@limetech/lime-elements 39.44.1 → 39.44.2

package/dist/collection/components/text-editor/prosemirror-adapter/editor-config.js

@@ -0,0 +1,75 @@
+import { Schema } from "prosemirror-model";
+import { schema as basicSchema } from "prosemirror-schema-basic";
+import { addListNodes } from "prosemirror-schema-list";
+import { exampleSetup } from "prosemirror-example-setup";
+import { keymap } from "prosemirror-keymap";
+import { editorMenuTypesArray } from "./menu/types";
+import { strikethrough } from "./menu/menu-schema-extender";
+import { linkMarkSpec } from "./plugins/link/link-mark";
+import { createLinkPlugin } from "./plugins/link/link-plugin";
+import { createImageInserterPlugin } from "./plugins/image/inserter";
+import { createImageViewPlugin } from "./plugins/image/view";
+import { createMenuStateTrackingPlugin } from "./plugins/menu-state-tracking-plugin";
+import { createActionBarInteractionPlugin } from "./plugins/menu-action-interaction-plugin";
+import { createTriggerPlugin } from "./plugins/trigger/factory";
+import { getTableNodes, getTableEditingPlugins } from "./plugins/table-plugin";
+import { getImageNode } from "./plugins/image/node";
+import { createNodeSpec } from "../utils/plugin-factory";
+/**
+ * Builds the ProseMirror schema used by the text editor.
+ *
+ * This is the single source of truth for the editor's schema: the
+ * `limel-prosemirror-adapter` component and any test that needs the real
+ * schema both call this, so the two can never drift apart.
+ *
+ * @param options - schema configuration derived from the editor's props
+ * @returns the configured ProseMirror schema
+ */
+export function buildEditorSchema(options) {
+    const { customElements, contentType, language, inlineImages } = options;
+    let nodes = basicSchema.spec.nodes;
+    for (const customElement of customElements) {
+        const newNodeSpec = createNodeSpec(customElement);
+        const nodeName = customElement.tagName;
+        nodes = nodes.append({ [nodeName]: newNodeSpec });
+    }
+    nodes = addListNodes(nodes, 'paragraph block*', 'block');
+    if (contentType === 'html') {
+        nodes = nodes.append(getTableNodes());
+    }
+    nodes = nodes.append(getImageNode(language, inlineImages));
+    return new Schema({
+        nodes: nodes,
+        marks: basicSchema.spec.marks.append({
+            strikethrough: strikethrough,
+            link: linkMarkSpec,
+        }),
+    });
+}
+/**
+ * Builds the ordered list of ProseMirror plugins used by the text editor.
+ *
+ * Plugin order is significant: ProseMirror resolves event props
+ * (`handlePaste`, `handleDOMEvents`, `handleKeyDown`) by calling plugins in
+ * this order and stopping at the first that returns a truthy value, and it
+ * chains `appendTransaction` in this order. Changing the order changes
+ * behavior. Callbacks the plugins need are injected so this can be built
+ * outside the component (e.g. in tests).
+ *
+ * @param options - the schema, command factory, converter and plugin callbacks
+ * @returns the ordered plugin list
+ */
+export function buildEditorPlugins(options) {
+    const { schema, menuCommandFactory, contentConverter, language, contentType, triggerCharacters, inlineImages, onNewLinkSelection, onImagePasted, onActiveItemsChange, } = options;
+    return [
+        ...exampleSetup({ schema: schema, menuBar: false }),
+        keymap(menuCommandFactory.buildKeymap()),
+        createTriggerPlugin(triggerCharacters, contentConverter),
+        createLinkPlugin(onNewLinkSelection),
+        createImageInserterPlugin(onImagePasted, inlineImages),
+        createImageViewPlugin(language),
+        createMenuStateTrackingPlugin(editorMenuTypesArray, menuCommandFactory, onActiveItemsChange),
+        createActionBarInteractionPlugin(menuCommandFactory),
+        ...getTableEditingPlugins(contentType === 'html'),
+    ];
+}

package/dist/collection/components/text-editor/prosemirror-adapter/prosemirror-adapter.js

@@ -1,32 +1,19 @@
 import { Host, h, } from "@stencil/core";
 import { EditorState, Selection } from "prosemirror-state";
 import { EditorView } from "prosemirror-view";
-import { Schema, DOMParser } from "prosemirror-model";
-import { schema } from "prosemirror-schema-basic";
-import { addListNodes } from "prosemirror-schema-list";
-import { exampleSetup } from "prosemirror-example-setup";
-import { keymap } from "prosemirror-keymap";
+import { DOMParser } from "prosemirror-model";
 import { MenuCommandFactory } from "./menu/menu-commands";
 import { menuTranslationIDs, getTextEditorMenuItems } from "./menu/menu-items";
 import { MarkdownConverter } from "../utils/markdown-converter";
 import { HTMLConverter } from "../utils/html-converter";
-import { EditorMenuTypes, editorMenuTypesArray, } from "./menu/types";
+import { EditorMenuTypes } from "./menu/types";
 import translate from "../../../global/translations";
 import { createRandomString } from "../../../util/random-string";
 import { isItem } from "../../action-bar/is-item";
 import { cloneDeep, debounce } from "lodash-es";
-import { strikethrough } from "./menu/menu-schema-extender";
-import { createLinkPlugin } from "./plugins/link/link-plugin";
-import { linkMarkSpec } from "./plugins/link/link-mark";
-import { createImageInserterPlugin } from "./plugins/image/inserter";
-import { createImageViewPlugin } from "./plugins/image/view";
-import { createMenuStateTrackingPlugin } from "./plugins/menu-state-tracking-plugin";
-import { createActionBarInteractionPlugin } from "./plugins/menu-action-interaction-plugin";
-import { createNodeSpec } from "../utils/plugin-factory";
-import { createTriggerPlugin } from "./plugins/trigger/factory";
 import { isInlineImageTag, } from "../text-editor.types";
-import { getTableNodes, getTableEditingPlugins } from "./plugins/table-plugin";
-import { getImageNode, imageCache } from "./plugins/image/node";
+import { imageCache } from "./plugins/image/node";
+import { buildEditorSchema, buildEditorPlugins, } from "./editor-config";
 import { getMetadataFromDoc, hasMetadataChanged, } from "../utils/metadata-utils";
 const DEBOUNCE_TIMEOUT = 300;
 /**
@@ -80,6 +67,7 @@ export class ProsemirrorAdapter {
         this.changeWaiting = false;
         this.transactionFired = false;
         this.lastClickedPos = null;
+        this.focusRestoreTimeout = null;
         this.metadata = { images: [], links: [] };
         /**
          *  Used to stop change event emitting as result of getting updated value from consumer
@@ -167,11 +155,20 @@ export class ProsemirrorAdapter {
                 //
                 // To detect this, we wait one tick after focus. If no transaction has fired by then,
                 // we assume the selection is unresolved and manually move the cursor to the last clicked position.
+                //
+                // The clicked position is only meaningful for the focus event that the
+                // click itself triggered, so it is consumed here and cleared on blur.
+                // Focus regained without a click (e.g. switching back to the window)
+                // must leave the selection untouched.
                 this.transactionFired = false;
-                setTimeout(() => {
-                    if (!this.transactionFired && this.lastClickedPos) {
+                this.focusRestoreTimeout = setTimeout(() => {
+                    const clickedPos = this.lastClickedPos;
+                    this.lastClickedPos = null;
+                    if (!this.transactionFired &&
+                        clickedPos !== null &&
+                        clickedPos <= this.view.state.doc.content.size) {
                         const { doc, tr } = this.view.state;
-                        const resolvedPos = doc.resolve(this.lastClickedPos);
+                        const resolvedPos = doc.resolve(clickedPos);
                         const selection = Selection.near(resolvedPos);
                         tr.setMeta('pointer', true);
                         this.view.dispatch(tr.setSelection(selection));
@@ -203,6 +200,7 @@ export class ProsemirrorAdapter {
             this.changeWaiting = false;
         }, DEBOUNCE_TIMEOUT);
         this.handleBlur = () => {
+            this.lastClickedPos = null;
             this.changeEmitter.flush();
         };
         this.portalId = createRandomString();
@@ -290,6 +288,13 @@ export class ProsemirrorAdapter {
     }
     disconnectedCallback() {
         var _a, _b, _c, _d, _e;
+        // The pending caret restoration must not run against a destroyed
+        // editor view. Chromium clears the click position via `blur` when a
+        // focused editor is removed, but that is not guaranteed in every
+        // browser.
+        clearTimeout(this.focusRestoreTimeout);
+        this.focusRestoreTimeout = null;
+        this.lastClickedPos = null;
         imageCache.clear();
         this.host.removeEventListener('open-editor-link-menu', this.handleOpenLinkMenu);
         (_b = (_a = this.view) === null || _a === void 0 ? void 0 : _a.dom) === null || _b === void 0 ? void 0 : _b.removeEventListener('blur', this.handleBlur);
@@ -297,7 +302,7 @@ export class ProsemirrorAdapter {
         (_e = this.view) === null || _e === void 0 ? void 0 : _e.destroy();
     }
     render() {
-        return (h(Host, { key: '27949dced1fd61d1a80c42f58cf1699f05acb52e', onFocus: this.handleFocus }, h("div", { key: '75e941459326f0fb8f8d5042becd570e06cd99fa', id: "editor" }), this.renderToolbar(), this.renderLinkMenu()));
+        return (h(Host, { key: '66da30fb04c3dc303f58153a8ca6c1b185aae681', onFocus: this.handleFocus }, h("div", { key: 'fbd8f2810334973488603dd19db7ba2402a14a13', id: "editor" }), this.renderToolbar(), this.renderLinkMenu()));
     }
     renderToolbar() {
         if (this.actionBarItems.length === 0 || this.ui === 'no-toolbar') {
@@ -353,23 +358,11 @@ export class ProsemirrorAdapter {
         this.lastEmittedValue = this.contentConverter.serialize(this.view, this.schema);
     }
     initializeSchema() {
-        let nodes = schema.spec.nodes;
-        for (const customElement of this.customElements) {
-            const newNodeSpec = createNodeSpec(customElement);
-            const nodeName = customElement.tagName;
-            nodes = nodes.append({ [nodeName]: newNodeSpec });
-        }
-        nodes = addListNodes(nodes, 'paragraph block*', 'block');
-        if (this.contentType === 'html') {
-            nodes = nodes.append(getTableNodes());
-        }
-        nodes = nodes.append(getImageNode(this.language, this.validatedInlineImages));
-        return new Schema({
-            nodes: nodes,
-            marks: schema.spec.marks.append({
-                strikethrough: strikethrough,
-                link: linkMarkSpec,
-            }),
+        return buildEditorSchema({
+            customElements: this.customElements,
+            contentType: this.contentType,
+            language: this.language,
+            inlineImages: this.validatedInlineImages,
         });
     }
     async parseInitialContent() {
@@ -386,17 +379,18 @@ export class ProsemirrorAdapter {
     createEditorState(initialDoc) {
         return EditorState.create({
             doc: initialDoc,
-            plugins: [
-                ...exampleSetup({ schema: this.schema, menuBar: false }),
-                keymap(this.menuCommandFactory.buildKeymap()),
-                createTriggerPlugin(this.triggerCharacters, this.contentConverter),
-                createLinkPlugin(this.handleNewLinkSelection),
-                createImageInserterPlugin(this.imagePasted.emit, this.validatedInlineImages),
-                createImageViewPlugin(this.language),
-                createMenuStateTrackingPlugin(editorMenuTypesArray, this.menuCommandFactory, this.updateActiveActionBarItems),
-                createActionBarInteractionPlugin(this.menuCommandFactory),
-                ...getTableEditingPlugins(this.contentType === 'html'),
-            ],
+            plugins: buildEditorPlugins({
+                schema: this.schema,
+                menuCommandFactory: this.menuCommandFactory,
+                contentConverter: this.contentConverter,
+                language: this.language,
+                contentType: this.contentType,
+                triggerCharacters: this.triggerCharacters,
+                inlineImages: this.validatedInlineImages,
+                onNewLinkSelection: this.handleNewLinkSelection,
+                onImagePasted: this.imagePasted.emit,
+                onActiveItemsChange: this.updateActiveActionBarItems,
+            }),
         });
     }
     async updateView(content) {
@@ -462,9 +456,16 @@ export class ProsemirrorAdapter {
                 "type": "string",
                 "mutable": false,
                 "complexType": {
-                    "original": "'markdown' | 'html'",
+                    "original": "ContentType",
                     "resolved": "\"html\" | \"markdown\"",
-                    "references": {}
+                    "references": {
+                        "ContentType": {
+                            "location": "import",
+                            "path": "./editor-config",
+                            "id": "src/components/text-editor/prosemirror-adapter/editor-config.ts::ContentType",
+                            "referenceLocation": "ContentType"
+                        }
+                    }
                 },
                 "required": false,
                 "optional": false,

package/dist/esm/limel-form.entry.js

@@ -20539,7 +20539,12 @@ function requireFastUri () {
 	 */
 	function resolve (baseURI, relativeURI, options) {
 	  const schemelessOptions = options ? Object.assign({ scheme: 'null' }, options) : { scheme: 'null' };
-	  const resolved = resolveComponent(parse(baseURI, schemelessOptions), parse(relativeURI, schemelessOptions), schemelessOptions, true);
+	  const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
+	  const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
+	  if (baseMalformed || relativeMalformed) {
+	    throw new Error(baseParsed.error || relativeParsed.error || 'URI is malformed.')
+	  }
+	  const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
 	  schemelessOptions.skipEscape = true;
 	  return serialize(resolved, schemelessOptions)
 	}
@@ -20715,6 +20720,19 @@ function requireFastUri () {
 
 	const URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
 
+	// Captures the authority component (between "//" and the next "/", "?" or "#"),
+	// with or without a scheme prefix, for the literal-backslash rejection below.
+	const AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/;
+
+	// Captures the leading authority-introducer region after an optional scheme: a
+	// run of forward slashes, backslashes, and the characters the WHATWG URL parser
+	// removes before parsing (TAB U+0009, LF U+000A, CR U+000D). A valid introducer
+	// is exactly "//". Node treats "\" as "/" on special schemes and strips those
+	// characters first, so forms like "\\", "/\", "\/", "/<TAB>/", or a leading
+	// "<TAB>//" reach an authority in Node while fast-uri's URI_PARSE folds them into
+	// the path group (host confusion / SSRF / redirect bypass).
+	const AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/;
+
 	/**
 	 * @param {import('./types/index').URIComponent} parsed
 	 * @param {RegExpMatchArray} matches
@@ -20761,6 +20779,41 @@ function requireFastUri () {
 	    }
 	  }
 
+	  // A literal backslash (U+005C) is not a valid RFC 3986 URI character and is
+	  // not an authority delimiter. Reject it in the authority rather than
+	  // rewriting it: normalizing "\" -> "/" (WHATWG error recovery) could silently
+	  // change the resource identified by an otherwise-invalid input, and lets "\"
+	  // act as a host delimiter here while Node's native URL parses a different
+	  // host (SSRF / redirect / origin-allowlist bypass). Percent-encoded %5C is
+	  // untouched and remains valid encoded data.
+	  const authorityMatch = uri.match(AUTHORITY_PREFIX);
+	  if (authorityMatch !== null && authorityMatch[1].indexOf('\\') !== -1) {
+	    parsed.error = 'URI authority must not contain a literal backslash.';
+	    malformedAuthorityOrPort = true;
+	  }
+
+	  // Reject a malformed or whitespace-smuggled authority introducer. fast-uri
+	  // only recognizes a literal "//"; anything else in the leading separator run
+	  // (a backslash, or a "//" that appears only after removing the TAB/LF/CR that
+	  // Node strips) means the authority fast-uri parses differs from the one Node's
+	  // URL resolves. Reject rather than rewrite, mirroring the literal-backslash
+	  // guard above. Percent-encoded forms (%5C, %09) are untouched, valid data.
+	  const introducerMatch = uri.match(AUTHORITY_INTRODUCER_REGION);
+	  if (introducerMatch !== null) {
+	    const region = introducerMatch[1];
+	    const normalizedRegion = region.replace(/[\t\n\r]/g, '');
+	    // Two or more leading separators introduce an authority.
+	    if (normalizedRegion.length >= 2) {
+	      if (normalizedRegion.slice(0, 2) !== '//') {
+	        parsed.error = parsed.error || 'URI authority must not contain a literal backslash.';
+	        malformedAuthorityOrPort = true;
+	      } else if (region.length !== normalizedRegion.length) {
+	        parsed.error = parsed.error || 'URI authority introducer must not contain whitespace.';
+	        malformedAuthorityOrPort = true;
+	      }
+	    }
+	  }
+
 	  const matches = uri.match(URI_PARSE);
 
 	  if (matches) {
@@ -20818,7 +20871,7 @@ function requireFastUri () {
 	      if (parsed.host && (options.domainHost || (schemeHandler && schemeHandler.domainHost)) && isIP === false && nonSimpleDomain(parsed.host)) {
 	        // convert Unicode IDN -> ASCII IDN
 	        try {
-	          parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
+	          parsed.host = new URL('http://' + parsed.host).hostname;
 	        } catch (e) {
 	          parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
 	        }