@lvce-editor/api 9.37.0 → 9.37.2

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export { activate } from './parts/Activation/Activation.ts';
 export { getColorThemeNames } from './parts/ColorTheme/ColorTheme.ts';
+export { markdownToVirtualDom } from './parts/Markdown/Markdown.ts';
 export { getAccessToken, type GetAccessTokenOptions } from './parts/Authentication/Authentication.ts';
 export { createElectronWebContentsView } from './parts/ElectronWebContentsView/ElectronWebContentsView.ts';
 export { executeCommand } from './parts/ExecuteCommand/ExecuteCommand.ts';

package/dist/index.js

@@ -1,5 +1,6 @@
 export { activate } from "./parts/Activation/Activation.js";
 export { getColorThemeNames } from "./parts/ColorTheme/ColorTheme.js";
+export { markdownToVirtualDom } from "./parts/Markdown/Markdown.js";
 export { getAccessToken } from "./parts/Authentication/Authentication.js";
 export { createElectronWebContentsView } from "./parts/ElectronWebContentsView/ElectronWebContentsView.js";
 export { executeCommand } from "./parts/ExecuteCommand/ExecuteCommand.js";

package/dist/parts/Markdown/Markdown.d.ts

@@ -0,0 +1,2 @@
+import type { VirtualDomNode } from '@lvce-editor/virtual-dom-worker';
+export declare const markdownToVirtualDom: (markdown: string) => Promise<readonly VirtualDomNode[]>;

package/dist/parts/Markdown/Markdown.js

@@ -0,0 +1,7 @@
+import { executeCommand } from "../ExecuteCommand/ExecuteCommand.js";
+import { sanitizeMarkdownVirtualDom } from "./SanitizeMarkdownVirtualDom.js";
+export const markdownToVirtualDom = async (markdown) => {
+    const html = (await executeCommand('Markdown.renderMarkdown', markdown));
+    const nodes = (await executeCommand('Markdown.getVirtualDom', html));
+    return sanitizeMarkdownVirtualDom(nodes);
+};

package/dist/parts/Markdown/SanitizeMarkdownVirtualDom.d.ts

@@ -0,0 +1,2 @@
+import type { VirtualDomNode } from '@lvce-editor/virtual-dom-worker';
+export declare const sanitizeMarkdownVirtualDom: (nodes: readonly VirtualDomNode[]) => readonly VirtualDomNode[];

package/dist/parts/Markdown/SanitizeMarkdownVirtualDom.js

@@ -0,0 +1,30 @@
+import { VirtualDomElements } from '@lvce-editor/virtual-dom-worker';
+const allowedHrefProtocols = new Set(['http', 'https', 'mailto', 'tel']);
+const allowedSrcProtocols = new Set(['http', 'https']);
+const protocolPattern = /^([a-z][a-z\d+.-]*):/i;
+const isAllowedUrl = (value, allowedProtocols) => {
+    const normalizedValue = [...value]
+        .filter((character) => {
+        const codePoint = character.codePointAt(0) ?? 0;
+        return codePoint > 32 && codePoint !== 127;
+    })
+        .join('');
+    const protocol = protocolPattern.exec(normalizedValue)?.[1]?.toLowerCase();
+    return !protocol || allowedProtocols.has(protocol);
+};
+export const sanitizeMarkdownVirtualDom = (nodes) => {
+    return nodes.map((node) => {
+        const sanitizedNode = { ...node };
+        if (typeof sanitizedNode.href === 'string' && !isAllowedUrl(sanitizedNode.href, allowedHrefProtocols)) {
+            delete sanitizedNode.href;
+        }
+        if (sanitizedNode.type === VirtualDomElements.A && typeof sanitizedNode.href === 'string') {
+            sanitizedNode.target = '_blank';
+            sanitizedNode.rel = 'noopener noreferrer';
+        }
+        if (typeof sanitizedNode.src === 'string' && !isAllowedUrl(sanitizedNode.src, allowedSrcProtocols)) {
+            delete sanitizedNode.src;
+        }
+        return sanitizedNode;
+    });
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lvce-editor/api",
-  "version": "9.37.0",
+  "version": "9.37.2",
   "description": "Tree-shakeable extension API for Lvce Editor extensions.",
   "keywords": [
     "lvce-editor",