@instructure/platform-sanitize 0.2.1

package/dist/__tests__/sanitizeHtml.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sanitizeHtml.test.d.ts.map

package/dist/__tests__/sanitizeHtml.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizeHtml.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/sanitizeHtml.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/sanitizeUrl.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sanitizeUrl.test.d.ts.map

package/dist/__tests__/sanitizeUrl.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizeUrl.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/sanitizeUrl.test.ts"],"names":[],"mappings":""}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { sanitizeHtml } from './sanitizeHtml';
+export { sanitizeUrl } from './sanitizeUrl';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA"}

package/dist/index.js

@@ -0,0 +1,194 @@
+import n from "dompurify";
+const d = /* @__PURE__ */ new Set([
+  // layout
+  "display",
+  "float",
+  "clear",
+  "overflow",
+  "overflow-x",
+  "overflow-y",
+  "visibility",
+  "cursor",
+  "direction",
+  "user-select",
+  "zoom",
+  // sizing
+  "width",
+  "height",
+  "min-width",
+  "min-height",
+  "max-width",
+  "max-height",
+  // spacing
+  "margin",
+  "margin-top",
+  "margin-right",
+  "margin-bottom",
+  "margin-left",
+  "margin-offset",
+  "padding",
+  "padding-top",
+  "padding-right",
+  "padding-bottom",
+  "padding-left",
+  // typography
+  "font",
+  "font-family",
+  "font-size",
+  "font-style",
+  "font-variant",
+  "font-weight",
+  "font-stretch",
+  "font-width",
+  "line-height",
+  "text-align",
+  "text-decoration",
+  "text-indent",
+  "white-space",
+  "vertical-align",
+  // color & background
+  "color",
+  "background",
+  "background-color",
+  "background-image",
+  "background-attachment",
+  "background-position",
+  "background-position-x",
+  "background-position-y",
+  "background-repeat",
+  // border
+  "border",
+  "border-color",
+  "border-style",
+  "border-width",
+  "border-radius",
+  "border-collapse",
+  "border-spacing",
+  "border-top",
+  "border-top-color",
+  "border-top-style",
+  "border-top-width",
+  "border-right",
+  "border-right-color",
+  "border-right-style",
+  "border-right-width",
+  "border-bottom",
+  "border-bottom-color",
+  "border-bottom-style",
+  "border-bottom-width",
+  "border-left",
+  "border-left-color",
+  "border-left-style",
+  "border-left-width",
+  // list
+  "list-style",
+  "list-style-image",
+  "list-style-position",
+  "list-style-type",
+  // table
+  "table-layout",
+  // flex
+  "flex",
+  "flex-basis",
+  "flex-direction",
+  "flex-flow",
+  "flex-grow",
+  "flex-shrink",
+  "flex-wrap",
+  "align-content",
+  "align-items",
+  "align-self",
+  "justify-content",
+  "justify-items",
+  "justify-self",
+  "order",
+  "gap",
+  "row-gap",
+  "column-gap",
+  "place-content",
+  "place-items",
+  "place-self",
+  // grid
+  "grid",
+  "grid-area",
+  "grid-auto-columns",
+  "grid-auto-flow",
+  "grid-auto-rows",
+  "grid-column",
+  "grid-column-end",
+  "grid-column-gap",
+  "grid-column-start",
+  "grid-gap",
+  "grid-row",
+  "grid-row-end",
+  "grid-row-gap",
+  "grid-row-start",
+  "grid-template",
+  "grid-template-areas",
+  "grid-template-columns",
+  "grid-template-rows"
+]), s = {
+  ADD_TAGS: ["iframe"],
+  ADD_ATTR: [
+    "allowfullscreen",
+    "allow",
+    "frameborder",
+    "sandbox",
+    "data-media-id",
+    "data-media-type",
+    // RCE produces target="_blank" for external links. Modern browsers treat
+    // target="_blank" as implicit rel="noopener", and the backend allowlist
+    // already includes target.
+    "target",
+    "webkitallowfullscreen",
+    "mozallowfullscreen",
+    "scrolling"
+  ],
+  // Rails UJS turns data-method/data-remote/etc. on clickable elements into
+  // state-changing requests carrying the victim's CSRF token. Strip them so
+  // user-authored HTML cannot become a CSRF gadget when UJS is on the page.
+  FORBID_ATTR: ["data-method", "data-remote", "data-url", "data-confirm", "data-disable-with"],
+  // In browsers that support the Trusted Types API (Chromium, Firefox),
+  // DOMPurify returns a TrustedHTML object rather than a plain string. The
+  // exported sanitizeHtml signature declares string — a deliberate lie that
+  // mirrors the same lie the browser DOM lib (Element.innerHTML: string),
+  // React (__html: string), and jQuery (html(string)) already tell. All those
+  // sinks runtime-accept TrustedHTML even though their TS signatures only
+  // declare string; lying here lets callers assign the result directly without
+  // a per-call cast. Do not perform string operations (.slice, .match, etc.)
+  // on the return value — those methods do not exist on TrustedHTML and will
+  // throw in modern browsers.
+  RETURN_TRUSTED_TYPE: !0
+};
+let o = null;
+function f() {
+  return o || (o = typeof n == "function" ? n(window) : n, o.addHook("afterSanitizeAttributes", (t) => {
+    if (!(t instanceof Element) || !t.hasAttribute("style")) return;
+    const e = t.style, i = [];
+    for (let r = 0; r < e.length; r++) {
+      const a = e.item(r);
+      d.has(a) || i.push(a);
+    }
+    for (const r of i) e.removeProperty(r);
+    e.length === 0 && t.removeAttribute("style");
+  }), o);
+}
+function m(t) {
+  if (typeof window > "u")
+    throw new Error("sanitizeHtml requires a DOM environment (window is not defined)");
+  return f().sanitize(t ?? "", s);
+}
+const g = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]), l = "http://platform-sanitize.invalid/";
+function b(t) {
+  if (!t || !t.trim()) return "about:blank";
+  try {
+    const e = new URL(t, l);
+    return g.has(e.protocol) ? e.href.startsWith(l) ? t : e.href : "about:blank";
+  } catch {
+    return "about:blank";
+  }
+}
+export {
+  m as sanitizeHtml,
+  b as sanitizeUrl
+};

package/dist/sanitizeHtml.d.ts

@@ -0,0 +1,2 @@
+export declare function sanitizeHtml(html: string | null | undefined): string;
+//# sourceMappingURL=sanitizeHtml.d.ts.map

package/dist/sanitizeHtml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizeHtml.d.ts","sourceRoot":"","sources":["../src/sanitizeHtml.ts"],"names":[],"mappings":"AAyMA,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAKpE"}

package/dist/sanitizeUrl.d.ts

@@ -0,0 +1,2 @@
+export declare function sanitizeUrl(url: string | null | undefined): string;
+//# sourceMappingURL=sanitizeUrl.d.ts.map

package/dist/sanitizeUrl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizeUrl.d.ts","sourceRoot":"","sources":["../src/sanitizeUrl.ts"],"names":[],"mappings":"AAiBA,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAYlE"}

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@instructure/platform-sanitize",
+  "version": "0.2.1",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "dompurify": "^3.0.0"
+  },
+  "devDependencies": {
+    "@vitest/coverage-v8": "^4.0.17",
+    "dompurify": "^3.0.0",
+    "jsdom": "^25.0.0",
+    "typescript": "^5.3.0",
+    "vite": "^6.0.0",
+    "vite-plugin-dts": "^4.0.0",
+    "vitest": "^4.0.0"
+  },
+  "scripts": {
+    "build": "vite build",
+    "dev": "vite build --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "type-check": "tsc --noEmit"
+  }
+}