@juspay/svelte-ui-components 2.136.1 → 2.136.7

package/dist/MarkdownText/markdown.js

@@ -0,0 +1,105 @@
+import { Marked } from 'marked';
+/**
+ * Chat content comes from models and users, not from the app's own templates,
+ * so the output must be safe without asking consumers to run a sanitizer:
+ * raw HTML never passes through (it renders as escaped text), and only these
+ * URL protocols survive on links. Everything else in the output is built by
+ * marked from markdown syntax alone.
+ */
+const SAFE_LINK_PROTOCOLS = new Set(['http:', 'https:', 'mailto:', 'tel:']);
+const SAFE_IMAGE_PROTOCOLS = new Set(['http:', 'https:']);
+/**
+ * Character references that decode to an ASCII control character, plus the two
+ * named forms HTML defines for tab and newline. These are the smuggling vector:
+ * `jav	ascript:` is not a scheme to `new URL()`, so it reads as a harmless
+ * relative path -- but the browser decodes the reference back to a tab when it
+ * parses the attribute, and the WHATWG URL parser strips tabs and newlines from
+ * INSIDE a scheme, leaving `javascript:`. The validator and the browser
+ * therefore disagree about the same string, which is the whole bug.
+ */
+const NUMERIC_REFERENCE = /&#(x[0-9a-f]+|[0-9]+);?/gi;
+const NAMED_WHITESPACE_REFERENCE = /&(tab|newline);/gi;
+// Matching control characters is the entire point: these are exactly what the
+// URL parser silently removes, and what an attacker smuggles in as a character
+// reference to hide a scheme.
+// eslint-disable-next-line no-control-regex
+const STRIPPED_BY_URL_PARSER = /[\u0000-\u0020\u007f]/g;
+/**
+ * Normalise an href the way the BROWSER will see it, then check the protocol.
+ * Decoding first and stripping second is what closes the gap: whatever survives
+ * this is what the URL parser is actually handed at click time.
+ */
+function normaliseForProtocolCheck(href) {
+    return href
+        .replace(NUMERIC_REFERENCE, (_match, code) => String.fromCodePoint(code[0].toLowerCase() === 'x' ? parseInt(code.slice(1), 16) : parseInt(code, 10)))
+        .replace(NAMED_WHITESPACE_REFERENCE, ' ')
+        .replace(STRIPPED_BY_URL_PARSER, '');
+}
+/**
+ * Relative URLs resolve against the placeholder base and come out `https:`, so
+ * they are allowed without a special case.
+ */
+function hasSafeProtocol(href, allowList) {
+    try {
+        return allowList.has(new URL(normaliseForProtocolCheck(href), 'https://relative.invalid').protocol);
+    }
+    catch {
+        return false;
+    }
+}
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+const sanitizingRenderer = {
+    html(token) {
+        return escapeHtml(token.text);
+    },
+    link(token) {
+        if (hasSafeProtocol(token.href, SAFE_LINK_PROTOCOLS)) {
+            return false;
+        }
+        return escapeHtml(token.text);
+    },
+    image(token) {
+        if (hasSafeProtocol(token.href, SAFE_IMAGE_PROTOCOLS)) {
+            return false;
+        }
+        return escapeHtml(token.text);
+    }
+};
+/* Safe to share across SSR requests: each instance's configuration (renderer,
+   gfm, breaks) is fixed at construction and parse() takes no per-request state,
+   so the cache only ever holds config-immutable parsers keyed by option shape. */
+const instances = new Map();
+/* External links open in a new tab with `rel="noopener noreferrer"` — the same
+   default the library's Button/Card apply to `target="_blank"` anchors. The
+   default renderer never emits `target`, so the regex can only annotate, never
+   duplicate; relative, mailto: and tel: links keep same-tab navigation. */
+const EXTERNAL_ANCHOR_PATTERN = /<a href="(https?:\/\/[^"]*)"/g;
+function annotateExternalLinks(html) {
+    return html.replace(EXTERNAL_ANCHOR_PATTERN, '<a href="$1" target="_blank" rel="noopener noreferrer"');
+}
+function instanceFor(options) {
+    const breaks = options.breaks === true;
+    const key = breaks ? 'breaks' : 'default';
+    let instance = instances.get(key);
+    if (!instance) {
+        instance = new Marked({ gfm: true, breaks, renderer: sanitizingRenderer });
+        instances.set(key, instance);
+    }
+    return instance;
+}
+/**
+ * Markdown → HTML with the sanitizing pipeline above. Pure string transform —
+ * no DOM involved — so it renders identically on server and client.
+ */
+export function renderMarkdown(markdown, options = {}) {
+    const instance = instanceFor(options);
+    const output = options.inline === true ? instance.parseInline(markdown) : instance.parse(markdown);
+    return typeof output === 'string' ? annotateExternalLinks(output) : '';
+}

package/dist/MarkdownText/properties.d.ts

@@ -0,0 +1,27 @@
+export type MarkdownTextProperties = OptionalMarkdownTextProperties & MandatoryMarkdownTextProperties;
+export type MandatoryMarkdownTextProperties = {
+    /**
+     * Markdown source. Rendered through the library's sanitized-by-construction
+     * pipeline: raw HTML (block and inline) is escaped and shown as text, and
+     * link/image URLs outside the safe-protocol allow-list are stripped while
+     * their text is kept.
+     */
+    markdown: string;
+};
+export type OptionalMarkdownTextProperties = {
+    /** Render single newlines as `<br>` (GFM "breaks" mode). */
+    breaks?: boolean;
+    testId?: string;
+    classes?: string;
+};
+export type RenderMarkdownOptions = {
+    /** Render single newlines as `<br>` (GFM "breaks" mode). */
+    breaks?: boolean;
+    /**
+     * Parse as inline markdown: no block elements (`<p>`, lists, tables) are
+     * produced, so the output can sit inside an existing `<p>` or `<span>`.
+     * The same sanitization applies — inline raw HTML is escaped and unsafe
+     * link/image protocols are stripped.
+     */
+    inline?: boolean;
+};

package/dist/SoundKit/properties.js

@@ -0,0 +1 @@
+export {};

package/dist/index.d.ts

@@ -86,6 +86,8 @@ export { default as Chat } from './Chat/Chat.svelte';
 export { default as ChatHeader } from './ChatHeader/ChatHeader.svelte';
 export { default as ChatMessage } from './ChatMessage/ChatMessage.svelte';
 export { default as ChatMessageList } from './ChatMessageList/ChatMessageList.svelte';
+export { default as MarkdownText } from './MarkdownText/MarkdownText.svelte';
+export { renderMarkdown } from './MarkdownText/markdown';
 export { default as ChatComposer } from './ChatComposer/ChatComposer.svelte';
 export { default as ChatSuggestions } from './ChatSuggestions/ChatSuggestions.svelte';
 export { default as ChatToolStatus } from './ChatToolStatus/ChatToolStatus.svelte';
@@ -152,7 +154,7 @@ export type * from './ThemeSwitcher/properties';
 export type * from './ThinkingIndicator/properties';
 export type * from './ToolCallLog/properties';
 export type * from './TaskList/properties';
-export type * from './soundKit/properties';
+export type * from './SoundKit/properties';
 export type * from './Book/properties';
 export type * from './Browser/properties';
 export type * from './Phone/properties';
@@ -187,6 +189,7 @@ export type * from './SpeechToText/types';
 export type * from './ChatHeader/properties';
 export type * from './ChatMessage/properties';
 export type * from './ChatMessageList/properties';
+export type * from './MarkdownText/properties';
 export type * from './ChatComposer/properties';
 export type * from './ChatSuggestions/properties';
 export type * from './ChatToolStatus/properties';
@@ -197,6 +200,6 @@ export type * from './Draggable/properties';
 export type * from './MediaPlayer/properties';
 export type * from './MediaUpload/properties';
 export type * from './Gallery/properties';
-export { createSoundKit } from './soundKit/soundKit';
+export { createSoundKit } from './SoundKit/SoundKit';
 export { validateInput, lockBodyScroll, unlockBodyScroll } from './utils';
 export { formatNumberIndian } from './_chart/format';

package/dist/index.js

@@ -86,6 +86,8 @@ export { default as Chat } from './Chat/Chat.svelte';
 export { default as ChatHeader } from './ChatHeader/ChatHeader.svelte';
 export { default as ChatMessage } from './ChatMessage/ChatMessage.svelte';
 export { default as ChatMessageList } from './ChatMessageList/ChatMessageList.svelte';
+export { default as MarkdownText } from './MarkdownText/MarkdownText.svelte';
+export { renderMarkdown } from './MarkdownText/markdown';
 export { default as ChatComposer } from './ChatComposer/ChatComposer.svelte';
 export { default as ChatSuggestions } from './ChatSuggestions/ChatSuggestions.svelte';
 export { default as ChatToolStatus } from './ChatToolStatus/ChatToolStatus.svelte';
@@ -100,6 +102,6 @@ export { default as Gallery } from './Gallery/Gallery.svelte';
 export { ChatController } from './Chat/controller.svelte';
 export { partyOf } from './Chat/roles';
 export { SpeechToTextController } from './SpeechToText/controller.svelte';
-export { createSoundKit } from './soundKit/soundKit';
+export { createSoundKit } from './SoundKit/SoundKit';
 export { validateInput, lockBodyScroll, unlockBodyScroll } from './utils';
 export { formatNumberIndian } from './_chart/format';