@kedataindo/docflow-core 0.0.99 → 0.0.100
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.cjs +23 -0
- package/dist/index.js +23 -0
- package/package.json +1 -1
package/dist/index.cjs
CHANGED
|
@@ -2041,6 +2041,28 @@ var KEEP_ATTRS = {
|
|
|
2041
2041
|
// lose the level, because normalization runs on every paste.
|
|
2042
2042
|
"*": /* @__PURE__ */ new Set(["style", "data-indent"])
|
|
2043
2043
|
};
|
|
2044
|
+
var URL_ATTRS = /* @__PURE__ */ new Set(["href", "src"]);
|
|
2045
|
+
var SAFE_URL_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:"]);
|
|
2046
|
+
var URL_VALIDATION_BASE = "https://docflow.invalid/";
|
|
2047
|
+
function isSafeUrlValue(value, allowMailto) {
|
|
2048
|
+
if (!value.trim()) return false;
|
|
2049
|
+
let scheme;
|
|
2050
|
+
try {
|
|
2051
|
+
scheme = new URL(value, URL_VALIDATION_BASE).protocol;
|
|
2052
|
+
} catch {
|
|
2053
|
+
return false;
|
|
2054
|
+
}
|
|
2055
|
+
if (SAFE_URL_SCHEMES.has(scheme)) return true;
|
|
2056
|
+
return allowMailto && scheme === "mailto:";
|
|
2057
|
+
}
|
|
2058
|
+
function cleanUrlAttrs(el) {
|
|
2059
|
+
const allowMailto = el.tagName === "A";
|
|
2060
|
+
for (const attr of Array.from(el.attributes)) {
|
|
2061
|
+
if (URL_ATTRS.has(attr.name) && !isSafeUrlValue(attr.value, allowMailto)) {
|
|
2062
|
+
el.removeAttribute(attr.name);
|
|
2063
|
+
}
|
|
2064
|
+
}
|
|
2065
|
+
}
|
|
2044
2066
|
function detectClipboardSource(html) {
|
|
2045
2067
|
if (/id\s*=\s*["']docs-internal/i.test(html)) return "google-docs";
|
|
2046
2068
|
if (/<o:p[\s>]|xmlns(:w|:o)?=|class\s*=\s*["']?Mso|mso-/i.test(html)) return "word";
|
|
@@ -2072,6 +2094,7 @@ function cleanAttrs(el) {
|
|
|
2072
2094
|
for (const attr of Array.from(el.attributes)) {
|
|
2073
2095
|
if (!keep.has(attr.name)) el.removeAttribute(attr.name);
|
|
2074
2096
|
}
|
|
2097
|
+
cleanUrlAttrs(el);
|
|
2075
2098
|
}
|
|
2076
2099
|
function unwrap(el) {
|
|
2077
2100
|
const parent = el.parentNode;
|
package/dist/index.js
CHANGED
|
@@ -1971,6 +1971,28 @@ var KEEP_ATTRS = {
|
|
|
1971
1971
|
// lose the level, because normalization runs on every paste.
|
|
1972
1972
|
"*": /* @__PURE__ */ new Set(["style", "data-indent"])
|
|
1973
1973
|
};
|
|
1974
|
+
var URL_ATTRS = /* @__PURE__ */ new Set(["href", "src"]);
|
|
1975
|
+
var SAFE_URL_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:"]);
|
|
1976
|
+
var URL_VALIDATION_BASE = "https://docflow.invalid/";
|
|
1977
|
+
function isSafeUrlValue(value, allowMailto) {
|
|
1978
|
+
if (!value.trim()) return false;
|
|
1979
|
+
let scheme;
|
|
1980
|
+
try {
|
|
1981
|
+
scheme = new URL(value, URL_VALIDATION_BASE).protocol;
|
|
1982
|
+
} catch {
|
|
1983
|
+
return false;
|
|
1984
|
+
}
|
|
1985
|
+
if (SAFE_URL_SCHEMES.has(scheme)) return true;
|
|
1986
|
+
return allowMailto && scheme === "mailto:";
|
|
1987
|
+
}
|
|
1988
|
+
function cleanUrlAttrs(el) {
|
|
1989
|
+
const allowMailto = el.tagName === "A";
|
|
1990
|
+
for (const attr of Array.from(el.attributes)) {
|
|
1991
|
+
if (URL_ATTRS.has(attr.name) && !isSafeUrlValue(attr.value, allowMailto)) {
|
|
1992
|
+
el.removeAttribute(attr.name);
|
|
1993
|
+
}
|
|
1994
|
+
}
|
|
1995
|
+
}
|
|
1974
1996
|
function detectClipboardSource(html) {
|
|
1975
1997
|
if (/id\s*=\s*["']docs-internal/i.test(html)) return "google-docs";
|
|
1976
1998
|
if (/<o:p[\s>]|xmlns(:w|:o)?=|class\s*=\s*["']?Mso|mso-/i.test(html)) return "word";
|
|
@@ -2002,6 +2024,7 @@ function cleanAttrs(el) {
|
|
|
2002
2024
|
for (const attr of Array.from(el.attributes)) {
|
|
2003
2025
|
if (!keep.has(attr.name)) el.removeAttribute(attr.name);
|
|
2004
2026
|
}
|
|
2027
|
+
cleanUrlAttrs(el);
|
|
2005
2028
|
}
|
|
2006
2029
|
function unwrap(el) {
|
|
2007
2030
|
const parent = el.parentNode;
|