@caelo-cms/shared 0.10.53 → 0.10.55

package/src/auto-update.ts

@@ -20,11 +20,14 @@
  * the soak period.
  *
  * Rules, in order (maintainer decisions on #696):
- *   1. nothing newer, or notices off → none;
+ *   1. nothing newer → none (there is no "notices off": security
+ *      releases are always announced, #862);
  *   2. off the stable channel, or the policy only notifies → notify;
  *   3. major → notify (never automatic before 1.0);
  *   4. release information unreadable → blocked (fails loudly, no guess);
- *   5. changes the cloud setup → needs_cloud_shell (never automatic);
+ *   5. changes the cloud setup → needs_cloud_shell (never automatic, even
+ *      with `autoConverge` on: that choice is inert until the converge job
+ *      runs these releases from Caelo, #819);
  *   6. destructive database changes → manual (never automatic);
  *   7. the kind is not switched on (security / patch / minor) → notify;
  *   8. no upgrader on this install → blocked;
@@ -194,9 +197,6 @@ export function decideAutoUpdate(input: AutoUpdateInput): AutoUpdateDecision {
   if (kind === null) {
     return { action: "none", reason: `v${input.installedVersion} is the newest release.` };
   }
-  if (policy.mode === "off") {
-    return { action: "none", reason: "Update notices are switched off in the update policy." };
-  }
   const v = release.version;
   const base = { version: v, kind } as const;
   if (!isStable(v)) {
@@ -229,10 +229,17 @@ export function decideAutoUpdate(input: AutoUpdateInput): AutoUpdateDecision {
   }
   const facts = input.facts;
   if (facts.infraChange === true) {
+    // FIXME(issue #819): once the converge job runs these releases from
+    // Caelo, `policy.autoConverge` decides here like autoPatch does below.
+    // Until then the Owner's "install automatically" choice is stored but
+    // has no effect, and the reason says so.
+    const ownerChoice = policy.autoConverge
+      ? " Your setting to install these automatically takes effect once Caelo can run them itself."
+      : "";
     return {
       action: "needs_cloud_shell",
       ...base,
-      reason: `v${v} changes this install's cloud setup, which the admin may not do. It is never installed automatically: the Owner runs it once with their own account in Cloud Shell.`,
+      reason: `v${v} changes this install's cloud setup, which the admin may not do. It is never installed automatically: the Owner runs it once with their own account in Cloud Shell.${ownerChoice}`,
     };
   }
   if (facts.contractMigrations) {

package/src/fonts.test.ts

@@ -10,6 +10,7 @@ import { describe, expect, it } from "bun:test";
 import {
   buildFontFaceCss,
   extractThemeFontRequests,
+  fontFaceProblem,
   fontUnresolvableMarker,
   googleFontsCssUrl,
   isSystemFontFamily,
@@ -155,3 +156,39 @@ describe("fontUnresolvableMarker", () => {
     expect(fontUnresolvableMarker("Poppins")).toBe("theme-font-unresolvable:Poppins");
   });
 });
+
+describe("buildFontFaceCss descriptor validation", () => {
+  const good = {
+    family: "Inter",
+    style: "normal",
+    weight: "400",
+    unicodeRange: "U+0000-00FF, U+0131, U+0152-0153",
+    publicUrl: "/_assets/fonts/inter/abc123.woff2",
+  };
+
+  it("accepts the descriptor shapes a css2 response carries", () => {
+    expect(fontFaceProblem(good)).toBeNull();
+    expect(fontFaceProblem({ ...good, style: "italic", weight: "100 900" })).toBeNull();
+    expect(fontFaceProblem({ ...good, style: "oblique 0deg 10deg" })).toBeNull();
+    expect(fontFaceProblem({ ...good, unicodeRange: null })).toBeNull();
+    expect(fontFaceProblem({ ...good, unicodeRange: "U+4??" })).toBeNull();
+  });
+
+  it("refuses descriptors that could close the <style> or add rules, instead of scrubbing them", () => {
+    expect(fontFaceProblem({ ...good, style: "normal;}</style><script>" })).toMatch(/font-style/);
+    expect(fontFaceProblem({ ...good, weight: "400;}</style>" })).toMatch(/font-weight/);
+    expect(fontFaceProblem({ ...good, unicodeRange: "U+0000-00FF;</style>" })).toMatch(
+      /unicode-range/,
+    );
+    expect(fontFaceProblem({ ...good, publicUrl: "/x.woff2)</style>" })).toMatch(/url/);
+    expect(() => buildFontFaceCss([{ ...good, weight: "400}</style>" }])).toThrow(
+      /invalid font-weight/,
+    );
+  });
+
+  it("writes a family name's < as a CSS escape so it cannot spell </style", () => {
+    const css = buildFontFaceCss([{ ...good, family: "Evil</style><script>alert(1)</script>" }]);
+    expect(css.toLowerCase()).not.toContain("</style");
+    expect(css).toContain("Evil\\3c /style>");
+  });
+});

package/src/fonts.ts

@@ -224,16 +224,53 @@ export function parseFontsCss(cssText: string): ParsedFontFace[] {
   return faces;
 }
 
+const FONT_STYLE_RE = /^(?:normal|italic|oblique(?: +-?\d{1,3}(?:\.\d+)?deg){0,2})$/i;
+const FONT_WEIGHT_RE = /^(?:normal|bold|\d{1,4}(?: +\d{1,4})?)$/i;
+const UNICODE_RANGE_ITEM = "U\\+[0-9A-F?]{1,6}(?:-[0-9A-F]{1,6})?";
+const UNICODE_RANGE_RE = new RegExp(`^${UNICODE_RANGE_ITEM}(?:, *${UNICODE_RANGE_ITEM})*$`, "i");
+/** A same-site asset path: no quotes, parens, whitespace or `<`. */
+const FONT_URL_RE = /^[A-Za-z0-9._~/:%+-]+$/;
+
+/**
+ * Why `face` cannot be emitted as an `@font-face` rule, or null when it can.
+ * The descriptors come from a remote fonts-CSS payload, so each one is held
+ * to the grammar a real descriptor has instead of being scrubbed: a value
+ * outside it could close the surrounding `<style>` or add rules, and a
+ * scrubbed value would ship a silently different font.
+ */
+export function fontFaceProblem(face: ResolvedFontFace): string | null {
+  if (!FONT_STYLE_RE.test(face.style)) return `font-style ${JSON.stringify(face.style)}`;
+  if (!FONT_WEIGHT_RE.test(face.weight)) return `font-weight ${JSON.stringify(face.weight)}`;
+  if (face.unicodeRange !== null && !UNICODE_RANGE_RE.test(face.unicodeRange)) {
+    return `unicode-range ${JSON.stringify(face.unicodeRange)}`;
+  }
+  if (!FONT_URL_RE.test(face.publicUrl)) return `url ${JSON.stringify(face.publicUrl)}`;
+  return null;
+}
+
 /**
  * Emit self-hosted @font-face CSS. `font-display: swap` always — text
  * must render in the fallback while the woff2 loads.
+ *
+ * Throws on a face {@link fontFaceProblem} refuses; the resolver checks
+ * faces first and reports a bad family as unresolved, so reaching the
+ * throw means a caller skipped that check.
  */
 export function buildFontFaceCss(faces: readonly ResolvedFontFace[]): string {
   return faces
     .map((f) => {
+      const problem = fontFaceProblem(f);
+      if (problem !== null) {
+        throw new Error(
+          `fonts: refusing the @font-face for ${JSON.stringify(f.family)} — invalid ${problem}. Re-fetch the family or pick another font.`,
+        );
+      }
+      // A CSS string; `<` is written as its CSS escape so no family name
+      // can spell `</style` in the surrounding HTML.
+      const family = JSON.stringify(f.family).replaceAll("<", "\\3c ");
       const range = f.unicodeRange !== null ? `unicode-range:${f.unicodeRange};` : "";
       return (
-        `@font-face{font-family:${JSON.stringify(f.family)};` +
+        `@font-face{font-family:${family};` +
         `font-style:${f.style};font-weight:${f.weight};font-display:swap;` +
         `src:url(${f.publicUrl}) format('woff2');${range}}`
       );

package/src/index.ts

@@ -25,6 +25,7 @@ export * from "./genesis-inventory.js";
 export * from "./google-models.js";
 export * from "./image-capabilities.js";
 export * from "./interactions.js";
+export * from "./link-refs.js";
 export {
   type LogContext,
   type Logger,
@@ -47,6 +48,7 @@ export * from "./preview-scanner.js";
 export * from "./proposal-status.js";
 export * from "./provisioning-command.js";
 export * from "./publish-live-parity.js";
+export * from "./raw-text-escape.js";
 export * from "./redirect-emit-caddy.js";
 export * from "./redirect-emit-cloudfront.js";
 export * from "./redirect-emit-front-door.js";