@lobehub/ui 2.24.0 → 2.24.1

package/es/Highlighter/Highlighter.js

@@ -1,12 +1,12 @@
 'use client';
 
-function _typeof(o) { "@babel/helpers - typeof"; return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, _typeof(o); }
 var _excluded = ["animated", "fullFeatured", "actionIconSize", "children", "language", "className", "copyable", "showLanguage", "variant", "shadow", "wrap", "bodyRender", "actionsRender", "enableTransformer", "theme", "icon", "fileName", "allowChangeLanguage", "defaultExpand"];
 function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
 function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 function _defineProperty(obj, key, value) { key = _toPropertyKey(key); if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
 function _toPropertyKey(t) { var i = _toPrimitive(t, "string"); return "symbol" == _typeof(i) ? i : String(i); }
 function _toPrimitive(t, r) { if ("object" != _typeof(t) || !t) return t; var e = t[Symbol.toPrimitive]; if (void 0 !== e) { var i = e.call(t, r || "default"); if ("object" != _typeof(i)) return i; throw new TypeError("@@toPrimitive must return a primitive value."); } return ("string" === r ? String : Number)(t); }
+function _typeof(o) { "@babel/helpers - typeof"; return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, _typeof(o); }
 function _slicedToArray(arr, i) { return _arrayWithHoles(arr) || _iterableToArrayLimit(arr, i) || _unsupportedIterableToArray(arr, i) || _nonIterableRest(); }
 function _nonIterableRest() { throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); }
 function _unsupportedIterableToArray(o, minLen) { if (!o) return; if (typeof o === "string") return _arrayLikeToArray(o, minLen); var n = Object.prototype.toString.call(o).slice(8, -1); if (n === "Object" && o.constructor) n = o.constructor.name; if (n === "Map" || n === "Set") return Array.from(o); if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _arrayLikeToArray(o, minLen); }
@@ -85,7 +85,16 @@ export var Highlighter = /*#__PURE__*/memo(function (_ref) {
       /* eslint-enable sort-keys-fix/sort-keys-fix */
     });
   }, [styles]);
-  var tirmedChildren = children.trim();
+
+  // Safely handle children with boundary check
+  var tirmedChildren = useMemo(function () {
+    if (children === null || children === undefined) return '';
+    if (typeof children !== 'string') {
+      console.warn('Highlighter: children should be a string, received:', _typeof(children));
+      return String(children);
+    }
+    return children.trim();
+  }, [children]);
   var copyContentRef = useRef(tirmedChildren);
   useEffect(function () {
     copyContentRef.current = tirmedChildren;

package/es/Highlighter/SyntaxHighlighter/StaticRenderer.js

@@ -3,6 +3,11 @@
 import { memo } from 'react';
 import { useHighlight } from "../../hooks/useHighlight";
 import { jsx as _jsx } from "react/jsx-runtime";
+// Escape HTML for fallback to prevent XSS
+var escapeHtml = function escapeHtml(str) {
+  return str.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;').replaceAll("'", '&#039;');
+};
+
 /**
  * Static renderer for syntax highlighting without animation
  * Uses useHighlight hook to generate HTML and renders it directly
@@ -15,7 +20,9 @@ var StaticRenderer = /*#__PURE__*/memo(function (_ref) {
     language = _ref.language,
     style = _ref.style,
     theme = _ref.theme;
-  var _useHighlight = useHighlight(children, {
+  // Safely handle empty or invalid children
+  var safeChildren = children !== null && children !== void 0 ? children : '';
+  var _useHighlight = useHighlight(safeChildren, {
       enableTransformer: enableTransformer,
       language: language,
       theme: theme
@@ -26,7 +33,7 @@ var StaticRenderer = /*#__PURE__*/memo(function (_ref) {
   return /*#__PURE__*/_jsx("div", {
     className: containerClassName,
     dangerouslySetInnerHTML: {
-      __html: data || "<pre><code>".concat(children, "</code></pre>")
+      __html: data || "<pre><code>".concat(escapeHtml(safeChildren), "</code></pre>")
     },
     dir: "ltr",
     style: style

package/es/Highlighter/SyntaxHighlighter/StreamRenderer.js

@@ -97,7 +97,10 @@ var StreamRenderer = /*#__PURE__*/memo(function (_ref5) {
     theme = _ref5.theme;
   var _useStyles = useStyles(),
     cx = _useStyles.cx;
-  var _useHighlight = useHighlight(children, {
+
+  // Safely handle empty or invalid children
+  var safeChildren = children !== null && children !== void 0 ? children : '';
+  var _useHighlight = useHighlight(safeChildren, {
       enableTransformer: enableTransformer,
       language: language,
       streaming: true,
@@ -114,7 +117,7 @@ var StreamRenderer = /*#__PURE__*/memo(function (_ref5) {
       style: style,
       children: /*#__PURE__*/_jsx("pre", {
         children: /*#__PURE__*/_jsx("code", {
-          children: children
+          children: safeChildren
         })
       })
     });

package/es/hooks/useHighlight.js

@@ -102,13 +102,14 @@ var useStreamingHighlighter = function useStreamingHighlighter(text, options) {
     setResult = _useState2[1];
   var tokenizerRef = useRef(null);
   var previousTextRef = useRef('');
-  var latestTextRef = useRef(text);
+  var safeText = text !== null && text !== void 0 ? text : '';
+  var latestTextRef = useRef(safeText);
   var preStyleRef = useRef(undefined);
   var colorReplacementsRef = useRef(colorReplacements);
   var linesRef = useRef([[]]);
   useEffect(function () {
-    latestTextRef.current = text;
-  }, [text]);
+    latestTextRef.current = safeText;
+  }, [safeText]);
   useEffect(function () {
     colorReplacementsRef.current = colorReplacements;
   }, [colorReplacements]);
@@ -281,8 +282,8 @@ var useStreamingHighlighter = function useStreamingHighlighter(text, options) {
   useEffect(function () {
     if (!enabled) return;
     if (!tokenizerRef.current) return;
-    updateTokens(text);
-  }, [enabled, text, updateTokens]);
+    updateTokens(safeText);
+  }, [enabled, safeText, updateTokens]);
   return result;
 };
 
@@ -295,7 +296,10 @@ export var useHighlight = function useHighlight(text, _ref3) {
   var _useThemeMode = useThemeMode(),
     isDarkMode = _useThemeMode.isDarkMode;
   var theme = useTheme();
-  var lang = language.toLowerCase();
+
+  // Safely handle language and text with boundary checks
+  var safeText = text !== null && text !== void 0 ? text : '';
+  var lang = (language !== null && language !== void 0 ? language : 'plaintext').toLowerCase();
 
   // Match supported languages
   var matchedLanguage = useMemo(function () {
@@ -340,9 +344,9 @@ export var useHighlight = function useHighlight(text, _ref3) {
   // Build cache key
   var cacheKey = useMemo(function () {
     // Use hash for long text
-    var hash = text.length < MD5_LENGTH_THRESHOLD ? text : Md5.hashStr(text);
+    var hash = safeText.length < MD5_LENGTH_THRESHOLD ? safeText : Md5.hashStr(safeText);
     return [matchedLanguage, builtinTheme || (isDarkMode ? 'd' : 'l'), hash].filter(Boolean).join('-');
-  }, [text, matchedLanguage, isDarkMode, builtinTheme]);
+  }, [safeText, matchedLanguage, isDarkMode, builtinTheme]);
 
   // Use SWR to get highlighted HTML
   var response = useSWR(streaming ? null : cacheKey, /*#__PURE__*/_asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee3() {
@@ -359,10 +363,10 @@ export var useHighlight = function useHighlight(text, _ref3) {
             _context3.next = 6;
             break;
           }
-          return _context3.abrupt("return", text);
+          return _context3.abrupt("return", safeText);
         case 6:
           _context3.next = 8;
-          return codeToHtml(text, {
+          return codeToHtml(safeText, {
             colorReplacements: builtinTheme ? undefined : colorReplacements,
             lang: matchedLanguage,
             theme: builtinTheme || (isDarkMode ? 'slack-dark' : 'slack-ochin'),
@@ -384,10 +388,10 @@ export var useHighlight = function useHighlight(text, _ref3) {
             _context3.next = 21;
             break;
           }
-          return _context3.abrupt("return", text);
+          return _context3.abrupt("return", safeText);
         case 21:
           _context3.next = 23;
-          return _codeToHtml(text, {
+          return _codeToHtml(safeText, {
             lang: matchedLanguage,
             theme: isDarkMode ? 'dark-plus' : 'light-plus'
           });
@@ -398,7 +402,7 @@ export var useHighlight = function useHighlight(text, _ref3) {
           _context3.prev = 27;
           _context3.t1 = _context3["catch"](15);
           // Fallback to plain text
-          fallbackHtml = "<pre class=\"fallback\"><code>".concat(escapeHtml(text), "</code></pre>");
+          fallbackHtml = "<pre class=\"fallback\"><code>".concat(escapeHtml(safeText), "</code></pre>");
           return _context3.abrupt("return", fallbackHtml);
         case 31:
         case "end":
@@ -414,7 +418,7 @@ export var useHighlight = function useHighlight(text, _ref3) {
     revalidateOnReconnect: false
   });
   var effectiveTheme = builtinTheme || (isDarkMode ? 'slack-dark' : 'slack-ochin');
-  var streamingResult = useStreamingHighlighter(text, {
+  var streamingResult = useStreamingHighlighter(safeText, {
     colorReplacements: builtinTheme ? undefined : colorReplacements[effectiveTheme],
     enabled: streaming,
     language: matchedLanguage,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lobehub/ui",
-  "version": "2.24.0",
+  "version": "2.24.1",
   "description": "Lobe UI is an open-source UI component library for building AIGC web apps",
   "keywords": [
     "lobehub",