@mintlify/common 1.0.1136 → 1.0.1138

package/dist/mdx/plugins/remark/remarkMdxRemoveJs.d.ts

@@ -3,4 +3,8 @@ import type { Root } from 'mdast';
 export declare function isStringSafe(value: string): boolean;
 export declare function filterStyleProperties(estree: Program): Program | null;
 export declare function rebuildStyleValue(properties: Property[]): string;
+export declare const MAX_PURE_DATA_DEPTH = 32;
+export declare function isPureDataExpression(value: unknown, depth?: number): boolean;
+export declare function isPureDataProgram(estree: Program): boolean;
+export declare function isUnsafeDataAttributeName(name: string): boolean;
 export declare function remarkMdxRemoveJs(): (tree: Root) => void;

package/dist/mdx/plugins/remark/remarkMdxRemoveJs.js

@@ -211,6 +211,76 @@ export function rebuildStyleValue(properties) {
     });
     return `{ ${parts.join(', ')} }`;
 }
+function isJsxLikeNode(value) {
+    return (typeof value === 'object' && value !== null && 'type' in value && typeof value.type === 'string');
+}
+const UNSAFE_OBJECT_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+export const MAX_PURE_DATA_DEPTH = 32;
+function isPureDataLiteral(node) {
+    if (node.type !== 'Literal' || 'regex' in node || 'bigint' in node)
+        return false;
+    const value = node.value;
+    return (value === null ||
+        typeof value === 'string' ||
+        typeof value === 'number' ||
+        typeof value === 'boolean');
+}
+function pureDataObjectKey(node) {
+    if (!isJsxLikeNode(node))
+        return null;
+    if (node.type === 'Identifier' && typeof node.name === 'string')
+        return node.name;
+    if (node.type === 'Literal' && (typeof node.value === 'string' || typeof node.value === 'number'))
+        return String(node.value);
+    return null;
+}
+function isPureDataProperty(value, depth) {
+    if (!isJsxLikeNode(value) || value.type !== 'Property')
+        return false;
+    if (value.kind !== 'init' ||
+        value.method === true ||
+        value.computed === true ||
+        value.shorthand === true)
+        return false;
+    const key = pureDataObjectKey(value.key);
+    if (key === null || UNSAFE_OBJECT_KEYS.has(key))
+        return false;
+    return isPureDataExpression(value.value, depth);
+}
+export function isPureDataExpression(value, depth = 0) {
+    if (!isJsxLikeNode(value))
+        return false;
+    if (isPureDataLiteral(value))
+        return true;
+    if (value.type === 'UnaryExpression') {
+        return (value.operator === '-' &&
+            isJsxLikeNode(value.argument) &&
+            value.argument.type === 'Literal' &&
+            typeof value.argument.value === 'number');
+    }
+    if (value.type === 'TemplateLiteral') {
+        return (Array.isArray(value.expressions) &&
+            value.expressions.length === 0 &&
+            Array.isArray(value.quasis));
+    }
+    if (depth >= MAX_PURE_DATA_DEPTH)
+        return false;
+    if (value.type === 'ArrayExpression') {
+        return (Array.isArray(value.elements) &&
+            value.elements.every((element) => isPureDataExpression(element, depth + 1)));
+    }
+    if (value.type === 'ObjectExpression') {
+        return (Array.isArray(value.properties) &&
+            value.properties.every((property) => isPureDataProperty(property, depth + 1)));
+    }
+    return false;
+}
+export function isPureDataProgram(estree) {
+    const stmt = estree.body[0];
+    if (estree.body.length !== 1 || (stmt === null || stmt === void 0 ? void 0 : stmt.type) !== 'ExpressionStatement')
+        return false;
+    return isPureDataExpression(stmt.expression);
+}
 function isPrimitiveLiteralExpression(node) {
     if (node.type === 'Literal')
         return true;
@@ -230,9 +300,7 @@ function isSafeJsxAttributeValue(value) {
         return true;
     if (node.type !== 'JSXExpressionContainer')
         return false;
-    if (typeof node.expression !== 'object' || node.expression == null)
-        return false;
-    return isPrimitiveLiteralExpression(node.expression);
+    return isPureDataExpression(node.expression);
 }
 const DANGEROUS_ELEMENT_NAMES = new Set(['script', 'style', 'iframe', 'meta']);
 function isSafeJsxElementName(name) {
@@ -246,6 +314,9 @@ function isSafeJsxElementName(name) {
         return false;
     return !DANGEROUS_ELEMENT_NAMES.has(elementName.toLowerCase());
 }
+export function isUnsafeDataAttributeName(name) {
+    return name === 'dangerouslySetInnerHTML' || /^on[A-Z]/.test(name);
+}
 function isEventHandlerAttribute(attributeNode) {
     const name = attributeNode.name;
     if (typeof name !== 'object' || name == null)
@@ -253,7 +324,7 @@ function isEventHandlerAttribute(attributeNode) {
     const nameNode = name;
     if (typeof nameNode.name !== 'string')
         return false;
-    return /^on[A-Z]/.test(nameNode.name);
+    return isUnsafeDataAttributeName(nameNode.name);
 }
 function isSafeStaticJsxNode(node) {
     if (node.type === 'JSXText')
@@ -463,14 +534,6 @@ function buildStubEsmNode(names) {
         },
     };
 }
-function isArrayOfStringLiterals(estree) {
-    const stmt = estree.body[0];
-    if (estree.body.length !== 1 || (stmt === null || stmt === void 0 ? void 0 : stmt.type) !== 'ExpressionStatement')
-        return false;
-    if (stmt.expression.type !== 'ArrayExpression')
-        return false;
-    return stmt.expression.elements.every((el) => (el === null || el === void 0 ? void 0 : el.type) === 'Literal' && typeof el.value === 'string');
-}
 export function remarkMdxRemoveJs() {
     return (tree) => {
         remove(tree, ['mdxTextExpression', 'mdxFlowExpression']);
@@ -505,7 +568,9 @@ export function remarkMdxRemoveJs() {
                             stubbedNamesMap.set(ident, { name: ident, isFunction: false });
                         return attr;
                     }
-                    if (((_b = attr.value.data) === null || _b === void 0 ? void 0 : _b.estree) && isArrayOfStringLiterals(attr.value.data.estree))
+                    if (!isUnsafeDataAttributeName(attr.name) &&
+                        ((_b = attr.value.data) === null || _b === void 0 ? void 0 : _b.estree) &&
+                        isPureDataProgram(attr.value.data.estree))
                         return attr;
                     if (isSafeStaticJsx((_c = attr.value.data) === null || _c === void 0 ? void 0 : _c.estree))
                         return attr;