@ecency/render-helper 2.3.7 → 2.3.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ecency/render-helper",
-  "version": "2.3.7",
+  "version": "2.3.9",
   "description": "Markdown+Html Render helper",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",

package/src/consts/allowed-attributes.const.ts

@@ -19,7 +19,8 @@ export const ALLOWED_ATTRIBUTES: XSSWhiteList = {
     'data-is-inline',
     'class',
     'title',
-    'data-id'
+    'data-id',
+    'id'
   ],
   'img': [
     'src',
@@ -30,9 +31,9 @@ export const ALLOWED_ATTRIBUTES: XSSWhiteList = {
     'decoding',
     'itemprop'
   ],
-  'span': ['class'],
+  'span': ['class', 'id'],
   'iframe': ['src', 'class', 'frameborder', 'allowfullscreen', 'webkitallowfullscreen', 'mozallowfullscreen', 'sandbox'],
-  'div': ['class'],
+  'div': ['class', 'id'],
   'strong': [],
   'b': [],
   'i': [],
@@ -43,13 +44,13 @@ export const ALLOWED_ATTRIBUTES: XSSWhiteList = {
   'blockquote': ['class'],
   'sup': [],
   'sub': [],
-  'h1': ['dir'],
-  'h2': ['dir'],
-  'h3': ['dir'],
-  'h4': ['dir'],
-  'h5': ['dir'],
-  'h6': ['dir'],
-  'p': ['dir'],
+  'h1': ['dir', 'id'],
+  'h2': ['dir', 'id'],
+  'h3': ['dir', 'id'],
+  'h4': ['dir', 'id'],
+  'h5': ['dir', 'id'],
+  'h6': ['dir', 'id'],
+  'p': ['dir', 'id'],
   'center': [],
   'ul': [],
   'ol': [],

package/src/consts/regexes.const.ts

@@ -42,3 +42,5 @@ export const LOOM_EMBED_REGEX = /^(https?:)?\/\/www.loom.com\/embed\/(.*)/i
 export const AUREAL_EMBED_REGEX = /^(https?:\/\/)?(www\.)?(?:aureal-embed)\.web\.app\/([0-9]+)/i
 export const ENTITY_REGEX = /&([a-z0-9]+|#[0-9]{1,6}|#x[0-9a-fA-F]{1,6});/ig
 export const SECTION_REGEX = /\B(\#[\da-zA-Z-_]+\b)(?!;)/i
+export const ID_WHITELIST = /^[A-Za-z][-A-Za-z0-9_]*$/
+

package/src/methods/sanitize-html.method.ts

@@ -1,5 +1,5 @@
 import xss from 'xss'
-import { ALLOWED_ATTRIBUTES } from '../consts'
+import {ALLOWED_ATTRIBUTES, ID_WHITELIST} from '../consts'
 
 const decodeEntities = (input: string): string =>
   input
@@ -19,7 +19,9 @@ export function sanitizeHtml(html: string): string {
       if (tag === 'img' && name === 'src' && (!/^https?:\/\//.test(decoded) || decoded.startsWith('javascript:'))) return '';
       if (tag === 'img' && ['dynsrc', 'lowsrc'].includes(name)) return '';
       if (tag === 'span' && name === 'class' && value === 'wr') return '';
-
+      if (name === 'id') {
+        if (!ID_WHITELIST.test(decoded)) return '';
+      }
       return undefined;
     }
   });

package/src/proxify-image-src.spec.ts

@@ -50,10 +50,10 @@ describe('Proxify image src', () => {
   })
 
   it('3- set proxy base', () => {
-    setProxyBase('https://img.esteem.app')
+    setProxyBase('https://images.hive.blog')
 
     const input = 'https://i.imgur.com/muESb0B.png'
-    const expected = 'https://img.esteem.app/p/2bP4pJr4wVimqCWjYimXJe2cnCgnJdyHYxb4dfF6gmC.png?format=match&mode=fit'
+    const expected = 'https://images.hive.blog/p/2bP4pJr4wVimqCWjYimXJe2cnCgnJdyHYxb4dfF6gmC?format=match&mode=fit'
 
     expect(proxifyImageSrc(input)).toBe(expected)
   })

package/src/proxify-image-src.ts

@@ -2,9 +2,11 @@ import multihash from 'multihashes'
 import querystring from 'querystring'
 
 let proxyBase = 'https://images.ecency.com'
+let fileExtension = true
 
 export function setProxyBase(p: string): void {
   proxyBase = p
+  fileExtension = proxyBase == 'https://images.ecency.com';
 }
 
 export function extractPHash(url: string): string | null {
@@ -62,10 +64,14 @@ export function proxifyImageSrc(url?: string, width = 0, height = 0, format = 'm
   const qs = querystring.stringify(options)
 
   if (pHash) {
-    return `${proxyBase}/p/${pHash}${format==='webp'?'.webp':'.png'}?${qs}`
+    if (fileExtension) {
+      return `${proxyBase}/p/${pHash}${format==='webp'?'.webp':'.png'}?${qs}`
+    } else {
+      return `${proxyBase}/p/${pHash}?${qs}`
+    }
   }
 
   const b58url = multihash.toB58String(Buffer.from(realUrl.toString()))
 
-  return `${proxyBase}/p/${b58url}${format==='webp'?'.webp':'.png'}?${qs}`
+  return `${proxyBase}/p/${b58url}${fileExtension ? format==='webp'?'.webp':'.png' : ''}?${qs}`
 }