@lionrapid/core 0.1.4-beta.0 → 0.1.4-beta.2

package/dist/browser/lionrapid.auto.dev.js

@@ -57,7 +57,17 @@ var LionRapid = (() => {
   var IS_CI = false;
   var LIONRAPID_DEV = true;
   var PERFORMANCE_TRACKING = true;
-  var LOG_LEVEL_ENV = "DEBUG";
+  function readBrowserLogLevel() {
+    try {
+      if (typeof localStorage !== "undefined") {
+        const v = localStorage.getItem("LIONRAPID_LOG_LEVEL");
+        if (v && typeof v === "string") return v;
+      }
+    } catch {
+    }
+    return null;
+  }
+  var LOG_LEVEL_ENV = readBrowserLogLevel() || "DEBUG";
   var Colors = {
     // Reset
     RESET: "\x1B[0m",
@@ -263,7 +273,7 @@ var LionRapid = (() => {
         case "NONE":
           return 4 /* NONE */;
         default:
-          return 0 /* DEBUG */;
+          return 2 /* WARN */;
       }
     }
     shouldEnableLogging() {
@@ -2124,6 +2134,27 @@ var LionRapid = (() => {
     }
   };
 
+  // src/content/safe-href.ts
+  var SAFE_SCHEME = /^[a-z][a-z0-9+.-]*:/i;
+  var ALLOWED_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:", "sms:"]);
+  function safeHref(href) {
+    if (!href) return "#";
+    const trimmed = href.trim();
+    if (!trimmed) return "#";
+    if (trimmed.startsWith("//")) {
+      return "#";
+    }
+    if (trimmed.startsWith("/") || trimmed.startsWith("?") || trimmed.startsWith("#") || trimmed.startsWith("./") || trimmed.startsWith("../")) {
+      return trimmed;
+    }
+    const schemeMatch = SAFE_SCHEME.exec(trimmed);
+    if (schemeMatch) {
+      const scheme = schemeMatch[0].toLowerCase();
+      return ALLOWED_SCHEMES.has(scheme) ? trimmed : "#";
+    }
+    return trimmed;
+  }
+
   // src/content/style-mapper/DefaultStyleMapper.ts
   var DefaultStyleMapper = class {
     constructor() {
@@ -2209,7 +2240,7 @@ var LionRapid = (() => {
         if (style.startsWith("hyperlink:")) {
           return {
             element: "a",
-            attrs: { href: style.slice("hyperlink:".length) }
+            attrs: { href: safeHref(style.slice("hyperlink:".length)) }
           };
         }
       }