@ecency/render-helper 2.5.11 → 2.5.12

package/dist/browser/index.d.ts

@@ -133,6 +133,20 @@ declare function setCacheSize(size: number): void;
 
 declare const SECTION_LIST: string[];
 
+/**
+ * True iff `value` is an absolute https:// URL whose host is one the renderer
+ * is permitted to embed AND (for hosts with a known embed-path shape) whose
+ * path matches that shape. Used to validate data-embed-src / data-video-href in
+ * the sanitizer and the iframe `src` the client video extensions assign.
+ *
+ * Defensive: never throws (a malformed URL returns false), rejects every
+ * non-https scheme (javascript:, data:, http:, protocol-relative //host),
+ * compares the parsed hostname so an attacker can't smuggle an allowed host as
+ * a path/query/userinfo/subdomain-suffix segment, and constrains the path so an
+ * allowed host can't be aimed at a non-embed route.
+ */
+declare function isAllowedEmbedSrc(value?: string | null): boolean;
+
 declare function isValidPermlink(permlink: string): boolean;
 
 /**
@@ -145,4 +159,4 @@ declare function isValidPermlink(permlink: string): boolean;
  */
 declare function simpleMarkdownToHTML(input: string): string;
 
-export { type Entry, IMAGE_SIZES, type ProxifyOptions, type RenderOptions, SECTION_LIST, type SeoContext, buildPictureSources, buildSrcSet, buildSrcSetForFormat, catchPostImage, getEntryImageRawUrl, isPictureEligibleRawUrl, isValidPermlink, getPostBodySummary as postBodySummary, proxifyImageSrc, markdown2Html as renderPostBody, setCacheSize, setProxyBase, setSlowRenderThresholdMs, simpleMarkdownToHTML };
+export { type Entry, IMAGE_SIZES, type ProxifyOptions, type RenderOptions, SECTION_LIST, type SeoContext, buildPictureSources, buildSrcSet, buildSrcSetForFormat, catchPostImage, getEntryImageRawUrl, isAllowedEmbedSrc, isPictureEligibleRawUrl, isValidPermlink, getPostBodySummary as postBodySummary, proxifyImageSrc, markdown2Html as renderPostBody, setCacheSize, setProxyBase, setSlowRenderThresholdMs, simpleMarkdownToHTML };

package/dist/browser/index.js

@@ -176,6 +176,96 @@ var ALLOWED_ATTRIBUTES = {
   "del": [],
   "ins": []
 };
+
+// src/consts/embed-hosts.const.ts
+var ALLOWED_EMBED_HOSTS = /* @__PURE__ */ new Set([
+  // YouTube
+  "www.youtube.com",
+  "youtube.com",
+  "www.youtube-nocookie.com",
+  "youtube-nocookie.com",
+  // Vimeo
+  "player.vimeo.com",
+  // Twitch
+  "player.twitch.tv",
+  // DTube
+  "emb.d.tube",
+  // 3Speak (video + audio)
+  "play.3speak.tv",
+  "3speak.tv",
+  "audio.3speak.tv",
+  // Loom
+  "www.loom.com",
+  // Spotify
+  "open.spotify.com",
+  // SoundCloud
+  "w.soundcloud.com",
+  // BitChute
+  "www.bitchute.com",
+  "bitchute.com",
+  // Rumble
+  "www.rumble.com",
+  "rumble.com",
+  // Brighteon
+  "www.brighteon.com",
+  "brighteon.com",
+  // VIMM
+  "www.vimm.tv",
+  // BrandNewTube
+  "brandnewtube.com",
+  // LBRY / Odysee
+  "lbry.tv",
+  "odysee.com",
+  // Skatehive / Skatehype
+  "ipfs.skatehive.app",
+  "www.skatehype.com",
+  "skatehype.com",
+  // archive.org
+  "archive.org",
+  // Truvvl
+  "embed.truvvl.com",
+  // Aureal
+  "aureal-embed.web.app",
+  "www.aureal-embed.web.app"
+  // Dapplr (player.*.dapplr.in / *.dapplr.in) — host suffix, handled below
+]);
+var ALLOWED_EMBED_HOST_SUFFIXES = [".dapplr.in"];
+var EMBED_HOST_PATH_PATTERNS = {
+  "www.youtube.com": /^\/embed\//,
+  "youtube.com": /^\/embed\//,
+  "www.youtube-nocookie.com": /^\/embed\//,
+  "youtube-nocookie.com": /^\/embed\//,
+  "player.vimeo.com": /^\/video\//,
+  "player.twitch.tv": /^\/$/,
+  // channel/video carried in the query string
+  "emb.d.tube": /^\/$/,
+  // dtube carries the ref in the #! fragment
+  "play.3speak.tv": /^\/(watch|embed)/,
+  "open.spotify.com": /^\/embed\//,
+  "www.loom.com": /^\/embed\//,
+  "www.bitchute.com": /^\/embed\//,
+  "bitchute.com": /^\/embed\//,
+  "www.rumble.com": /^\/embed\//,
+  "rumble.com": /^\/embed\//,
+  "www.brighteon.com": /^\/embed\//,
+  "brighteon.com": /^\/embed\//
+};
+function isAllowedEmbedSrc(value) {
+  if (!value) return false;
+  let url;
+  try {
+    url = new URL(value.trim());
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "https:") return false;
+  const host = url.hostname.toLowerCase();
+  const hostAllowed = ALLOWED_EMBED_HOSTS.has(host) || ALLOWED_EMBED_HOST_SUFFIXES.some((suffix) => host.endsWith(suffix));
+  if (!hostAllowed) return false;
+  const pathPattern = EMBED_HOST_PATH_PATTERNS[host];
+  if (pathPattern && !pathPattern.test(url.pathname)) return false;
+  return true;
+}
 function createParser() {
   return new DOMParser$1({
     onError(level, msg) {
@@ -571,6 +661,14 @@ function buildPictureSources(rawUrl) {
 }
 
 // src/methods/sanitize-html.method.ts
+var EMBED_SRC_DATA_ATTRS = /* @__PURE__ */ new Set(["data-embed-src", "data-video-href"]);
+var isSafeNavValue = (value) => {
+  const trimmed = value.trim().replace(/[\t\n\r\f\v\0]/g, "").toLowerCase();
+  if (!trimmed) return false;
+  const isSafeScheme = /^(https?|mailto|hive|tel|web\+[a-z0-9.+-]+):/i.test(trimmed);
+  const isRelative = /^(\/\/|\/[^/]?|#|\?|[a-z0-9._\-]+(\/|$))/i.test(trimmed);
+  return isSafeScheme || isRelative;
+};
 var decodeEntities = (input) => input.replace(/&#(\d+);?/g, (_, dec) => String.fromCodePoint(Number(dec))).replace(/&#x([0-9a-f]+);?/gi, (_, hex) => String.fromCodePoint(parseInt(hex, 16)));
 var isProxyPSrcset = (srcset) => {
   const base = trimTrailingSlash(getProxyBase());
@@ -598,6 +696,8 @@ function sanitizeHtml(html) {
       if (tag === "video" && ["src", "poster"].includes(name) && !/^https?:\/\//.test(decodedLower)) return "";
       if (tag === "img" && ["dynsrc", "lowsrc"].includes(name)) return "";
       if (tag === "span" && name === "class" && decoded.toLowerCase().trim() === "wr") return "";
+      if (EMBED_SRC_DATA_ATTRS.has(name) && !isAllowedEmbedSrc(decoded)) return "";
+      if (name === "data-href" && !isSafeNavValue(decoded)) return "";
       if (name === "id") {
         if (!ID_WHITELIST.test(decoded)) return "";
       }
@@ -2203,6 +2303,6 @@ function getPostBodySummary(obj, length, platform) {
   return res;
 }
 
-export { IMAGE_SIZES, SECTION_LIST, buildPictureSources, buildSrcSet, buildSrcSetForFormat, catchPostImage, getEntryImageRawUrl, isPictureEligibleRawUrl, isValidPermlink, getPostBodySummary as postBodySummary, proxifyImageSrc, markdown2Html as renderPostBody, setCacheSize, setProxyBase, setSlowRenderThresholdMs, simpleMarkdownToHTML };
+export { IMAGE_SIZES, SECTION_LIST, buildPictureSources, buildSrcSet, buildSrcSetForFormat, catchPostImage, getEntryImageRawUrl, isAllowedEmbedSrc, isPictureEligibleRawUrl, isValidPermlink, getPostBodySummary as postBodySummary, proxifyImageSrc, markdown2Html as renderPostBody, setCacheSize, setProxyBase, setSlowRenderThresholdMs, simpleMarkdownToHTML };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map