@heliosgraphics/utils 6.0.0-alpha.18 → 6.0.0-alpha.19
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +2 -2
- package/sanitize.ts +3 -3
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@heliosgraphics/utils",
|
|
3
|
-
"version": "6.0.0-alpha.
|
|
3
|
+
"version": "6.0.0-alpha.19",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"sideEffects": false,
|
|
6
6
|
"author": "Chris Puska <chris@puska.org>",
|
|
@@ -27,6 +27,6 @@
|
|
|
27
27
|
"url": "https://github.com/heliosgraphics/helios-ui/issues"
|
|
28
28
|
},
|
|
29
29
|
"devDependencies": {
|
|
30
|
-
"@types/node": "^
|
|
30
|
+
"@types/node": "^26"
|
|
31
31
|
}
|
|
32
32
|
}
|
package/sanitize.ts
CHANGED
|
@@ -25,6 +25,7 @@ const ALLOWED_TAGS = new Set([
|
|
|
25
25
|
const ALLOWED_ATTRIBUTES = new Set(["class", "id", "title"])
|
|
26
26
|
|
|
27
27
|
const SAFE_PROTOCOLS = /^(https?|mailto|tel|ftp):/i
|
|
28
|
+
const UNSAFE_PROTOCOLS = new Set(["data", "javascript", "livescript", "mocha", "vbscript"])
|
|
28
29
|
const EMOJI_CLUSTER_LEFT_PATTERN: RegExp = /\p{Extended_Pictographic}(?:\uFE0F|[\u{1F3FB}-\u{1F3FF}])*$/u
|
|
29
30
|
const EMOJI_CLUSTER_RIGHT_PATTERN: RegExp = /^\p{Extended_Pictographic}/u
|
|
30
31
|
|
|
@@ -106,7 +107,6 @@ export const sanitizeText = (input: string = "", options: SanitizeTextOptions =
|
|
|
106
107
|
.replace(/<!--[\s\S]*?-->/g, "")
|
|
107
108
|
.replace(/\\[0-9a-f]{1,6}\s*/gi, "")
|
|
108
109
|
.replace(/<img[^>]*src\s*=\s*["']data:[^"']*["'][^>]*>/gi, "")
|
|
109
|
-
.replace(/data\s*:[^"'\s>)]*/gi, "")
|
|
110
110
|
|
|
111
111
|
// Then decode entities
|
|
112
112
|
sanitized = sanitized
|
|
@@ -165,11 +165,11 @@ export const sanitizeText = (input: string = "", options: SanitizeTextOptions =
|
|
|
165
165
|
sanitized = sanitized.replace(/<style\b[^>]*>[\s\S]*$/gi, "")
|
|
166
166
|
|
|
167
167
|
sanitized = sanitized.replace(
|
|
168
|
-
/(\w+(?:[\s\u00A0]*\w)*)\s*(?::|:|:|%3a|%3A|\\:|:)/gi,
|
|
168
|
+
/(\w+(?:[\s\u00A0]*\w)*)\s*(?::|:|:|%3a|%3A|\\:|:)(?=\S)/gi,
|
|
169
169
|
(_: string, protocol: string) => {
|
|
170
170
|
const cleanProtocol = protocol.replace(/[\s\u00A0]/g, "").toLowerCase()
|
|
171
171
|
const testString = cleanProtocol + ":"
|
|
172
|
-
return SAFE_PROTOCOLS.test(testString) ? testString : ""
|
|
172
|
+
return SAFE_PROTOCOLS.test(testString) || !UNSAFE_PROTOCOLS.has(cleanProtocol) ? testString : ""
|
|
173
173
|
},
|
|
174
174
|
)
|
|
175
175
|
|