@instructure/platform-sanitize 0.3.13 → 0.3.15

package/dist/index.js

@@ -1,5 +1,5 @@
-import c from "dompurify";
-const p = /* @__PURE__ */ new Set([
+import u from "dompurify";
+const m = /* @__PURE__ */ new Set([
   // layout
   "display",
   "float",
@@ -228,14 +228,15 @@ const p = /* @__PURE__ */ new Set([
   "counter-increment",
   "content",
   // UI / interaction
-  // pointer-events is included: RCE uses it legitimately (e.g. non-interactive
-  // decorative overlays). It is not in the overlay-phishing class because it
-  // cannot reposition elements — position/z-index remain blocked.
+  // pointer-events and z-index are safe: neither can reposition elements
+  // outside the container. The overlay-phishing risk comes from position:fixed/sticky,
+  // which SAFE_POSITION_VALUES strips.
   "pointer-events",
+  "z-index",
   "caret-color",
   "accent-color",
   "appearance"
-]), m = /* @__PURE__ */ new Set([
+]), w = /* @__PURE__ */ new Set([
   "src",
   "href",
   "action",
@@ -246,7 +247,7 @@ const p = /* @__PURE__ */ new Set([
   "cite",
   "longdesc",
   "xlink:href"
-]), u = /^\s*(\/\/|\\)/, w = [
+]), h = [
   "background",
   "background-image",
   "list-style",
@@ -255,7 +256,7 @@ const p = /* @__PURE__ */ new Set([
   // content: url(...) triggers an HTTP GET even on non-pseudo elements in some
   // browsers; strip it as defense-in-depth against tracking-pixel exfiltration.
   "content"
-], h = /url\s*\(\s*['"]?(?:[a-z][a-z0-9+\-.]*:|\/\/)/i, y = /* @__PURE__ */ new Set([
+], y = /url\s*\(\s*['"]?(?:[a-z][a-z0-9+\-.]*:|\/\/)/i, k = /* @__PURE__ */ new Set([
   "allow-downloads",
   "allow-forms",
   "allow-modals",
@@ -268,7 +269,7 @@ const p = /* @__PURE__ */ new Set([
   "allow-scripts",
   "allow-storage-access-by-user-activation",
   "allow-top-navigation-by-user-activation"
-]), d = {
+]), f = {
   ADD_TAGS: ["iframe"],
   ADD_ATTR: [
     "allowfullscreen",
@@ -289,7 +290,8 @@ const p = /* @__PURE__ */ new Set([
     // expressions; `arg` labels sub-expressions referenced by intent.
     // These are plain string annotations — no URL-loading, no code execution.
     "intent",
-    "arg"
+    "arg",
+    "loading"
   ],
   // Rails UJS turns data-method/data-remote/etc. on clickable elements into
   // state-changing requests carrying the victim's CSRF token. Strip them so
@@ -310,17 +312,17 @@ const p = /* @__PURE__ */ new Set([
   // confusion attacks where fragments like <svg> could influence parse context.
   FORCE_BODY: !0
 };
-let i = null;
-function k() {
-  return i || (i = typeof c == "function" ? c(window) : c, i.addHook("afterSanitizeAttributes", (t) => {
-    if (!(t instanceof Element) || !t.hasAttribute("style")) return;
-    const e = t.style, o = [];
-    for (let n = 0; n < e.length; n++) {
-      const a = e.item(n);
-      p.has(a) || o.push(a);
+let a = null;
+function A() {
+  return a || (a = typeof u == "function" ? u(window) : u, a.addHook("afterSanitizeAttributes", (e) => {
+    if (!(e instanceof Element) || !e.hasAttribute("style")) return;
+    const r = e.style, t = [];
+    for (let n = 0; n < r.length; n++) {
+      const i = r.item(n);
+      m.has(i) || t.push(i);
     }
-    for (const n of o) e.removeProperty(n);
-    const r = /* @__PURE__ */ new Set([
+    for (const n of t) r.removeProperty(n);
+    const o = /* @__PURE__ */ new Set([
       "static",
       "relative",
       "absolute",
@@ -329,39 +331,54 @@ function k() {
       "unset",
       "revert",
       "revert-layer"
-    ]), s = e.getPropertyValue("position").trim().toLowerCase();
-    s && !r.has(s) && e.removeProperty("position");
-    for (const n of w) {
-      const a = e.getPropertyValue(n);
-      a && h.test(a) && e.removeProperty(n);
+    ]), s = r.getPropertyValue("position").trim().toLowerCase();
+    s && !o.has(s) && r.removeProperty("position");
+    for (const n of h) {
+      const i = r.getPropertyValue(n);
+      i && y.test(i) && r.removeProperty(n);
     }
-    e.length === 0 && t.removeAttribute("style");
-  }), i.addHook("uponSanitizeAttribute", (t, e) => {
-    m.has(e.attrName) && u.test(e.attrValue) && (e.keepAttr = !1);
-  }), i.addHook("afterSanitizeAttributes", (t) => {
-    if (!(t instanceof Element) || !t.hasAttribute("srcset")) return;
-    (t.getAttribute("srcset") ?? "").split(",").map((r) => r.trim().split(/\s+/)[0]).some((r) => u.test(r)) && t.removeAttribute("srcset");
-  }), i.addHook("afterSanitizeAttributes", (t) => {
-    var r;
-    if (!(t instanceof Element) || t.tagName !== "A" && t.tagName !== "AREA" || ((r = t.getAttribute("target")) == null ? void 0 : r.toLowerCase()) !== "_blank") return;
-    const e = t.getAttribute("rel") ?? "", o = new Set(e.split(/\s+/).filter(Boolean));
-    o.add("noopener"), t.setAttribute("rel", [...o].join(" "));
-  }), i.addHook("afterSanitizeAttributes", (t) => {
-    if (!(t instanceof Element) || t.tagName !== "IFRAME" || !t.hasAttribute("sandbox")) return;
-    const o = (t.getAttribute("sandbox") ?? "").toLowerCase().split(/\s+/).filter(Boolean), r = o.filter((s) => y.has(s));
-    r.length !== o.length && t.setAttribute("sandbox", r.join(" "));
-  }), i);
+    r.length === 0 && e.removeAttribute("style");
+  }), a.addHook("uponSanitizeAttribute", (e, r) => {
+    if (!w.has(r.attrName)) return;
+    const t = r.attrValue;
+    /^\s*\/\//.test(t) ? (r.attrValue = t.trimStart().replace(/^\/\//, "https://"), r.keepAttr = !0) : /^\s*\\/.test(t) && (r.keepAttr = !1);
+  }), a.addHook("afterSanitizeAttributes", (e) => {
+    if (!(e instanceof Element) || !e.hasAttribute("srcset")) return;
+    const t = (e.getAttribute("srcset") ?? "").split(","), o = (i) => i.trim().split(/\s+/)[0];
+    if (t.some((i) => /^\s*\\/.test(o(i)))) {
+      e.removeAttribute("srcset");
+      return;
+    }
+    let s = !1;
+    const n = t.map((i) => {
+      const l = o(i);
+      if (!l.startsWith("//")) return i;
+      s = !0;
+      const d = i.indexOf(l);
+      return i.slice(0, d) + "https://" + l.slice(2) + i.slice(d + l.length);
+    });
+    s && e.setAttribute("srcset", n.join(","));
+  }), a.addHook("afterSanitizeAttributes", (e) => {
+    var o;
+    if (!(e instanceof Element) || e.tagName !== "A" && e.tagName !== "AREA" || ((o = e.getAttribute("target")) == null ? void 0 : o.toLowerCase()) !== "_blank") return;
+    const r = e.getAttribute("rel") ?? "", t = new Set(r.split(/\s+/).filter(Boolean));
+    t.add("noopener"), e.setAttribute("rel", [...t].join(" "));
+  }), a.addHook("afterSanitizeAttributes", (e) => {
+    if (!(e instanceof Element) || e.tagName !== "IFRAME" || !e.hasAttribute("sandbox")) return;
+    const t = (e.getAttribute("sandbox") ?? "").toLowerCase().split(/\s+/).filter(Boolean), o = t.filter((s) => k.has(s));
+    o.length !== t.length && e.setAttribute("sandbox", o.join(" "));
+  }), a);
 }
-function R(t, e) {
+function v(e, r) {
   if (typeof window > "u")
     throw new Error("sanitizeHtml requires a DOM environment (window is not defined)");
-  const o = e != null && e.allowFormAttributeNames ? { ...d, SANITIZE_DOM: !1 } : d;
-  return k().sanitize(t ?? "", o);
+  const t = r != null && r.allowFormAttributeNames ? { ...f, SANITIZE_DOM: !1 } : f;
+  return A().sanitize(e ?? "", t);
 }
-const f = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]), l = "http://platform-sanitize.invalid/", b = /^\s*\/\//, g = (
+const p = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]), c = "http://platform-sanitize.invalid/", g = /^\s*\/\//, b = (
   // oxlint-disable-next-line no-control-regex -- intentional security guard
   /^[\u0000-\u0020\u007F-\u00A0\u2000-\u200F\u2028\u2029\u202F\u205F\u2060\u3000\uFEFF]*(?:javascript|data|vbscript|file):/i
-), A = {
+), x = {
   colon: ":",
   // javascript&colon;alert(1) → javascript:alert(1)
   sol: "/",
@@ -374,49 +391,49 @@ const f = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]), l = "
 `
   // java&NewLine;script:
 };
-function E(t) {
-  return t.replace(/&#(\d+);/g, (e, o) => {
-    const r = Number(o);
-    if (!Number.isFinite(r) || r < 0 || r > 1114111) return "";
+function E(e) {
+  return e.replace(/&#(\d+);/g, (r, t) => {
+    const o = Number(t);
+    if (!Number.isFinite(o) || o < 0 || o > 1114111) return "";
     try {
-      return String.fromCodePoint(r);
+      return String.fromCodePoint(o);
     } catch {
       return "";
     }
-  }).replace(/&#x([\da-f]+);/gi, (e, o) => {
-    const r = parseInt(o, 16);
-    if (!Number.isFinite(r) || r < 0 || r > 1114111) return "";
+  }).replace(/&#x([\da-f]+);/gi, (r, t) => {
+    const o = parseInt(t, 16);
+    if (!Number.isFinite(o) || o < 0 || o > 1114111) return "";
     try {
-      return String.fromCodePoint(r);
+      return String.fromCodePoint(o);
     } catch {
       return "";
     }
-  }).replace(/&([A-Za-z][A-Za-z0-9]*);/g, (e, o) => A[o] ?? e);
+  }).replace(/&([A-Za-z][A-Za-z0-9]*);/g, (r, t) => x[t] ?? r);
 }
-function S(t) {
-  if (!t || !t.trim()) return "about:blank";
-  const e = t.replace(/\\/g, "/");
-  if (b.test(e) || g.test(e)) return "about:blank";
-  if (/&[#A-Za-z]/.test(e)) {
-    const o = E(e);
-    if (b.test(o) || g.test(o))
+function R(e) {
+  if (!e || !e.trim()) return "about:blank";
+  const r = e.replace(/\\/g, "/");
+  if (g.test(r) || b.test(r)) return "about:blank";
+  if (/&[#A-Za-z]/.test(r)) {
+    const t = E(r);
+    if (g.test(t) || b.test(t))
       return "about:blank";
     try {
-      const r = new URL(o, l);
-      if (!r.href.startsWith(l) && !f.has(r.protocol))
+      const o = new URL(t, c);
+      if (!o.href.startsWith(c) && !p.has(o.protocol))
         return "about:blank";
     } catch {
       return "about:blank";
     }
   }
   try {
-    const o = new URL(e, l);
-    return !f.has(o.protocol) || (o.protocol === "http:" || o.protocol === "https:") && (o.username || o.password) ? "about:blank" : o.href.startsWith(l) ? t : e.replace(/[\x00-\x1F\u2028\u2029]/g, "").replace(/%250[9ad]/gi, "").replace(/%0[9ad]/gi, "");
+    const t = new URL(r, c);
+    return !p.has(t.protocol) || (t.protocol === "http:" || t.protocol === "https:") && (t.username || t.password) ? "about:blank" : t.href.startsWith(c) ? e : r.replace(/[\x00-\x1F\u2028\u2029]/g, "").replace(/%250[9ad]/gi, "").replace(/%0[9ad]/gi, "");
   } catch {
     return "about:blank";
   }
 }
 export {
-  R as sanitizeHtml,
-  S as sanitizeUrl
+  v as sanitizeHtml,
+  R as sanitizeUrl
 };

package/dist/sanitizeHtml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizeHtml.d.ts","sourceRoot":"","sources":["../src/sanitizeHtml.ts"],"names":[],"mappings":"AAubA,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,OAAO,CAAC,EAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9C,MAAM,CASR"}
+{"version":3,"file":"sanitizeHtml.d.ts","sourceRoot":"","sources":["../src/sanitizeHtml.ts"],"names":[],"mappings":"AA6cA,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,OAAO,CAAC,EAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9C,MAAM,CASR"}

package/dist/sanitizeUrl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizeUrl.d.ts","sourceRoot":"","sources":["../src/sanitizeUrl.ts"],"names":[],"mappings":"AAoFA,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAwDlE"}
+{"version":3,"file":"sanitizeUrl.d.ts","sourceRoot":"","sources":["../src/sanitizeUrl.ts"],"names":[],"mappings":"AAsFA,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAwDlE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@instructure/platform-sanitize",
-  "version": "0.3.13",
+  "version": "0.3.15",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",