@instructure/platform-sanitize 0.3.11 → 0.3.13

package/dist/__tests__/sanitizeHtml.browser.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sanitizeHtml.browser.test.d.ts.map

package/dist/__tests__/sanitizeHtml.browser.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizeHtml.browser.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/sanitizeHtml.browser.test.ts"],"names":[],"mappings":""}

package/dist/index.js

@@ -1,5 +1,5 @@
 import c from "dompurify";
-const g = /* @__PURE__ */ new Set([
+const p = /* @__PURE__ */ new Set([
   // layout
   "display",
   "float",
@@ -106,6 +106,13 @@ const g = /* @__PURE__ */ new Set([
   "border-style",
   "border-width",
   "border-radius",
+  // Chrome's CSSOM expands border-radius to these four longhands when iterating
+  // element.style — the shorthand itself never appears in the iterator, so the
+  // hook would strip all four corners unless they are explicitly listed here.
+  "border-top-left-radius",
+  "border-top-right-radius",
+  "border-bottom-right-radius",
+  "border-bottom-left-radius",
   "border-collapse",
   "border-spacing",
   "border-top",
@@ -130,6 +137,9 @@ const g = /* @__PURE__ */ new Set([
   "outline-color",
   "outline-style",
   "outline-width",
+  // outline-offset is not part of the `outline` shorthand, so it must be listed
+  // separately or it is stripped when authored on its own (focus-ring styling).
+  "outline-offset",
   // list
   "list-style",
   "list-style-image",
@@ -225,7 +235,7 @@ const g = /* @__PURE__ */ new Set([
   "caret-color",
   "accent-color",
   "appearance"
-]), b = /* @__PURE__ */ new Set([
+]), m = /* @__PURE__ */ new Set([
   "src",
   "href",
   "action",
@@ -236,7 +246,7 @@ const g = /* @__PURE__ */ new Set([
   "cite",
   "longdesc",
   "xlink:href"
-]), u = /^\s*(\/\/|\\)/, m = [
+]), u = /^\s*(\/\/|\\)/, w = [
   "background",
   "background-image",
   "list-style",
@@ -245,7 +255,7 @@ const g = /* @__PURE__ */ new Set([
   // content: url(...) triggers an HTTP GET even on non-pseudo elements in some
   // browsers; strip it as defense-in-depth against tracking-pixel exfiltration.
   "content"
-], w = /url\s*\(\s*['"]?(?:[a-z][a-z0-9+\-.]*:|\/\/)/i, h = /* @__PURE__ */ new Set([
+], h = /url\s*\(\s*['"]?(?:[a-z][a-z0-9+\-.]*:|\/\/)/i, y = /* @__PURE__ */ new Set([
   "allow-downloads",
   "allow-forms",
   "allow-modals",
@@ -258,7 +268,7 @@ const g = /* @__PURE__ */ new Set([
   "allow-scripts",
   "allow-storage-access-by-user-activation",
   "allow-top-navigation-by-user-activation"
-]), y = {
+]), d = {
   ADD_TAGS: ["iframe"],
   ADD_ATTR: [
     "allowfullscreen",
@@ -307,7 +317,7 @@ function k() {
     const e = t.style, o = [];
     for (let n = 0; n < e.length; n++) {
       const a = e.item(n);
-      g.has(a) || o.push(a);
+      p.has(a) || o.push(a);
     }
     for (const n of o) e.removeProperty(n);
     const r = /* @__PURE__ */ new Set([
@@ -321,13 +331,13 @@ function k() {
       "revert-layer"
     ]), s = e.getPropertyValue("position").trim().toLowerCase();
     s && !r.has(s) && e.removeProperty("position");
-    for (const n of m) {
+    for (const n of w) {
       const a = e.getPropertyValue(n);
-      a && w.test(a) && e.removeProperty(n);
+      a && h.test(a) && e.removeProperty(n);
     }
     e.length === 0 && t.removeAttribute("style");
   }), i.addHook("uponSanitizeAttribute", (t, e) => {
-    b.has(e.attrName) && u.test(e.attrValue) && (e.keepAttr = !1);
+    m.has(e.attrName) && u.test(e.attrValue) && (e.keepAttr = !1);
   }), i.addHook("afterSanitizeAttributes", (t) => {
     if (!(t instanceof Element) || !t.hasAttribute("srcset")) return;
     (t.getAttribute("srcset") ?? "").split(",").map((r) => r.trim().split(/\s+/)[0]).some((r) => u.test(r)) && t.removeAttribute("srcset");
@@ -338,16 +348,17 @@ function k() {
     o.add("noopener"), t.setAttribute("rel", [...o].join(" "));
   }), i.addHook("afterSanitizeAttributes", (t) => {
     if (!(t instanceof Element) || t.tagName !== "IFRAME" || !t.hasAttribute("sandbox")) return;
-    const o = (t.getAttribute("sandbox") ?? "").toLowerCase().split(/\s+/).filter(Boolean), r = o.filter((s) => h.has(s));
+    const o = (t.getAttribute("sandbox") ?? "").toLowerCase().split(/\s+/).filter(Boolean), r = o.filter((s) => y.has(s));
     r.length !== o.length && t.setAttribute("sandbox", r.join(" "));
   }), i);
 }
-function R(t) {
+function R(t, e) {
   if (typeof window > "u")
     throw new Error("sanitizeHtml requires a DOM environment (window is not defined)");
-  return k().sanitize(t ?? "", y);
+  const o = e != null && e.allowFormAttributeNames ? { ...d, SANITIZE_DOM: !1 } : d;
+  return k().sanitize(t ?? "", o);
 }
-const d = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]), l = "http://platform-sanitize.invalid/", f = /^\s*\/\//, p = (
+const f = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]), l = "http://platform-sanitize.invalid/", b = /^\s*\/\//, g = (
   // oxlint-disable-next-line no-control-regex -- intentional security guard
   /^[\u0000-\u0020\u007F-\u00A0\u2000-\u200F\u2028\u2029\u202F\u205F\u2060\u3000\uFEFF]*(?:javascript|data|vbscript|file):/i
 ), A = {
@@ -385,14 +396,14 @@ function E(t) {
 function S(t) {
   if (!t || !t.trim()) return "about:blank";
   const e = t.replace(/\\/g, "/");
-  if (f.test(e) || p.test(e)) return "about:blank";
+  if (b.test(e) || g.test(e)) return "about:blank";
   if (/&[#A-Za-z]/.test(e)) {
     const o = E(e);
-    if (f.test(o) || p.test(o))
+    if (b.test(o) || g.test(o))
       return "about:blank";
     try {
       const r = new URL(o, l);
-      if (!r.href.startsWith(l) && !d.has(r.protocol))
+      if (!r.href.startsWith(l) && !f.has(r.protocol))
         return "about:blank";
     } catch {
       return "about:blank";
@@ -400,7 +411,7 @@ function S(t) {
   }
   try {
     const o = new URL(e, l);
-    return !d.has(o.protocol) || (o.protocol === "http:" || o.protocol === "https:") && (o.username || o.password) ? "about:blank" : o.href.startsWith(l) ? t : e.replace(/[\x00-\x1F\u2028\u2029]/g, "").replace(/%250[9ad]/gi, "").replace(/%0[9ad]/gi, "");
+    return !f.has(o.protocol) || (o.protocol === "http:" || o.protocol === "https:") && (o.username || o.password) ? "about:blank" : o.href.startsWith(l) ? t : e.replace(/[\x00-\x1F\u2028\u2029]/g, "").replace(/%250[9ad]/gi, "").replace(/%0[9ad]/gi, "");
   } catch {
     return "about:blank";
   }

package/dist/sanitizeHtml.d.ts

@@ -1,2 +1,4 @@
-export declare function sanitizeHtml(html: string | null | undefined): string;
+export declare function sanitizeHtml(html: string | null | undefined, options?: {
+    allowFormAttributeNames?: boolean;
+}): string;
 //# sourceMappingURL=sanitizeHtml.d.ts.map

package/dist/sanitizeHtml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizeHtml.d.ts","sourceRoot":"","sources":["../src/sanitizeHtml.ts"],"names":[],"mappings":"AA6aA,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAKpE"}
+{"version":3,"file":"sanitizeHtml.d.ts","sourceRoot":"","sources":["../src/sanitizeHtml.ts"],"names":[],"mappings":"AAubA,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,OAAO,CAAC,EAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9C,MAAM,CASR"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@instructure/platform-sanitize",
-  "version": "0.3.11",
+  "version": "0.3.13",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -17,25 +17,29 @@
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "build": "vite build",
-    "dev": "vite build --watch",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage",
-    "type-check": "tsc --noEmit"
-  },
   "peerDependencies": {
     "dompurify": "^3.4.0"
   },
   "devDependencies": {
     "@types/trusted-types": "^2.0.7",
+    "@vitest/browser": "^4.0.17",
+    "@vitest/browser-playwright": "^4.0.17",
     "@vitest/coverage-v8": "^4.0.17",
     "dompurify": "^3.4.0",
     "jsdom": "^25.0.0",
+    "playwright": "^1.60.0",
     "typescript": "^5.3.0",
     "vite": "^6.0.0",
     "vite-plugin-dts": "^4.0.0",
     "vitest": "^4.0.0"
+  },
+  "scripts": {
+    "build": "vite build",
+    "dev": "vite build --watch",
+    "test": "vitest run",
+    "test:browser": "vitest run --config vitest.browser.config.ts",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "type-check": "tsc --noEmit"
   }
-}
+}