@file-viewer/core 2.4.0 → 3.0.1

package/dist/security/svgResources.js

@@ -0,0 +1,177 @@
+const SVG_URL_ATTRIBUTES = new Set(['href', 'xlink:href', 'src', 'poster']);
+const SAFE_EMBEDDED_IMAGE_DATA_URL = /^data:image\/(?:avif|bmp|gif|jpeg|png|webp|x-icon);base64,[A-Za-z0-9+/=\s]+$/i;
+const stripResourceUrlControlCharacters = (value) => {
+    let normalized = '';
+    for (const character of value) {
+        const codePoint = character.charCodeAt(0);
+        if (codePoint <= 0x20 || (codePoint >= 0x7f && codePoint <= 0x9f))
+            continue;
+        normalized += character;
+    }
+    return normalized.trim();
+};
+const isSafeSvgAnchorUrl = (value) => {
+    const normalized = stripResourceUrlControlCharacters(value);
+    if (!normalized)
+        return false;
+    if (/^#[A-Za-z0-9_.:-]+$/.test(normalized))
+        return true;
+    if (/^(?:https?|mailto|tel):/i.test(normalized))
+        return true;
+    return !normalized.includes(':') &&
+        !normalized.startsWith('//') &&
+        !normalized.startsWith('\\');
+};
+const isSafeEmbeddedSvgUrl = (value, allowFragment) => {
+    const normalized = stripResourceUrlControlCharacters(value);
+    if (allowFragment && /^#[A-Za-z0-9_.:-]+$/.test(normalized))
+        return true;
+    if (/^blob:/i.test(normalized))
+        return true;
+    return SAFE_EMBEDDED_IMAGE_DATA_URL.test(normalized);
+};
+const normalizeCssUrl = (value) => {
+    let normalized = value.trim();
+    const quote = normalized[0];
+    if ((quote === '"' || quote === "'") && normalized[normalized.length - 1] === quote) {
+        normalized = normalized.slice(1, -1).trim();
+    }
+    return stripResourceUrlControlCharacters(normalized);
+};
+const isSafeSvgCssUrl = (value) => {
+    const normalized = normalizeCssUrl(value);
+    return /^#[A-Za-z0-9_.:-]+$/.test(normalized) ||
+        /^blob:/i.test(normalized) ||
+        SAFE_EMBEDDED_IMAGE_DATA_URL.test(normalized);
+};
+/**
+ * Keep ordinary SVG styles while preventing imports and resource requests.
+ * Obfuscated URL tokens fail closed instead of depending on parser quirks.
+ */
+export const sanitizeFileViewerSvgCss = (value) => {
+    const normalizedCharacters = [];
+    for (const character of value) {
+        const codePoint = character.charCodeAt(0);
+        const disallowedControl = codePoint <= 0x08 || codePoint === 0x0b || codePoint === 0x0c ||
+            (codePoint >= 0x0e && codePoint <= 0x1f) || (codePoint >= 0x7f && codePoint <= 0x9f);
+        if (!disallowedControl)
+            normalizedCharacters.push(character);
+    }
+    const normalized = normalizedCharacters.join('');
+    if (normalized.includes('\\') || normalized.includes('/*') || /@import\b/i.test(normalized)) {
+        return '';
+    }
+    const chunks = [];
+    let segmentStart = 0;
+    let cursor = 0;
+    while (cursor < normalized.length) {
+        const hasUrlPrefix = (normalized.charCodeAt(cursor) | 0x20) === 0x75 &&
+            (normalized.charCodeAt(cursor + 1) | 0x20) === 0x72 &&
+            (normalized.charCodeAt(cursor + 2) | 0x20) === 0x6c;
+        if (!hasUrlPrefix) {
+            cursor += 1;
+            continue;
+        }
+        let open = cursor + 3;
+        while (open < normalized.length && normalized[open].trim() === '')
+            open += 1;
+        if (normalized[open] !== '(') {
+            cursor += 1;
+            continue;
+        }
+        let close = open + 1;
+        while (close < normalized.length && normalized[close] !== ')')
+            close += 1;
+        if (close >= normalized.length)
+            return '';
+        const target = normalized.slice(open + 1, close);
+        chunks.push(normalized.slice(segmentStart, cursor));
+        chunks.push(isSafeSvgCssUrl(target) ? `url(${target})` : 'none');
+        cursor = close + 1;
+        segmentStart = cursor;
+    }
+    chunks.push(normalized.slice(segmentStart));
+    return chunks.join('');
+};
+/** Remove executable attributes and every SVG resource URL that can load data remotely. */
+export const sanitizeFileViewerSvgResources = (root) => {
+    root.querySelectorAll('*').forEach(element => {
+        for (const attribute of Array.from(element.attributes)) {
+            const name = attribute.name.toLowerCase();
+            if (name.startsWith('on') || name === 'srcdoc') {
+                element.removeAttribute(attribute.name);
+                continue;
+            }
+            if (name === 'style') {
+                const sanitizedStyle = sanitizeFileViewerSvgCss(attribute.value);
+                if (sanitizedStyle) {
+                    element.setAttribute(attribute.name, sanitizedStyle);
+                }
+                else {
+                    element.removeAttribute(attribute.name);
+                }
+                continue;
+            }
+            if (SVG_URL_ATTRIBUTES.has(name)) {
+                const localName = element.localName.toLowerCase();
+                const isAnchor = localName === 'a' && name === 'href';
+                const allowFragment = localName === 'use' || localName === 'mpath';
+                const safe = isAnchor
+                    ? isSafeSvgAnchorUrl(attribute.value)
+                    : isSafeEmbeddedSvgUrl(attribute.value, allowFragment);
+                if (safe) {
+                    attribute.value = stripResourceUrlControlCharacters(attribute.value);
+                }
+                else {
+                    element.removeAttribute(attribute.name);
+                }
+                continue;
+            }
+            if (/url\s*\(/i.test(attribute.value)) {
+                const sanitizedValue = sanitizeFileViewerSvgCss(attribute.value);
+                if (sanitizedValue) {
+                    element.setAttribute(attribute.name, sanitizedValue);
+                }
+                else {
+                    element.removeAttribute(attribute.name);
+                }
+            }
+        }
+    });
+    root.querySelectorAll('style').forEach(style => {
+        const sanitizedStyle = sanitizeFileViewerSvgCss(style.textContent || '');
+        if (sanitizedStyle) {
+            style.textContent = sanitizedStyle;
+        }
+        else {
+            style.remove();
+        }
+    });
+};
+const canonicalizeMermaidSourceForResourceScan = (source) => {
+    let output = '';
+    for (const character of source) {
+        const codePoint = character.charCodeAt(0);
+        if (codePoint === 0 || (codePoint >= 0x7f && codePoint <= 0x9f))
+            continue;
+        output += codePoint < 0x20 && character !== '\n' && character !== '\r' && character !== '\t'
+            ? ' '
+            : character;
+    }
+    return output;
+};
+/**
+ * Mermaid 11 resolves image-node URLs with `new Image()` while rendering,
+ * before its SVG can be sanitized. Reject image metadata and explicit remote
+ * URLs before calling Mermaid so an untrusted diagram cannot initiate I/O.
+ */
+export const assertFileViewerMermaidSourceHasNoExternalResources = (source) => {
+    const normalized = canonicalizeMermaidSourceForResourceScan(String(source || ''));
+    const compact = normalized.replace(/[\t\r\n ]+/g, '');
+    const hasImageMetadata = /(?:^|[,{])\s*(?:img|["']img["'])\s*:/im.test(normalized);
+    const hasRemoteUrl = /(?:https?|ftp):\/\//i.test(compact) ||
+        /(?:^|[\s"'(=:,])(?:\/\/|\\\\)[A-Za-z0-9]/m.test(normalized);
+    if (hasImageMetadata || hasRemoteUrl) {
+        throw new Error('Mermaid diagrams may not load external image resources.');
+    }
+};

package/dist/viewer/createViewer.js

@@ -319,6 +319,47 @@ export const createViewer = (container, createOptions = {}) => {
             registerHandler,
         });
     };
+    const renderNestedBuffer = async (buffer, type, target, context) => {
+        var _a;
+        const inheritedOptions = (context === null || context === void 0 ? void 0 : context.options) || options;
+        const nestedViewer = createViewer(target, {
+            registry,
+            options: {
+                ...inheritedOptions,
+                // The parent already resolved its renderer assembly into `registry`.
+                // Reuse that exact registry without reinstalling presets or mutating a
+                // shared registry while an attachment is open.
+                autoRenderers: false,
+                rendererMode: 'extend',
+                renderers: undefined,
+                preset: undefined,
+                presets: undefined,
+            },
+            signal: context === null || context === void 0 ? void 0 : context.signal,
+            renderPurpose: (context === null || context === void 0 ? void 0 : context.renderPurpose) || createOptions.renderPurpose || 'preview',
+        });
+        try {
+            await nestedViewer.load({
+                buffer,
+                filename: (context === null || context === void 0 ? void 0 : context.filename) || `attachment.${type || 'bin'}`,
+                type,
+            }, {
+                signal: context === null || context === void 0 ? void 0 : context.signal,
+            });
+            if ((_a = context === null || context === void 0 ? void 0 : context.signal) === null || _a === void 0 ? void 0 : _a.aborted) {
+                await nestedViewer.destroy('replace');
+                return undefined;
+            }
+            return {
+                $el: target,
+                destroy: () => nestedViewer.destroy('component-unmount'),
+            };
+        }
+        catch (error) {
+            await nestedViewer.destroy('replace');
+            throw error;
+        }
+    };
     const buildCurrentLifecycleContext = () => {
         const source = currentSource || normalizeSource({});
         return buildFileViewerLifecycleContextFromNormalizedSource({
@@ -514,6 +555,7 @@ export const createViewer = (container, createOptions = {}) => {
                     },
                     renderContext: {
                         renderPurpose: createOptions.renderPurpose || 'preview',
+                        renderNestedBuffer,
                     },
                 });
             }

package/dist/viewer/operations.d.ts

@@ -87,6 +87,7 @@ export declare const resolveFileViewerOriginalFilename: (source: FileViewerOrigi
 export declare const resolveFileViewerOperationFilename: ({ filename, source, fallback, }: ResolveFileViewerOperationFilenameInput) => string;
 export declare const resolveFileViewerOperationActionErrorMessage: ({ context, formatErrorMessage, prefixes, i18n, }: ResolveFileViewerOperationActionErrorMessageInput) => string;
 export declare const hasFileViewerOriginalSource: (source: FileViewerOriginalSourceState) => boolean;
+export declare const replaceFileViewerPrintDocument: (targetDocument: Document, sanitizedRoot: HTMLHtmlElement) => void;
 export declare const executeFileViewerDownloadOperation: ({ source, filename, beforeOperation, i18n, throwOnMissingSource, }: ExecuteFileViewerDownloadOperationInput) => Promise<boolean>;
 export declare const executeFileViewerExportHtmlOperation: ({ download, filename, beforeOperation, i18n, ...input }: ExecuteFileViewerExportHtmlOperationInput) => Promise<string>;
 export declare const executeFileViewerPrintOperation: ({ autoPrint, beforeOperation, i18n, openWindow, printAvailable, printWindow, ...input }: ExecuteFileViewerPrintOperationInput) => Promise<boolean>;

package/dist/viewer/operations.js

@@ -1,4 +1,4 @@
-import { buildFileViewerRenderedHtmlDocument, triggerFileViewerBlobDownload, triggerFileViewerUrlDownload, waitForFileViewerPrintWindowReady, } from '../output/export.js';
+import { triggerFileViewerBlobDownload, triggerFileViewerUrlDownload, waitForFileViewerPrintWindowReady, } from '../output/export.js';
 import { DEFAULT_FILE_VIEWER_SOURCE_FILENAME } from '../source/index.js';
 import { translateFileViewerMessage, } from '../i18n/messages.js';
 export const DEFAULT_FILE_VIEWER_PREVIEW_TITLE = 'file-viewer-preview';
@@ -65,6 +65,7 @@ const buildRenderedHtmlDocumentFromOperation = async (mode, { source, title, fil
     if (!source) {
         throw new Error(translateFileViewerMessage(i18n, 'error.noExportContent'));
     }
+    const { buildFileViewerRenderedHtmlDocument } = await import('../export.js');
     return buildFileViewerRenderedHtmlDocument({
         source,
         mode,
@@ -77,6 +78,69 @@ const buildRenderedHtmlDocumentFromOperation = async (mode, { source, title, fil
         mask: mode === 'print' ? mask : null,
     });
 };
+const buildRenderedDomDocumentFromOperation = async ({ source, title, filename, adapter = null, watermarkInlineStyle, mask = null, i18n, }) => {
+    if (!source) {
+        throw new Error(translateFileViewerMessage(i18n, 'error.noExportContent'));
+    }
+    const { buildFileViewerRenderedDomDocument } = await import('../export.js');
+    return buildFileViewerRenderedDomDocument({
+        source,
+        mode: 'print',
+        title: resolveFileViewerOperationFilename({
+            filename: title || filename,
+            fallback: DEFAULT_FILE_VIEWER_PREVIEW_TITLE,
+        }),
+        adapter,
+        watermarkInlineStyle,
+        mask,
+    });
+};
+export const replaceFileViewerPrintDocument = (targetDocument, sanitizedRoot) => {
+    const importedRoot = targetDocument.importNode(sanitizedRoot, true);
+    const currentRoot = targetDocument.documentElement;
+    if (currentRoot) {
+        currentRoot.replaceWith(importedRoot);
+    }
+    else {
+        targetDocument.append(importedRoot);
+    }
+    if (!targetDocument.doctype) {
+        targetDocument.insertBefore(targetDocument.implementation.createDocumentType('html', '', ''), importedRoot);
+    }
+};
+const FILE_VIEWER_PRINT_STANDARDS_DOCUMENT = '<!doctype html><html lang="en"><head><meta charset="utf-8"></head><body></body></html>';
+const ensureFileViewerPrintStandardsMode = async (targetWindow) => {
+    if (targetWindow.document.compatMode === 'CSS1Compat') {
+        return;
+    }
+    const targetGlobal = targetWindow;
+    const objectUrl = targetGlobal.URL.createObjectURL(new targetGlobal.Blob([FILE_VIEWER_PRINT_STANDARDS_DOCUMENT], {
+        type: 'text/html;charset=utf-8',
+    }));
+    try {
+        await new Promise((resolve, reject) => {
+            let settled = false;
+            const finish = () => {
+                if (settled)
+                    return;
+                settled = true;
+                globalThis.clearTimeout(timeoutId);
+                if (targetWindow.document.compatMode === 'CSS1Compat') {
+                    resolve();
+                }
+                else {
+                    reject(new Error('Unable to initialize the print window in standards mode.'));
+                }
+            };
+            const timeoutId = globalThis.setTimeout(finish, 1500);
+            targetWindow.addEventListener('load', finish, { once: true });
+            targetWindow.location.replace(objectUrl);
+        });
+    }
+    finally {
+        targetGlobal.URL.revokeObjectURL(objectUrl);
+    }
+};
 export const executeFileViewerDownloadOperation = async ({ source, filename, beforeOperation, i18n, throwOnMissingSource = true, }) => {
     var _a;
     if (!hasFileViewerOriginalSource(source)) {
@@ -145,16 +209,15 @@ export const executeFileViewerPrintOperation = async ({ autoPrint = true, before
     if (!await runBeforeOperation(beforeOperation, 'print')) {
         return false;
     }
-    const html = await buildRenderedHtmlDocumentFromOperation('print', { ...input, i18n });
+    const printableRoot = await buildRenderedDomDocumentFromOperation({ ...input, i18n });
     const targetWindow = printWindow ||
         (openWindow === null || openWindow === void 0 ? void 0 : openWindow()) ||
         (typeof window !== 'undefined' ? window.open('', '_blank') : null);
     if (!targetWindow) {
         throw new Error(translateFileViewerMessage(i18n, 'error.printWindowBlocked'));
     }
-    targetWindow.document.open();
-    targetWindow.document.write(html);
-    targetWindow.document.close();
+    await ensureFileViewerPrintStandardsMode(targetWindow);
+    replaceFileViewerPrintDocument(targetWindow.document, printableRoot);
     targetWindow.focus();
     await waitForFileViewerPrintWindowReady(targetWindow);
     if (autoPrint !== false) {

package/dist/viewer/state.js

@@ -47,6 +47,7 @@ const rendererPackageById = {
     ofd: '@file-viewer/renderer-ofd',
     typst: '@file-viewer/renderer-typst',
     archive: '@file-viewer/renderer-archive',
+    chm: '@file-viewer/renderer-chm',
     email: '@file-viewer/renderer-email',
     eda: '@file-viewer/renderer-eda',
     cad: '@file-viewer/renderer-cad',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@file-viewer/core",
-  "version": "2.4.0",
+  "version": "3.0.1",
   "private": false,
   "type": "module",
   "description": "Framework-neutral modular TypeScript core for File Viewer renderer orchestration, lifecycle APIs, search, zoom, print, and export",
@@ -62,6 +62,11 @@
       "import": "./dist/browser.js",
       "default": "./dist/browser.js"
     },
+    "./export": {
+      "types": "./dist/export.d.ts",
+      "import": "./dist/export.js",
+      "default": "./dist/export.js"
+    },
     "./print-mask": {
       "types": "./dist/print-mask.d.ts",
       "import": "./dist/print-mask.js",
@@ -84,6 +89,9 @@
     "README.en.md",
     "LICENSE"
   ],
+  "dependencies": {
+    "dompurify": "3.4.14"
+  },
   "devDependencies": {
     "typescript": "^6.0.3"
   },