@bygghammar/cms-platform 0.92.1 → 0.92.2

package/CHANGELOG.md

@@ -8,6 +8,19 @@ matches `package.json` exactly. See
 Versions 0.1.0 through 0.78.0 predate this repository and were reconstructed
 from the published npm tarballs.
 
+## 0.92.2
+
+- Fix rich-text attribute escaping. `sanitizeHtml` read attribute values as
+  raw text and escaped them again, so every save and every render added an
+  `amp;` to each `&` in a link: `?calendardates=…&trp=…` reached the browser
+  with a query key named `amp;trp`. Attribute values are now decoded once,
+  checked, and escaped exactly once, so sanitizing is idempotent through save
+  and render. The URL allowlist, style checks and target check judge the
+  decoded value, the one the browser will use. Text content is unchanged.
+- Links stored before this release keep their extra levels until an editor
+  saves the correct URL; they no longer grow on each save.
+- Two scheduling test suites no longer depend on the date they run on.
+
 ## 0.92.1
 
 - Fix the page-builder save and publish RPC call by removing the unsupported

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bygghammar/cms-platform",
-  "version": "0.92.1",
+  "version": "0.92.2",
   "description": "Shared CMS platform: blocks, block types, i18n core, UI primitives and design-token contract used by every Bygghammar/Voyara site.",
   "type": "module",
   "sideEffects": [

package/src/html/sanitize-html.ts

@@ -85,6 +85,48 @@ function escapeAttr(v: string): string {
   return v.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
 
+/** The named references the editor and browsers write into attribute values. */
+const NAMED_REFERENCES: Record<string, string> = {
+  amp: "&",
+  AMP: "&",
+  lt: "<",
+  LT: "<",
+  gt: ">",
+  GT: ">",
+  quot: '"',
+  QUOT: '"',
+  apos: "'",
+  nbsp: "\u00a0",
+};
+
+/**
+ * An attribute value as a browser reads it: its character references decoded.
+ *
+ * Stored markup is HTML, so `?a=1&amp;b=2` means `?a=1&b=2`. Everything below
+ * judges the decoded value, and `escapeAttr` encodes it exactly once on the
+ * way out. Reading the raw text instead let `escapeAttr` encode the editor's
+ * own `&amp;` a second time, so every save and every render added a level and
+ * a link's `&b=` arrived in the browser as a key named `amp;b`.
+ *
+ * Numeric references, and the named ones above, are decoded. Any other name
+ * is left as written, so it is escaped as text and reaches the browser as that
+ * literal text. Either way the browser ends up with exactly the string that
+ * was checked: `&#106;avascript:` is judged as `javascript:`, and an
+ * undecoded `javascript&colon;` never becomes one.
+ */
+function decodeAttr(value: string): string {
+  return value.replace(
+    /&(?:#([0-9]{1,7})|#[xX]([0-9a-fA-F]{1,6})|([a-zA-Z][a-zA-Z0-9]{0,31}));/g,
+    (reference, decimal?: string, hex?: string, name?: string) => {
+      if (name !== undefined) return NAMED_REFERENCES[name] ?? reference;
+      const code = decimal !== undefined ? Number.parseInt(decimal, 10) : Number.parseInt(hex ?? "", 16);
+      // What a browser does with these: the replacement character.
+      if (code === 0 || code > 0x10ffff || (code >= 0xd800 && code <= 0xdfff)) return "\ufffd";
+      return String.fromCodePoint(code);
+    },
+  );
+}
+
 const ATTR_RE = /([a-zA-Z_:][-a-zA-Z0-9_:.]*)\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>]+))/g;
 
 function sanitizeAttrs(tag: string, raw: string): string {
@@ -94,7 +136,7 @@ function sanitizeAttrs(tag: string, raw: string): string {
   ATTR_RE.lastIndex = 0;
   while ((m = ATTR_RE.exec(raw))) {
     const name = m[1].toLowerCase();
-    let value = m[3] ?? m[4] ?? m[5] ?? "";
+    let value = decodeAttr(m[3] ?? m[4] ?? m[5] ?? "");
     if (name.startsWith("on")) continue;
     if (!GLOBAL_ATTRS.has(name) && !allowed?.has(name)) continue;
     if (name === "href" || name === "src" || name === "srcset") {