@instructure/platform-sanitize 0.5.0 → 0.5.2

package/dist/index.js

@@ -1,5 +1,63 @@
-import f from "dompurify";
-const w = /* @__PURE__ */ new Set([
+import m from "dompurify";
+const f = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]), u = "http://platform-sanitize.invalid/", p = /^\s*\/\//, b = (
+  // oxlint-disable-next-line no-control-regex -- intentional security guard
+  /^[\u0000-\u0020\u007F-\u00A0\u2000-\u200F\u2028\u2029\u202F\u205F\u2060\u3000\uFEFF]*(?:javascript|data|vbscript|file):/i
+), h = {
+  colon: ":",
+  // javascript:alert(1) → javascript:alert(1)
+  sol: "/",
+  // //evil.com → //evil.com (protocol-relative)
+  bsol: "\\",
+  // \\evil.com → \\evil.com
+  Tab: "	",
+  // java	script: — WHATWG strips mid-scheme tabs
+  NewLine: `
+`
+  // java
script:
+};
+function w(s) {
+  return s.replace(/&#(\d+);/g, (t, e) => {
+    const r = Number(e);
+    if (!Number.isFinite(r) || r < 0 || r > 1114111) return "";
+    try {
+      return String.fromCodePoint(r);
+    } catch {
+      return "";
+    }
+  }).replace(/&#x([\da-f]+);/gi, (t, e) => {
+    const r = parseInt(e, 16);
+    if (!Number.isFinite(r) || r < 0 || r > 1114111) return "";
+    try {
+      return String.fromCodePoint(r);
+    } catch {
+      return "";
+    }
+  }).replace(/&([A-Za-z][A-Za-z0-9]*);/g, (t, e) => h[e] ?? t);
+}
+function A(s) {
+  if (!s || !s.trim()) return "about:blank";
+  const t = s.replace(/\\/g, "/");
+  if (p.test(t) || b.test(t)) return "about:blank";
+  if (/&[#A-Za-z]/.test(t)) {
+    const e = w(t);
+    if (p.test(e) || b.test(e))
+      return "about:blank";
+    try {
+      const r = new URL(e, u);
+      if (!r.href.startsWith(u) && !f.has(r.protocol))
+        return "about:blank";
+    } catch {
+      return "about:blank";
+    }
+  }
+  try {
+    const e = new URL(t, u);
+    return !f.has(e.protocol) || (e.protocol === "http:" || e.protocol === "https:") && (e.username || e.password) ? "about:blank" : e.href.startsWith(u) ? s : t.replace(/[\x00-\x1F\u2028\u2029]/g, "").replace(/%250[9ad]/gi, "").replace(/%0[9ad]/gi, "");
+  } catch {
+    return "about:blank";
+  }
+}
+const y = /* @__PURE__ */ new Set([
   // layout
   "display",
   "float",
@@ -241,7 +299,7 @@ const w = /* @__PURE__ */ new Set([
   "caret-color",
   "accent-color",
   "appearance"
-]), h = /* @__PURE__ */ new Set([
+]), k = /* @__PURE__ */ new Set([
   "src",
   "href",
   "action",
@@ -252,7 +310,7 @@ const w = /* @__PURE__ */ new Set([
   "cite",
   "longdesc",
   "xlink:href"
-]), y = ["content"], A = /url\s*\(\s*['"]?(?:[a-z][a-z0-9+\-.]*:|\/\/)/i, k = /* @__PURE__ */ new Set([
+]), S = ["content"], E = /url\s*\(\s*['"]?(?:[a-z][a-z0-9+\-.]*:|\/\/)/i, v = /* @__PURE__ */ new Set([
   "allow-downloads",
   "allow-forms",
   "allow-modals",
@@ -265,7 +323,14 @@ const w = /* @__PURE__ */ new Set([
   "allow-scripts",
   "allow-storage-access-by-user-activation",
   "allow-top-navigation-by-user-activation"
-]), p = {
+]), x = {
+  "data-url": "data-custom-url",
+  "data-method": "data-custom-method",
+  "data-remote": "data-custom-remote",
+  "data-remove": "data-custom-remove",
+  "data-confirm": "data-custom-confirm",
+  "data-disable-with": "data-custom-disable-with"
+}, _ = /* @__PURE__ */ new Set(["data-item-href"]), g = {
   // semantics and annotation are re-allowed because DOMPurify blocks all of
   // mathMlDisallowed by default. semantics is a safe structural wrapper;
   // annotation carries LaTeX source text (e.g. \frac{1}{2}); Canvas emits
@@ -299,7 +364,33 @@ const w = /* @__PURE__ */ new Set([
   // files from a separate sandboxed origin. object/embed also have no usable
   // sandbox attribute, so the sandbox-token hook cannot constrain them — again,
   // parity with an unsandboxed iframe, which is already permitted.
-  ADD_TAGS: ["iframe", "semantics", "annotation", "annotation-xml", "object", "embed", "param"],
+  //
+  // maction…none are the remaining MathML presentation/layout containers from
+  // DOMPurify's mathMlDisallowed set (RCX-5259). They are re-added as tags only:
+  // unlike annotation-xml they are NOT HTML integration points, so they carry no
+  // namespace-confusion (mXSS) risk and need no guarding hook. Because they go in
+  // ADD_TAGS and not ADD_ATTR, DOMPurify keeps filtering their attributes — an
+  // event handler like onclick on <maction> is still stripped.
+  ADD_TAGS: [
+    "iframe",
+    "semantics",
+    "annotation",
+    "annotation-xml",
+    "object",
+    "embed",
+    "param",
+    "maction",
+    "maligngroup",
+    "malignmark",
+    "mlongdiv",
+    "mscarries",
+    "mscarry",
+    "msgroup",
+    "mstack",
+    "msline",
+    "msrow",
+    "none"
+  ],
   ADD_ATTR: [
     "allowfullscreen",
     "allow",
@@ -330,10 +421,6 @@ const w = /* @__PURE__ */ new Set([
     "intent",
     "arg"
   ],
-  // Rails UJS turns data-method/data-remote/etc. on clickable elements into
-  // state-changing requests carrying the victim's CSRF token. Strip them so
-  // user-authored HTML cannot become a CSRF gadget when UJS is on the page.
-  FORBID_ATTR: ["data-method", "data-remote", "data-url", "data-confirm", "data-disable-with"],
   // In browsers that support the Trusted Types API (Chromium, Firefox),
   // DOMPurify returns a TrustedHTML object rather than a plain string. The
   // exported sanitizeHtml signature declares string — a deliberate lie that
@@ -349,18 +436,18 @@ const w = /* @__PURE__ */ new Set([
   // confusion attacks where fragments like <svg> could influence parse context.
   FORCE_BODY: !0
 };
-let n = null;
-function E() {
-  if (n) return n;
-  n = typeof f == "function" ? f(window) : f, n.addHook("afterSanitizeAttributes", (t) => {
+let a = null;
+function R() {
+  if (a) return a;
+  a = typeof m == "function" ? m(window) : m, a.addHook("afterSanitizeAttributes", (t) => {
     if (!(t instanceof Element) || !t.hasAttribute("style")) return;
     const e = t.style, r = [];
     for (let i = 0; i < e.length; i++) {
       const l = e.item(i);
-      w.has(l) || r.push(l);
+      y.has(l) || r.push(l);
     }
     for (const i of r) e.removeProperty(i);
-    const s = /* @__PURE__ */ new Set([
+    const n = /* @__PURE__ */ new Set([
       "static",
       "relative",
       "absolute",
@@ -370,120 +457,71 @@ function E() {
       "revert",
       "revert-layer"
     ]), c = e.getPropertyValue("position").trim().toLowerCase();
-    c && !s.has(c) && e.removeProperty("position");
+    c && !n.has(c) && e.removeProperty("position");
     const d = /* @__PURE__ */ new Set(["initial", "inherit", "unset", "revert", "revert-layer"]), o = e.getPropertyValue("opacity").trim().toLowerCase();
     o && !d.has(o) && (o.endsWith("%") ? parseFloat(o) / 100 : parseFloat(o)) < 0.05 && e.removeProperty("opacity");
-    for (const i of y) {
+    for (const i of S) {
       const l = e.getPropertyValue(i);
-      l && A.test(l) && e.removeProperty(i);
+      l && E.test(l) && e.removeProperty(i);
     }
     e.length === 0 && t.removeAttribute("style");
-  }), n.addHook("uponSanitizeAttribute", (t, e) => {
-    if (!h.has(e.attrName)) return;
+  }), a.addHook("uponSanitizeAttribute", (t, e) => {
+    if (!k.has(e.attrName)) return;
     const r = e.attrValue;
     /^\s*\/\//.test(r) ? (e.attrValue = r.trimStart().replace(/^\/\//, "https://"), e.keepAttr = !0) : /^\s*\\/.test(r) && (e.keepAttr = !1);
-  }), n.addHook("afterSanitizeAttributes", (t) => {
+  }), a.addHook("uponSanitizeAttribute", (t, e) => {
+    if (!_.has(e.attrName)) return;
+    const r = e.attrValue;
+    if (!r.trim()) return;
+    const n = /^\s*\/\//.test(r) ? r.trimStart().replace(/^\/\//, "https://") : r;
+    e.attrValue = A(n);
+  }), a.addHook("uponSanitizeAttribute", (t, e) => {
+    const r = x[e.attrName];
+    !r || !(t instanceof Element) || (t.hasAttribute(r) || t.setAttribute(r, e.attrValue), e.keepAttr = !1);
+  }), a.addHook("afterSanitizeAttributes", (t) => {
     if (!(t instanceof Element) || !t.hasAttribute("srcset")) return;
-    const r = (t.getAttribute("srcset") ?? "").split(","), s = (o) => o.trim().split(/\s+/)[0];
-    if (r.some((o) => /^\s*\\/.test(s(o)))) {
+    const r = (t.getAttribute("srcset") ?? "").split(","), n = (o) => o.trim().split(/\s+/)[0];
+    if (r.some((o) => /^\s*\\/.test(n(o)))) {
       t.removeAttribute("srcset");
       return;
     }
     let c = !1;
     const d = r.map((o) => {
-      const i = s(o);
+      const i = n(o);
       if (!i.startsWith("//")) return o;
       c = !0;
       const l = o.indexOf(i);
       return o.slice(0, l) + "https://" + i.slice(2) + o.slice(l + i.length);
     });
     c && t.setAttribute("srcset", d.join(","));
-  }), n.addHook("afterSanitizeAttributes", (t) => {
-    var s;
-    if (!(t instanceof Element) || t.tagName !== "A" && t.tagName !== "AREA" || ((s = t.getAttribute("target")) == null ? void 0 : s.toLowerCase()) !== "_blank") return;
+  }), a.addHook("afterSanitizeAttributes", (t) => {
+    var n;
+    if (!(t instanceof Element) || t.tagName !== "A" && t.tagName !== "AREA" || ((n = t.getAttribute("target")) == null ? void 0 : n.toLowerCase()) !== "_blank") return;
     const e = t.getAttribute("rel") ?? "", r = new Set(e.split(/\s+/).filter(Boolean));
     r.add("noopener"), t.setAttribute("rel", [...r].join(" "));
-  }), n.addHook("afterSanitizeAttributes", (t) => {
+  }), a.addHook("afterSanitizeAttributes", (t) => {
     if (!(t instanceof Element) || t.tagName !== "IFRAME" || !t.hasAttribute("sandbox")) return;
-    const r = (t.getAttribute("sandbox") ?? "").toLowerCase().split(/\s+/).filter(Boolean), s = r.filter((c) => k.has(c));
-    s.length !== r.length && t.setAttribute("sandbox", s.join(" "));
-  }), n.addHook("afterSanitizeAttributes", (t) => {
+    const r = (t.getAttribute("sandbox") ?? "").toLowerCase().split(/\s+/).filter(Boolean), n = r.filter((c) => v.has(c));
+    n.length !== r.length && t.setAttribute("sandbox", n.join(" "));
+  }), a.addHook("afterSanitizeAttributes", (t) => {
     if (!(t instanceof Element) || t.tagName !== "PARAM") return;
     const e = t.getAttribute("value");
     e && /^\s*(?:javascript|vbscript):/i.test(e) && t.removeAttribute("value");
   });
-  const a = /* @__PURE__ */ new Set(["text/html", "application/xhtml+xml"]);
-  return n.addHook("afterSanitizeElements", (t) => {
+  const s = /* @__PURE__ */ new Set(["text/html", "application/xhtml+xml"]);
+  return a.addHook("afterSanitizeElements", (t) => {
     if (!(t instanceof Element) || t.tagName.toLowerCase() !== "annotation-xml") return;
     const e = (t.getAttribute("encoding") ?? "").toLowerCase().trim();
-    a.has(e) && t.remove();
-  }), n;
+    s.has(e) && t.remove();
+  }), a;
 }
-function R(a, t) {
+function N(s, t) {
   if (typeof window > "u")
     throw new Error("sanitizeHtml requires a DOM environment (window is not defined)");
-  const e = t != null && t.allowFormAttributeNames ? { ...p, SANITIZE_DOM: !1 } : p;
-  return E().sanitize(a ?? "", e);
-}
-const m = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]), u = "http://platform-sanitize.invalid/", b = /^\s*\/\//, g = (
-  // oxlint-disable-next-line no-control-regex -- intentional security guard
-  /^[\u0000-\u0020\u007F-\u00A0\u2000-\u200F\u2028\u2029\u202F\u205F\u2060\u3000\uFEFF]*(?:javascript|data|vbscript|file):/i
-), S = {
-  colon: ":",
-  // javascript&colon;alert(1) → javascript:alert(1)
-  sol: "/",
-  // &sol;&sol;evil.com → //evil.com (protocol-relative)
-  bsol: "\\",
-  // &bsol;&bsol;evil.com → \\evil.com
-  Tab: "	",
-  // java&Tab;script: — WHATWG strips mid-scheme tabs
-  NewLine: `
-`
-  // java&NewLine;script:
-};
-function x(a) {
-  return a.replace(/&#(\d+);/g, (t, e) => {
-    const r = Number(e);
-    if (!Number.isFinite(r) || r < 0 || r > 1114111) return "";
-    try {
-      return String.fromCodePoint(r);
-    } catch {
-      return "";
-    }
-  }).replace(/&#x([\da-f]+);/gi, (t, e) => {
-    const r = parseInt(e, 16);
-    if (!Number.isFinite(r) || r < 0 || r > 1114111) return "";
-    try {
-      return String.fromCodePoint(r);
-    } catch {
-      return "";
-    }
-  }).replace(/&([A-Za-z][A-Za-z0-9]*);/g, (t, e) => S[e] ?? t);
-}
-function _(a) {
-  if (!a || !a.trim()) return "about:blank";
-  const t = a.replace(/\\/g, "/");
-  if (b.test(t) || g.test(t)) return "about:blank";
-  if (/&[#A-Za-z]/.test(t)) {
-    const e = x(t);
-    if (b.test(e) || g.test(e))
-      return "about:blank";
-    try {
-      const r = new URL(e, u);
-      if (!r.href.startsWith(u) && !m.has(r.protocol))
-        return "about:blank";
-    } catch {
-      return "about:blank";
-    }
-  }
-  try {
-    const e = new URL(t, u);
-    return !m.has(e.protocol) || (e.protocol === "http:" || e.protocol === "https:") && (e.username || e.password) ? "about:blank" : e.href.startsWith(u) ? a : t.replace(/[\x00-\x1F\u2028\u2029]/g, "").replace(/%250[9ad]/gi, "").replace(/%0[9ad]/gi, "");
-  } catch {
-    return "about:blank";
-  }
+  const e = t != null && t.allowFormAttributeNames ? { ...g, SANITIZE_DOM: !1 } : g;
+  return R().sanitize(s ?? "", e);
 }
 export {
-  R as sanitizeHtml,
-  _ as sanitizeUrl
+  N as sanitizeHtml,
+  A as sanitizeUrl
 };

package/dist/sanitizeHtml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizeHtml.d.ts","sourceRoot":"","sources":["../src/sanitizeHtml.ts"],"names":[],"mappings":"AAoiBA,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,OAAO,CAAC,EAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9C,MAAM,CASR"}
+{"version":3,"file":"sanitizeHtml.d.ts","sourceRoot":"","sources":["../src/sanitizeHtml.ts"],"names":[],"mappings":"AAymBA,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,OAAO,CAAC,EAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9C,MAAM,CASR"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@instructure/platform-sanitize",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",