@instructure/platform-sanitize 0.2.1 → 0.3.0

package/dist/index.js

@@ -1,4 +1,4 @@
-import n from "dompurify";
+import a from "dompurify";
 const d = /* @__PURE__ */ new Set([
   // layout
   "display",
@@ -127,7 +127,18 @@ const d = /* @__PURE__ */ new Set([
   "grid-template-areas",
   "grid-template-columns",
   "grid-template-rows"
-]), s = {
+]), c = /* @__PURE__ */ new Set([
+  "src",
+  "href",
+  "action",
+  "formaction",
+  "data",
+  "poster",
+  "background",
+  "cite",
+  "longdesc",
+  "xlink:href"
+]), l = /^\s*(\/\/|\\)/, f = {
   ADD_TAGS: ["iframe"],
   ADD_ATTR: [
     "allowfullscreen",
@@ -161,34 +172,39 @@ const d = /* @__PURE__ */ new Set([
   RETURN_TRUSTED_TYPE: !0
 };
 let o = null;
-function f() {
-  return o || (o = typeof n == "function" ? n(window) : n, o.addHook("afterSanitizeAttributes", (t) => {
+function g() {
+  return o || (o = typeof a == "function" ? a(window) : a, o.addHook("afterSanitizeAttributes", (t) => {
     if (!(t instanceof Element) || !t.hasAttribute("style")) return;
     const e = t.style, i = [];
     for (let r = 0; r < e.length; r++) {
-      const a = e.item(r);
-      d.has(a) || i.push(a);
+      const n = e.item(r);
+      d.has(n) || i.push(n);
     }
     for (const r of i) e.removeProperty(r);
     e.length === 0 && t.removeAttribute("style");
+  }), o.addHook("uponSanitizeAttribute", (t, e) => {
+    c.has(e.attrName) && l.test(e.attrValue) && (e.keepAttr = !1);
+  }), o.addHook("afterSanitizeAttributes", (t) => {
+    if (!(t instanceof Element) || !t.hasAttribute("srcset")) return;
+    (t.getAttribute("srcset") ?? "").split(",").map((r) => r.trim().split(/\s+/)[0]).some((r) => l.test(r)) && t.removeAttribute("srcset");
   }), o);
 }
-function m(t) {
+function p(t) {
   if (typeof window > "u")
     throw new Error("sanitizeHtml requires a DOM environment (window is not defined)");
-  return f().sanitize(t ?? "", s);
+  return g().sanitize(t ?? "", f);
 }
-const g = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]), l = "http://platform-sanitize.invalid/";
-function b(t) {
-  if (!t || !t.trim()) return "about:blank";
+const m = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]), s = "http://platform-sanitize.invalid/", u = /^\s*\/\//;
+function h(t) {
+  if (!t || !t.trim() || u.test(t)) return "about:blank";
   try {
-    const e = new URL(t, l);
-    return g.has(e.protocol) ? e.href.startsWith(l) ? t : e.href : "about:blank";
+    const e = new URL(t, s);
+    return m.has(e.protocol) ? e.href.startsWith(s) ? t : e.href : "about:blank";
   } catch {
     return "about:blank";
   }
 }
 export {
-  m as sanitizeHtml,
-  b as sanitizeUrl
+  p as sanitizeHtml,
+  h as sanitizeUrl
 };

package/dist/sanitizeHtml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizeHtml.d.ts","sourceRoot":"","sources":["../src/sanitizeHtml.ts"],"names":[],"mappings":"AAyMA,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAKpE"}
+{"version":3,"file":"sanitizeHtml.d.ts","sourceRoot":"","sources":["../src/sanitizeHtml.ts"],"names":[],"mappings":"AA4OA,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAKpE"}

package/dist/sanitizeUrl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizeUrl.d.ts","sourceRoot":"","sources":["../src/sanitizeUrl.ts"],"names":[],"mappings":"AAiBA,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAYlE"}
+{"version":3,"file":"sanitizeUrl.d.ts","sourceRoot":"","sources":["../src/sanitizeUrl.ts"],"names":[],"mappings":"AAwBA,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAalE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@instructure/platform-sanitize",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",