@lionrapid/core 0.1.4-beta.0 → 0.1.4-beta.2

package/dist/browser/lionrapid.editor.js

@@ -501,6 +501,27 @@ var LionRapidEditor = (() => {
 }
 `;
 
+  // src/content/safe-href.ts
+  var SAFE_SCHEME = /^[a-z][a-z0-9+.-]*:/i;
+  var ALLOWED_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:", "sms:"]);
+  function safeHref(href) {
+    if (!href) return "#";
+    const trimmed = href.trim();
+    if (!trimmed) return "#";
+    if (trimmed.startsWith("//")) {
+      return "#";
+    }
+    if (trimmed.startsWith("/") || trimmed.startsWith("?") || trimmed.startsWith("#") || trimmed.startsWith("./") || trimmed.startsWith("../")) {
+      return trimmed;
+    }
+    const schemeMatch = SAFE_SCHEME.exec(trimmed);
+    if (schemeMatch) {
+      const scheme = schemeMatch[0].toLowerCase();
+      return ALLOWED_SCHEMES.has(scheme) ? trimmed : "#";
+    }
+    return trimmed;
+  }
+
   // src/content/style-mapper/DefaultStyleMapper.ts
   var DefaultStyleMapper = class {
     constructor() {
@@ -586,7 +607,7 @@ var LionRapidEditor = (() => {
         if (style.startsWith("hyperlink:")) {
           return {
             element: "a",
-            attrs: { href: style.slice("hyperlink:".length) }
+            attrs: { href: safeHref(style.slice("hyperlink:".length)) }
           };
         }
       }