@ecency/render-helper 2.3.1 → 2.3.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ecency/render-helper",
-  "version": "2.3.1",
+  "version": "2.3.3",
   "description": "Markdown+Html Render helper",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",

package/src/helper.ts

@@ -22,8 +22,18 @@ export function extractYtStartTime(url:string):string {
       return '' + parseInt(params.get('t')); //parsing is important as sometimes t is famated '123s';
     }else if (params.has('start')){
       return params.get('start');
-    } 
+    }
   } catch (error) {
     return '';
   }
 }
+export function isValidPermlink(permlink: string): boolean {
+  // Should not contain image extensions, query params, or fragments
+  const isImage = /\.(jpg|jpeg|png|webp|gif|svg)$/i.test(permlink);
+  const hasSpecialChars = /[?#]/.test(permlink);
+  const isCleanFormat = /^[a-z0-9-]+$/.test(permlink); // Hive standard
+
+  return isCleanFormat && !isImage && !hasSpecialChars;
+}
+
+

package/src/markdown-2-html.spec.ts

@@ -910,7 +910,7 @@ describe('Markdown2Html', () => {
         last_update: '2019-05-10T09:15:21',
         body: 'direct link https://ecency.com/@ecency/faq?history'
       }
-      const expected = '<p dir=\"auto\">direct link <a class=\"markdown-post-link\" data-href=\"https://ecency.com/@ecency/faq?history\" data-is-inline=\"false\" data-tag=\"post\" data-author=\"ecency\" data-permlink=\"faq?history\">@ecency/faq?history</a></p>'
+      const expected = '<p dir=\"auto\">direct link <a href=\"https://ecency.com/@ecency/faq?history\" class=\"markdown-post-link\">https://ecency.com/@ecency/faq?history</a></p>'
 
       expect(markdown2Html(input)).toBe(expected)
     })
@@ -922,7 +922,7 @@ describe('Markdown2Html', () => {
         last_update: '2019-05-10T09:15:21',
         body: 'direct link https://ecency.com/@ecency/posts?q=games'
       }
-      const expected = '<p dir=\"auto\">direct link <a href=\"https://ecency.com/@ecency/posts?q=games\" class=\"markdown-profile-link\">@ecency/posts?q=games</a></p>'
+      const expected = '<p dir=\"auto\">direct link <a href=\"https://ecency.com/@ecency/posts?q=games\" class=\"markdown-profile-link\">https://ecency.com/@ecency/posts?q=games</a></p>'
 
       expect(markdown2Html(input)).toBe(expected)
     })

package/src/methods/a.method.ts

@@ -30,12 +30,8 @@ import {
 import { getSerializedInnerHTML } from './get-inner-html.method'
 import { proxifyImageSrc } from '../proxify-image-src'
 import { removeChildNodes } from './remove-child-nodes.method'
-import { extractYtStartTime } from '../helper'
+import { extractYtStartTime, isValidPermlink } from '../helper'
 
-function isValidPermlink(permlink: string): boolean {
-  // Reject anything that looks like a file (ends with .jpg/.png/.webp/.jpeg etc)
-  return !/\.(jpg|jpeg|png|webp|gif|svg)$/i.test(permlink);
-}
 
 export function a(el: HTMLElement, forApp: boolean, webp: boolean): void {
   let href = el.getAttribute('href')
@@ -162,6 +158,7 @@ export function a(el: HTMLElement, forApp: boolean, webp: boolean): void {
       const author = tpostMatch[2].replace('@', '').toLowerCase()
       const section = tpostMatch[3]
 
+      if (!isValidPermlink(section)) return;
       if (el.textContent === href) {
         el.textContent = `@${author}/${section}`
       }

package/src/methods/img.method.ts

@@ -4,7 +4,7 @@ export function img(el: HTMLElement, webp: boolean): void {
   el.removeAttribute("width");
   el.removeAttribute("height");
 
-  const src = el.getAttribute("src") || "";
+  let src = el.getAttribute("src") || "";
 
   // Normalize encoded characters
   const decodedSrc = decodeURIComponent(
@@ -15,16 +15,14 @@ export function img(el: HTMLElement, webp: boolean): void {
   // ❌ Remove if javascript or empty/invalid
   const isInvalid = !src || decodedSrc.startsWith("javascript") || decodedSrc.startsWith("vbscript") || decodedSrc === "x";
   if (isInvalid) {
-    el.remove();
-    return;
+    src = ""
   }
 
-  // ❌ Skip relative paths (e.g., `photo.jpg`)
+  // ❌ Skip relative paths (e.g., `photo.jpg`, `./photo.png`, `assets/pic.jpeg`)
   const isRelative = !/^https?:\/\//i.test(src) && !src.startsWith("/");
   if (isRelative) {
-    console.warn("Skipped relative image:", src);
-    el.remove();
-    return;
+    //console.warn("Skipped relative image:", src);
+    src = ""
   }
 
   // Sanitize any dynamic or low-res src-like attributes

package/src/methods/linkify.method.ts

@@ -1,5 +1,6 @@
 import { IMG_REGEX, SECTION_LIST } from '../consts'
 import { proxifyImageSrc } from '../proxify-image-src'
+import {isValidPermlink} from "../helper";
 
 export function linkify(content: string, forApp: boolean, webp: boolean): string {
   // Tags
@@ -33,13 +34,15 @@ export function linkify(content: string, forApp: boolean, webp: boolean): string
   content = content.replace(
     /((^|\s)(\/|)@[\w.\d-]+)\/(\S+)/gi, (match, u, p1, p2, p3) => {
       const uu = u.trim().toLowerCase().replace('/@', '').replace('@', '');
-      const perm = p3;
+      const permlink = p3;
+      if (!isValidPermlink(permlink)) return match;
+
       if (SECTION_LIST.some(v => p3.includes(v))) {
-        const attrs = forApp ? `https://ecency.com/@${uu}/${perm}` : `href="/@${uu}/${perm}"`
-        return ` <a class="markdown-profile-link" ${attrs}>@${uu}/${perm}</a>`
+        const attrs = forApp ? `https://ecency.com/@${uu}/${permlink}` : `href="/@${uu}/${permlink}"`
+        return ` <a class="markdown-profile-link" ${attrs}>@${uu}/${permlink}</a>`
       } else {
-        const attrs = forApp ? `data-author="${uu}" data-tag="post" data-permlink="${perm}"` : `href="/post/@${uu}/${perm}"`
-        return ` <a class="markdown-post-link" ${attrs}>@${uu}/${perm}</a>`
+        const attrs = forApp ? `data-author="${uu}" data-tag="post" data-permlink="${permlink}"` : `href="/post/@${uu}/${permlink}"`
+        return ` <a class="markdown-post-link" ${attrs}>@${uu}/${permlink}</a>`
       }
     }
   )

package/src/methods/text.method.ts

@@ -1,5 +1,5 @@
 import { IMG_REGEX, YOUTUBE_REGEX, WHITE_LIST, DOMParser, POST_REGEX,  } from '../consts'
-import { extractYtStartTime } from '../helper'
+import { extractYtStartTime, isValidPermlink } from '../helper'
 import { proxifyImageSrc } from '../proxify-image-src'
 import { linkify } from './linkify.method'
 
@@ -59,6 +59,7 @@ export function text(node: HTMLElement, forApp: boolean, webp: boolean): void {
       const tag = postMatch[2]
       const author = postMatch[3].replace('@', '')
       const permlink = postMatch[4]
+      if (!isValidPermlink(permlink)) return;
 
       const attrs = forApp ? `data-tag="${tag}" data-author="${author}" data-permlink="${permlink}" class="markdown-post-link"` : `class="markdown-post-link" href="/${tag}/@${author}/${permlink}"`
       const replaceNode = DOMParser.parseFromString(

package/src/test/data/legacy/10.json

@@ -1,5 +1,5 @@
 {
   "id": 10,
   "input": "Lorem ipsum dolor <img src=x onerror=alert(x)> sit amet.\n\n<a href=\"javascript:void(0)\">etiam ut sollicitudin neque</a>\n\n<a onclick=\"console.log('ss')\">Vivamus pulvinar semper porttitor</a>",
-  "result": ""
+  "result": "<p dir=\"auto\">Lorem ipsum dolor <img /> sit amet.</p>\n<p dir=\"auto\"><a>etiam ut sollicitudin neque</a></p>\n<p dir=\"auto\"><a>Vivamus pulvinar semper porttitor</a></p>"
 }

package/src/test/data/legacy/21.json

@@ -1,5 +1,5 @@
 {
   "id": 21,
   "input": "javascript:/*--></title></style></textarea></script></xmp><svg/onload='+/\"/+/onmouseover=1/+/[*/[]/+alert(1)//'>\n\n<IMG SRC=\"javascript:alert('XSS');\"><img src=\"javascript:alert('XSS');\">\n\n<IMG SRC=javascript:alert('XSS')> <img src=javascript:alert('XSS')>",
-  "result": ""
+  "result": "<p dir=\"auto\">javascript:/<em>--&gt;&lt;svg/onload='+/\"/+/onmouseover=1/+/[</em>/[]/+alert(1)//'&gt;</p>\n<p dir=\"auto\"><img /><img /></p>\n<p dir=\"auto\">&lt;IMG SRC=javascript:alert('XSS')&gt; &lt;img src=javascript:alert('XSS')&gt;</p>"
 }

package/src/test/data/legacy/22.json

@@ -1,5 +1,5 @@
 {
   "id": 22,
   "input": "<IMG SRC=JaVaScRiPt:alert('XSS')> <IMG SRC=javascript:alert(&quot;XSS&quot;)>\n<IMG SRC=`javascript:alert(\"RSnake says, 'XSS'\")`>\n<a onmouseover=\"alert(document.cookie)\">xxs link</a><a onmouseover=alert(document.cookie)>xxs link</a>\n<IMG \"\"\"><SCRIPT>alert(\"XSS\")</SCRIPT>\"><IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>\n <IMG SRC= onmouseover=\"alert('xxs')\">",
-  "result": ""
+  "result": "<p dir=\"auto\">&lt;IMG SRC=JaVaScRiPt:alert('XSS')&gt; &lt;IMG SRC=javascript:alert(&quot;XSS&quot;)&gt;<br />\n&lt;IMG SRC=<code>javascript:alert(\"RSnake says, 'XSS'\")</code>&gt;<br />\n<a>xxs link</a><a>xxs link</a><br />\n&lt;IMG \"\"\"&gt;alert(&quot;XSS&quot;)\"&gt;<img /><br />\n&lt;IMG SRC= onmouseover=\"alert('xxs')\"&gt;</p>"
 }

package/src/test/data/legacy/23.json

@@ -1,5 +1,5 @@
 {
   "id": 23,
   "input": "<IMG SRC=/ onerror=\"alert(String.fromCharCode(88,83,83))\"></img> <img src=x onerror=\"&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041\"> <IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;> <IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29> <IMG SRC=\" &#14;  javascript:alert('XSS');\">",
-  "result": ""
+  "result": "<p dir=\"auto\">&lt;IMG SRC=/ onerror=\"alert(String.fromCharCode(88,83,83))\"&gt; <img /> &lt;IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;&gt; <img /> <img /></p>"
 }

package/src/test/data/legacy/26.json

@@ -1,5 +1,5 @@
 {
   "id": 26,
   "input": "<IMG DYNSRC=\"javascript:alert('XSS')\"> <IMG LOWSRC=\"javascript:alert('XSS')\"> <STYLE>li {list-style-image: url(\"javascript:alert('XSS')\");}</STYLE>",
-  "result": ""
+  "result": "<p dir=\"auto\"><img /> <img /> </p>"
 }