@file-viewer/renderer-text 2.2.8 → 2.2.9

package/dist/markdown.js

@@ -1,5 +1,35 @@
 import { marked } from 'marked';
+import createDOMPurify from 'dompurify';
 import { createFileViewerZoomChangeEmitter as createZoomChangeEmitter, readFileViewerText as readText, registerFileViewerZoomProvider, resolveFileViewerFitScale, unregisterFileViewerZoomProvider, } from '@file-viewer/core';
+const createSafeTextFragment = (documentRef, value) => {
+    const fragment = documentRef.createDocumentFragment();
+    fragment.append(documentRef.createTextNode(value));
+    return fragment;
+};
+const sanitizeMarkdownHtml = (documentRef, html) => {
+    const windowRef = documentRef.defaultView;
+    if (!windowRef) {
+        return createSafeTextFragment(documentRef, html);
+    }
+    const purifier = createDOMPurify(windowRef);
+    if (!purifier.isSupported) {
+        return createSafeTextFragment(documentRef, html);
+    }
+    return purifier.sanitize(html, {
+        RETURN_DOM_FRAGMENT: true,
+        USE_PROFILES: { html: true },
+        ADD_ATTR: ['target'],
+        FORBID_TAGS: ['style', 'iframe', 'object', 'embed', 'form'],
+        FORBID_ATTR: ['style', 'srcdoc'],
+    });
+};
+const hardenMarkdownLinks = (root) => {
+    root.querySelectorAll('a[target]').forEach(anchor => {
+        if ((anchor.getAttribute('target') || '').trim().toLowerCase() === '_blank') {
+            anchor.rel = 'noopener noreferrer';
+        }
+    });
+};
 const markdownStyle = `
 .markdown-viewer{min-height:100%;padding:28px 16px 48px;background:var(--file-viewer-render-surface-background,#eef1f4);overflow:auto;box-sizing:border-box}
 .markdown-body{color-scheme:light;--bgColor-default:#fff;--bgColor-muted:#f6f8fa;--bgColor-neutral-muted:#818b981f;--borderColor-default:#d1d9e0;--borderColor-muted:#d1d9e0b3;--borderColor-neutral-muted:#d1d9e0b3;--fgColor-default:#1f2328;--fgColor-muted:#59636e;--fgColor-accent:#0969da;background:var(--bgColor-default);border:1px solid rgba(20,35,53,.1);border-radius:12px;margin:0 auto;box-sizing:border-box;min-width:200px;max-width:var(--markdown-max-width,980px);padding:var(--markdown-padding,45px);color:var(--fgColor-default);font-size:var(--markdown-font-size,16px);box-shadow:0 18px 42px rgba(15,23,42,.1)}
@@ -175,7 +205,9 @@ export default async function renderMarkdown(buffer, target, context) {
     root.dataset.viewerZoomProvider = 'markdown';
     const article = document.createElement('article');
     article.className = 'markdown-body';
-    article.innerHTML = await marked(stripMarkdownFrontmatter(text));
+    const renderedHtml = await marked(stripMarkdownFrontmatter(text));
+    article.append(sanitizeMarkdownHtml(article.ownerDocument, renderedHtml));
+    hardenMarkdownLinks(article);
     applyMarkdownZoom(root, zoom);
     root.append(article);
     target.replaceChildren(createStyle(), root);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@file-viewer/renderer-text",
-  "version": "2.2.8",
+  "version": "2.2.9",
   "private": false,
   "type": "module",
   "description": "Standalone code, text, Markdown, patch diff, and Git bundle renderer plugin for File Viewer.",
@@ -57,11 +57,12 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@file-viewer/core": "2.2.8",
+    "@file-viewer/core": "2.2.9",
     "diff2html": "^3.4.56",
+    "dompurify": "^3.4.13",
     "highlight.js": "^11.11.1",
     "marked": "^18.0.5",
-    "mermaid": "^11.15.0",
+    "mermaid": "^11.16.1",
     "pako": "^2.1.0"
   },
   "devDependencies": {