@ecency/render-helper 2.3.6 → 2.3.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ecency/render-helper",
-  "version": "2.3.6",
+  "version": "2.3.7",
   "description": "Markdown+Html Render helper",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",

package/src/helper.ts

@@ -36,4 +36,26 @@ export function isValidPermlink(permlink: string): boolean {
   return isCleanFormat && !isImage && !hasSpecialChars;
 }
 
+// Reference: https://en.wikipedia.org/wiki/Domain_Name_System#Domain_name_syntax
+// Hive account names must follow similar rules to DNS (RFC 1035)
+const LABEL_REGEX = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+
+export function isValidUsername(username: string): boolean {
+  if (!username || typeof username !== 'string') return false;
+  if (username.length > 16) return false;
+
+  const labels = username.split('.');
+
+  return labels.every(label => {
+    return (
+      label.length >= 3 &&
+      label.length <= 16 &&
+      /^[a-z]/.test(label) &&                    // must start with a letter
+      LABEL_REGEX.test(label) &&                 // a-z0-9, hyphens, no start/end hyphen
+      !label.includes('..')                      // double dots are impossible after split, but just in case
+    );
+  });
+}
+
+
 

package/src/markdown-2-html.spec.ts

@@ -270,7 +270,7 @@ describe('Markdown2Html', () => {
         body: '@lorem @ipsum @dolor \n @Sit amet'
       }
       expected =
-        '<p dir=\"auto\"><span><a class="markdown-author-link" data-author="lorem">@lorem</a> <a class="markdown-author-link" data-author="ipsum">@ipsum</a> <a class="markdown-author-link" data-author="dolor">@dolor</a></span><br /><span>\n<a class="markdown-author-link" data-author="sit">@Sit</a> amet</span></p>'
+        '<p dir=\"auto\"><span><a class="markdown-author-link" data-author="lorem">@lorem</a> <a class="markdown-author-link" data-author="ipsum">@ipsum</a> <a class="markdown-author-link" data-author="dolor">@dolor</a></span><br />\n@Sit amet</p>'
       expect(markdown2Html(input)).toBe(expected)
     })
 

package/src/methods/a.method.ts

@@ -30,8 +30,8 @@ import {
 import { getSerializedInnerHTML } from './get-inner-html.method'
 import { proxifyImageSrc } from '../proxify-image-src'
 import { removeChildNodes } from './remove-child-nodes.method'
-import { extractYtStartTime, isValidPermlink } from '../helper'
-import {createImageHTML} from "./img.method";
+import { extractYtStartTime, isValidPermlink, isValidUsername } from '../helper'
+import { createImageHTML } from "./img.method";
 
 
 export function a(el: HTMLElement, forApp: boolean, webp: boolean): void {
@@ -128,8 +128,12 @@ export function a(el: HTMLElement, forApp: boolean, webp: boolean): void {
   // If a hive user with url
   const mentionMatch = href.match(MENTION_REGEX)
   if (mentionMatch && WHITE_LIST.includes(mentionMatch[1].replace(/www./,'')) && mentionMatch.length === 3) {
+    const _author = mentionMatch[2].replace('@', '')
+    if (!isValidUsername(_author)) return
+    const author = _author.toLowerCase()
+
     el.setAttribute('class', 'markdown-author-link')
-    const author = mentionMatch[2].replace('@', '').toLowerCase()
+
     if (author.indexOf('/')===-1) {
       if (el.textContent === href) {
         el.textContent = `@${author}`
@@ -213,8 +217,11 @@ export function a(el: HTMLElement, forApp: boolean, webp: boolean): void {
   // If a hive user with internal url
   const imentionMatch = href.match(INTERNAL_MENTION_REGEX)
   if (imentionMatch) {
+    const _author = imentionMatch[0].replace('/@', '')
+    if (!isValidUsername(_author)) return
+    const author = _author.toLowerCase()
+
     el.setAttribute('class', 'markdown-author-link')
-    const author = imentionMatch[0].replace('/@', '').toLowerCase()
     if (author.indexOf('/')===-1) {
       if (el.textContent === href) {
         el.textContent = `@${author}`

package/src/methods/linkify.method.ts

@@ -1,7 +1,7 @@
 import { IMG_REGEX, SECTION_LIST } from '../consts'
 import { proxifyImageSrc } from '../proxify-image-src'
-import {isValidPermlink} from "../helper";
-import {createImageHTML} from "./img.method";
+import { isValidPermlink, isValidUsername } from "../helper";
+import { createImageHTML } from "./img.method";
 
 export function linkify(content: string, forApp: boolean, webp: boolean): string {
   // Tags
@@ -22,7 +22,7 @@ export function linkify(content: string, forApp: boolean, webp: boolean): string
     (match, preceeding1, preceeding2, user) => {
       const userLower = user.toLowerCase()
       const preceedings = (preceeding1 || '') + (preceeding2 || '')
-      if (userLower.indexOf('/') === -1) {
+      if (userLower.indexOf('/') === -1 && isValidUsername(user)) {
         const attrs = forApp ? `data-author="${userLower}"` : `href="/@${userLower}"`
         return `${preceedings}<a class="markdown-author-link" ${attrs}>@${user}</a>`
       } else {

package/src/methods/text.method.ts

@@ -1,5 +1,5 @@
-import { IMG_REGEX, YOUTUBE_REGEX, WHITE_LIST, DOMParser, POST_REGEX,  } from '../consts'
-import { extractYtStartTime, isValidPermlink } from '../helper'
+import { IMG_REGEX, YOUTUBE_REGEX, WHITE_LIST, DOMParser, POST_REGEX  } from '../consts'
+import { extractYtStartTime, isValidPermlink, isValidUsername } from '../helper'
 import { proxifyImageSrc } from '../proxify-image-src'
 import { linkify } from './linkify.method'
 import {createImageHTML} from "./img.method";
@@ -58,7 +58,9 @@ export function text(node: HTMLElement, forApp: boolean, webp: boolean): void {
       const tag = postMatch[2]
       const author = postMatch[3].replace('@', '')
       const permlink = postMatch[4]
-      if (!isValidPermlink(permlink)) return;
+
+      if (!isValidUsername(author)) return
+      if (!isValidPermlink(permlink)) return
 
       const attrs = forApp ? `data-tag="${tag}" data-author="${author}" data-permlink="${permlink}" class="markdown-post-link"` : `class="markdown-post-link" href="/${tag}/@${author}/${permlink}"`
       const replaceNode = DOMParser.parseFromString(