@lionrapid/core 0.1.4-beta.0 → 0.1.4-beta.2

package/dist/browser/lionrapid.esm.js

@@ -18,7 +18,17 @@ var IS_DEVELOPMENT = false;
 var IS_CI = false;
 var LIONRAPID_DEV = false;
 var PERFORMANCE_TRACKING = false;
-var LOG_LEVEL_ENV = IS_PRODUCTION ? "ERROR" : "DEBUG";
+function readBrowserLogLevel() {
+  try {
+    if (typeof localStorage !== "undefined") {
+      const v = localStorage.getItem("LIONRAPID_LOG_LEVEL");
+      if (v && typeof v === "string") return v;
+    }
+  } catch {
+  }
+  return null;
+}
+var LOG_LEVEL_ENV = readBrowserLogLevel() || "" || "WARN";
 var Colors = {
   // Reset
   RESET: "\x1B[0m",
@@ -224,7 +234,7 @@ var DevelopmentLogger = class _DevelopmentLogger {
       case "NONE":
         return 4 /* NONE */;
       default:
-        return 0 /* DEBUG */;
+        return 2 /* WARN */;
     }
   }
   shouldEnableLogging() {
@@ -2144,6 +2154,27 @@ var NetworkHandler = class {
   }
 };
 
+// src/content/safe-href.ts
+var SAFE_SCHEME = /^[a-z][a-z0-9+.-]*:/i;
+var ALLOWED_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:", "sms:"]);
+function safeHref(href) {
+  if (!href) return "#";
+  const trimmed = href.trim();
+  if (!trimmed) return "#";
+  if (trimmed.startsWith("//")) {
+    return "#";
+  }
+  if (trimmed.startsWith("/") || trimmed.startsWith("?") || trimmed.startsWith("#") || trimmed.startsWith("./") || trimmed.startsWith("../")) {
+    return trimmed;
+  }
+  const schemeMatch = SAFE_SCHEME.exec(trimmed);
+  if (schemeMatch) {
+    const scheme = schemeMatch[0].toLowerCase();
+    return ALLOWED_SCHEMES.has(scheme) ? trimmed : "#";
+  }
+  return trimmed;
+}
+
 // src/content/style-mapper/DefaultStyleMapper.ts
 var DefaultStyleMapper = class {
   constructor() {
@@ -2229,7 +2260,7 @@ var DefaultStyleMapper = class {
       if (style.startsWith("hyperlink:")) {
         return {
           element: "a",
-          attrs: { href: style.slice("hyperlink:".length) }
+          attrs: { href: safeHref(style.slice("hyperlink:".length)) }
         };
       }
     }