@file-viewer/doc 2.3.0 → 2.3.1

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { parseMsDoc } from './msdoc/parser.js';
-export { renderMsDoc, defaultMsDocCss } from './render/html.js';
-export { createMsDocViewer, mountMsDoc, parseMsDocToHtml } from './viewer.js';
+export { renderMsDoc, defaultMsDocCss, sanitizeMsDocLinkHref } from './render/html.js';
+export { createMsDocViewer, mountMsDoc, parseMsDocToHtml, sanitizeMsDocHtml } from './viewer.js';
 export { MsDocWorkerClient } from './worker-client.js';
 export type * from './types.js';

package/dist/index.js

@@ -1,4 +1,4 @@
 export { parseMsDoc } from './msdoc/parser.js';
-export { renderMsDoc, defaultMsDocCss } from './render/html.js';
-export { createMsDocViewer, mountMsDoc, parseMsDocToHtml } from './viewer.js';
+export { renderMsDoc, defaultMsDocCss, sanitizeMsDocLinkHref } from './render/html.js';
+export { createMsDocViewer, mountMsDoc, parseMsDocToHtml, sanitizeMsDocHtml } from './viewer.js';
 export { MsDocWorkerClient } from './worker-client.js';

package/dist/render/html.d.ts

@@ -1,4 +1,11 @@
 import type { MsDocParseResult, MsDocRenderOptions, MsDocRenderResult } from '../types.js';
+type ExternalLinkPolicy = NonNullable<MsDocRenderOptions['externalLinkPolicy']>;
+/**
+ * Normalizes a document-provided hyperlink before it reaches generated HTML.
+ * Internal bookmarks always remain available. External navigation is opt-in
+ * and is still restricted to browser-safe schemes and relative paths.
+ */
+export declare function sanitizeMsDocLinkHref(href: string | undefined | null, policy?: ExternalLinkPolicy): string | null;
 export declare function defaultMsDocCss(): string;
 /**
  * Converts the parsed AST into HTML and a companion CSS string.
@@ -6,3 +13,4 @@ export declare function defaultMsDocCss(): string;
  * to customize styles or consume the AST directly.
  */
 export declare function renderMsDoc(parsed: MsDocParseResult, options?: MsDocRenderOptions): MsDocRenderResult;
+export {};

package/dist/render/html.js

@@ -22,9 +22,51 @@ const COLOR_INDEX_MAP = {
 function styleObjectToCss(style) {
     return Object.entries(style)
         .filter(([, value]) => value != null && value !== '')
-        .map(([key, value]) => `${key}:${value}`)
+        .map(([key, value]) => `${key}:${escapeHtml(value)}`)
         .join(';');
 }
+function quoteCssString(value) {
+    const escaped = String(value ?? '')
+        .replace(/\\/g, '\\\\')
+        .replace(/'/g, "\\'")
+        .replace(/[\n\r\f]/g, ' ')
+        .replace(/[\u0000-\u001f\u007f-\u009f]/g, ' ');
+    return `'${escaped}'`;
+}
+/**
+ * Normalizes a document-provided hyperlink before it reaches generated HTML.
+ * Internal bookmarks always remain available. External navigation is opt-in
+ * and is still restricted to browser-safe schemes and relative paths.
+ */
+export function sanitizeMsDocLinkHref(href, policy = 'block') {
+    const value = String(href ?? '')
+        .replace(/[\u0000-\u0020\u007f-\u009f]/g, '')
+        .trim();
+    if (!value)
+        return null;
+    if (value.startsWith('#'))
+        return value;
+    if (policy !== 'allow')
+        return null;
+    if (/^(?:https?:|mailto:|tel:)/i.test(value))
+        return value;
+    if (value.startsWith('//') || value.startsWith('\\'))
+        return null;
+    if (/^(?:\/|\.\/|\.\.\/)/.test(value) && !value.startsWith('//') && !value.startsWith('\\\\')) {
+        return value;
+    }
+    if (!/^[a-z][a-z\d+.-]*:/i.test(value) && !value.startsWith('\\'))
+        return value;
+    return null;
+}
+function renderLink(content, href) {
+    if (!href)
+        return content;
+    const escapedHref = escapeHtml(href);
+    if (href.startsWith('#'))
+        return `<a class="msdoc-link" href="${escapedHref}">${content}</a>`;
+    return `<a class="msdoc-link" href="${escapedHref}" target="_blank" rel="noreferrer noopener">${content}</a>`;
+}
 function borderToCss(border) {
     if (!border || border.nil)
         return null;
@@ -167,7 +209,7 @@ function inlineStyleToCss(styleState) {
     if (styleState.fontSizeHalfPoints)
         style['font-size'] = `${styleState.fontSizeHalfPoints / 2}pt`;
     if (styleState.fontFamily)
-        style['font-family'] = `'${String(styleState.fontFamily).replace(/'/g, "\\'")}', sans-serif`;
+        style['font-family'] = `${quoteCssString(styleState.fontFamily)},sans-serif`;
     if (styleState.colorIndex && COLOR_INDEX_MAP[styleState.colorIndex])
         style.color = COLOR_INDEX_MAP[styleState.colorIndex];
     const highlightIndex = typeof styleState.highlight === 'number' ? styleState.highlight : styleState.highlight?.index;
@@ -196,16 +238,13 @@ function inlineStyleToCss(styleState) {
         style.direction = 'rtl';
     return style;
 }
-function renderTextNode(node) {
+function renderTextNode(node, context) {
     const content = escapeHtml(node.text);
     const inlineStyle = inlineStyleToCss(node.style);
     inlineStyle['white-space'] = 'break-spaces';
     const style = styleObjectToCss(inlineStyle);
     const inner = `<span${style ? ` style="${style}"` : ''}>${content}</span>`;
-    if (node.href) {
-        return `<a class="msdoc-link" href="${escapeHtml(node.href)}" target="_blank" rel="noreferrer noopener">${inner}</a>`;
-    }
-    return inner;
+    return renderLink(inner, sanitizeMsDocLinkHref(node.href, context.externalLinkPolicy));
 }
 function inlineImageDisplaySizePx(asset) {
     const widthPx = twipsToPx(asset.meta?.displayWidthTwips);
@@ -234,15 +273,31 @@ function sanitizeImageSource(src) {
         return value;
     return null;
 }
-function sanitizeAssetHref(href) {
-    const value = String(href || '').trim();
+function sanitizeDownloadHref(href) {
+    const value = String(href ?? '').trim();
     if (!value)
         return null;
-    if (/^(?:data:|blob:|https?:)/i.test(value))
+    const dataUrl = /^data:([^;,]+);base64,([a-z\d+/=\s]+)$/i.exec(value);
+    if (!dataUrl)
+        return null;
+    const mimeType = dataUrl[1].trim().toLowerCase();
+    if (/^(?:text\/(?:html|javascript)|application\/(?:javascript|xhtml\+xml|xml)|image\/svg\+xml)$/.test(mimeType)) {
+        return null;
+    }
+    if (mimeType.endsWith('+xml'))
+        return null;
+    return value;
+}
+function sanitizeAssetHref(href, context) {
+    const downloadHref = sanitizeDownloadHref(href);
+    if (downloadHref)
+        return downloadHref;
+    const value = sanitizeMsDocLinkHref(href, context.externalLinkPolicy);
+    if (value && !value.startsWith('#'))
         return value;
     return null;
 }
-function renderImageNode(node) {
+function renderImageNode(node, context) {
     const src = sanitizeImageSource(node.asset.sourceUrl) || sanitizeImageSource(node.asset.dataUrl);
     const baseStyle = inlineStyleToCss(node.style);
     const displaySize = inlineImageDisplaySizePx(node.asset);
@@ -257,38 +312,33 @@ function renderImageNode(node) {
         baseStyle.height = 'auto';
     }
     if (!src || node.asset.displayable === false) {
-        const fallbackHref = sanitizeAssetHref(node.asset.dataUrl) || sanitizeAssetHref(node.asset.sourceUrl);
+        const fallbackHref = sanitizeAssetHref(node.asset.dataUrl, context) || sanitizeAssetHref(node.asset.sourceUrl, context);
         const label = escapeHtml(String(node.asset.meta?.linkedPath || node.asset.mime || 'image'));
         const inner = fallbackHref
             ? `<a class="msdoc-attachment msdoc-image-fallback" href="${escapeHtml(fallbackHref)}" target="_blank" rel="noreferrer noopener">🖼 ${label}</a>`
             : `<span class="msdoc-image-fallback">🖼 ${label}</span>`;
-        if (node.href) {
-            return `<a class="msdoc-link" href="${escapeHtml(node.href)}" target="_blank" rel="noreferrer noopener">${inner}</a>`;
-        }
-        return inner;
+        return renderLink(inner, sanitizeMsDocLinkHref(node.href, context.externalLinkPolicy));
     }
     const img = `<img class="msdoc-image" src="${escapeHtml(src)}" alt="" style="${styleObjectToCss(baseStyle)}">`;
-    if (node.href) {
-        return `<a class="msdoc-link" href="${escapeHtml(node.href)}" target="_blank" rel="noreferrer noopener">${img}</a>`;
-    }
-    return img;
+    return renderLink(img, sanitizeMsDocLinkHref(node.href, context.externalLinkPolicy));
 }
-function renderAttachmentNode(node) {
+function renderAttachmentNode(node, context) {
     const label = escapeHtml(node.asset.name || 'embedded-file');
-    const inner = `<a class="msdoc-attachment" href="${escapeHtml(node.asset.dataUrl)}" download="${label}">📎 ${label}</a>`;
-    if (node.href) {
-        return `<a class="msdoc-link" href="${escapeHtml(node.href)}" target="_blank" rel="noreferrer noopener">${inner}</a>`;
-    }
-    return inner;
+    const downloadHref = sanitizeDownloadHref(node.asset.dataUrl);
+    const inner = downloadHref
+        ? `<a class="msdoc-attachment" href="${escapeHtml(downloadHref)}" download="${label}">📎 ${label}</a>`
+        : `<span class="msdoc-attachment">📎 ${label}</span>`;
+    const href = sanitizeMsDocLinkHref(node.href, context.externalLinkPolicy);
+    return href ? `<span class="msdoc-inline-group">${inner}${renderLink('↗', href)}</span>` : inner;
 }
-function renderInlineNodes(nodes) {
+function renderInlineNodes(nodes, context) {
     return nodes.map((node) => {
         if (node.type === 'text')
-            return renderTextNode(node);
+            return renderTextNode(node, context);
         if (node.type === 'image')
-            return renderImageNode(node);
+            return renderImageNode(node, context);
         if (node.type === 'attachment')
-            return renderAttachmentNode(node);
+            return renderAttachmentNode(node, context);
         if (node.type === 'lineBreak')
             return '<br>';
         if (node.type === 'pageBreak')
@@ -296,10 +346,10 @@ function renderInlineNodes(nodes) {
         return '';
     }).join('');
 }
-function renderParagraphBlock(block, options = {}) {
+function renderParagraphBlock(block, context, options = {}) {
     const tag = options.inline ? 'div' : 'p';
     const style = styleObjectToCss(paragraphStyleToCss(block.paraState));
-    const body = renderInlineNodes(block.inlines || []);
+    const body = renderInlineNodes(block.inlines || [], context);
     const empty = body || '<br>';
     const classNames = ['msdoc-paragraph'];
     if (block.styleName)
@@ -380,7 +430,7 @@ function tableStyle(block) {
     style['table-layout'] = 'fixed';
     return style;
 }
-function renderTableBlock(block) {
+function renderTableBlock(block, context) {
     const rows = block.rows.map((row) => {
         const rowHeight = row.state?.rowHeight ? twipsToPx(Math.abs(row.state.rowHeight)) : null;
         const rowStyle = rowHeight ? ` style="height:${rowHeight}px"` : '';
@@ -393,7 +443,7 @@ function renderTableBlock(block) {
             if ((cell.rowspan ?? 1) > 1)
                 attrs.push(` rowspan="${cell.rowspan}"`);
             const style = styleObjectToCss(cellStyle(cell));
-            const body = cell.paragraphs.map((paragraph) => renderParagraphBlock(paragraph, { inline: true })).join('');
+            const body = cell.paragraphs.map((paragraph) => renderParagraphBlock(paragraph, context, { inline: true })).join('');
             return `<td class="msdoc-cell"${attrs.join('')}${style ? ` style="${style}"` : ''}>${body || '<div class="msdoc-paragraph"><br></div>'}</td>`;
         })
             .join('');
@@ -402,7 +452,14 @@ function renderTableBlock(block) {
     return `<table class="msdoc-table msdoc-table-depth-${block.depth}" style="${styleObjectToCss(tableStyle(block))}"><tbody>${rows}</tbody></table>`;
 }
 function renderAttachmentsBlock(block) {
-    const items = block.items.map((item) => `<li><a class="msdoc-attachment" href="${escapeHtml(item.dataUrl)}" download="${escapeHtml(item.name || 'embedded-file')}">📎 ${escapeHtml(item.name || 'embedded-file')}</a></li>`).join('');
+    const items = block.items.map((item) => {
+        const label = escapeHtml(item.name || 'embedded-file');
+        const downloadHref = sanitizeDownloadHref(item.dataUrl);
+        const content = downloadHref
+            ? `<a class="msdoc-attachment" href="${escapeHtml(downloadHref)}" download="${label}">📎 ${label}</a>`
+            : `<span class="msdoc-attachment">📎 ${label}</span>`;
+        return `<li>${content}</li>`;
+    }).join('');
     return `<section class="msdoc-attachments"><div class="msdoc-attachments-title">Embedded attachments</div><ul>${items}</ul></section>`;
 }
 export function defaultMsDocCss() {
@@ -430,11 +487,14 @@ export function defaultMsDocCss() {
  */
 export function renderMsDoc(parsed, options = {}) {
     const css = options.css ?? defaultMsDocCss();
+    const context = {
+        externalLinkPolicy: options.externalLinkPolicy ?? 'block',
+    };
     const html = parsed.blocks.map((block) => {
         if (block.type === 'paragraph')
-            return renderParagraphBlock(block);
+            return renderParagraphBlock(block, context);
         if (block.type === 'table')
-            return renderTableBlock(block);
+            return renderTableBlock(block, context);
         if (block.type === 'attachments')
             return renderAttachmentsBlock(block);
         return '';

package/dist/types.d.ts

@@ -617,6 +617,8 @@ export interface MsDocParseOptions {
 }
 export interface MsDocRenderOptions {
     css?: string;
+    /** External links are blocked by default; internal document bookmarks remain active. */
+    externalLinkPolicy?: 'allow' | 'block';
 }
 export interface MsDocMeta {
     fib: {

package/dist/viewer.d.ts

@@ -1,4 +1,5 @@
 import type { MsDocParseToHtmlOptions, MsDocRenderResult, MsDocViewer, MsDocViewerConfig, ViewerInput } from './types.js';
+export declare function sanitizeMsDocHtml(html: string, targetWindow: Window): DocumentFragment;
 export declare function mountMsDoc(container: HTMLElement, rendered: MsDocRenderResult): HTMLElement;
 export declare function parseMsDocToHtml(input: ViewerInput, options?: MsDocParseToHtmlOptions): Promise<MsDocRenderResult>;
 /**

package/dist/viewer.js

@@ -1,3 +1,4 @@
+import createDOMPurify from 'dompurify';
 import { parseMsDoc } from './msdoc/parser.js';
 import { renderMsDoc } from './render/html.js';
 async function normalizeInput(input) {
@@ -19,10 +20,28 @@ async function normalizeInput(input) {
     }
     throw new TypeError('Unsupported input type');
 }
+export function sanitizeMsDocHtml(html, targetWindow) {
+    const purifier = createDOMPurify(targetWindow);
+    return purifier.sanitize(html, {
+        RETURN_DOM_FRAGMENT: true,
+        USE_PROFILES: { html: true },
+        FORBID_TAGS: ['base', 'embed', 'form', 'iframe', 'object', 'script', 'style', 'template'],
+        FORBID_ATTR: ['action', 'formaction', 'srcdoc'],
+    });
+}
 export function mountMsDoc(container, rendered) {
     if (!container)
         throw new Error('A container element is required');
-    container.innerHTML = `<style data-msdoc>${rendered.css}</style><div class="msdoc-root">${rendered.html}</div>`;
+    const targetWindow = container.ownerDocument.defaultView;
+    if (!targetWindow)
+        throw new Error('The container must belong to a browser document');
+    const style = container.ownerDocument.createElement('style');
+    style.dataset.msdoc = '';
+    style.textContent = rendered.css;
+    const root = container.ownerDocument.createElement('div');
+    root.className = 'msdoc-root';
+    root.append(sanitizeMsDocHtml(rendered.html, targetWindow));
+    container.replaceChildren(style, root);
     return container;
 }
 export async function parseMsDocToHtml(input, options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@file-viewer/doc",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "private": false,
   "type": "module",
   "description": "Browser-native legacy MS-DOC (.doc) parser and HTML renderer extracted from the public msdoc-viewer 0.2.0 line.",
@@ -61,6 +61,9 @@
     "README.en.md",
     "LICENSE"
   ],
+  "dependencies": {
+    "dompurify": "^3.4.13"
+  },
   "devDependencies": {
     "typescript": "^6.0.3"
   },