][a-z0-9+.-]*:/i.test(v)) return false;
   if (v.startsWith("//")) return false;
   if (v.startsWith("/")) return false;
@@ -19,6 +20,9 @@ function isSchemeless(raw) {
   if (v.startsWith("?")) return false;
   return true;
 }
+function isBareEmail(raw) {
+  return /^[^\s@/:?#]+@[^\s@/:?#]+\.[a-z]{2,}$/i.test((raw || "").trim());
+}
 function withHttps(raw) {
   return `https://${(raw || "").trim().replace(/^\/+/, "")}`;
 }
@@ -31,6 +35,18 @@ function isExternalHost(raw, currentHost) {
     return false;
   }
 }
+function extractLinkTargets(text) {
+  const out = [];
+  if (typeof text !== "string") return out;
+  for (const m of text.matchAll(/<a\b[^>]*?\bhref\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>]+))/gi)) {
+    out.push({ syntax: "html", value: m[2] ?? m[3] ?? m[4] ?? "" });
+  }
+  for (const m of text.matchAll(/(!)?\[(?:[^\]\[]|\[[^\]]*\])*\]\(([^)\s]+)/g)) {
+    if (m[1]) continue;
+    out.push({ syntax: "markdown", value: m[2] ?? "" });
+  }
+  return out;
+}
 function isDangerousUrl(raw) {
   const v = (raw || "").replace(/[\u0000-\u0020]/g, "");
   return /^(?:javascript|data|vbscript):/i.test(v);
@@ -563,7 +579,7 @@ function renderLinkDialog() {
   }
   const existingRef = linkEditing?.getAttribute("data-cms-ref") ?? "";
   const onPageTab = !editing || !!existingRef;
-  d.innerHTML = `<div style="display:flex;gap:4px;padding:8px 8px 0"><button type="button" data-testid="inline-link-tab-page" data-tab="page" style="${tabCss(onPageTab)}">${L.linkTabPage}</button><button type="button" data-testid="inline-link-tab-url" data-tab="url" style="${tabCss(!onPageTab)}">${L.linkTabUrl}</button></div><div style="padding:10px 12px 12px"><div data-pane="page" style="display:${onPageTab ? "block" : "none"}"><input data-testid="inline-link-search" data-role="search" placeholder="${L.linkSearch}" style="${fieldCss()}"><div data-role="current" data-testid="inline-link-current" style="display:none;margin-top:8px;padding:7px 10px;background:rgba(0,178,255,.08);border:1px solid rgba(0,178,255,.28);border-radius:8px;font-size:11.5px;color:#c9d1dd;line-height:1.45"></div><div data-role="list" data-testid="inline-link-list" style="margin-top:8px;max-height:196px;overflow-y:auto;border:1px solid #3a3f4a;border-radius:8px;background:#141821"></div></div><div data-pane="url" style="display:${onPageTab ? "none" : "block"}"><label style="${labelCss()}">${L.linkUrl}</label><input data-testid="inline-link-url" data-role="url" placeholder="https://\u2026" style="${fieldCss()}"><div data-role="schemeless" data-testid="inline-link-schemeless" style="${noticeCss("schemeless")}"><p data-role="schemeless-text" style="margin:0;font-size:11.5px;line-height:1.5"></p><button type="button" data-testid="inline-link-add-scheme" data-role="add-scheme" style="${btnCss(false)};margin-top:7px;height:26px;font-size:12px">${L.linkSchemelessFix}</button></div></div><label style="${labelCss()}">${L.linkText}</label><input data-testid="inline-link-text" data-role="text" placeholder="${L.linkTextAuto}" style="${fieldCss()}"><p data-role="hint" style="font-size:11.5px;color:#9aa3b2;margin:6px 0 0;line-height:1.5"></p><button type="button" data-role="newtab" data-testid="inline-link-newtab" aria-pressed="false" style="display:flex;align-items:center;gap:8px;margin-top:12px;background:none;border:none;padding:0;cursor:pointer;font-family:inherit;font-size:12.5px;color:#c9d1dd"><span data-role="newtab-box" style="${checkboxCss(false)}"></span><span>${L.linkNewTab}</span></button><div data-role="live" style="display:flex;gap:8px;margin-top:12px;padding:9px 10px;background:rgba(0,178,255,.08);border:1px solid rgba(0,178,255,.28);border-radius:8px"><p style="margin:0;font-size:11.5px;color:#c9d1dd;line-height:1.55">${L.linkLiveHint}</p></div><div style="display:flex;gap:8px;align-items:center;margin-top:14px"><div data-role="remove"></div><div style="flex:1"></div><button type="button" data-testid="inline-link-cancel" data-role="cancel" style="${btnCss(false)}">${L.linkCancel}</button><button type="button" data-testid="inline-link-submit" data-role="submit" style="${btnCss(true)}" disabled>${editing ? L.linkSave : L.linkInsert}</button></div></div>`;
+  d.innerHTML = `<div style="display:flex;gap:4px;padding:8px 8px 0"><button type="button" data-testid="inline-link-tab-page" data-tab="page" style="${tabCss(onPageTab)}">${L.linkTabPage}</button><button type="button" data-testid="inline-link-tab-url" data-tab="url" style="${tabCss(!onPageTab)}">${L.linkTabUrl}</button></div><div style="padding:10px 12px 12px"><div data-pane="page" style="display:${onPageTab ? "block" : "none"}"><input data-testid="inline-link-search" data-role="search" placeholder="${L.linkSearch}" style="${fieldCss()}"><div data-role="current" data-testid="inline-link-current" style="display:none;margin-top:8px;padding:7px 10px;background:rgba(0,178,255,.08);border:1px solid rgba(0,178,255,.28);border-radius:8px;font-size:11.5px;color:#c9d1dd;line-height:1.45"></div><div data-role="list" data-testid="inline-link-list" style="margin-top:8px;max-height:196px;overflow-y:auto;border:1px solid #3a3f4a;border-radius:8px;background:#141821"></div></div><div data-pane="url" style="display:${onPageTab ? "none" : "block"}"><label style="${labelCss()}">${L.linkUrl}</label><input data-testid="inline-link-url" data-role="url" placeholder="https://\u2026" style="${fieldCss()}"><div data-role="schemeless" style="${noticeCss("schemeless")}"><p data-role="schemeless-text" style="margin:0;font-size:11.5px;line-height:1.5"></p><button type="button" data-testid="inline-link-add-scheme" data-role="add-scheme" style="${btnCss(false)};margin-top:7px;height:26px;font-size:12px">${L.linkSchemelessFix}</button></div></div><label style="${labelCss()}">${L.linkText}</label><input data-testid="inline-link-text" data-role="text" placeholder="${L.linkTextAuto}" style="${fieldCss()}"><p data-role="hint" style="font-size:11.5px;color:#9aa3b2;margin:6px 0 0;line-height:1.5"></p><button type="button" data-role="newtab" data-testid="inline-link-newtab" aria-pressed="false" style="display:flex;align-items:center;gap:8px;margin-top:12px;background:none;border:none;padding:0;cursor:pointer;font-family:inherit;font-size:12.5px;color:#c9d1dd"><span data-role="newtab-box" style="${checkboxCss(false)}"></span><span>${L.linkNewTab}</span></button><div data-role="live" style="display:flex;gap:8px;margin-top:12px;padding:9px 10px;background:rgba(0,178,255,.08);border:1px solid rgba(0,178,255,.28);border-radius:8px"><p style="margin:0;font-size:11.5px;color:#c9d1dd;line-height:1.55">${L.linkLiveHint}</p></div><div style="display:flex;gap:8px;align-items:center;margin-top:14px"><div data-role="remove"></div><div style="flex:1"></div><button type="button" data-testid="inline-link-cancel" data-role="cancel" style="${btnCss(false)}">${L.linkCancel}</button><button type="button" data-testid="inline-link-submit" data-role="submit" style="${btnCss(true, true)}" disabled>${editing ? L.linkSave : L.linkInsert}</button></div></div>`;
   const q = (role) => d.querySelector(`[data-role="${role}"]`);
   const text = q("text");
   const urlIn = q("url");
@@ -571,7 +587,7 @@ function renderLinkDialog() {
   if (editing) {
     text.value = linkEditing?.getAttribute("data-cms-ref-label") === "auto" ? "" : linkEditing?.textContent ?? "";
     if (!existingRef) urlIn.value = linkEditing?.getAttribute("href") ?? "";
-    linkNewTab = linkEditing?.getAttribute("target") === "_blank";
+    linkNewTab = (linkEditing?.getAttribute("target") ?? "").trim().toLowerCase() === "_blank";
     linkNewTabTouched = true;
     q("remove").appendChild(buildRemoveLink());
   }
@@ -706,7 +722,8 @@ function syncLinkDialog() {
   const own = q("text").value.trim();
   q("hint").innerHTML = own ? uiLabels.linkTextOwnHint : onPage ? uiLabels.linkTextAutoHint : uiLabels.linkUrlHint;
   q("live").style.display = onPage ? "flex" : "none";
-  q("submit").disabled = onPage ? !linkPicked : !q("url").value.trim();
+  const submit = q("submit");
+  submit.disabled = onPage ? !linkPicked : !q("url").value.trim();
   const raw = q("url").value;
   const dangerous = !onPage && isDangerousUrl(raw);
   const doubtful = !onPage && !dangerous && isSchemeless(raw);
@@ -717,34 +734,45 @@ function syncLinkDialog() {
     notice.setAttribute("data-variant", "blocked");
     q("schemeless-text").innerHTML = uiLabels.linkBlocked.replace(
       "{v}",
-      escapeHtml(raw.trim())
+      () => escapeHtml(raw.trim())
     );
-    q("submit").disabled = true;
+    submit.disabled = true;
   } else if (doubtful) {
     notice.setAttribute("style", noticeCss("schemeless"));
     notice.setAttribute("data-variant", "schemeless");
     q("schemeless-text").innerHTML = uiLabels.linkSchemeless.replace(
       "{v}",
-      escapeHtml(raw.trim())
+      () => escapeHtml(raw.trim())
     );
   }
+  submit.setAttribute("style", btnCss(true, submit.disabled));
+  if (!show) {
+    notice.removeAttribute("data-variant");
+    notice.removeAttribute("data-testid");
+    q("schemeless-text").innerHTML = "";
+  } else {
+    notice.setAttribute("data-testid", dangerous ? "inline-link-blocked" : "inline-link-schemeless");
+  }
   notice.style.display = show ? "block" : "none";
   q("schemeless-text").style.color = dangerous ? "#f5c6c6" : "#e8d6b0";
   q("add-scheme").style.display = doubtful ? "" : "none";
-  if (!onPage && !linkNewTabTouched) {
-    linkNewTab = isExternalHost(raw, typeof location !== "undefined" ? location.host : "");
+  if (!linkNewTabTouched) {
+    linkNewTab = onPage ? false : isExternalHost(raw, typeof location !== "undefined" ? location.host : "");
   }
   const box = q("newtab-box");
   if (box) box.setAttribute("style", checkboxCss(linkNewTab));
   q("newtab").setAttribute("aria-pressed", String(linkNewTab));
 }
 function setLinkTarget(el, newTab) {
+  const tokens = (el.getAttribute("rel") ?? "").split(/\s+/).filter(Boolean);
+  const kept = tokens.filter((t) => t.toLowerCase() !== "noopener");
   if (newTab) {
     el.setAttribute("target", "_blank");
-    el.setAttribute("rel", "noopener");
+    el.setAttribute("rel", ["noopener", ...kept].join(" "));
   } else {
     el.removeAttribute("target");
-    el.removeAttribute("rel");
+    if (kept.length) el.setAttribute("rel", kept.join(" "));
+    else el.removeAttribute("rel");
   }
 }
 function applyLink() {
@@ -801,7 +829,11 @@ var noticeCss = (variant) => "display:none;margin-top:8px;padding:8px 10px;borde
 var checkboxCss = (on) => "width:16px;height:16px;flex:0 0 16px;border-radius:4px;box-sizing:border-box;display:inline-block;" + (on ? `background:#00b2ff;border:1px solid #00b2ff;background-image:url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16'><path d='M4 8.5l2.6 2.6L12 5.8' fill='none' stroke='white' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'/></svg>");background-size:100% 100%;` : "background:#141821;border:1px solid #3a3f4a;");
 var fieldCss = () => "width:100%;background:#141821;border:1px solid #3a3f4a;color:#fff;height:34px;border-radius:7px;padding:0 10px;font-size:13.5px;outline:none;font-family:inherit;box-sizing:border-box;";
 var labelCss = () => "font-size:11px;letter-spacing:.06em;text-transform:uppercase;color:#9aa3b2;margin:12px 0 5px;display:block;";
-var btnCss = (primary) => "height:33px;border-radius:7px;font-size:13px;cursor:pointer;padding:0 14px;font-weight:600;font-family:inherit;" + (primary ? "background:#00b2ff;color:#04121b;border:none;" : "background:none;border:1px solid #3a3f4a;color:#fff;font-weight:500;");
+var btnCss = (primary, disabled = false) => "height:33px;border-radius:7px;font-size:13px;padding:0 14px;font-weight:600;font-family:inherit;" + // A disabled button that still looks clickable is the silent state this whole
+// card exists to remove: the editor clicks, nothing happens, and the dialog
+// reads as broken rather than as refusing. It matters more now that `disabled`
+// is what stops a javascript: address being inserted.
+(disabled ? "cursor:not-allowed;opacity:.42;" : "cursor:pointer;") + (primary ? "background:#00b2ff;color:#04121b;border:none;" : "background:none;border:1px solid #3a3f4a;color:#fff;font-weight:500;");
 function toggleEmojiPicker(anchor) {
   if (!emojiPicker) emojiPicker = buildEmojiPicker();
   if (emojiPicker.style.display === "block") {
@@ -1030,7 +1062,7 @@ function preservedLinkAttrs(el) {
     const name = attr.name.toLowerCase();
     if (name === "href") continue;
     if (name.startsWith("on")) continue;
-    if (/^javascript:/i.test(attr.value.trim())) continue;
+    if (isDangerousUrl(attr.value)) continue;
     out.push(`${name}="${escapeAttr(attr.value)}"`);
   }
   return out;
@@ -1228,13 +1260,19 @@ export {
   applyFieldSlice,
   buildConnectUrl,
   disconnect,
+  extractLinkTargets,
   getConnectedToken,
   htmlToMarkdown,
   initInlineEdit,
+  isBareEmail,
+  isDangerousUrl,
+  isExternalHost,
+  isSchemeless,
   positionPopover,
   renderCurrentRefLine,
   rescanFields,
   resolveExistingRef,
-  setLinkTarget
+  setLinkTarget,
+  withHttps
 };
 //# sourceMappingURL=index.js.map