@limetech/lime-elements 39.3.2 → 39.4.0

package/dist/types/components/markdown/markdown.d.ts

@@ -3,6 +3,16 @@ import { CustomElementDefinition } from '../../global/shared-types/custom-elemen
  * The Markdown component receives markdown syntax
  * and renders it as HTML.
  *
+ * A built-in set of lime-elements components is whitelisted by default
+ * and can be used directly in markdown content without any configuration.
+ * Consumers can extend this list via the `whitelist` prop or `limel-config`.
+ *
+ * When custom elements use JSON attribute values, any URL-bearing
+ * properties (`href`, `src`, `cite`, `longDesc`) are automatically
+ * sanitized using the same protocol allowlists as rehype-sanitize.
+ * URLs with dangerous schemes (e.g. `javascript:`, `data:`) are
+ * removed (with a console warning) to prevent script injection.
+ *
  * @exampleComponent limel-example-markdown-headings
  * @exampleComponent limel-example-markdown-emphasis
  * @exampleComponent limel-example-markdown-lists
@@ -28,11 +38,23 @@ export declare class Markdown {
      */
     value: string;
     /**
-     * Whitelisted html elements.
+     * Additional whitelisted custom elements to render inside markdown.
+     *
+     * A built-in set of lime-elements components (such as `limel-chip`,
+     * `limel-icon`, `limel-badge`, `limel-callout`, etc.) is always
+     * allowed by default. Any entries provided here are **merged** with
+     * those defaults — if both define the same `tagName`, their
+     * attributes are combined.
+     *
+     * Can also be set via `limel-config`. Setting this property will
+     * override the global config.
+     *
+     * JSON attribute values that contain URL-bearing properties
+     * (`href`, `src`, `cite`, `longDesc`) are automatically sanitized
+     * using the same protocol allowlists as rehype-sanitize. URLs with
+     * dangerous schemes (e.g. `javascript:`, `data:`) are removed
+     * (with a console warning).
      *
-     * Any custom element added here will not be sanitized and thus rendered.
-     * Can also be set via `limel-config`. Setting this property will override
-     * the global config.
      * @alpha
      */
     whitelist?: CustomElementDefinition[];
@@ -48,9 +70,12 @@ export declare class Markdown {
      */
     removeEmptyParagraphs: boolean;
     textChanged(): Promise<void>;
+    handleWhitelistChange(): Promise<void>;
     handleRemoveEmptyParagraphsChange(): Promise<void>;
     private rootElement;
     private imageIntersectionObserver;
+    private cachedConsumerWhitelist?;
+    private cachedCombinedWhitelist?;
     componentDidLoad(): Promise<void>;
     disconnectedCallback(): void;
     render(): any;

package/dist/types/components/markdown/safe-url-protocols.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Map of URL-bearing property names to their allowed protocols, sourced
+ * from rehype-sanitize's defaultSchema. This means protocol updates from
+ * Dependabot bumps to rehype-sanitize automatically apply here too —
+ * no custom blocklist to maintain.
+ *
+ * We can't use rehype-sanitize directly for URL sanitization because it
+ * operates on HTML attributes, not on values inside JSON strings. By the
+ * time rehype-sanitize runs, `link` is just a raw JSON string attribute —
+ * the `href` only becomes visible after JSON parsing in hydration.
+ * So we replicate rehype-sanitize's protocol validation logic here,
+ * using its own protocol list as the source of truth.
+ *
+ * The map covers all URL-bearing property names that rehype-sanitize
+ * defines protocols for: `href`, `src`, `cite`, and `longDesc`.
+ *
+ * @internal
+ */
+export declare const SAFE_PROTOCOLS_BY_PROPERTY: Map<string, Set<string>>;
+//# sourceMappingURL=safe-url-protocols.d.ts.map

package/dist/types/components.d.ts

@@ -2348,6 +2348,14 @@ export namespace Components {
     /**
      * The Markdown component receives markdown syntax
      * and renders it as HTML.
+     * A built-in set of lime-elements components is whitelisted by default
+     * and can be used directly in markdown content without any configuration.
+     * Consumers can extend this list via the `whitelist` prop or `limel-config`.
+     * When custom elements use JSON attribute values, any URL-bearing
+     * properties (`href`, `src`, `cite`, `longDesc`) are automatically
+     * sanitized using the same protocol allowlists as rehype-sanitize.
+     * URLs with dangerous schemes (e.g. `javascript:`, `data:`) are
+     * removed (with a console warning) to prevent script injection.
      * @exampleComponent limel-example-markdown-headings
      * @exampleComponent limel-example-markdown-emphasis
      * @exampleComponent limel-example-markdown-lists
@@ -2382,7 +2390,7 @@ export namespace Components {
          */
         "value": string;
         /**
-          * Whitelisted html elements.  Any custom element added here will not be sanitized and thus rendered. Can also be set via `limel-config`. Setting this property will override the global config.
+          * Additional whitelisted custom elements to render inside markdown.  A built-in set of lime-elements components (such as `limel-chip`, `limel-icon`, `limel-badge`, `limel-callout`, etc.) is always allowed by default. Any entries provided here are **merged** with those defaults — if both define the same `tagName`, their attributes are combined.  Can also be set via `limel-config`. Setting this property will override the global config.  JSON attribute values that contain URL-bearing properties (`href`, `src`, `cite`, `longDesc`) are automatically sanitized using the same protocol allowlists as rehype-sanitize. URLs with dangerous schemes (e.g. `javascript:`, `data:`) are removed (with a console warning).
           * @alpha 
           * @default globalConfig.markdownWhitelist
          */
@@ -5309,6 +5317,14 @@ declare global {
     /**
      * The Markdown component receives markdown syntax
      * and renders it as HTML.
+     * A built-in set of lime-elements components is whitelisted by default
+     * and can be used directly in markdown content without any configuration.
+     * Consumers can extend this list via the `whitelist` prop or `limel-config`.
+     * When custom elements use JSON attribute values, any URL-bearing
+     * properties (`href`, `src`, `cite`, `longDesc`) are automatically
+     * sanitized using the same protocol allowlists as rehype-sanitize.
+     * URLs with dangerous schemes (e.g. `javascript:`, `data:`) are
+     * removed (with a console warning) to prevent script injection.
      * @exampleComponent limel-example-markdown-headings
      * @exampleComponent limel-example-markdown-emphasis
      * @exampleComponent limel-example-markdown-lists
@@ -8650,6 +8666,14 @@ declare namespace LocalJSX {
     /**
      * The Markdown component receives markdown syntax
      * and renders it as HTML.
+     * A built-in set of lime-elements components is whitelisted by default
+     * and can be used directly in markdown content without any configuration.
+     * Consumers can extend this list via the `whitelist` prop or `limel-config`.
+     * When custom elements use JSON attribute values, any URL-bearing
+     * properties (`href`, `src`, `cite`, `longDesc`) are automatically
+     * sanitized using the same protocol allowlists as rehype-sanitize.
+     * URLs with dangerous schemes (e.g. `javascript:`, `data:`) are
+     * removed (with a console warning) to prevent script injection.
      * @exampleComponent limel-example-markdown-headings
      * @exampleComponent limel-example-markdown-emphasis
      * @exampleComponent limel-example-markdown-lists
@@ -8684,7 +8708,7 @@ declare namespace LocalJSX {
          */
         "value"?: string;
         /**
-          * Whitelisted html elements.  Any custom element added here will not be sanitized and thus rendered. Can also be set via `limel-config`. Setting this property will override the global config.
+          * Additional whitelisted custom elements to render inside markdown.  A built-in set of lime-elements components (such as `limel-chip`, `limel-icon`, `limel-badge`, `limel-callout`, etc.) is always allowed by default. Any entries provided here are **merged** with those defaults — if both define the same `tagName`, their attributes are combined.  Can also be set via `limel-config`. Setting this property will override the global config.  JSON attribute values that contain URL-bearing properties (`href`, `src`, `cite`, `longDesc`) are automatically sanitized using the same protocol allowlists as rehype-sanitize. URLs with dangerous schemes (e.g. `javascript:`, `data:`) are removed (with a console warning).
           * @alpha 
           * @default globalConfig.markdownWhitelist
          */
@@ -11693,6 +11717,14 @@ declare module "@stencil/core" {
             /**
              * The Markdown component receives markdown syntax
              * and renders it as HTML.
+             * A built-in set of lime-elements components is whitelisted by default
+             * and can be used directly in markdown content without any configuration.
+             * Consumers can extend this list via the `whitelist` prop or `limel-config`.
+             * When custom elements use JSON attribute values, any URL-bearing
+             * properties (`href`, `src`, `cite`, `longDesc`) are automatically
+             * sanitized using the same protocol allowlists as rehype-sanitize.
+             * URLs with dangerous schemes (e.g. `javascript:`, `data:`) are
+             * removed (with a console warning) to prevent script injection.
              * @exampleComponent limel-example-markdown-headings
              * @exampleComponent limel-example-markdown-emphasis
              * @exampleComponent limel-example-markdown-lists

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@limetech/lime-elements",
-  "version": "39.3.2",
+  "version": "39.4.0",
   "description": "Lime Elements",
   "author": "Lime Technologies",
   "license": "Apache-2.0",

package/dist/lime-elements/p-49204db4.entry.js

@@ -1 +0,0 @@
-import{r as e,h as t,H as o}from"./p-DBTJNfo7.js";import{m as r}from"./p-BRCcjfVu.js";import{g as a}from"./p-Dnt5w_Bp.js";import"./p-BFTU3MAI.js";import"./p-2kcqdtMr.js";class l{constructor(e){this.handleIntersection=e=>{for(const t of e)if(t.isIntersecting){const e=t.target,o=e.dataset.src;o&&(e.setAttribute("src",o),delete e.dataset.src),this.observer.unobserve(e)}},this.observer=new IntersectionObserver(this.handleIntersection);const t=e.querySelectorAll("img");for(const e of t)this.observer.observe(e)}disconnect(){this.observer.disconnect()}}function n(e,t){for(const o of t){const t=e.getAttribute(o);if(!t)continue;const r=i(t);void 0!==r&&(e[s(o)]=r)}}function i(e){const t=e.trim();if(t.startsWith("{")&&t.endsWith("}")||t.startsWith("[")&&t.endsWith("]"))try{return JSON.parse(t)}catch(e){try{const e=t.replaceAll(""",'"').replaceAll(""",'"').replaceAll(""",'"').replaceAll("'","'").replaceAll("'","'").replaceAll("'","'").replaceAll("&","&");return JSON.parse(e)}catch(e){return}}}function s(e){return e.replaceAll(/-([a-z])/g,((e,t)=>t.toUpperCase()))}const d=class{constructor(t){e(this,t),this.value="",this.whitelist=a.markdownWhitelist,this.lazyLoadImages=!1,this.removeEmptyParagraphs=!0,this.imageIntersectionObserver=null}async textChanged(){var e,t;try{this.cleanupImageIntersectionObserver();const o=await r(this.value,{forceHardLineBreaks:!0,whitelist:null!==(e=this.whitelist)&&void 0!==e?e:[],lazyLoadImages:this.lazyLoadImages,removeEmptyParagraphs:this.removeEmptyParagraphs});this.rootElement.innerHTML=o,function(e,t){if(e&&(null==t?void 0:t.length))for(const o of t){const t=e.querySelectorAll(o.tagName);for(const e of t)n(e,o.attributes)}}(this.rootElement,null!==(t=this.whitelist)&&void 0!==t?t:[]),this.setupImageIntersectionObserver()}catch(e){console.error(e)}}handleRemoveEmptyParagraphsChange(){return this.textChanged()}async componentDidLoad(){this.textChanged()}disconnectedCallback(){this.cleanupImageIntersectionObserver()}render(){return t(o,{key:"d7e3122596fa19c63e05d69855fbc693cb8c4fe7"},t("div",{key:"9a65798b0888a3d2d7a35c0d320408faa3d937b6",id:"markdown",ref:e=>this.rootElement=e}))}setupImageIntersectionObserver(){this.lazyLoadImages&&(this.imageIntersectionObserver=new l(this.rootElement))}cleanupImageIntersectionObserver(){this.imageIntersectionObserver&&(this.imageIntersectionObserver.disconnect(),this.imageIntersectionObserver=null)}static get watchers(){return{value:[{textChanged:0}],removeEmptyParagraphs:[{handleRemoveEmptyParagraphsChange:0}]}}};d.style='@charset "UTF-8";code{font-family:ui-monospace, "Cascadia Code", "Source Code Pro", Menlo, Consolas, "DejaVu Sans Mono", monospace;font-size:var(--limel-theme-default-small-font-size);letter-spacing:-0.0125rem;color:rgb(var(--contrast-1300));-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-hyphens:none;-moz-hyphens:none;-ms-hyphens:none;hyphens:none;display:inline-block;border-radius:0.25rem;padding:0.03125rem 0.25rem;background-color:rgb(var(--contrast-600))}pre>code{display:block;margin:0.5rem 0;padding:0.5rem 0.75rem;overflow:auto;white-space:pre-wrap}h1{font-size:1.5rem}h2{font-size:1.25rem}h3{font-size:1.125rem}h4{font-size:1rem}h5{font-size:var(--limel-theme-default-font-size)}h6{font-size:0.75rem}h1,h2{margin-top:0.5rem;margin-bottom:0.5rem;letter-spacing:-0.03125rem;font-weight:500}h3,h4{margin-top:0.75rem;margin-bottom:0.25rem;font-weight:600}h5,h6{margin-top:0.5rem;margin-bottom:0.125rem;font-weight:600}h1,h2,h3,h4,h5,h6{word-break:break-word;hyphens:auto;-webkit-hyphens:auto}:not([contenteditable=true]) h1,:not([contenteditable=true]) h2,:not([contenteditable=true]) h3,:not([contenteditable=true]) h4,:not([contenteditable=true]) h5,:not([contenteditable=true]) h6{text-wrap:balance}[contenteditable=true] h1,[contenteditable=true] h2,[contenteditable=true] h3,[contenteditable=true] h4,[contenteditable=true] h5,[contenteditable=true] h6{text-wrap:initial}:host(limel-markdown.truncate-paragraphs) p{overflow:hidden;white-space:nowrap;text-overflow:ellipsis}p,li{font-size:var(--limel-theme-default-font-size);word-break:break-word}a{word-break:break-all}p{margin-top:0;margin-bottom:0.5rem}p:only-child{margin-bottom:0}a{transition:color 0.2s ease;color:var(--markdown-hyperlink-color, rgb(var(--color-blue-dark)));text-decoration:none}a:hover{color:var(--markdown-hyperlink-color--hovered, rgb(var(--color-blue-default)))}hr{margin:1.75rem 0 2rem 0;border-width:0;border-top:1px solid rgb(var(--contrast-500))}ul{list-style:none}ul li{position:relative;margin-left:0.75rem}ul li:before{content:"";position:absolute;left:-0.5rem;top:0.5rem;width:0.25rem;height:0.25rem;border-radius:50%;background-color:rgb(var(--contrast-700));display:block}ol{margin-top:0.25rem;padding-left:1rem}ul{margin-top:0.25rem;padding-left:0}ul ul,ul ol,ol ol,ol ul{margin-left:0}li{margin-bottom:0.25rem}:host(limel-markdown:not(.no-table-styles)) table{table-layout:auto;min-width:100%;border-collapse:collapse;border-spacing:0;background:transparent;margin:0.75rem 0}:host(limel-markdown:not(.no-table-styles)) tbody{border:1px solid rgb(var(--contrast-400));border-radius:0.25rem}:host(limel-markdown:not(.no-table-styles)) th,:host(limel-markdown:not(.no-table-styles)) td{text-align:left;vertical-align:top;transition:background-color 0.2s ease;font-size:var(--limel-theme-default-font-size)}:host(limel-markdown:not(.no-table-styles)) td{padding:0.5rem 0.375rem 0.75rem 0.375rem}:host(limel-markdown:not(.no-table-styles)) tr th{background-color:rgb(var(--contrast-400));padding:0.25rem 0.375rem;font-weight:normal}:host(limel-markdown:not(.no-table-styles)) tr th:only-child{text-align:center}:host(limel-markdown:not(.no-table-styles)) tbody tr:nth-child(odd) td{background-color:rgb(var(--contrast-200))}:host(limel-markdown:not(.no-table-styles)) tbody tr:hover td{background-color:rgb(var(--contrast-300))}table{display:block;box-sizing:border-box;overflow-x:auto;-webkit-overflow-scrolling:touch;max-width:100%}blockquote{position:relative;max-width:100%;margin:0.75rem 0;padding:0.5rem;border-left:0.25rem solid rgb(var(--contrast-500));background-color:rgb(var(--contrast-200))}blockquote:before,blockquote:after{position:absolute;line-height:0;font-size:2rem;opacity:0.4}blockquote:before{content:"“";left:-0.5rem;top:0.5rem}blockquote:after{content:"”";right:-0.25rem;bottom:-0.25rem}blockquote blockquote{padding-top:0;padding-right:0;padding-bottom:0;padding-left:0.25rem;border-color:rgb(var(--contrast-700));border-left-width:1px}blockquote blockquote:before,blockquote blockquote:after{display:none}blockquote:has(>blockquote){padding-left:0.25rem;padding-bottom:0}dl{display:grid;grid-template-columns:1fr 2fr;grid-template-rows:1fr;margin-bottom:2rem;border:1px solid rgb(var(--contrast-400));border-radius:0.375rem;background-color:rgb(var(--contrast-200))}dl dt,dl dd{padding:0.375rem 0.5rem;font-size:var(--limel-theme-default-font-size);margin:0}dl dt:nth-of-type(even),dl dd:nth-of-type(even){background-color:rgb(var(--contrast-300))}dl dt:first-child{border-top-left-radius:0.375rem}dl dt:last-child{border-bottom-left-radius:0.375rem}dl dd:first-child{border-top-right-radius:0.375rem}dl dd:last-child{border-bottom-right-radius:0.375rem}img{max-width:100%;border-radius:0.25rem}kbd{font-family:ui-monospace, "Cascadia Code", "Source Code Pro", Menlo, Consolas, "DejaVu Sans Mono", monospace;font-weight:600;color:rgb(var(--contrast-1100));background-color:rgb(var(--contrast-200));white-space:pre;word-spacing:normal;word-break:normal;word-wrap:normal;line-height:normal;padding:0.125rem 0.5rem;margin:0 0.25rem;box-shadow:var(--button-shadow-normal), 0 0.03125rem 0.21875rem 0 rgba(var(--contrast-100), 0.5) inset;border-radius:0.125rem;border-style:solid;border-color:rgba(var(--contrast-600), 0.8);border-width:0 1px 0.125rem 1px}:host(limel-markdown.adjust-for-table-cell) img{max-height:1.25rem;vertical-align:middle}:host(limel-markdown.adjust-for-table-cell) p{display:inline}:host(limel-markdown.adjust-for-table-cell) h1,:host(limel-markdown.adjust-for-table-cell) h2,:host(limel-markdown.adjust-for-table-cell) h3,:host(limel-markdown.adjust-for-table-cell) h4,:host(limel-markdown.adjust-for-table-cell) h5,:host(limel-markdown.adjust-for-table-cell) h6{display:inline-block;vertical-align:bottom;font-size:var(--limel-theme-default-font-size);margin:0 0.25rem 0 0;letter-spacing:normal;font-weight:500}:host(limel-markdown.adjust-for-table-cell) h1:before,:host(limel-markdown.adjust-for-table-cell) h2:before,:host(limel-markdown.adjust-for-table-cell) h3:before,:host(limel-markdown.adjust-for-table-cell) h4:before,:host(limel-markdown.adjust-for-table-cell) h5:before,:host(limel-markdown.adjust-for-table-cell) h6:before{opacity:0.6;vertical-align:middle;font-size:0.5rem;border-radius:0.25rem 0 0 0.25rem;padding:0.25rem;padding-right:2rem;margin-right:-1.75rem;background:linear-gradient(to right, rgb(var(--contrast-800), 0.6), rgb(var(--contrast-800), 0))}:host(limel-markdown.adjust-for-table-cell) h1:before{content:"H1"}:host(limel-markdown.adjust-for-table-cell) h2:before{content:"H2"}:host(limel-markdown.adjust-for-table-cell) h3:before{content:"H3"}:host(limel-markdown.adjust-for-table-cell) h4:before{content:"H4"}:host(limel-markdown.adjust-for-table-cell) h5:before{content:"H5"}:host(limel-markdown.adjust-for-table-cell) h6:before{content:"H6"}:host(limel-markdown.adjust-for-table-cell) pre{margin:0}:host(limel-markdown.adjust-for-table-cell) pre>code{padding:0.125rem;margin:0}:host(limel-markdown.adjust-for-table-cell) dl{margin:0}:host(limel-markdown.adjust-for-table-cell) dl dt,:host(limel-markdown.adjust-for-table-cell) dl dd{padding:0.00625rem 0.125rem}*,*::before,*::after{box-sizing:border-box}* :where(:not(img,video,svg,canvas,iframe)),*::before :where(:not(img,video,svg,canvas,iframe)),*::after :where(:not(img,video,svg,canvas,iframe)){min-width:0;min-height:0}hr{border-top:1px solid rgb(var(--contrast-700))}.MsoNormal{margin:0}:host(limel-markdown.reset-img-height) #markdown img{height:auto}';export{d as limel_markdown}