@designcrowd/library.brand-page 6.0.26-json-prereq-2 → 6.0.26

package/src/brand-page-maker/utils/rte-sanitize-json.test.ts

@@ -1,158 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { sanitizeRteJson } from './rte-sanitize.util';
-import { toRteJson } from './rte-render.util';
-import { COMPLEX_RTE_HTML } from '../__fixtures__/complex-rte.fixture';
-
-/**
- * BP-5787 — native JSON sanitiser (T5). Operates on the Tiptap tree directly
- * (no editor, no HTML, no DOMPurify). Mirrors the HTML allowlist's guarantees.
- */
-const doc = (content: unknown[]): unknown => ({ type: 'doc', content });
-const para = (content: unknown[]) => ({ type: 'paragraph', content });
-const text = (t: string, marks?: unknown[]) => ({
-  type: 'text',
-  text: t,
-  marks,
-});
-const json = (v: unknown) => JSON.stringify(v);
-
-describe('sanitizeRteJson (native)', () => {
-  it('drops unknown node types but keeps their valid text siblings', () => {
-    const out = sanitizeRteJson(
-      doc([
-        para([text('keep me')]),
-        { type: 'image', attrs: { src: 'x', onerror: 'alert(1)' } },
-        { type: 'script', content: [text('alert(1)')] },
-      ]),
-    );
-
-    expect(json(out)).toContain('keep me');
-    expect(json(out)).not.toContain('image');
-    expect(json(out)).not.toContain('script');
-    expect(json(out)).not.toContain('alert(1)');
-  });
-
-  it('drops unknown mark types, keeps allow-listed ones', () => {
-    const out = sanitizeRteJson(
-      doc([
-        para([
-          text('bold', [{ type: 'bold' }]),
-          text('evil', [{ type: 'onclick', attrs: { js: 'alert(1)' } }]),
-        ]),
-      ]),
-    );
-
-    expect(json(out)).toContain('"type":"bold"');
-    expect(json(out)).not.toContain('onclick');
-    expect(json(out)).not.toContain('alert(1)');
-  });
-
-  it('strips javascript: / data: hrefs from link marks (drops the mark)', () => {
-    const out = sanitizeRteJson(
-      doc([
-        para([
-          // eslint-disable-next-line no-script-url
-          text('click', [
-            { type: 'link', attrs: { href: 'javascript:alert(1)' } },
-          ]),
-        ]),
-      ]),
-    );
-
-    expect(json(out)).toContain('click'); // text kept
-    expect(json(out)).not.toContain('javascript:');
-    expect(json(out)).not.toContain('"type":"link"');
-  });
-
-  it('keeps safe links', () => {
-    const out = sanitizeRteJson(
-      doc([
-        para([
-          text('site', [
-            {
-              type: 'link',
-              attrs: { href: 'https://example.com', target: '_blank' },
-            },
-          ]),
-        ]),
-      ]),
-    );
-
-    expect(json(out)).toContain('https://example.com');
-  });
-
-  it('keeps safe textStyle attrs incl. theme token, drops injection values', () => {
-    const out = sanitizeRteJson(
-      doc([
-        para([
-          text('ok', [
-            {
-              type: 'textStyle',
-              attrs: {
-                color: 'var(--logo-text-color)',
-                fontFamily: 'Open Sans',
-                fontSize: '1.5em',
-              },
-            },
-          ]),
-          text('bad', [
-            {
-              type: 'textStyle',
-              attrs: {
-                color: 'red; position: fixed; top: 0',
-                fontSize: '1em" onload="x',
-              },
-            },
-          ]),
-        ]),
-      ]),
-    );
-
-    const s = json(out);
-
-    expect(s).toContain('var(--logo-text-color)');
-    expect(s).toContain('Open Sans');
-    expect(s).toContain('1.5em');
-    // injection values dropped
-    expect(s).not.toContain('position: fixed');
-    expect(s).not.toContain('onload');
-  });
-
-  it('clamps heading level and keeps valid textAlign', () => {
-    const out: any = sanitizeRteJson(
-      doc([
-        {
-          type: 'heading',
-          attrs: { level: 99, textAlign: 'center' },
-          content: [text('H')],
-        },
-        {
-          type: 'paragraph',
-          attrs: { textAlign: 'evil' },
-          content: [text('P')],
-        },
-      ]),
-    );
-
-    expect(out.content[0].attrs.level).toBe(1);
-    expect(out.content[0].attrs.textAlign).toBe('center');
-    expect(out.content[1].attrs?.textAlign).toBeUndefined();
-  });
-
-  it('passes the clean complex fixture through unchanged (idempotent)', () => {
-    const clean = toRteJson(COMPLEX_RTE_HTML);
-    const once = sanitizeRteJson(clean);
-    const twice = sanitizeRteJson(once);
-
-    expect(twice).toEqual(once);
-    // legitimate content preserved
-    expect(json(once)).toContain('var(--logo-text-color)');
-    expect(json(once)).toContain('Montserrat');
-    expect(json(once)).toContain('https://example.com');
-  });
-
-  it('returns an empty doc for non-document input', () => {
-    expect(sanitizeRteJson(null)).toEqual({ type: 'doc', content: [] });
-    expect(sanitizeRteJson('<p>x</p>')).toEqual({ type: 'doc', content: [] });
-  });
-});

package/src/brand-page-maker/utils/rte-sanitize.util.ts

@@ -1,195 +0,0 @@
-import type { JSONContent } from '@tiptap/vue-3';
-import { validateAndSanitizeHref } from './rich-text-editor.util';
-
-/**
- * BP-5787 — native JSON sanitiser for RTE content.
- *
- * Operates directly on the Tiptap document tree: no editor instantiation, no
- * HTML round-trip, no DOMPurify. This is the hot path (runs on every editor
- * update and on the server sanitise gate), so it is a single, allocation-light
- * recursive walk.
- *
- * Security model (mirrors the HTML allowlist it replaces):
- *  - only allow-listed node and mark types survive; everything else is dropped;
- *  - textStyle / highlight attrs are restricted to known keys whose values must
- *    be "safe CSS values" (no quotes/angle-brackets/extra declarations/url()/
- *    expression()), preventing CSS-injection when the value is later rendered
- *    into a `style="…"` attribute;
- *  - link hrefs go through the same validateAndSanitizeHref used by the HTML
- *    sanitiser; unsafe links lose their href (and the mark);
- *  - heading levels are clamped to 1–6.
- */
-
-// ProseMirror node types the editor schema can legitimately produce.
-const ALLOWED_NODE_TYPES = new Set([
-  'doc',
-  'paragraph',
-  'heading',
-  'text',
-  'hardBreak',
-  'bulletList',
-  'orderedList',
-  'listItem',
-  'blockquote',
-  'codeBlock',
-  'horizontalRule',
-]);
-
-// Inline mark types the editor produces (strong/em/u/s/code/span/mark/a).
-const ALLOWED_MARK_TYPES = new Set([
-  'bold',
-  'italic',
-  'underline',
-  'strike',
-  'code',
-  'textStyle',
-  'highlight',
-  'link',
-]);
-
-// textStyle attrs map to the allow-listed CSS properties (font-weight →
-// bold mark, text-decoration → underline/strike, text-align → node attr,
-// background-color → highlight, so they are intentionally not here).
-const ALLOWED_TEXT_STYLE_ATTRS = new Set([
-  'color',
-  'fontFamily',
-  'fontSize',
-  'letterSpacing',
-  'lineHeight',
-]);
-
-type Mark = { type?: string; attrs?: Record<string, unknown> };
-
-/**
- * A safe CSS value is a short string free of characters that could inject an
- * extra declaration or escape the attribute, and free of the url()/expression()
- * vectors. Legitimate values — `rgb(255, 0, 0)`, `#FF0000`,
- * `var(--logo-text-color)`, `Open Sans`, `1.5em` — all pass.
- */
-const isSafeCssValue = (value: unknown): value is string =>
-  typeof value === 'string' &&
-  value.length > 0 &&
-  value.length <= 200 &&
-  !/[<>"';]/.test(value) &&
-  !/url\s*\(/i.test(value) &&
-  !/expression\s*\(/i.test(value);
-
-const sanitizeTextStyleAttrs = (
-  attrs: Record<string, unknown>,
-): Record<string, unknown> | null => {
-  const clean: Record<string, unknown> = {};
-
-  for (const key of Object.keys(attrs)) {
-    if (!ALLOWED_TEXT_STYLE_ATTRS.has(key)) continue;
-
-    const value = attrs[key];
-
-    // Tiptap emits '' for unset textStyle slots — preserve them.
-    if (value === '' || value == null) {
-      clean[key] = '';
-    } else if (isSafeCssValue(value)) {
-      clean[key] = value;
-    }
-    // else: drop the unsafe value
-  }
-
-  return Object.keys(clean).length ? clean : null;
-};
-
-const sanitizeMark = (mark: Mark): Mark | null => {
-  const type = mark?.type;
-
-  if (!type || !ALLOWED_MARK_TYPES.has(type)) return null;
-
-  const attrs = mark.attrs;
-
-  if (type === 'link') {
-    const href =
-      typeof attrs?.href === 'string'
-        ? validateAndSanitizeHref(attrs.href)
-        : null;
-
-    if (!href) return null; // drop links with unsafe/empty href
-
-    const cleanAttrs: Record<string, unknown> = { href };
-
-    if (attrs?.target != null) cleanAttrs.target = attrs.target;
-
-    if (attrs?.rel != null) cleanAttrs.rel = attrs.rel;
-
-    return { type, attrs: cleanAttrs };
-  }
-
-  if (type === 'textStyle') {
-    const clean = attrs ? sanitizeTextStyleAttrs(attrs) : null;
-
-    return clean ? { type, attrs: clean } : null;
-  }
-
-  if (type === 'highlight') {
-    return isSafeCssValue(attrs?.color)
-      ? { type, attrs: { color: attrs!.color } }
-      : { type };
-  }
-
-  // Plain marks (bold/italic/underline/strike/code) carry no attrs.
-  return { type };
-};
-
-const ALIGN_VALUES = new Set(['left', 'center', 'right', 'justify']);
-
-const sanitizeNode = (node: JSONContent): JSONContent | null => {
-  const type = node?.type;
-
-  if (!type || !ALLOWED_NODE_TYPES.has(type)) return null;
-
-  const clean: JSONContent = { type };
-  const attrs: Record<string, unknown> = {};
-
-  if (type === 'heading') {
-    const level = Number((node.attrs as { level?: unknown })?.level);
-
-    attrs.level = level >= 1 && level <= 6 ? level : 1;
-  }
-
-  if (type === 'heading' || type === 'paragraph') {
-    const align = (node.attrs as { textAlign?: unknown })?.textAlign;
-
-    if (typeof align === 'string' && ALIGN_VALUES.has(align)) {
-      attrs.textAlign = align;
-    }
-  }
-
-  if (Object.keys(attrs).length) clean.attrs = attrs;
-
-  if (typeof node.text === 'string') clean.text = node.text;
-
-  if (Array.isArray(node.marks)) {
-    const marks = node.marks
-      .map((m) => sanitizeMark(m as Mark))
-      .filter(Boolean) as JSONContent['marks'];
-
-    if (marks && marks.length) clean.marks = marks;
-  }
-
-  if (Array.isArray(node.content)) {
-    const content = node.content
-      .map(sanitizeNode)
-      .filter(Boolean) as JSONContent[];
-
-    if (content.length) clean.content = content;
-  }
-
-  return clean;
-};
-
-/**
- * Sanitise a Tiptap JSON document (returns a new clean doc). Returns a minimal
- * empty doc if the input isn't a usable document.
- */
-export const sanitizeRteJson = (doc: unknown): JSONContent => {
-  const clean =
-    doc && typeof doc === 'object' ? sanitizeNode(doc as JSONContent) : null;
-
-  return clean && clean.type === 'doc' ? clean : { type: 'doc', content: [] };
-};

package/src/brand-page-maker/validators/field.validator.test.ts

@@ -1,55 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { validatorDict } from './field.validator';
-
-/**
- * BP-5857 — the `title` validator must preserve pre-JSON (staging) semantics.
- * An RTE field's value used to be inline HTML: an empty editor was "<p></p>",
- * a non-empty string, so the required check always PASSED for RTE fields — it
- * only failed for genuinely empty PLAIN inputs. RTE fields are now Tiptap JSON
- * docs, so any doc must likewise count as "present" (valid); a plain string is
- * still required to be non-empty.
- */
-describe('field.validator — title (nonEmptyString)', () => {
-  const titleValidator = validatorDict.title;
-
-  const jsonDoc = (text: string) => ({
-    type: 'doc',
-    content: [
-      {
-        type: 'paragraph',
-        content: text
-          ? [{ type: 'text', text, marks: [{ type: 'bold' }] }]
-          : [],
-      },
-    ],
-  });
-
-  it('accepts a non-empty plain string', () => {
-    expect(titleValidator.validate('title', 'Payments').isValid).toBe(true);
-  });
-
-  it('rejects an empty plain string (required still enforced for plain inputs)', () => {
-    expect(titleValidator.validate('title', '').isValid).toBe(false);
-  });
-
-  it('accepts legacy empty RTE HTML "<p></p>" (non-empty string — staging parity)', () => {
-    expect(titleValidator.validate('title', '<p></p>').isValid).toBe(true);
-  });
-
-  it('accepts a Tiptap JSON doc with visible text', () => {
-    expect(titleValidator.validate('title', jsonDoc('Payments')).isValid).toBe(
-      true,
-    );
-  });
-
-  it('accepts an empty Tiptap JSON doc (RTE parity — empty editor is "present")', () => {
-    expect(titleValidator.validate('title', jsonDoc('')).isValid).toBe(true);
-  });
-
-  it('rejects null/undefined without throwing', () => {
-    expect(titleValidator.validate('title', null as any).isValid).toBe(false);
-    expect(titleValidator.validate('title', undefined as any).isValid).toBe(
-      false,
-    );
-  });
-});