@helping-ai-workflow/md2doc 3.4.0 → 3.4.2

package/lib/editor/client.js

@@ -145,7 +145,63 @@
   // in the opposite direction (a zero-width "after" range) to let the
   // existing UndoStack undo()/redo() pair (lib/editor/lineops.js) handle a
   // pure insertion/pure removal without a third op shape.
-  function commitBlockInsertion(state, blockId, newBlockLines) {
+  /**
+   * Is every line of this paste part of a list?
+   *
+   * "Part of a list" is a list line OR an indented continuation of one — a
+   * wrapped sentence, a nested block, a fenced snippet inside an item. Blank
+   * lines inside the paste are allowed (a list may be loose on purpose; what
+   * this decides is only whether to ADD one at the seam).
+   *
+   * A paste that is a list FOLLOWED BY a paragraph answers false, and should:
+   * the blank line before that paragraph is what keeps it out of the last
+   * item, and the seam's own blank is the lesser problem of the two.
+   */
+  function pasteIsAllListLines(pastedLines) {
+    let sawListLine = false;
+    for (const raw of pastedLines) {
+      const line = String(raw == null ? '' : raw);
+      if (line.trim() === '') continue;
+      if (LIST_LINE_RE.test(line)) { sawListLine = true; continue; }
+      // A continuation has to be indented AND it has to belong to something.
+      if (sawListLine && /^[ \t]/.test(line)) continue;
+      return false;
+    }
+    return sawListLine;
+  }
+
+  // Does this line open a list item? Deliberately the same shape as
+  // list-md.js's own SRC_MARKER_RE (`^([ \t]*)(?:[-*+]|\d{1,9}[.)])([ \t]+)…`),
+  // which is function-local there and answers a different question — it
+  // PARSES a marker, this only CLASSIFIES a line. The two are kept in
+  // agreement by a test that runs both over the same table of lines rather
+  // than by sharing one object: making that one exportable would drag a
+  // browser-side module into commitBlockInsertion(), whose whole value is
+  // that it is a pure function node can call directly.
+  const LIST_LINE_RE = /^[ \t]*(?:[-*+]|\d{1,9}[.)])[ \t]+/;
+
+  /**
+   * `opts.tight` — insert with NO leading blank line, and skip the trailing
+   * one when what follows is itself a list line.
+   *
+   * The always-on blank is right for a paragraph and wrong for a list item:
+   * a blank line between items makes the list LOOSE, every item then renders
+   * as <p>, serializeBlocks() answers 'P' per item, and the run degrades
+   * READ-ONLY with no banner. A user meets that as "I pasted an item beside
+   * my list and now Tab does nothing" — no error, no explanation, nothing to
+   * search for.
+   *
+   * It is why insertListItemAfter() and duplicateListItems() bypass this
+   * function. Paste could not: it carries arbitrary pasted lines, and
+   * re-serialising a run to absorb them would REWRITE the user's bytes —
+   * marker widths, ordinals, and the escaping trap duplicateListItems()
+   * records ('~5px' coming back as '\~5px'). So paste keeps the raw-line
+   * insert and turns the leading blank off instead.
+   *
+   * Opt-in, decided by the caller: every other call site wants the blank.
+   */
+  function commitBlockInsertion(state, blockId, newBlockLines, opts) {
+    const tight = !!(opts && opts.tight);
     const block = state.blocks.find((b) => b.id === blockId);
     // T8 item 1, third helper in the same family: the anchor's range is read as
     // an interval here too (`endLine + 1` is the insertion point, `lines[endLine]`
@@ -157,20 +213,26 @@
     if (anchorRefusal) return anchorRefusal;
     const endLine = block.endLine;
     const nextLine = state.lines[endLine]; // 0-indexed: line right after the block, or undefined at EOF
-    const needsTrailingBlank = nextLine !== undefined && nextLine.trim() !== '';
+    // A list line following a tight insert needs no separator: emitting one
+    // would divorce THAT item from the run instead — the same defect, one
+    // item further down.
+    const needsTrailingBlank = nextLine !== undefined && nextLine.trim() !== '' &&
+      !(tight && LIST_LINE_RE.test(nextLine));
+    const lead = tight ? [] : [''];
     const after = needsTrailingBlank
-      ? ['', ...newBlockLines, '']
-      : ['', ...newBlockLines];
+      ? [...lead, ...newBlockLines, '']
+      : [...lead, ...newBlockLines];
     const op = { startLine: endLine + 1, endLine, before: [], after };
     const r = ops.insertLines(state.lines, endLine, after);
     const blocks = ops.shiftBlocks(state.blocks, blockId, r.delta);
     state.stack.push(op);
     // The new block's own content starts one line after the leading blank
-    // this function always inserts (see `after` above — its first element
-    // is always the fresh leading blank) — callers use this to locate the
-    // freshly-inserted block in the blocks array a subsequent full
-    // rerenderAll() (which recomputes blocks server-side) hands back.
-    const newStartLine = op.startLine + 1;
+    // this function inserts by default (see `after` above) — callers use this
+    // to locate the freshly-inserted block in the blocks array a subsequent
+    // full rerenderAll() (which recomputes blocks server-side) hands back.
+    // A tight insert emits no leading blank, so its content begins on the
+    // first inserted line itself.
+    const newStartLine = tight ? op.startLine : op.startLine + 1;
     return { lines: r.lines, blocks, op, newStartLine };
   }
 
@@ -646,7 +708,7 @@
   }
 
   if (typeof module === 'object' && module.exports) {
-    module.exports = { extractBlockSource, commitEdit, commitRangeEdit, commitRangeRemoval, commitListBlockRemoval, commitBlockInsertion, planBlockMove, commitBlockMove, reorderSpanRange, spanMoveRange, spanIndentsAreAnchored, blockMoveSeamRefusal, rollbackFailedRender, headingDepthOf, withHeadingDepth, resolveDrawioLanding, shiftBlocksAfterBodyEdit, waveDiscardIsSafe };
+    module.exports = { pasteIsAllListLines, LIST_LINE_RE, extractBlockSource, commitEdit, commitRangeEdit, commitRangeRemoval, commitListBlockRemoval, commitBlockInsertion, planBlockMove, commitBlockMove, reorderSpanRange, spanMoveRange, spanIndentsAreAnchored, blockMoveSeamRefusal, rollbackFailedRender, headingDepthOf, withHeadingDepth, resolveDrawioLanding, shiftBlocksAfterBodyEdit, waveDiscardIsSafe };
     return; // node: pure core only
   }
 
@@ -4984,7 +5046,14 @@
     const liveBlockId = Number(anchorEl.getAttribute('data-block-id'));
     const block = blocks.find((b) => b.id === liveBlockId);
     if (!block) return;
-    const result = commitBlockInsertion({ lines, blocks, stack }, liveBlockId, newLines);
+    // `tight` is only ever honoured when the anchor really is a list item:
+    // the caller decides the CONTENT is list-shaped, this decides the
+    // DESTINATION is a list. Both halves are needed — tight-inserting a list
+    // under a paragraph would glue it to that paragraph's last line.
+    const tight = !!(opts && opts.tight) &&
+      anchorEl.getAttribute('data-block-type') === 'li';
+    const result = commitBlockInsertion({ lines, blocks, stack }, liveBlockId, newLines,
+      { tight });
     const prevLines = lines;
     lines = result.lines;
     const editRange = result.op
@@ -14242,7 +14311,32 @@
   // intent has to be captured on the keystroke that produced it.
   let plainPasteArmed = false;
 
-  const TOOLBAR_UNSUPPORTED_IMAGE_MESSAGE = '只接受 PNG / JPEG / GIF / WebP 圖片';
+  const TOOLBAR_UNSUPPORTED_IMAGE_MESSAGE =
+    '只接受 PNG / JPEG / GIF / WebP 圖片，或 draw.io 的 .drawio / .xml';
+  // The one place the two accepted diagram extensions are written down on
+  // this side. /api/asset owns the same pair plus the content check.
+  const DRAWIO_NAME_RE = /\.(drawio|xml)$/i;
+
+  /**
+   * Is this File something the insert path will even try to send?
+   *
+   * ONE predicate with three call sites -- the `drop` filter,
+   * `clipboardItemsOf()` and `uploadImageBlob()` -- because three copies of
+   * "is this insertable" is three chances to disagree. v3.4.1's first cut
+   * widened only two of them and the `drop` filter kept dropping .drawio
+   * files on the floor: the filter runs BEFORE insertImages(), so the file
+   * never entered the pipeline and there was no banner, no request, no
+   * failure -- nothing at all happened, which is indistinguishable from the
+   * feature not existing.
+   *
+   * "Will try to send" is the whole claim. Whether anything is WRITTEN is
+   * decided by /api/asset, which re-checks the extension against its own two
+   * literals and then parses the bytes.
+   */
+  function insertableFile(f) {
+    if (!f || !assetLib) return false;
+    return !!(assetLib.extFor(f.type) || DRAWIO_NAME_RE.test(f.name || ''));
+  }
   const TOOLBAR_NO_ANCHOR_MESSAGE = '找不到可以插入圖片的位置';
   // backlog #10 — see the keydown handler's own comment for why every
   // stray-key hand-back raises this rather than only some of them.
@@ -15208,7 +15302,13 @@
   // authoritative.
   async function uploadImageBlob(blob) {
     if (!blob) return null;
-    if (!assetLib || !assetLib.extFor(blob.type)) {
+    // A .drawio arrives with `type === ''` -- browsers have no media type for
+    // it -- so `extFor()` alone answered "unsupported" without ever asking the
+    // server. The name is enough to get the request SENT; it is not enough to
+    // get anything written: /api/asset re-checks the extension against its own
+    // two literals and then parses the bytes. Keep the two rules the same
+    // shape, and let the server's refusal be the one the user sees.
+    if (!insertableFile(blob)) {
       showBanner(TOOLBAR_UNSUPPORTED_IMAGE_MESSAGE, null, null);
       return null;
     }
@@ -15238,6 +15338,15 @@
     }
     let j;
     try { j = await res.json(); } catch (e) { j = null; }
+    // A refusal carries a reason; saying "伺服器回應格式不正確" instead is a
+    // second wrong answer on top of the first. The content gate added in
+    // v3.4.1 makes this reachable for an ordinary mistake -- picking an .xml
+    // that is not a draw.io diagram -- so the reason has to arrive.
+    if (!res.ok) {
+      const why = (j && typeof j.error === 'string' && j.error) ? j.error : ('HTTP ' + res.status);
+      showBanner('檔案上傳失敗 — ' + why, null, null);
+      return null;
+    }
     if (!j || typeof j.path !== 'string') {
       showBanner('圖片上傳失敗 — 伺服器回應格式不正確。', null, null);
       return null;
@@ -15351,7 +15460,13 @@
     const dialogIdentity = captureBlockIdentity(anchorEl);
     const input = document.createElement('input');
     input.type = 'file';
-    input.accept = 'image/png,image/jpeg,image/gif,image/webp';
+    // v3.4.1: extension tokens sit beside the MIME tokens deliberately.
+    // `.drawio` has no registered media type, so a MIME-only accept list
+    // cannot name it and the dialog greys the file out -- which is how
+    // v3.4.0 shipped a renderer that embeds .drawio/.xml next to an insert
+    // button that could not pick one. Mixing the two token kinds is what
+    // the attribute is specified for.
+    input.accept = 'image/png,image/jpeg,image/gif,image/webp,.drawio,.xml';
     input.multiple = true;
     input.hidden = true;
     // (a) above.
@@ -15436,7 +15551,7 @@
       const files = e.dataTransfer
         ? Array.prototype.slice.call(e.dataTransfer.files || [])
         : [];
-      const images = files.filter((f) => !!(assetLib && assetLib.extFor(f.type)));
+      const images = files.filter(insertableFile);
       if (!images.length) return; // not ours: let the page do whatever it would
       e.preventDefault();
       const anchorEl = (e.target && e.target.closest) ? e.target.closest('.ed-block') : null;
@@ -15456,8 +15571,15 @@
     try { items['text/html'] = dt.getData('text/html') || ''; } catch (err) { items['text/html'] = ''; }
     const files = dt.files ? Array.prototype.slice.call(dt.files) : [];
     for (let i = 0; i < files.length; i += 1) {
-      if (files[i] && String(files[i].type).indexOf('image/') === 0) {
-        items[files[i].type] = files[i];
+      // This map is keyed by MIME, and a .drawio has no MIME at all, so a
+      // diagram pasted as a FILE goes under the fixed 'file' key that
+      // pickPayload() also looks at. The key is a protocol constant between
+      // these two modules -- the RULE for which files are insertable stays
+      // in insertableFile() alone, so paste-md.js never grows a second
+      // opinion about extensions.
+      if (files[i] && insertableFile(files[i])) {
+        const mime = String(files[i].type || '');
+        items[mime.indexOf('image/') === 0 ? mime : 'file'] = files[i];
         break;
       }
     }
@@ -15524,7 +15646,9 @@
       // commitBlockInsertion()/replaceLines() and therefore through
       // serializeBlocks()'s existing gates, instead of arriving as a pile of
       // foreign nodes the serializer would have to make sense of afterwards.
-      insertBlockBelow(editEl.closest('.ed-block'), 'paragraph', { lines: md.split('\n') });
+      const pastedLines = md.split('\n');
+      insertBlockBelow(editEl.closest('.ed-block'), 'paragraph',
+        { lines: pastedLines, tight: pasteIsAllListLines(pastedLines) });
       return;
     }
     snapBurstIfActive(editEl, 'paste-pre');

package/lib/editor/paste-md.js

@@ -243,10 +243,14 @@ function htmlToMarkdown(html) {
 function pickPayload(clipboardItems, plainOnly) {
   var items = clipboardItems || {};
 
+  // 'file' sits beside the image/* keys: a .drawio carries no MIME, so the
+  // client keys it there rather than inventing one. The payload kind stays
+  // 'image' because its only consumer is the upload path, which asks nothing
+  // about the bytes -- /api/asset decides what may actually be written.
   var imageKey = null;
   for (var k in items) {
     if (Object.prototype.hasOwnProperty.call(items, k) &&
-        k.indexOf('image/') === 0 && items[k] != null) {
+        (k.indexOf('image/') === 0 || k === 'file') && items[k] != null) {
       imageKey = k;
       break;
     }

package/lib/editor/server.js

@@ -670,12 +670,46 @@ async function createEditorServer({
           return send(res, 400, { error: 'fileId must be an index into the open file list' });
         }
         const file = absFiles[fileId];
-        const ext = assetLib.extFor(body.mime);
-        if (!ext) return send(res, 400, { error: 'unsupported image type' });
         const b64 = typeof body.data === 'string' ? body.data : '';
         const buf = Buffer.from(b64, 'base64');
         if (buf.length === 0) return send(res, 400, { error: 'empty image payload' });
 
+        // v3.4.1: two gates, not one widened whitelist.
+        //
+        // The raster gate is `extFor(body.mime)` and it is unchanged --
+        // `image/svg+xml` stays out for the reason asset.js documents (an SVG
+        // can carry <script>, and a MIME string is attacker-controlled).
+        //
+        // The drawio gate below exists because that first gate CANNOT answer
+        // for .drawio at all: browsers report `file.type === ''` for it, so
+        // v3.4.0 shipped a renderer that embeds `.drawio`/`.xml` and an insert
+        // path that answered every such upload with 'unsupported image type'.
+        //
+        // Its rule is the half that makes it safe: the EXTENSION picks the
+        // candidate and the CONTENT decides whether anything is written. The
+        // extension is matched against two literals and the stored value is
+        // taken from this table rather than from the name, so no casing,
+        // Unicode lookalike or double-extension in an attacker-supplied
+        // filename can become the extension on disk. A payload renamed to
+        // .xml is refused unless drawio's own parser recognises a root it
+        // writes (<mxfile> or <mxGraphModel>).
+        const DRAWIO_EXT = { '.drawio': '.drawio', '.xml': '.xml' };
+        let ext = assetLib.extFor(body.mime);
+        if (!ext) {
+          const rawName = String(body.name === null || body.name === undefined ? '' : body.name);
+          const m = /\.(drawio|xml)$/i.exec(rawName);
+          const candidate = m ? DRAWIO_EXT['.' + m[1].toLowerCase()] : null;
+          if (!candidate) return send(res, 400, { error: 'unsupported image type' });
+          // `buf` is what lands on disk, so `buf` is what gets checked --
+          // never a re-decode of `body.data`, which could differ.
+          if (!drawioLib.isDrawioXml(buf.toString('utf8'))) {
+            return send(res, 400, {
+              error: 'refused: this file is not a draw.io diagram (no <mxfile> or <mxGraphModel> root)',
+            });
+          }
+          ext = candidate;
+        }
+
         const baseDir = path.dirname(file);
         const assetsDir = path.join(baseDir, 'assets');
         fs.mkdirSync(assetsDir, { recursive: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helping-ai-workflow/md2doc",
-  "version": "3.4.0",
+  "version": "3.4.2",
   "description": "Markdown → HTML / PDF renderer with WaveDrom, Mermaid, Graphviz, and draw.io support",
   "keywords": [
     "markdown",