@hyperframes/core 0.8.7 → 0.8.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/canaryRegistry.d.ts.map +1 -1
- package/dist/canaryRegistry.js +0 -27
- package/dist/canaryRegistry.js.map +1 -1
- package/dist/generated/runtime-inline.js +1 -1
- package/dist/hyperframe.runtime.iife.js +21 -21
- package/dist/runtime/applyVariableBindings.d.ts.map +1 -1
- package/dist/runtime/applyVariableBindings.js +1 -26
- package/dist/runtime/applyVariableBindings.js.map +1 -1
- package/package.json +4 -4
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"applyVariableBindings.d.ts","sourceRoot":"","sources":["../../src/runtime/applyVariableBindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;
|
|
1
|
+
{"version":3,"file":"applyVariableBindings.d.ts","sourceRoot":"","sources":["../../src/runtime/applyVariableBindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAuBH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEtD;AAsFD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI,CA8BzD"}
|
|
@@ -27,7 +27,7 @@
|
|
|
27
27
|
* values.
|
|
28
28
|
*/
|
|
29
29
|
import { readVariablesForElement } from "./variableScope.js";
|
|
30
|
-
import { isScalarVariableValue as isScalar } from "@hyperframes/parsers/composition";
|
|
30
|
+
import { isScalarVariableValue as isScalar, isSafeMediaUrl, } from "@hyperframes/parsers/composition";
|
|
31
31
|
// data-var-src only rebinds media `src` on media elements. A user-controlled
|
|
32
32
|
// variable value assigned to a src is an XSS surface on tags whose src executes
|
|
33
33
|
// (`<iframe src="javascript:…">`, `<script src="data:…">`, `<embed>`), so the
|
|
@@ -43,31 +43,6 @@ function resolveUrl(value) {
|
|
|
43
43
|
}
|
|
44
44
|
return null;
|
|
45
45
|
}
|
|
46
|
-
/**
|
|
47
|
-
* Protocol allowlist for a resolved media URL. Relative URLs (no scheme) resolve
|
|
48
|
-
* against the page origin and are always safe. Absolute URLs are restricted to
|
|
49
|
-
* http(s)/blob and image data: URIs — defense-in-depth alongside VAR_SRC_TAGS,
|
|
50
|
-
* blocking `javascript:`, `data:text/html`, `file:`, etc. even if a future tag
|
|
51
|
-
* slips past the element guard. Control chars are stripped before the scheme
|
|
52
|
-
* test because browsers ignore them when parsing the URL (`java\tscript:`).
|
|
53
|
-
*/
|
|
54
|
-
function isSafeMediaUrl(url) {
|
|
55
|
-
// Browsers ignore ASCII control chars/whitespace when parsing a URL, so strip
|
|
56
|
-
// them before reading the scheme (defeats `java\tscript:` style bypasses).
|
|
57
|
-
// oxlint-disable-next-line no-control-regex -- control chars are the target here
|
|
58
|
-
const normalized = url.replace(/[\u0000-\u0020]/g, "");
|
|
59
|
-
const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(normalized);
|
|
60
|
-
if (!scheme)
|
|
61
|
-
return true;
|
|
62
|
-
const proto = scheme[1]?.toLowerCase();
|
|
63
|
-
if (!proto)
|
|
64
|
-
return false;
|
|
65
|
-
if (proto === "https" || proto === "http" || proto === "blob")
|
|
66
|
-
return true;
|
|
67
|
-
if (proto === "data")
|
|
68
|
-
return /^data:image\//i.test(normalized);
|
|
69
|
-
return false;
|
|
70
|
-
}
|
|
71
46
|
/**
|
|
72
47
|
* Strip characters that could smuggle additional declarations or markup out of
|
|
73
48
|
* a var() substitution site. A scalar value folded into `background: var(--x)`
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"applyVariableBindings.js","sourceRoot":"","sources":["../../src/runtime/applyVariableBindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,
|
|
1
|
+
{"version":3,"file":"applyVariableBindings.js","sourceRoot":"","sources":["../../src/runtime/applyVariableBindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EACL,qBAAqB,IAAI,QAAQ,EACjC,cAAc,GACf,MAAM,kCAAkC,CAAC;AAE1C,6EAA6E;AAC7E,gFAAgF;AAChF,8EAA8E;AAC9E,yEAAyE;AACzE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElE,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAAI,KAA2B,CAAC,GAAG,CAAC;QAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED,iFAAiF;AACjF,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,yEAAyE;QACzE,2CAA2C;QAC3C,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;QAChD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AASD,SAAS,gBAAgB,CAAC,EAAW,EAAE,KAAuB;IAC5D,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC3C,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,4BAA4B,CAAC,EAAW,EAAE,IAAY;IAC7D,IAAI,EAAE,CAAC,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAC/B,EAAE,CAAC,WAAW,GAAG,IAAI,CAAC;QACtB,OAAO;IACT,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS;YAAE,SAAS;QAC/C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACrC,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,GAAa;IAChC,OAAO,CACL,GAAG,CAAC,aAAa,CAAC,gBAAgB,CAAC;QACnC,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC;QAC3B,GAAG,CAAC,IAAI,EAAE,iBAAiB;QAC3B,GAAG,CAAC,IAAI,CACT,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,GAAa,EAAE,KAAuB;IACtE,uEAAuE;IACvE,+DAA+D;IAC/D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAW,CAAC;IACjC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO;QAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAChC,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC;QAC3E,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7C,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,GAAG,KAAK,IAAI,IAAI,IAAI,YAAY,WAAW,EAAE,CAAC;gBAChD,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAa;IACjD,MAAM,KAAK,GAAqB,IAAI,GAAG,EAAE,CAAC;IAC1C,wBAAwB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAErC,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;QACnD,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,4EAA4E;QAC5E,8EAA8E;QAC9E,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,IAAI,CACV,2CAA2C,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,4CAA4C,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CACrJ,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,UAAU,CAAC,gBAAgB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxD,IAAI,GAAG,KAAK,IAAI;YAAE,SAAS;QAC3B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,wCAAwC,EAAE,yBAAyB,CAAC,CAAC;YAClF,SAAS;QACX,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,QAAQ,CAAC,KAAK,CAAC;YAAE,4BAA4B,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,CAAC;AACH,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@hyperframes/core",
|
|
3
|
-
"version": "0.8.
|
|
3
|
+
"version": "0.8.8",
|
|
4
4
|
"description": "",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -274,9 +274,9 @@
|
|
|
274
274
|
"bpm-detective": "^2.0.5",
|
|
275
275
|
"linkedom": "^0.18.12",
|
|
276
276
|
"postcss": "^8.5.8",
|
|
277
|
-
"@hyperframes/
|
|
278
|
-
"@hyperframes/
|
|
279
|
-
"@hyperframes/
|
|
277
|
+
"@hyperframes/lint": "0.8.8",
|
|
278
|
+
"@hyperframes/parsers": "0.8.8",
|
|
279
|
+
"@hyperframes/studio-server": "0.8.8"
|
|
280
280
|
},
|
|
281
281
|
"devDependencies": {
|
|
282
282
|
"@types/jsdom": "^28.0.0",
|