@makolabs/ripple 3.8.0 → 3.9.1

package/dist/helper/is-safe-http-url.js

@@ -0,0 +1,214 @@
+/**
+ * URL safety helpers for the file-preview viewers. See spec §4 / threat
+ * register T0.1, T1.3, T1.4. `isSafeHttpUrl` is a strict allowlist; do not
+ * convert it to a denylist.
+ */
+/** Parse a hostname into a 32-bit IPv4 int, or null if it is not an IPv4 form. */
+function toIpv4Int(hostname) {
+    const host = hostname.toLowerCase();
+    // Dotted forms: a, a.b, a.b.c, a.b.c.d where each part may be dec/hex/octal.
+    const parts = host.split('.');
+    if (parts.length >= 1 && parts.length <= 4 && parts.every((p) => p.length > 0)) {
+        const nums = [];
+        for (const part of parts) {
+            let n;
+            if (/^0x[0-9a-f]+$/.test(part))
+                n = parseInt(part, 16);
+            else if (/^0[0-7]+$/.test(part))
+                n = parseInt(part, 8);
+            else if (/^[0-9]+$/.test(part))
+                n = parseInt(part, 10);
+            else
+                return null;
+            if (!Number.isFinite(n) || n < 0)
+                return null;
+            nums.push(n);
+        }
+        // Single number (e.g. 2130706433) => whole 32-bit address.
+        if (nums.length === 1) {
+            const n = nums[0];
+            return n <= 0xffffffff ? n >>> 0 : null;
+        }
+        // Last part fills remaining bytes; leading parts must be single bytes.
+        const last = nums[nums.length - 1];
+        const lead = nums.slice(0, -1);
+        if (lead.some((n) => n > 255))
+            return null;
+        const remaining = 4 - lead.length;
+        if (last > 0xffffffff || last >= 256 ** remaining)
+            return null;
+        let value = 0;
+        for (const n of lead)
+            value = (value << 8) | n;
+        value = (value * 256 ** remaining + last) >>> 0;
+        return value;
+    }
+    return null;
+}
+function ipv4IntInBlockedRange(ip) {
+    const a = (ip >>> 24) & 0xff;
+    const b = (ip >>> 16) & 0xff;
+    if (a === 0)
+        return true; // 0.0.0.0/8
+    if (a === 10)
+        return true; // 10/8
+    if (a === 127)
+        return true; // 127/8 loopback
+    if (a === 169 && b === 254)
+        return true; // 169.254/16 link-local
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // 172.16/12
+    if (a === 192 && b === 168)
+        return true; // 192.168/16
+    return false;
+}
+/** True for loopback / link-local / private / metadata / encoded-IP hosts. */
+export function isBlockedHost(hostname) {
+    if (!hostname)
+        return true;
+    let host = hostname.toLowerCase().trim();
+    // Strip IPv6 brackets if present.
+    if (host.startsWith('[') && host.endsWith(']'))
+        host = host.slice(1, -1);
+    if (host === 'localhost' || host.endsWith('.localhost'))
+        return true;
+    if (host.endsWith('.internal') || host.startsWith('metadata.'))
+        return true;
+    // IPv6 loopback + unique-local (fc00::/7 => fc.. or fd..) + link-local (fe80).
+    if (host === '::1')
+        return true;
+    if (host.includes(':')) {
+        // IPv4-mapped IPv6 (::ffff:127.0.0.1, normalized by URL parser to
+        // ::ffff:7f00:1) tunnels a v4 address through a v6 host — unwrap and
+        // re-check against the v4 ranges so mapped loopback/private stays blocked.
+        const mapped = /^::ffff:(.+)$/.exec(host);
+        if (mapped) {
+            const tail = mapped[1];
+            const dotted = toIpv4Int(tail);
+            if (dotted !== null)
+                return ipv4IntInBlockedRange(dotted);
+            const groups = tail.split(':');
+            if (groups.length === 2 && groups.every((g) => /^[0-9a-f]{1,4}$/.test(g))) {
+                const v4 = ((parseInt(groups[0], 16) << 16) | parseInt(groups[1], 16)) >>> 0;
+                return ipv4IntInBlockedRange(v4);
+            }
+        }
+        if (host.startsWith('fc') || host.startsWith('fd'))
+            return true;
+        if (host.startsWith('fe80'))
+            return true;
+        return false;
+    }
+    const ip = toIpv4Int(host);
+    if (ip !== null)
+        return ipv4IntInBlockedRange(ip);
+    return false;
+}
+// Control chars + space; WHATWG URL strips \t\n\r, so reject before parsing.
+// Matches U+0000–U+0020 (includes tab, newline, CR, space) and U+007F (DEL).
+// eslint-disable-next-line no-control-regex -- detecting control chars is the point
+const CONTROL_OR_SPACE = /[\u0000-\u0020\u007f]/;
+function defaultBase(opts) {
+    if (opts.base)
+        return opts.base;
+    if (typeof document !== 'undefined')
+        return document.baseURI;
+    return undefined;
+}
+function originOf(value) {
+    try {
+        return new URL(value).origin;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Strict allowlist: http/https (+ same-origin blob when allowBlob). */
+export function isSafeHttpUrl(url, opts = {}) {
+    if (typeof url !== 'string' || url.length === 0)
+        return false;
+    if (CONTROL_OR_SPACE.test(url))
+        return false;
+    const base = defaultBase(opts);
+    let parsed;
+    try {
+        parsed = new URL(url, base);
+    }
+    catch {
+        return false;
+    }
+    if (parsed.username || parsed.password)
+        return false;
+    const proto = parsed.protocol;
+    if (proto === 'blob:') {
+        if (!opts.allowBlob)
+            return false;
+        // blob: origin is embedded in the URL; require it to match the base origin.
+        const baseOrigin = base ? originOf(base) : undefined;
+        if (!baseOrigin || parsed.origin !== baseOrigin)
+            return false;
+        return true;
+    }
+    if (proto !== 'http:' && proto !== 'https:')
+        return false;
+    const baseOrigin = base
+        ? originOf(base)
+        : typeof location !== 'undefined'
+            ? location.origin
+            : undefined;
+    if (isBlockedHost(parsed.hostname)) {
+        // allowPrivateHosts only waives host-blocking for the base (same-origin)
+        // origin or an explicitly allowed origin — never a blanket SSRF bypass to
+        // arbitrary loopback/LAN/metadata hosts.
+        const privateOk = !!opts.allowPrivateHosts &&
+            ((!!baseOrigin && parsed.origin === baseOrigin) ||
+                (opts.allowedOrigins?.includes(parsed.origin) ?? false));
+        if (!privateOk)
+            return false;
+    }
+    if (opts.sameOrigin || opts.allowedOrigins) {
+        const allowed = new Set(opts.allowedOrigins ?? []);
+        if (opts.sameOrigin && baseOrigin)
+            allowed.add(baseOrigin);
+        // Fail closed: a same-origin / allowlist requirement with no resolvable
+        // allowed origin (e.g. sameOrigin in a non-browser with no base) must not
+        // silently permit every origin.
+        if (allowed.size === 0)
+            return false;
+        if (!allowed.has(parsed.origin))
+            return false;
+    }
+    return true;
+}
+/** Strip query string + hash for safe logging (signed-URL tokens live there). */
+export function redactUrl(url, base) {
+    try {
+        const resolved = base ?? (typeof document !== 'undefined' ? document.baseURI : undefined);
+        const u = new URL(url, resolved);
+        return u.origin + u.pathname;
+    }
+    catch {
+        return '[unparseable url]';
+    }
+}
+/** Schemes that can execute script or read local files — never valid for a link. */
+const DANGEROUS_LINK_SCHEMES = new Set(['javascript:', 'data:', 'vbscript:', 'file:']);
+/**
+ * Link-href guard for navigation (`<a href>`). Broader than isSafeHttpUrl:
+ * allows http/https/mailto/tel/relative/hash, blocks only executable schemes.
+ */
+export function isSafeLinkHref(href, base) {
+    if (typeof href !== 'string' || href.length === 0)
+        return false;
+    if (CONTROL_OR_SPACE.test(href))
+        return false;
+    const resolved = base ?? (typeof document !== 'undefined' ? document.baseURI : undefined);
+    try {
+        const parsed = new URL(href, resolved);
+        return !DANGEROUS_LINK_SCHEMES.has(parsed.protocol);
+    }
+    catch {
+        // No usable base + relative href: safe only if it carries no scheme.
+        return !/^[a-z][a-z0-9+.-]*:/i.test(href);
+    }
+}

package/dist/helper/pdf-safety.d.ts

@@ -0,0 +1,38 @@
+/** Options passed to pdfjs getDocument to neutralise eval/XFA and silence logging. */
+export declare const PDFJS_DOCUMENT_OPTIONS: {
+    readonly isEvalSupported: false;
+    readonly enableXfa: false;
+    readonly verbosity: 0;
+};
+/** True when a pdfjs-dist version is at/above the CVE-2024-4367 fix (4.2.67). */
+export declare function isPdfJsVersionSafe(version: string | undefined): boolean;
+export type CanvasDimensions = {
+    cssWidth: number;
+    cssHeight: number;
+    pixelWidth: number;
+    pixelHeight: number;
+    effectivePixelRatio: number;
+};
+/**
+ * Compute canvas backing-store + CSS dimensions for a page, clamping the
+ * backing store to MAX_CANVAS_SIDE/MAX_CANVAS_AREA so a giant MediaBox can't
+ * OOM the tab. CSS (display) size is preserved; only resolution is reduced.
+ */
+export declare function computeCanvasDimensions(baseWidth: number, baseHeight: number, scale: number, rawPixelRatio: number): CanvasDimensions;
+/** Number of pages to eagerly render: min(numPages, maxPages); 0 if invalid. */
+export declare function pagesToRender(numPages: number, maxPages: number): number;
+/** How the viewer auto-sizes a page to its container. `fit-width` spans the
+ *  available width (scroll vertically); `fit-page` fits the whole first page. */
+export type FitMode = 'fit-width' | 'fit-page';
+/**
+ * Resolve a `fit-width`/`fit-page` request into a concrete render scale for the
+ * given page and container, clamped to [minScale, maxScale]. `padding` is the
+ * total horizontal (and, for `fit-page`, vertical) chrome to subtract from the
+ * container before fitting. Invalid geometry falls back to a clamped scale of 1
+ * so the caller always gets a usable number.
+ */
+export declare function computeFitScale(pageWidth: number, pageHeight: number, containerWidth: number, containerHeight: number, mode: FitMode, opts: {
+    minScale: number;
+    maxScale: number;
+    padding?: number;
+}): number;

package/dist/helper/pdf-safety.js

@@ -0,0 +1,85 @@
+/** Pure pdfjs hardening helpers — testable without a browser/canvas. See spec §5.2. */
+import { MAX_CANVAS_AREA, MAX_CANVAS_SIDE, clampPixelRatio } from './resource-limits.js';
+/** Options passed to pdfjs getDocument to neutralise eval/XFA and silence logging. */
+export const PDFJS_DOCUMENT_OPTIONS = {
+    isEvalSupported: false,
+    enableXfa: false,
+    verbosity: 0
+};
+/** True when a pdfjs-dist version is at/above the CVE-2024-4367 fix (4.2.67). */
+export function isPdfJsVersionSafe(version) {
+    if (!version || typeof version !== 'string')
+        return false;
+    const m = version.match(/^(\d+)\.(\d+)\.(\d+)/);
+    if (!m)
+        return false;
+    const major = Number(m[1]);
+    const minor = Number(m[2]);
+    const patch = Number(m[3]);
+    if (major > 4)
+        return true;
+    if (major < 4)
+        return false;
+    if (minor > 2)
+        return true;
+    if (minor < 2)
+        return false;
+    return patch >= 67;
+}
+/**
+ * Compute canvas backing-store + CSS dimensions for a page, clamping the
+ * backing store to MAX_CANVAS_SIDE/MAX_CANVAS_AREA so a giant MediaBox can't
+ * OOM the tab. CSS (display) size is preserved; only resolution is reduced.
+ */
+export function computeCanvasDimensions(baseWidth, baseHeight, scale, rawPixelRatio) {
+    const pr = clampPixelRatio(rawPixelRatio);
+    const cssWidth = baseWidth * scale;
+    const cssHeight = baseHeight * scale;
+    let pixelWidth = cssWidth * pr;
+    let pixelHeight = cssHeight * pr;
+    const sideScale = Math.min(1, MAX_CANVAS_SIDE / pixelWidth, MAX_CANVAS_SIDE / pixelHeight);
+    pixelWidth *= sideScale;
+    pixelHeight *= sideScale;
+    const area = pixelWidth * pixelHeight;
+    const areaScale = area > MAX_CANVAS_AREA ? Math.sqrt(MAX_CANVAS_AREA / area) : 1;
+    pixelWidth *= areaScale;
+    pixelHeight *= areaScale;
+    return {
+        cssWidth,
+        cssHeight,
+        pixelWidth: Math.max(1, Math.floor(pixelWidth)),
+        pixelHeight: Math.max(1, Math.floor(pixelHeight)),
+        effectivePixelRatio: pr * sideScale * areaScale
+    };
+}
+/** Number of pages to eagerly render: min(numPages, maxPages); 0 if invalid. */
+export function pagesToRender(numPages, maxPages) {
+    if (!Number.isFinite(numPages) || numPages <= 0)
+        return 0;
+    return Math.min(numPages, Math.max(0, maxPages));
+}
+/**
+ * Resolve a `fit-width`/`fit-page` request into a concrete render scale for the
+ * given page and container, clamped to [minScale, maxScale]. `padding` is the
+ * total horizontal (and, for `fit-page`, vertical) chrome to subtract from the
+ * container before fitting. Invalid geometry falls back to a clamped scale of 1
+ * so the caller always gets a usable number.
+ */
+export function computeFitScale(pageWidth, pageHeight, containerWidth, containerHeight, mode, opts) {
+    const { minScale, maxScale, padding = 0 } = opts;
+    const clamp = (value) => Math.min(Math.max(value, minScale), maxScale);
+    const finiteAndPositive = (n) => Number.isFinite(n) && n > 0;
+    if (!finiteAndPositive(pageWidth) ||
+        !finiteAndPositive(pageHeight) ||
+        !finiteAndPositive(containerWidth) ||
+        !finiteAndPositive(containerHeight)) {
+        return clamp(1);
+    }
+    const availWidth = Math.max(0, containerWidth - padding);
+    const widthScale = availWidth / pageWidth;
+    if (mode === 'fit-page') {
+        const availHeight = Math.max(0, containerHeight - padding);
+        return clamp(Math.min(widthScale, availHeight / pageHeight));
+    }
+    return clamp(widthScale);
+}

package/dist/helper/resource-limits.d.ts

@@ -0,0 +1,13 @@
+/** Shared resource caps for the file-preview viewers. See spec §4. */
+/** Max PDF pages PdfViewer will eagerly render before showing a "first N" banner. */
+export declare const MAX_PAGES = 200;
+/** Max canvas area (px²) — 16 MP is safe across Chrome/Safari/Firefox. */
+export declare const MAX_CANVAS_AREA = 16000000;
+/** Max canvas side length (px). */
+export declare const MAX_CANVAS_SIDE = 8192;
+/** Max decoded image pixels (w×h) before falling back to download. */
+export declare const MAX_IMAGE_PIXELS = 40000000;
+/** Max decoded text bytes TextViewer will buffer before truncating. */
+export declare const MAX_TEXT_BYTES: number;
+/** Clamp a devicePixelRatio into [1, 2]; invalid input falls back to 1. */
+export declare function clampPixelRatio(dpr?: number): number;

package/dist/helper/resource-limits.js

@@ -0,0 +1,16 @@
+/** Shared resource caps for the file-preview viewers. See spec §4. */
+/** Max PDF pages PdfViewer will eagerly render before showing a "first N" banner. */
+export const MAX_PAGES = 200;
+/** Max canvas area (px²) — 16 MP is safe across Chrome/Safari/Firefox. */
+export const MAX_CANVAS_AREA = 16_000_000;
+/** Max canvas side length (px). */
+export const MAX_CANVAS_SIDE = 8192;
+/** Max decoded image pixels (w×h) before falling back to download. */
+export const MAX_IMAGE_PIXELS = 40_000_000;
+/** Max decoded text bytes TextViewer will buffer before truncating. */
+export const MAX_TEXT_BYTES = 2 * 1024 * 1024;
+/** Clamp a devicePixelRatio into [1, 2]; invalid input falls back to 1. */
+export function clampPixelRatio(dpr) {
+    const value = typeof dpr === 'number' && Number.isFinite(dpr) && dpr > 0 ? dpr : 1;
+    return Math.min(value, 2);
+}

package/dist/helper/sanitize-html.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Sanitise an untrusted HTML string with DOMPurify. Returns '' when no DOM is
+ * available (SSR) so unsanitised HTML can never reach the page. See spec §5.9.
+ */
+export declare function sanitizeHtml(dirty: string): string;

package/dist/helper/sanitize-html.js

@@ -0,0 +1,12 @@
+import DOMPurify from 'dompurify';
+/**
+ * Sanitise an untrusted HTML string with DOMPurify. Returns '' when no DOM is
+ * available (SSR) so unsanitised HTML can never reach the page. See spec §5.9.
+ */
+export function sanitizeHtml(dirty) {
+    if (typeof dirty !== 'string')
+        return '';
+    if (typeof window === 'undefined')
+        return '';
+    return DOMPurify.sanitize(dirty);
+}

package/dist/index.d.ts

@@ -47,6 +47,9 @@ export type { SpinnerProps } from './elements/spinner/spinner-types.js';
 export type { SkeletonProps, SkeletonVariant } from './elements/skeleton/skeleton-types.js';
 export type { EmptyStateProps, EmptyStateSize } from './elements/empty-state/empty-state-types.js';
 export type { PdfViewerProps } from './elements/pdf-viewer/pdf-viewer-types.js';
+export type { FileViewerProps, FileKindValue } from './elements/file-viewer/file-viewer-types.js';
+export { FileKind, fileKindFromMime, fileKindFromFileName } from './elements/file-viewer/file-viewer-types.js';
+export type { FilePreviewModalProps } from './elements/file-viewer/file-preview-modal-types.js';
 export type { TooltipProps, TooltipPlacement, TooltipSize, TooltipVariant } from './elements/tooltip/tooltip-types.js';
 export type { PopoverProps, PopoverPlacement, PopoverTrigger } from './elements/popover/popover-types.js';
 export type { CalendarProps, CalendarMode } from './forms/calendar/calendar-types.js';
@@ -65,6 +68,10 @@ export type { ChatMessageType, StreamingCallback, ChatAction, ChatMessage, ChatR
 export type { GetUsersOptions, GetUsersResult, UserEmail, UserPhone, User, Permission, Role, UserTableProps, UserModalProps, UserModalSavePayload, UserViewModalProps, UserApproveModalProps, UserManagementAdapter, UserManagementProps, FormErrors } from './user-management/user-management-types.js';
 export { tv, cn } from './helper/cls.js';
 export { isRouteActive } from './helper/nav.svelte.js';
+export * from './helper/resource-limits.js';
+export * from './helper/is-safe-http-url.js';
+export * from './helper/pdf-safety.js';
+export * from './helper/sanitize-html.js';
 export { default as Button } from './button/Button.svelte';
 export { default as Modal } from './modal/Modal.svelte';
 export { default as ConfirmDialog } from './modal/ConfirmDialog.svelte';
@@ -101,6 +108,8 @@ export { spinner as spinnerVariants } from './elements/spinner/spinner.js';
 export { default as EmptyState } from './elements/empty-state/EmptyState.svelte';
 export { emptyState as emptyStateVariants } from './elements/empty-state/empty-state.js';
 export { default as PdfViewer } from './elements/pdf-viewer/PdfViewer.svelte';
+export { default as FileViewer } from './elements/file-viewer/FileViewer.svelte';
+export { default as FilePreviewModal } from './elements/file-viewer/FilePreviewModal.svelte';
 export { default as Tooltip } from './elements/tooltip/Tooltip.svelte';
 export { default as Popover } from './elements/popover/Popover.svelte';
 export { default as ComboBox } from './elements/combobox/ComboBox.svelte';

package/dist/index.js

@@ -12,12 +12,17 @@ export { buildTestId } from './helper/testid.js';
 export { ALL_COUNTRY_CODES, COUNTRY_NAMES } from './forms/market/country-data.js';
 export { Market } from './forms/market/market.js';
 export { countryCodeToFlagEmoji } from './forms/market/flag-emoji.js';
+export { FileKind, fileKindFromMime, fileKindFromFileName } from './elements/file-viewer/file-viewer-types.js';
 export { defaultDatePresets, toIsoDate, fromIsoDate } from './filters/date-presets.js';
 // ============================================================================
 // Helper utilities
 // ============================================================================
 export { tv, cn } from './helper/cls.js';
 export { isRouteActive } from './helper/nav.svelte.js';
+export * from './helper/resource-limits.js';
+export * from './helper/is-safe-http-url.js';
+export * from './helper/pdf-safety.js';
+export * from './helper/sanitize-html.js';
 // ============================================================================
 // Direct Component Exports
 // ============================================================================
@@ -78,6 +83,9 @@ export { default as EmptyState } from './elements/empty-state/EmptyState.svelte'
 export { emptyState as emptyStateVariants } from './elements/empty-state/empty-state.js';
 // Elements - PdfViewer
 export { default as PdfViewer } from './elements/pdf-viewer/PdfViewer.svelte';
+// Elements - File viewers
+export { default as FileViewer } from './elements/file-viewer/FileViewer.svelte';
+export { default as FilePreviewModal } from './elements/file-viewer/FilePreviewModal.svelte';
 // Elements - Tooltip
 export { default as Tooltip } from './elements/tooltip/Tooltip.svelte';
 // Elements - Popover

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@makolabs/ripple",
-	"version": "3.8.0",
+	"version": "3.9.1",
 	"description": "Simple Svelte 5 powered component library ✨",
 	"license": "SEE LICENSE IN LICENSE",
 	"repository": {
@@ -55,7 +55,7 @@
 	},
 	"peerDependencies": {
 		"@sveltejs/kit": "^2.0.0",
-		"pdfjs-dist": "^4.0.0 || ^5.0.0",
+		"pdfjs-dist": "^4.2.67 || ^5.0.0",
 		"svelte": "^5.0.0 || ^6.0.0"
 	},
 	"peerDependenciesMeta": {
@@ -79,6 +79,7 @@
 		"@testing-library/jest-dom": "^6.9.1",
 		"@testing-library/svelte": "^5.2.4",
 		"@types/node": "^22.19.1",
+		"@vitest/coverage-v8": "^4.1.9",
 		"eslint": "^9.39.1",
 		"eslint-config-prettier": "^10.0.1",
 		"eslint-plugin-storybook": "^10.0.7",
@@ -147,6 +148,7 @@
 		"@aws-sdk/s3-request-presigner": "^3.1029.0",
 		"@friendofsvelte/mermaid": "^0.0.4",
 		"dayjs": "^1.11.19",
+		"dompurify": "^3.4.11",
 		"echarts": "^6.0.0",
 		"marked": "^17.0.0",
 		"svelte-highlight": "^7.9.0",