@evolvere/sgp-ui 1.6.9 → 1.6.10

package/lib/time-picker.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 83);
+/******/ 	return __webpack_require__(__webpack_require__.s = 85);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -227,7 +227,7 @@ module.exports = require("@evolvere/sgp-ui/lib/utils/dom");
 
 /***/ }),
 
-/***/ 28:
+/***/ 29:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";
@@ -330,7 +330,7 @@ var locale_ = __webpack_require__(6);
 var locale_default = /*#__PURE__*/__webpack_require__.n(locale_);
 
 // EXTERNAL MODULE: ./packages/date-picker/src/basic/time-spinner.vue + 4 modules
-var time_spinner = __webpack_require__(35);
+var time_spinner = __webpack_require__(36);
 
 // CONCATENATED MODULE: ./node_modules/_babel-loader@7.1.5@babel-loader/lib!./node_modules/_vue-loader@15.10.0@vue-loader/lib??vue-loader-options!./packages/date-picker/src/panel/time.vue?vue&type=script&lang=js&
 //
@@ -552,7 +552,7 @@ var component = Object(componentNormalizer["a" /* default */])(
 
 /***/ }),
 
-/***/ 31:
+/***/ 32:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";
@@ -587,7 +587,7 @@ var component = Object(componentNormalizer["a" /* default */])(
 
 /***/ }),
 
-/***/ 33:
+/***/ 34:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";
@@ -1718,7 +1718,7 @@ var component = Object(componentNormalizer["a" /* default */])(
 
 /***/ }),
 
-/***/ 35:
+/***/ 36:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";
@@ -2088,7 +2088,7 @@ var scrollbar_ = __webpack_require__(15);
 var scrollbar_default = /*#__PURE__*/__webpack_require__.n(scrollbar_);
 
 // EXTERNAL MODULE: ./src/directives/repeat-click.js
-var repeat_click = __webpack_require__(31);
+var repeat_click = __webpack_require__(32);
 
 // CONCATENATED MODULE: ./node_modules/_babel-loader@7.1.5@babel-loader/lib!./node_modules/_vue-loader@15.10.0@vue-loader/lib??vue-loader-options!./packages/date-picker/src/basic/time-spinner.vue?vue&type=script&lang=js&
 //
@@ -2444,7 +2444,7 @@ module.exports = require("vue");
 
 /***/ }),
 
-/***/ 83:
+/***/ 85:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";
@@ -2452,10 +2452,10 @@ module.exports = require("vue");
 __webpack_require__.r(__webpack_exports__);
 
 // EXTERNAL MODULE: ./packages/date-picker/src/picker.vue + 4 modules
-var picker = __webpack_require__(33);
+var picker = __webpack_require__(34);
 
 // EXTERNAL MODULE: ./packages/date-picker/src/panel/time.vue + 4 modules
-var time = __webpack_require__(28);
+var time = __webpack_require__(29);
 
 // CONCATENATED MODULE: ./node_modules/_vue-loader@15.10.0@vue-loader/lib/loaders/templateLoader.js??vue-loader-options!./node_modules/_vue-loader@15.10.0@vue-loader/lib??vue-loader-options!./packages/date-picker/src/panel/time-range.vue?vue&type=template&id=7ed65786&
 var render = function () {
@@ -2601,7 +2601,7 @@ var locale_ = __webpack_require__(6);
 var locale_default = /*#__PURE__*/__webpack_require__.n(locale_);
 
 // EXTERNAL MODULE: ./packages/date-picker/src/basic/time-spinner.vue + 4 modules
-var time_spinner = __webpack_require__(35);
+var time_spinner = __webpack_require__(36);
 
 // CONCATENATED MODULE: ./node_modules/_babel-loader@7.1.5@babel-loader/lib!./node_modules/_vue-loader@15.10.0@vue-loader/lib??vue-loader-options!./packages/date-picker/src/panel/time-range.vue?vue&type=script&lang=js&
 //

package/lib/time-select.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 82);
+/******/ 	return __webpack_require__(__webpack_require__.s = 84);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -220,14 +220,14 @@ module.exports = require("@evolvere/sgp-ui/lib/scrollbar");
 
 /***/ }),
 
-/***/ 32:
+/***/ 33:
 /***/ (function(module, exports) {
 
 module.exports = require("@evolvere/sgp-ui/lib/utils/scroll-into-view");
 
 /***/ }),
 
-/***/ 33:
+/***/ 34:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";
@@ -1379,7 +1379,7 @@ module.exports = require("vue");
 
 /***/ }),
 
-/***/ 82:
+/***/ 84:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";
@@ -1387,7 +1387,7 @@ module.exports = require("vue");
 __webpack_require__.r(__webpack_exports__);
 
 // EXTERNAL MODULE: ./packages/date-picker/src/picker.vue + 4 modules
-var picker = __webpack_require__(33);
+var picker = __webpack_require__(34);
 
 // CONCATENATED MODULE: ./node_modules/_vue-loader@15.10.0@vue-loader/lib/loaders/templateLoader.js??vue-loader-options!./node_modules/_vue-loader@15.10.0@vue-loader/lib??vue-loader-options!./packages/date-picker/src/panel/time-select.vue?vue&type=template&id=047b9193&
 var render = function () {
@@ -1468,7 +1468,7 @@ var scrollbar_ = __webpack_require__(15);
 var scrollbar_default = /*#__PURE__*/__webpack_require__.n(scrollbar_);
 
 // EXTERNAL MODULE: external "@evolvere/sgp-ui/lib/utils/scroll-into-view"
-var scroll_into_view_ = __webpack_require__(32);
+var scroll_into_view_ = __webpack_require__(33);
 var scroll_into_view_default = /*#__PURE__*/__webpack_require__.n(scroll_into_view_);
 
 // CONCATENATED MODULE: ./node_modules/_babel-loader@7.1.5@babel-loader/lib!./node_modules/_vue-loader@15.10.0@vue-loader/lib??vue-loader-options!./packages/date-picker/src/panel/time-select.vue?vue&type=script&lang=js&

package/lib/timeline-item.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 127);
+/******/ 	return __webpack_require__(__webpack_require__.s = 129);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -192,7 +192,7 @@ function normalizeComponent(
 
 /***/ }),
 
-/***/ 127:
+/***/ 129:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/timeline.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 140);
+/******/ 	return __webpack_require__(__webpack_require__.s = 142);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -192,7 +192,7 @@ function normalizeComponent(
 
 /***/ }),
 
-/***/ 140:
+/***/ 142:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/tooltip.js

@@ -82,12 +82,12 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 145);
+/******/ 	return __webpack_require__(__webpack_require__.s = 147);
 /******/ })
 /************************************************************************/
 /******/ ({
 
-/***/ 145:
+/***/ 147:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";

package/lib/transfer.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 72);
+/******/ 	return __webpack_require__(__webpack_require__.s = 74);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -227,7 +227,7 @@ module.exports = require("@evolvere/sgp-ui/lib/mixins/emitter");
 
 /***/ }),
 
-/***/ 41:
+/***/ 42:
 /***/ (function(module, exports) {
 
 module.exports = require("@evolvere/sgp-ui/lib/checkbox-group");
@@ -241,7 +241,7 @@ module.exports = require("@evolvere/sgp-ui/lib/mixins/locale");
 
 /***/ }),
 
-/***/ 72:
+/***/ 74:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";
@@ -536,7 +536,7 @@ transfer_panelvue_type_template_id_260da9e7_render._withStripped = true
 // CONCATENATED MODULE: ./packages/transfer/src/transfer-panel.vue?vue&type=template&id=260da9e7&
 
 // EXTERNAL MODULE: external "@evolvere/sgp-ui/lib/checkbox-group"
-var checkbox_group_ = __webpack_require__(41);
+var checkbox_group_ = __webpack_require__(42);
 var checkbox_group_default = /*#__PURE__*/__webpack_require__.n(checkbox_group_);
 
 // EXTERNAL MODULE: external "@evolvere/sgp-ui/lib/checkbox"

package/lib/tree.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 66);
+/******/ 	return __webpack_require__(__webpack_require__.s = 68);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -213,17 +213,17 @@ module.exports = require("@evolvere/sgp-ui/lib/locale");
 
 /***/ }),
 
-/***/ 29:
+/***/ 3:
 /***/ (function(module, exports) {
 
-module.exports = require("@evolvere/sgp-ui/lib/transitions/collapse-transition");
+module.exports = require("@evolvere/sgp-ui/lib/utils/util");
 
 /***/ }),
 
-/***/ 3:
+/***/ 30:
 /***/ (function(module, exports) {
 
-module.exports = require("@evolvere/sgp-ui/lib/utils/util");
+module.exports = require("@evolvere/sgp-ui/lib/transitions/collapse-transition");
 
 /***/ }),
 
@@ -234,7 +234,7 @@ module.exports = require("@evolvere/sgp-ui/lib/mixins/emitter");
 
 /***/ }),
 
-/***/ 66:
+/***/ 68:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";
@@ -1421,7 +1421,7 @@ tree_nodevue_type_template_id_097e75f6_render._withStripped = true
 // CONCATENATED MODULE: ./packages/tree/src/tree-node.vue?vue&type=template&id=097e75f6&
 
 // EXTERNAL MODULE: external "@evolvere/sgp-ui/lib/transitions/collapse-transition"
-var collapse_transition_ = __webpack_require__(29);
+var collapse_transition_ = __webpack_require__(30);
 var collapse_transition_default = /*#__PURE__*/__webpack_require__.n(collapse_transition_);
 
 // EXTERNAL MODULE: external "@evolvere/sgp-ui/lib/checkbox"

package/lib/upload.js

@@ -82,7 +82,7 @@ module.exports =
 /******/
 /******/
 /******/ 	// Load entry module and return exports
-/******/ 	return __webpack_require__(__webpack_require__.s = 65);
+/******/ 	return __webpack_require__(__webpack_require__.s = 67);
 /******/ })
 /************************************************************************/
 /******/ ({
@@ -206,28 +206,28 @@ module.exports = require("yakuza1");
 
 /***/ }),
 
-/***/ 27:
+/***/ 28:
 /***/ (function(module, exports) {
 
 module.exports = require("babel-helper-vue-jsx-merge-props");
 
 /***/ }),
 
-/***/ 36:
+/***/ 37:
 /***/ (function(module, exports) {
 
 module.exports = require("yakuza1/lib/safe");
 
 /***/ }),
 
-/***/ 43:
+/***/ 44:
 /***/ (function(module, exports) {
 
 module.exports = require("yakuza1/lib/config/def");
 
 /***/ }),
 
-/***/ 46:
+/***/ 47:
 /***/ (function(module, exports) {
 
 module.exports = require("@evolvere/sgp-ui/lib/progress");
@@ -241,7 +241,7 @@ module.exports = require("@evolvere/sgp-ui/lib/mixins/locale");
 
 /***/ }),
 
-/***/ 65:
+/***/ 67:
 /***/ (function(module, __webpack_exports__, __webpack_require__) {
 
 "use strict";
@@ -416,7 +416,7 @@ var locale_ = __webpack_require__(6);
 var locale_default = /*#__PURE__*/__webpack_require__.n(locale_);
 
 // EXTERNAL MODULE: external "@evolvere/sgp-ui/lib/progress"
-var progress_ = __webpack_require__(46);
+var progress_ = __webpack_require__(47);
 var progress_default = /*#__PURE__*/__webpack_require__.n(progress_);
 
 // CONCATENATED MODULE: ./node_modules/_babel-loader@7.1.5@babel-loader/lib!./node_modules/_vue-loader@15.10.0@vue-loader/lib??vue-loader-options!./packages/upload/src/upload-list.vue?vue&type=script&lang=js&
@@ -551,17 +551,17 @@ var component = Object(componentNormalizer["a" /* default */])(
 
 /* harmony default export */ var upload_list = (component.exports);
 // EXTERNAL MODULE: external "babel-helper-vue-jsx-merge-props"
-var external_babel_helper_vue_jsx_merge_props_ = __webpack_require__(27);
+var external_babel_helper_vue_jsx_merge_props_ = __webpack_require__(28);
 var external_babel_helper_vue_jsx_merge_props_default = /*#__PURE__*/__webpack_require__.n(external_babel_helper_vue_jsx_merge_props_);
 
 // EXTERNAL MODULE: external "yakuza1/lib/config/def"
-var def_ = __webpack_require__(43);
+var def_ = __webpack_require__(44);
 
 // EXTERNAL MODULE: external "yakuza1"
 var external_yakuza1_ = __webpack_require__(21);
 
 // EXTERNAL MODULE: external "yakuza1/lib/safe"
-var safe_ = __webpack_require__(36);
+var safe_ = __webpack_require__(37);
 
 // CONCATENATED MODULE: ./packages/upload/src/ajax.js
 var _extends = Object.assign || function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evolvere/sgp-ui",
-  "version": "1.6.9",
+  "version": "1.6.10",
   "description": "A Component Library for Vue.js.",
   "main": "lib/rdc-sgp-ui.common.js",
   "files": [
@@ -27,6 +27,7 @@
     "lint": "eslint src/**/* test/**/* packages/**/* build/**/* --quiet",
     "pub1": "npm run bootstrap && sh build/git-release.sh && sh build/release.sh && node build/bin/gen-indices.js && sh build/deploy-faas.sh",
     "test": "npm run lint && npm run build:theme && cross-env CI_ENV=/dev/ BABEL_ENV=test karma start test/unit/karma.conf.js --single-run",
+    "test:editor-security": "cross-env BABEL_ENV=test karma start test/unit/karma.editor-security.conf.js --single-run",
     "test:watch": "npm run build:theme && cross-env BABEL_ENV=test karma start test/unit/karma.conf.js",
     "pub": "sh build/release.sh"
   },
@@ -64,6 +65,7 @@
     "async-validator": "~1.8.1",
     "babel-helper-vue-jsx-merge-props": "^2.0.0",
     "deepmerge": "^1.2.0",
+    "dompurify": "3.4.14",
     "normalize-wheel": "^1.0.1",
     "resize-observer-polyfill": "^1.5.0",
     "throttle-debounce": "^1.0.1",

package/packages/editor/src/html-security.js

@@ -0,0 +1,180 @@
+import DOMPurify from 'dompurify';
+
+export const MAX_EDITOR_HTML_LENGTH = 1024 * 1024;
+export const MAX_IMAGE_SIZE = 5 * 1024 * 1024;
+export const MAX_IMAGE_COUNT = 10;
+
+const SAFE_PROTOCOLS = ['http:', 'https:'];
+const SAFE_LINK_PROTOCOLS = SAFE_PROTOCOLS.concat(['mailto:', 'tel:']);
+const SAFE_URI_PATTERN = /^(?:(?:https?|mailto|tel):|(?:\.{0,2}\/|#))/i;
+
+const PURIFY_OPTIONS = {
+  ALLOWED_TAGS: [
+    'a', 'b', 'blockquote', 'br', 'code', 'del', 'div', 'em', 'h1', 'h2',
+    'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'iframe', 'img', 'li', 'ol', 'p',
+    'pre', 's', 'span', 'strike', 'strong', 'sub', 'sup', 'table', 'tbody',
+    'td', 'tfoot', 'th', 'thead', 'tr', 'u', 'ul', 'video', 'source'
+  ],
+  ALLOWED_ATTR: [
+    'allow', 'allowfullscreen', 'alt', 'colspan', 'controls', 'frameborder',
+    'height', 'href', 'loading', 'loop', 'muted', 'playsinline', 'poster',
+    'preload', 'referrerpolicy', 'rel', 'rowspan', 'sandbox', 'src', 'style',
+    'target', 'title', 'webkitallowfullscreen', 'width'
+  ],
+  // These attributes carry fixed policy tokens rather than URLs. DOMPurify
+  // otherwise applies its URI value check and removes the security settings.
+  ADD_URI_SAFE_ATTR: ['loading', 'referrerpolicy', 'rel', 'sandbox', 'target'],
+  ALLOW_ARIA_ATTR: false,
+  ALLOW_DATA_ATTR: false,
+  ALLOW_UNKNOWN_PROTOCOLS: false,
+  ALLOWED_URI_REGEXP: SAFE_URI_PATTERN,
+  FORBID_TAGS: [
+    'base', 'button', 'embed', 'form', 'input', 'link', 'math', 'meta',
+    'noscript', 'object', 'option', 'script', 'select', 'style', 'svg',
+    'template', 'textarea'
+  ],
+  FORBID_ATTR: ['formaction', 'id', 'name', 'srcdoc', 'xlink:href'],
+  KEEP_CONTENT: true,
+  RETURN_TRUSTED_TYPE: false,
+  SANITIZE_DOM: true,
+  SANITIZE_NAMED_PROPS: true
+};
+
+const COLOR_VALUE = /^(?:#[0-9a-f]{3,8}|[a-z]{1,20}|rgba?\(\s*\d{1,3}\s*,\s*\d{1,3}\s*,\s*\d{1,3}(?:\s*,\s*(?:0|1|0?\.\d+))?\s*\))$/i;
+const LENGTH_VALUE = /^\d+(?:\.\d+)?(?:px|em|rem|%)?$/i;
+const FONT_FAMILY_VALUE = /^[a-z0-9\u4e00-\u9fff ,'-]{1,120}$/i;
+
+const SAFE_STYLE_RULES = {
+  'background-color': COLOR_VALUE,
+  color: COLOR_VALUE,
+  'font-family': FONT_FAMILY_VALUE,
+  'font-size': LENGTH_VALUE,
+  'font-style': /^(?:normal|italic|oblique)$/i,
+  'font-weight': /^(?:normal|bold|bolder|lighter|[1-9]00)$/i,
+  'line-height': LENGTH_VALUE,
+  'list-style-type': /^(?:disc|circle|square|decimal|lower-alpha|upper-alpha|lower-roman|upper-roman|none)$/i,
+  'margin-left': LENGTH_VALUE,
+  'max-width': LENGTH_VALUE,
+  'padding-left': LENGTH_VALUE,
+  'text-align': /^(?:left|right|center|justify)$/i,
+  'text-decoration': /^(?:none|underline|line-through)(?:\s+(?:underline|line-through))*$/i,
+  'text-indent': LENGTH_VALUE,
+  'vertical-align': /^(?:baseline|sub|super|top|text-top|middle|bottom|text-bottom)$/i,
+  'white-space': /^(?:normal|nowrap|pre|pre-wrap|pre-line)$/i
+};
+
+function parseUrl(value) {
+  const url = (value || '').trim();
+  if (!url || /[\u0000-\u001f\u007f]/.test(url)) return null;
+
+  const parser = document.createElement('a');
+  parser.href = url;
+  return parser;
+}
+
+function hasSafeProtocol(value, protocols) {
+  const parser = parseUrl(value);
+  return !!parser && protocols.indexOf(parser.protocol.toLowerCase()) !== -1;
+}
+
+export function isSafeLink(link) {
+  return hasSafeProtocol(link, SAFE_LINK_PROTOCOLS);
+}
+
+export function isSafeMediaSource(source) {
+  return hasSafeProtocol(source, SAFE_PROTOCOLS);
+}
+
+function sanitizeStyle(styleText) {
+  if (!styleText || styleText.length > 500 || /[\\<>{}]|url\s*\(|expression\s*\(|@import|javascript\s*:|data\s*:|-moz-binding|behavior\s*:/i.test(styleText)) {
+    return '';
+  }
+
+  return styleText.split(';').reduce((rules, declaration) => {
+    const separator = declaration.indexOf(':');
+    if (separator === -1) return rules;
+
+    const property = declaration.slice(0, separator).trim().toLowerCase();
+    const value = declaration.slice(separator + 1).trim();
+    const rule = SAFE_STYLE_RULES[property];
+    if (rule && rule.test(value)) rules.push(`${property}: ${value}`);
+    return rules;
+  }, []).join('; ');
+}
+
+function normalizeDimension(element, attribute) {
+  if (!element.hasAttribute(attribute)) return;
+  const value = Number(element.getAttribute(attribute));
+  if (!Number.isInteger(value) || value < 1 || value > 10000) {
+    element.removeAttribute(attribute);
+  }
+}
+
+function normalizeRichText(html) {
+  const template = document.createElement('template');
+  template.innerHTML = html;
+  const elements = Array.prototype.slice.call(template.content.querySelectorAll('*'));
+
+  elements.forEach(element => {
+    const style = sanitizeStyle(element.getAttribute('style'));
+    if (style) element.setAttribute('style', style);
+    else element.removeAttribute('style');
+
+    normalizeDimension(element, 'width');
+    normalizeDimension(element, 'height');
+
+    if (element.tagName === 'A') {
+      if (!isSafeLink(element.getAttribute('href'))) element.removeAttribute('href');
+      if (element.getAttribute('target') === '_blank') {
+        element.setAttribute('rel', 'noopener noreferrer');
+      } else {
+        element.removeAttribute('target');
+        element.removeAttribute('rel');
+      }
+    }
+
+    if (element.tagName === 'IMG') {
+      if (!isSafeMediaSource(element.getAttribute('src'))) {
+        element.parentNode.removeChild(element);
+        return;
+      }
+      element.setAttribute('loading', 'lazy');
+      element.setAttribute('referrerpolicy', 'no-referrer');
+    }
+
+    if (element.tagName === 'IFRAME') {
+      if (!isSafeMediaSource(element.getAttribute('src'))) {
+        element.parentNode.removeChild(element);
+        return;
+      }
+      element.setAttribute('sandbox', 'allow-scripts allow-presentation allow-popups');
+      element.setAttribute('referrerpolicy', 'no-referrer');
+      element.setAttribute('loading', 'lazy');
+    }
+
+    if ((element.tagName === 'VIDEO' || element.tagName === 'SOURCE') &&
+      !isSafeMediaSource(element.getAttribute('src'))) {
+      element.parentNode.removeChild(element);
+    }
+  });
+
+  return template.innerHTML;
+}
+
+export function sanitizeEditorHtml(html) {
+  if (typeof html !== 'string' || html.length > MAX_EDITOR_HTML_LENGTH) return '';
+
+  const sanitized = DOMPurify.sanitize(html, PURIFY_OPTIONS);
+  const normalized = normalizeRichText(sanitized);
+  return DOMPurify.sanitize(normalized, PURIFY_OPTIONS);
+}
+
+export function validateImageFiles(files) {
+  if (!files || files.length < 1 || files.length > MAX_IMAGE_COUNT) return false;
+  return Array.prototype.every.call(files, file => (
+    !!file &&
+    file.size > 0 &&
+    file.size <= MAX_IMAGE_SIZE &&
+    /^(?:image\/jpeg|image\/png|image\/gif)$/i.test(file.type || '')
+  ));
+}