@bygghammar/cms-platform 0.95.0 → 0.97.0

package/src/html/html-tokenizer.ts

@@ -0,0 +1,254 @@
+/**
+ * An HTML tokenizer for the sanitizer, following the WHATWG tokenizer states
+ * that matter for a fragment of body content. No DOM is needed, so it runs the
+ * same on the server and in the browser.
+ *
+ * It splits markup into text, start tags and end tags, the way a browser
+ * would. Comments, DOCTYPEs, CDATA sections and processing instructions are
+ * consumed and produce nothing. A tag that runs into the end of the input is
+ * dropped, as a browser drops it. The content of raw-text and RCDATA elements
+ * (`<script>`, `<style>`, `<textarea>`, …) is returned as one text token, as
+ * the browser's tree builder makes the tokenizer read it.
+ *
+ * Values are returned exactly as written — text and attribute values are not
+ * decoded here. The sanitizer re-serializes everything it keeps, so nothing
+ * from the input reaches its output without being re-encoded.
+ */
+
+export type HtmlToken =
+  | { kind: "text"; raw: string }
+  | {
+      kind: "start";
+      name: string;
+      /** In source order; a repeated name keeps its first value, as browsers do. */
+      attrs: Array<{ name: string; raw: string }>;
+      selfClosing: boolean;
+    }
+  | { kind: "end"; name: string };
+
+/** Elements whose content the browser reads as text up to their own end tag. */
+const RAW_TEXT = new Set([
+  "script",
+  "style",
+  "xmp",
+  "iframe",
+  "noembed",
+  "noframes",
+  "noscript",
+  "title",
+  "textarea",
+]);
+
+const isWhitespace = (c: string) =>
+  c === " " || c === "\t" || c === "\n" || c === "\f" || c === "\r";
+const isAlpha = (c: string) => (c >= "a" && c <= "z") || (c >= "A" && c <= "Z");
+
+/** Lower-cases ASCII only, as the HTML tokenizer does for names. */
+function asciiLower(value: string): string {
+  return value.replace(/[A-Z]+/g, (m) => m.toLowerCase());
+}
+
+export function tokenizeHtml(input: string): HtmlToken[] {
+  const html = input.replace(/\r\n?/g, "\n").replace(/\u0000/g, "�");
+  const tokens: HtmlToken[] = [];
+  const n = html.length;
+  let lower: string | undefined;
+  let i = 0;
+  let textStart = 0;
+
+  const flushText = (end: number) => {
+    if (end > textStart) tokens.push({ kind: "text", raw: html.slice(textStart, end) });
+  };
+
+  /** Skips a bogus comment: everything up to and including the next `>`. */
+  const skipBogusComment = (from: number): number => {
+    const end = html.indexOf(">", from);
+    return end < 0 ? n : end + 1;
+  };
+
+  /** Skips a comment whose `<!--` ends at `from`. */
+  const skipComment = (from: number): number => {
+    if (html.startsWith(">", from)) return from + 1; // <!-->
+    if (html.startsWith("->", from)) return from + 2; // <!--->
+    let j = from;
+    while (j < n) {
+      if (html.startsWith("-->", j)) return j + 3;
+      if (html.startsWith("--!>", j)) return j + 4;
+      j++;
+    }
+    return n;
+  };
+
+  /**
+   * Reads a tag whose name starts at `from`. Returns the token and the index
+   * after the tag, or null when the input ends inside it.
+   */
+  const readTag = (
+    from: number,
+    closing: boolean,
+  ): { token: HtmlToken; next: number } | null => {
+    let j = from;
+    while (j < n && !isWhitespace(html[j]!) && html[j] !== "/" && html[j] !== ">") j++;
+    const name = asciiLower(html.slice(from, j));
+    const attrs: Array<{ name: string; raw: string }> = [];
+    const seen = new Set<string>();
+    let selfClosing = false;
+
+    for (;;) {
+      // Before attribute name.
+      while (j < n && (isWhitespace(html[j]!) || html[j] === "/")) {
+        if (html[j] === "/") {
+          // Self-closing start tag state.
+          if (html[j + 1] === ">") {
+            selfClosing = true;
+            j++;
+            break;
+          }
+        }
+        j++;
+      }
+      if (j >= n) return null;
+      if (html[j] === ">") {
+        j++;
+        break;
+      }
+      // Attribute name: a leading `=` is part of the name.
+      const nameStart = j;
+      j++;
+      while (j < n && !isWhitespace(html[j]!) && html[j] !== "/" && html[j] !== ">" && html[j] !== "=") {
+        j++;
+      }
+      const attrName = asciiLower(html.slice(nameStart, j));
+      // After attribute name.
+      while (j < n && isWhitespace(html[j]!)) j++;
+      let raw = "";
+      if (j < n && html[j] === "=") {
+        j++;
+        while (j < n && isWhitespace(html[j]!)) j++;
+        if (j >= n) return null;
+        const quote = html[j];
+        if (quote === '"' || quote === "'") {
+          const end = html.indexOf(quote, j + 1);
+          if (end < 0) return null;
+          raw = html.slice(j + 1, end);
+          j = end + 1;
+        } else if (html[j] !== ">") {
+          const start = j;
+          while (j < n && !isWhitespace(html[j]!) && html[j] !== ">") j++;
+          raw = html.slice(start, j);
+        }
+      }
+      if (j >= n) return null;
+      if (!seen.has(attrName)) {
+        seen.add(attrName);
+        attrs.push({ name: attrName, raw });
+      }
+    }
+
+    const token: HtmlToken = closing
+      ? { kind: "end", name }
+      : { kind: "start", name, attrs, selfClosing };
+    return { token, next: j };
+  };
+
+  while (i < n) {
+    const lt = html.indexOf("<", i);
+    if (lt < 0) break;
+    const c = html[lt + 1] ?? "";
+
+    if (isAlpha(c)) {
+      const tag = readTag(lt + 1, false);
+      flushText(lt);
+      if (!tag) {
+        // The input ends inside the tag: the browser drops it.
+        i = textStart = n;
+        break;
+      }
+      tokens.push(tag.token);
+      i = textStart = tag.next;
+      const name = tag.token.kind === "start" ? tag.token.name : "";
+      if (name === "plaintext") {
+        flushText(n);
+        textStart = n;
+        i = n;
+        break;
+      }
+      if (RAW_TEXT.has(name)) {
+        // Read the content as text, up to `</name` followed by a delimiter.
+        // ASCII-only lower-casing keeps every index the same as in `html`.
+        lower ??= asciiLower(html);
+        let j = i;
+        let end = -1;
+        while ((j = lower.indexOf(`</${name}`, j)) >= 0) {
+          const after = html[j + 2 + name.length] ?? "";
+          if (after === "" || isWhitespace(after) || after === "/" || after === ">") {
+            end = j;
+            break;
+          }
+          j += 2 + name.length;
+        }
+        if (end < 0) {
+          if (i < n) tokens.push({ kind: "text", raw: html.slice(i) });
+          i = textStart = n;
+          break;
+        }
+        if (end > i) tokens.push({ kind: "text", raw: html.slice(i, end) });
+        const close = readTag(end + 2, true);
+        tokens.push({ kind: "end", name });
+        i = textStart = close ? close.next : n;
+      }
+      continue;
+    }
+
+    if (c === "/") {
+      const d = html[lt + 2] ?? "";
+      if (isAlpha(d)) {
+        const tag = readTag(lt + 2, true);
+        flushText(lt);
+        if (!tag) {
+          i = textStart = n;
+          break;
+        }
+        tokens.push(tag.token);
+        i = textStart = tag.next;
+        continue;
+      }
+      if (d === ">") {
+        flushText(lt);
+        i = textStart = lt + 3;
+        continue;
+      }
+      if (d === "") {
+        // `</` at the end of the input is text.
+        i = n;
+        break;
+      }
+      flushText(lt);
+      i = textStart = skipBogusComment(lt + 2);
+      continue;
+    }
+
+    if (c === "!") {
+      flushText(lt);
+      if (html.startsWith("--", lt + 2)) {
+        i = textStart = skipComment(lt + 4);
+      } else {
+        // DOCTYPE, CDATA and anything else after `<!` end at the next `>`.
+        i = textStart = skipBogusComment(lt + 2);
+      }
+      continue;
+    }
+
+    if (c === "?") {
+      flushText(lt);
+      i = textStart = skipBogusComment(lt + 1);
+      continue;
+    }
+
+    // A `<` that starts nothing is text.
+    i = lt + 1;
+  }
+
+  flushText(n);
+  return tokens;
+}

package/src/html/sanitize-html.ts

@@ -5,7 +5,16 @@
  * only staff can author it, the output is sanitized on every render so a
  * pasted `<script>`, inline event handler or `javascript:` URL can never end
  * up in a page.
+ *
+ * The input is tokenized the way a browser tokenizes it (`html-tokenizer`),
+ * and the output is written from scratch: allowed elements with allowed,
+ * re-encoded attributes, and text with every `<` and `>` escaped. Nothing from
+ * the input is ever copied through as written, so markup the sanitizer does
+ * not recognise — an unterminated tag, a stray `<` — reaches the page as
+ * visible text and can never be completed into an element by the markup that
+ * follows it.
  */
+import { tokenizeHtml } from "./html-tokenizer";
 
 const ALLOWED_TAGS = new Set([
   "p", "br", "hr", "span", "div",
@@ -19,9 +28,13 @@ const ALLOWED_TAGS = new Set([
 
 /** Tags whose entire contents are dropped. */
 const DROP_WITH_CONTENT = new Set([
-  "script", "style", "iframe", "object", "embed", "noscript", "template", "svg", "math",
+  "script", "style", "iframe", "object", "noscript", "template", "svg", "math",
+  "textarea", "title", "xmp", "noembed", "noframes", "plaintext",
 ]);
 
+/** Dropped elements that can contain themselves, so their end tags are counted. */
+const NESTING = new Set(["svg", "math", "object", "template"]);
+
 const VOID_TAGS = new Set(["br", "hr", "img", "col"]);
 
 const GLOBAL_ATTRS = new Set(["class", "style", "id", "title", "dir", "lang"]);
@@ -58,10 +71,13 @@ const ALLOWED_CSS = new Set([
 
 const SAFE_URL = /^(https?:\/\/|mailto:|tel:|\/|#|\.\/|\.\.\/)/i;
 
-function safeUrl(raw: string): string | null {
+function safeUrl(raw: string, attribute: string): string | null {
   const value = raw.trim().replace(/[\u0000-\u001f]/g, "");
   if (!value) return null;
-  if (/^data:image\/(png|jpe?g|gif|webp|avif);base64,/i.test(value)) return value;
+  // An inline image is an image source, never a link target.
+  if (/^data:image\/(png|jpe?g|gif|webp|avif);base64,/i.test(value)) {
+    return attribute === "src" ? value : null;
+  }
   if (!SAFE_URL.test(value)) return null;
   if (/^\s*javascript:/i.test(value)) return null;
   return value;
@@ -127,21 +143,17 @@ export function decodeAttr(value: string): string {
   );
 }
 
-const ATTR_RE = /([a-zA-Z_:][-a-zA-Z0-9_:.]*)\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>]+))/g;
-
-function sanitizeAttrs(tag: string, raw: string): string {
-  const allowed = TAG_ATTRS[tag];
+function sanitizeAttrs(tag: string, attrs: ReadonlyArray<{ name: string; raw: string }>): string {
+  const allowed = Object.prototype.hasOwnProperty.call(TAG_ATTRS, tag) ? TAG_ATTRS[tag] : undefined;
   const parts: string[] = [];
-  let m: RegExpExecArray | null;
-  ATTR_RE.lastIndex = 0;
-  while ((m = ATTR_RE.exec(raw))) {
-    const name = m[1].toLowerCase();
-    let value = decodeAttr(m[3] ?? m[4] ?? m[5] ?? "");
+  for (const attr of attrs) {
+    const name = attr.name;
+    let value = decodeAttr(attr.raw);
     if (name.startsWith("on")) continue;
     if (!GLOBAL_ATTRS.has(name) && !allowed?.has(name)) continue;
     if (name === "href" || name === "src" || name === "srcset") {
       if (name === "srcset") continue;
-      const url = safeUrl(value);
+      const url = safeUrl(value, name);
       if (!url) continue;
       value = url;
     }
@@ -164,30 +176,56 @@ function sanitizeAttrs(tag: string, raw: string): string {
   return parts.length ? " " + parts.join(" ") : "";
 }
 
+/** A character reference as written in text: kept, since it can only decode to text. */
+const CHAR_REF = /^&(?:#[0-9]{1,7}|#[xX][0-9a-fA-F]{1,6}|[a-zA-Z][a-zA-Z0-9]{0,31});/;
+
+/** Text as written, made safe to emit: no `<` or `>`, and every `&` a reference. */
+function escapeText(raw: string): string {
+  let out = "";
+  for (let i = 0; i < raw.length; i++) {
+    const c = raw[i]!;
+    if (c === "<") out += "&lt;";
+    else if (c === ">") out += "&gt;";
+    else if (c === "&") out += CHAR_REF.test(raw.slice(i, i + 42)) ? "&" : "&amp;";
+    else out += c;
+  }
+  return out;
+}
+
 /** Sanitize an HTML fragment down to the editor's allowlist. */
 export function sanitizeHtml(input: string | undefined | null): string {
   if (!input) return "";
-  // Remove comments and any element whose content must go with it.
-  let html = input.replace(/<!--[\s\S]*?-->/g, "");
-  for (const tag of DROP_WITH_CONTENT) {
-    html = html.replace(new RegExp(`<${tag}[\\s\\S]*?<\\/${tag}\\s*>`, "gi"), "");
-    html = html.replace(new RegExp(`<${tag}\\b[^>]*\\/?>`, "gi"), "");
-  }
-
   const open: string[] = [];
   let out = "";
-  let last = 0;
-  const tagRe = /<\s*(\/)?\s*([a-zA-Z][a-zA-Z0-9-]*)((?:[^>"']|"[^"]*"|'[^']*')*)>/g;
-  let m: RegExpExecArray | null;
-
-  while ((m = tagRe.exec(html))) {
-    out += html.slice(last, m.index);
-    last = m.index + m[0].length;
-    const closing = Boolean(m[1]);
-    const tag = m[2].toLowerCase();
+  /** The dropped element being skipped, and how deep inside it we are. */
+  let skipping: { tag: string; depth: number } | null = null;
+
+  for (const token of tokenizeHtml(input)) {
+    if (skipping) {
+      if (token.kind === "start" && token.name === skipping.tag && NESTING.has(token.name)) {
+        if (!token.selfClosing) skipping.depth++;
+      } else if (token.kind === "end" && token.name === skipping.tag) {
+        if (--skipping.depth === 0) skipping = null;
+      }
+      continue;
+    }
+
+    if (token.kind === "text") {
+      out += escapeText(token.raw);
+      continue;
+    }
+
+    const tag = token.name;
+    if (token.kind === "start" && DROP_WITH_CONTENT.has(tag)) {
+      // A self-closing <svg/> or <math/> is empty; every other one has content.
+      if (!(token.selfClosing && (tag === "svg" || tag === "math"))) {
+        skipping = { tag, depth: 1 };
+      }
+      continue;
+    }
     if (!ALLOWED_TAGS.has(tag)) continue;
 
-    if (closing) {
+    if (token.kind === "end") {
       if (VOID_TAGS.has(tag)) continue;
       const at = open.lastIndexOf(tag);
       if (at < 0) continue;
@@ -197,22 +235,19 @@ export function sanitizeHtml(input: string | undefined | null): string {
     }
 
     if (VOID_TAGS.has(tag)) {
-      out += `<${tag}${sanitizeAttrs(tag, m[3] ?? "")} />`;
+      out += `<${tag}${sanitizeAttrs(tag, token.attrs)} />`;
       continue;
     }
-    out += `<${tag}${sanitizeAttrs(tag, m[3] ?? "")}>`;
+    out += `<${tag}${sanitizeAttrs(tag, token.attrs)}>`;
     open.push(tag);
   }
-  out += html.slice(last);
   while (open.length) out += `</${open.pop()}>`;
   return out;
 }
 
 /** Plain-text preview of rich text (used for thumbnails and summaries). */
 export function htmlToText(input: string | undefined | null): string {
-  return sanitizeHtml(input)
-    .replace(/<[^>]+>/g, " ")
-    .replace(/&nbsp;/g, " ")
+  return decodeAttr(sanitizeHtml(input).replace(/<[^>]+>/g, " "))
     .replace(/\s+/g, " ")
     .trim();
 }

package/src/navigation/visibility.ts

@@ -16,12 +16,21 @@ import type { HiddenPageReason } from "../cms/page-visibility";
 import { normalizeOrigin, normalizeRoutePath } from "../site/route-index";
 import type { NavigationItem } from "./index";
 
+/**
+ * Why a page's addresses are hidden from navigation: its permanent state
+ * (offline, link-only), or `booking-off` — a booking-off landing page while
+ * booking is hidden, which stays indexable and in the sitemap.
+ */
+export type HiddenPathReason = HiddenPageReason | "booking-off";
+
 /** Why a saved link is not shown. */
-export type HiddenLinkReason = HiddenPageReason | "booking" | "unknown";
+export type HiddenLinkReason = HiddenPathReason | "booking" | "unknown";
 
 export const HIDDEN_LINK_REASONS: Record<HiddenLinkReason, string> = {
   offline: "Not shown on the site: the page it links to is offline.",
   "link-only": "Not shown on the site: the page it links to is link-only.",
+  "booking-off":
+    "Not shown while booking is hidden: the page it links to is hidden from the website until booking is shown again (it stays reachable and indexable).",
   booking: "Not shown on the site: booking is switched off in Site settings.",
   unknown: "Not shown right now: the site could not read which pages are public.",
 };
@@ -35,12 +44,21 @@ export type LinkVisibilityPolicy = {
   known: boolean;
   /** Booking links in site-wide chrome (menu, footer, header button). */
   bookingVisible: boolean;
-  /** Normalized served paths of unlisted pages, every locale and alias. */
-  hiddenPaths: Readonly<Record<string, HiddenPageReason>>;
+  /**
+   * Normalized served paths of unlisted pages, every locale and alias — and,
+   * while booking is off, of booking-off landing pages (`booking-off`).
+   */
+  hiddenPaths: Readonly<Record<string, HiddenPathReason>>;
   /** Origins that are this site, for absolute links written with the domain. */
   origins: readonly string[];
   /** Locale prefixes, so `/EN/...` and `/en/...` compare equal. */
   locales?: readonly string[];
+  /**
+   * Normalized addresses of the site's own booking page — every locale, slug
+   * and alias. Supplied by the host, which knows its routes; the platform
+   * names none. A booking-off notice never links there.
+   */
+  bookingPagePaths?: readonly string[];
 };
 
 /** No filtering at all: what screens without a public policy render with. */
@@ -93,6 +111,43 @@ export function linkHideReason(href: string, policy: LinkVisibilityPolicy): Hidd
   return policy.hiddenPaths[path] ?? null;
 }
 
+/**
+ * Is this link a page card or list entry for a page that is hidden from the
+ * website right now because booking is off?
+ *
+ * For the structured page lists inside page content (link tiles, destination
+ * cards): they leave out booking-off landing pages, and only those. Their
+ * links to offline or link-only pages, and every link in running text, are
+ * left exactly as before.
+ */
+export function isHiddenFromDiscovery(href: string | null | undefined, policy: LinkVisibilityPolicy): boolean {
+  if (!href) return false;
+  const path = internalPathOf(href, policy);
+  return path !== null && policy.hiddenPaths[path] === "booking-off";
+}
+
+/**
+ * Does this link lead to booking: a booking site, or the site's own booking
+ * page in any spelling the host named? Query strings and fragments do not
+ * change the answer.
+ */
+export function isBookingDestination(href: string | null | undefined, policy: LinkVisibilityPolicy): boolean {
+  if (!href) return false;
+  if (isBookingHref(href)) return true;
+  const path = internalPathOf(href, policy);
+  return path !== null && (policy.bookingPagePaths ?? []).includes(path);
+}
+
+/**
+ * May a booking-off notice offer this link? Not when it leads to booking —
+ * the notice says booking is not offered here — and not when it leads to a
+ * page the same policy hides from the website.
+ */
+export function isNoticeLinkAllowed(href: string | null | undefined, policy: LinkVisibilityPolicy): boolean {
+  if (!href) return false;
+  return !isBookingDestination(href, policy) && !isHiddenFromDiscovery(href, policy);
+}
+
 /**
  * Navigation with hidden links removed, order preserved.
  *
@@ -221,12 +276,19 @@ export function savedLinkHrefs(section: "nav" | "footer", value: unknown): strin
  * page: that would publish the address of each link-only page in the source of
  * every other page. The chrome only needs answers for the links it has, and
  * those addresses are already in the content that is sent anyway.
+ *
+ * `booking-off` entries are kept whether linked from `hrefs` or not: those
+ * pages are public, indexable and in the sitemap, so naming them publishes
+ * nothing, and page cards in the content need them too.
  */
 export function restrictToLinks(
   policy: LinkVisibilityPolicy,
   hrefs: readonly string[],
 ): LinkVisibilityPolicy {
   const hiddenPaths: Record<string, LinkVisibilityPolicy["hiddenPaths"][string]> = {};
+  for (const [path, reason] of Object.entries(policy.hiddenPaths)) {
+    if (reason === "booking-off") hiddenPaths[path] = reason;
+  }
   for (const href of hrefs) {
     const path = internalPathOf(href, policy);
     if (path !== null && policy.hiddenPaths[path]) hiddenPaths[path] = policy.hiddenPaths[path]!;