@burger-editor/frozen-patty 4.0.0-alpha.2 → 4.0.0-alpha.22

package/dist/utils.d.ts

@@ -1,4 +1,8 @@
-import type { FrozenPattyData, PrimitiveDatum } from './types.js';
+import type { FieldDefinition, FrozenPattyData, FrozenPattyFlattenData, PrimitiveDatum } from './types.js';
+/**
+ * List of dangerous HTML elements to block for XSS protection
+ */
+export declare const DANGEROUS_ELEMENTS: string[];
 /**
  *
  * @param kvs
@@ -8,11 +12,74 @@ export declare function arrayToHash(kvs: [keyof FrozenPattyData, PrimitiveDatum,
 };
 /**
  *
- * @param str
+ * @param el
+ * @param nodeName
+ * @param attr
+ * @param xssSanitize
+ */
+export declare function replaceNode(el: Element, nodeName: string, attr: string, xssSanitize?: boolean): Element;
+/**
+ * Removes dangerous script elements from HTML string
+ * @param html HTML string
+ * @returns Sanitized HTML
+ */
+export declare function sanitizeHtml(html: string): string;
+/**
+ * Sanitizes attribute value
+ * @param name Attribute name
+ * @param value Attribute value
+ * @returns Safe attribute value, or null if dangerous
+ */
+export declare function sanitizeAttributeValue<T extends PrimitiveDatum>(name: string, value: T): T | null;
+/**
+ *
+ * @param data
+ * @param definedFields
+ */
+export declare function maxLengthOf(data: FrozenPattyData, definedFields: string[]): number;
+/**
+ *
+ * @param el
+ * @param attr
+ */
+export declare function definedFields(el: Element, attr: string): string[];
+/**
+ *
+ * @param el
+ * @param attr
+ */
+export declare function getFields(el: Element, attr: string): readonly FieldDefinition[];
+/**
+ *
+ * @param el
+ * @param attr
+ * @param dataKeyName
+ */
+export declare function hasField(el: Element, attr: string, dataKeyName: string): boolean;
+/**
+ *
+ * @param fields
+ * @param oldPropName
+ * @param newPropName
+ */
+export declare function replaceProp(fields: readonly FieldDefinition[], oldPropName: string, newPropName: string): FieldDefinition[];
+/**
+ *
+ * @param fields
+ * @param propName
+ */
+export declare function removeProp(fields: readonly FieldDefinition[], propName: string): FieldDefinition[];
+/**
+ * - 値が配列の場合は、index に対応する値を返す。
+ * - 値が配列でない場合は、そのまま返す。
+ * - ⚠️ 値が配列で、index に対応する値が undefined の場合は、配列の最初の値を返す。
+ * @param data
+ * @param index
  */
-export declare function kebabCase(str: string): string;
+export declare function flattenData(data: FrozenPattyData, index: number): FrozenPattyFlattenData;
 /**
  *
- * @param str
+ * @param el
+ * @param name
  */
-export declare function camelCase(str: string): string;
+export declare function propInElement(el: Element, name: string): boolean;

package/dist/utils.js

@@ -1,3 +1,18 @@
+import { parseFields } from './parse-fields.js';
+/**
+ * List of dangerous HTML elements to block for XSS protection
+ */
+export const DANGEROUS_ELEMENTS = [
+    'script',
+    'style',
+    'template',
+    'object',
+    'embed',
+    'iframe',
+    'frame',
+    'frameset',
+    'applet',
+];
 /**
  *
  * @param kvs
@@ -23,15 +38,240 @@ export function arrayToHash(kvs) {
 }
 /**
  *
- * @param str
+ * @param el
+ * @param nodeName
+ * @param attr
+ * @param xssSanitize
+ */
+export function replaceNode(el, nodeName, attr, xssSanitize = true) {
+    nodeName = nodeName.toLowerCase();
+    const currentName = el.localName ?? el.nodeName.toLowerCase();
+    if (currentName === nodeName) {
+        return el;
+    }
+    // Check element name if XSS protection is enabled
+    if (xssSanitize && // Disallow dangerous elements
+        DANGEROUS_ELEMENTS.includes(nodeName)) {
+        return el;
+    }
+    const node = (el.ownerDocument ?? document).createElement(nodeName);
+    for (const child of el.childNodes) {
+        node.append(child.cloneNode(true));
+    }
+    const fields = getFields(el, attr);
+    const attrs = new Set(fields.map((field) => field.propName));
+    for (const { name, value } of el.attributes) {
+        if (attrs.has(name)) {
+            continue;
+        }
+        // Check attribute value if XSS protection is enabled
+        if (xssSanitize) {
+            const sanitizedValue = sanitizeAttributeValue(name, value);
+            if (sanitizedValue !== null) {
+                node.setAttribute(name, sanitizedValue);
+            }
+            continue;
+        }
+        node.setAttribute(name, value);
+    }
+    el.replaceWith(node);
+    return node;
+}
+/**
+ * Removes dangerous script elements from HTML string
+ * @param html HTML string
+ * @returns Sanitized HTML
+ */
+export function sanitizeHtml(html) {
+    if (typeof html !== 'string') {
+        return '';
+    }
+    // Simple approach to handle script tags content
+    // First remove script tags but keep their content
+    let sanitized = html;
+    // For each dangerous element, replace tag but keep content using regex
+    // Example: <script>alert("XSS")</script> -> alert("XSS")
+    for (const tagName of DANGEROUS_ELEMENTS) {
+        const regex = new RegExp(`<${tagName}[^>]*>(.*?)<\\/${tagName}>`, 'gis');
+        sanitized = sanitized.replace(regex, '$1');
+    }
+    // Parse HTML safely using DOM parser for remaining sanitization
+    const doc = new DOMParser().parseFromString(sanitized, 'text/html');
+    const body = doc.body;
+    // Remove event handler attributes from all elements
+    sanitizeElementAndChildren(body);
+    return body.innerHTML;
+}
+/**
+ * Sanitizes an element and all its child elements
+ * @param element Target element
+ */
+function sanitizeElementAndChildren(element) {
+    // Remove dangerous attributes from current element
+    sanitizeAttributes(element);
+    // Process child elements recursively
+    const children = element.children;
+    for (const child of children) {
+        sanitizeElementAndChildren(child);
+    }
+}
+/**
+ * Sanitizes attribute value
+ * @param name Attribute name
+ * @param value Attribute value
+ * @returns Safe attribute value, or null if dangerous
+ */
+export function sanitizeAttributeValue(name, value) {
+    if (typeof value !== 'string') {
+        return value;
+    }
+    name = name.toLowerCase();
+    // Disallow event handler attributes
+    if (name.startsWith('on')) {
+        return null;
+    }
+    // Check for dangerous protocol in link attributes
+    if (name === 'href' ||
+        name === 'src' ||
+        name === 'action' ||
+        name === 'formaction' ||
+        name === 'xlink:href') {
+        const trimmedValue = value.trim().toLowerCase();
+        if (trimmedValue.startsWith('javascript:') ||
+            trimmedValue.startsWith('data:') ||
+            trimmedValue.startsWith('vbscript:')) {
+            return null;
+        }
+    }
+    // Other dangerous attributes
+    if (['manifest'].includes(name)) {
+        return null;
+    }
+    return value;
+}
+/**
+ * Removes dangerous attributes from an element
+ * @param element Target element
+ */
+function sanitizeAttributes(element) {
+    // Collect list of dangerous attributes
+    const dangerousAttrs = [...element.attributes]
+        .filter((attr) => sanitizeAttributeValue(attr.name, attr.value) === null)
+        .map((attr) => attr.name);
+    // Remove dangerous attributes
+    for (const attrName of dangerousAttrs) {
+        element.removeAttribute(attrName);
+    }
+}
+/**
+ *
+ * @param data
+ * @param definedFields
+ */
+export function maxLengthOf(data, definedFields) {
+    let maxLength = 0;
+    for (const key in data) {
+        if (definedFields.includes(key) && Array.isArray(data[key])) {
+            maxLength = Math.max(maxLength, data[key].length);
+        }
+    }
+    return maxLength;
+}
+/**
+ *
+ * @param el
+ * @param attr
+ */
+export function definedFields(el, attr) {
+    const fieldDefinitions = getFields(el, attr);
+    return fieldDefinitions.map((field) => field.fieldName);
+}
+/**
+ *
+ * @param el
+ * @param attr
+ */
+export function getFields(el, attr) {
+    const fields = el.getAttribute(`data-${attr}`);
+    if (!fields) {
+        return [];
+    }
+    return parseFields(fields);
+}
+/**
+ *
+ * @param el
+ * @param attr
+ * @param dataKeyName
+ */
+export function hasField(el, attr, dataKeyName) {
+    const fieldDefinitions = getFields(el, attr);
+    return fieldDefinitions.some((field) => field.fieldName === dataKeyName);
+}
+/**
+ *
+ * @param fields
+ * @param oldPropName
+ * @param newPropName
  */
-export function kebabCase(str) {
-    return str.replaceAll(/([A-Z])/g, '-$1').toLowerCase();
+export function replaceProp(fields, oldPropName, newPropName) {
+    return fields.map((field) => {
+        if (field.propName === oldPropName) {
+            return {
+                ...field,
+                propName: newPropName,
+            };
+        }
+        return field;
+    });
 }
 /**
  *
- * @param str
+ * @param fields
+ * @param propName
  */
-export function camelCase(str) {
-    return str.replaceAll(/-([a-z])/g, (_, c) => c.toUpperCase());
+export function removeProp(fields, propName) {
+    return fields.filter((field) => field.propName !== propName);
+}
+/**
+ * - 値が配列の場合は、index に対応する値を返す。
+ * - 値が配列でない場合は、そのまま返す。
+ * - ⚠️ 値が配列で、index に対応する値が undefined の場合は、配列の最初の値を返す。
+ * @param data
+ * @param index
+ */
+export function flattenData(data, index) {
+    const result = {};
+    for (const key in data) {
+        result[key] = Array.isArray(data[key])
+            ? data[key][index] === undefined
+                ? data[key][0]
+                : data[key][index]
+            : data[key];
+    }
+    return result;
+}
+/**
+ * 特定の要素で、`propName in element`で判定できない属性名
+ */
+const specificProp = {
+    /*
+     * JSDOMの未実装対策
+     * @see https://github.com/jsdom/jsdom/blob/main/lib/jsdom/living/nodes/HTMLSourceElement.webidl
+     * Living Standardでは実装済み
+     * @see https://html.spec.whatwg.org/multipage/embedded-content.html#htmlsourceelement
+     */
+    source: ['width', 'height'],
+};
+/**
+ *
+ * @param el
+ * @param name
+ */
+export function propInElement(el, name) {
+    const has = name in el;
+    if (has) {
+        return true;
+    }
+    return specificProp[el.localName]?.includes(name) ?? false;
 }

package/package.json

@@ -1,13 +1,12 @@
 {
 	"name": "@burger-editor/frozen-patty",
-	"version": "4.0.0-alpha.2",
-	"description": "Pure HTML to JSON converter that not use template engine.",
+	"version": "4.0.0-alpha.22",
+	"description": "Pure HTML to JSON converter that does not use a template engine.",
 	"author": "D-ZERO",
-	"license": "MIT",
+	"license": "(MIT OR Apache-2.0)",
 	"repository": {
 		"url": "https://github.com/d-zero-dev/BurgerEditor.git"
 	},
-	"private": false,
 	"publishConfig": {
 		"access": "public"
 	},
@@ -41,5 +40,8 @@
 		"dev": "tsc --watch --project tsconfig.build.json",
 		"clean": "tsc --build --clean"
 	},
-	"gitHead": "1cea9c5b36023cad1acfc2b3ef8b18c0d5bf79c2"
+	"dependencies": {
+		"@burger-editor/utils": "4.0.0-alpha.22"
+	},
+	"gitHead": "2ef680acadafee63247905c7efd92e134d89ae19"
 }

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2017-2024 D-ZERO Co., Ltd.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/dist/field-name-parser.d.ts

@@ -1,8 +0,0 @@
-/**
- *
- * @param field
- */
-export declare function fieldNameParser(field: string): {
-    fieldName: string;
-    propName: string;
-};

package/dist/field-name-parser.js

@@ -1,18 +0,0 @@
-import { camelCase } from './utils.js';
-/**
- *
- * @param field
- */
-export function fieldNameParser(field) {
-    field = field.trim().toLowerCase();
-    if (!field) {
-        throw new Error('Field name is empty.');
-    }
-    let [fieldName, propName] = field.split(':');
-    propName = propName?.trim() || '';
-    fieldName = fieldName?.trim() || propName || field;
-    return {
-        fieldName: camelCase(fieldName),
-        propName,
-    };
-}

package/dist/get.js

@@ -1,19 +0,0 @@
-import { getValues } from './get-values.js';
-import { arrayToHash } from './utils.js';
-/**
- *
- * @param el
- * @param attr
- * @param typeConvert
- * @param filter
- */
-export default function (el, attr, typeConvert, filter) {
-    // eslint-disable-next-line unicorn/prefer-spread
-    const filedElements = Array.from(el.querySelectorAll(`[data-${attr}]`));
-    let values = [];
-    for (const _el of filedElements) {
-        values = [...values, ...getValues(_el, typeConvert, attr, filter)];
-    }
-    const result = arrayToHash(values);
-    return result;
-}

package/dist/set.d.ts

@@ -1,9 +0,0 @@
-import type { Filter, FrozenPattyData } from './types.js';
-/**
- *
- * @param el
- * @param data
- * @param attr
- * @param filter
- */
-export default function (el: Element, data: FrozenPattyData, attr: string, filter?: Filter): Element;

package/dist/set.js

@@ -1,60 +0,0 @@
-import { setValue } from './set-value.js';
-import { kebabCase } from './utils.js';
-/**
- *
- * @param el
- * @param data
- * @param attr
- * @param filter
- */
-export default function (el, data, attr, filter) {
-    el = el.cloneNode(true);
-    for (const dataKeyName in data) {
-        if (dataKeyName in data) {
-            const datum = data[dataKeyName];
-            const selector = `[data-${attr}*="${kebabCase(dataKeyName)}"]`;
-            // eslint-disable-next-line unicorn/prefer-spread
-            const targetList = Array.from(el.querySelectorAll(selector));
-            if (Array.isArray(datum)) {
-                const targetEl = targetList[0];
-                if (!targetEl) {
-                    continue;
-                }
-                const listRoot = targetEl.closest(`[data-${attr}-list]`);
-                if (!listRoot || (listRoot && listRoot.children.length === 0)) {
-                    continue;
-                }
-                const listItem = listRoot.children[0]?.cloneNode(true);
-                while (listItem && datum.length > listRoot.children.length) {
-                    listRoot.append(listItem.cloneNode(true));
-                }
-                // eslint-disable-next-line unicorn/prefer-spread
-                const newChildren = Array.from(listRoot.querySelectorAll(selector));
-                // eslint-disable-next-line unicorn/prefer-spread
-                const oldChildList = Array.from(listRoot.children);
-                let deleteNodeList = [];
-                for (const [i, child] of [...newChildren].entries()) {
-                    if (datum[i] == null) {
-                        setValue(child, dataKeyName, '', attr, filter);
-                        const oldChild = oldChildList[i];
-                        if (oldChild) {
-                            deleteNodeList.push(oldChild);
-                        }
-                    }
-                    else {
-                        setValue(child, dataKeyName, datum[i], attr, filter);
-                        deleteNodeList = [];
-                    }
-                }
-                for (const node of deleteNodeList)
-                    node.remove();
-            }
-            else {
-                for (const [, targetEl] of [...targetList].entries()) {
-                    setValue(targetEl, dataKeyName, datum, attr, filter);
-                }
-            }
-        }
-    }
-    return el;
-}