@gilav21/shadcn-angular-rte 0.2.0 → 0.2.1

package/fesm2022/gilav21-shadcn-angular-rte-markup-safety-qJk8EoPk.mjs

@@ -0,0 +1,69 @@
+/*
+ * Importers (DOCX, DOC, PPTX, PDF) build markup from values read out of a
+ * document the user did not write. Each helper here makes one kind of such value
+ * safe for the slot it lands in, so a caller either gets a value of the right
+ * grammar or `undefined` and leaves the declaration, attribute or link out.
+ *
+ * "Escaped" is not enough for a CSS value: an escaped `red;background:url(…)` is
+ * still two declarations. A value has to MATCH the grammar of its property.
+ */
+/** Hex, functional `rgb()/rgba()/hsl()/hsla()` with numeric arguments, or a bare keyword. */
+const CSS_COLOR = /^(?:#[\da-f]{3,8}|(?:rgba?|hsla?)\([\d\s.,%/+-]*\)|[a-z]+)$/i;
+const IMAGE_DATA_URL = /^data:image\/[\w.+-]+;base64,[\w+/=]*$/;
+const SAFE_LINK_PROTOCOLS = new Set(['http:', 'https:', 'mailto:']);
+/**
+ * A document colour when it is plain colour syntax, else `undefined`. The syntax
+ * admits no `;`, quote or `url(`, so the value cannot add a declaration or fetch.
+ */
+function cssColor(value) {
+    return value && CSS_COLOR.test(value) ? value : undefined;
+}
+/**
+ * A document font name as one quoted CSS string, without a generic fallback (the
+ * caller appends the fallback its context wants). Quotes and backslashes are
+ * escaped and control characters dropped, because any of them could end the
+ * string and let the name write further declarations.
+ */
+function cssFontFamily(name) {
+    let quoted = '';
+    for (const ch of name) {
+        const code = ch.codePointAt(0) ?? 0;
+        if (code < 0x20 || code === 0x7f)
+            continue;
+        quoted += ch === '\\' || ch === "'" ? `\\${ch}` : ch;
+    }
+    return `'${quoted}'`;
+}
+/** The value when it is a base64 image data URL — the only image source the parsers produce — else `undefined`. */
+function imageDataUrl(value) {
+    return value && IMAGE_DATA_URL.test(value) ? value : undefined;
+}
+/**
+ * A link target an importer may render: an in-document `#fragment`, or an absolute
+ * http, https or mailto URL (returned as the browser will parse it, so the scheme
+ * checked is the scheme followed). Anything else — `javascript:`, `data:`, relative
+ * paths — yields `undefined` and the text renders unlinked.
+ */
+function safeLinkHref(href) {
+    if (href.startsWith('#'))
+        return href;
+    try {
+        const url = new URL(href);
+        return SAFE_LINK_PROTOCOLS.has(url.protocol) ? url.href : undefined;
+    }
+    catch {
+        // Not an absolute URL; relative targets are not rendered as links.
+        return undefined;
+    }
+}
+/** A value for a double-quoted HTML attribute: nothing in it can end the attribute or open a tag. */
+function escapeAttribute(value) {
+    return value
+        .replaceAll('&', '&amp;')
+        .replaceAll('"', '&quot;')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;');
+}
+
+export { cssFontFamily as a, cssColor as c, escapeAttribute as e, imageDataUrl as i, safeLinkHref as s };
+//# sourceMappingURL=gilav21-shadcn-angular-rte-markup-safety-qJk8EoPk.mjs.map

package/fesm2022/gilav21-shadcn-angular-rte-markup-safety-qJk8EoPk.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"gilav21-shadcn-angular-rte-markup-safety-qJk8EoPk.mjs","sources":["../../../packages/rte-package/src/lib/parsers/markup-safety.ts"],"sourcesContent":["/*\n * Importers (DOCX, DOC, PPTX, PDF) build markup from values read out of a\n * document the user did not write. Each helper here makes one kind of such value\n * safe for the slot it lands in, so a caller either gets a value of the right\n * grammar or `undefined` and leaves the declaration, attribute or link out.\n *\n * \"Escaped\" is not enough for a CSS value: an escaped `red;background:url(…)` is\n * still two declarations. A value has to MATCH the grammar of its property.\n */\n\n/** Hex, functional `rgb()/rgba()/hsl()/hsla()` with numeric arguments, or a bare keyword. */\nconst CSS_COLOR = /^(?:#[\\da-f]{3,8}|(?:rgba?|hsla?)\\([\\d\\s.,%/+-]*\\)|[a-z]+)$/i;\nconst IMAGE_DATA_URL = /^data:image\\/[\\w.+-]+;base64,[\\w+/=]*$/;\nconst SAFE_LINK_PROTOCOLS: ReadonlySet<string> = new Set(['http:', 'https:', 'mailto:']);\n\n/**\n * A document colour when it is plain colour syntax, else `undefined`. The syntax\n * admits no `;`, quote or `url(`, so the value cannot add a declaration or fetch.\n */\nexport function cssColor(value: string | undefined): string | undefined {\n    return value && CSS_COLOR.test(value) ? value : undefined;\n}\n\n/**\n * A document font name as one quoted CSS string, without a generic fallback (the\n * caller appends the fallback its context wants). Quotes and backslashes are\n * escaped and control characters dropped, because any of them could end the\n * string and let the name write further declarations.\n */\nexport function cssFontFamily(name: string): string {\n    let quoted = '';\n    for (const ch of name) {\n        const code = ch.codePointAt(0) ?? 0;\n        if (code < 0x20 || code === 0x7f) continue;\n        quoted += ch === '\\\\' || ch === \"'\" ? `\\\\${ch}` : ch;\n    }\n    return `'${quoted}'`;\n}\n\n/** The value when it is a base64 image data URL — the only image source the parsers produce — else `undefined`. */\nexport function imageDataUrl(value: string | undefined): string | undefined {\n    return value && IMAGE_DATA_URL.test(value) ? value : undefined;\n}\n\n/**\n * A link target an importer may render: an in-document `#fragment`, or an absolute\n * http, https or mailto URL (returned as the browser will parse it, so the scheme\n * checked is the scheme followed). Anything else — `javascript:`, `data:`, relative\n * paths — yields `undefined` and the text renders unlinked.\n */\nexport function safeLinkHref(href: string): string | undefined {\n    if (href.startsWith('#')) return href;\n    try {\n        const url = new URL(href);\n        return SAFE_LINK_PROTOCOLS.has(url.protocol) ? url.href : undefined;\n    } catch {\n        // Not an absolute URL; relative targets are not rendered as links.\n        return undefined;\n    }\n}\n\n/** A value for a double-quoted HTML attribute: nothing in it can end the attribute or open a tag. */\nexport function escapeAttribute(value: string): string {\n    return value\n        .replaceAll('&', '&amp;')\n        .replaceAll('\"', '&quot;')\n        .replaceAll('<', '&lt;')\n        .replaceAll('>', '&gt;');\n}\n"],"names":[],"mappings":"AAAA;;;;;;;;AAQG;AAEH;AACA,MAAM,SAAS,GAAG,8DAA8D;AAChF,MAAM,cAAc,GAAG,wCAAwC;AAC/D,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAExF;;;AAGG;AACG,SAAU,QAAQ,CAAC,KAAyB,EAAA;AAC9C,IAAA,OAAO,KAAK,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,SAAS;AAC7D;AAEA;;;;;AAKG;AACG,SAAU,aAAa,CAAC,IAAY,EAAA;IACtC,IAAI,MAAM,GAAG,EAAE;AACf,IAAA,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE;QACnB,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,QAAA,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE;AAClC,QAAA,MAAM,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,GAAG,GAAG,KAAK,EAAE,CAAA,CAAE,GAAG,EAAE;IACxD;IACA,OAAO,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,CAAG;AACxB;AAEA;AACM,SAAU,YAAY,CAAC,KAAyB,EAAA;AAClD,IAAA,OAAO,KAAK,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,SAAS;AAClE;AAEA;;;;;AAKG;AACG,SAAU,YAAY,CAAC,IAAY,EAAA;AACrC,IAAA,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;AAAE,QAAA,OAAO,IAAI;AACrC,IAAA,IAAI;AACA,QAAA,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC;AACzB,QAAA,OAAO,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,IAAI,GAAG,SAAS;IACvE;AAAE,IAAA,MAAM;;AAEJ,QAAA,OAAO,SAAS;IACpB;AACJ;AAEA;AACM,SAAU,eAAe,CAAC,KAAa,EAAA;AACzC,IAAA,OAAO;AACF,SAAA,UAAU,CAAC,GAAG,EAAE,OAAO;AACvB,SAAA,UAAU,CAAC,GAAG,EAAE,QAAQ;AACxB,SAAA,UAAU,CAAC,GAAG,EAAE,MAAM;AACtB,SAAA,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;AAChC;;;;"}