@heliosgraphics/utils 6.0.0-alpha.14 → 6.0.0-alpha.15

package/clipboard.ts

@@ -1,9 +1,13 @@
 export const copyValue = async (text: string): Promise<void> => {
-	if (navigator?.clipboard?.writeText) {
+	if (typeof navigator !== "undefined" && navigator.clipboard?.writeText) {
 		await navigator.clipboard.writeText(text)
 		return
 	}
 
+	if (typeof document === "undefined" || !document.body || typeof document.execCommand !== "function") {
+		return
+	}
+
 	const input: HTMLTextAreaElement = document.createElement("textarea")
 
 	document.body.appendChild(input)

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@heliosgraphics/utils",
-	"version": "6.0.0-alpha.14",
+	"version": "6.0.0-alpha.15",
 	"type": "module",
 	"sideEffects": false,
 	"author": "Chris Puska <chris@puska.org>",

package/sanitize.ts

@@ -26,6 +26,10 @@ const ALLOWED_ATTRIBUTES = new Set(["class", "id", "title"])
 
 const SAFE_PROTOCOLS = /^(https?|mailto|tel|ftp):/i
 
+interface SanitizeTextOptions {
+	allowLinks?: boolean
+}
+
 const DANGEROUS_FUNCTIONS: Array<RegExp> = [
 	/alert(?=\s*\()/gi,
 	/eval(?=\s*\()/gi,
@@ -81,9 +85,11 @@ const DANGEROUS_FUNCTIONS: Array<RegExp> = [
 	/createElement\s*\(\s*["']script["']\s*\)/gi,
 ]
 
-export const sanitizeText = (input: string = ""): string => {
+export const sanitizeText = (input: string = "", options: SanitizeTextOptions = {}): string => {
 	if (!input) return ""
 
+	const { allowLinks = false } = options
+
 	// First remove dangerous patterns before decoding
 	let sanitized = input
 		.replace(/<!--[\s\S]*?-->/g, "")
@@ -162,7 +168,7 @@ export const sanitizeText = (input: string = ""): string => {
 		(_fullMatch: string, closing: string, tagName: string, attributes: string) => {
 			const tag = tagName.toLowerCase()
 
-			if (!ALLOWED_TAGS.has(tag)) {
+			if (!ALLOWED_TAGS.has(tag) && !(allowLinks && tag === "a")) {
 				return ""
 			}
 
@@ -193,6 +199,10 @@ export const sanitizeText = (input: string = ""): string => {
 
 								cleanAttributes += ` ${attrName}="${cleanValue}"`
 							}
+
+							if (allowLinks && tag === "a" && attrName === "href" && SAFE_PROTOCOLS.test(attrValue)) {
+								cleanAttributes += ` href="${attrValue}"`
+							}
 						}
 					})
 				}
@@ -208,6 +218,10 @@ export const sanitizeText = (input: string = ""): string => {
 		sanitized = sanitized.replace(pattern, "")
 	})
 
+	if (allowLinks) {
+		sanitized = sanitized.replace(/<a>(.*?)<\/a>/gi, "$1")
+	}
+
 	// Additional targeted cleanup for specific dangerous contexts
 	sanitized = sanitized.replace(/\balert\s*(?=[,)])/gi, "")
 	sanitized = sanitized.replace(/\bjavascript\s*(?=:)/gi, "")