@bygghammar/cms-platform 0.92.0 → 0.92.2

package/CHANGELOG.md

@@ -8,6 +8,29 @@ matches `package.json` exactly. See
 Versions 0.1.0 through 0.78.0 predate this repository and were reconstructed
 from the published npm tarballs.
 
+## 0.92.2
+
+- Fix rich-text attribute escaping. `sanitizeHtml` read attribute values as
+  raw text and escaped them again, so every save and every render added an
+  `amp;` to each `&` in a link: `?calendardates=…&trp=…` reached the browser
+  with a query key named `amp;trp`. Attribute values are now decoded once,
+  checked, and escaped exactly once, so sanitizing is idempotent through save
+  and render. The URL allowlist, style checks and target check judge the
+  decoded value, the one the browser will use. Text content is unchanged.
+- Links stored before this release keep their extra levels until an editor
+  saves the correct URL; they no longer grow on each save.
+- Two scheduling test suites no longer depend on the date they run on.
+
+## 0.92.1
+
+- Fix the page-builder save and publish RPC call by removing the unsupported
+  `_source_page_id` argument. The database supplies the source page internally,
+  preserving self-reveal protection. No migration is added or changed, and
+  platform contract v3 is unchanged.
+- Clarify publication RPC errors so an argument mismatch is not presented as
+  proof that migrations must be replayed. Include only a recognized diagnostic
+  code and request a schema comparison before applying changes.
+
 ## 0.92.0
 
 **Breaking: platform contract v3.** A site pinned to this package must call

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bygghammar/cms-platform",
-  "version": "0.92.0",
+  "version": "0.92.2",
   "description": "Shared CMS platform: blocks, block types, i18n core, UI primitives and design-token contract used by every Bygghammar/Voyara site.",
   "type": "module",
   "sideEffects": [

package/src/html/sanitize-html.ts

@@ -85,6 +85,48 @@ function escapeAttr(v: string): string {
   return v.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
 
+/** The named references the editor and browsers write into attribute values. */
+const NAMED_REFERENCES: Record<string, string> = {
+  amp: "&",
+  AMP: "&",
+  lt: "<",
+  LT: "<",
+  gt: ">",
+  GT: ">",
+  quot: '"',
+  QUOT: '"',
+  apos: "'",
+  nbsp: "\u00a0",
+};
+
+/**
+ * An attribute value as a browser reads it: its character references decoded.
+ *
+ * Stored markup is HTML, so `?a=1&amp;b=2` means `?a=1&b=2`. Everything below
+ * judges the decoded value, and `escapeAttr` encodes it exactly once on the
+ * way out. Reading the raw text instead let `escapeAttr` encode the editor's
+ * own `&amp;` a second time, so every save and every render added a level and
+ * a link's `&b=` arrived in the browser as a key named `amp;b`.
+ *
+ * Numeric references, and the named ones above, are decoded. Any other name
+ * is left as written, so it is escaped as text and reaches the browser as that
+ * literal text. Either way the browser ends up with exactly the string that
+ * was checked: `&#106;avascript:` is judged as `javascript:`, and an
+ * undecoded `javascript&colon;` never becomes one.
+ */
+function decodeAttr(value: string): string {
+  return value.replace(
+    /&(?:#([0-9]{1,7})|#[xX]([0-9a-fA-F]{1,6})|([a-zA-Z][a-zA-Z0-9]{0,31}));/g,
+    (reference, decimal?: string, hex?: string, name?: string) => {
+      if (name !== undefined) return NAMED_REFERENCES[name] ?? reference;
+      const code = decimal !== undefined ? Number.parseInt(decimal, 10) : Number.parseInt(hex ?? "", 16);
+      // What a browser does with these: the replacement character.
+      if (code === 0 || code > 0x10ffff || (code >= 0xd800 && code <= 0xdfff)) return "\ufffd";
+      return String.fromCodePoint(code);
+    },
+  );
+}
+
 const ATTR_RE = /([a-zA-Z_:][-a-zA-Z0-9_:.]*)\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>]+))/g;
 
 function sanitizeAttrs(tag: string, raw: string): string {
@@ -94,7 +136,7 @@ function sanitizeAttrs(tag: string, raw: string): string {
   ATTR_RE.lastIndex = 0;
   while ((m = ATTR_RE.exec(raw))) {
     const name = m[1].toLowerCase();
-    let value = m[3] ?? m[4] ?? m[5] ?? "";
+    let value = decodeAttr(m[3] ?? m[4] ?? m[5] ?? "");
     if (name.startsWith("on")) continue;
     if (!GLOBAL_ATTRS.has(name) && !allowed?.has(name)) continue;
     if (name === "href" || name === "src" || name === "srcset") {

package/src/server/pages-core.ts

@@ -377,9 +377,9 @@ export async function getPageForEditCore({ context }: PagesDeps, key: string) {
 }
 
 /**
- * Codes and wording that mean "this installation has not run the publication
- * migration yet". `PGRST202`/`PGRST203` come from PostgREST, `42883`/`42P01`
- * from PostgreSQL itself.
+ * Codes and wording that mean "this installation has no such function, or none
+ * that takes these arguments". `PGRST202`/`PGRST203` come from PostgREST, which
+ * answers the same way for both; `42883`/`42P01` from PostgreSQL itself.
  */
 const FUNCTION_MISSING = new Set(["PGRST202", "PGRST203", "42883", "42P01"]);
 
@@ -423,10 +423,14 @@ async function publicationRpc(
   ) {
     // A slice of the generated migration manifest rather than a second copy of
     // the names: an operator sent after a file this package has stopped
-    // shipping is worse off than one told nothing.
+    // shipping is worse off than one told nothing. Only a code from the set
+    // above is repeated; the backend's own message is not.
     throw new Error(
-      `${whenFailed}: this database does not have ${fn}. Apply the migrations ` +
-        `${installedBy.join(" and ")} shipped with this package and try again.`,
+      `${whenFailed}: the database has no ${fn} that accepts this call` +
+        `${FUNCTION_MISSING.has(code) ? ` (${code})` : ""}. Either the migrations ` +
+        `${installedBy.join(" and ")} shipped with this package are not installed, ` +
+        `or the installed ${fn} takes different arguments than this package sends. ` +
+        `Compare the database's schema with this package before applying anything.`,
     );
   }
   throw new Error(message || whenFailed);
@@ -474,10 +478,10 @@ export async function savePageVersionCore(
       _note: input.note ?? null,
       _publish: Boolean(input.publish),
       _actor_email: actorEmail(context),
+      // No `_source_page_id`: the function takes none, and names `_page_id` as
+      // the source of every reveal itself, so a countdown pointing at the page
+      // being published is still refused rather than hiding it.
       _reveals: reveals,
-      // Named so a countdown pointing at the page being published is refused
-      // rather than hiding it until its own deadline.
-      _source_page_id: input.pageId,
       _audit: input.publish
         ? {
             description: