@instructure/platform-sanitize 0.5.1 → 0.5.3

package/dist/index.js

@@ -1,5 +1,5 @@
-import f from "dompurify";
-const m = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]), u = "http://platform-sanitize.invalid/", p = /^\s*\/\//, b = (
+import m from "dompurify";
+const f = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]), u = "http://platform-sanitize.invalid/", p = /^\s*\/\//, b = (
   // oxlint-disable-next-line no-control-regex -- intentional security guard
   /^[\u0000-\u0020\u007F-\u00A0\u2000-\u200F\u2028\u2029\u202F\u205F\u2060\u3000\uFEFF]*(?:javascript|data|vbscript|file):/i
 ), h = {
@@ -44,7 +44,7 @@ function A(s) {
       return "about:blank";
     try {
       const r = new URL(e, u);
-      if (!r.href.startsWith(u) && !m.has(r.protocol))
+      if (!r.href.startsWith(u) && !f.has(r.protocol))
         return "about:blank";
     } catch {
       return "about:blank";
@@ -52,7 +52,7 @@ function A(s) {
   }
   try {
     const e = new URL(t, u);
-    return !m.has(e.protocol) || (e.protocol === "http:" || e.protocol === "https:") && (e.username || e.password) ? "about:blank" : e.href.startsWith(u) ? s : t.replace(/[\x00-\x1F\u2028\u2029]/g, "").replace(/%250[9ad]/gi, "").replace(/%0[9ad]/gi, "");
+    return !f.has(e.protocol) || (e.protocol === "http:" || e.protocol === "https:") && (e.username || e.password) ? "about:blank" : e.href.startsWith(u) ? s : t.replace(/[\x00-\x1F\u2028\u2029]/g, "").replace(/%250[9ad]/gi, "").replace(/%0[9ad]/gi, "");
   } catch {
     return "about:blank";
   }
@@ -116,6 +116,11 @@ const y = /* @__PURE__ */ new Set([
   "text-decoration",
   "text-indent",
   "white-space",
+  // Chrome's CSSOM expands `white-space` to these longhands when iterating
+  // element.style — the shorthand never appears in the iterator, so the hook
+  // would strip them unless listed explicitly (same as border-radius below).
+  "white-space-collapse",
+  "text-wrap-mode",
   "vertical-align",
   "text-transform",
   "letter-spacing",
@@ -299,7 +304,7 @@ const y = /* @__PURE__ */ new Set([
   "caret-color",
   "accent-color",
   "appearance"
-]), S = /* @__PURE__ */ new Set([
+]), k = /* @__PURE__ */ new Set([
   "src",
   "href",
   "action",
@@ -310,7 +315,7 @@ const y = /* @__PURE__ */ new Set([
   "cite",
   "longdesc",
   "xlink:href"
-]), k = ["content"], E = /url\s*\(\s*['"]?(?:[a-z][a-z0-9+\-.]*:|\/\/)/i, v = /* @__PURE__ */ new Set([
+]), S = ["content"], E = /url\s*\(\s*['"]?(?:[a-z][a-z0-9+\-.]*:|\/\/)/i, v = /* @__PURE__ */ new Set([
   "allow-downloads",
   "allow-forms",
   "allow-modals",
@@ -364,7 +369,33 @@ const y = /* @__PURE__ */ new Set([
   // files from a separate sandboxed origin. object/embed also have no usable
   // sandbox attribute, so the sandbox-token hook cannot constrain them — again,
   // parity with an unsandboxed iframe, which is already permitted.
-  ADD_TAGS: ["iframe", "semantics", "annotation", "annotation-xml", "object", "embed", "param"],
+  //
+  // maction…none are the remaining MathML presentation/layout containers from
+  // DOMPurify's mathMlDisallowed set (RCX-5259). They are re-added as tags only:
+  // unlike annotation-xml they are NOT HTML integration points, so they carry no
+  // namespace-confusion (mXSS) risk and need no guarding hook. Because they go in
+  // ADD_TAGS and not ADD_ATTR, DOMPurify keeps filtering their attributes — an
+  // event handler like onclick on <maction> is still stripped.
+  ADD_TAGS: [
+    "iframe",
+    "semantics",
+    "annotation",
+    "annotation-xml",
+    "object",
+    "embed",
+    "param",
+    "maction",
+    "maligngroup",
+    "malignmark",
+    "mlongdiv",
+    "mscarries",
+    "mscarry",
+    "msgroup",
+    "mstack",
+    "msline",
+    "msrow",
+    "none"
+  ],
   ADD_ATTR: [
     "allowfullscreen",
     "allow",
@@ -413,7 +444,7 @@ const y = /* @__PURE__ */ new Set([
 let a = null;
 function R() {
   if (a) return a;
-  a = typeof f == "function" ? f(window) : f, a.addHook("afterSanitizeAttributes", (t) => {
+  a = typeof m == "function" ? m(window) : m, a.addHook("afterSanitizeAttributes", (t) => {
     if (!(t instanceof Element) || !t.hasAttribute("style")) return;
     const e = t.style, r = [];
     for (let i = 0; i < e.length; i++) {
@@ -434,13 +465,13 @@ function R() {
     c && !n.has(c) && e.removeProperty("position");
     const d = /* @__PURE__ */ new Set(["initial", "inherit", "unset", "revert", "revert-layer"]), o = e.getPropertyValue("opacity").trim().toLowerCase();
     o && !d.has(o) && (o.endsWith("%") ? parseFloat(o) / 100 : parseFloat(o)) < 0.05 && e.removeProperty("opacity");
-    for (const i of k) {
+    for (const i of S) {
       const l = e.getPropertyValue(i);
       l && E.test(l) && e.removeProperty(i);
     }
     e.length === 0 && t.removeAttribute("style");
   }), a.addHook("uponSanitizeAttribute", (t, e) => {
-    if (!S.has(e.attrName)) return;
+    if (!k.has(e.attrName)) return;
     const r = e.attrValue;
     /^\s*\/\//.test(r) ? (e.attrValue = r.trimStart().replace(/^\/\//, "https://"), e.keepAttr = !0) : /^\s*\\/.test(r) && (e.keepAttr = !1);
   }), a.addHook("uponSanitizeAttribute", (t, e) => {

package/dist/sanitizeHtml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizeHtml.d.ts","sourceRoot":"","sources":["../src/sanitizeHtml.ts"],"names":[],"mappings":"AA+kBA,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,OAAO,CAAC,EAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9C,MAAM,CASR"}
+{"version":3,"file":"sanitizeHtml.d.ts","sourceRoot":"","sources":["../src/sanitizeHtml.ts"],"names":[],"mappings":"AA8mBA,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,OAAO,CAAC,EAAE;IAAE,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9C,MAAM,CASR"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@instructure/platform-sanitize",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",