@mahe_pkm/buzl-html-editor 0.2.1 → 0.2.2

package/dist/public/public-live-edit.js

@@ -261,7 +261,7 @@
     if (!editMode) return;
     const editable = event.target.closest && event.target.closest('[data-buzl-public-edit="true"]');
     if (!editable) return;
-    if (editable.closest('a, button, summary')) event.preventDefault();
+    if (event.target.closest && event.target.closest('a, button, summary')) event.preventDefault();
     event.stopPropagation();
   }, true);
 

package/dist/server.js

@@ -26,9 +26,12 @@ const SITE_ROOT = path.resolve(process.env.BUZL_SITE_ROOT || process.cwd());
 
 const PUBLIC_LIVE_EDIT_ENABLED = new Set(['127.0.0.1', 'localhost', '::1'])
   .has(String(HOST).toLowerCase());
-const PUBLIC_EDIT_SELECTOR = [
-  'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'p', 'span', 'li', 'a', 'button', 'summary',
-  'figcaption', 'blockquote', 'cite', 'label', 'small', 'strong', 'em',
+const PUBLIC_BLOCK_EDIT_SELECTOR = [
+  'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'p', 'li', 'figcaption', 'blockquote',
+  'cite', 'label',
+].join(',');
+const PUBLIC_STANDALONE_EDIT_SELECTOR = [
+  'span', 'a', 'small', 'strong', 'em',
 ].join(',');
 const PUBLIC_EDIT_SESSION_TTL_MS = 2 * 60 * 60 * 1000;
 const publicEditSessions = new Map();
@@ -958,20 +961,36 @@ function removePublicEditArtifacts($) {
 }
 
 function collectPublicEditCandidates($) {
-  const candidates = [];
-  $(PUBLIC_EDIT_SELECTOR).each((_, element) => {
+  const isSafeTextTarget = (element) => {
     const target = $(element);
     const text = target.text();
-    if (!text || !text.trim()) return;
-    if (target.closest('svg, [aria-hidden="true"], script, style, noscript, input, textarea, select').length) {
-      return;
+    if (!text || !text.trim()) return false;
+    if (target.closest('svg, [aria-hidden="true"], script, style, noscript, input, textarea, select, iframe, canvas').length) {
+      return false;
     }
+    return !target.find('input, textarea, select, button, summary, iframe, canvas, video, audio, [contenteditable="true"]').length;
+  };
 
-    candidates.push(element);
+  const rawBlockCandidates = [];
+  $(PUBLIC_BLOCK_EDIT_SELECTOR).each((_, element) => {
+    if (isSafeTextTarget(element)) rawBlockCandidates.push(element);
+  });
+  // Prefer the innermost semantic block. This avoids overlapping edit targets
+  // for nested list items or a paragraph inside a blockquote.
+  const rawBlockSet = new Set(rawBlockCandidates);
+  const blockCandidates = rawBlockCandidates.filter((element) => !$(element).find('*').toArray()
+    .some((descendant) => rawBlockSet.has(descendant)));
+  const blockSet = new Set(blockCandidates);
+  const standaloneCandidates = [];
+  $(PUBLIC_STANDALONE_EDIT_SELECTOR).each((_, element) => {
+    if (!isSafeTextTarget(element)) return;
+    const target = $(element);
+    if (target.parents().toArray().some((parent) => blockSet.has(parent))) return;
+    standaloneCandidates.push(element);
   });
-  const candidateSet = new Set(candidates);
-  return candidates.filter((element) => !$(element).find('*').toArray()
-    .some((descendant) => candidateSet.has(descendant)));
+  const standaloneSet = new Set(standaloneCandidates);
+  return [...blockCandidates, ...standaloneCandidates.filter((element) => !$(element).find('*').toArray()
+    .some((descendant) => standaloneSet.has(descendant)))];
 }
 
 function sanitizePublicEditHtml(value) {
@@ -984,15 +1003,22 @@ function sanitizePublicEditHtml(value) {
   root.find('script, style, iframe, object, embed, form, input, textarea, select, option, button, link, meta')
     .remove();
 
-  const allowedTags = new Set(['br', 'strong', 'b', 'em', 'i', 'u', 's', 'sub', 'sup', 'span']);
+  const allowedTags = new Set(['br', 'strong', 'b', 'em', 'i', 'u', 's', 'sub', 'sup', 'span', 'a']);
   root.find('*').toArray().reverse().forEach((element) => {
     const tagName = String(element.tagName || element.name || '').toLowerCase();
     if (!allowedTags.has(tagName)) {
       fragment(element).replaceWith(fragment(element).text());
       return;
     }
-    for (const attribute of Object.keys(element.attribs || {})) {
-      fragment(element).removeAttr(attribute);
+    for (const [attribute, rawValue] of Object.entries(element.attribs || {})) {
+      const name = attribute.toLowerCase();
+      if (tagName === 'a' && ['href', 'target', 'rel'].includes(name)) {
+        if (name === 'href' && /^(?:javascript|data|vbscript):/i.test(String(rawValue).trim())) {
+          fragment(element).removeAttr(attribute);
+        }
+      } else {
+        fragment(element).removeAttr(attribute);
+      }
     }
   });
   return root.html() || '';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mahe_pkm/buzl-html-editor",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Local visual editor and static-site server for multi-page HTML websites",
   "author": "mahe_pkm",
   "type": "commonjs",