@nocobase/utils 2.3.0-beta.2 → 2.3.0-beta.20

package/lib/client.d.ts

@@ -29,6 +29,7 @@ export * from './ses';
 export * from './i18n';
 export * from './isPortalInBody';
 export * from './parseHTML';
+export * from './sanitize-rich-text-html';
 export * from './uid';
 export * from './url';
 export * from './transformMultiColumnToSingleColumn';

package/lib/client.js

@@ -67,6 +67,7 @@ __reExport(client_exports, require("./ses"), module.exports);
 __reExport(client_exports, require("./i18n"), module.exports);
 __reExport(client_exports, require("./isPortalInBody"), module.exports);
 __reExport(client_exports, require("./parseHTML"), module.exports);
+__reExport(client_exports, require("./sanitize-rich-text-html"), module.exports);
 __reExport(client_exports, require("./uid"), module.exports);
 __reExport(client_exports, require("./url"), module.exports);
 __reExport(client_exports, require("./transformMultiColumnToSingleColumn"), module.exports);
@@ -100,6 +101,7 @@ __reExport(client_exports, require("./liquidjs"), module.exports);
   ...require("./i18n"),
   ...require("./isPortalInBody"),
   ...require("./parseHTML"),
+  ...require("./sanitize-rich-text-html"),
   ...require("./uid"),
   ...require("./url"),
   ...require("./transformMultiColumnToSingleColumn"),

package/lib/index.d.ts

@@ -46,6 +46,7 @@ export * from './url';
 export * from './variable-usage';
 export * from './wrap-middleware';
 export * from './run-sql';
+export * from './sanitize-rich-text-html';
 export * from './liquidjs';
 export * from './server-request';
 export * from './storage-path';

package/lib/index.js

@@ -82,6 +82,7 @@ __reExport(src_exports, require("./url"), module.exports);
 __reExport(src_exports, require("./variable-usage"), module.exports);
 __reExport(src_exports, require("./wrap-middleware"), module.exports);
 __reExport(src_exports, require("./run-sql"), module.exports);
+__reExport(src_exports, require("./sanitize-rich-text-html"), module.exports);
 __reExport(src_exports, require("./liquidjs"), module.exports);
 __reExport(src_exports, require("./server-request"), module.exports);
 __reExport(src_exports, require("./storage-path"), module.exports);
@@ -127,6 +128,7 @@ __reExport(src_exports, require("./storage-path"), module.exports);
   ...require("./variable-usage"),
   ...require("./wrap-middleware"),
   ...require("./run-sql"),
+  ...require("./sanitize-rich-text-html"),
   ...require("./liquidjs"),
   ...require("./server-request"),
   ...require("./storage-path")

package/lib/sanitize-rich-text-html.d.ts

@@ -0,0 +1,9 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+export declare function sanitizeRichTextHtml(value: string): any;

package/lib/sanitize-rich-text-html.js

@@ -0,0 +1,145 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var sanitize_rich_text_html_exports = {};
+__export(sanitize_rich_text_html_exports, {
+  sanitizeRichTextHtml: () => sanitizeRichTextHtml
+});
+module.exports = __toCommonJS(sanitize_rich_text_html_exports);
+var import_sanitize_html = __toESM(require("sanitize-html"));
+const imageDataUrlPattern = /^data:image\/(?:gif|jpe?g|png|webp);base64,[a-z\d+/=\s]+$/i;
+const dimensionPattern = /^(?:\d{1,4}(?:\.\d+)?(?:px)?|(?:100|[1-9]?\d)(?:\.\d+)?%)$/;
+const imageStyleDimensionPattern = /^(?:\d{1,4}(?:\.\d+)?px|(?:100|[1-9]?\d)(?:\.\d+)?%)$/;
+function sanitizeLinkAttributes(attribs) {
+  const nextAttributes = { ...attribs };
+  if (nextAttributes.target && !["_blank", "_self"].includes(nextAttributes.target)) {
+    delete nextAttributes.target;
+  }
+  if (nextAttributes.target === "_blank") {
+    nextAttributes.rel = "noopener noreferrer";
+  } else {
+    delete nextAttributes.rel;
+  }
+  return nextAttributes;
+}
+__name(sanitizeLinkAttributes, "sanitizeLinkAttributes");
+function sanitizeImageAttributes(attribs) {
+  var _a;
+  const nextAttributes = { ...attribs };
+  if (((_a = nextAttributes.src) == null ? void 0 : _a.trim().toLowerCase().startsWith("data:")) && !imageDataUrlPattern.test(nextAttributes.src)) {
+    delete nextAttributes.src;
+  }
+  for (const dimension of ["width", "height"]) {
+    if (nextAttributes[dimension] && !dimensionPattern.test(nextAttributes[dimension])) {
+      delete nextAttributes[dimension];
+    }
+  }
+  return nextAttributes;
+}
+__name(sanitizeImageAttributes, "sanitizeImageAttributes");
+const richTextSanitizeOptions = {
+  allowedTags: [
+    "a",
+    "b",
+    "blockquote",
+    "br",
+    "em",
+    "h1",
+    "h2",
+    "h3",
+    "h4",
+    "h5",
+    "h6",
+    "i",
+    "img",
+    "li",
+    "ol",
+    "p",
+    "s",
+    "span",
+    "strike",
+    "strong",
+    "u",
+    "ul"
+  ],
+  allowedAttributes: {
+    a: ["href", "target", "rel"],
+    img: ["src", "alt", "title", "width", "height", "style"],
+    span: ["style"]
+  },
+  allowedClasses: {
+    blockquote: [/^ql-indent-[1-9]$/],
+    h1: [/^ql-indent-[1-9]$/],
+    h2: [/^ql-indent-[1-9]$/],
+    h3: [/^ql-indent-[1-9]$/],
+    h4: [/^ql-indent-[1-9]$/],
+    h5: [/^ql-indent-[1-9]$/],
+    h6: [/^ql-indent-[1-9]$/],
+    li: [/^ql-indent-[1-9]$/],
+    p: [/^ql-indent-[1-9]$/]
+  },
+  allowedStyles: {
+    img: {
+      height: [imageStyleDimensionPattern],
+      width: [imageStyleDimensionPattern]
+    },
+    span: {
+      "font-size": [/^(?:12|14|16|18|20|24|32|48)px$/]
+    }
+  },
+  allowedSchemes: ["http", "https", "mailto", "tel"],
+  allowedSchemesByTag: {
+    img: ["http", "https", "data"]
+  },
+  allowProtocolRelative: false,
+  transformTags: {
+    a(tagName, attribs) {
+      return { tagName, attribs: sanitizeLinkAttributes(attribs) };
+    },
+    img(tagName, attribs) {
+      return { tagName, attribs: sanitizeImageAttributes(attribs) };
+    }
+  }
+};
+function sanitizeRichTextHtml(value) {
+  return (0, import_sanitize_html.default)(value, richTextSanitizeOptions);
+}
+__name(sanitizeRichTextHtml, "sanitizeRichTextHtml");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  sanitizeRichTextHtml
+});

package/lib/server-request.d.ts

@@ -18,6 +18,7 @@ export declare function matchesDomainPattern(hostname: string, pattern: string):
  *
  * Throws an error if:
  *   - The URL scheme is not http or https.
+ *   - SERVER_REQUEST_DISALLOW_IP is true and the host is a literal IP address.
  *   - SERVER_REQUEST_WHITELIST is set and the host does not match any entry.
  *
  * Silently returns for relative URLs (no scheme) so that internal API calls

package/lib/server-request.js

@@ -189,13 +189,19 @@ function checkUrlAgainstWhitelist(url) {
     );
   }
   const host = getNormalizedHost(parsed);
+  if (process.env.SERVER_REQUEST_DISALLOW_IP === "true" && import_ipaddr.default.isValid(host)) {
+    throw new Error(`Outbound request to "${host}" is blocked because SERVER_REQUEST_DISALLOW_IP is enabled.`);
+  }
   const whitelist = process.env.SERVER_REQUEST_WHITELIST;
   if (!whitelist || !whitelist.trim()) {
     warnIfSsrfRiskTarget(host);
     return;
   }
   const entries = whitelist.split(",").map((e) => e.trim()).filter(Boolean);
-  if (entries.length === 0) return;
+  if (entries.length === 0) {
+    warnIfSsrfRiskTarget(host);
+    return;
+  }
   for (const entry of entries) {
     if (matchesEntry(host, entry)) return;
   }

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@nocobase/utils",
-  "version": "2.3.0-beta.2",
+  "version": "2.3.0-beta.20",
   "main": "lib/index.js",
   "types": "./lib/index.d.ts",
   "license": "Apache-2.0",
   "dependencies": {
-    "@budibase/handlebars-helpers": "0.14.0",
+    "@budibase/handlebars-helpers": "0.14.3",
     "@hapi/topo": "^6.0.0",
     "@rc-component/mini-decimal": "^1.1.0",
     "axios": "^1.7.0",
@@ -19,7 +19,8 @@
     "liquidjs": "^10.23.0",
     "multer": "^2.1.1",
     "object-path": "^0.11.8",
+    "sanitize-html": "2.17.7",
     "ses": "^1.14.0"
   },
-  "gitHead": "2e5b43a39d3f3e7cff58cb5e5a36a8c8e599dfb5"
+  "gitHead": "31adfe1b6bd3136bec29ff936fe1a0a7b5273d67"
 }