@burger-editor/frozen-patty 4.0.0-alpha.3 → 4.0.0-alpha.4

package/dist/utils.js

@@ -1,3 +1,18 @@
+import { parseFields } from './parse-fields.js';
+/**
+ * List of dangerous HTML elements to block for XSS protection
+ */
+export const DANGEROUS_ELEMENTS = [
+    'script',
+    'style',
+    'template',
+    'object',
+    'embed',
+    'iframe',
+    'frame',
+    'frameset',
+    'applet',
+];
 /**
  *
  * @param kvs
@@ -21,17 +36,268 @@ export function arrayToHash(kvs) {
     }
     return result;
 }
+const kebabCaseCache = new Map();
 /**
  *
  * @param str
  */
 export function kebabCase(str) {
-    return str.replaceAll(/([A-Z])/g, '-$1').toLowerCase();
+    if (kebabCaseCache.has(str)) {
+        return kebabCaseCache.get(str);
+    }
+    const result = str.replaceAll(/([A-Z])/g, '-$1').toLowerCase();
+    kebabCaseCache.set(str, result);
+    return result;
 }
+const camelCaseCache = new Map();
 /**
  *
  * @param str
  */
 export function camelCase(str) {
-    return str.replaceAll(/-([a-z])/g, (_, c) => c.toUpperCase());
+    if (camelCaseCache.has(str)) {
+        return camelCaseCache.get(str);
+    }
+    const result = str.replaceAll(/-([a-z])/g, (_, c) => c.toUpperCase());
+    camelCaseCache.set(str, result);
+    return result;
+}
+/**
+ *
+ * @param el
+ * @param nodeName
+ * @param attr
+ * @param xssSanitize
+ */
+export function replaceNode(el, nodeName, attr, xssSanitize = true) {
+    nodeName = nodeName.toLowerCase();
+    const currentName = el.localName ?? el.nodeName.toLowerCase();
+    if (currentName === nodeName) {
+        return el;
+    }
+    // Check element name if XSS protection is enabled
+    if (xssSanitize && // Disallow dangerous elements
+        DANGEROUS_ELEMENTS.includes(nodeName)) {
+        return el;
+    }
+    const node = (el.ownerDocument ?? document).createElement(nodeName);
+    for (const child of el.childNodes) {
+        node.append(child.cloneNode(true));
+    }
+    const fields = getFields(el, attr);
+    const attrs = new Set(fields.map((field) => field.propName));
+    for (const { name, value } of el.attributes) {
+        if (attrs.has(name)) {
+            continue;
+        }
+        // Check attribute value if XSS protection is enabled
+        if (xssSanitize) {
+            const sanitizedValue = sanitizeAttributeValue(name, value);
+            if (sanitizedValue !== null) {
+                node.setAttribute(name, sanitizedValue);
+            }
+            continue;
+        }
+        node.setAttribute(name, value);
+    }
+    el.replaceWith(node);
+    return node;
+}
+/**
+ * Removes dangerous script elements from HTML string
+ * @param html HTML string
+ * @returns Sanitized HTML
+ */
+export function sanitizeHtml(html) {
+    if (typeof html !== 'string') {
+        return '';
+    }
+    // Simple approach to handle script tags content
+    // First remove script tags but keep their content
+    let sanitized = html;
+    // For each dangerous element, replace tag but keep content using regex
+    // Example: <script>alert("XSS")</script> -> alert("XSS")
+    for (const tagName of DANGEROUS_ELEMENTS) {
+        const regex = new RegExp(`<${tagName}[^>]*>(.*?)<\\/${tagName}>`, 'gis');
+        sanitized = sanitized.replace(regex, '$1');
+    }
+    // Parse HTML safely using DOM parser for remaining sanitization
+    const doc = new DOMParser().parseFromString(sanitized, 'text/html');
+    const body = doc.body;
+    // Remove event handler attributes from all elements
+    sanitizeElementAndChildren(body);
+    return body.innerHTML;
+}
+/**
+ * Sanitizes an element and all its child elements
+ * @param element Target element
+ */
+function sanitizeElementAndChildren(element) {
+    // Remove dangerous attributes from current element
+    sanitizeAttributes(element);
+    // Process child elements recursively
+    const children = element.children;
+    for (const child of children) {
+        sanitizeElementAndChildren(child);
+    }
+}
+/**
+ * Sanitizes attribute value
+ * @param name Attribute name
+ * @param value Attribute value
+ * @returns Safe attribute value, or null if dangerous
+ */
+export function sanitizeAttributeValue(name, value) {
+    if (typeof value !== 'string') {
+        return value;
+    }
+    name = name.toLowerCase();
+    // Disallow event handler attributes
+    if (name.startsWith('on')) {
+        return null;
+    }
+    // Check for dangerous protocol in link attributes
+    if (name === 'href' ||
+        name === 'src' ||
+        name === 'action' ||
+        name === 'formaction' ||
+        name === 'xlink:href') {
+        const trimmedValue = value.trim().toLowerCase();
+        if (trimmedValue.startsWith('javascript:') ||
+            trimmedValue.startsWith('data:') ||
+            trimmedValue.startsWith('vbscript:')) {
+            return null;
+        }
+    }
+    // Other dangerous attributes
+    if (['manifest'].includes(name)) {
+        return null;
+    }
+    return value;
+}
+/**
+ * Removes dangerous attributes from an element
+ * @param element Target element
+ */
+function sanitizeAttributes(element) {
+    // Collect list of dangerous attributes
+    const dangerousAttrs = [...element.attributes]
+        .filter((attr) => sanitizeAttributeValue(attr.name, attr.value) === null)
+        .map((attr) => attr.name);
+    // Remove dangerous attributes
+    for (const attrName of dangerousAttrs) {
+        element.removeAttribute(attrName);
+    }
+}
+/**
+ *
+ * @param data
+ * @param definedFields
+ */
+export function maxLengthOf(data, definedFields) {
+    let maxLength = 0;
+    for (const key in data) {
+        if (definedFields.includes(key) && Array.isArray(data[key])) {
+            maxLength = Math.max(maxLength, data[key].length);
+        }
+    }
+    return maxLength;
+}
+/**
+ *
+ * @param el
+ * @param attr
+ */
+export function definedFields(el, attr) {
+    const fieldDefinitions = getFields(el, attr);
+    return fieldDefinitions.map((field) => field.fieldName);
+}
+/**
+ *
+ * @param el
+ * @param attr
+ */
+export function getFields(el, attr) {
+    const fields = el.getAttribute(`data-${attr}`);
+    if (!fields) {
+        return [];
+    }
+    return parseFields(fields);
+}
+/**
+ *
+ * @param el
+ * @param attr
+ * @param dataKeyName
+ */
+export function hasField(el, attr, dataKeyName) {
+    const fieldDefinitions = getFields(el, attr);
+    return fieldDefinitions.some((field) => field.fieldName === dataKeyName);
+}
+/**
+ *
+ * @param fields
+ * @param oldPropName
+ * @param newPropName
+ */
+export function replaceProp(fields, oldPropName, newPropName) {
+    return fields.map((field) => {
+        if (field.propName === oldPropName) {
+            return {
+                ...field,
+                propName: newPropName,
+            };
+        }
+        return field;
+    });
+}
+/**
+ *
+ * @param fields
+ * @param propName
+ */
+export function removeProp(fields, propName) {
+    return fields.filter((field) => field.propName !== propName);
+}
+/**
+ * - 値が配列の場合は、index に対応する値を返す。
+ * - 値が配列でない場合は、そのまま返す。
+ * - ⚠️ 値が配列で、index に対応する値が undefined の場合は、配列の最初の値を返す。
+ * @param data
+ * @param index
+ */
+export function flattenData(data, index) {
+    const result = {};
+    for (const key in data) {
+        result[key] = Array.isArray(data[key])
+            ? data[key][index] === undefined
+                ? data[key][0]
+                : data[key][index]
+            : data[key];
+    }
+    return result;
+}
+/**
+ * 特定の要素で、`propName in element`で判定できない属性名
+ */
+const specificProp = {
+    /*
+     * JSDOMの未実装対策
+     * @see https://github.com/jsdom/jsdom/blob/main/lib/jsdom/living/nodes/HTMLSourceElement.webidl
+     * Living Standardでは実装済み
+     * @see https://html.spec.whatwg.org/multipage/embedded-content.html#htmlsourceelement
+     */
+    source: ['width', 'height'],
+};
+/**
+ *
+ * @param el
+ * @param name
+ */
+export function propInElement(el, name) {
+    const has = name in el;
+    if (has) {
+        return true;
+    }
+    return specificProp[el.localName]?.includes(name) ?? false;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@burger-editor/frozen-patty",
-	"version": "4.0.0-alpha.3",
-	"description": "Pure HTML to JSON converter that not use template engine.",
+	"version": "4.0.0-alpha.4",
+	"description": "Pure HTML to JSON converter that does not use a template engine.",
 	"author": "D-ZERO",
 	"license": "MIT",
 	"repository": {
@@ -41,5 +41,5 @@
 		"dev": "tsc --watch --project tsconfig.build.json",
 		"clean": "tsc --build --clean"
 	},
-	"gitHead": "23c89d351064c391a45ba6a95ab7602f2a644ff0"
+	"gitHead": "823486d58579275ae556942c5d7a4aef4e1f634e"
 }