@kedataindo/docflow-core 0.0.98 → 0.0.100

package/dist/index.cjs

@@ -2041,6 +2041,28 @@ var KEEP_ATTRS = {
   // lose the level, because normalization runs on every paste.
   "*": /* @__PURE__ */ new Set(["style", "data-indent"])
 };
+var URL_ATTRS = /* @__PURE__ */ new Set(["href", "src"]);
+var SAFE_URL_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:"]);
+var URL_VALIDATION_BASE = "https://docflow.invalid/";
+function isSafeUrlValue(value, allowMailto) {
+  if (!value.trim()) return false;
+  let scheme;
+  try {
+    scheme = new URL(value, URL_VALIDATION_BASE).protocol;
+  } catch {
+    return false;
+  }
+  if (SAFE_URL_SCHEMES.has(scheme)) return true;
+  return allowMailto && scheme === "mailto:";
+}
+function cleanUrlAttrs(el) {
+  const allowMailto = el.tagName === "A";
+  for (const attr of Array.from(el.attributes)) {
+    if (URL_ATTRS.has(attr.name) && !isSafeUrlValue(attr.value, allowMailto)) {
+      el.removeAttribute(attr.name);
+    }
+  }
+}
 function detectClipboardSource(html) {
   if (/id\s*=\s*["']docs-internal/i.test(html)) return "google-docs";
   if (/<o:p[\s>]|xmlns(:w|:o)?=|class\s*=\s*["']?Mso|mso-/i.test(html)) return "word";
@@ -2072,6 +2094,7 @@ function cleanAttrs(el) {
   for (const attr of Array.from(el.attributes)) {
     if (!keep.has(attr.name)) el.removeAttribute(attr.name);
   }
+  cleanUrlAttrs(el);
 }
 function unwrap(el) {
   const parent = el.parentNode;

package/dist/index.js

@@ -1971,6 +1971,28 @@ var KEEP_ATTRS = {
   // lose the level, because normalization runs on every paste.
   "*": /* @__PURE__ */ new Set(["style", "data-indent"])
 };
+var URL_ATTRS = /* @__PURE__ */ new Set(["href", "src"]);
+var SAFE_URL_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:"]);
+var URL_VALIDATION_BASE = "https://docflow.invalid/";
+function isSafeUrlValue(value, allowMailto) {
+  if (!value.trim()) return false;
+  let scheme;
+  try {
+    scheme = new URL(value, URL_VALIDATION_BASE).protocol;
+  } catch {
+    return false;
+  }
+  if (SAFE_URL_SCHEMES.has(scheme)) return true;
+  return allowMailto && scheme === "mailto:";
+}
+function cleanUrlAttrs(el) {
+  const allowMailto = el.tagName === "A";
+  for (const attr of Array.from(el.attributes)) {
+    if (URL_ATTRS.has(attr.name) && !isSafeUrlValue(attr.value, allowMailto)) {
+      el.removeAttribute(attr.name);
+    }
+  }
+}
 function detectClipboardSource(html) {
   if (/id\s*=\s*["']docs-internal/i.test(html)) return "google-docs";
   if (/<o:p[\s>]|xmlns(:w|:o)?=|class\s*=\s*["']?Mso|mso-/i.test(html)) return "word";
@@ -2002,6 +2024,7 @@ function cleanAttrs(el) {
   for (const attr of Array.from(el.attributes)) {
     if (!keep.has(attr.name)) el.removeAttribute(attr.name);
   }
+  cleanUrlAttrs(el);
 }
 function unwrap(el) {
   const parent = el.parentNode;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kedataindo/docflow-core",
   "license": "Apache-2.0",
-  "version": "0.0.98",
+  "version": "0.0.100",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -66,7 +66,7 @@
   "devDependencies": {
     "@vitest/coverage-v8": "^2.1.3",
     "fake-indexeddb": "^6.2.5",
-    "happy-dom": "^21.0.1",
+    "happy-dom": "^21.0.3",
     "tsup": "^9.0.0",
     "typescript": "^5.6.3",
     "vitest": "^2.1.3"
@@ -74,6 +74,14 @@
   "engines": {
     "node": ">=20"
   },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Kedata-Indonesia/docflow.git"
+  },
+  "homepage": "https://github.com/Kedata-Indonesia/docflow#readme",
+  "bugs": {
+    "url": "https://github.com/Kedata-Indonesia/docflow/issues"
+  },
   "scripts": {
     "build": "tsup",
     "typecheck": "tsc --noEmit",