@ecency/render-helper 2.5.26 → 2.5.28

package/README.md

@@ -15,7 +15,7 @@ Built and maintained by [Ecency](https://ecency.com), an open-source social plat
 
 ### From Monorepo Root
 - `pnpm render-helper` - Build render-helper package
-- `pnpm build:packages` - Build all packages (sdk, wallets, renderer, render-helper)
+- `pnpm build:packages` - Build all packages (sdk, wallets, render-helper, ui)
 - `pnpm publish:render-helper` - Manually publish to npm
 
 ### CI/CD

package/dist/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,85 @@
+# Third-party notices
+
+`@ecency/render-helper` bundles the following packages into its published build output.
+Their licences and copyright notices are reproduced here in full, as those licences require.
+
+This file is generated during the build from the bundler's own metafile, so it lists what was
+actually inlined. Do not edit it by hand.
+
+## autolinker 3.16.2
+
+License: MIT
+
+```
+The MIT License (MIT)
+
+Copyright (c) 2014 Gregory Jacobs (http://greg-jacobs.com)
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```
+
+## remarkable 2.0.1
+
+License: MIT
+
+```
+The MIT License (MIT)
+
+Copyright (c) 2014-2016, Jon Schlinkert
+Copyright (c) 2014 Jon Schlinkert, Vitaly Puzrin.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+```
+
+## tslib 2.8.1
+
+License: 0BSD
+
+```
+Copyright (c) Microsoft Corporation.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+```
+

package/dist/browser/index.js

@@ -1,5 +1,5 @@
 import { DOMParser as DOMParser$1, XMLSerializer } from '@xmldom/xmldom';
-import he2 from 'he';
+import { decodeHTML } from 'entities';
 import xss from 'xss';
 import querystring from 'querystring';
 import { LRUCache } from 'lru-cache';
@@ -282,8 +282,19 @@ function createParser() {
   });
 }
 var DOMParser = createParser();
+var LEADING_ZEROS_DEC = /&#0+(?=[0-9])/g;
+var LEADING_ZEROS_HEX = /&#x0+(?=[0-9a-f])/gi;
+var OVERLONG_NUMERIC_REF = /&#(?:x[0-9a-f]{256,}|[0-9]{309,});?/gi;
+function decodeEntities(value) {
+  const safe = value.replace(LEADING_ZEROS_DEC, "&#").replace(LEADING_ZEROS_HEX, (m) => m.slice(0, 3)).replace(OVERLONG_NUMERIC_REF, "\uFFFD");
+  try {
+    return decodeHTML(safe);
+  } catch {
+    return safe;
+  }
+}
 function decodeImageSrc(src) {
-  const entityDecoded = he2.decode(src);
+  const entityDecoded = decodeEntities(src);
   try {
     return decodeURIComponent(entityDecoded).trim();
   } catch {
@@ -738,7 +749,7 @@ var isSafeNavValue = (value) => {
   const isRelative = /^(\/\/|\/[^/]?|#|\?|[a-z0-9._\-]+(\/|$))/i.test(trimmed);
   return isSafeScheme || isRelative;
 };
-var decodeEntities = (input) => input.replace(/&#(\d+);?/g, (_, dec) => String.fromCodePoint(Number(dec))).replace(/&#x([0-9a-f]+);?/gi, (_, hex) => String.fromCodePoint(parseInt(hex, 16)));
+var decodeEntities2 = (input) => input.replace(/&#(\d+);?/g, (_, dec) => String.fromCodePoint(Number(dec))).replace(/&#x([0-9a-f]+);?/gi, (_, hex) => String.fromCodePoint(parseInt(hex, 16)));
 var isProxyPSrcset = (srcset) => {
   const base = trimTrailingSlash(getProxyBase());
   const candidates = srcset.split(",").map((c) => c.trim().split(/\s+/)[0]).filter(Boolean);
@@ -752,7 +763,7 @@ function sanitizeHtml(html) {
     css: false,
     // block style attrs entirely for safety
     onTagAttr: (tag, name, value) => {
-      const decoded = decodeEntities(value.trim());
+      const decoded = decodeEntities2(value.trim());
       const decodedLower = decoded.toLowerCase();
       if (name.startsWith("on")) return "";
       if (tag === "img" && name === "src" && !/^https?:\/\//.test(decodedLower)) return "";
@@ -2178,6 +2189,8 @@ function markdown2Html(obj, forApp = true, _webp = false, parentDomain = "ecency
   cacheSet(key, res);
   return res;
 }
+
+// src/catch-post-image.ts
 var gifLinkRegex = /\.(gif)$/i;
 function isGifLink(link) {
   return gifLinkRegex.test(link);
@@ -2234,7 +2247,7 @@ function findFirstImageUrl(body, includeBareUrls = false) {
   return candidates[0].url;
 }
 function proxifyFound(src, width, height, format) {
-  const decoded = he2.decode(src);
+  const decoded = decodeEntities(src);
   if (isGifLink(decoded)) {
     return proxifyImageSrc(decoded, 0, 0, format);
   }
@@ -2252,7 +2265,7 @@ function getImage(entry, width = 0, height = 0, format = "match") {
     }
   }
   if (meta && typeof meta.image === "string" && meta.image.length > 0) {
-    const decodedImage = he2.decode(meta.image);
+    const decodedImage = decodeEntities(meta.image);
     if (isGifLink(decodedImage)) {
       return proxifyImageSrc(decodedImage, 0, 0, format);
     }
@@ -2260,7 +2273,7 @@ function getImage(entry, width = 0, height = 0, format = "match") {
   }
   if (meta && meta.image && !!meta.image.length && meta.image[0]) {
     if (typeof meta.image[0] === "string") {
-      const decodedImage = he2.decode(meta.image[0]);
+      const decodedImage = decodeEntities(meta.image[0]);
       if (isGifLink(decodedImage)) {
         return proxifyImageSrc(decodedImage, 0, 0, format);
       }
@@ -2415,7 +2428,7 @@ function postBodySummary(entryBody, length = 200, platform = "web") {
     text2 = joint(text2.split(" "), length);
   }
   if (text2) {
-    text2 = he2.decode(text2);
+    text2 = decodeEntities(text2);
   }
   return text2;
 }