@instructure/platform-sanitize 0.3.2 → 0.3.11

package/dist/index.js

@@ -1,5 +1,5 @@
-import a from "dompurify";
-const d = /* @__PURE__ */ new Set([
+import c from "dompurify";
+const g = /* @__PURE__ */ new Set([
   // layout
   "display",
   "float",
@@ -12,6 +12,12 @@ const d = /* @__PURE__ */ new Set([
   "direction",
   "user-select",
   "zoom",
+  // positioning — values filtered by allowlist hook below
+  "position",
+  "top",
+  "right",
+  "bottom",
+  "left",
   // sizing
   "width",
   "height",
@@ -19,6 +25,12 @@ const d = /* @__PURE__ */ new Set([
   "min-height",
   "max-width",
   "max-height",
+  // box model extensions
+  "box-sizing",
+  "aspect-ratio",
+  "resize",
+  "object-fit",
+  "object-position",
   // spacing
   "margin",
   "margin-top",
@@ -46,6 +58,35 @@ const d = /* @__PURE__ */ new Set([
   "text-indent",
   "white-space",
   "vertical-align",
+  "text-transform",
+  "letter-spacing",
+  "word-spacing",
+  "text-shadow",
+  "text-overflow",
+  "text-decoration-color",
+  "text-decoration-line",
+  "text-decoration-style",
+  "text-decoration-thickness",
+  "text-underline-offset",
+  "text-align-last",
+  "unicode-bidi",
+  // font extensions
+  "font-feature-settings",
+  "font-kerning",
+  "font-optical-sizing",
+  "font-variant-caps",
+  "font-variant-ligatures",
+  "font-variant-numeric",
+  // text flow
+  "word-break",
+  "overflow-wrap",
+  "word-wrap",
+  "hyphens",
+  "line-break",
+  "tab-size",
+  "writing-mode",
+  "text-orientation",
+  "text-combine-upright",
   // color & background
   "color",
   "background",
@@ -56,6 +97,9 @@ const d = /* @__PURE__ */ new Set([
   "background-position-x",
   "background-position-y",
   "background-repeat",
+  "background-size",
+  "background-clip",
+  "background-origin",
   // border
   "border",
   "border-color",
@@ -80,6 +124,12 @@ const d = /* @__PURE__ */ new Set([
   "border-left-color",
   "border-left-style",
   "border-left-width",
+  // shadows & outline
+  "box-shadow",
+  "outline",
+  "outline-color",
+  "outline-style",
+  "outline-width",
   // list
   "list-style",
   "list-style-image",
@@ -87,6 +137,8 @@ const d = /* @__PURE__ */ new Set([
   "list-style-type",
   // table
   "table-layout",
+  "caption-side",
+  "empty-cells",
   // flex
   "flex",
   "flex-basis",
@@ -126,8 +178,54 @@ const d = /* @__PURE__ */ new Set([
   "grid-template",
   "grid-template-areas",
   "grid-template-columns",
-  "grid-template-rows"
-]), c = /* @__PURE__ */ new Set([
+  "grid-template-rows",
+  // transitions
+  "transition",
+  "transition-property",
+  "transition-duration",
+  "transition-timing-function",
+  "transition-delay",
+  // animations
+  "animation",
+  "animation-name",
+  "animation-duration",
+  "animation-timing-function",
+  "animation-delay",
+  "animation-iteration-count",
+  "animation-direction",
+  "animation-fill-mode",
+  "animation-play-state",
+  // columns
+  "column-count",
+  "column-width",
+  "columns",
+  "column-rule",
+  "column-rule-color",
+  "column-rule-style",
+  "column-rule-width",
+  "column-fill",
+  "column-span",
+  // page breaks
+  "break-before",
+  "break-after",
+  "break-inside",
+  "page-break-before",
+  "page-break-after",
+  "page-break-inside",
+  // generated content
+  "quotes",
+  "counter-reset",
+  "counter-increment",
+  "content",
+  // UI / interaction
+  // pointer-events is included: RCE uses it legitimately (e.g. non-interactive
+  // decorative overlays). It is not in the overlay-phishing class because it
+  // cannot reposition elements — position/z-index remain blocked.
+  "pointer-events",
+  "caret-color",
+  "accent-color",
+  "appearance"
+]), b = /* @__PURE__ */ new Set([
   "src",
   "href",
   "action",
@@ -138,7 +236,29 @@ const d = /* @__PURE__ */ new Set([
   "cite",
   "longdesc",
   "xlink:href"
-]), l = /^\s*(\/\/|\\)/, f = {
+]), u = /^\s*(\/\/|\\)/, m = [
+  "background",
+  "background-image",
+  "list-style",
+  "list-style-image",
+  "cursor",
+  // content: url(...) triggers an HTTP GET even on non-pseudo elements in some
+  // browsers; strip it as defense-in-depth against tracking-pixel exfiltration.
+  "content"
+], w = /url\s*\(\s*['"]?(?:[a-z][a-z0-9+\-.]*:|\/\/)/i, h = /* @__PURE__ */ new Set([
+  "allow-downloads",
+  "allow-forms",
+  "allow-modals",
+  "allow-orientation-lock",
+  "allow-pointer-lock",
+  "allow-popups",
+  "allow-popups-to-escape-sandbox",
+  "allow-presentation",
+  "allow-same-origin",
+  "allow-scripts",
+  "allow-storage-access-by-user-activation",
+  "allow-top-navigation-by-user-activation"
+]), y = {
   ADD_TAGS: ["iframe"],
   ADD_ATTR: [
     "allowfullscreen",
@@ -153,7 +273,13 @@ const d = /* @__PURE__ */ new Set([
     "target",
     "webkitallowfullscreen",
     "mozallowfullscreen",
-    "scrolling"
+    "scrolling",
+    // MathML 4 (W3C) annotation attributes for screen-reader accessibility.
+    // MathCAT, JAWS, and NVDA use `intent` to know how to pronounce
+    // expressions; `arg` labels sub-expressions referenced by intent.
+    // These are plain string annotations — no URL-loading, no code execution.
+    "intent",
+    "arg"
   ],
   // Rails UJS turns data-method/data-remote/etc. on clickable elements into
   // state-changing requests carrying the victim's CSRF token. Strip them so
@@ -169,44 +295,117 @@ const d = /* @__PURE__ */ new Set([
   // a per-call cast. Do not perform string operations (.slice, .match, etc.)
   // on the return value — those methods do not exist on TrustedHTML and will
   // throw in modern browsers.
-  RETURN_TRUSTED_TYPE: !0
+  RETURN_TRUSTED_TYPE: !0,
+  // Wraps input in a body context during parsing, preventing namespace
+  // confusion attacks where fragments like <svg> could influence parse context.
+  FORCE_BODY: !0
 };
-let o = null;
-function g() {
-  return o || (o = typeof a == "function" ? a(window) : a, o.addHook("afterSanitizeAttributes", (t) => {
+let i = null;
+function k() {
+  return i || (i = typeof c == "function" ? c(window) : c, i.addHook("afterSanitizeAttributes", (t) => {
     if (!(t instanceof Element) || !t.hasAttribute("style")) return;
-    const e = t.style, i = [];
-    for (let r = 0; r < e.length; r++) {
-      const n = e.item(r);
-      d.has(n) || i.push(n);
+    const e = t.style, o = [];
+    for (let n = 0; n < e.length; n++) {
+      const a = e.item(n);
+      g.has(a) || o.push(a);
+    }
+    for (const n of o) e.removeProperty(n);
+    const r = /* @__PURE__ */ new Set([
+      "static",
+      "relative",
+      "absolute",
+      "initial",
+      "inherit",
+      "unset",
+      "revert",
+      "revert-layer"
+    ]), s = e.getPropertyValue("position").trim().toLowerCase();
+    s && !r.has(s) && e.removeProperty("position");
+    for (const n of m) {
+      const a = e.getPropertyValue(n);
+      a && w.test(a) && e.removeProperty(n);
     }
-    for (const r of i) e.removeProperty(r);
     e.length === 0 && t.removeAttribute("style");
-  }), o.addHook("uponSanitizeAttribute", (t, e) => {
-    c.has(e.attrName) && l.test(e.attrValue) && (e.keepAttr = !1);
-  }), o.addHook("afterSanitizeAttributes", (t) => {
+  }), i.addHook("uponSanitizeAttribute", (t, e) => {
+    b.has(e.attrName) && u.test(e.attrValue) && (e.keepAttr = !1);
+  }), i.addHook("afterSanitizeAttributes", (t) => {
     if (!(t instanceof Element) || !t.hasAttribute("srcset")) return;
-    (t.getAttribute("srcset") ?? "").split(",").map((r) => r.trim().split(/\s+/)[0]).some((r) => l.test(r)) && t.removeAttribute("srcset");
-  }), o);
+    (t.getAttribute("srcset") ?? "").split(",").map((r) => r.trim().split(/\s+/)[0]).some((r) => u.test(r)) && t.removeAttribute("srcset");
+  }), i.addHook("afterSanitizeAttributes", (t) => {
+    var r;
+    if (!(t instanceof Element) || t.tagName !== "A" && t.tagName !== "AREA" || ((r = t.getAttribute("target")) == null ? void 0 : r.toLowerCase()) !== "_blank") return;
+    const e = t.getAttribute("rel") ?? "", o = new Set(e.split(/\s+/).filter(Boolean));
+    o.add("noopener"), t.setAttribute("rel", [...o].join(" "));
+  }), i.addHook("afterSanitizeAttributes", (t) => {
+    if (!(t instanceof Element) || t.tagName !== "IFRAME" || !t.hasAttribute("sandbox")) return;
+    const o = (t.getAttribute("sandbox") ?? "").toLowerCase().split(/\s+/).filter(Boolean), r = o.filter((s) => h.has(s));
+    r.length !== o.length && t.setAttribute("sandbox", r.join(" "));
+  }), i);
 }
-function p(t) {
+function R(t) {
   if (typeof window > "u")
     throw new Error("sanitizeHtml requires a DOM environment (window is not defined)");
-  return g().sanitize(t ?? "", f);
+  return k().sanitize(t ?? "", y);
 }
-const m = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]), s = "http://platform-sanitize.invalid/", u = /^\s*\/\//;
-function h(t) {
+const d = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]), l = "http://platform-sanitize.invalid/", f = /^\s*\/\//, p = (
+  // oxlint-disable-next-line no-control-regex -- intentional security guard
+  /^[\u0000-\u0020\u007F-\u00A0\u2000-\u200F\u2028\u2029\u202F\u205F\u2060\u3000\uFEFF]*(?:javascript|data|vbscript|file):/i
+), A = {
+  colon: ":",
+  // javascript&colon;alert(1) → javascript:alert(1)
+  sol: "/",
+  // &sol;&sol;evil.com → //evil.com (protocol-relative)
+  bsol: "\\",
+  // &bsol;&bsol;evil.com → \\evil.com
+  Tab: "	",
+  // java&Tab;script: — WHATWG strips mid-scheme tabs
+  NewLine: `
+`
+  // java&NewLine;script:
+};
+function E(t) {
+  return t.replace(/&#(\d+);/g, (e, o) => {
+    const r = Number(o);
+    if (!Number.isFinite(r) || r < 0 || r > 1114111) return "";
+    try {
+      return String.fromCodePoint(r);
+    } catch {
+      return "";
+    }
+  }).replace(/&#x([\da-f]+);/gi, (e, o) => {
+    const r = parseInt(o, 16);
+    if (!Number.isFinite(r) || r < 0 || r > 1114111) return "";
+    try {
+      return String.fromCodePoint(r);
+    } catch {
+      return "";
+    }
+  }).replace(/&([A-Za-z][A-Za-z0-9]*);/g, (e, o) => A[o] ?? e);
+}
+function S(t) {
   if (!t || !t.trim()) return "about:blank";
   const e = t.replace(/\\/g, "/");
-  if (u.test(e)) return "about:blank";
+  if (f.test(e) || p.test(e)) return "about:blank";
+  if (/&[#A-Za-z]/.test(e)) {
+    const o = E(e);
+    if (f.test(o) || p.test(o))
+      return "about:blank";
+    try {
+      const r = new URL(o, l);
+      if (!r.href.startsWith(l) && !d.has(r.protocol))
+        return "about:blank";
+    } catch {
+      return "about:blank";
+    }
+  }
   try {
-    const i = new URL(e, s);
-    return m.has(i.protocol) ? i.href.startsWith(s) ? t : e.replace(/[\x00-\x1F]/g, "") : "about:blank";
+    const o = new URL(e, l);
+    return !d.has(o.protocol) || (o.protocol === "http:" || o.protocol === "https:") && (o.username || o.password) ? "about:blank" : o.href.startsWith(l) ? t : e.replace(/[\x00-\x1F\u2028\u2029]/g, "").replace(/%250[9ad]/gi, "").replace(/%0[9ad]/gi, "");
   } catch {
     return "about:blank";
   }
 }
 export {
-  p as sanitizeHtml,
-  h as sanitizeUrl
+  R as sanitizeHtml,
+  S as sanitizeUrl
 };

package/dist/sanitizeHtml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizeHtml.d.ts","sourceRoot":"","sources":["../src/sanitizeHtml.ts"],"names":[],"mappings":"AA4OA,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAKpE"}
+{"version":3,"file":"sanitizeHtml.d.ts","sourceRoot":"","sources":["../src/sanitizeHtml.ts"],"names":[],"mappings":"AA6aA,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAKpE"}

package/dist/sanitizeUrl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizeUrl.d.ts","sourceRoot":"","sources":["../src/sanitizeUrl.ts"],"names":[],"mappings":"AAyBA,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAoBlE"}
+{"version":3,"file":"sanitizeUrl.d.ts","sourceRoot":"","sources":["../src/sanitizeUrl.ts"],"names":[],"mappings":"AAoFA,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAwDlE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@instructure/platform-sanitize",
-  "version": "0.3.2",
+  "version": "0.3.11",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -17,24 +17,25 @@
   "publishConfig": {
     "access": "public"
   },
+  "scripts": {
+    "build": "vite build",
+    "dev": "vite build --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "type-check": "tsc --noEmit"
+  },
   "peerDependencies": {
-    "dompurify": "^3.0.0"
+    "dompurify": "^3.4.0"
   },
   "devDependencies": {
+    "@types/trusted-types": "^2.0.7",
     "@vitest/coverage-v8": "^4.0.17",
-    "dompurify": "^3.0.0",
+    "dompurify": "^3.4.0",
     "jsdom": "^25.0.0",
     "typescript": "^5.3.0",
     "vite": "^6.0.0",
     "vite-plugin-dts": "^4.0.0",
     "vitest": "^4.0.0"
-  },
-  "scripts": {
-    "build": "vite build",
-    "dev": "vite build --watch",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage",
-    "type-check": "tsc --noEmit"
   }
-}
+}