@nocobase/utils 2.3.0-beta.5 → 2.4.0-alpha.1

package/lib/client.d.ts

@@ -29,6 +29,7 @@ export * from './ses';
 export * from './i18n';
 export * from './isPortalInBody';
 export * from './parseHTML';
+export * from './sanitize-rich-text-html';
 export * from './uid';
 export * from './url';
 export * from './transformMultiColumnToSingleColumn';

package/lib/client.js

@@ -67,6 +67,7 @@ __reExport(client_exports, require("./ses"), module.exports);
 __reExport(client_exports, require("./i18n"), module.exports);
 __reExport(client_exports, require("./isPortalInBody"), module.exports);
 __reExport(client_exports, require("./parseHTML"), module.exports);
+__reExport(client_exports, require("./sanitize-rich-text-html"), module.exports);
 __reExport(client_exports, require("./uid"), module.exports);
 __reExport(client_exports, require("./url"), module.exports);
 __reExport(client_exports, require("./transformMultiColumnToSingleColumn"), module.exports);
@@ -100,6 +101,7 @@ __reExport(client_exports, require("./liquidjs"), module.exports);
   ...require("./i18n"),
   ...require("./isPortalInBody"),
   ...require("./parseHTML"),
+  ...require("./sanitize-rich-text-html"),
   ...require("./uid"),
   ...require("./url"),
   ...require("./transformMultiColumnToSingleColumn"),

package/lib/index.d.ts

@@ -46,6 +46,7 @@ export * from './url';
 export * from './variable-usage';
 export * from './wrap-middleware';
 export * from './run-sql';
+export * from './sanitize-rich-text-html';
 export * from './liquidjs';
 export * from './server-request';
 export * from './storage-path';

package/lib/index.js

@@ -82,6 +82,7 @@ __reExport(src_exports, require("./url"), module.exports);
 __reExport(src_exports, require("./variable-usage"), module.exports);
 __reExport(src_exports, require("./wrap-middleware"), module.exports);
 __reExport(src_exports, require("./run-sql"), module.exports);
+__reExport(src_exports, require("./sanitize-rich-text-html"), module.exports);
 __reExport(src_exports, require("./liquidjs"), module.exports);
 __reExport(src_exports, require("./server-request"), module.exports);
 __reExport(src_exports, require("./storage-path"), module.exports);
@@ -127,6 +128,7 @@ __reExport(src_exports, require("./storage-path"), module.exports);
   ...require("./variable-usage"),
   ...require("./wrap-middleware"),
   ...require("./run-sql"),
+  ...require("./sanitize-rich-text-html"),
   ...require("./liquidjs"),
   ...require("./server-request"),
   ...require("./storage-path")

package/lib/sanitize-rich-text-html.d.ts

@@ -0,0 +1,9 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+export declare function sanitizeRichTextHtml(value: string): any;

package/lib/sanitize-rich-text-html.js

@@ -0,0 +1,145 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var sanitize_rich_text_html_exports = {};
+__export(sanitize_rich_text_html_exports, {
+  sanitizeRichTextHtml: () => sanitizeRichTextHtml
+});
+module.exports = __toCommonJS(sanitize_rich_text_html_exports);
+var import_sanitize_html = __toESM(require("sanitize-html"));
+const imageDataUrlPattern = /^data:image\/(?:gif|jpe?g|png|webp);base64,[a-z\d+/=\s]+$/i;
+const dimensionPattern = /^(?:\d{1,4}(?:\.\d+)?(?:px)?|(?:100|[1-9]?\d)(?:\.\d+)?%)$/;
+const imageStyleDimensionPattern = /^(?:\d{1,4}(?:\.\d+)?px|(?:100|[1-9]?\d)(?:\.\d+)?%)$/;
+function sanitizeLinkAttributes(attribs) {
+  const nextAttributes = { ...attribs };
+  if (nextAttributes.target && !["_blank", "_self"].includes(nextAttributes.target)) {
+    delete nextAttributes.target;
+  }
+  if (nextAttributes.target === "_blank") {
+    nextAttributes.rel = "noopener noreferrer";
+  } else {
+    delete nextAttributes.rel;
+  }
+  return nextAttributes;
+}
+__name(sanitizeLinkAttributes, "sanitizeLinkAttributes");
+function sanitizeImageAttributes(attribs) {
+  var _a;
+  const nextAttributes = { ...attribs };
+  if (((_a = nextAttributes.src) == null ? void 0 : _a.trim().toLowerCase().startsWith("data:")) && !imageDataUrlPattern.test(nextAttributes.src)) {
+    delete nextAttributes.src;
+  }
+  for (const dimension of ["width", "height"]) {
+    if (nextAttributes[dimension] && !dimensionPattern.test(nextAttributes[dimension])) {
+      delete nextAttributes[dimension];
+    }
+  }
+  return nextAttributes;
+}
+__name(sanitizeImageAttributes, "sanitizeImageAttributes");
+const richTextSanitizeOptions = {
+  allowedTags: [
+    "a",
+    "b",
+    "blockquote",
+    "br",
+    "em",
+    "h1",
+    "h2",
+    "h3",
+    "h4",
+    "h5",
+    "h6",
+    "i",
+    "img",
+    "li",
+    "ol",
+    "p",
+    "s",
+    "span",
+    "strike",
+    "strong",
+    "u",
+    "ul"
+  ],
+  allowedAttributes: {
+    a: ["href", "target", "rel"],
+    img: ["src", "alt", "title", "width", "height", "style"],
+    span: ["style"]
+  },
+  allowedClasses: {
+    blockquote: [/^ql-indent-[1-9]$/],
+    h1: [/^ql-indent-[1-9]$/],
+    h2: [/^ql-indent-[1-9]$/],
+    h3: [/^ql-indent-[1-9]$/],
+    h4: [/^ql-indent-[1-9]$/],
+    h5: [/^ql-indent-[1-9]$/],
+    h6: [/^ql-indent-[1-9]$/],
+    li: [/^ql-indent-[1-9]$/],
+    p: [/^ql-indent-[1-9]$/]
+  },
+  allowedStyles: {
+    img: {
+      height: [imageStyleDimensionPattern],
+      width: [imageStyleDimensionPattern]
+    },
+    span: {
+      "font-size": [/^(?:12|14|16|18|20|24|32|48)px$/]
+    }
+  },
+  allowedSchemes: ["http", "https", "mailto", "tel"],
+  allowedSchemesByTag: {
+    img: ["http", "https", "data"]
+  },
+  allowProtocolRelative: false,
+  transformTags: {
+    a(tagName, attribs) {
+      return { tagName, attribs: sanitizeLinkAttributes(attribs) };
+    },
+    img(tagName, attribs) {
+      return { tagName, attribs: sanitizeImageAttributes(attribs) };
+    }
+  }
+};
+function sanitizeRichTextHtml(value) {
+  return (0, import_sanitize_html.default)(value, richTextSanitizeOptions);
+}
+__name(sanitizeRichTextHtml, "sanitizeRichTextHtml");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  sanitizeRichTextHtml
+});

package/lib/storage-path.js

@@ -43,12 +43,19 @@ __export(storage_path_exports, {
 });
 module.exports = __toCommonJS(storage_path_exports);
 var import_path = __toESM(require("path"));
+function resolveDefaultStorageRoot() {
+  if (import_path.default.basename(process.cwd()) === "source") {
+    return import_path.default.resolve(process.cwd(), "..", "storage");
+  }
+  return import_path.default.resolve(process.cwd(), "storage");
+}
+__name(resolveDefaultStorageRoot, "resolveDefaultStorageRoot");
 function resolveStorageRoot() {
   const raw = process.env.STORAGE_PATH;
   if (raw) {
     return import_path.default.isAbsolute(raw) ? raw : import_path.default.resolve(process.cwd(), raw);
   }
-  return import_path.default.resolve(process.cwd(), "storage");
+  return resolveDefaultStorageRoot();
 }
 __name(resolveStorageRoot, "resolveStorageRoot");
 function storagePathJoin(...segments) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/utils",
-  "version": "2.3.0-beta.5",
+  "version": "2.4.0-alpha.1",
   "main": "lib/index.js",
   "types": "./lib/index.d.ts",
   "license": "Apache-2.0",
@@ -19,7 +19,8 @@
     "liquidjs": "^10.23.0",
     "multer": "^2.1.1",
     "object-path": "^0.11.8",
+    "sanitize-html": "2.17.5",
     "ses": "^1.14.0"
   },
-  "gitHead": "7047516aba0d14965ddf457b64587103a871b923"
+  "gitHead": "82ecd3aed067e4cc98c32e7a0039b6e55cee76a7"
 }