@neo4j-antora/mark-terms 1.1.2 → 1.1.3

package/mark-terms.js

@@ -5,50 +5,56 @@ module.exports = function (registry) {
 
       if (!doc.getAttribute('page-terms-to-mark')) return
 
-      let terms = doc.getAttribute('page-terms-to-mark').split(',').map(function (value) {
-          return value.trim();
-        })
 
-      if (!terms) return
+      // escape special characters in the term to mark before using
+      function escapeRegExp(str) {
+        let escapedStr = str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); // $& means the whole matched string
+        return escapedStr
+      }
 
-      let markTitles = doc.getAttribute('page-terms-mark-titles')? true : false
-      let devMode = doc.getAttribute('page-terms-dev-mode')
-      
-      let marker = doc.getAttribute('page-terms-marker') || '®'
+      // test terms against regexp attacks
+      // let terms = doc.getAttribute('page-terms-to-mark')
+      let terms = doc.getAttribute('page-terms-to-mark')
+      if (!/^[\w\s-,]+?$/.test(terms)) {
+        doc.getLogger().error(`mark-terms: invalid terms "${terms}"`)
+        return
+      }
+
+      const safeTerms = terms.split(',').map(function (value) {
+          return escapeRegExp(value.trim());
+        })
+
+      if (!safeTerms) return
 
       // test marker
       // marker must be a string that starts with & ends with ;
+      let marker = doc.getAttribute('page-terms-marker') || '®'
       if (!/^&[\w\s-]+?;$/.test(marker)) {
-        doc.getLogger().error(`mark-terms: invalid marker "${marker}"`)
+        doc.getLogger().error(`(mark-terms) marker '${marker}' is not an HTML entity`)
         return
       }
 
+      let markTitles = doc.getAttribute('page-terms-mark-titles')? true : false
+      let devMode = doc.getAttribute('page-terms-dev-mode')
+
+      const safeMarker = escapeRegExp(marker)
+
       let markAdded = []
       
-      terms.forEach(term => {
+      safeTerms.forEach(safeTerm => {
 
-        // test term
+        // test safeTerm
         // let's reject it if it contains anything other than word characters, spaces, numbers, or hyphens
-        if (!/^[\w\s-]+$/.test(term)) {
-          doc.getLogger().error(`mark-terms: invalid term "${term}"`)
+        if (!/^[\w\s-]+$/.test(safeTerm)) {
+          doc.getLogger().error(`(mark-terms): term '${safeTerm}' is not valid. Terms must only contain letters, numbers, spaces, or hyphens.`)
           return
         }
 
-        // escape special characters in the term to mark before using in regexp
-        function escapeRegExp(str) {
-          let escapedStr = str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); // $& means the whole matched string
-          return escapedStr
-        }
-
-        let re = new RegExp(`(^|\\[|\\s)${escapeRegExp(term)}\\b`)
-
-        let reMarked = new RegExp(`${escapeRegExp(term)} ${escapeRegExp(marker)}`)
-
         doc.findBy().forEach(block => {
 
           // if we've already marked ths, don't mark it again
           // unless testing in dev mode
-          if ( markAdded.includes(term) && !devMode) return
+          if ( markAdded.includes(safeTerm) && !devMode) return
 
           // lists
           if (block.getContext() === 'olist' || block.getContext() === 'ulist') {
@@ -82,7 +88,7 @@ module.exports = function (registry) {
 
           // test each line
           block.lines.forEach((line, i) => {
-            let reggedLine = testLine(line)
+            let reggedLine = testLine(line, i)
             block.lines[i] = reggedLine
           })
 
@@ -90,20 +96,21 @@ module.exports = function (registry) {
 
         // test a line of content from a block or a table cell
         function testLine(line) {
+
+          const safelyMarkedTerm = safeTerm + safeMarker
         
           // return if we've already marked this term
-          if (markAdded.includes(term) && !devMode) return line
+          if (markAdded.includes(safeTerm) && !devMode) return line
 
-          // return if this term is already marked
-          if (reMarked.test(line)) {
-              markAdded.push(term)
-              return line
+          if (line.includes(safelyMarkedTerm)) {
+            markAdded.push(safeTerm)
+            return line
           }
 
           // mark the first instance of the term if we find a match
-          if (re.test(line)) {
-              markAdded.push(term)
-              return line.replace(re, '$1' + term + marker)
+          if (line.includes(safeTerm)) {
+            doc.getLogger().info(`(mark-terms) marked '${safeTerm}'`)
+            return line.replace(safeTerm, safelyMarkedTerm)
           }
 
           // we checked but there was no match

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@neo4j-antora/mark-terms",
-    "version": "1.1.2",
+    "version": "1.1.3",
     "description": "Asciidoc extension to mark the first instance of a term on a page, typically with a copyright symbol",
     "main": "mark-terms.js",
     "scripts": {