@camstack/ui-library 1.2.275 → 1.2.276

package/dist/composites/sanitize-info-html.d.ts

@@ -0,0 +1,16 @@
+/**
+* Sanitize a small HTML subset for `ConfigInfoField.format='html'`.
+*
+* Only `<a>`, `<ul>`, `<ol>`, `<li>`, `<strong>`, `<em>`, `<code>`,
+* `<br>`, `<p>`, and `<span>` are kept. On anchors, only `href` and a
+* normalised `target`/`rel` are emitted; everything else is dropped
+* (including event handlers and inline styles).
+*
+* Allowed `href` schemes: `http(s):`, `mailto:`, and **root-relative**
+* paths (`/addon/…`). Root-relative links stay same-tab (session cookie);
+* absolute http(s) open in a new tab. Protocol-relative (`//…`) is refused.
+*
+* The input comes from addon-authored copy bundled at build time —
+* sanitisation is defence in depth rather than primary trust boundary.
+*/
+export declare function sanitizeInfoHtml(html: string): string;

package/dist/index.cjs

@@ -7249,6 +7249,68 @@ function ConfigIconFieldControl({ label, value, defaultKey, disabled, onChange }
 	});
 }
 //#endregion
+//#region src/composites/sanitize-info-html.ts
+/**
+* Sanitize a small HTML subset for `ConfigInfoField.format='html'`.
+*
+* Only `<a>`, `<ul>`, `<ol>`, `<li>`, `<strong>`, `<em>`, `<code>`,
+* `<br>`, `<p>`, and `<span>` are kept. On anchors, only `href` and a
+* normalised `target`/`rel` are emitted; everything else is dropped
+* (including event handlers and inline styles).
+*
+* Allowed `href` schemes: `http(s):`, `mailto:`, and **root-relative**
+* paths (`/addon/…`). Root-relative links stay same-tab (session cookie);
+* absolute http(s) open in a new tab. Protocol-relative (`//…`) is refused.
+*
+* The input comes from addon-authored copy bundled at build time —
+* sanitisation is defence in depth rather than primary trust boundary.
+*/
+function sanitizeInfoHtml(html) {
+	if (typeof window === "undefined" || typeof DOMParser === "undefined") return "";
+	const ALLOWED_TAGS = new Set([
+		"A",
+		"UL",
+		"OL",
+		"LI",
+		"STRONG",
+		"EM",
+		"CODE",
+		"BR",
+		"P",
+		"SPAN",
+		"B"
+	]);
+	const doc = new DOMParser().parseFromString(`<div>${html}</div>`, "text/html");
+	const root = doc.body.firstElementChild;
+	if (!root) return "";
+	const walk = (node) => {
+		const children = Array.from(node.children);
+		for (const child of children) {
+			if (!ALLOWED_TAGS.has(child.tagName)) {
+				const text = doc.createTextNode(child.textContent ?? "");
+				child.replaceWith(text);
+				continue;
+			}
+			const allowed = child.tagName === "A" ? new Set(["href"]) : /* @__PURE__ */ new Set();
+			for (const attr of Array.from(child.attributes)) if (!allowed.has(attr.name)) child.removeAttribute(attr.name);
+			if (child.tagName === "A") {
+				const href = child.getAttribute("href") ?? "";
+				const isHttp = /^https?:\/\//i.test(href);
+				const isMailto = href.startsWith("mailto:");
+				const isRootRelative = href.startsWith("/") && !href.startsWith("//");
+				if (!isHttp && !isMailto && !isRootRelative) child.removeAttribute("href");
+				else if (isHttp) {
+					child.setAttribute("target", "_blank");
+					child.setAttribute("rel", "noopener noreferrer");
+				}
+			}
+			walk(child);
+		}
+	};
+	walk(root);
+	return root.innerHTML;
+}
+//#endregion
 //#region ../../node_modules/clsx/dist/clsx.mjs
 function r(e) {
 	var t, f, n = "";
@@ -29020,57 +29082,6 @@ var INFO_VARIANT_STYLES = {
 		text: "text-danger"
 	}
 };
-/**
-* Sanitize a small HTML subset for `ConfigInfoField.format='html'`.
-*
-* Only `<a>`, `<ul>`, `<ol>`, `<li>`, `<strong>`, `<em>`, `<code>`,
-* `<br>`, and `<p>` are kept. On anchors, only `href` (http/https only)
-* and a normalised `target/rel` are emitted; everything else is dropped
-* (including event handlers and inline styles). The input comes from
-* addon-authored copy bundled at build time — sanitisation is defence
-* in depth rather than primary trust boundary.
-*/
-function sanitizeInfoHtml(html) {
-	if (typeof window === "undefined" || typeof DOMParser === "undefined") return "";
-	const ALLOWED_TAGS = new Set([
-		"A",
-		"UL",
-		"OL",
-		"LI",
-		"STRONG",
-		"EM",
-		"CODE",
-		"BR",
-		"P",
-		"SPAN"
-	]);
-	const doc = new DOMParser().parseFromString(`<div>${html}</div>`, "text/html");
-	const root = doc.body.firstElementChild;
-	if (!root) return "";
-	const walk = (node) => {
-		const children = Array.from(node.children);
-		for (const child of children) {
-			if (!ALLOWED_TAGS.has(child.tagName)) {
-				const text = doc.createTextNode(child.textContent ?? "");
-				child.replaceWith(text);
-				continue;
-			}
-			const allowed = child.tagName === "A" ? new Set(["href"]) : /* @__PURE__ */ new Set();
-			for (const attr of Array.from(child.attributes)) if (!allowed.has(attr.name)) child.removeAttribute(attr.name);
-			if (child.tagName === "A") {
-				const href = child.getAttribute("href") ?? "";
-				if (!/^https?:\/\//i.test(href) && !href.startsWith("mailto:")) child.removeAttribute("href");
-				else {
-					child.setAttribute("target", "_blank");
-					child.setAttribute("rel", "noopener noreferrer");
-				}
-			}
-			walk(child);
-		}
-	};
-	walk(root);
-	return root.innerHTML;
-}
 function InfoBox({ field }) {
 	const styles = INFO_VARIANT_STYLES[field.variant ?? "info"] ?? INFO_VARIANT_STYLES["info"];
 	const isHtml = field.format === "html";

package/dist/index.js

@@ -7225,6 +7225,68 @@ function ConfigIconFieldControl({ label, value, defaultKey, disabled, onChange }
 	});
 }
 //#endregion
+//#region src/composites/sanitize-info-html.ts
+/**
+* Sanitize a small HTML subset for `ConfigInfoField.format='html'`.
+*
+* Only `<a>`, `<ul>`, `<ol>`, `<li>`, `<strong>`, `<em>`, `<code>`,
+* `<br>`, `<p>`, and `<span>` are kept. On anchors, only `href` and a
+* normalised `target`/`rel` are emitted; everything else is dropped
+* (including event handlers and inline styles).
+*
+* Allowed `href` schemes: `http(s):`, `mailto:`, and **root-relative**
+* paths (`/addon/…`). Root-relative links stay same-tab (session cookie);
+* absolute http(s) open in a new tab. Protocol-relative (`//…`) is refused.
+*
+* The input comes from addon-authored copy bundled at build time —
+* sanitisation is defence in depth rather than primary trust boundary.
+*/
+function sanitizeInfoHtml(html) {
+	if (typeof window === "undefined" || typeof DOMParser === "undefined") return "";
+	const ALLOWED_TAGS = new Set([
+		"A",
+		"UL",
+		"OL",
+		"LI",
+		"STRONG",
+		"EM",
+		"CODE",
+		"BR",
+		"P",
+		"SPAN",
+		"B"
+	]);
+	const doc = new DOMParser().parseFromString(`<div>${html}</div>`, "text/html");
+	const root = doc.body.firstElementChild;
+	if (!root) return "";
+	const walk = (node) => {
+		const children = Array.from(node.children);
+		for (const child of children) {
+			if (!ALLOWED_TAGS.has(child.tagName)) {
+				const text = doc.createTextNode(child.textContent ?? "");
+				child.replaceWith(text);
+				continue;
+			}
+			const allowed = child.tagName === "A" ? new Set(["href"]) : /* @__PURE__ */ new Set();
+			for (const attr of Array.from(child.attributes)) if (!allowed.has(attr.name)) child.removeAttribute(attr.name);
+			if (child.tagName === "A") {
+				const href = child.getAttribute("href") ?? "";
+				const isHttp = /^https?:\/\//i.test(href);
+				const isMailto = href.startsWith("mailto:");
+				const isRootRelative = href.startsWith("/") && !href.startsWith("//");
+				if (!isHttp && !isMailto && !isRootRelative) child.removeAttribute("href");
+				else if (isHttp) {
+					child.setAttribute("target", "_blank");
+					child.setAttribute("rel", "noopener noreferrer");
+				}
+			}
+			walk(child);
+		}
+	};
+	walk(root);
+	return root.innerHTML;
+}
+//#endregion
 //#region ../../node_modules/clsx/dist/clsx.mjs
 function r(e) {
 	var t, f, n = "";
@@ -28996,57 +29058,6 @@ var INFO_VARIANT_STYLES = {
 		text: "text-danger"
 	}
 };
-/**
-* Sanitize a small HTML subset for `ConfigInfoField.format='html'`.
-*
-* Only `<a>`, `<ul>`, `<ol>`, `<li>`, `<strong>`, `<em>`, `<code>`,
-* `<br>`, and `<p>` are kept. On anchors, only `href` (http/https only)
-* and a normalised `target/rel` are emitted; everything else is dropped
-* (including event handlers and inline styles). The input comes from
-* addon-authored copy bundled at build time — sanitisation is defence
-* in depth rather than primary trust boundary.
-*/
-function sanitizeInfoHtml(html) {
-	if (typeof window === "undefined" || typeof DOMParser === "undefined") return "";
-	const ALLOWED_TAGS = new Set([
-		"A",
-		"UL",
-		"OL",
-		"LI",
-		"STRONG",
-		"EM",
-		"CODE",
-		"BR",
-		"P",
-		"SPAN"
-	]);
-	const doc = new DOMParser().parseFromString(`<div>${html}</div>`, "text/html");
-	const root = doc.body.firstElementChild;
-	if (!root) return "";
-	const walk = (node) => {
-		const children = Array.from(node.children);
-		for (const child of children) {
-			if (!ALLOWED_TAGS.has(child.tagName)) {
-				const text = doc.createTextNode(child.textContent ?? "");
-				child.replaceWith(text);
-				continue;
-			}
-			const allowed = child.tagName === "A" ? new Set(["href"]) : /* @__PURE__ */ new Set();
-			for (const attr of Array.from(child.attributes)) if (!allowed.has(attr.name)) child.removeAttribute(attr.name);
-			if (child.tagName === "A") {
-				const href = child.getAttribute("href") ?? "";
-				if (!/^https?:\/\//i.test(href) && !href.startsWith("mailto:")) child.removeAttribute("href");
-				else {
-					child.setAttribute("target", "_blank");
-					child.setAttribute("rel", "noopener noreferrer");
-				}
-			}
-			walk(child);
-		}
-	};
-	walk(root);
-	return root.innerHTML;
-}
 function InfoBox({ field }) {
 	const styles = INFO_VARIANT_STYLES[field.variant ?? "info"] ?? INFO_VARIANT_STYLES["info"];
 	const isHtml = field.format === "html";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/ui-library",
-  "version": "1.2.275",
+  "version": "1.2.276",
   "type": "module",
   "main": "dist/index.cjs",
   "module": "dist/index.js",