@dogsbay/format-starlight 0.2.0-beta.132 → 0.2.0-beta.133

package/dist/adapters/cloudflare.js

@@ -15,6 +15,18 @@ import { FIXED_SLUG, githubSlug } from "../github-slug.js";
 import { outsideFences, outsideInlineCode } from "../fences.js";
 import { findSelfClosingTags, parseJsLiteral } from "../js-literal.js";
 import { componentPropDefaults, jsValueToJinja, renderComponentTemplate, splitTopLevel } from "../jsx-to-jinja.js";
+/**
+ * gray-matter EVALUATES front matter that opens with `---js` / `---javascript` (its javascript
+ * engine is `eval`), so a page in someone else's repo could run code on this machine. Every
+ * call passes this, which refuses that engine; YAML and JSON are unchanged.
+ */
+const NO_JS_FRONT_MATTER = {
+    engines: {
+        javascript: () => {
+            throw new Error("JavaScript front matter is not run");
+        },
+    },
+};
 // ── Indentation helper ─────────────────────────────────
 /**
  * Indent all lines of content to match the indentation of the original tag.
@@ -856,7 +868,7 @@ export function resolvePlanBadges(source, partialsDir) {
  */
 function readYaml(file) {
     const yaml = readFileSync(file, "utf8").replace(/^\uFEFF?---[ \t]*\r?\n/, "");
-    return matter(`---\n${yaml}\n---\n`).data;
+    return matter(`---\n${yaml}\n---\n`, NO_JS_FRONT_MATTER).data;
 }
 const yamlCache = new Map();
 function cachedYaml(file) {
@@ -1239,7 +1251,7 @@ export function resolveLocalDataComponents(source, partialsDir) {
                 const file = within(content, join(dir, f));
                 if (!file)
                     throw new Error("outside");
-                const parsed = matter(readFileSync(file, "utf8"));
+                const parsed = matter(readFileSync(file, "utf8"), NO_JS_FRONT_MATTER);
                 // The body's own imports go (the page's are stripped the same way).
                 const body = outsideFences(parsed.content, (t) => t.replace(/^import\s[^\n]*from\s*["'][^"']+["'];?[ \t]*$/gm, ""));
                 return { data: parsed.data, body: body.trim() };
@@ -1650,7 +1662,7 @@ function loadChangelog(dir) {
             }
             for (const file of files.sort()) {
                 try {
-                    const parsed = matter(readFileSync(join(sub, file), "utf8"));
+                    const parsed = matter(readFileSync(join(sub, file), "utf8"), NO_JS_FRONT_MATTER);
                     const fm = parsed.data;
                     const d = fm.date instanceof Date ? fm.date : new Date(String(fm.date ?? ""));
                     if (Number.isNaN(d.getTime()))

package/dist/parse.js

@@ -12,6 +12,18 @@
 import { assignHeadingSlugs } from "./github-slug.js";
 import MarkdownIt from "markdown-it";
 import matter from "gray-matter";
+/**
+ * gray-matter EVALUATES front matter that opens with `---js` / `---javascript` (its javascript
+ * engine is `eval`), so a page in someone else's repo could run code on this machine. Every
+ * call passes this, which refuses that engine; YAML and JSON are unchanged.
+ */
+const NO_JS_FRONT_MATTER = {
+    engines: {
+        javascript: () => {
+            throw new Error("JavaScript front matter is not run");
+        },
+    },
+};
 const md = new MarkdownIt({ html: true, linkify: true });
 export function extractFrontmatter(source) {
     const lines = source.split("\n");
@@ -27,7 +39,7 @@ export function extractFrontmatter(source) {
     // Parse YAML via gray-matter for a full record that preserves custom fields.
     let raw = {};
     try {
-        const result = matter(source);
+        const result = matter(source, NO_JS_FRONT_MATTER);
         raw = result.data ?? {};
     }
     catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dogsbay/format-starlight",
-  "version": "0.2.0-beta.132",
+  "version": "0.2.0-beta.133",
   "description": "Starlight MDX importer for Dogsbay — converts Starlight sources (with JSX components, Render partials, and adapter-specific extensions) into TreeNode[]",
   "type": "module",
   "exports": {
@@ -17,9 +17,9 @@
     "jsonc-parser": "^3.3.1",
     "markdown-it": "^14.3.0",
     "markdown-it-footnote": "^4.0.0",
-    "@dogsbay/markdown-it-mdx-jsx": "0.2.0-beta.132",
-    "@dogsbay/types": "0.2.0-beta.132",
-    "@dogsbay/format-dogsbay-md": "0.2.0-beta.132"
+    "@dogsbay/format-dogsbay-md": "0.2.0-beta.133",
+    "@dogsbay/types": "0.2.0-beta.133",
+    "@dogsbay/markdown-it-mdx-jsx": "0.2.0-beta.133"
   },
   "devDependencies": {
     "@types/iarna__toml": "^2.0.5",