@dustfeather/deckrun 2.0.0

package/dist/safe-fetch.js

@@ -0,0 +1,173 @@
+import { lookup as dnsLookup } from "dns";
+import { isIP } from "net";
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+/**
+ * An address the server refuses to open a connection to.
+ *
+ * `/__fetch-doc` fetches a URL the caller supplies and hands the body back, so
+ * without this it is an open proxy into everything the machine can reach that
+ * the caller cannot: other loopback services, the cloud instance metadata
+ * endpoint on 169.254.169.254, and anything on the local network.
+ */
+function blockedReason(address, family) {
+    if (family === 6) {
+        const ip = address.toLowerCase().split("%")[0];
+        // An IPv4-mapped address is an IPv4 address wearing a different hat.
+        const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(ip);
+        if (mapped)
+            return blockedReason(mapped[1], 4);
+        if (ip === "::1")
+            return "loopback";
+        if (ip === "::")
+            return "unspecified";
+        const head = parseInt(ip.split(":")[0] || "0", 16);
+        if ((head & 0xfe00) === 0xfc00)
+            return "unique-local";
+        if ((head & 0xffc0) === 0xfe80)
+            return "link-local";
+        if ((head & 0xff00) === 0xff00)
+            return "multicast";
+        return null;
+    }
+    const octets = address.split(".").map(Number);
+    if (octets.length !== 4 || octets.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) {
+        return "unparseable";
+    }
+    const [a, b] = octets;
+    if (a === 0)
+        return "unspecified";
+    if (a === 10)
+        return "private";
+    if (a === 127)
+        return "loopback";
+    if (a === 169 && b === 254)
+        return "link-local";
+    if (a === 172 && b >= 16 && b <= 31)
+        return "private";
+    if (a === 192 && b === 168)
+        return "private";
+    if (a === 100 && b >= 64 && b <= 127)
+        return "carrier-grade NAT";
+    if (a === 198 && (b === 18 || b === 19))
+        return "benchmarking";
+    if (a >= 224)
+        return "multicast or reserved";
+    return null;
+}
+export class BlockedAddressError extends Error {
+}
+/**
+ * A dns.lookup replacement that fails the connection when the name resolves
+ * somewhere private.
+ *
+ * The check has to sit here rather than in front of the request: resolving the
+ * name separately and then calling fetch() leaves a window in which the record
+ * can change between the two, and the connection is then made to an address
+ * that was never checked. This runs at connect time, on the addresses the
+ * socket is actually about to use.
+ */
+function guardedLookup(hostname, options, callback) {
+    dnsLookup(hostname, { ...options, all: true }, (err, addresses) => {
+        if (err)
+            return callback(err, undefined);
+        if (!addresses || addresses.length === 0) {
+            return callback(new BlockedAddressError(`'${hostname}' did not resolve`), undefined);
+        }
+        for (const entry of addresses) {
+            const reason = blockedReason(entry.address, entry.family);
+            if (reason) {
+                return callback(new BlockedAddressError(`'${hostname}' resolves to a ${reason} address (${entry.address})`), undefined);
+            }
+        }
+        const wantsAll = options?.all === true;
+        if (wantsAll)
+            return callback(null, addresses);
+        return callback(null, addresses[0].address, addresses[0].family);
+    });
+}
+/**
+ * Fetches a public http(s) document.
+ *
+ * Redirects are followed by hand rather than by the client, so every hop is
+ * checked instead of only the URL the caller passed — a public URL that 302s
+ * to 169.254.169.254 is the ordinary way past a check that only looks at the
+ * first request.
+ */
+export async function safeFetch(raw, options) {
+    const maxRedirects = options.maxRedirects ?? 5;
+    let target = new URL(raw);
+    for (let hop = 0;; hop++) {
+        if (target.protocol !== "http:" && target.protocol !== "https:") {
+            throw new BlockedAddressError("url must be http or https");
+        }
+        const response = await requestOnce(target, options);
+        const location = response.headers.location;
+        const isRedirect = typeof response.statusCode === "number" &&
+            response.statusCode >= 300 &&
+            response.statusCode < 400 &&
+            typeof location === "string";
+        if (!isRedirect) {
+            const { body, truncated } = await readCapped(response, options.maxBytes);
+            return {
+                status: response.statusCode ?? 0,
+                headers: response.headers,
+                body,
+                url: target,
+                truncated,
+            };
+        }
+        response.resume();
+        if (hop >= maxRedirects)
+            throw new BlockedAddressError("too many redirects");
+        target = new URL(location, target);
+    }
+}
+function requestOnce(target, options) {
+    // A hostname that is already an IP literal never reaches the lookup hook —
+    // Node connects straight to it — so it is checked here instead.
+    const literal = target.hostname.replace(/^\[|\]$/g, "");
+    const family = isIP(literal);
+    if (family) {
+        const reason = blockedReason(literal, family);
+        if (reason) {
+            throw new BlockedAddressError(`${literal} is a ${reason} address`);
+        }
+    }
+    const secure = target.protocol === "https:";
+    const send = secure ? httpsRequest : httpRequest;
+    const requestOptions = {
+        protocol: target.protocol,
+        hostname: target.hostname,
+        port: target.port || (secure ? 443 : 80),
+        path: `${target.pathname}${target.search}`,
+        method: "GET",
+        headers: { "User-Agent": options.userAgent ?? "deckrun", Accept: "*/*" },
+        lookup: guardedLookup,
+    };
+    return new Promise((resolve, reject) => {
+        const req = send(requestOptions, resolve);
+        req.setTimeout(options.timeoutMs ?? 15_000, () => {
+            req.destroy(new Error("timed out"));
+        });
+        req.once("error", reject);
+        req.end();
+    });
+}
+function readCapped(response, maxBytes) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        response.on("data", (chunk) => {
+            size += chunk.length;
+            if (size > maxBytes) {
+                response.destroy();
+                resolve({ body: Buffer.concat(chunks).toString("utf-8"), truncated: true });
+                return;
+            }
+            chunks.push(chunk);
+        });
+        response.once("end", () => resolve({ body: Buffer.concat(chunks).toString("utf-8"), truncated: false }));
+        response.once("error", reject);
+    });
+}

package/dist/sanitize.js

@@ -0,0 +1,102 @@
+import sanitizeHtml from "sanitize-html";
+/**
+ * Strips executable markup out of rendered slide HTML.
+ *
+ * marked dropped its `sanitize` option in v8 and nothing replaced it, so raw
+ * HTML in a deck reached the rendered slide verbatim: a `<script>` tag, an
+ * `onerror=` handler and a `javascript:` href all survived. Opening a `.md`
+ * file someone else wrote ran their JavaScript — in the editor preview, in the
+ * presented deck, and in the standalone HTML export handed to an audience.
+ *
+ * Benign HTML is kept rather than escaped, because decks legitimately use it
+ * for layout. What goes is the part that executes: script and event handlers,
+ * plugin and frame embeds, and any URL scheme that is not a plain link or an
+ * inline image.
+ */
+const ALLOWED_TAGS = [
+    // Text and structure marked emits, plus the layout tags decks tend to use.
+    "h1", "h2", "h3", "h4", "h5", "h6",
+    "p", "div", "span", "section", "article", "header", "footer", "aside", "main",
+    "blockquote", "pre", "code", "kbd", "samp", "var",
+    "ul", "ol", "li", "dl", "dt", "dd",
+    "table", "thead", "tbody", "tfoot", "tr", "th", "td", "caption", "colgroup", "col",
+    "a", "img", "figure", "figcaption", "picture", "source",
+    "b", "i", "em", "strong", "small", "s", "strike", "del", "ins", "mark", "sub", "sup", "u",
+    "br", "hr", "wbr", "abbr", "cite", "q", "time", "details", "summary",
+    // Inline SVG, so diagrams and icons pasted into a deck still render.
+    "svg", "g", "path", "circle", "ellipse", "rect", "line", "polyline", "polygon",
+    "text", "tspan", "defs", "marker", "linearGradient", "radialGradient", "stop",
+    "clipPath", "mask", "pattern", "symbol", "use", "title", "desc",
+];
+// `data-*` matters to deckrun itself: the math nodes carry `data-display` and
+// the slide wrapper carries `data-index`. `aria-*` is markup, not capability.
+const COMMON_ATTRS = [
+    "class", "id", "title", "style", "role", "lang", "dir", "hidden",
+    "data-*", "aria-*",
+];
+/** Geometry and paint attributes, so inline SVG survives intact. */
+const SVG_ATTRS = [
+    "d", "cx", "cy", "r", "rx", "ry", "x", "y", "x1", "y1", "x2", "y2",
+    "width", "height", "points", "transform", "fill", "fill-opacity", "fill-rule",
+    "stroke", "stroke-width", "stroke-linecap", "stroke-linejoin", "stroke-dasharray",
+    "stroke-dashoffset", "stroke-opacity", "opacity", "offset", "stop-color",
+    "stop-opacity", "gradientUnits", "gradientTransform", "patternUnits",
+    "markerWidth", "markerHeight", "refX", "refY", "orient", "clip-path",
+    "text-anchor", "dominant-baseline", "font-size", "font-family", "font-weight",
+    "dx", "dy", "viewBox", "preserveAspectRatio", "xmlns", "xmlns:xlink",
+    // The parser lowercases attribute names, so the camelCase SVG attributes
+    // have to be listed in both forms or they are dropped from real diagrams.
+    "viewbox", "preserveaspectratio", "gradientunits", "gradienttransform",
+    "patternunits", "markerwidth", "markerheight", "refx", "refy",
+];
+export function sanitizeSlideHtml(html) {
+    return sanitizeHtml(html, {
+        allowedTags: ALLOWED_TAGS,
+        allowedAttributes: {
+            "*": COMMON_ATTRS,
+            a: [...COMMON_ATTRS, "href", "target", "rel", "name"],
+            img: [...COMMON_ATTRS, "src", "alt", "width", "height", "loading", "decoding", "srcset", "sizes"],
+            source: [...COMMON_ATTRS, "src", "srcset", "sizes", "type", "media"],
+            td: [...COMMON_ATTRS, "colspan", "rowspan", "align", "valign"],
+            th: [...COMMON_ATTRS, "colspan", "rowspan", "align", "valign", "scope"],
+            col: [...COMMON_ATTRS, "span", "width"],
+            colgroup: [...COMMON_ATTRS, "span"],
+            ol: [...COMMON_ATTRS, "start", "reversed", "type"],
+            li: [...COMMON_ATTRS, "value"],
+            details: [...COMMON_ATTRS, "open"],
+            time: [...COMMON_ATTRS, "datetime"],
+            svg: [...COMMON_ATTRS, ...SVG_ATTRS],
+            g: [...COMMON_ATTRS, ...SVG_ATTRS],
+            path: [...COMMON_ATTRS, ...SVG_ATTRS],
+            circle: [...COMMON_ATTRS, ...SVG_ATTRS],
+            ellipse: [...COMMON_ATTRS, ...SVG_ATTRS],
+            rect: [...COMMON_ATTRS, ...SVG_ATTRS],
+            line: [...COMMON_ATTRS, ...SVG_ATTRS],
+            polyline: [...COMMON_ATTRS, ...SVG_ATTRS],
+            polygon: [...COMMON_ATTRS, ...SVG_ATTRS],
+            text: [...COMMON_ATTRS, ...SVG_ATTRS],
+            tspan: [...COMMON_ATTRS, ...SVG_ATTRS],
+            marker: [...COMMON_ATTRS, ...SVG_ATTRS],
+            linearGradient: [...COMMON_ATTRS, ...SVG_ATTRS],
+            radialGradient: [...COMMON_ATTRS, ...SVG_ATTRS],
+            stop: [...COMMON_ATTRS, ...SVG_ATTRS],
+            clipPath: [...COMMON_ATTRS, ...SVG_ATTRS],
+            mask: [...COMMON_ATTRS, ...SVG_ATTRS],
+            pattern: [...COMMON_ATTRS, ...SVG_ATTRS],
+            symbol: [...COMMON_ATTRS, ...SVG_ATTRS],
+            use: [...COMMON_ATTRS, ...SVG_ATTRS, "href"],
+        },
+        allowedSchemes: ["http", "https", "mailto", "tel"],
+        allowedSchemesByTag: { img: ["http", "https", "data"] },
+        allowedSchemesAppliedToAttributes: ["href", "src", "cite", "srcset"],
+        allowProtocolRelative: true,
+        // Class names are a styling hook, not a capability; keep them all.
+        allowedClasses: false,
+        // Anything not in the tag list is unwrapped rather than deleted, so the
+        // text inside an unknown wrapper is not silently lost — except for the
+        // elements whose *content* is the payload.
+        nonTextTags: ["script", "style", "textarea", "option", "noscript", "template", "iframe", "object", "embed"],
+        parseStyleAttributes: false,
+        allowVulnerableTags: false,
+    });
+}