@ecomcx/ecomweb-content 0.0.0-stage → 1.14.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (38) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +157 -2
  3. package/dist/block.d.ts +58 -0
  4. package/dist/block.js +60 -0
  5. package/dist/embed.d.ts +23 -0
  6. package/dist/embed.js +63 -0
  7. package/dist/index.d.ts +10 -0
  8. package/dist/index.js +10 -0
  9. package/dist/migrate.d.ts +2 -0
  10. package/dist/migrate.js +19 -0
  11. package/dist/normalize.d.ts +25 -0
  12. package/dist/normalize.js +146 -0
  13. package/dist/schema.d.ts +31 -0
  14. package/dist/schema.js +167 -0
  15. package/dist/style.d.ts +74 -0
  16. package/dist/style.js +285 -0
  17. package/dist/text.d.ts +9 -0
  18. package/dist/text.js +30 -0
  19. package/dist/types.d.ts +36 -0
  20. package/dist/types.js +6 -0
  21. package/dist/url.d.ts +7 -0
  22. package/dist/url.js +21 -0
  23. package/fixtures/all-core-nodes.json +782 -0
  24. package/fixtures/attr-coercion.json +219 -0
  25. package/fixtures/basic-blocks.json +414 -0
  26. package/fixtures/block-extras.json +131 -0
  27. package/fixtures/block-styles.json +316 -0
  28. package/fixtures/dynamic-blocks.json +316 -0
  29. package/fixtures/editor-output-nulls.json +112 -0
  30. package/fixtures/empty-and-newer.json +12 -0
  31. package/fixtures/invalid-structure.json +145 -0
  32. package/fixtures/layout-blocks.json +238 -0
  33. package/fixtures/legacy-html-string.json +17 -0
  34. package/fixtures/legacy-tiptap-doc.json +41 -0
  35. package/fixtures/plugin-blocks-preserved.json +155 -0
  36. package/fixtures/synced-pattern.json +80 -0
  37. package/package.json +44 -4
  38. package/style.css +161 -0
package/dist/url.js ADDED
@@ -0,0 +1,21 @@
1
+ /**
2
+ * URL an toàn cho href/src: http(s), mailto, tel, tương đối (/, #, ?, ./), ảnh data:image/* (không SVG).
3
+ * Cùng quy tắc với ContentSanitizer.IsSafeUrl của máy chủ.
4
+ */
5
+ export function isSafeUrl(url) {
6
+ if (url == null || url === "")
7
+ return true;
8
+ // Bỏ ký tự điều khiển/khoảng trắng mà trình duyệt bỏ qua khi phân tích ("java\tscript:")
9
+ const u = String(url).replace(/[\u0000- ]/g, "").toLowerCase();
10
+ if (u.startsWith("data:"))
11
+ return u.startsWith("data:image/") && !u.startsWith("data:image/svg");
12
+ const colon = u.indexOf(":");
13
+ if (colon < 0)
14
+ return true;
15
+ const sep = u.search(/[/?#]/);
16
+ if (sep >= 0 && sep < colon)
17
+ return true; // ":" nằm sau phần đường dẫn → URL tương đối
18
+ return ["http", "https", "mailto", "tel"].includes(u.slice(0, colon));
19
+ }
20
+ /** URL an toàn hoặc chuỗi thay thế. */
21
+ export const safeUrl = (url, fallback = "#") => (isSafeUrl(url) && url != null ? String(url) : fallback);