@excalidraw/excalidraw 0.17.1-f597bd3 → 0.17.1-f59b4f6

package/dist/dev/index.js

@@ -6447,17 +6447,20 @@ var init_groups = __esm({
 
 // data/url.ts
 import { sanitizeUrl } from "@braintree/sanitize-url";
-var normalizeLink, isLocalLink, toValidURL;
+var sanitizeHTMLAttribute, normalizeLink, isLocalLink, toValidURL;
 var init_url = __esm({
   "data/url.ts"() {
     "use strict";
     init_define_import_meta_env();
+    sanitizeHTMLAttribute = (html) => {
+      return html.replace(/"/g, """);
+    };
     normalizeLink = (link) => {
       link = link.trim();
       if (!link) {
         return link;
       }
-      return sanitizeUrl(link);
+      return sanitizeUrl(sanitizeHTMLAttribute(link));
     };
     isLocalLink = (link) => {
       return !!(link?.includes(location.origin) || link?.startsWith("/"));
@@ -6979,15 +6982,16 @@ var init_embeddable = __esm({
     init_newElement();
     init_textElement();
     init_typeChecks();
+    init_url();
     embeddedLinkCache = /* @__PURE__ */ new Map();
     RE_YOUTUBE = /^(?:http(?:s)?:\/\/)?(?:www\.)?youtu(?:be\.com|\.be)\/(embed\/|watch\?v=|shorts\/|playlist\?list=|embed\/videoseries\?list=)?([a-zA-Z0-9_-]+)(?:\?t=|&t=|\?start=|&start=)?([a-zA-Z0-9_-]+)?[^\s]*$/;
-    RE_VIMEO = /^(?:http(?:s)?:\/\/)?(?:(?:w){3}.)?(?:player\.)?vimeo\.com\/(?:video\/)?([^?\s]+)(?:\?.*)?$/;
+    RE_VIMEO = /^(?:http(?:s)?:\/\/)?(?:(?:w){3}\.)?(?:player\.)?vimeo\.com\/(?:video\/)?([^?\s]+)(?:\?.*)?$/;
     RE_FIGMA = /^https:\/\/(?:www\.)?figma\.com/;
-    RE_GH_GIST = /^https:\/\/gist\.github\.com/;
-    RE_GH_GIST_EMBED = /^<script[\s\S]*?\ssrc=["'](https:\/\/gist.github.com\/.*?)\.js["']/i;
-    RE_TWITTER = /(?:http(?:s)?:\/\/)?(?:(?:w){3}.)?(?:twitter|x).com/;
-    RE_TWITTER_EMBED = /^<blockquote[\s\S]*?\shref=["'](https:\/\/(?:twitter|x).com\/[^"']*)/i;
-    RE_VALTOWN = /^https:\/\/(?:www\.)?val.town\/(v|embed)\/[a-zA-Z_$][0-9a-zA-Z_$]+\.[a-zA-Z_$][0-9a-zA-Z_$]+/;
+    RE_GH_GIST = /^https:\/\/gist\.github\.com\/([\w_-]+)\/([\w_-]+)/;
+    RE_GH_GIST_EMBED = /^<script[\s\S]*?\ssrc=["'](https:\/\/gist\.github\.com\/.*?)\.js["']/i;
+    RE_TWITTER = /(?:https?:\/\/)?(?:(?:w){3}\.)?(?:twitter|x)\.com\/[^/]+\/status\/(\d+)/;
+    RE_TWITTER_EMBED = /^<blockquote[\s\S]*?\shref=["'](https?:\/\/(?:twitter|x)\.com\/[^"']*)/i;
+    RE_VALTOWN = /^https:\/\/(?:www\.)?val\.town\/(v|embed)\/[a-zA-Z_$][0-9a-zA-Z_$]+\.[a-zA-Z_$][0-9a-zA-Z_$]+/;
     RE_GENERIC_EMBED = /^<(?:iframe|blockquote)[\s\S]*?\s(?:src|href)=["']([^"']*)["'][\s\S]*?>$/i;
     RE_GIPHY = /giphy.com\/(?:clips|embed|gifs)\/[a-zA-Z0-9]*?-?([a-zA-Z0-9]+)(?:[^a-zA-Z0-9]|$)/;
     ALLOWED_DOMAINS = /* @__PURE__ */ new Set([
@@ -7085,50 +7089,38 @@ var init_embeddable = __esm({
         return { link, intrinsicSize: aspectRatio, type };
       }
       if (RE_TWITTER.test(link)) {
-        link = link.replace(/\bx.com\b/, "twitter.com");
-        let ret;
-        if (/<blockquote/.test(link)) {
-          const srcDoc = createSrcDoc(link);
-          ret = {
-            type: "document",
-            srcdoc: () => srcDoc,
-            intrinsicSize: { w: 480, h: 480 }
-          };
-        } else {
-          ret = {
-            type: "document",
-            srcdoc: (theme) => createSrcDoc(
-              `<blockquote class="twitter-tweet" data-dnt="true" data-theme="${theme}"><a href="${link}"></a></blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"><\/script>`
-            ),
-            intrinsicSize: { w: 480, h: 480 }
-          };
-        }
+        const postId = link.match(RE_TWITTER)[1];
+        const safeURL = sanitizeHTMLAttribute(
+          `https://twitter.com/x/status/${postId}`
+        );
+        const ret = {
+          type: "document",
+          srcdoc: (theme) => createSrcDoc(
+            `<blockquote class="twitter-tweet" data-dnt="true" data-theme="${theme}"><a href="${safeURL}"></a></blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"><\/script>`
+          ),
+          intrinsicSize: { w: 480, h: 480 },
+          sandbox: { allowSameOrigin: true }
+        };
         embeddedLinkCache.set(originalLink, ret);
         return ret;
       }
       if (RE_GH_GIST.test(link)) {
-        let ret;
-        if (/<script>/.test(link)) {
-          const srcDoc = createSrcDoc(link);
-          ret = {
-            type: "document",
-            srcdoc: () => srcDoc,
-            intrinsicSize: { w: 550, h: 720 }
-          };
-        } else {
-          ret = {
-            type: "document",
-            srcdoc: () => createSrcDoc(`
-          <script src="${link}.js"><\/script>
+        const [, user, gistId] = link.match(RE_GH_GIST);
+        const safeURL = sanitizeHTMLAttribute(
+          `https://gist.github.com/${user}/${gistId}`
+        );
+        const ret = {
+          type: "document",
+          srcdoc: () => createSrcDoc(`
+          <script src="${safeURL}.js"><\/script>
           <style type="text/css">
             * { margin: 0px; }
             table, .gist { height: 100%; }
             .gist .gist-file { height: calc(100vh - 2px); padding: 0px; display: grid; grid-template-rows: 1fr auto; }
           </style>
         `),
-            intrinsicSize: { w: 550, h: 720 }
-          };
-        }
+          intrinsicSize: { w: 550, h: 720 }
+        };
         embeddedLinkCache.set(link, ret);
         return ret;
       }
@@ -7715,6 +7707,9 @@ var init_staticSvgScene = __esm({
       }
       elements.filter((el) => !isIframeLikeElement(el)).forEach((element) => {
         if (!element.isDeleted) {
+          if (isTextElement(element) && element.containerId && elementsMap.has(element.containerId)) {
+            return;
+          }
           try {
             renderElementToSvg(
               element,
@@ -7726,6 +7721,19 @@ var init_staticSvgScene = __esm({
               element.y + renderConfig.offsetY,
               renderConfig
             );
+            const boundTextElement = getBoundTextElement(element, elementsMap);
+            if (boundTextElement) {
+              renderElementToSvg(
+                boundTextElement,
+                elementsMap,
+                rsvg,
+                svgRoot,
+                files,
+                boundTextElement.x + renderConfig.offsetX,
+                boundTextElement.y + renderConfig.offsetY,
+                renderConfig
+              );
+            }
           } catch (error) {
             console.error(error);
           }
@@ -9061,13 +9069,19 @@ var init_shape = __esm({
         data: polyline
       };
     };
-    getClosedCurveShape = (roughShape, startingPoint = [0, 0], angleInRadian, center) => {
-      const ops = getCurvePathOps2(roughShape);
+    getClosedCurveShape = (element, roughShape, startingPoint = [0, 0], angleInRadian, center) => {
       const transform = (p) => pointRotate(
         [p[0] + startingPoint[0], p[1] + startingPoint[1]],
         angleToDegrees(angleInRadian),
         center
       );
+      if (element.roundness === null) {
+        return {
+          type: "polygon",
+          data: close(element.points.map((p) => transform(p)))
+        };
+      }
+      const ops = getCurvePathOps2(roughShape);
       const points = [];
       let odd = false;
       for (const operation of ops) {
@@ -9292,6 +9306,7 @@ var init_staticScene = __esm({
     init_helpers();
     init_helpers2();
     init_utils();
+    init_textElement();
     strokeGrid = (context, gridSize, scrollX, scrollY, zoom, width, height) => {
       const BOLD_LINE_FREQUENCY = 5;
       let GridLineColor;
@@ -9446,8 +9461,11 @@ var init_staticScene = __esm({
       visibleElements.filter((el) => !isIframeLikeElement(el)).forEach((element) => {
         try {
           const frameId = element.frameId || appState.frameToHighlight?.id;
+          if (isTextElement(element) && element.containerId && elementsMap.has(element.containerId)) {
+            return;
+          }
+          context.save();
           if (frameId && appState.frameRendering.enabled && appState.frameRendering.clip) {
-            context.save();
             const frame = getTargetFrame(element, elementsMap, appState);
             if (frame && isElementInFrame(element, elementsMap, appState)) {
               frameClip(frame, context, renderConfig, appState);
@@ -9461,7 +9479,6 @@ var init_staticScene = __esm({
               renderConfig,
               appState
             );
-            context.restore();
           } else {
             renderElement(
               element,
@@ -9473,6 +9490,19 @@ var init_staticScene = __esm({
               appState
             );
           }
+          const boundTextElement = getBoundTextElement(element, allElementsMap);
+          if (boundTextElement) {
+            renderElement(
+              boundTextElement,
+              elementsMap,
+              allElementsMap,
+              rc,
+              context,
+              renderConfig,
+              appState
+            );
+          }
+          context.restore();
           if (!isExporting) {
             renderLinkIcon(element, context, appState, elementsMap);
           }
@@ -37371,7 +37401,7 @@ var App = class _App extends React38.Component {
                         title: "Excalidraw Embedded Content",
                         allow: "accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture",
                         allowFullScreen: true,
-                        sandbox: "allow-same-origin allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-presentation allow-downloads"
+                        sandbox: `${src?.sandbox?.allowSameOrigin ? "allow-same-origin" : ""} allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-presentation allow-downloads`
                       }
                     )
                   }
@@ -39794,6 +39824,7 @@ var App = class _App extends React38.Component {
           this.scene.getNonDeletedElementsMap()
         );
         return shouldTestInside(element) ? getClosedCurveShape(
+          element,
           roughShape,
           [element.x, element.y],
           element.angle,