@ecency/render-helper 2.2.39 → 2.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ecency/render-helper",
-  "version": "2.2.39",
+  "version": "2.3.0",
   "description": "Markdown+Html Render helper",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",

package/src/methods/a.method.ts

@@ -32,6 +32,11 @@ import { proxifyImageSrc } from '../proxify-image-src'
 import { removeChildNodes } from './remove-child-nodes.method'
 import { extractYtStartTime } from '../helper'
 
+function isValidPermlink(permlink: string): boolean {
+  // Reject anything that looks like a file (ends with .jpg/.png/.webp/.jpeg etc)
+  return !/\.(jpg|jpeg|png|webp|gif|svg)$/i.test(permlink);
+}
+
 export function a(el: HTMLElement, forApp: boolean, webp: boolean): void {
   let href = el.getAttribute('href')
 
@@ -101,6 +106,9 @@ export function a(el: HTMLElement, forApp: boolean, webp: boolean): void {
     const tag = postMatch[2]
     const author = postMatch[3].replace('@', '')
     const permlink = postMatch[4]
+
+    if (!isValidPermlink(permlink)) return;
+
     let isInline = true;
     if (el.textContent === href) {
       el.textContent = `@${author}/${permlink}`
@@ -133,7 +141,7 @@ export function a(el: HTMLElement, forApp: boolean, webp: boolean): void {
       }
       if (forApp) {
         el.removeAttribute('href')
-  
+
         el.setAttribute('data-author', author)
       } else {
         const h = `/@${author}`
@@ -180,6 +188,9 @@ export function a(el: HTMLElement, forApp: boolean, webp: boolean): void {
       el.setAttribute('class', 'markdown-post-link')
       const author = tpostMatch[2].replace('@', '')
       const permlink = tpostMatch[3]
+
+      if (!isValidPermlink(permlink)) return;
+
       let isInline = true;
       if (el.textContent === href) {
         el.textContent = `@${author}/${permlink}`
@@ -252,7 +263,11 @@ export function a(el: HTMLElement, forApp: boolean, webp: boolean): void {
 
       const author = cpostMatch[1].replace('@', '')
       const permlink = cpostMatch[2]
+
+      if (!isValidPermlink(permlink)) return;
+
       let isInline = true;
+
       if (el.textContent === href) {
         el.textContent = `@${author}/${permlink}`
         isInline = false;
@@ -353,7 +368,11 @@ export function a(el: HTMLElement, forApp: boolean, webp: boolean): void {
     const tag = 'ccc'
     const author = cccMatch[2].replace('@', '')
     const permlink = cccMatch[3]
+
+    if (!isValidPermlink(permlink)) return;
+
     let isInline = true;
+
     if (el.textContent === href) {
       el.textContent = `@${author}/${permlink}`
       isInline = false;
@@ -441,7 +460,7 @@ export function a(el: HTMLElement, forApp: boolean, webp: boolean): void {
       const embedSrc = `https://www.youtube.com/embed/${vid}?autoplay=1`
 
       el.textContent = ''
-     
+
       el.setAttribute('data-embed-src', embedSrc);
       el.setAttribute('data-youtube', vid);
 
@@ -521,7 +540,7 @@ export function a(el: HTMLElement, forApp: boolean, webp: boolean): void {
   if (match && el.textContent.trim() === href) {
     const e = SPOTIFY_REGEX.exec(href)
     if (e[1]) {
-      
+
       el.setAttribute('class', 'markdown-audio-link markdown-audio-link-spotify')
       el.removeAttribute('href')
 
@@ -536,7 +555,7 @@ export function a(el: HTMLElement, forApp: boolean, webp: boolean): void {
       ifr.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-popups')
       el.appendChild(ifr)
 
-      return      
+      return
     }
   }
 
@@ -545,7 +564,7 @@ export function a(el: HTMLElement, forApp: boolean, webp: boolean): void {
   if (match && el.textContent.trim() === href) {
     const e = LOOM_REGEX.exec(href)
     if (e[2]) {
-      
+
       el.setAttribute('class', 'markdown-video-link markdown-video-link-loom')
       el.removeAttribute('href')
 
@@ -560,7 +579,7 @@ export function a(el: HTMLElement, forApp: boolean, webp: boolean): void {
       ifr.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-popups')
       el.appendChild(ifr)
 
-      return      
+      return
     }
   }
 
@@ -577,21 +596,21 @@ export function a(el: HTMLElement, forApp: boolean, webp: boolean): void {
       if (e[2] && e[3]) {
         el.setAttribute('class', 'markdown-video-link markdown-video-link-dtube')
         el.removeAttribute('href')
-   
+
 
         const videoHref = `https://emb.d.tube/#!/${e[2]}/${e[3]}`
 
         // el.setAttribute('data-video-href', videoHref)
         el.setAttribute('data-embed-src', videoHref)
 
-        //process thumb img element 
+        //process thumb img element
         if (imgEls.length === 1) {
-          const thumbnail = proxifyImageSrc(imgEls[0].getAttribute('src').replace(/\s+/g, ''), 0, 0, webp ? 'webp' : 'match') 
+          const thumbnail = proxifyImageSrc(imgEls[0].getAttribute('src').replace(/\s+/g, ''), 0, 0, webp ? 'webp' : 'match')
           const thumbImg = el.ownerDocument.createElement('img')
 
           thumbImg.setAttribute('class', 'no-replace video-thumbnail')
           thumbImg.setAttribute('itemprop', 'thumbnailUrl')
-            
+
           thumbImg.setAttribute('src', thumbnail)
           el.appendChild(thumbImg)
 
@@ -604,7 +623,7 @@ export function a(el: HTMLElement, forApp: boolean, webp: boolean): void {
         const play = el.ownerDocument.createElement('span')
         play.setAttribute('class', 'markdown-video-play')
 
-  
+
         el.appendChild(play)
 
         return
@@ -628,7 +647,7 @@ export function a(el: HTMLElement, forApp: boolean, webp: boolean): void {
       play.setAttribute('class', 'markdown-video-play')
 
       el.appendChild(play)
- 
+
 
       return
     }

package/src/methods/img.method.ts

@@ -1,16 +1,43 @@
-import { proxifyImageSrc } from '../proxify-image-src'
+import { proxifyImageSrc } from "../proxify-image-src";
 
 export function img(el: HTMLElement, webp: boolean): void {
-  el.removeAttribute('width')
-  el.removeAttribute('height')
+  el.removeAttribute("width");
+  el.removeAttribute("height");
 
-  let src = el.getAttribute('src')
-  if (src.startsWith('javascript')) {
-    src = ''
+  const src = el.getAttribute("src") || "";
+
+  // Normalize encoded characters
+  const decodedSrc = decodeURIComponent(
+    src.replace(/&#(\d+);/g, (_, dec) => String.fromCharCode(dec))
+      .replace(/&#x([0-9a-f]+);/gi, (_, hex) => String.fromCharCode(parseInt(hex, 16)))
+  ).trim().toLowerCase();
+
+  // ❌ Remove if javascript or empty/invalid
+  const isInvalid = !src || decodedSrc.startsWith("javascript") || decodedSrc.startsWith("vbscript") || decodedSrc === "x";
+  if (isInvalid) {
+    el.remove();
+    return;
+  }
+
+  // ❌ Skip relative paths (e.g., `photo.jpg`)
+  const isRelative = !/^https?:\/\//i.test(src) && !src.startsWith("/");
+  if (isRelative) {
+    console.warn("Skipped relative image:", src);
+    el.remove();
+    return;
   }
-  el.setAttribute('itemprop', 'image')
 
-  if (el.getAttribute('class').indexOf('no-replace') === -1) {
-    el.setAttribute('src', proxifyImageSrc(src, 0, 0, webp ? 'webp' : 'match'))
+  // Sanitize any dynamic or low-res src-like attributes
+  ["onerror", "dynsrc", "lowsrc"].forEach(attr => el.removeAttribute(attr));
+
+  el.setAttribute("itemprop", "image");
+
+  const cls = el.getAttribute("class") || "";
+  const shouldReplace = !cls.includes("no-replace");
+  const hasAlreadyProxied = src.startsWith("https://images.ecency.com");
+
+  if (shouldReplace && !hasAlreadyProxied) {
+    const proxified = proxifyImageSrc(src, 0, 0, webp ? "webp" : "match");
+    el.setAttribute("src", proxified);
   }
 }

package/src/methods/sanitize-html.method.ts

@@ -1,19 +1,26 @@
 import xss from 'xss'
 import { ALLOWED_ATTRIBUTES } from '../consts'
 
+const decodeEntities = (input: string): string =>
+  input
+    .replace(/&#(\d+);?/g, (_, dec) => String.fromCharCode(dec))
+    .replace(/&#x([0-9a-f]+);?/gi, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
+
 export function sanitizeHtml(html: string): string {
   return xss(html, {
     whiteList: ALLOWED_ATTRIBUTES,
-    stripIgnoreTag: true, // filter out all HTML not in the whitelist
-    css: true,
+    stripIgnoreTag: true,
     stripIgnoreTagBody: ['style'],
+    css: false, // block style attrs entirely for safety
     onTagAttr: (tag, name, value) => {
-      if (tag === 'span' && name === 'class' && value === 'wr') {
-        return ''
-      }
-      if (tag === 'img' && name === 'src' && !/^https?:\/\//.test(value)) {
-        return ''
-      }
+      const decoded = decodeEntities(value.trim().toLowerCase());
+
+      if (name.startsWith('on')) return ''; // 🛡 event handlers
+      if (tag === 'img' && name === 'src' && (!/^https?:\/\//.test(decoded) || decoded.startsWith('javascript:'))) return '';
+      if (tag === 'img' && ['dynsrc', 'lowsrc'].includes(name)) return '';
+      if (tag === 'span' && name === 'class' && value === 'wr') return '';
+
+      return undefined;
     }
-  })
+  });
 }

package/src/test/data/legacy/10.json

@@ -1,5 +1,5 @@
 {
   "id": 10,
   "input": "Lorem ipsum dolor <img src=x onerror=alert(x)> sit amet.\n\n<a href=\"javascript:void(0)\">etiam ut sollicitudin neque</a>\n\n<a onclick=\"console.log('ss')\">Vivamus pulvinar semper porttitor</a>",
-  "result": "<p dir=\"auto\">Lorem ipsum dolor <img /> sit amet.</p>\n<p dir=\"auto\"><a>etiam ut sollicitudin neque</a></p>\n<p dir=\"auto\"><a>Vivamus pulvinar semper porttitor</a></p>"
+  "result": ""
 }

package/src/test/data/legacy/21.json

@@ -1,5 +1,5 @@
 {
   "id": 21,
   "input": "javascript:/*--></title></style></textarea></script></xmp><svg/onload='+/\"/+/onmouseover=1/+/[*/[]/+alert(1)//'>\n\n<IMG SRC=\"javascript:alert('XSS');\"><img src=\"javascript:alert('XSS');\">\n\n<IMG SRC=javascript:alert('XSS')> <img src=javascript:alert('XSS')>",
-  "result": "<p dir=\"auto\">javascript:/<em>--&gt;&lt;svg/onload='+/\"/+/onmouseover=1/+/[</em>/[]/+alert(1)//'&gt;</p>\n<p dir=\"auto\"><img /><img /></p>\n<p dir=\"auto\">&lt;IMG SRC=javascript:alert('XSS')&gt; &lt;img src=javascript:alert('XSS')&gt;</p>"
+  "result": ""
 }

package/src/test/data/legacy/22.json

@@ -1,5 +1,5 @@
 {
   "id": 22,
   "input": "<IMG SRC=JaVaScRiPt:alert('XSS')> <IMG SRC=javascript:alert(&quot;XSS&quot;)>\n<IMG SRC=`javascript:alert(\"RSnake says, 'XSS'\")`>\n<a onmouseover=\"alert(document.cookie)\">xxs link</a><a onmouseover=alert(document.cookie)>xxs link</a>\n<IMG \"\"\"><SCRIPT>alert(\"XSS\")</SCRIPT>\"><IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>\n <IMG SRC= onmouseover=\"alert('xxs')\">",
-  "result": "<p dir=\"auto\">&lt;IMG SRC=JaVaScRiPt:alert('XSS')&gt; &lt;IMG SRC=javascript:alert(&quot;XSS&quot;)&gt;<br />\n&lt;IMG SRC=<code>javascript:alert(\"RSnake says, 'XSS'\")</code>&gt;<br />\n<a>xxs link</a><a>xxs link</a><br />\n&lt;IMG \"\"\"&gt;alert(&quot;XSS&quot;)\"&gt;<img /><br />\n&lt;IMG SRC= onmouseover=\"alert('xxs')\"&gt;</p>"
+  "result": ""
 }

package/src/test/data/legacy/23.json

@@ -1,5 +1,5 @@
 {
   "id": 23,
   "input": "<IMG SRC=/ onerror=\"alert(String.fromCharCode(88,83,83))\"></img> <img src=x onerror=\"&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041\"> <IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;> <IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29> <IMG SRC=\" &#14;  javascript:alert('XSS');\">",
-  "result": "<p dir=\"auto\">&lt;IMG SRC=/ onerror=\"alert(String.fromCharCode(88,83,83))\"&gt; <img /> &lt;IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;&gt; <img /> <img /></p>"
+  "result": ""
 }

package/src/test/data/legacy/26.json

@@ -1,5 +1,5 @@
 {
   "id": 26,
   "input": "<IMG DYNSRC=\"javascript:alert('XSS')\"> <IMG LOWSRC=\"javascript:alert('XSS')\"> <STYLE>li {list-style-image: url(\"javascript:alert('XSS')\");}</STYLE>",
-  "result": "<p dir=\"auto\"><img /> <img /> </p>"
+  "result": ""
 }