@ng-prism/core 22.1.2 → 22.1.4

package/dist/app/renderer/prism-renderer.component.js

@@ -301,6 +301,10 @@ export class PrismRendererComponent {
                         read: ViewContainerRef,
                     }, isSignal: true }] }] }); })();
 (() => { (typeof ngDevMode === "undefined" || ngDevMode) && i0.ɵsetClassDebugInfo(PrismRendererComponent, { className: "PrismRendererComponent", filePath: "app/renderer/prism-renderer.component.ts", lineNumber: 180 }); })();
+// SAFETY: `content` originates from `@Showcase({ variants: [{ content }] })`
+// in developer-authored source code. It is trusted by ng-prism's threat model
+// (see SECURITY.md). Sanitization would strip the Angular component/directive
+// selectors that variant content is meant to project.
 function parseContentToNodes(content) {
     if (typeof content === 'string') {
         return [htmlToNodes(content)];
@@ -313,10 +317,12 @@ function parseContentToNodes(content) {
         if (selector === 'default')
             continue;
         const wrapper = document.createElement('div');
+        // SAFETY: trusted developer-authored HTML — see SECURITY.md.
         wrapper.innerHTML = html;
         const nodes = [];
         for (const child of Array.from(wrapper.childNodes)) {
             const el = document.createElement('div');
+            // SAFETY: trusted developer-authored HTML — see SECURITY.md.
             el.innerHTML = child.outerHTML ?? child.textContent ?? '';
             const projected = el.firstChild;
             if (projected && projected instanceof Element) {
@@ -334,6 +340,8 @@ function parseContentToNodes(content) {
     }
     return result;
 }
+// SAFETY: see `parseContentToNodes` above and SECURITY.md — `html` is trusted
+// developer-authored variant content from the `@Showcase` decorator.
 function htmlToNodes(html) {
     const wrapper = document.createElement('div');
     wrapper.innerHTML = html;

package/dist/app/renderer/snippet-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"snippet-generator.d.ts","sourceRoot":"","sources":["../../../src/app/renderer/snippet-generator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAEvE,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC;CAC/B;AAwBD,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,SAAS,EAAE,EACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACzC,gBAAgB,CAAC,EAAE,uBAAuB,GACzC,MAAM,CAmER"}
+{"version":3,"file":"snippet-generator.d.ts","sourceRoot":"","sources":["../../../src/app/renderer/snippet-generator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAEvE,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC;CAC/B;AAwBD,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,SAAS,EAAE,EACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACzC,gBAAgB,CAAC,EAAE,uBAAuB,GACzC,MAAM,CA0ER"}

package/dist/app/renderer/snippet-generator.js

@@ -6,7 +6,7 @@ function pushAttribute(attributes, name, value) {
         attributes.push(`${name}="${escapeAttrValue(value)}"`);
     }
     else if (typeof value === 'boolean') {
-        attributes.push(`[${name}]="true"`);
+        attributes.push(`[${name}]="${value}"`);
     }
     else if (typeof value === 'number') {
         attributes.push(`[${name}]="${value}"`);
@@ -29,12 +29,16 @@ export function generateSnippet(selector, inputs, values, explicitKeys, content,
         const value = values[input.name];
         if (value === undefined)
             continue;
-        if (typeof value === 'boolean' && !value)
-            continue;
         if (input.defaultValue !== undefined &&
             value === input.defaultValue &&
             !explicitKeys?.has(input.name))
             continue;
+        // Only a guess, and only sound when no default is known: a boolean input
+        // that defaults to `true` has to show its explicit `false`.
+        if (input.defaultValue === undefined &&
+            typeof value === 'boolean' &&
+            !value)
+            continue;
         pushAttribute(attributes, input.name, value);
     }
     for (const [name, value] of Object.entries(values)) {
@@ -108,12 +112,16 @@ function generateDirectiveSnippet(selector, inputs, values, explicitKeys, conten
         const value = values[input.name];
         if (value === undefined)
             continue;
-        if (typeof value === 'boolean' && !value)
-            continue;
         if (input.defaultValue !== undefined &&
             value === input.defaultValue &&
             !explicitKeys?.has(input.name))
             continue;
+        // Only a guess, and only sound when no default is known: a boolean input
+        // that defaults to `true` has to show its explicit `false`.
+        if (input.defaultValue === undefined &&
+            typeof value === 'boolean' &&
+            !value)
+            continue;
         pushAttribute(attributes, input.name, value);
     }
     for (const [name, value] of Object.entries(values)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ng-prism/core",
-  "version": "22.1.2",
+  "version": "22.1.4",
   "description": "ng-prism — the Angular-native Storybook alternative. Lightweight component showcase with @Showcase decorator, no story files needed.",
   "keywords": [
     "ng-prism",