@ecency/render-helper 2.5.11 → 2.5.12

package/dist/node/index.cjs

@@ -205,6 +205,96 @@ var ALLOWED_ATTRIBUTES = {
   "del": [],
   "ins": []
 };
+
+// src/consts/embed-hosts.const.ts
+var ALLOWED_EMBED_HOSTS = /* @__PURE__ */ new Set([
+  // YouTube
+  "www.youtube.com",
+  "youtube.com",
+  "www.youtube-nocookie.com",
+  "youtube-nocookie.com",
+  // Vimeo
+  "player.vimeo.com",
+  // Twitch
+  "player.twitch.tv",
+  // DTube
+  "emb.d.tube",
+  // 3Speak (video + audio)
+  "play.3speak.tv",
+  "3speak.tv",
+  "audio.3speak.tv",
+  // Loom
+  "www.loom.com",
+  // Spotify
+  "open.spotify.com",
+  // SoundCloud
+  "w.soundcloud.com",
+  // BitChute
+  "www.bitchute.com",
+  "bitchute.com",
+  // Rumble
+  "www.rumble.com",
+  "rumble.com",
+  // Brighteon
+  "www.brighteon.com",
+  "brighteon.com",
+  // VIMM
+  "www.vimm.tv",
+  // BrandNewTube
+  "brandnewtube.com",
+  // LBRY / Odysee
+  "lbry.tv",
+  "odysee.com",
+  // Skatehive / Skatehype
+  "ipfs.skatehive.app",
+  "www.skatehype.com",
+  "skatehype.com",
+  // archive.org
+  "archive.org",
+  // Truvvl
+  "embed.truvvl.com",
+  // Aureal
+  "aureal-embed.web.app",
+  "www.aureal-embed.web.app"
+  // Dapplr (player.*.dapplr.in / *.dapplr.in) — host suffix, handled below
+]);
+var ALLOWED_EMBED_HOST_SUFFIXES = [".dapplr.in"];
+var EMBED_HOST_PATH_PATTERNS = {
+  "www.youtube.com": /^\/embed\//,
+  "youtube.com": /^\/embed\//,
+  "www.youtube-nocookie.com": /^\/embed\//,
+  "youtube-nocookie.com": /^\/embed\//,
+  "player.vimeo.com": /^\/video\//,
+  "player.twitch.tv": /^\/$/,
+  // channel/video carried in the query string
+  "emb.d.tube": /^\/$/,
+  // dtube carries the ref in the #! fragment
+  "play.3speak.tv": /^\/(watch|embed)/,
+  "open.spotify.com": /^\/embed\//,
+  "www.loom.com": /^\/embed\//,
+  "www.bitchute.com": /^\/embed\//,
+  "bitchute.com": /^\/embed\//,
+  "www.rumble.com": /^\/embed\//,
+  "rumble.com": /^\/embed\//,
+  "www.brighteon.com": /^\/embed\//,
+  "brighteon.com": /^\/embed\//
+};
+function isAllowedEmbedSrc(value) {
+  if (!value) return false;
+  let url;
+  try {
+    url = new URL(value.trim());
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "https:") return false;
+  const host = url.hostname.toLowerCase();
+  const hostAllowed = ALLOWED_EMBED_HOSTS.has(host) || ALLOWED_EMBED_HOST_SUFFIXES.some((suffix) => host.endsWith(suffix));
+  if (!hostAllowed) return false;
+  const pathPattern = EMBED_HOST_PATH_PATTERNS[host];
+  if (pathPattern && !pathPattern.test(url.pathname)) return false;
+  return true;
+}
 function createParser() {
   return new xmldom.DOMParser({
     onError(level, msg) {
@@ -600,6 +690,14 @@ function buildPictureSources(rawUrl) {
 }
 
 // src/methods/sanitize-html.method.ts
+var EMBED_SRC_DATA_ATTRS = /* @__PURE__ */ new Set(["data-embed-src", "data-video-href"]);
+var isSafeNavValue = (value) => {
+  const trimmed = value.trim().replace(/[\t\n\r\f\v\0]/g, "").toLowerCase();
+  if (!trimmed) return false;
+  const isSafeScheme = /^(https?|mailto|hive|tel|web\+[a-z0-9.+-]+):/i.test(trimmed);
+  const isRelative = /^(\/\/|\/[^/]?|#|\?|[a-z0-9._\-]+(\/|$))/i.test(trimmed);
+  return isSafeScheme || isRelative;
+};
 var decodeEntities = (input) => input.replace(/&#(\d+);?/g, (_, dec) => String.fromCodePoint(Number(dec))).replace(/&#x([0-9a-f]+);?/gi, (_, hex) => String.fromCodePoint(parseInt(hex, 16)));
 var isProxyPSrcset = (srcset) => {
   const base = trimTrailingSlash(getProxyBase());
@@ -627,6 +725,8 @@ function sanitizeHtml(html) {
       if (tag === "video" && ["src", "poster"].includes(name) && !/^https?:\/\//.test(decodedLower)) return "";
       if (tag === "img" && ["dynsrc", "lowsrc"].includes(name)) return "";
       if (tag === "span" && name === "class" && decoded.toLowerCase().trim() === "wr") return "";
+      if (EMBED_SRC_DATA_ATTRS.has(name) && !isAllowedEmbedSrc(decoded)) return "";
+      if (name === "data-href" && !isSafeNavValue(decoded)) return "";
       if (name === "id") {
         if (!ID_WHITELIST.test(decoded)) return "";
       }
@@ -2239,6 +2339,7 @@ exports.buildSrcSet = buildSrcSet;
 exports.buildSrcSetForFormat = buildSrcSetForFormat;
 exports.catchPostImage = catchPostImage;
 exports.getEntryImageRawUrl = getEntryImageRawUrl;
+exports.isAllowedEmbedSrc = isAllowedEmbedSrc;
 exports.isPictureEligibleRawUrl = isPictureEligibleRawUrl;
 exports.isValidPermlink = isValidPermlink;
 exports.postBodySummary = getPostBodySummary;