@entropicwarrior/sdoc 0.2.9 → 0.2.11

package/docs/reference/sdoc-authoring.sdoc

@@ -421,7 +421,7 @@ Content of Section B.
             ```
             ````
 
-            For security, \`<script>\` and \`<foreignObject>\` tags are stripped from the SVG content before rendering. All other SVG elements pass through as-is.
+            For security, the following are stripped before rendering: \`<script>\` tags, \`<foreignObject>\` tags, event-handler attributes (\`onload\`, \`onclick\`, etc.), and \`javascript:\` URLs. Content outside the \`<svg>\` root element is discarded. All other SVG elements and attributes pass through as-is.
         }
 
         # Math Blocks @math-blocks

package/lexica/specification.sdoc

@@ -608,9 +608,9 @@ Content of Section B.
                 - Optional language tag after the opening fence
                 - The special language tag `math` renders the block as a display equation via KaTeX (no copy button)
                 - The special language tag `mermaid` renders the block as an SVG diagram via the Mermaid library
-                - The special language tag `svg` renders the block as an inline SVG graphic. Script and foreignObject tags are stripped for security.
+                - The special language tag `svg` renders the block as an inline SVG graphic. Script tags, foreignObject tags, event-handler attributes, and javascript: URLs are stripped for security.
                 - Fences may use more than three backticks (e.g. four or five) to nest code blocks that themselves contain triple backticks. The closing fence must match the opening fence length.
-                - Code blocks display a copy-to-clipboard button (visible on hover) in all rendered HTML output
+                - Code blocks display a copy-to-clipboard button (visible on hover) in all rendered HTML output, except for `math`, `mermaid`, and `svg` blocks which render without it
             }
 
             # Include by Link @code-includes

package/package.json

@@ -2,7 +2,7 @@
   "name": "@entropicwarrior/sdoc",
   "displayName": "SDOC - Docs for Human/Agent Teams",
   "description": "A plain-text documentation format with explicit brace scoping — deterministic parsing, AI-agent efficiency, and 10-50x token savings vs Markdown.",
-  "version": "0.2.9",
+  "version": "0.2.11",
   "publisher": "entropicwarrior-msenfin",
   "license": "MIT",
   "repository": {

package/src/sdoc.js

@@ -1391,11 +1391,32 @@ function escapeHtml(value) {
 }
 
 function sanitizeSvg(svg) {
-  return svg
-    .replace(/<script[\s>][\s\S]*?<\/script\s*>/gi, "")
-    .replace(/<script\s*\/>/gi, "")
-    .replace(/<foreignObject[\s>][\s\S]*?<\/foreignObject\s*>/gi, "")
-    .replace(/<foreignObject\s*\/>/gi, "");
+  if (typeof svg !== "string") return "";
+
+  // Enforce a single <svg> root — discard anything outside it.
+  const openMatch = svg.match(/<svg[\s>]/i);
+  const closeMatch = svg.match(/<\/svg\s*>/i);
+  if (!openMatch || !closeMatch) return "";
+  const start = svg.indexOf(openMatch[0]);
+  const end = svg.indexOf(closeMatch[0], start) + closeMatch[0].length;
+  let s = svg.slice(start, end);
+
+  // Strip <script> and <foreignObject> elements (including self-closing).
+  s = s.replace(/<script[\s>][\s\S]*?<\/script\s*>/gi, "");
+  s = s.replace(/<script\b[^>]*\/\s*>/gi, "");
+  s = s.replace(/<foreignObject[\s>][\s\S]*?<\/foreignObject\s*>/gi, "");
+  s = s.replace(/<foreignObject\b[^>]*\/\s*>/gi, "");
+
+  // Strip event-handler attributes (onload, onclick, etc.).
+  s = s.replace(/\s+on[a-z]+\s*=\s*(".*?"|'.*?'|[^\s>]+)/gi, "");
+
+  // Neutralize javascript: URLs in href and xlink:href.
+  s = s.replace(
+    /(\s+(?:xlink:)?href\s*=\s*)(["'])(\s*javascript:)/gi,
+    function (_match, prefix, quote) { return prefix + quote + "#"; }
+  );
+
+  return s;
 }
 
 function escapeAttr(value) {
@@ -1474,6 +1495,8 @@ function renderInlineNodes(nodes) {
 function renderScope(scope, depth, isTitleScope = false) {
   // :comment scopes are not rendered
   if (scope.scopeType === "comment") return "";
+  // @about is document metadata, not rendered in output
+  if (scope.id && scope.id.toLowerCase() === "about") return "";
 
   const level = Math.min(6, Math.max(1, depth));
   const children = scope.children.map((child) => renderNode(child, depth + 1)).join("\n");

package/src/slide-renderer.js

@@ -7,7 +7,7 @@
 //   const { nodes, meta } = extractMeta(parsed.nodes);
 //   const html = renderSlides(nodes, { meta, themeCss, themeJs });
 
-const { parseInline, renderKatex, escapeHtml, escapeAttr } = require("./sdoc");
+const { parseInline, renderKatex, escapeHtml, escapeAttr, sanitizeSvg } = require("./sdoc");
 
 // ---------------------------------------------------------------------------
 // Inline rendering — produces clean HTML without sdoc-* classes
@@ -71,6 +71,9 @@ function renderNode(node) {
       if (node.lang === "mermaid") {
         return `<pre class="mermaid">${escapeHtml(node.text)}</pre>`;
       }
+      if (node.lang === "svg") {
+        return `<div class="sdoc-svg-block">${sanitizeSvg(node.text)}</div>`;
+      }
       if (node.lang === "math") {
         return `<div class="sdoc-math sdoc-math-block">${renderKatex(node.text, true)}</div>`;
       }