@docubook/flame 1.3.3 → 1.3.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -52,11 +52,7 @@ export class BuildPluginBuilder implements PluginBuilder {
52
52
  try {
53
53
  const result = cb(context);
54
54
  if (result) {
55
- if (Array.isArray(result)) {
56
- items.push(...result);
57
- } else {
58
- items.push(result);
59
- }
55
+ this.collectItems(items, result, "injectBody");
60
56
  }
61
57
  } catch (err) {
62
58
  throw new Error(
@@ -83,11 +79,7 @@ export class BuildPluginBuilder implements PluginBuilder {
83
79
  try {
84
80
  const result = cb(context);
85
81
  if (result) {
86
- if (Array.isArray(result)) {
87
- items.push(...result);
88
- } else {
89
- items.push(result);
90
- }
82
+ this.collectItems(items, result, "injectHead");
91
83
  }
92
84
  } catch (err) {
93
85
  throw new Error(
@@ -462,4 +454,28 @@ export class BuildPluginBuilder implements PluginBuilder {
462
454
  transformHtml(callback: (html: string, context: PageContext) => Awaitable<string>): void {
463
455
  this._transformHtml.push(callback);
464
456
  }
457
+
458
+ /**
459
+ * Collect items from a callback result, filtering only valid strings.
460
+ * Non-string items and unexpected types are logged as warnings.
461
+ */
462
+ private collectItems(items: string[], result: string | string[], hookName: string): void {
463
+ if (Array.isArray(result)) {
464
+ for (const item of result) {
465
+ if (typeof item === "string") {
466
+ items.push(item);
467
+ } else {
468
+ console.warn(
469
+ `[plugin] ${hookName} callback returned non-string item (got ${typeof item}), skipping`
470
+ );
471
+ }
472
+ }
473
+ } else if (typeof result === "string") {
474
+ items.push(result);
475
+ } else {
476
+ console.warn(
477
+ `[plugin] ${hookName} callback returned unexpected type (got ${typeof result}), expected string or string[], skipping`
478
+ );
479
+ }
480
+ }
465
481
  }
@@ -167,6 +167,9 @@ export interface PluginBuilder {
167
167
  * Register a callback that returns HTML strings to inject inside `<head>`.
168
168
  * Results from all plugins are merged and deduplicated.
169
169
  *
170
+ * ⚠️ Sanitize any user-controlled or external data before injecting.
171
+ * Plugin-provided strings are injected raw into the final HTML.
172
+ *
170
173
  * Use for: analytics snippets, meta tags, stylesheet links.
171
174
  *
172
175
  * @param callback - Returns a single HTML string or an array. Called once per page.
@@ -182,6 +185,9 @@ export interface PluginBuilder {
182
185
  * Register a callback that returns HTML strings to inject before `</body>`.
183
186
  * Results from all plugins are merged and deduplicated.
184
187
  *
188
+ * ⚠️ Sanitize any user-controlled or external data before injecting.
189
+ * Plugin-provided strings are injected raw into the final HTML.
190
+ *
185
191
  * Use for: chat widgets, live-script loaders, deferred scripts.
186
192
  *
187
193
  * @param callback - Returns a single HTML string or an array. Called once per page.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@docubook/flame",
3
- "version": "1.3.3",
3
+ "version": "1.3.4",
4
4
  "description": "A blazing-fast React + MDX framework powered by Bun, built for modern documentation experiences.",
5
5
  "type": "module",
6
6
  "bin": {
@@ -53,9 +53,9 @@
53
53
  "react-dom": "^19.2.7",
54
54
  "unified": "^11.0.0",
55
55
  "@docubook/core": "^1.7.2",
56
- "@docubook/mdx-content": "^3.2.2",
57
56
  "@docubook/themes-colors": "^0.10.2",
58
- "@docubook/ui-react": "^0.1.4"
57
+ "@docubook/ui-react": "^0.1.4",
58
+ "@docubook/mdx-content": "^3.2.2"
59
59
  },
60
60
  "peerDependencies": {
61
61
  "@sentry/bun": "^10.0.0"