@fynixorg/ui 1.0.13 → 1.0.14

package/dist/plugins/vite-plugin-res.js

@@ -1,6 +1,98 @@
 import { transform } from "esbuild";
 import { normalizePath } from "vite";
 import * as ts from "typescript";
+function sanitizeIdentifier(identifier) {
+    if (typeof identifier !== "string")
+        return "";
+    const sanitized = identifier.replace(/[^a-zA-Z0-9_$]/g, "");
+    if (/^\d/.test(sanitized)) {
+        return "_" + sanitized;
+    }
+    const dangerousWords = [
+        "eval",
+        "Function",
+        "constructor",
+        "prototype",
+        "__proto__",
+        "window",
+        "global",
+        "process",
+        "require",
+        "import",
+        "export",
+        "document",
+        "location",
+        "alert",
+        "confirm",
+        "prompt",
+    ];
+    if (dangerousWords.includes(sanitized)) {
+        return "safe_" + sanitized;
+    }
+    return sanitized || "defaultIdentifier";
+}
+function escapeHTML(str) {
+    if (typeof str !== "string")
+        return "";
+    return str
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#x27;")
+        .replace(/\//g, "&#x2F;")
+        .replace(/`/g, "&#x60;")
+        .replace(/=/g, "&#x3D;");
+}
+function sanitizeCSS(css) {
+    if (typeof css !== "string")
+        return "";
+    return css
+        .replace(/javascript:/gi, "")
+        .replace(/vbscript:/gi, "")
+        .replace(/data:/gi, "")
+        .replace(/expression\s*\(/gi, "")
+        .replace(/@import/gi, "")
+        .replace(/url\s*\(/gi, "")
+        .replace(/behavior\s*:/gi, "");
+}
+function sanitizePath(path) {
+    if (typeof path !== "string")
+        return "";
+    return path
+        .replace(/\.\./g, "")
+        .replace(/~/g, "")
+        .replace(/\\+/g, "/")
+        .replace(/\/+/g, "/")
+        .replace(/^\//g, "")
+        .replace(/\/$/, "");
+}
+function validateTemplateContent(content) {
+    if (typeof content !== "string")
+        return "";
+    const dangerousPatterns = [
+        /\$\{.*?\}/g,
+        /eval\s*\(/gi,
+        /Function\s*\(/gi,
+        /__proto__/gi,
+        /constructor/gi,
+        /import\s*\(/gi,
+        /require\s*\(/gi,
+        /process\./gi,
+        /global\./gi,
+        /<script/gi,
+        /javascript:/gi,
+        /vbscript:/gi,
+        /data:.*script/gi,
+    ];
+    for (const pattern of dangerousPatterns) {
+        if (pattern.test(content)) {
+            console.warn(`[Security] Blocked dangerous pattern in template: ${pattern}`);
+            return "";
+        }
+    }
+    return content;
+}
 const colors = {
     reset: "\x1b[0m",
     red: "\x1b[31m",
@@ -13,6 +105,13 @@ const colors = {
     bold: "\x1b[1m",
 };
 function parseSFC(source) {
+    if (typeof source !== "string" || source.length > 1000000) {
+        throw new Error("Invalid or excessively large SFC source");
+    }
+    const sanitizedSource = validateTemplateContent(source);
+    if (!sanitizedSource) {
+        throw new Error("SFC contains potentially dangerous content");
+    }
     const result = {
         logic: "",
         view: "",
@@ -25,11 +124,14 @@ function parseSFC(source) {
         imports: [],
         exports: [],
     };
-    const logicMatch = source.match(/<logic\s+setup\s*=\s*["']?(ts|js)["']?\s*>([\s\S]*?)<\/logic>/i);
+    const logicMatch = sanitizedSource.match(/<logic\s+setup\s*=\s*["']?(ts|js)["']?\s*>([\s\S]*?)<\/logic>/i);
     if (logicMatch && logicMatch[1] && logicMatch[2] !== undefined) {
         result.hasLogic = true;
         result.logicLang = logicMatch[1].toLowerCase();
         const rawLogic = logicMatch[2].trim();
+        if (rawLogic.length > 100000) {
+            throw new Error("Logic block exceeds size limit");
+        }
         const logicLines = rawLogic.split("\n");
         const imports = [];
         const exports = [];
@@ -40,6 +142,10 @@ function parseSFC(source) {
         for (let i = 0; i < logicLines.length; i++) {
             const line = logicLines[i] ?? "";
             const trimmed = line.trim();
+            if (validateTemplateContent(line) === "") {
+                console.warn(`[Security] Skipped potentially dangerous line in logic block`);
+                continue;
+            }
             if (inExportBlock) {
                 exportBuffer.push(line);
                 const openBraces = ((line && line.match(/{/g)) || []).length;
@@ -85,27 +191,61 @@ function parseSFC(source) {
         result.exports = exports;
         result.logic = otherLogic.join("\n");
     }
-    const viewMatch = source.match(/<view\s*>([\s\S]*?)<\/view>/i);
+    const viewMatch = sanitizedSource.match(/<view\s*>([\s\S]*?)<\/view>/i);
     if (viewMatch && viewMatch[1] !== undefined) {
+        const viewContent = viewMatch[1].trim();
+        if (viewContent.length > 50000) {
+            throw new Error("View block exceeds size limit");
+        }
         result.hasView = true;
-        result.view = viewMatch[1].trim();
+        result.view = viewContent;
     }
-    const styleMatch = source.match(/<style(\s+scoped)?\s*>([\s\S]*?)<\/style>/i);
+    const styleMatch = sanitizedSource.match(/<style(\s+scoped)?\s*>([\s\S]*?)<\/style>/i);
     if (styleMatch && styleMatch[2] !== undefined) {
+        const styleContent = styleMatch[2].trim();
+        if (styleContent.length > 100000) {
+            throw new Error("Style block exceeds size limit");
+        }
         result.hasStyle = true;
         result.isStyleScoped = !!styleMatch[1];
-        result.style = styleMatch[2].trim();
+        result.style = sanitizeCSS(styleContent);
     }
     return result;
 }
 function generateStyleId(filePath) {
+    const safePath = sanitizePath(filePath);
+    if (typeof crypto !== "undefined" && crypto.subtle) {
+        const encoder = new TextEncoder();
+        const data = encoder.encode(safePath + Date.now());
+        let dataHash = 0;
+        for (let i = 0; i < data.length; i++) {
+            const byte = data[i];
+            if (byte !== undefined) {
+                dataHash = (dataHash << 5) - dataHash + byte;
+                dataHash = dataHash & dataHash;
+            }
+        }
+        const combinedInput = safePath + "_security_salt_" + dataHash;
+        let hash = 0;
+        for (let i = 0; i < combinedInput.length; i++) {
+            const char = combinedInput.charCodeAt(i);
+            hash = (hash << 5) - hash + char;
+            hash = hash & hash;
+        }
+        const timestamp = Date.now().toString(36);
+        const hashStr = Math.abs(hash).toString(36);
+        return sanitizeIdentifier(`fynix-${hashStr}-${timestamp}`);
+    }
     let hash = 0;
-    for (let i = 0; i < filePath.length; i++) {
-        const char = filePath.charCodeAt(i);
+    const input = safePath + "_security_salt";
+    for (let i = 0; i < input.length; i++) {
+        const char = input.charCodeAt(i);
         hash = (hash << 5) - hash + char;
         hash = hash & hash;
     }
-    return `fynix-${Math.abs(hash).toString(36)}`;
+    const timestamp = Date.now().toString(36);
+    const hashStr = Math.abs(hash).toString(36);
+    return sanitizeIdentifier(`fynix-${hashStr}-${timestamp}`);
 }
 function scopeStyles(css, scopeId) {
     const dataAttr = `[data-${scopeId}]`;
@@ -155,23 +295,34 @@ function scopeStyles(css, scopeId) {
     return css;
 }
 function transformSFC(parsed, filePath, jsxFactory) {
-    const styleId = generateStyleId(filePath);
+    if (!parsed || typeof parsed !== "object") {
+        throw new Error("Invalid parsed SFC result");
+    }
+    const safeFilePath = sanitizePath(filePath);
+    const safeJsxFactory = sanitizeIdentifier(jsxFactory);
+    if (!safeJsxFactory) {
+        throw new Error("Invalid JSX factory name");
+    }
+    const styleId = generateStyleId(safeFilePath);
     const lines = [];
-    lines.push(`import { ${jsxFactory} } from '@fynixorg/ui';`);
+    lines.push(`import { ${safeJsxFactory} } from '@fynixorg/ui';`);
     if (parsed.imports.length > 0) {
         parsed.imports.forEach((importLine) => {
-            lines.push(importLine);
+            const validatedImport = validateTemplateContent(importLine);
+            if (validatedImport) {
+                lines.push(validatedImport);
+            }
         });
     }
     lines.push("");
     if (parsed.hasStyle) {
-        let processedStyle = parsed.style;
+        let processedStyle = sanitizeCSS(parsed.style);
         if (parsed.isStyleScoped) {
-            processedStyle = scopeStyles(parsed.style, styleId);
+            processedStyle = scopeStyles(processedStyle, styleId);
         }
         lines.push(`// Inject styles`);
         lines.push(`if (typeof document !== 'undefined') {`);
-        lines.push(`  const styleId = '${styleId}';`);
+        lines.push(`  const styleId = ${JSON.stringify(styleId)};`);
         lines.push(`  if (!document.getElementById(styleId)) {`);
         lines.push(`    const styleEl = document.createElement('style');`);
         lines.push(`    styleEl.id = styleId;`);
@@ -183,7 +334,10 @@ function transformSFC(parsed, filePath, jsxFactory) {
     }
     if (parsed.exports.length > 0) {
         parsed.exports.forEach((exportLine) => {
-            lines.push(exportLine);
+            const validatedExport = validateTemplateContent(exportLine);
+            if (validatedExport) {
+                lines.push(validatedExport);
+            }
         });
         lines.push("");
     }
@@ -197,44 +351,58 @@ function transformSFC(parsed, filePath, jsxFactory) {
         lines.push(`  // Component logic`);
         const logicLines = parsed.logic.split("\n");
         logicLines.forEach((line) => {
-            if (line.trim()) {
-                lines.push(`  ${line}`);
+            const validatedLine = validateTemplateContent(line);
+            if (validatedLine && validatedLine.trim()) {
+                lines.push(`  ${validatedLine}`);
             }
         });
         lines.push("");
     }
     if (parsed.exports.some((e) => e.trim().startsWith("export const meta"))) {
         lines.push(`  if (typeof document !== "undefined" && typeof meta !== "undefined") {`);
-        lines.push(`    if (meta.title) document.title = meta.title;`);
+        lines.push(`    if (meta.title) {`);
+        lines.push(`      // Import the escapeHTML function for secure processing`);
+        lines.push(`      const escapeHTML = ${escapeHTML.toString()};`);
+        lines.push(`      const safeTitle = escapeHTML(String(meta.title)).substring(0, 60);`);
+        lines.push(`      document.title = safeTitle;`);
+        lines.push(`    }`);
         lines.push(`    const _meta = meta as any;`);
+        lines.push(`    const escapeHTML = ${escapeHTML.toString()};`);
         lines.push(`    const metaTags = [`);
-        lines.push(`      _meta.description ? { name: "description", content: _meta.description } : null,`);
-        lines.push(`      _meta.keywords ? { name: "keywords", content: _meta.keywords } : null,`);
-        lines.push(`      _meta.ogTitle ? { property: "og:title", content: _meta.ogTitle } : null,`);
-        lines.push(`      _meta.ogDescription ? { property: "og:description", content: _meta.ogDescription } : null,`);
-        lines.push(`      _meta.ogImage ? { property: "og:image", content: _meta.ogImage } : null,`);
+        lines.push(`      _meta.description ? { name: "description", content: escapeHTML(String(_meta.description || '')).substring(0, 300) } : null,`);
+        lines.push(`      _meta.keywords ? { name: "keywords", content: escapeHTML(String(_meta.keywords || '')).substring(0, 200) } : null,`);
+        lines.push(`      _meta.ogTitle ? { property: "og:title", content: escapeHTML(String(_meta.ogTitle || '')).substring(0, 60) } : null,`);
+        lines.push(`      _meta.ogDescription ? { property: "og:description", content: escapeHTML(String(_meta.ogDescription || '')).substring(0, 300) } : null,`);
+        lines.push(`      _meta.ogImage ? { property: "og:image", content: escapeHTML(String(_meta.ogImage || '')).substring(0, 500) } : null,`);
         lines.push(`    ].filter(Boolean);`);
         lines.push(`    metaTags.forEach((tagObj) => {`);
         lines.push(`      if (!tagObj) return;`);
         lines.push(`      const { name, property, content } = tagObj;`);
-        lines.push(`      if (!content) return;`);
+        lines.push(`      if (!content || typeof content !== 'string') return;`);
         lines.push(`      let tag;`);
         lines.push(`      if (name) {`);
-        lines.push("        tag = document.querySelector(`meta[name='${name}']`);");
+        lines.push(`        const safeName = name.replace(/[^a-zA-Z0-9-_]/g, '');`);
+        lines.push(`        if (!safeName) return;`);
+        lines.push("        tag = document.querySelector(`meta[name='${safeName}']`);");
         lines.push(`        if (!tag) {`);
         lines.push(`          tag = document.createElement("meta");`);
-        lines.push(`          tag.setAttribute("name", name);`);
+        lines.push(`          tag.setAttribute("name", safeName);`);
         lines.push(`          document.head.appendChild(tag);`);
         lines.push(`        }`);
         lines.push(`      } else if (property) {`);
-        lines.push("        tag = document.querySelector(`meta[property='${property}']`);");
+        lines.push(`        const safeProperty = property.replace(/[^a-zA-Z0-9-_:]/g, '');`);
+        lines.push(`        if (!safeProperty) return;`);
+        lines.push("        tag = document.querySelector(`meta[property='${safeProperty}']`);");
         lines.push(`        if (!tag) {`);
         lines.push(`          tag = document.createElement("meta");`);
-        lines.push(`          tag.setAttribute("property", property);`);
+        lines.push(`          tag.setAttribute("property", safeProperty);`);
         lines.push(`          document.head.appendChild(tag);`);
         lines.push(`        }`);
         lines.push(`      }`);
-        lines.push(`      if (tag) tag.setAttribute("content", content);`);
+        lines.push(`      if (tag) {`);
+        lines.push(`        // Escape content to prevent XSS using escapeHTML function`);
+        lines.push(`        tag.setAttribute("content", content);`);
+        lines.push(`      }`);
         lines.push(`    });`);
         lines.push(`  }`);
         lines.push("");
@@ -242,7 +410,10 @@ function transformSFC(parsed, filePath, jsxFactory) {
     if (parsed.hasView) {
         lines.push(`  // Component view`);
         if (parsed.isStyleScoped) {
-            let viewContent = parsed.view.trim();
+            let viewContent = validateTemplateContent(parsed.view.trim());
+            if (!viewContent) {
+                throw new Error("View content contains dangerous patterns");
+            }
             const showGeneratedCode = typeof globalThis !== "undefined" &&
                 globalThis.fynixShowGeneratedCode !== undefined
                 ? globalThis.fynixShowGeneratedCode
@@ -258,15 +429,11 @@ function transformSFC(parsed, filePath, jsxFactory) {
                 const closingBracket = tagMatch[3];
                 if (showGeneratedCode) {
                     console.log(`${colors.magenta}[DEBUG] Matched tag:${colors.reset} ${openTag}`);
-                    console.log(`${colors.magenta}[DEBUG] Attributes:${colors.reset} ${attributes}`);
                 }
-                const modifiedStart = `${openTag}${attributes} data-${styleId}=""${closingBracket}`;
+                const safeDataAttr = sanitizeIdentifier(`data-${styleId}`);
+                const modifiedStart = `${openTag}${attributes} ${safeDataAttr}=""${closingBracket}`;
                 const restOfView = viewContent.substring(tagMatch[0].length);
                 const modifiedView = modifiedStart + restOfView;
-                if (showGeneratedCode) {
-                    console.log(`${colors.magenta}[DEBUG] Modified first line:${colors.reset}`);
-                    console.log(modifiedView.split("\n")[0]);
-                }
                 lines.push(`  return (`);
                 const viewLines = modifiedView.split("\n");
                 viewLines.forEach((line) => {
@@ -276,8 +443,8 @@ function transformSFC(parsed, filePath, jsxFactory) {
             }
             else {
                 lines.push(`  return (`);
-                lines.push(`    <div data-${styleId}="">`);
-                const viewLines = parsed.view.split("\n");
+                lines.push(`    <div ${sanitizeIdentifier(`data-${styleId}`)}="">`);
+                const viewLines = viewContent.split("\n");
                 viewLines.forEach((line) => {
                     lines.push(`      ${line}`);
                 });
@@ -286,8 +453,12 @@ function transformSFC(parsed, filePath, jsxFactory) {
             }
         }
         else {
+            const validatedView = validateTemplateContent(parsed.view);
+            if (!validatedView) {
+                throw new Error("View content contains dangerous patterns");
+            }
             lines.push(`  return (`);
-            const viewLines = parsed.view.split("\n");
+            const viewLines = validatedView.split("\n");
             viewLines.forEach((line) => {
                 lines.push(`    ${line}`);
             });
@@ -454,6 +625,11 @@ class TypeScriptChecker {
 }
 export default function fynixPlugin(options = {}) {
     const { jsxFactory = "Fynix", jsxFragment = "Fynix.Fragment", include = [".ts", ".js", ".jsx", ".tsx", ".fnx"], exclude = ["node_modules"], sourcemap = true, esbuildOptions = {}, enableSFC = true, showGeneratedCode = false, typeCheck = false, tsConfig, } = options;
+    const safeJsxFactory = sanitizeIdentifier(jsxFactory);
+    const safeJsxFragment = sanitizeIdentifier(jsxFragment);
+    if (!safeJsxFactory || !safeJsxFragment) {
+        throw new Error("Invalid JSX factory or fragment names provided");
+    }
     let typeChecker = null;
     if (typeCheck) {
         typeChecker = new TypeScriptChecker(tsConfig);
@@ -463,6 +639,14 @@ export default function fynixPlugin(options = {}) {
         enforce: "pre",
         async transform(code, id) {
             const normalizedId = normalizePath(id);
+            const safePath = sanitizePath(normalizedId);
+            if (!safePath || safePath !== normalizedId.replace(/^.*[\/\\]/, "")) {
+                console.warn(`[Security] Potentially dangerous file path blocked: ${normalizedId}`);
+                return null;
+            }
+            if (code.length > 10485760) {
+                throw new Error(`File ${normalizedId} exceeds maximum size limit`);
+            }
             const shouldExclude = exclude.some((pattern) => normalizedId.includes(pattern));
             if (shouldExclude)
                 return null;
@@ -477,10 +661,15 @@ export default function fynixPlugin(options = {}) {
                 let codeToTransform = code;
                 let loader = "tsx";
                 let shouldTypeCheck = false;
+                const validatedCode = validateTemplateContent(code);
+                if (!validatedCode) {
+                    throw new Error(`File contains potentially dangerous content: ${normalizedId}`);
+                }
+                codeToTransform = validatedCode;
                 if (normalizedId.endsWith(".fnx") && enableSFC) {
-                    const parsed = parseSFC(code);
+                    const parsed = parseSFC(codeToTransform);
                     validateSFC(parsed, normalizedId);
-                    codeToTransform = transformSFC(parsed, normalizedId, jsxFactory);
+                    codeToTransform = transformSFC(parsed, normalizedId, safeJsxFactory);
                     if (showGeneratedCode) {
                         console.log(`\n${colors.cyan}${"=".repeat(80)}${colors.reset}`);
                         console.log(`${colors.cyan}[Fynix SFC]${colors.reset} Generated code for: ${colors.gray}${normalizedId}${colors.reset}`);
@@ -532,9 +721,12 @@ export default function fynixPlugin(options = {}) {
                         }
                     }
                 }
+                if (codeToTransform.length > 5242880) {
+                    throw new Error(`Transformed code exceeds size limit for ${normalizedId}`);
+                }
                 const result = await transform(codeToTransform, {
                     loader,
-                    jsxFactory,
+                    jsxFactory: safeJsxFactory,
                     jsxFragment,
                     sourcemap,
                     sourcefile: id,
@@ -585,16 +777,16 @@ export default function fynixPlugin(options = {}) {
         config() {
             const config = {
                 esbuild: {
-                    jsxFactory,
-                    jsxFragment,
-                    jsxInject: `import { ${jsxFactory} } from '@fynixorg/ui'`,
+                    jsxFactory: safeJsxFactory,
+                    jsxFragment: safeJsxFragment,
+                    jsxInject: `import { ${safeJsxFactory} } from '@fynixorg/ui'`,
                 },
                 optimizeDeps: {
                     include: ["@fynixorg/ui"],
                     esbuildOptions: {
                         jsx: "transform",
-                        jsxFactory,
-                        jsxFragment,
+                        jsxFactory: safeJsxFactory,
+                        jsxFragment: safeJsxFragment,
                     },
                 },
                 resolve: {