@medialane/ui 0.4.2 → 0.4.3

package/dist/utils/ipfs.cjs

@@ -22,11 +22,18 @@ __export(ipfs_exports, {
 });
 module.exports = __toCommonJS(ipfs_exports);
 const DEFAULT_GATEWAY = "https://ipfs.io/ipfs/";
+const ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:", "ipfs:"]);
 function ipfsToHttp(uri, gateway = DEFAULT_GATEWAY) {
   if (!uri) return "";
   if (uri.startsWith("ipfs://")) {
     return uri.replace("ipfs://", gateway);
   }
+  try {
+    const { protocol } = new URL(uri);
+    if (!ALLOWED_PROTOCOLS.has(protocol)) return "";
+  } catch {
+    return "";
+  }
   return uri;
 }
 // Annotate the CommonJS export names for ESM import in node:

package/dist/utils/ipfs.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/ipfs.ts"],"sourcesContent":["const DEFAULT_GATEWAY = \"https://ipfs.io/ipfs/\";\n\n/**\n * Convert an IPFS URI to an HTTP URL.\n * Accepts ipfs://<cid>, ipfs://<cid>/<path>, or plain HTTP URLs (returned as-is).\n *\n * @param uri - The IPFS URI or HTTP URL to convert.\n * @param gateway - Gateway base URL (default: ipfs.io). Should end without a trailing slash.\n */\nexport function ipfsToHttp(\n  uri: string | null | undefined,\n  gateway = DEFAULT_GATEWAY\n): string {\n  if (!uri) return \"\";\n  if (uri.startsWith(\"ipfs://\")) {\n    return uri.replace(\"ipfs://\", gateway);\n  }\n  return uri;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAAM,kBAAkB;AASjB,SAAS,WACd,KACA,UAAU,iBACF;AACR,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,IAAI,WAAW,SAAS,GAAG;AAC7B,WAAO,IAAI,QAAQ,WAAW,OAAO;AAAA,EACvC;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/utils/ipfs.ts"],"sourcesContent":["const DEFAULT_GATEWAY = \"https://ipfs.io/ipfs/\";\n\nconst ALLOWED_PROTOCOLS = new Set([\"http:\", \"https:\", \"ipfs:\"]);\n\n/**\n * Convert an IPFS URI to an HTTP URL.\n * Accepts ipfs://<cid>, ipfs://<cid>/<path>, or plain HTTP/HTTPS URLs.\n * Rejects javascript:, data:, blob:, and any other non-allowlisted protocols.\n *\n * @param uri - The IPFS URI or HTTP URL to convert.\n * @param gateway - Gateway base URL (default: ipfs.io). Should end without a trailing slash.\n */\nexport function ipfsToHttp(\n  uri: string | null | undefined,\n  gateway = DEFAULT_GATEWAY\n): string {\n  if (!uri) return \"\";\n  if (uri.startsWith(\"ipfs://\")) {\n    return uri.replace(\"ipfs://\", gateway);\n  }\n  try {\n    const { protocol } = new URL(uri);\n    if (!ALLOWED_PROTOCOLS.has(protocol)) return \"\";\n  } catch {\n    return \"\";\n  }\n  return uri;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAAM,kBAAkB;AAExB,MAAM,oBAAoB,oBAAI,IAAI,CAAC,SAAS,UAAU,OAAO,CAAC;AAUvD,SAAS,WACd,KACA,UAAU,iBACF;AACR,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,IAAI,WAAW,SAAS,GAAG;AAC7B,WAAO,IAAI,QAAQ,WAAW,OAAO;AAAA,EACvC;AACA,MAAI;AACF,UAAM,EAAE,SAAS,IAAI,IAAI,IAAI,GAAG;AAChC,QAAI,CAAC,kBAAkB,IAAI,QAAQ,EAAG,QAAO;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AACT;","names":[]}

package/dist/utils/ipfs.d.cts

@@ -1,6 +1,7 @@
 /**
  * Convert an IPFS URI to an HTTP URL.
- * Accepts ipfs://<cid>, ipfs://<cid>/<path>, or plain HTTP URLs (returned as-is).
+ * Accepts ipfs://<cid>, ipfs://<cid>/<path>, or plain HTTP/HTTPS URLs.
+ * Rejects javascript:, data:, blob:, and any other non-allowlisted protocols.
  *
  * @param uri - The IPFS URI or HTTP URL to convert.
  * @param gateway - Gateway base URL (default: ipfs.io). Should end without a trailing slash.

package/dist/utils/ipfs.d.ts

@@ -1,6 +1,7 @@
 /**
  * Convert an IPFS URI to an HTTP URL.
- * Accepts ipfs://<cid>, ipfs://<cid>/<path>, or plain HTTP URLs (returned as-is).
+ * Accepts ipfs://<cid>, ipfs://<cid>/<path>, or plain HTTP/HTTPS URLs.
+ * Rejects javascript:, data:, blob:, and any other non-allowlisted protocols.
  *
  * @param uri - The IPFS URI or HTTP URL to convert.
  * @param gateway - Gateway base URL (default: ipfs.io). Should end without a trailing slash.

package/dist/utils/ipfs.js

@@ -1,9 +1,16 @@
 const DEFAULT_GATEWAY = "https://ipfs.io/ipfs/";
+const ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:", "ipfs:"]);
 function ipfsToHttp(uri, gateway = DEFAULT_GATEWAY) {
   if (!uri) return "";
   if (uri.startsWith("ipfs://")) {
     return uri.replace("ipfs://", gateway);
   }
+  try {
+    const { protocol } = new URL(uri);
+    if (!ALLOWED_PROTOCOLS.has(protocol)) return "";
+  } catch {
+    return "";
+  }
   return uri;
 }
 export {

package/dist/utils/ipfs.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/ipfs.ts"],"sourcesContent":["const DEFAULT_GATEWAY = \"https://ipfs.io/ipfs/\";\n\n/**\n * Convert an IPFS URI to an HTTP URL.\n * Accepts ipfs://<cid>, ipfs://<cid>/<path>, or plain HTTP URLs (returned as-is).\n *\n * @param uri - The IPFS URI or HTTP URL to convert.\n * @param gateway - Gateway base URL (default: ipfs.io). Should end without a trailing slash.\n */\nexport function ipfsToHttp(\n  uri: string | null | undefined,\n  gateway = DEFAULT_GATEWAY\n): string {\n  if (!uri) return \"\";\n  if (uri.startsWith(\"ipfs://\")) {\n    return uri.replace(\"ipfs://\", gateway);\n  }\n  return uri;\n}\n"],"mappings":"AAAA,MAAM,kBAAkB;AASjB,SAAS,WACd,KACA,UAAU,iBACF;AACR,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,IAAI,WAAW,SAAS,GAAG;AAC7B,WAAO,IAAI,QAAQ,WAAW,OAAO;AAAA,EACvC;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/utils/ipfs.ts"],"sourcesContent":["const DEFAULT_GATEWAY = \"https://ipfs.io/ipfs/\";\n\nconst ALLOWED_PROTOCOLS = new Set([\"http:\", \"https:\", \"ipfs:\"]);\n\n/**\n * Convert an IPFS URI to an HTTP URL.\n * Accepts ipfs://<cid>, ipfs://<cid>/<path>, or plain HTTP/HTTPS URLs.\n * Rejects javascript:, data:, blob:, and any other non-allowlisted protocols.\n *\n * @param uri - The IPFS URI or HTTP URL to convert.\n * @param gateway - Gateway base URL (default: ipfs.io). Should end without a trailing slash.\n */\nexport function ipfsToHttp(\n  uri: string | null | undefined,\n  gateway = DEFAULT_GATEWAY\n): string {\n  if (!uri) return \"\";\n  if (uri.startsWith(\"ipfs://\")) {\n    return uri.replace(\"ipfs://\", gateway);\n  }\n  try {\n    const { protocol } = new URL(uri);\n    if (!ALLOWED_PROTOCOLS.has(protocol)) return \"\";\n  } catch {\n    return \"\";\n  }\n  return uri;\n}\n"],"mappings":"AAAA,MAAM,kBAAkB;AAExB,MAAM,oBAAoB,oBAAI,IAAI,CAAC,SAAS,UAAU,OAAO,CAAC;AAUvD,SAAS,WACd,KACA,UAAU,iBACF;AACR,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,IAAI,WAAW,SAAS,GAAG;AAC7B,WAAO,IAAI,QAAQ,WAAW,OAAO;AAAA,EACvC;AACA,MAAI;AACF,UAAM,EAAE,SAAS,IAAI,IAAI,IAAI,GAAG;AAChC,QAAI,CAAC,kBAAkB,IAAI,QAAQ,EAAG,QAAO;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AACT;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@medialane/ui",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "Shared UI components for Medialane apps",
   "type": "module",
   "main": "./dist/index.cjs",