@payloadcms/richtext-lexical 3.80.0-canary.11 → 3.80.0-canary.13

package/dist/features/converters/lexicalToHtml/async/converters/heading.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"heading.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/heading.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAEtD,eAAO,MAAM,yBAAyB,EAAE,mBAAmB,CAAC,qBAAqB,CAUhF,CAAA"}
+{"version":3,"file":"heading.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/heading.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAItD,eAAO,MAAM,yBAAyB,EAAE,mBAAmB,CAAC,qBAAqB,CAYhF,CAAA"}

package/dist/features/converters/lexicalToHtml/async/converters/heading.js

@@ -1,3 +1,4 @@
+const ALLOWED_HEADING_TAGS = new Set(['h1', 'h2', 'h3', 'h4', 'h5', 'h6']);
 export const HeadingHTMLConverterAsync = {
   heading: async ({
     node,
@@ -7,7 +8,8 @@ export const HeadingHTMLConverterAsync = {
     const children = (await nodesToHTML({
       nodes: node.children
     })).join('');
-    return `<${node.tag}${providedStyleTag}>${children}</${node.tag}>`;
+    const tag = ALLOWED_HEADING_TAGS.has(node.tag) ? node.tag : 'h1';
+    return `<${tag}${providedStyleTag}>${children}</${tag}>`;
   }
 };
 //# sourceMappingURL=heading.js.map

package/dist/features/converters/lexicalToHtml/async/converters/heading.js.map

@@ -1 +1 @@
-{"version":3,"file":"heading.js","names":["HeadingHTMLConverterAsync","heading","node","nodesToHTML","providedStyleTag","children","nodes","join","tag"],"sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/heading.ts"],"sourcesContent":["import type { SerializedHeadingNode } from '../../../../../nodeTypes.js'\nimport type { HTMLConvertersAsync } from '../types.js'\n\nexport const HeadingHTMLConverterAsync: HTMLConvertersAsync<SerializedHeadingNode> = {\n  heading: async ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = (\n      await nodesToHTML({\n        nodes: node.children,\n      })\n    ).join('')\n\n    return `<${node.tag}${providedStyleTag}>${children}</${node.tag}>`\n  },\n}\n"],"mappings":"AAGA,OAAO,MAAMA,yBAAA,GAAwE;EACnFC,OAAA,EAAS,MAAAA,CAAO;IAAEC,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IACrD,MAAMC,QAAA,GAAW,CACf,MAAMF,WAAA,CAAY;MAChBG,KAAA,EAAOJ,IAAA,CAAKG;IACd,EAAC,EACDE,IAAI,CAAC;IAEP,OAAO,IAAIL,IAAA,CAAKM,GAAG,GAAGJ,gBAAA,IAAoBC,QAAA,KAAaH,IAAA,CAAKM,GAAG,GAAG;EACpE;AACF","ignoreList":[]}
+{"version":3,"file":"heading.js","names":["ALLOWED_HEADING_TAGS","Set","HeadingHTMLConverterAsync","heading","node","nodesToHTML","providedStyleTag","children","nodes","join","tag","has"],"sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/heading.ts"],"sourcesContent":["import type { SerializedHeadingNode } from '../../../../../nodeTypes.js'\nimport type { HTMLConvertersAsync } from '../types.js'\n\nconst ALLOWED_HEADING_TAGS = new Set(['h1', 'h2', 'h3', 'h4', 'h5', 'h6'])\n\nexport const HeadingHTMLConverterAsync: HTMLConvertersAsync<SerializedHeadingNode> = {\n  heading: async ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = (\n      await nodesToHTML({\n        nodes: node.children,\n      })\n    ).join('')\n\n    const tag = ALLOWED_HEADING_TAGS.has(node.tag) ? node.tag : 'h1'\n\n    return `<${tag}${providedStyleTag}>${children}</${tag}>`\n  },\n}\n"],"mappings":"AAGA,MAAMA,oBAAA,GAAuB,IAAIC,GAAA,CAAI,CAAC,MAAM,MAAM,MAAM,MAAM,MAAM,KAAK;AAEzE,OAAO,MAAMC,yBAAA,GAAwE;EACnFC,OAAA,EAAS,MAAAA,CAAO;IAAEC,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IACrD,MAAMC,QAAA,GAAW,CACf,MAAMF,WAAA,CAAY;MAChBG,KAAA,EAAOJ,IAAA,CAAKG;IACd,EAAC,EACDE,IAAI,CAAC;IAEP,MAAMC,GAAA,GAAMV,oBAAA,CAAqBW,GAAG,CAACP,IAAA,CAAKM,GAAG,IAAIN,IAAA,CAAKM,GAAG,GAAG;IAE5D,OAAO,IAAIA,GAAA,GAAMJ,gBAAA,IAAoBC,QAAA,KAAaG,GAAA,GAAM;EAC1D;AACF","ignoreList":[]}

package/dist/features/converters/lexicalToHtml/async/converters/link.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"link.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/link.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAC7F,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEtE,eAAO,MAAM,sBAAsB,EAAE,CAAC,IAAI,EAAE;IAC1C,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QACzB,QAAQ,EAAE,kBAAkB,CAAA;QAC5B,QAAQ,CAAC,EAAE,cAAc,CAAA;KAC1B,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;CAC/B,KAAK,mBAAmB,CAAC,sBAAsB,GAAG,kBAAkB,CAiCnE,CAAA"}
+{"version":3,"file":"link.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/link.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAC7F,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEtE,eAAO,MAAM,sBAAsB,EAAE,CAAC,IAAI,EAAE;IAC1C,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QACzB,QAAQ,EAAE,kBAAkB,CAAA;QAC5B,QAAQ,CAAC,EAAE,cAAc,CAAA;KAC1B,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;CAC/B,KAAK,mBAAmB,CAAC,sBAAsB,GAAG,kBAAkB,CAsCnE,CAAA"}

package/dist/features/converters/lexicalToHtml/async/converters/link.js

@@ -1,3 +1,5 @@
+import escapeHTML from 'escape-html';
+import { sanitizeUrl } from 'payload/shared';
 export const LinkHTMLConverterAsync = ({
   internalDocToHref
 }) => ({
@@ -9,7 +11,8 @@ export const LinkHTMLConverterAsync = ({
     const children = (await nodesToHTML({
       nodes: node.children
     })).join('');
-    return `<a${providedStyleTag} href="${node.fields.url}"${node.fields.newTab ? ' rel="noopener noreferrer" target="_blank"' : ''}>${children}</a>`;
+    const href = escapeHTML(sanitizeUrl(node.fields.url ?? ''));
+    return `<a${providedStyleTag} href="${href}"${node.fields.newTab ? ' rel="noopener noreferrer" target="_blank"' : ''}>${children}</a>`;
   },
   link: async ({
     node,
@@ -28,11 +31,13 @@ export const LinkHTMLConverterAsync = ({
           populate
         });
       } else {
+        // eslint-disable-next-line no-console
         console.error('Lexical => HTML converter: Link converter: found internal link, but internalDocToHref is not provided');
         href = '#'; // fallback
       }
     }
-    return `<a${providedStyleTag} href="${href}"${node.fields.newTab ? ' rel="noopener noreferrer" target="_blank"' : ''}>${children}</a>`;
+    const safeHref = escapeHTML(sanitizeUrl(href));
+    return `<a${providedStyleTag} href="${safeHref}"${node.fields.newTab ? ' rel="noopener noreferrer" target="_blank"' : ''}>${children}</a>`;
   }
 });
 //# sourceMappingURL=link.js.map

package/dist/features/converters/lexicalToHtml/async/converters/link.js.map

@@ -1 +1 @@
-{"version":3,"file":"link.js","names":["LinkHTMLConverterAsync","internalDocToHref","autolink","node","nodesToHTML","providedStyleTag","children","nodes","join","fields","url","newTab","link","populate","href","linkType","linkNode","console","error"],"sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/link.ts"],"sourcesContent":["import type { SerializedAutoLinkNode, SerializedLinkNode } from '../../../../../nodeTypes.js'\nimport type { HTMLConvertersAsync, HTMLPopulateFn } from '../types.js'\n\nexport const LinkHTMLConverterAsync: (args: {\n  internalDocToHref?: (args: {\n    linkNode: SerializedLinkNode\n    populate?: HTMLPopulateFn\n  }) => Promise<string> | string\n}) => HTMLConvertersAsync<SerializedAutoLinkNode | SerializedLinkNode> = ({\n  internalDocToHref,\n}) => ({\n  autolink: async ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = (\n      await nodesToHTML({\n        nodes: node.children,\n      })\n    ).join('')\n\n    return `<a${providedStyleTag} href=\"${node.fields.url}\"${node.fields.newTab ? ' rel=\"noopener noreferrer\" target=\"_blank\"' : ''}>${children}</a>`\n  },\n  link: async ({ node, nodesToHTML, populate, providedStyleTag }) => {\n    const children = (\n      await nodesToHTML({\n        nodes: node.children,\n      })\n    ).join('')\n\n    let href: string = node.fields.url ?? ''\n    if (node.fields.linkType === 'internal') {\n      if (internalDocToHref) {\n        href = await internalDocToHref({ linkNode: node, populate })\n      } else {\n        console.error(\n          'Lexical => HTML converter: Link converter: found internal link, but internalDocToHref is not provided',\n        )\n        href = '#' // fallback\n      }\n    }\n\n    return `<a${providedStyleTag} href=\"${href}\"${node.fields.newTab ? ' rel=\"noopener noreferrer\" target=\"_blank\"' : ''}>${children}</a>`\n  },\n})\n"],"mappings":"AAGA,OAAO,MAAMA,sBAAA,GAK4DA,CAAC;EACxEC;AAAiB,CAClB,MAAM;EACLC,QAAA,EAAU,MAAAA,CAAO;IAAEC,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IACtD,MAAMC,QAAA,GAAW,CACf,MAAMF,WAAA,CAAY;MAChBG,KAAA,EAAOJ,IAAA,CAAKG;IACd,EAAC,EACDE,IAAI,CAAC;IAEP,OAAO,KAAKH,gBAAA,UAA0BF,IAAA,CAAKM,MAAM,CAACC,GAAG,IAAIP,IAAA,CAAKM,MAAM,CAACE,MAAM,GAAG,+CAA+C,MAAML,QAAA,MAAc;EACnJ;EACAM,IAAA,EAAM,MAAAA,CAAO;IAAET,IAAI;IAAEC,WAAW;IAAES,QAAQ;IAAER;EAAgB,CAAE;IAC5D,MAAMC,QAAA,GAAW,CACf,MAAMF,WAAA,CAAY;MAChBG,KAAA,EAAOJ,IAAA,CAAKG;IACd,EAAC,EACDE,IAAI,CAAC;IAEP,IAAIM,IAAA,GAAeX,IAAA,CAAKM,MAAM,CAACC,GAAG,IAAI;IACtC,IAAIP,IAAA,CAAKM,MAAM,CAACM,QAAQ,KAAK,YAAY;MACvC,IAAId,iBAAA,EAAmB;QACrBa,IAAA,GAAO,MAAMb,iBAAA,CAAkB;UAAEe,QAAA,EAAUb,IAAA;UAAMU;QAAS;MAC5D,OAAO;QACLI,OAAA,CAAQC,KAAK,CACX;QAEFJ,IAAA,GAAO,KAAI;MACb;IACF;IAEA,OAAO,KAAKT,gBAAA,UAA0BS,IAAA,IAAQX,IAAA,CAAKM,MAAM,CAACE,MAAM,GAAG,+CAA+C,MAAML,QAAA,MAAc;EACxI;AACF","ignoreList":[]}
+{"version":3,"file":"link.js","names":["escapeHTML","sanitizeUrl","LinkHTMLConverterAsync","internalDocToHref","autolink","node","nodesToHTML","providedStyleTag","children","nodes","join","href","fields","url","newTab","link","populate","linkType","linkNode","console","error","safeHref"],"sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/link.ts"],"sourcesContent":["import escapeHTML from 'escape-html'\nimport { sanitizeUrl } from 'payload/shared'\n\nimport type { SerializedAutoLinkNode, SerializedLinkNode } from '../../../../../nodeTypes.js'\nimport type { HTMLConvertersAsync, HTMLPopulateFn } from '../types.js'\n\nexport const LinkHTMLConverterAsync: (args: {\n  internalDocToHref?: (args: {\n    linkNode: SerializedLinkNode\n    populate?: HTMLPopulateFn\n  }) => Promise<string> | string\n}) => HTMLConvertersAsync<SerializedAutoLinkNode | SerializedLinkNode> = ({\n  internalDocToHref,\n}) => ({\n  autolink: async ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = (\n      await nodesToHTML({\n        nodes: node.children,\n      })\n    ).join('')\n\n    const href = escapeHTML(sanitizeUrl(node.fields.url ?? ''))\n\n    return `<a${providedStyleTag} href=\"${href}\"${node.fields.newTab ? ' rel=\"noopener noreferrer\" target=\"_blank\"' : ''}>${children}</a>`\n  },\n  link: async ({ node, nodesToHTML, populate, providedStyleTag }) => {\n    const children = (\n      await nodesToHTML({\n        nodes: node.children,\n      })\n    ).join('')\n\n    let href: string = node.fields.url ?? ''\n    if (node.fields.linkType === 'internal') {\n      if (internalDocToHref) {\n        href = await internalDocToHref({ linkNode: node, populate })\n      } else {\n        // eslint-disable-next-line no-console\n        console.error(\n          'Lexical => HTML converter: Link converter: found internal link, but internalDocToHref is not provided',\n        )\n        href = '#' // fallback\n      }\n    }\n\n    const safeHref = escapeHTML(sanitizeUrl(href))\n\n    return `<a${providedStyleTag} href=\"${safeHref}\"${node.fields.newTab ? ' rel=\"noopener noreferrer\" target=\"_blank\"' : ''}>${children}</a>`\n  },\n})\n"],"mappings":"AAAA,OAAOA,UAAA,MAAgB;AACvB,SAASC,WAAW,QAAQ;AAK5B,OAAO,MAAMC,sBAAA,GAK4DA,CAAC;EACxEC;AAAiB,CAClB,MAAM;EACLC,QAAA,EAAU,MAAAA,CAAO;IAAEC,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IACtD,MAAMC,QAAA,GAAW,CACf,MAAMF,WAAA,CAAY;MAChBG,KAAA,EAAOJ,IAAA,CAAKG;IACd,EAAC,EACDE,IAAI,CAAC;IAEP,MAAMC,IAAA,GAAOX,UAAA,CAAWC,WAAA,CAAYI,IAAA,CAAKO,MAAM,CAACC,GAAG,IAAI;IAEvD,OAAO,KAAKN,gBAAA,UAA0BI,IAAA,IAAQN,IAAA,CAAKO,MAAM,CAACE,MAAM,GAAG,+CAA+C,MAAMN,QAAA,MAAc;EACxI;EACAO,IAAA,EAAM,MAAAA,CAAO;IAAEV,IAAI;IAAEC,WAAW;IAAEU,QAAQ;IAAET;EAAgB,CAAE;IAC5D,MAAMC,QAAA,GAAW,CACf,MAAMF,WAAA,CAAY;MAChBG,KAAA,EAAOJ,IAAA,CAAKG;IACd,EAAC,EACDE,IAAI,CAAC;IAEP,IAAIC,IAAA,GAAeN,IAAA,CAAKO,MAAM,CAACC,GAAG,IAAI;IACtC,IAAIR,IAAA,CAAKO,MAAM,CAACK,QAAQ,KAAK,YAAY;MACvC,IAAId,iBAAA,EAAmB;QACrBQ,IAAA,GAAO,MAAMR,iBAAA,CAAkB;UAAEe,QAAA,EAAUb,IAAA;UAAMW;QAAS;MAC5D,OAAO;QACL;QACAG,OAAA,CAAQC,KAAK,CACX;QAEFT,IAAA,GAAO,KAAI;MACb;IACF;IAEA,MAAMU,QAAA,GAAWrB,UAAA,CAAWC,WAAA,CAAYU,IAAA;IAExC,OAAO,KAAKJ,gBAAA,UAA0Bc,QAAA,IAAYhB,IAAA,CAAKO,MAAM,CAACE,MAAM,GAAG,+CAA+C,MAAMN,QAAA,MAAc;EAC5I;AACF","ignoreList":[]}

package/dist/features/converters/lexicalToHtml/async/converters/list.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/list.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAC7F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAEtD,eAAO,MAAM,sBAAsB,EAAE,mBAAmB,CACtD,sBAAsB,GAAG,kBAAkB,CA8C5C,CAAA"}
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/list.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAC7F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAKtD,eAAO,MAAM,sBAAsB,EAAE,mBAAmB,CACtD,sBAAsB,GAAG,kBAAkB,CAiD5C,CAAA"}

package/dist/features/converters/lexicalToHtml/async/converters/list.js

@@ -1,4 +1,6 @@
 import { v4 as uuidv4 } from 'uuid';
+const ALLOWED_LIST_TAGS = new Set(['ol', 'ul']);
+const ALLOWED_LIST_TYPES = new Set(['bullet', 'check', 'number']);
 export const ListHTMLConverterAsync = {
   list: async ({
     node,
@@ -8,7 +10,9 @@ export const ListHTMLConverterAsync = {
     const children = (await nodesToHTML({
       nodes: node.children
     })).join('');
-    return `<${node.tag}${providedStyleTag} class="list-${node.listType}">${children}</${node.tag}>`;
+    const tag = ALLOWED_LIST_TAGS.has(node.tag) ? node.tag : 'ul';
+    const listType = ALLOWED_LIST_TYPES.has(node.listType) ? node.listType : 'bullet';
+    return `<${tag}${providedStyleTag} class="list-${listType}">${children}</${tag}>`;
   },
   listitem: async ({
     node,

package/dist/features/converters/lexicalToHtml/async/converters/list.js.map

@@ -1 +1 @@
-{"version":3,"file":"list.js","names":["v4","uuidv4","ListHTMLConverterAsync","list","node","nodesToHTML","providedStyleTag","children","nodes","join","tag","listType","listitem","parent","providedCSSString","hasSubLists","some","child","type","uuid","checked","value"],"sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/list.ts"],"sourcesContent":["import { v4 as uuidv4 } from 'uuid'\n\nimport type { SerializedListItemNode, SerializedListNode } from '../../../../../nodeTypes.js'\nimport type { HTMLConvertersAsync } from '../types.js'\n\nexport const ListHTMLConverterAsync: HTMLConvertersAsync<\n  SerializedListItemNode | SerializedListNode\n> = {\n  list: async ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = (\n      await nodesToHTML({\n        nodes: node.children,\n      })\n    ).join('')\n\n    return `<${node.tag}${providedStyleTag} class=\"list-${node.listType}\">${children}</${node.tag}>`\n  },\n  listitem: async ({ node, nodesToHTML, parent, providedCSSString }) => {\n    const hasSubLists = node.children.some((child) => child.type === 'list')\n\n    const children = (\n      await nodesToHTML({\n        nodes: node.children,\n      })\n    ).join('')\n\n    if ('listType' in parent && parent?.listType === 'check') {\n      const uuid = uuidv4()\n      return `<li\n          aria-checked=\"${node.checked ? 'true' : 'false'}\"\n          class=\"list-item-checkbox${node.checked ? ' list-item-checkbox-checked' : ' list-item-checkbox-unchecked'}${hasSubLists ? ' nestedListItem' : ''}\"\n          role=\"checkbox\"\n          style=\"list-style-type: none;${providedCSSString}\"\n          tabIndex=\"-1\"\n          value=\"${node.value}\"\n        >\n          ${\n            hasSubLists\n              ? children\n              : `<input${node.checked ? ' checked' : ''} id=\"${uuid}\" readOnly=\"true\" type=\"checkbox\" />\n            <label htmlFor=\"${uuid}\">${children}</label>\n            <br />`\n          }\n        </li>`\n    } else {\n      return `<li\n          class=\"${hasSubLists ? 'nestedListItem' : ''}\"\n          style=\"${hasSubLists ? `list-style-type: none;${providedCSSString}` : providedCSSString}\"\n          value=\"${node.value}\"\n        >${children}</li>`\n    }\n  },\n}\n"],"mappings":"AAAA,SAASA,EAAA,IAAMC,MAAM,QAAQ;AAK7B,OAAO,MAAMC,sBAAA,GAET;EACFC,IAAA,EAAM,MAAAA,CAAO;IAAEC,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IAClD,MAAMC,QAAA,GAAW,CACf,MAAMF,WAAA,CAAY;MAChBG,KAAA,EAAOJ,IAAA,CAAKG;IACd,EAAC,EACDE,IAAI,CAAC;IAEP,OAAO,IAAIL,IAAA,CAAKM,GAAG,GAAGJ,gBAAA,gBAAgCF,IAAA,CAAKO,QAAQ,KAAKJ,QAAA,KAAaH,IAAA,CAAKM,GAAG,GAAG;EAClG;EACAE,QAAA,EAAU,MAAAA,CAAO;IAAER,IAAI;IAAEC,WAAW;IAAEQ,MAAM;IAAEC;EAAiB,CAAE;IAC/D,MAAMC,WAAA,GAAcX,IAAA,CAAKG,QAAQ,CAACS,IAAI,CAAEC,KAAA,IAAUA,KAAA,CAAMC,IAAI,KAAK;IAEjE,MAAMX,QAAA,GAAW,CACf,MAAMF,WAAA,CAAY;MAChBG,KAAA,EAAOJ,IAAA,CAAKG;IACd,EAAC,EACDE,IAAI,CAAC;IAEP,IAAI,cAAcI,MAAA,IAAUA,MAAA,EAAQF,QAAA,KAAa,SAAS;MACxD,MAAMQ,IAAA,GAAOlB,MAAA;MACb,OAAO;0BACaG,IAAA,CAAKgB,OAAO,GAAG,SAAS;qCACbhB,IAAA,CAAKgB,OAAO,GAAG,gCAAgC,kCAAkCL,WAAA,GAAc,oBAAoB;;yCAE/GD,iBAAA;;mBAEtBV,IAAA,CAAKiB,KAAK;;YAGjBN,WAAA,GACIR,QAAA,GACA,SAASH,IAAA,CAAKgB,OAAO,GAAG,aAAa,UAAUD,IAAA;8BACjCA,IAAA,KAASZ,QAAA;mBACpB;cAEL;IACV,OAAO;MACL,OAAO;mBACMQ,WAAA,GAAc,mBAAmB;mBACjCA,WAAA,GAAc,yBAAyBD,iBAAA,EAAmB,GAAGA,iBAAA;mBAC7DV,IAAA,CAAKiB,KAAK;WAClBd,QAAA,OAAe;IACtB;EACF;AACF","ignoreList":[]}
+{"version":3,"file":"list.js","names":["v4","uuidv4","ALLOWED_LIST_TAGS","Set","ALLOWED_LIST_TYPES","ListHTMLConverterAsync","list","node","nodesToHTML","providedStyleTag","children","nodes","join","tag","has","listType","listitem","parent","providedCSSString","hasSubLists","some","child","type","uuid","checked","value"],"sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/list.ts"],"sourcesContent":["import { v4 as uuidv4 } from 'uuid'\n\nimport type { SerializedListItemNode, SerializedListNode } from '../../../../../nodeTypes.js'\nimport type { HTMLConvertersAsync } from '../types.js'\n\nconst ALLOWED_LIST_TAGS = new Set(['ol', 'ul'])\nconst ALLOWED_LIST_TYPES = new Set(['bullet', 'check', 'number'])\n\nexport const ListHTMLConverterAsync: HTMLConvertersAsync<\n  SerializedListItemNode | SerializedListNode\n> = {\n  list: async ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = (\n      await nodesToHTML({\n        nodes: node.children,\n      })\n    ).join('')\n\n    const tag = ALLOWED_LIST_TAGS.has(node.tag) ? node.tag : 'ul'\n    const listType = ALLOWED_LIST_TYPES.has(node.listType) ? node.listType : 'bullet'\n\n    return `<${tag}${providedStyleTag} class=\"list-${listType}\">${children}</${tag}>`\n  },\n  listitem: async ({ node, nodesToHTML, parent, providedCSSString }) => {\n    const hasSubLists = node.children.some((child) => child.type === 'list')\n\n    const children = (\n      await nodesToHTML({\n        nodes: node.children,\n      })\n    ).join('')\n\n    if ('listType' in parent && parent?.listType === 'check') {\n      const uuid = uuidv4()\n      return `<li\n          aria-checked=\"${node.checked ? 'true' : 'false'}\"\n          class=\"list-item-checkbox${node.checked ? ' list-item-checkbox-checked' : ' list-item-checkbox-unchecked'}${hasSubLists ? ' nestedListItem' : ''}\"\n          role=\"checkbox\"\n          style=\"list-style-type: none;${providedCSSString}\"\n          tabIndex=\"-1\"\n          value=\"${node.value}\"\n        >\n          ${\n            hasSubLists\n              ? children\n              : `<input${node.checked ? ' checked' : ''} id=\"${uuid}\" readOnly=\"true\" type=\"checkbox\" />\n            <label htmlFor=\"${uuid}\">${children}</label>\n            <br />`\n          }\n        </li>`\n    } else {\n      return `<li\n          class=\"${hasSubLists ? 'nestedListItem' : ''}\"\n          style=\"${hasSubLists ? `list-style-type: none;${providedCSSString}` : providedCSSString}\"\n          value=\"${node.value}\"\n        >${children}</li>`\n    }\n  },\n}\n"],"mappings":"AAAA,SAASA,EAAA,IAAMC,MAAM,QAAQ;AAK7B,MAAMC,iBAAA,GAAoB,IAAIC,GAAA,CAAI,CAAC,MAAM,KAAK;AAC9C,MAAMC,kBAAA,GAAqB,IAAID,GAAA,CAAI,CAAC,UAAU,SAAS,SAAS;AAEhE,OAAO,MAAME,sBAAA,GAET;EACFC,IAAA,EAAM,MAAAA,CAAO;IAAEC,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IAClD,MAAMC,QAAA,GAAW,CACf,MAAMF,WAAA,CAAY;MAChBG,KAAA,EAAOJ,IAAA,CAAKG;IACd,EAAC,EACDE,IAAI,CAAC;IAEP,MAAMC,GAAA,GAAMX,iBAAA,CAAkBY,GAAG,CAACP,IAAA,CAAKM,GAAG,IAAIN,IAAA,CAAKM,GAAG,GAAG;IACzD,MAAME,QAAA,GAAWX,kBAAA,CAAmBU,GAAG,CAACP,IAAA,CAAKQ,QAAQ,IAAIR,IAAA,CAAKQ,QAAQ,GAAG;IAEzE,OAAO,IAAIF,GAAA,GAAMJ,gBAAA,gBAAgCM,QAAA,KAAaL,QAAA,KAAaG,GAAA,GAAM;EACnF;EACAG,QAAA,EAAU,MAAAA,CAAO;IAAET,IAAI;IAAEC,WAAW;IAAES,MAAM;IAAEC;EAAiB,CAAE;IAC/D,MAAMC,WAAA,GAAcZ,IAAA,CAAKG,QAAQ,CAACU,IAAI,CAAEC,KAAA,IAAUA,KAAA,CAAMC,IAAI,KAAK;IAEjE,MAAMZ,QAAA,GAAW,CACf,MAAMF,WAAA,CAAY;MAChBG,KAAA,EAAOJ,IAAA,CAAKG;IACd,EAAC,EACDE,IAAI,CAAC;IAEP,IAAI,cAAcK,MAAA,IAAUA,MAAA,EAAQF,QAAA,KAAa,SAAS;MACxD,MAAMQ,IAAA,GAAOtB,MAAA;MACb,OAAO;0BACaM,IAAA,CAAKiB,OAAO,GAAG,SAAS;qCACbjB,IAAA,CAAKiB,OAAO,GAAG,gCAAgC,kCAAkCL,WAAA,GAAc,oBAAoB;;yCAE/GD,iBAAA;;mBAEtBX,IAAA,CAAKkB,KAAK;;YAGjBN,WAAA,GACIT,QAAA,GACA,SAASH,IAAA,CAAKiB,OAAO,GAAG,aAAa,UAAUD,IAAA;8BACjCA,IAAA,KAASb,QAAA;mBACpB;cAEL;IACV,OAAO;MACL,OAAO;mBACMS,WAAA,GAAc,mBAAmB;mBACjCA,WAAA,GAAc,yBAAyBD,iBAAA,EAAmB,GAAGA,iBAAA;mBAC7DX,IAAA,CAAKkB,KAAK;WAClBf,QAAA,OAAe;IACtB;EACF;AACF","ignoreList":[]}

package/dist/features/converters/lexicalToHtml/async/converters/table.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"table.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/table.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACvB,MAAM,6BAA6B,CAAA;AACpC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAEtD,eAAO,MAAM,uBAAuB,EAAE,mBAAmB,CACvD,uBAAuB,GAAG,mBAAmB,GAAG,sBAAsB,CAwDvE,CAAA"}
+{"version":3,"file":"table.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/table.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACvB,MAAM,6BAA6B,CAAA;AACpC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAItD,eAAO,MAAM,uBAAuB,EAAE,mBAAmB,CACvD,uBAAuB,GAAG,mBAAmB,GAAG,sBAAsB,CAwDvE,CAAA"}

package/dist/features/converters/lexicalToHtml/async/converters/table.js

@@ -1,3 +1,4 @@
+import { isSafeCssColor } from '../../shared/cssColors.js';
 export const TableHTMLConverterAsync = {
   table: async ({
     node,
@@ -24,7 +25,7 @@ export const TableHTMLConverterAsync = {
     const TagName = node.headerState > 0 ? 'th' : 'td';
     const headerStateClass = `lexical-table-cell-header-${node.headerState}`;
     let style = 'border: 1px solid #ccc; padding: 8px;' + providedCSSString;
-    if (node.backgroundColor) {
+    if (node.backgroundColor && isSafeCssColor(node.backgroundColor)) {
       style += ` background-color: ${node.backgroundColor};`;
     }
     const colSpanAttr = node.colSpan && node.colSpan > 1 ? ` colspan="${node.colSpan}"` : '';

package/dist/features/converters/lexicalToHtml/async/converters/table.js.map

@@ -1 +1 @@
-{"version":3,"file":"table.js","names":["TableHTMLConverterAsync","table","node","nodesToHTML","providedStyleTag","children","nodes","join","tablecell","providedCSSString","TagName","headerState","headerStateClass","style","backgroundColor","colSpanAttr","colSpan","rowSpanAttr","rowSpan","tablerow"],"sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/table.ts"],"sourcesContent":["import type {\n  SerializedTableCellNode,\n  SerializedTableNode,\n  SerializedTableRowNode,\n} from '../../../../../nodeTypes.js'\nimport type { HTMLConvertersAsync } from '../types.js'\n\nexport const TableHTMLConverterAsync: HTMLConvertersAsync<\n  SerializedTableCellNode | SerializedTableNode | SerializedTableRowNode\n> = {\n  table: async ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = (\n      await nodesToHTML({\n        nodes: node.children,\n      })\n    ).join('')\n\n    return `<div${providedStyleTag} class=\"lexical-table-container\">\n        <table class=\"lexical-table\" style=\"border-collapse: collapse;\">\n          <tbody>${children}</tbody>\n        </table>\n      </div>`\n  },\n\n  tablecell: async ({ node, nodesToHTML, providedCSSString }) => {\n    const children = (\n      await nodesToHTML({\n        nodes: node.children,\n      })\n    ).join('')\n\n    const TagName = node.headerState > 0 ? 'th' : 'td'\n    const headerStateClass = `lexical-table-cell-header-${node.headerState}`\n\n    let style = 'border: 1px solid #ccc; padding: 8px;' + providedCSSString\n    if (node.backgroundColor) {\n      style += ` background-color: ${node.backgroundColor};`\n    }\n\n    const colSpanAttr = node.colSpan && node.colSpan > 1 ? ` colspan=\"${node.colSpan}\"` : ''\n    const rowSpanAttr = node.rowSpan && node.rowSpan > 1 ? ` rowspan=\"${node.rowSpan}\"` : ''\n\n    return `<${TagName}\n        class=\"lexical-table-cell ${headerStateClass}\"\n        ${colSpanAttr}\n        ${rowSpanAttr}\n        style=\"${style}\"\n      >\n        ${children}\n      </${TagName}>\n    `\n  },\n\n  tablerow: async ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = (\n      await nodesToHTML({\n        nodes: node.children,\n      })\n    ).join('')\n\n    return `<tr${providedStyleTag} class=\"lexical-table-row\">\n        ${children}\n      </tr>`\n  },\n}\n"],"mappings":"AAOA,OAAO,MAAMA,uBAAA,GAET;EACFC,KAAA,EAAO,MAAAA,CAAO;IAAEC,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IACnD,MAAMC,QAAA,GAAW,CACf,MAAMF,WAAA,CAAY;MAChBG,KAAA,EAAOJ,IAAA,CAAKG;IACd,EAAC,EACDE,IAAI,CAAC;IAEP,OAAO,OAAOH,gBAAA;;mBAECC,QAAA;;aAEN;EACX;EAEAG,SAAA,EAAW,MAAAA,CAAO;IAAEN,IAAI;IAAEC,WAAW;IAAEM;EAAiB,CAAE;IACxD,MAAMJ,QAAA,GAAW,CACf,MAAMF,WAAA,CAAY;MAChBG,KAAA,EAAOJ,IAAA,CAAKG;IACd,EAAC,EACDE,IAAI,CAAC;IAEP,MAAMG,OAAA,GAAUR,IAAA,CAAKS,WAAW,GAAG,IAAI,OAAO;IAC9C,MAAMC,gBAAA,GAAmB,6BAA6BV,IAAA,CAAKS,WAAW,EAAE;IAExE,IAAIE,KAAA,GAAQ,0CAA0CJ,iBAAA;IACtD,IAAIP,IAAA,CAAKY,eAAe,EAAE;MACxBD,KAAA,IAAS,sBAAsBX,IAAA,CAAKY,eAAe,GAAG;IACxD;IAEA,MAAMC,WAAA,GAAcb,IAAA,CAAKc,OAAO,IAAId,IAAA,CAAKc,OAAO,GAAG,IAAI,aAAad,IAAA,CAAKc,OAAO,GAAG,GAAG;IACtF,MAAMC,WAAA,GAAcf,IAAA,CAAKgB,OAAO,IAAIhB,IAAA,CAAKgB,OAAO,GAAG,IAAI,aAAahB,IAAA,CAAKgB,OAAO,GAAG,GAAG;IAEtF,OAAO,IAAIR,OAAA;oCACqBE,gBAAA;UAC1BG,WAAA;UACAE,WAAA;iBACOJ,KAAA;;UAEPR,QAAA;UACAK,OAAA;KACL;EACH;EAEAS,QAAA,EAAU,MAAAA,CAAO;IAAEjB,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IACtD,MAAMC,QAAA,GAAW,CACf,MAAMF,WAAA,CAAY;MAChBG,KAAA,EAAOJ,IAAA,CAAKG;IACd,EAAC,EACDE,IAAI,CAAC;IAEP,OAAO,MAAMH,gBAAA;UACPC,QAAA;YACE;EACV;AACF","ignoreList":[]}
+{"version":3,"file":"table.js","names":["isSafeCssColor","TableHTMLConverterAsync","table","node","nodesToHTML","providedStyleTag","children","nodes","join","tablecell","providedCSSString","TagName","headerState","headerStateClass","style","backgroundColor","colSpanAttr","colSpan","rowSpanAttr","rowSpan","tablerow"],"sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/table.ts"],"sourcesContent":["import type {\n  SerializedTableCellNode,\n  SerializedTableNode,\n  SerializedTableRowNode,\n} from '../../../../../nodeTypes.js'\nimport type { HTMLConvertersAsync } from '../types.js'\n\nimport { isSafeCssColor } from '../../shared/cssColors.js'\n\nexport const TableHTMLConverterAsync: HTMLConvertersAsync<\n  SerializedTableCellNode | SerializedTableNode | SerializedTableRowNode\n> = {\n  table: async ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = (\n      await nodesToHTML({\n        nodes: node.children,\n      })\n    ).join('')\n\n    return `<div${providedStyleTag} class=\"lexical-table-container\">\n        <table class=\"lexical-table\" style=\"border-collapse: collapse;\">\n          <tbody>${children}</tbody>\n        </table>\n      </div>`\n  },\n\n  tablecell: async ({ node, nodesToHTML, providedCSSString }) => {\n    const children = (\n      await nodesToHTML({\n        nodes: node.children,\n      })\n    ).join('')\n\n    const TagName = node.headerState > 0 ? 'th' : 'td'\n    const headerStateClass = `lexical-table-cell-header-${node.headerState}`\n\n    let style = 'border: 1px solid #ccc; padding: 8px;' + providedCSSString\n    if (node.backgroundColor && isSafeCssColor(node.backgroundColor)) {\n      style += ` background-color: ${node.backgroundColor};`\n    }\n\n    const colSpanAttr = node.colSpan && node.colSpan > 1 ? ` colspan=\"${node.colSpan}\"` : ''\n    const rowSpanAttr = node.rowSpan && node.rowSpan > 1 ? ` rowspan=\"${node.rowSpan}\"` : ''\n\n    return `<${TagName}\n        class=\"lexical-table-cell ${headerStateClass}\"\n        ${colSpanAttr}\n        ${rowSpanAttr}\n        style=\"${style}\"\n      >\n        ${children}\n      </${TagName}>\n    `\n  },\n\n  tablerow: async ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = (\n      await nodesToHTML({\n        nodes: node.children,\n      })\n    ).join('')\n\n    return `<tr${providedStyleTag} class=\"lexical-table-row\">\n        ${children}\n      </tr>`\n  },\n}\n"],"mappings":"AAOA,SAASA,cAAc,QAAQ;AAE/B,OAAO,MAAMC,uBAAA,GAET;EACFC,KAAA,EAAO,MAAAA,CAAO;IAAEC,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IACnD,MAAMC,QAAA,GAAW,CACf,MAAMF,WAAA,CAAY;MAChBG,KAAA,EAAOJ,IAAA,CAAKG;IACd,EAAC,EACDE,IAAI,CAAC;IAEP,OAAO,OAAOH,gBAAA;;mBAECC,QAAA;;aAEN;EACX;EAEAG,SAAA,EAAW,MAAAA,CAAO;IAAEN,IAAI;IAAEC,WAAW;IAAEM;EAAiB,CAAE;IACxD,MAAMJ,QAAA,GAAW,CACf,MAAMF,WAAA,CAAY;MAChBG,KAAA,EAAOJ,IAAA,CAAKG;IACd,EAAC,EACDE,IAAI,CAAC;IAEP,MAAMG,OAAA,GAAUR,IAAA,CAAKS,WAAW,GAAG,IAAI,OAAO;IAC9C,MAAMC,gBAAA,GAAmB,6BAA6BV,IAAA,CAAKS,WAAW,EAAE;IAExE,IAAIE,KAAA,GAAQ,0CAA0CJ,iBAAA;IACtD,IAAIP,IAAA,CAAKY,eAAe,IAAIf,cAAA,CAAeG,IAAA,CAAKY,eAAe,GAAG;MAChED,KAAA,IAAS,sBAAsBX,IAAA,CAAKY,eAAe,GAAG;IACxD;IAEA,MAAMC,WAAA,GAAcb,IAAA,CAAKc,OAAO,IAAId,IAAA,CAAKc,OAAO,GAAG,IAAI,aAAad,IAAA,CAAKc,OAAO,GAAG,GAAG;IACtF,MAAMC,WAAA,GAAcf,IAAA,CAAKgB,OAAO,IAAIhB,IAAA,CAAKgB,OAAO,GAAG,IAAI,aAAahB,IAAA,CAAKgB,OAAO,GAAG,GAAG;IAEtF,OAAO,IAAIR,OAAA;oCACqBE,gBAAA;UAC1BG,WAAA;UACAE,WAAA;iBACOJ,KAAA;;UAEPR,QAAA;UACAK,OAAA;KACL;EACH;EAEAS,QAAA,EAAU,MAAAA,CAAO;IAAEjB,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IACtD,MAAMC,QAAA,GAAW,CACf,MAAMF,WAAA,CAAY;MAChBG,KAAA,EAAOJ,IAAA,CAAKG;IACd,EAAC,EACDE,IAAI,CAAC;IAEP,OAAO,MAAMH,gBAAA;UACPC,QAAA;YACE;EACV;AACF","ignoreList":[]}

package/dist/features/converters/lexicalToHtml/async/converters/text.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"text.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/text.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAItD,eAAO,MAAM,sBAAsB,EAAE,mBAAmB,CAAC,kBAAkB,CA4B1E,CAAA"}
+{"version":3,"file":"text.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/text.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAItD,eAAO,MAAM,sBAAsB,EAAE,mBAAmB,CAAC,kBAAkB,CA4B1E,CAAA"}

package/dist/features/converters/lexicalToHtml/async/converters/text.js

@@ -1,9 +1,10 @@
+import escapeHTML from 'escape-html';
 import { NodeFormat } from '../../../../../lexical/utils/nodeFormat.js';
 export const TextHTMLConverterAsync = {
   text: ({
     node
   }) => {
-    let text = node.text;
+    let text = escapeHTML(node.text);
     if (node.format & NodeFormat.IS_BOLD) {
       text = `<strong>${text}</strong>`;
     }

package/dist/features/converters/lexicalToHtml/async/converters/text.js.map

@@ -1 +1 @@
-{"version":3,"file":"text.js","names":["NodeFormat","TextHTMLConverterAsync","text","node","format","IS_BOLD","IS_ITALIC","IS_STRIKETHROUGH","IS_UNDERLINE","IS_CODE","IS_SUBSCRIPT","IS_SUPERSCRIPT"],"sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/text.ts"],"sourcesContent":["import type { SerializedTextNode } from '../../../../../nodeTypes.js'\nimport type { HTMLConvertersAsync } from '../types.js'\n\nimport { NodeFormat } from '../../../../../lexical/utils/nodeFormat.js'\n\nexport const TextHTMLConverterAsync: HTMLConvertersAsync<SerializedTextNode> = {\n  text: ({ node }) => {\n    let text = node.text\n\n    if (node.format & NodeFormat.IS_BOLD) {\n      text = `<strong>${text}</strong>`\n    }\n    if (node.format & NodeFormat.IS_ITALIC) {\n      text = `<em>${text}</em>`\n    }\n    if (node.format & NodeFormat.IS_STRIKETHROUGH) {\n      text = `<span style=\"text-decoration: line-through;\">${text}</span>`\n    }\n    if (node.format & NodeFormat.IS_UNDERLINE) {\n      text = `<span style=\"text-decoration: underline;\">${text}</span>`\n    }\n    if (node.format & NodeFormat.IS_CODE) {\n      text = `<code>${text}</code>`\n    }\n    if (node.format & NodeFormat.IS_SUBSCRIPT) {\n      text = `<sub>${text}</sub>`\n    }\n    if (node.format & NodeFormat.IS_SUPERSCRIPT) {\n      text = `<sup>${text}</sup>`\n    }\n\n    return text\n  },\n}\n"],"mappings":"AAGA,SAASA,UAAU,QAAQ;AAE3B,OAAO,MAAMC,sBAAA,GAAkE;EAC7EC,IAAA,EAAMA,CAAC;IAAEC;EAAI,CAAE;IACb,IAAID,IAAA,GAAOC,IAAA,CAAKD,IAAI;IAEpB,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWK,OAAO,EAAE;MACpCH,IAAA,GAAO,WAAWA,IAAA,WAAe;IACnC;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWM,SAAS,EAAE;MACtCJ,IAAA,GAAO,OAAOA,IAAA,OAAW;IAC3B;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWO,gBAAgB,EAAE;MAC7CL,IAAA,GAAO,gDAAgDA,IAAA,SAAa;IACtE;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWQ,YAAY,EAAE;MACzCN,IAAA,GAAO,6CAA6CA,IAAA,SAAa;IACnE;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWS,OAAO,EAAE;MACpCP,IAAA,GAAO,SAASA,IAAA,SAAa;IAC/B;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWU,YAAY,EAAE;MACzCR,IAAA,GAAO,QAAQA,IAAA,QAAY;IAC7B;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWW,cAAc,EAAE;MAC3CT,IAAA,GAAO,QAAQA,IAAA,QAAY;IAC7B;IAEA,OAAOA,IAAA;EACT;AACF","ignoreList":[]}
+{"version":3,"file":"text.js","names":["escapeHTML","NodeFormat","TextHTMLConverterAsync","text","node","format","IS_BOLD","IS_ITALIC","IS_STRIKETHROUGH","IS_UNDERLINE","IS_CODE","IS_SUBSCRIPT","IS_SUPERSCRIPT"],"sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/text.ts"],"sourcesContent":["import escapeHTML from 'escape-html'\n\nimport type { SerializedTextNode } from '../../../../../nodeTypes.js'\nimport type { HTMLConvertersAsync } from '../types.js'\n\nimport { NodeFormat } from '../../../../../lexical/utils/nodeFormat.js'\n\nexport const TextHTMLConverterAsync: HTMLConvertersAsync<SerializedTextNode> = {\n  text: ({ node }) => {\n    let text = escapeHTML(node.text)\n\n    if (node.format & NodeFormat.IS_BOLD) {\n      text = `<strong>${text}</strong>`\n    }\n    if (node.format & NodeFormat.IS_ITALIC) {\n      text = `<em>${text}</em>`\n    }\n    if (node.format & NodeFormat.IS_STRIKETHROUGH) {\n      text = `<span style=\"text-decoration: line-through;\">${text}</span>`\n    }\n    if (node.format & NodeFormat.IS_UNDERLINE) {\n      text = `<span style=\"text-decoration: underline;\">${text}</span>`\n    }\n    if (node.format & NodeFormat.IS_CODE) {\n      text = `<code>${text}</code>`\n    }\n    if (node.format & NodeFormat.IS_SUBSCRIPT) {\n      text = `<sub>${text}</sub>`\n    }\n    if (node.format & NodeFormat.IS_SUPERSCRIPT) {\n      text = `<sup>${text}</sup>`\n    }\n\n    return text\n  },\n}\n"],"mappings":"AAAA,OAAOA,UAAA,MAAgB;AAKvB,SAASC,UAAU,QAAQ;AAE3B,OAAO,MAAMC,sBAAA,GAAkE;EAC7EC,IAAA,EAAMA,CAAC;IAAEC;EAAI,CAAE;IACb,IAAID,IAAA,GAAOH,UAAA,CAAWI,IAAA,CAAKD,IAAI;IAE/B,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWK,OAAO,EAAE;MACpCH,IAAA,GAAO,WAAWA,IAAA,WAAe;IACnC;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWM,SAAS,EAAE;MACtCJ,IAAA,GAAO,OAAOA,IAAA,OAAW;IAC3B;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWO,gBAAgB,EAAE;MAC7CL,IAAA,GAAO,gDAAgDA,IAAA,SAAa;IACtE;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWQ,YAAY,EAAE;MACzCN,IAAA,GAAO,6CAA6CA,IAAA,SAAa;IACnE;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWS,OAAO,EAAE;MACpCP,IAAA,GAAO,SAASA,IAAA,SAAa;IAC/B;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWU,YAAY,EAAE;MACzCR,IAAA,GAAO,QAAQA,IAAA,QAAY;IAC7B;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWW,cAAc,EAAE;MAC3CT,IAAA,GAAO,QAAQA,IAAA,QAAY;IAC7B;IAEA,OAAOA,IAAA;EACT;AACF","ignoreList":[]}

package/dist/features/converters/lexicalToHtml/async/converters/upload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/upload.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAEvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAEtD,eAAO,MAAM,wBAAwB,EAAE,mBAAmB,CAAC,oBAAoB,CAkF9E,CAAA"}
+{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/upload.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAEvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAEtD,eAAO,MAAM,wBAAwB,EAAE,mBAAmB,CAAC,oBAAoB,CAoF9E,CAAA"}

package/dist/features/converters/lexicalToHtml/async/converters/upload.js

@@ -1,3 +1,4 @@
+import escapeHTML from 'escape-html';
 export const UploadHTMLConverterAsync = {
   upload: async ({
     node,
@@ -21,20 +22,20 @@ export const UploadHTMLConverterAsync = {
     if (!uploadDoc) {
       return '';
     }
-    const alt = node.fields?.alt || uploadDoc?.alt || '';
-    const url = uploadDoc.url;
+    const alt = escapeHTML(node.fields?.alt || uploadDoc?.alt || '');
+    const url = escapeHTML(uploadDoc.url ?? '');
     // 1) If upload is NOT an image, return a link
     if (!uploadDoc.mimeType.startsWith('image')) {
-      return `<a${providedStyleTag} href="${url}" rel="noopener noreferrer">${uploadDoc.filename}</a$>`;
+      return `<a${providedStyleTag} href="${url}" rel="noopener noreferrer">${escapeHTML(uploadDoc.filename ?? '')}</a>`;
     }
     // 2) If image has no different sizes, return a simple <img />
     if (!uploadDoc.sizes || !Object.keys(uploadDoc.sizes).length) {
       return `
         <img${providedStyleTag}
           alt="${alt}"
-          height="${uploadDoc.height}"
+          height="${escapeHTML(String(uploadDoc.height ?? ''))}"
           src="${url}"
-          width="${uploadDoc.width}"
+          width="${escapeHTML(String(uploadDoc.width ?? ''))}"
         />
       `;
     }
@@ -47,18 +48,18 @@ export const UploadHTMLConverterAsync = {
       }
       pictureHTML += `
         <source
-          media="(max-width: ${imageSize.width}px)"
-          srcset="${imageSize.url}"
-          type="${imageSize.mimeType}"
+          media="(max-width: ${escapeHTML(String(imageSize.width))}px)"
+          srcset="${escapeHTML(imageSize.url)}"
+          type="${escapeHTML(imageSize.mimeType)}"
         />
       `;
     }
     pictureHTML += `
       <img
         alt="${alt}"
-        height="${uploadDoc.height}"
+        height="${escapeHTML(String(uploadDoc.height ?? ''))}"
         src="${url}"
-        width="${uploadDoc.width}"
+        width="${escapeHTML(String(uploadDoc.width ?? ''))}"
       />
     `;
     return `<picture${providedStyleTag}>${pictureHTML}</picture>`;

package/dist/features/converters/lexicalToHtml/async/converters/upload.js.map

@@ -1 +1 @@
-{"version":3,"file":"upload.js","names":["UploadHTMLConverterAsync","upload","node","populate","providedStyleTag","uploadNode","uploadDoc","undefined","value","id","collectionSlug","relationTo","alt","fields","url","mimeType","startsWith","filename","sizes","Object","keys","length","height","width","pictureHTML","size","imageSize","filesize"],"sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/upload.ts"],"sourcesContent":["import type { FileData, FileSizeImproved, TypeWithID } from 'payload'\n\nimport type { SerializedUploadNode } from '../../../../../nodeTypes.js'\nimport type { UploadDataImproved } from '../../../../upload/server/nodes/UploadNode.js'\nimport type { HTMLConvertersAsync } from '../types.js'\n\nexport const UploadHTMLConverterAsync: HTMLConvertersAsync<SerializedUploadNode> = {\n  upload: async ({ node, populate, providedStyleTag }) => {\n    const uploadNode = node as UploadDataImproved\n\n    let uploadDoc: (FileData & TypeWithID) | undefined = undefined\n\n    // If there's no valid upload data, populate return an empty string\n    if (typeof uploadNode.value !== 'object') {\n      if (!populate) {\n        return ''\n      }\n      uploadDoc = await populate<FileData & TypeWithID>({\n        id: uploadNode.value,\n        collectionSlug: uploadNode.relationTo,\n      })\n    } else {\n      uploadDoc = uploadNode.value as unknown as FileData & TypeWithID\n    }\n\n    if (!uploadDoc) {\n      return ''\n    }\n\n    const alt = (node.fields?.alt as string) || (uploadDoc as { alt?: string })?.alt || ''\n\n    const url = uploadDoc.url\n\n    // 1) If upload is NOT an image, return a link\n    if (!uploadDoc.mimeType.startsWith('image')) {\n      return `<a${providedStyleTag} href=\"${url}\" rel=\"noopener noreferrer\">${uploadDoc.filename}</a$>`\n    }\n\n    // 2) If image has no different sizes, return a simple <img />\n    if (!uploadDoc.sizes || !Object.keys(uploadDoc.sizes).length) {\n      return `\n        <img${providedStyleTag}\n          alt=\"${alt}\"\n          height=\"${uploadDoc.height}\"\n          src=\"${url}\"\n          width=\"${uploadDoc.width}\"\n        />\n      `\n    }\n\n    // 3) If image has different sizes, build a <picture> element with <source> tags\n    let pictureHTML = ''\n\n    for (const size in uploadDoc.sizes) {\n      const imageSize = uploadDoc.sizes[size] as FileSizeImproved\n\n      if (\n        !imageSize ||\n        !imageSize.width ||\n        !imageSize.height ||\n        !imageSize.mimeType ||\n        !imageSize.filesize ||\n        !imageSize.filename ||\n        !imageSize.url\n      ) {\n        continue\n      }\n\n      pictureHTML += `\n        <source\n          media=\"(max-width: ${imageSize.width}px)\"\n          srcset=\"${imageSize.url}\"\n          type=\"${imageSize.mimeType}\"\n        />\n      `\n    }\n\n    pictureHTML += `\n      <img\n        alt=\"${alt}\"\n        height=\"${uploadDoc.height}\"\n        src=\"${url}\"\n        width=\"${uploadDoc.width}\"\n      />\n    `\n\n    return `<picture${providedStyleTag}>${pictureHTML}</picture>`\n  },\n}\n"],"mappings":"AAMA,OAAO,MAAMA,wBAAA,GAAsE;EACjFC,MAAA,EAAQ,MAAAA,CAAO;IAAEC,IAAI;IAAEC,QAAQ;IAAEC;EAAgB,CAAE;IACjD,MAAMC,UAAA,GAAaH,IAAA;IAEnB,IAAII,SAAA,GAAiDC,SAAA;IAErD;IACA,IAAI,OAAOF,UAAA,CAAWG,KAAK,KAAK,UAAU;MACxC,IAAI,CAACL,QAAA,EAAU;QACb,OAAO;MACT;MACAG,SAAA,GAAY,MAAMH,QAAA,CAAgC;QAChDM,EAAA,EAAIJ,UAAA,CAAWG,KAAK;QACpBE,cAAA,EAAgBL,UAAA,CAAWM;MAC7B;IACF,OAAO;MACLL,SAAA,GAAYD,UAAA,CAAWG,KAAK;IAC9B;IAEA,IAAI,CAACF,SAAA,EAAW;MACd,OAAO;IACT;IAEA,MAAMM,GAAA,GAAMV,IAAC,CAAKW,MAAM,EAAED,GAAA,IAAmBN,SAAA,EAAgCM,GAAA,IAAO;IAEpF,MAAME,GAAA,GAAMR,SAAA,CAAUQ,GAAG;IAEzB;IACA,IAAI,CAACR,SAAA,CAAUS,QAAQ,CAACC,UAAU,CAAC,UAAU;MAC3C,OAAO,KAAKZ,gBAAA,UAA0BU,GAAA,+BAAkCR,SAAA,CAAUW,QAAQ,OAAO;IACnG;IAEA;IACA,IAAI,CAACX,SAAA,CAAUY,KAAK,IAAI,CAACC,MAAA,CAAOC,IAAI,CAACd,SAAA,CAAUY,KAAK,EAAEG,MAAM,EAAE;MAC5D,OAAO;cACCjB,gBAAA;iBACGQ,GAAA;oBACGN,SAAA,CAAUgB,MAAM;iBACnBR,GAAA;mBACER,SAAA,CAAUiB,KAAK;;OAE3B;IACH;IAEA;IACA,IAAIC,WAAA,GAAc;IAElB,KAAK,MAAMC,IAAA,IAAQnB,SAAA,CAAUY,KAAK,EAAE;MAClC,MAAMQ,SAAA,GAAYpB,SAAA,CAAUY,KAAK,CAACO,IAAA,CAAK;MAEvC,IACE,CAACC,SAAA,IACD,CAACA,SAAA,CAAUH,KAAK,IAChB,CAACG,SAAA,CAAUJ,MAAM,IACjB,CAACI,SAAA,CAAUX,QAAQ,IACnB,CAACW,SAAA,CAAUC,QAAQ,IACnB,CAACD,SAAA,CAAUT,QAAQ,IACnB,CAACS,SAAA,CAAUZ,GAAG,EACd;QACA;MACF;MAEAU,WAAA,IAAe;;+BAEUE,SAAA,CAAUH,KAAK;oBAC1BG,SAAA,CAAUZ,GAAG;kBACfY,SAAA,CAAUX,QAAQ;;OAE7B;IACH;IAEAS,WAAA,IAAe;;eAEJZ,GAAA;kBACGN,SAAA,CAAUgB,MAAM;eACnBR,GAAA;iBACER,SAAA,CAAUiB,KAAK;;KAE3B;IAED,OAAO,WAAWnB,gBAAA,IAAoBoB,WAAA,YAAuB;EAC/D;AACF","ignoreList":[]}
+{"version":3,"file":"upload.js","names":["escapeHTML","UploadHTMLConverterAsync","upload","node","populate","providedStyleTag","uploadNode","uploadDoc","undefined","value","id","collectionSlug","relationTo","alt","fields","url","mimeType","startsWith","filename","sizes","Object","keys","length","String","height","width","pictureHTML","size","imageSize","filesize"],"sources":["../../../../../../src/features/converters/lexicalToHtml/async/converters/upload.ts"],"sourcesContent":["import type { FileData, FileSizeImproved, TypeWithID } from 'payload'\n\nimport escapeHTML from 'escape-html'\n\nimport type { SerializedUploadNode } from '../../../../../nodeTypes.js'\nimport type { UploadDataImproved } from '../../../../upload/server/nodes/UploadNode.js'\nimport type { HTMLConvertersAsync } from '../types.js'\n\nexport const UploadHTMLConverterAsync: HTMLConvertersAsync<SerializedUploadNode> = {\n  upload: async ({ node, populate, providedStyleTag }) => {\n    const uploadNode = node as UploadDataImproved\n\n    let uploadDoc: (FileData & TypeWithID) | undefined = undefined\n\n    // If there's no valid upload data, populate return an empty string\n    if (typeof uploadNode.value !== 'object') {\n      if (!populate) {\n        return ''\n      }\n      uploadDoc = await populate<FileData & TypeWithID>({\n        id: uploadNode.value,\n        collectionSlug: uploadNode.relationTo,\n      })\n    } else {\n      uploadDoc = uploadNode.value as unknown as FileData & TypeWithID\n    }\n\n    if (!uploadDoc) {\n      return ''\n    }\n\n    const alt = escapeHTML(\n      (node.fields?.alt as string) || (uploadDoc as { alt?: string })?.alt || '',\n    )\n\n    const url = escapeHTML(uploadDoc.url ?? '')\n\n    // 1) If upload is NOT an image, return a link\n    if (!uploadDoc.mimeType.startsWith('image')) {\n      return `<a${providedStyleTag} href=\"${url}\" rel=\"noopener noreferrer\">${escapeHTML(uploadDoc.filename ?? '')}</a>`\n    }\n\n    // 2) If image has no different sizes, return a simple <img />\n    if (!uploadDoc.sizes || !Object.keys(uploadDoc.sizes).length) {\n      return `\n        <img${providedStyleTag}\n          alt=\"${alt}\"\n          height=\"${escapeHTML(String(uploadDoc.height ?? ''))}\"\n          src=\"${url}\"\n          width=\"${escapeHTML(String(uploadDoc.width ?? ''))}\"\n        />\n      `\n    }\n\n    // 3) If image has different sizes, build a <picture> element with <source> tags\n    let pictureHTML = ''\n\n    for (const size in uploadDoc.sizes) {\n      const imageSize = uploadDoc.sizes[size] as FileSizeImproved\n\n      if (\n        !imageSize ||\n        !imageSize.width ||\n        !imageSize.height ||\n        !imageSize.mimeType ||\n        !imageSize.filesize ||\n        !imageSize.filename ||\n        !imageSize.url\n      ) {\n        continue\n      }\n\n      pictureHTML += `\n        <source\n          media=\"(max-width: ${escapeHTML(String(imageSize.width))}px)\"\n          srcset=\"${escapeHTML(imageSize.url)}\"\n          type=\"${escapeHTML(imageSize.mimeType)}\"\n        />\n      `\n    }\n\n    pictureHTML += `\n      <img\n        alt=\"${alt}\"\n        height=\"${escapeHTML(String(uploadDoc.height ?? ''))}\"\n        src=\"${url}\"\n        width=\"${escapeHTML(String(uploadDoc.width ?? ''))}\"\n      />\n    `\n\n    return `<picture${providedStyleTag}>${pictureHTML}</picture>`\n  },\n}\n"],"mappings":"AAEA,OAAOA,UAAA,MAAgB;AAMvB,OAAO,MAAMC,wBAAA,GAAsE;EACjFC,MAAA,EAAQ,MAAAA,CAAO;IAAEC,IAAI;IAAEC,QAAQ;IAAEC;EAAgB,CAAE;IACjD,MAAMC,UAAA,GAAaH,IAAA;IAEnB,IAAII,SAAA,GAAiDC,SAAA;IAErD;IACA,IAAI,OAAOF,UAAA,CAAWG,KAAK,KAAK,UAAU;MACxC,IAAI,CAACL,QAAA,EAAU;QACb,OAAO;MACT;MACAG,SAAA,GAAY,MAAMH,QAAA,CAAgC;QAChDM,EAAA,EAAIJ,UAAA,CAAWG,KAAK;QACpBE,cAAA,EAAgBL,UAAA,CAAWM;MAC7B;IACF,OAAO;MACLL,SAAA,GAAYD,UAAA,CAAWG,KAAK;IAC9B;IAEA,IAAI,CAACF,SAAA,EAAW;MACd,OAAO;IACT;IAEA,MAAMM,GAAA,GAAMb,UAAA,CACVG,IAAC,CAAKW,MAAM,EAAED,GAAA,IAAmBN,SAAA,EAAgCM,GAAA,IAAO;IAG1E,MAAME,GAAA,GAAMf,UAAA,CAAWO,SAAA,CAAUQ,GAAG,IAAI;IAExC;IACA,IAAI,CAACR,SAAA,CAAUS,QAAQ,CAACC,UAAU,CAAC,UAAU;MAC3C,OAAO,KAAKZ,gBAAA,UAA0BU,GAAA,+BAAkCf,UAAA,CAAWO,SAAA,CAAUW,QAAQ,IAAI,SAAS;IACpH;IAEA;IACA,IAAI,CAACX,SAAA,CAAUY,KAAK,IAAI,CAACC,MAAA,CAAOC,IAAI,CAACd,SAAA,CAAUY,KAAK,EAAEG,MAAM,EAAE;MAC5D,OAAO;cACCjB,gBAAA;iBACGQ,GAAA;oBACGb,UAAA,CAAWuB,MAAA,CAAOhB,SAAA,CAAUiB,MAAM,IAAI;iBACzCT,GAAA;mBACEf,UAAA,CAAWuB,MAAA,CAAOhB,SAAA,CAAUkB,KAAK,IAAI;;OAEjD;IACH;IAEA;IACA,IAAIC,WAAA,GAAc;IAElB,KAAK,MAAMC,IAAA,IAAQpB,SAAA,CAAUY,KAAK,EAAE;MAClC,MAAMS,SAAA,GAAYrB,SAAA,CAAUY,KAAK,CAACQ,IAAA,CAAK;MAEvC,IACE,CAACC,SAAA,IACD,CAACA,SAAA,CAAUH,KAAK,IAChB,CAACG,SAAA,CAAUJ,MAAM,IACjB,CAACI,SAAA,CAAUZ,QAAQ,IACnB,CAACY,SAAA,CAAUC,QAAQ,IACnB,CAACD,SAAA,CAAUV,QAAQ,IACnB,CAACU,SAAA,CAAUb,GAAG,EACd;QACA;MACF;MAEAW,WAAA,IAAe;;+BAEU1B,UAAA,CAAWuB,MAAA,CAAOK,SAAA,CAAUH,KAAK;oBAC5CzB,UAAA,CAAW4B,SAAA,CAAUb,GAAG;kBAC1Bf,UAAA,CAAW4B,SAAA,CAAUZ,QAAQ;;OAExC;IACH;IAEAU,WAAA,IAAe;;eAEJb,GAAA;kBACGb,UAAA,CAAWuB,MAAA,CAAOhB,SAAA,CAAUiB,MAAM,IAAI;eACzCT,GAAA;iBACEf,UAAA,CAAWuB,MAAA,CAAOhB,SAAA,CAAUkB,KAAK,IAAI;;KAEjD;IAED,OAAO,WAAWpB,gBAAA,IAAoBqB,WAAA,YAAuB;EAC/D;AACF","ignoreList":[]}

package/dist/features/converters/lexicalToHtml/shared/cssColors.d.ts

@@ -0,0 +1,5 @@
+/** Complete set of CSS named colors (CSS Color Level 4) plus common CSS-wide keywords */
+export declare const CSS_NAMED_COLORS: Set<string>;
+/** Returns true when `value` is a safe CSS color (named color, hex, rgb/a, hsl/a) */
+export declare const isSafeCssColor: (value: string) => boolean;
+//# sourceMappingURL=cssColors.d.ts.map

package/dist/features/converters/lexicalToHtml/shared/cssColors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cssColors.d.ts","sourceRoot":"","sources":["../../../../../src/features/converters/lexicalToHtml/shared/cssColors.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,eAAO,MAAM,gBAAgB,aA0J3B,CAAA;AAKF,qFAAqF;AACrF,eAAO,MAAM,cAAc,UAAW,MAAM,KAAG,OAE9C,CAAA"}

package/dist/features/converters/lexicalToHtml/shared/cssColors.js

@@ -0,0 +1,8 @@
+/** Complete set of CSS named colors (CSS Color Level 4) plus common CSS-wide keywords */export const CSS_NAMED_COLORS = new Set(['aliceblue', 'antiquewhite', 'aqua', 'aquamarine', 'azure', 'beige', 'bisque', 'black', 'blanchedalmond', 'blue', 'blueviolet', 'brown', 'burlywood', 'cadetblue', 'chartreuse', 'chocolate', 'coral', 'cornflowerblue', 'cornsilk', 'crimson', 'currentcolor', 'cyan', 'darkblue', 'darkcyan', 'darkgoldenrod', 'darkgray', 'darkgreen', 'darkgrey', 'darkkhaki', 'darkmagenta', 'darkolivegreen', 'darkorange', 'darkorchid', 'darkred', 'darksalmon', 'darkseagreen', 'darkslateblue', 'darkslategray', 'darkslategrey', 'darkturquoise', 'darkviolet', 'deeppink', 'deepskyblue', 'dimgray', 'dimgrey', 'dodgerblue', 'firebrick', 'floralwhite', 'forestgreen', 'fuchsia', 'gainsboro', 'ghostwhite', 'gold', 'goldenrod', 'gray', 'green', 'greenyellow', 'grey', 'honeydew', 'hotpink', 'indianred', 'indigo', 'inherit', 'initial', 'ivory', 'khaki', 'lavender', 'lavenderblush', 'lawngreen', 'lemonchiffon', 'lightblue', 'lightcoral', 'lightcyan', 'lightgoldenrodyellow', 'lightgray', 'lightgreen', 'lightgrey', 'lightpink', 'lightsalmon', 'lightseagreen', 'lightskyblue', 'lightslategray', 'lightslategrey', 'lightsteelblue', 'lightyellow', 'lime', 'limegreen', 'linen', 'magenta', 'maroon', 'mediumaquamarine', 'mediumblue', 'mediumorchid', 'mediumpurple', 'mediumseagreen', 'mediumslateblue', 'mediumspringgreen', 'mediumturquoise', 'mediumvioletred', 'midnightblue', 'mintcream', 'mistyrose', 'moccasin', 'navajowhite', 'navy', 'oldlace', 'olive', 'olivedrab', 'orange', 'orangered', 'orchid', 'palegoldenrod', 'palegreen', 'paleturquoise', 'palevioletred', 'papayawhip', 'peachpuff', 'peru', 'pink', 'plum', 'powderblue', 'purple', 'rebeccapurple', 'red', 'rosybrown', 'royalblue', 'saddlebrown', 'salmon', 'sandybrown', 'seagreen', 'seashell', 'sienna', 'silver', 'skyblue', 'slateblue', 'slategray', 'slategrey', 'snow', 'springgreen', 'steelblue', 'tan', 'teal', 'thistle', 'tomato', 'transparent', 'turquoise', 'unset', 'violet', 'wheat', 'white', 'whitesmoke', 'yellow', 'yellowgreen']);
+/** Matches hex, rgb/rgba, hsl/hsla functional notation */
+const SAFE_CSS_COLOR_FN = /^(?:#[0-9a-fA-F]{3,8}|rgba?\([\d,.\s/%]+\)|hsla?\([\d,.\s/%deg]+\))$/;
+/** Returns true when `value` is a safe CSS color (named color, hex, rgb/a, hsl/a) */
+export const isSafeCssColor = value => {
+  return SAFE_CSS_COLOR_FN.test(value) || CSS_NAMED_COLORS.has(value.toLowerCase());
+};
+//# sourceMappingURL=cssColors.js.map

package/dist/features/converters/lexicalToHtml/shared/cssColors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cssColors.js","names":["CSS_NAMED_COLORS","Set","SAFE_CSS_COLOR_FN","isSafeCssColor","value","test","has","toLowerCase"],"sources":["../../../../../src/features/converters/lexicalToHtml/shared/cssColors.ts"],"sourcesContent":["/** Complete set of CSS named colors (CSS Color Level 4) plus common CSS-wide keywords */\nexport const CSS_NAMED_COLORS = new Set([\n  'aliceblue',\n  'antiquewhite',\n  'aqua',\n  'aquamarine',\n  'azure',\n  'beige',\n  'bisque',\n  'black',\n  'blanchedalmond',\n  'blue',\n  'blueviolet',\n  'brown',\n  'burlywood',\n  'cadetblue',\n  'chartreuse',\n  'chocolate',\n  'coral',\n  'cornflowerblue',\n  'cornsilk',\n  'crimson',\n  'currentcolor',\n  'cyan',\n  'darkblue',\n  'darkcyan',\n  'darkgoldenrod',\n  'darkgray',\n  'darkgreen',\n  'darkgrey',\n  'darkkhaki',\n  'darkmagenta',\n  'darkolivegreen',\n  'darkorange',\n  'darkorchid',\n  'darkred',\n  'darksalmon',\n  'darkseagreen',\n  'darkslateblue',\n  'darkslategray',\n  'darkslategrey',\n  'darkturquoise',\n  'darkviolet',\n  'deeppink',\n  'deepskyblue',\n  'dimgray',\n  'dimgrey',\n  'dodgerblue',\n  'firebrick',\n  'floralwhite',\n  'forestgreen',\n  'fuchsia',\n  'gainsboro',\n  'ghostwhite',\n  'gold',\n  'goldenrod',\n  'gray',\n  'green',\n  'greenyellow',\n  'grey',\n  'honeydew',\n  'hotpink',\n  'indianred',\n  'indigo',\n  'inherit',\n  'initial',\n  'ivory',\n  'khaki',\n  'lavender',\n  'lavenderblush',\n  'lawngreen',\n  'lemonchiffon',\n  'lightblue',\n  'lightcoral',\n  'lightcyan',\n  'lightgoldenrodyellow',\n  'lightgray',\n  'lightgreen',\n  'lightgrey',\n  'lightpink',\n  'lightsalmon',\n  'lightseagreen',\n  'lightskyblue',\n  'lightslategray',\n  'lightslategrey',\n  'lightsteelblue',\n  'lightyellow',\n  'lime',\n  'limegreen',\n  'linen',\n  'magenta',\n  'maroon',\n  'mediumaquamarine',\n  'mediumblue',\n  'mediumorchid',\n  'mediumpurple',\n  'mediumseagreen',\n  'mediumslateblue',\n  'mediumspringgreen',\n  'mediumturquoise',\n  'mediumvioletred',\n  'midnightblue',\n  'mintcream',\n  'mistyrose',\n  'moccasin',\n  'navajowhite',\n  'navy',\n  'oldlace',\n  'olive',\n  'olivedrab',\n  'orange',\n  'orangered',\n  'orchid',\n  'palegoldenrod',\n  'palegreen',\n  'paleturquoise',\n  'palevioletred',\n  'papayawhip',\n  'peachpuff',\n  'peru',\n  'pink',\n  'plum',\n  'powderblue',\n  'purple',\n  'rebeccapurple',\n  'red',\n  'rosybrown',\n  'royalblue',\n  'saddlebrown',\n  'salmon',\n  'sandybrown',\n  'seagreen',\n  'seashell',\n  'sienna',\n  'silver',\n  'skyblue',\n  'slateblue',\n  'slategray',\n  'slategrey',\n  'snow',\n  'springgreen',\n  'steelblue',\n  'tan',\n  'teal',\n  'thistle',\n  'tomato',\n  'transparent',\n  'turquoise',\n  'unset',\n  'violet',\n  'wheat',\n  'white',\n  'whitesmoke',\n  'yellow',\n  'yellowgreen',\n])\n\n/** Matches hex, rgb/rgba, hsl/hsla functional notation */\nconst SAFE_CSS_COLOR_FN = /^(?:#[0-9a-fA-F]{3,8}|rgba?\\([\\d,.\\s/%]+\\)|hsla?\\([\\d,.\\s/%deg]+\\))$/\n\n/** Returns true when `value` is a safe CSS color (named color, hex, rgb/a, hsl/a) */\nexport const isSafeCssColor = (value: string): boolean => {\n  return SAFE_CSS_COLOR_FN.test(value) || CSS_NAMED_COLORS.has(value.toLowerCase())\n}\n"],"mappings":"AAAA,yFACA,OAAO,MAAMA,gBAAA,GAAmB,IAAIC,GAAA,CAAI,CACtC,aACA,gBACA,QACA,cACA,SACA,SACA,UACA,SACA,kBACA,QACA,cACA,SACA,aACA,aACA,cACA,aACA,SACA,kBACA,YACA,WACA,gBACA,QACA,YACA,YACA,iBACA,YACA,aACA,YACA,aACA,eACA,kBACA,cACA,cACA,WACA,cACA,gBACA,iBACA,iBACA,iBACA,iBACA,cACA,YACA,eACA,WACA,WACA,cACA,aACA,eACA,eACA,WACA,aACA,cACA,QACA,aACA,QACA,SACA,eACA,QACA,YACA,WACA,aACA,UACA,WACA,WACA,SACA,SACA,YACA,iBACA,aACA,gBACA,aACA,cACA,aACA,wBACA,aACA,cACA,aACA,aACA,eACA,iBACA,gBACA,kBACA,kBACA,kBACA,eACA,QACA,aACA,SACA,WACA,UACA,oBACA,cACA,gBACA,gBACA,kBACA,mBACA,qBACA,mBACA,mBACA,gBACA,aACA,aACA,YACA,eACA,QACA,WACA,SACA,aACA,UACA,aACA,UACA,iBACA,aACA,iBACA,iBACA,cACA,aACA,QACA,QACA,QACA,cACA,UACA,iBACA,OACA,aACA,aACA,eACA,UACA,cACA,YACA,YACA,UACA,UACA,WACA,aACA,aACA,aACA,QACA,eACA,aACA,OACA,QACA,WACA,UACA,eACA,aACA,SACA,UACA,SACA,SACA,cACA,UACA,cACD;AAED;AACA,MAAMC,iBAAA,GAAoB;AAE1B;AACA,OAAO,MAAMC,cAAA,GAAkBC,KAAA;EAC7B,OAAOF,iBAAA,CAAkBG,IAAI,CAACD,KAAA,KAAUJ,gBAAA,CAAiBM,GAAG,CAACF,KAAA,CAAMG,WAAW;AAChF","ignoreList":[]}

package/dist/features/converters/lexicalToHtml/sync/converters/heading.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"heading.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/heading.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD,eAAO,MAAM,oBAAoB,EAAE,cAAc,CAAC,qBAAqB,CAQtE,CAAA"}
+{"version":3,"file":"heading.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/heading.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAIjD,eAAO,MAAM,oBAAoB,EAAE,cAAc,CAAC,qBAAqB,CAUtE,CAAA"}

package/dist/features/converters/lexicalToHtml/sync/converters/heading.js

@@ -1,3 +1,4 @@
+const ALLOWED_HEADING_TAGS = new Set(['h1', 'h2', 'h3', 'h4', 'h5', 'h6']);
 export const HeadingHTMLConverter = {
   heading: ({
     node,
@@ -7,7 +8,8 @@ export const HeadingHTMLConverter = {
     const children = nodesToHTML({
       nodes: node.children
     }).join('');
-    return `<${node.tag}${providedStyleTag}>${children}</${node.tag}>`;
+    const tag = ALLOWED_HEADING_TAGS.has(node.tag) ? node.tag : 'h1';
+    return `<${tag}${providedStyleTag}>${children}</${tag}>`;
   }
 };
 //# sourceMappingURL=heading.js.map

package/dist/features/converters/lexicalToHtml/sync/converters/heading.js.map

@@ -1 +1 @@
-{"version":3,"file":"heading.js","names":["HeadingHTMLConverter","heading","node","nodesToHTML","providedStyleTag","children","nodes","join","tag"],"sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/heading.ts"],"sourcesContent":["import type { SerializedHeadingNode } from '../../../../../nodeTypes.js'\nimport type { HTMLConverters } from '../types.js'\n\nexport const HeadingHTMLConverter: HTMLConverters<SerializedHeadingNode> = {\n  heading: ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = nodesToHTML({\n      nodes: node.children,\n    }).join('')\n\n    return `<${node.tag}${providedStyleTag}>${children}</${node.tag}>`\n  },\n}\n"],"mappings":"AAGA,OAAO,MAAMA,oBAAA,GAA8D;EACzEC,OAAA,EAASA,CAAC;IAAEC,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IAC/C,MAAMC,QAAA,GAAWF,WAAA,CAAY;MAC3BG,KAAA,EAAOJ,IAAA,CAAKG;IACd,GAAGE,IAAI,CAAC;IAER,OAAO,IAAIL,IAAA,CAAKM,GAAG,GAAGJ,gBAAA,IAAoBC,QAAA,KAAaH,IAAA,CAAKM,GAAG,GAAG;EACpE;AACF","ignoreList":[]}
+{"version":3,"file":"heading.js","names":["ALLOWED_HEADING_TAGS","Set","HeadingHTMLConverter","heading","node","nodesToHTML","providedStyleTag","children","nodes","join","tag","has"],"sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/heading.ts"],"sourcesContent":["import type { SerializedHeadingNode } from '../../../../../nodeTypes.js'\nimport type { HTMLConverters } from '../types.js'\n\nconst ALLOWED_HEADING_TAGS = new Set(['h1', 'h2', 'h3', 'h4', 'h5', 'h6'])\n\nexport const HeadingHTMLConverter: HTMLConverters<SerializedHeadingNode> = {\n  heading: ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = nodesToHTML({\n      nodes: node.children,\n    }).join('')\n\n    const tag = ALLOWED_HEADING_TAGS.has(node.tag) ? node.tag : 'h1'\n\n    return `<${tag}${providedStyleTag}>${children}</${tag}>`\n  },\n}\n"],"mappings":"AAGA,MAAMA,oBAAA,GAAuB,IAAIC,GAAA,CAAI,CAAC,MAAM,MAAM,MAAM,MAAM,MAAM,KAAK;AAEzE,OAAO,MAAMC,oBAAA,GAA8D;EACzEC,OAAA,EAASA,CAAC;IAAEC,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IAC/C,MAAMC,QAAA,GAAWF,WAAA,CAAY;MAC3BG,KAAA,EAAOJ,IAAA,CAAKG;IACd,GAAGE,IAAI,CAAC;IAER,MAAMC,GAAA,GAAMV,oBAAA,CAAqBW,GAAG,CAACP,IAAA,CAAKM,GAAG,IAAIN,IAAA,CAAKM,GAAG,GAAG;IAE5D,OAAO,IAAIA,GAAA,GAAMJ,gBAAA,IAAoBC,QAAA,KAAaG,GAAA,GAAM;EAC1D;AACF","ignoreList":[]}

package/dist/features/converters/lexicalToHtml/sync/converters/link.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"link.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/link.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAC7F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD,eAAO,MAAM,iBAAiB,EAAE,CAAC,IAAI,EAAE;IACrC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,kBAAkB,CAAA;KAAE,KAAK,MAAM,CAAA;CACvE,KAAK,cAAc,CAAC,sBAAsB,GAAG,kBAAkB,CA2B9D,CAAA"}
+{"version":3,"file":"link.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/link.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAC7F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD,eAAO,MAAM,iBAAiB,EAAE,CAAC,IAAI,EAAE;IACrC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,kBAAkB,CAAA;KAAE,KAAK,MAAM,CAAA;CACvE,KAAK,cAAc,CAAC,sBAAsB,GAAG,kBAAkB,CAgC9D,CAAA"}

package/dist/features/converters/lexicalToHtml/sync/converters/link.js

@@ -1,3 +1,5 @@
+import escapeHTML from 'escape-html';
+import { sanitizeUrl } from 'payload/shared';
 export const LinkHTMLConverter = ({
   internalDocToHref
 }) => ({
@@ -9,7 +11,8 @@ export const LinkHTMLConverter = ({
     const children = nodesToHTML({
       nodes: node.children
     }).join('');
-    return `<a${providedStyleTag} href="${node.fields.url}"${node.fields.newTab ? ' rel="noopener noreferrer" target="_blank"' : ''}>${children}</a>`;
+    const href = escapeHTML(sanitizeUrl(node.fields.url ?? ''));
+    return `<a${providedStyleTag} href="${href}"${node.fields.newTab ? ' rel="noopener noreferrer" target="_blank"' : ''}>${children}</a>`;
   },
   link: ({
     node,
@@ -26,11 +29,13 @@ export const LinkHTMLConverter = ({
           linkNode: node
         });
       } else {
+        // eslint-disable-next-line no-console
         console.error('Lexical => HTML converter: Link converter: found internal link, but internalDocToHref is not provided');
         href = '#'; // fallback
       }
     }
-    return `<a${providedStyleTag} href="${href}"${node.fields.newTab ? ' rel="noopener noreferrer" target="_blank"' : ''}>${children}</a>`;
+    const safeHref = escapeHTML(sanitizeUrl(href));
+    return `<a${providedStyleTag} href="${safeHref}"${node.fields.newTab ? ' rel="noopener noreferrer" target="_blank"' : ''}>${children}</a>`;
   }
 });
 //# sourceMappingURL=link.js.map

package/dist/features/converters/lexicalToHtml/sync/converters/link.js.map

@@ -1 +1 @@
-{"version":3,"file":"link.js","names":["LinkHTMLConverter","internalDocToHref","autolink","node","nodesToHTML","providedStyleTag","children","nodes","join","fields","url","newTab","link","href","linkType","linkNode","console","error"],"sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/link.ts"],"sourcesContent":["import type { SerializedAutoLinkNode, SerializedLinkNode } from '../../../../../nodeTypes.js'\nimport type { HTMLConverters } from '../types.js'\n\nexport const LinkHTMLConverter: (args: {\n  internalDocToHref?: (args: { linkNode: SerializedLinkNode }) => string\n}) => HTMLConverters<SerializedAutoLinkNode | SerializedLinkNode> = ({ internalDocToHref }) => ({\n  autolink: ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = nodesToHTML({\n      nodes: node.children,\n    }).join('')\n\n    return `<a${providedStyleTag} href=\"${node.fields.url}\"${node.fields.newTab ? ' rel=\"noopener noreferrer\" target=\"_blank\"' : ''}>${children}</a>`\n  },\n  link: ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = nodesToHTML({\n      nodes: node.children,\n    }).join('')\n\n    let href: string = node.fields.url ?? ''\n    if (node.fields.linkType === 'internal') {\n      if (internalDocToHref) {\n        href = internalDocToHref({ linkNode: node })\n      } else {\n        console.error(\n          'Lexical => HTML converter: Link converter: found internal link, but internalDocToHref is not provided',\n        )\n        href = '#' // fallback\n      }\n    }\n\n    return `<a${providedStyleTag} href=\"${href}\"${node.fields.newTab ? ' rel=\"noopener noreferrer\" target=\"_blank\"' : ''}>${children}</a>`\n  },\n})\n"],"mappings":"AAGA,OAAO,MAAMA,iBAAA,GAEuDA,CAAC;EAAEC;AAAiB,CAAE,MAAM;EAC9FC,QAAA,EAAUA,CAAC;IAAEC,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IAChD,MAAMC,QAAA,GAAWF,WAAA,CAAY;MAC3BG,KAAA,EAAOJ,IAAA,CAAKG;IACd,GAAGE,IAAI,CAAC;IAER,OAAO,KAAKH,gBAAA,UAA0BF,IAAA,CAAKM,MAAM,CAACC,GAAG,IAAIP,IAAA,CAAKM,MAAM,CAACE,MAAM,GAAG,+CAA+C,MAAML,QAAA,MAAc;EACnJ;EACAM,IAAA,EAAMA,CAAC;IAAET,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IAC5C,MAAMC,QAAA,GAAWF,WAAA,CAAY;MAC3BG,KAAA,EAAOJ,IAAA,CAAKG;IACd,GAAGE,IAAI,CAAC;IAER,IAAIK,IAAA,GAAeV,IAAA,CAAKM,MAAM,CAACC,GAAG,IAAI;IACtC,IAAIP,IAAA,CAAKM,MAAM,CAACK,QAAQ,KAAK,YAAY;MACvC,IAAIb,iBAAA,EAAmB;QACrBY,IAAA,GAAOZ,iBAAA,CAAkB;UAAEc,QAAA,EAAUZ;QAAK;MAC5C,OAAO;QACLa,OAAA,CAAQC,KAAK,CACX;QAEFJ,IAAA,GAAO,KAAI;MACb;IACF;IAEA,OAAO,KAAKR,gBAAA,UAA0BQ,IAAA,IAAQV,IAAA,CAAKM,MAAM,CAACE,MAAM,GAAG,+CAA+C,MAAML,QAAA,MAAc;EACxI;AACF","ignoreList":[]}
+{"version":3,"file":"link.js","names":["escapeHTML","sanitizeUrl","LinkHTMLConverter","internalDocToHref","autolink","node","nodesToHTML","providedStyleTag","children","nodes","join","href","fields","url","newTab","link","linkType","linkNode","console","error","safeHref"],"sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/link.ts"],"sourcesContent":["import escapeHTML from 'escape-html'\nimport { sanitizeUrl } from 'payload/shared'\n\nimport type { SerializedAutoLinkNode, SerializedLinkNode } from '../../../../../nodeTypes.js'\nimport type { HTMLConverters } from '../types.js'\n\nexport const LinkHTMLConverter: (args: {\n  internalDocToHref?: (args: { linkNode: SerializedLinkNode }) => string\n}) => HTMLConverters<SerializedAutoLinkNode | SerializedLinkNode> = ({ internalDocToHref }) => ({\n  autolink: ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = nodesToHTML({\n      nodes: node.children,\n    }).join('')\n\n    const href = escapeHTML(sanitizeUrl(node.fields.url ?? ''))\n\n    return `<a${providedStyleTag} href=\"${href}\"${node.fields.newTab ? ' rel=\"noopener noreferrer\" target=\"_blank\"' : ''}>${children}</a>`\n  },\n  link: ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = nodesToHTML({\n      nodes: node.children,\n    }).join('')\n\n    let href: string = node.fields.url ?? ''\n    if (node.fields.linkType === 'internal') {\n      if (internalDocToHref) {\n        href = internalDocToHref({ linkNode: node })\n      } else {\n        // eslint-disable-next-line no-console\n        console.error(\n          'Lexical => HTML converter: Link converter: found internal link, but internalDocToHref is not provided',\n        )\n        href = '#' // fallback\n      }\n    }\n\n    const safeHref = escapeHTML(sanitizeUrl(href))\n\n    return `<a${providedStyleTag} href=\"${safeHref}\"${node.fields.newTab ? ' rel=\"noopener noreferrer\" target=\"_blank\"' : ''}>${children}</a>`\n  },\n})\n"],"mappings":"AAAA,OAAOA,UAAA,MAAgB;AACvB,SAASC,WAAW,QAAQ;AAK5B,OAAO,MAAMC,iBAAA,GAEuDA,CAAC;EAAEC;AAAiB,CAAE,MAAM;EAC9FC,QAAA,EAAUA,CAAC;IAAEC,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IAChD,MAAMC,QAAA,GAAWF,WAAA,CAAY;MAC3BG,KAAA,EAAOJ,IAAA,CAAKG;IACd,GAAGE,IAAI,CAAC;IAER,MAAMC,IAAA,GAAOX,UAAA,CAAWC,WAAA,CAAYI,IAAA,CAAKO,MAAM,CAACC,GAAG,IAAI;IAEvD,OAAO,KAAKN,gBAAA,UAA0BI,IAAA,IAAQN,IAAA,CAAKO,MAAM,CAACE,MAAM,GAAG,+CAA+C,MAAMN,QAAA,MAAc;EACxI;EACAO,IAAA,EAAMA,CAAC;IAAEV,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IAC5C,MAAMC,QAAA,GAAWF,WAAA,CAAY;MAC3BG,KAAA,EAAOJ,IAAA,CAAKG;IACd,GAAGE,IAAI,CAAC;IAER,IAAIC,IAAA,GAAeN,IAAA,CAAKO,MAAM,CAACC,GAAG,IAAI;IACtC,IAAIR,IAAA,CAAKO,MAAM,CAACI,QAAQ,KAAK,YAAY;MACvC,IAAIb,iBAAA,EAAmB;QACrBQ,IAAA,GAAOR,iBAAA,CAAkB;UAAEc,QAAA,EAAUZ;QAAK;MAC5C,OAAO;QACL;QACAa,OAAA,CAAQC,KAAK,CACX;QAEFR,IAAA,GAAO,KAAI;MACb;IACF;IAEA,MAAMS,QAAA,GAAWpB,UAAA,CAAWC,WAAA,CAAYU,IAAA;IAExC,OAAO,KAAKJ,gBAAA,UAA0Ba,QAAA,IAAYf,IAAA,CAAKO,MAAM,CAACE,MAAM,GAAG,+CAA+C,MAAMN,QAAA,MAAc;EAC5I;AACF","ignoreList":[]}

package/dist/features/converters/lexicalToHtml/sync/converters/list.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/list.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAC7F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD,eAAO,MAAM,iBAAiB,EAAE,cAAc,CAAC,sBAAsB,GAAG,kBAAkB,CAyCzF,CAAA"}
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/list.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAC7F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAKjD,eAAO,MAAM,iBAAiB,EAAE,cAAc,CAAC,sBAAsB,GAAG,kBAAkB,CA4CzF,CAAA"}

package/dist/features/converters/lexicalToHtml/sync/converters/list.js

@@ -1,4 +1,6 @@
 import { v4 as uuidv4 } from 'uuid';
+const ALLOWED_LIST_TAGS = new Set(['ol', 'ul']);
+const ALLOWED_LIST_TYPES = new Set(['bullet', 'check', 'number']);
 export const ListHTMLConverter = {
   list: ({
     node,
@@ -8,7 +10,9 @@ export const ListHTMLConverter = {
     const children = nodesToHTML({
       nodes: node.children
     }).join('');
-    return `<${node.tag}${providedStyleTag} class="list-${node.listType}">${children}</${node.tag}>`;
+    const tag = ALLOWED_LIST_TAGS.has(node.tag) ? node.tag : 'ul';
+    const listType = ALLOWED_LIST_TYPES.has(node.listType) ? node.listType : 'bullet';
+    return `<${tag}${providedStyleTag} class="list-${listType}">${children}</${tag}>`;
   },
   listitem: ({
     node,

package/dist/features/converters/lexicalToHtml/sync/converters/list.js.map

@@ -1 +1 @@
-{"version":3,"file":"list.js","names":["v4","uuidv4","ListHTMLConverter","list","node","nodesToHTML","providedStyleTag","children","nodes","join","tag","listType","listitem","parent","providedCSSString","hasSubLists","some","child","type","uuid","checked","value"],"sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/list.ts"],"sourcesContent":["import { v4 as uuidv4 } from 'uuid'\n\nimport type { SerializedListItemNode, SerializedListNode } from '../../../../../nodeTypes.js'\nimport type { HTMLConverters } from '../types.js'\n\nexport const ListHTMLConverter: HTMLConverters<SerializedListItemNode | SerializedListNode> = {\n  list: ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = nodesToHTML({\n      nodes: node.children,\n    }).join('')\n\n    return `<${node.tag}${providedStyleTag} class=\"list-${node.listType}\">${children}</${node.tag}>`\n  },\n  listitem: ({ node, nodesToHTML, parent, providedCSSString }) => {\n    const hasSubLists = node.children.some((child) => child.type === 'list')\n\n    const children = nodesToHTML({\n      nodes: node.children,\n    }).join('')\n\n    if ('listType' in parent && parent?.listType === 'check') {\n      const uuid = uuidv4()\n      return `<li\n          aria-checked=\"${node.checked ? 'true' : 'false'}\"\n          class=\"list-item-checkbox${node.checked ? ' list-item-checkbox-checked' : ' list-item-checkbox-unchecked'}${hasSubLists ? ' nestedListItem' : ''}\"\n          role=\"checkbox\"\n          style=\"list-style-type: none;${providedCSSString}\"\n          tabIndex=\"-1\"\n          value=\"${node.value}\"\n        >\n          ${\n            hasSubLists\n              ? children\n              : `<input${node.checked ? ' checked' : ''} id=\"${uuid}\" readOnly=\"true\" type=\"checkbox\" />\n            <label htmlFor=\"${uuid}\">${children}</label>\n            <br />`\n          }\n        </li>`\n    } else {\n      return `<li\n          class=\"${hasSubLists ? 'nestedListItem' : ''}\"\n          style=\"${hasSubLists ? `list-style-type: none;${providedCSSString}` : providedCSSString}\"\n          value=\"${node.value}\"\n        >${children}</li>`\n    }\n  },\n}\n"],"mappings":"AAAA,SAASA,EAAA,IAAMC,MAAM,QAAQ;AAK7B,OAAO,MAAMC,iBAAA,GAAiF;EAC5FC,IAAA,EAAMA,CAAC;IAAEC,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IAC5C,MAAMC,QAAA,GAAWF,WAAA,CAAY;MAC3BG,KAAA,EAAOJ,IAAA,CAAKG;IACd,GAAGE,IAAI,CAAC;IAER,OAAO,IAAIL,IAAA,CAAKM,GAAG,GAAGJ,gBAAA,gBAAgCF,IAAA,CAAKO,QAAQ,KAAKJ,QAAA,KAAaH,IAAA,CAAKM,GAAG,GAAG;EAClG;EACAE,QAAA,EAAUA,CAAC;IAAER,IAAI;IAAEC,WAAW;IAAEQ,MAAM;IAAEC;EAAiB,CAAE;IACzD,MAAMC,WAAA,GAAcX,IAAA,CAAKG,QAAQ,CAACS,IAAI,CAAEC,KAAA,IAAUA,KAAA,CAAMC,IAAI,KAAK;IAEjE,MAAMX,QAAA,GAAWF,WAAA,CAAY;MAC3BG,KAAA,EAAOJ,IAAA,CAAKG;IACd,GAAGE,IAAI,CAAC;IAER,IAAI,cAAcI,MAAA,IAAUA,MAAA,EAAQF,QAAA,KAAa,SAAS;MACxD,MAAMQ,IAAA,GAAOlB,MAAA;MACb,OAAO;0BACaG,IAAA,CAAKgB,OAAO,GAAG,SAAS;qCACbhB,IAAA,CAAKgB,OAAO,GAAG,gCAAgC,kCAAkCL,WAAA,GAAc,oBAAoB;;yCAE/GD,iBAAA;;mBAEtBV,IAAA,CAAKiB,KAAK;;YAGjBN,WAAA,GACIR,QAAA,GACA,SAASH,IAAA,CAAKgB,OAAO,GAAG,aAAa,UAAUD,IAAA;8BACjCA,IAAA,KAASZ,QAAA;mBACpB;cAEL;IACV,OAAO;MACL,OAAO;mBACMQ,WAAA,GAAc,mBAAmB;mBACjCA,WAAA,GAAc,yBAAyBD,iBAAA,EAAmB,GAAGA,iBAAA;mBAC7DV,IAAA,CAAKiB,KAAK;WAClBd,QAAA,OAAe;IACtB;EACF;AACF","ignoreList":[]}
+{"version":3,"file":"list.js","names":["v4","uuidv4","ALLOWED_LIST_TAGS","Set","ALLOWED_LIST_TYPES","ListHTMLConverter","list","node","nodesToHTML","providedStyleTag","children","nodes","join","tag","has","listType","listitem","parent","providedCSSString","hasSubLists","some","child","type","uuid","checked","value"],"sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/list.ts"],"sourcesContent":["import { v4 as uuidv4 } from 'uuid'\n\nimport type { SerializedListItemNode, SerializedListNode } from '../../../../../nodeTypes.js'\nimport type { HTMLConverters } from '../types.js'\n\nconst ALLOWED_LIST_TAGS = new Set(['ol', 'ul'])\nconst ALLOWED_LIST_TYPES = new Set(['bullet', 'check', 'number'])\n\nexport const ListHTMLConverter: HTMLConverters<SerializedListItemNode | SerializedListNode> = {\n  list: ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = nodesToHTML({\n      nodes: node.children,\n    }).join('')\n\n    const tag = ALLOWED_LIST_TAGS.has(node.tag) ? node.tag : 'ul'\n    const listType = ALLOWED_LIST_TYPES.has(node.listType) ? node.listType : 'bullet'\n\n    return `<${tag}${providedStyleTag} class=\"list-${listType}\">${children}</${tag}>`\n  },\n  listitem: ({ node, nodesToHTML, parent, providedCSSString }) => {\n    const hasSubLists = node.children.some((child) => child.type === 'list')\n\n    const children = nodesToHTML({\n      nodes: node.children,\n    }).join('')\n\n    if ('listType' in parent && parent?.listType === 'check') {\n      const uuid = uuidv4()\n      return `<li\n          aria-checked=\"${node.checked ? 'true' : 'false'}\"\n          class=\"list-item-checkbox${node.checked ? ' list-item-checkbox-checked' : ' list-item-checkbox-unchecked'}${hasSubLists ? ' nestedListItem' : ''}\"\n          role=\"checkbox\"\n          style=\"list-style-type: none;${providedCSSString}\"\n          tabIndex=\"-1\"\n          value=\"${node.value}\"\n        >\n          ${\n            hasSubLists\n              ? children\n              : `<input${node.checked ? ' checked' : ''} id=\"${uuid}\" readOnly=\"true\" type=\"checkbox\" />\n            <label htmlFor=\"${uuid}\">${children}</label>\n            <br />`\n          }\n        </li>`\n    } else {\n      return `<li\n          class=\"${hasSubLists ? 'nestedListItem' : ''}\"\n          style=\"${hasSubLists ? `list-style-type: none;${providedCSSString}` : providedCSSString}\"\n          value=\"${node.value}\"\n        >${children}</li>`\n    }\n  },\n}\n"],"mappings":"AAAA,SAASA,EAAA,IAAMC,MAAM,QAAQ;AAK7B,MAAMC,iBAAA,GAAoB,IAAIC,GAAA,CAAI,CAAC,MAAM,KAAK;AAC9C,MAAMC,kBAAA,GAAqB,IAAID,GAAA,CAAI,CAAC,UAAU,SAAS,SAAS;AAEhE,OAAO,MAAME,iBAAA,GAAiF;EAC5FC,IAAA,EAAMA,CAAC;IAAEC,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IAC5C,MAAMC,QAAA,GAAWF,WAAA,CAAY;MAC3BG,KAAA,EAAOJ,IAAA,CAAKG;IACd,GAAGE,IAAI,CAAC;IAER,MAAMC,GAAA,GAAMX,iBAAA,CAAkBY,GAAG,CAACP,IAAA,CAAKM,GAAG,IAAIN,IAAA,CAAKM,GAAG,GAAG;IACzD,MAAME,QAAA,GAAWX,kBAAA,CAAmBU,GAAG,CAACP,IAAA,CAAKQ,QAAQ,IAAIR,IAAA,CAAKQ,QAAQ,GAAG;IAEzE,OAAO,IAAIF,GAAA,GAAMJ,gBAAA,gBAAgCM,QAAA,KAAaL,QAAA,KAAaG,GAAA,GAAM;EACnF;EACAG,QAAA,EAAUA,CAAC;IAAET,IAAI;IAAEC,WAAW;IAAES,MAAM;IAAEC;EAAiB,CAAE;IACzD,MAAMC,WAAA,GAAcZ,IAAA,CAAKG,QAAQ,CAACU,IAAI,CAAEC,KAAA,IAAUA,KAAA,CAAMC,IAAI,KAAK;IAEjE,MAAMZ,QAAA,GAAWF,WAAA,CAAY;MAC3BG,KAAA,EAAOJ,IAAA,CAAKG;IACd,GAAGE,IAAI,CAAC;IAER,IAAI,cAAcK,MAAA,IAAUA,MAAA,EAAQF,QAAA,KAAa,SAAS;MACxD,MAAMQ,IAAA,GAAOtB,MAAA;MACb,OAAO;0BACaM,IAAA,CAAKiB,OAAO,GAAG,SAAS;qCACbjB,IAAA,CAAKiB,OAAO,GAAG,gCAAgC,kCAAkCL,WAAA,GAAc,oBAAoB;;yCAE/GD,iBAAA;;mBAEtBX,IAAA,CAAKkB,KAAK;;YAGjBN,WAAA,GACIT,QAAA,GACA,SAASH,IAAA,CAAKiB,OAAO,GAAG,aAAa,UAAUD,IAAA;8BACjCA,IAAA,KAASb,QAAA;mBACpB;cAEL;IACV,OAAO;MACL,OAAO;mBACMS,WAAA,GAAc,mBAAmB;mBACjCA,WAAA,GAAc,yBAAyBD,iBAAA,EAAmB,GAAGA,iBAAA;mBAC7DX,IAAA,CAAKkB,KAAK;WAClBf,QAAA,OAAe;IACtB;EACF;AACF","ignoreList":[]}

package/dist/features/converters/lexicalToHtml/sync/converters/table.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"table.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/table.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACvB,MAAM,6BAA6B,CAAA;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD,eAAO,MAAM,kBAAkB,EAAE,cAAc,CAC7C,uBAAuB,GAAG,mBAAmB,GAAG,sBAAsB,CAkDvE,CAAA"}
+{"version":3,"file":"table.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/table.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACvB,MAAM,6BAA6B,CAAA;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAIjD,eAAO,MAAM,kBAAkB,EAAE,cAAc,CAC7C,uBAAuB,GAAG,mBAAmB,GAAG,sBAAsB,CAkDvE,CAAA"}

package/dist/features/converters/lexicalToHtml/sync/converters/table.js

@@ -1,3 +1,4 @@
+import { isSafeCssColor } from '../../shared/cssColors.js';
 export const TableHTMLConverter = {
   table: ({
     node,
@@ -24,7 +25,7 @@ export const TableHTMLConverter = {
     const TagName = node.headerState > 0 ? 'th' : 'td';
     const headerStateClass = `lexical-table-cell-header-${node.headerState}`;
     let style = 'border: 1px solid #ccc; padding: 8px;' + providedCSSString;
-    if (node.backgroundColor) {
+    if (node.backgroundColor && isSafeCssColor(node.backgroundColor)) {
       style += ` background-color: ${node.backgroundColor};`;
     }
     const colSpanAttr = node.colSpan && node.colSpan > 1 ? ` colspan="${node.colSpan}"` : '';

package/dist/features/converters/lexicalToHtml/sync/converters/table.js.map

@@ -1 +1 @@
-{"version":3,"file":"table.js","names":["TableHTMLConverter","table","node","nodesToHTML","providedStyleTag","children","nodes","join","tablecell","providedCSSString","TagName","headerState","headerStateClass","style","backgroundColor","colSpanAttr","colSpan","rowSpanAttr","rowSpan","tablerow"],"sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/table.ts"],"sourcesContent":["import type {\n  SerializedTableCellNode,\n  SerializedTableNode,\n  SerializedTableRowNode,\n} from '../../../../../nodeTypes.js'\nimport type { HTMLConverters } from '../types.js'\n\nexport const TableHTMLConverter: HTMLConverters<\n  SerializedTableCellNode | SerializedTableNode | SerializedTableRowNode\n> = {\n  table: ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = nodesToHTML({\n      nodes: node.children,\n    }).join('')\n\n    return `<div${providedStyleTag} class=\"lexical-table-container\">\n        <table class=\"lexical-table\" style=\"border-collapse: collapse;\">\n          <tbody>${children}</tbody>\n        </table>\n      </div>`\n  },\n\n  tablecell: ({ node, nodesToHTML, providedCSSString }) => {\n    const children = nodesToHTML({\n      nodes: node.children,\n    }).join('')\n\n    const TagName = node.headerState > 0 ? 'th' : 'td'\n    const headerStateClass = `lexical-table-cell-header-${node.headerState}`\n\n    let style = 'border: 1px solid #ccc; padding: 8px;' + providedCSSString\n    if (node.backgroundColor) {\n      style += ` background-color: ${node.backgroundColor};`\n    }\n\n    const colSpanAttr = node.colSpan && node.colSpan > 1 ? ` colspan=\"${node.colSpan}\"` : ''\n    const rowSpanAttr = node.rowSpan && node.rowSpan > 1 ? ` rowspan=\"${node.rowSpan}\"` : ''\n\n    return `<${TagName}\n        class=\"lexical-table-cell ${headerStateClass}\"\n        ${colSpanAttr}\n        ${rowSpanAttr}\n        style=\"${style}\"\n      >\n        ${children}\n      </${TagName}>\n    `\n  },\n\n  tablerow: ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = nodesToHTML({\n      nodes: node.children,\n    }).join('')\n\n    return `<tr${providedStyleTag} class=\"lexical-table-row\">\n        ${children}\n      </tr>`\n  },\n}\n"],"mappings":"AAOA,OAAO,MAAMA,kBAAA,GAET;EACFC,KAAA,EAAOA,CAAC;IAAEC,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IAC7C,MAAMC,QAAA,GAAWF,WAAA,CAAY;MAC3BG,KAAA,EAAOJ,IAAA,CAAKG;IACd,GAAGE,IAAI,CAAC;IAER,OAAO,OAAOH,gBAAA;;mBAECC,QAAA;;aAEN;EACX;EAEAG,SAAA,EAAWA,CAAC;IAAEN,IAAI;IAAEC,WAAW;IAAEM;EAAiB,CAAE;IAClD,MAAMJ,QAAA,GAAWF,WAAA,CAAY;MAC3BG,KAAA,EAAOJ,IAAA,CAAKG;IACd,GAAGE,IAAI,CAAC;IAER,MAAMG,OAAA,GAAUR,IAAA,CAAKS,WAAW,GAAG,IAAI,OAAO;IAC9C,MAAMC,gBAAA,GAAmB,6BAA6BV,IAAA,CAAKS,WAAW,EAAE;IAExE,IAAIE,KAAA,GAAQ,0CAA0CJ,iBAAA;IACtD,IAAIP,IAAA,CAAKY,eAAe,EAAE;MACxBD,KAAA,IAAS,sBAAsBX,IAAA,CAAKY,eAAe,GAAG;IACxD;IAEA,MAAMC,WAAA,GAAcb,IAAA,CAAKc,OAAO,IAAId,IAAA,CAAKc,OAAO,GAAG,IAAI,aAAad,IAAA,CAAKc,OAAO,GAAG,GAAG;IACtF,MAAMC,WAAA,GAAcf,IAAA,CAAKgB,OAAO,IAAIhB,IAAA,CAAKgB,OAAO,GAAG,IAAI,aAAahB,IAAA,CAAKgB,OAAO,GAAG,GAAG;IAEtF,OAAO,IAAIR,OAAA;oCACqBE,gBAAA;UAC1BG,WAAA;UACAE,WAAA;iBACOJ,KAAA;;UAEPR,QAAA;UACAK,OAAA;KACL;EACH;EAEAS,QAAA,EAAUA,CAAC;IAAEjB,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IAChD,MAAMC,QAAA,GAAWF,WAAA,CAAY;MAC3BG,KAAA,EAAOJ,IAAA,CAAKG;IACd,GAAGE,IAAI,CAAC;IAER,OAAO,MAAMH,gBAAA;UACPC,QAAA;YACE;EACV;AACF","ignoreList":[]}
+{"version":3,"file":"table.js","names":["isSafeCssColor","TableHTMLConverter","table","node","nodesToHTML","providedStyleTag","children","nodes","join","tablecell","providedCSSString","TagName","headerState","headerStateClass","style","backgroundColor","colSpanAttr","colSpan","rowSpanAttr","rowSpan","tablerow"],"sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/table.ts"],"sourcesContent":["import type {\n  SerializedTableCellNode,\n  SerializedTableNode,\n  SerializedTableRowNode,\n} from '../../../../../nodeTypes.js'\nimport type { HTMLConverters } from '../types.js'\n\nimport { isSafeCssColor } from '../../shared/cssColors.js'\n\nexport const TableHTMLConverter: HTMLConverters<\n  SerializedTableCellNode | SerializedTableNode | SerializedTableRowNode\n> = {\n  table: ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = nodesToHTML({\n      nodes: node.children,\n    }).join('')\n\n    return `<div${providedStyleTag} class=\"lexical-table-container\">\n        <table class=\"lexical-table\" style=\"border-collapse: collapse;\">\n          <tbody>${children}</tbody>\n        </table>\n      </div>`\n  },\n\n  tablecell: ({ node, nodesToHTML, providedCSSString }) => {\n    const children = nodesToHTML({\n      nodes: node.children,\n    }).join('')\n\n    const TagName = node.headerState > 0 ? 'th' : 'td'\n    const headerStateClass = `lexical-table-cell-header-${node.headerState}`\n\n    let style = 'border: 1px solid #ccc; padding: 8px;' + providedCSSString\n    if (node.backgroundColor && isSafeCssColor(node.backgroundColor)) {\n      style += ` background-color: ${node.backgroundColor};`\n    }\n\n    const colSpanAttr = node.colSpan && node.colSpan > 1 ? ` colspan=\"${node.colSpan}\"` : ''\n    const rowSpanAttr = node.rowSpan && node.rowSpan > 1 ? ` rowspan=\"${node.rowSpan}\"` : ''\n\n    return `<${TagName}\n        class=\"lexical-table-cell ${headerStateClass}\"\n        ${colSpanAttr}\n        ${rowSpanAttr}\n        style=\"${style}\"\n      >\n        ${children}\n      </${TagName}>\n    `\n  },\n\n  tablerow: ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = nodesToHTML({\n      nodes: node.children,\n    }).join('')\n\n    return `<tr${providedStyleTag} class=\"lexical-table-row\">\n        ${children}\n      </tr>`\n  },\n}\n"],"mappings":"AAOA,SAASA,cAAc,QAAQ;AAE/B,OAAO,MAAMC,kBAAA,GAET;EACFC,KAAA,EAAOA,CAAC;IAAEC,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IAC7C,MAAMC,QAAA,GAAWF,WAAA,CAAY;MAC3BG,KAAA,EAAOJ,IAAA,CAAKG;IACd,GAAGE,IAAI,CAAC;IAER,OAAO,OAAOH,gBAAA;;mBAECC,QAAA;;aAEN;EACX;EAEAG,SAAA,EAAWA,CAAC;IAAEN,IAAI;IAAEC,WAAW;IAAEM;EAAiB,CAAE;IAClD,MAAMJ,QAAA,GAAWF,WAAA,CAAY;MAC3BG,KAAA,EAAOJ,IAAA,CAAKG;IACd,GAAGE,IAAI,CAAC;IAER,MAAMG,OAAA,GAAUR,IAAA,CAAKS,WAAW,GAAG,IAAI,OAAO;IAC9C,MAAMC,gBAAA,GAAmB,6BAA6BV,IAAA,CAAKS,WAAW,EAAE;IAExE,IAAIE,KAAA,GAAQ,0CAA0CJ,iBAAA;IACtD,IAAIP,IAAA,CAAKY,eAAe,IAAIf,cAAA,CAAeG,IAAA,CAAKY,eAAe,GAAG;MAChED,KAAA,IAAS,sBAAsBX,IAAA,CAAKY,eAAe,GAAG;IACxD;IAEA,MAAMC,WAAA,GAAcb,IAAA,CAAKc,OAAO,IAAId,IAAA,CAAKc,OAAO,GAAG,IAAI,aAAad,IAAA,CAAKc,OAAO,GAAG,GAAG;IACtF,MAAMC,WAAA,GAAcf,IAAA,CAAKgB,OAAO,IAAIhB,IAAA,CAAKgB,OAAO,GAAG,IAAI,aAAahB,IAAA,CAAKgB,OAAO,GAAG,GAAG;IAEtF,OAAO,IAAIR,OAAA;oCACqBE,gBAAA;UAC1BG,WAAA;UACAE,WAAA;iBACOJ,KAAA;;UAEPR,QAAA;UACAK,OAAA;KACL;EACH;EAEAS,QAAA,EAAUA,CAAC;IAAEjB,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IAChD,MAAMC,QAAA,GAAWF,WAAA,CAAY;MAC3BG,KAAA,EAAOJ,IAAA,CAAKG;IACd,GAAGE,IAAI,CAAC;IAER,OAAO,MAAMH,gBAAA;UACPC,QAAA;YACE;EACV;AACF","ignoreList":[]}

package/dist/features/converters/lexicalToHtml/sync/converters/text.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"text.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/text.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAIjD,eAAO,MAAM,iBAAiB,EAAE,cAAc,CAAC,kBAAkB,CA4BhE,CAAA"}
+{"version":3,"file":"text.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/text.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAIjD,eAAO,MAAM,iBAAiB,EAAE,cAAc,CAAC,kBAAkB,CA4BhE,CAAA"}

package/dist/features/converters/lexicalToHtml/sync/converters/text.js

@@ -1,9 +1,10 @@
+import escapeHTML from 'escape-html';
 import { NodeFormat } from '../../../../../lexical/utils/nodeFormat.js';
 export const TextHTMLConverter = {
   text: ({
     node
   }) => {
-    let text = node.text;
+    let text = escapeHTML(node.text);
     if (node.format & NodeFormat.IS_BOLD) {
       text = `<strong>${text}</strong>`;
     }

package/dist/features/converters/lexicalToHtml/sync/converters/text.js.map

@@ -1 +1 @@
-{"version":3,"file":"text.js","names":["NodeFormat","TextHTMLConverter","text","node","format","IS_BOLD","IS_ITALIC","IS_STRIKETHROUGH","IS_UNDERLINE","IS_CODE","IS_SUBSCRIPT","IS_SUPERSCRIPT"],"sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/text.ts"],"sourcesContent":["import type { SerializedTextNode } from '../../../../../nodeTypes.js'\nimport type { HTMLConverters } from '../types.js'\n\nimport { NodeFormat } from '../../../../../lexical/utils/nodeFormat.js'\n\nexport const TextHTMLConverter: HTMLConverters<SerializedTextNode> = {\n  text: ({ node }) => {\n    let text = node.text\n\n    if (node.format & NodeFormat.IS_BOLD) {\n      text = `<strong>${text}</strong>`\n    }\n    if (node.format & NodeFormat.IS_ITALIC) {\n      text = `<em>${text}</em>`\n    }\n    if (node.format & NodeFormat.IS_STRIKETHROUGH) {\n      text = `<span style=\"text-decoration: line-through;\">${text}</span>`\n    }\n    if (node.format & NodeFormat.IS_UNDERLINE) {\n      text = `<span style=\"text-decoration: underline;\">${text}</span>`\n    }\n    if (node.format & NodeFormat.IS_CODE) {\n      text = `<code>${text}</code>`\n    }\n    if (node.format & NodeFormat.IS_SUBSCRIPT) {\n      text = `<sub>${text}</sub>`\n    }\n    if (node.format & NodeFormat.IS_SUPERSCRIPT) {\n      text = `<sup>${text}</sup>`\n    }\n\n    return text\n  },\n}\n"],"mappings":"AAGA,SAASA,UAAU,QAAQ;AAE3B,OAAO,MAAMC,iBAAA,GAAwD;EACnEC,IAAA,EAAMA,CAAC;IAAEC;EAAI,CAAE;IACb,IAAID,IAAA,GAAOC,IAAA,CAAKD,IAAI;IAEpB,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWK,OAAO,EAAE;MACpCH,IAAA,GAAO,WAAWA,IAAA,WAAe;IACnC;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWM,SAAS,EAAE;MACtCJ,IAAA,GAAO,OAAOA,IAAA,OAAW;IAC3B;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWO,gBAAgB,EAAE;MAC7CL,IAAA,GAAO,gDAAgDA,IAAA,SAAa;IACtE;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWQ,YAAY,EAAE;MACzCN,IAAA,GAAO,6CAA6CA,IAAA,SAAa;IACnE;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWS,OAAO,EAAE;MACpCP,IAAA,GAAO,SAASA,IAAA,SAAa;IAC/B;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWU,YAAY,EAAE;MACzCR,IAAA,GAAO,QAAQA,IAAA,QAAY;IAC7B;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWW,cAAc,EAAE;MAC3CT,IAAA,GAAO,QAAQA,IAAA,QAAY;IAC7B;IAEA,OAAOA,IAAA;EACT;AACF","ignoreList":[]}
+{"version":3,"file":"text.js","names":["escapeHTML","NodeFormat","TextHTMLConverter","text","node","format","IS_BOLD","IS_ITALIC","IS_STRIKETHROUGH","IS_UNDERLINE","IS_CODE","IS_SUBSCRIPT","IS_SUPERSCRIPT"],"sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/text.ts"],"sourcesContent":["import escapeHTML from 'escape-html'\n\nimport type { SerializedTextNode } from '../../../../../nodeTypes.js'\nimport type { HTMLConverters } from '../types.js'\n\nimport { NodeFormat } from '../../../../../lexical/utils/nodeFormat.js'\n\nexport const TextHTMLConverter: HTMLConverters<SerializedTextNode> = {\n  text: ({ node }) => {\n    let text = escapeHTML(node.text)\n\n    if (node.format & NodeFormat.IS_BOLD) {\n      text = `<strong>${text}</strong>`\n    }\n    if (node.format & NodeFormat.IS_ITALIC) {\n      text = `<em>${text}</em>`\n    }\n    if (node.format & NodeFormat.IS_STRIKETHROUGH) {\n      text = `<span style=\"text-decoration: line-through;\">${text}</span>`\n    }\n    if (node.format & NodeFormat.IS_UNDERLINE) {\n      text = `<span style=\"text-decoration: underline;\">${text}</span>`\n    }\n    if (node.format & NodeFormat.IS_CODE) {\n      text = `<code>${text}</code>`\n    }\n    if (node.format & NodeFormat.IS_SUBSCRIPT) {\n      text = `<sub>${text}</sub>`\n    }\n    if (node.format & NodeFormat.IS_SUPERSCRIPT) {\n      text = `<sup>${text}</sup>`\n    }\n\n    return text\n  },\n}\n"],"mappings":"AAAA,OAAOA,UAAA,MAAgB;AAKvB,SAASC,UAAU,QAAQ;AAE3B,OAAO,MAAMC,iBAAA,GAAwD;EACnEC,IAAA,EAAMA,CAAC;IAAEC;EAAI,CAAE;IACb,IAAID,IAAA,GAAOH,UAAA,CAAWI,IAAA,CAAKD,IAAI;IAE/B,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWK,OAAO,EAAE;MACpCH,IAAA,GAAO,WAAWA,IAAA,WAAe;IACnC;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWM,SAAS,EAAE;MACtCJ,IAAA,GAAO,OAAOA,IAAA,OAAW;IAC3B;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWO,gBAAgB,EAAE;MAC7CL,IAAA,GAAO,gDAAgDA,IAAA,SAAa;IACtE;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWQ,YAAY,EAAE;MACzCN,IAAA,GAAO,6CAA6CA,IAAA,SAAa;IACnE;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWS,OAAO,EAAE;MACpCP,IAAA,GAAO,SAASA,IAAA,SAAa;IAC/B;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWU,YAAY,EAAE;MACzCR,IAAA,GAAO,QAAQA,IAAA,QAAY;IAC7B;IACA,IAAIC,IAAA,CAAKC,MAAM,GAAGJ,UAAA,CAAWW,cAAc,EAAE;MAC3CT,IAAA,GAAO,QAAQA,IAAA,QAAY;IAC7B;IAEA,OAAOA,IAAA;EACT;AACF","ignoreList":[]}

package/dist/features/converters/lexicalToHtml/sync/converters/upload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/upload.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAEvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD,eAAO,MAAM,mBAAmB,EAAE,cAAc,CAAC,oBAAoB,CA4EpE,CAAA"}
+{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/upload.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAEvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD,eAAO,MAAM,mBAAmB,EAAE,cAAc,CAAC,oBAAoB,CA8EpE,CAAA"}

package/dist/features/converters/lexicalToHtml/sync/converters/upload.js

@@ -1,3 +1,4 @@
+import escapeHTML from 'escape-html';
 export const UploadHTMLConverter = {
   upload: ({
     node,
@@ -14,20 +15,20 @@ export const UploadHTMLConverter = {
     if (!uploadDoc) {
       return '';
     }
-    const alt = node.fields?.alt || uploadDoc?.alt || '';
-    const url = uploadDoc.url;
+    const alt = escapeHTML(node.fields?.alt || uploadDoc?.alt || '');
+    const url = escapeHTML(uploadDoc.url ?? '');
     // 1) If upload is NOT an image, return a link
     if (!uploadDoc.mimeType.startsWith('image')) {
-      return `<a${providedStyleTag} href="${url}" rel="noopener noreferrer">${uploadDoc.filename}</a$>`;
+      return `<a${providedStyleTag} href="${url}" rel="noopener noreferrer">${escapeHTML(uploadDoc.filename ?? '')}</a>`;
     }
     // 2) If image has no different sizes, return a simple <img />
     if (!uploadDoc.sizes || !Object.keys(uploadDoc.sizes).length) {
       return `
         <img${providedStyleTag}
           alt="${alt}"
-          height="${uploadDoc.height}"
+          height="${escapeHTML(String(uploadDoc.height ?? ''))}"
           src="${url}"
-          width="${uploadDoc.width}"
+          width="${escapeHTML(String(uploadDoc.width ?? ''))}"
         />
       `;
     }
@@ -40,18 +41,18 @@ export const UploadHTMLConverter = {
       }
       pictureHTML += `
         <source
-          media="(max-width: ${imageSize.width}px)"
-          srcset="${imageSize.url}"
-          type="${imageSize.mimeType}"
+          media="(max-width: ${escapeHTML(String(imageSize.width))}px)"
+          srcset="${escapeHTML(imageSize.url)}"
+          type="${escapeHTML(imageSize.mimeType)}"
         />
       `;
     }
     pictureHTML += `
       <img
         alt="${alt}"
-        height="${uploadDoc.height}"
+        height="${escapeHTML(String(uploadDoc.height ?? ''))}"
         src="${url}"
-        width="${uploadDoc.width}"
+        width="${escapeHTML(String(uploadDoc.width ?? ''))}"
       />
     `;
     return `<picture${providedStyleTag}>${pictureHTML}</picture>`;

package/dist/features/converters/lexicalToHtml/sync/converters/upload.js.map

@@ -1 +1 @@
-{"version":3,"file":"upload.js","names":["UploadHTMLConverter","upload","node","providedStyleTag","uploadNode","uploadDoc","undefined","value","alt","fields","url","mimeType","startsWith","filename","sizes","Object","keys","length","height","width","pictureHTML","size","imageSize","filesize"],"sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/upload.ts"],"sourcesContent":["import type { FileData, FileSizeImproved, TypeWithID } from 'payload'\n\nimport type { SerializedUploadNode } from '../../../../../nodeTypes.js'\nimport type { UploadDataImproved } from '../../../../upload/server/nodes/UploadNode.js'\nimport type { HTMLConverters } from '../types.js'\n\nexport const UploadHTMLConverter: HTMLConverters<SerializedUploadNode> = {\n  upload: ({ node, providedStyleTag }) => {\n    const uploadNode = node as UploadDataImproved\n\n    let uploadDoc: (FileData & TypeWithID) | undefined = undefined\n\n    // If there's no valid upload data, populate return an empty string\n    if (typeof uploadNode.value !== 'object') {\n      return ''\n    } else {\n      uploadDoc = uploadNode.value as unknown as FileData & TypeWithID\n    }\n\n    if (!uploadDoc) {\n      return ''\n    }\n\n    const alt = (node.fields?.alt as string) || (uploadDoc as { alt?: string })?.alt || ''\n\n    const url = uploadDoc.url\n\n    // 1) If upload is NOT an image, return a link\n    if (!uploadDoc.mimeType.startsWith('image')) {\n      return `<a${providedStyleTag} href=\"${url}\" rel=\"noopener noreferrer\">${uploadDoc.filename}</a$>`\n    }\n\n    // 2) If image has no different sizes, return a simple <img />\n    if (!uploadDoc.sizes || !Object.keys(uploadDoc.sizes).length) {\n      return `\n        <img${providedStyleTag}\n          alt=\"${alt}\"\n          height=\"${uploadDoc.height}\"\n          src=\"${url}\"\n          width=\"${uploadDoc.width}\"\n        />\n      `\n    }\n\n    // 3) If image has different sizes, build a <picture> element with <source> tags\n    let pictureHTML = ''\n\n    for (const size in uploadDoc.sizes) {\n      const imageSize = uploadDoc.sizes[size] as FileSizeImproved\n\n      if (\n        !imageSize ||\n        !imageSize.width ||\n        !imageSize.height ||\n        !imageSize.mimeType ||\n        !imageSize.filesize ||\n        !imageSize.filename ||\n        !imageSize.url\n      ) {\n        continue\n      }\n\n      pictureHTML += `\n        <source\n          media=\"(max-width: ${imageSize.width}px)\"\n          srcset=\"${imageSize.url}\"\n          type=\"${imageSize.mimeType}\"\n        />\n      `\n    }\n\n    pictureHTML += `\n      <img\n        alt=\"${alt}\"\n        height=\"${uploadDoc.height}\"\n        src=\"${url}\"\n        width=\"${uploadDoc.width}\"\n      />\n    `\n\n    return `<picture${providedStyleTag}>${pictureHTML}</picture>`\n  },\n}\n"],"mappings":"AAMA,OAAO,MAAMA,mBAAA,GAA4D;EACvEC,MAAA,EAAQA,CAAC;IAAEC,IAAI;IAAEC;EAAgB,CAAE;IACjC,MAAMC,UAAA,GAAaF,IAAA;IAEnB,IAAIG,SAAA,GAAiDC,SAAA;IAErD;IACA,IAAI,OAAOF,UAAA,CAAWG,KAAK,KAAK,UAAU;MACxC,OAAO;IACT,OAAO;MACLF,SAAA,GAAYD,UAAA,CAAWG,KAAK;IAC9B;IAEA,IAAI,CAACF,SAAA,EAAW;MACd,OAAO;IACT;IAEA,MAAMG,GAAA,GAAMN,IAAC,CAAKO,MAAM,EAAED,GAAA,IAAmBH,SAAA,EAAgCG,GAAA,IAAO;IAEpF,MAAME,GAAA,GAAML,SAAA,CAAUK,GAAG;IAEzB;IACA,IAAI,CAACL,SAAA,CAAUM,QAAQ,CAACC,UAAU,CAAC,UAAU;MAC3C,OAAO,KAAKT,gBAAA,UAA0BO,GAAA,+BAAkCL,SAAA,CAAUQ,QAAQ,OAAO;IACnG;IAEA;IACA,IAAI,CAACR,SAAA,CAAUS,KAAK,IAAI,CAACC,MAAA,CAAOC,IAAI,CAACX,SAAA,CAAUS,KAAK,EAAEG,MAAM,EAAE;MAC5D,OAAO;cACCd,gBAAA;iBACGK,GAAA;oBACGH,SAAA,CAAUa,MAAM;iBACnBR,GAAA;mBACEL,SAAA,CAAUc,KAAK;;OAE3B;IACH;IAEA;IACA,IAAIC,WAAA,GAAc;IAElB,KAAK,MAAMC,IAAA,IAAQhB,SAAA,CAAUS,KAAK,EAAE;MAClC,MAAMQ,SAAA,GAAYjB,SAAA,CAAUS,KAAK,CAACO,IAAA,CAAK;MAEvC,IACE,CAACC,SAAA,IACD,CAACA,SAAA,CAAUH,KAAK,IAChB,CAACG,SAAA,CAAUJ,MAAM,IACjB,CAACI,SAAA,CAAUX,QAAQ,IACnB,CAACW,SAAA,CAAUC,QAAQ,IACnB,CAACD,SAAA,CAAUT,QAAQ,IACnB,CAACS,SAAA,CAAUZ,GAAG,EACd;QACA;MACF;MAEAU,WAAA,IAAe;;+BAEUE,SAAA,CAAUH,KAAK;oBAC1BG,SAAA,CAAUZ,GAAG;kBACfY,SAAA,CAAUX,QAAQ;;OAE7B;IACH;IAEAS,WAAA,IAAe;;eAEJZ,GAAA;kBACGH,SAAA,CAAUa,MAAM;eACnBR,GAAA;iBACEL,SAAA,CAAUc,KAAK;;KAE3B;IAED,OAAO,WAAWhB,gBAAA,IAAoBiB,WAAA,YAAuB;EAC/D;AACF","ignoreList":[]}
+{"version":3,"file":"upload.js","names":["escapeHTML","UploadHTMLConverter","upload","node","providedStyleTag","uploadNode","uploadDoc","undefined","value","alt","fields","url","mimeType","startsWith","filename","sizes","Object","keys","length","String","height","width","pictureHTML","size","imageSize","filesize"],"sources":["../../../../../../src/features/converters/lexicalToHtml/sync/converters/upload.ts"],"sourcesContent":["import type { FileData, FileSizeImproved, TypeWithID } from 'payload'\n\nimport escapeHTML from 'escape-html'\n\nimport type { SerializedUploadNode } from '../../../../../nodeTypes.js'\nimport type { UploadDataImproved } from '../../../../upload/server/nodes/UploadNode.js'\nimport type { HTMLConverters } from '../types.js'\n\nexport const UploadHTMLConverter: HTMLConverters<SerializedUploadNode> = {\n  upload: ({ node, providedStyleTag }) => {\n    const uploadNode = node as UploadDataImproved\n\n    let uploadDoc: (FileData & TypeWithID) | undefined = undefined\n\n    // If there's no valid upload data, populate return an empty string\n    if (typeof uploadNode.value !== 'object') {\n      return ''\n    } else {\n      uploadDoc = uploadNode.value as unknown as FileData & TypeWithID\n    }\n\n    if (!uploadDoc) {\n      return ''\n    }\n\n    const alt = escapeHTML(\n      (node.fields?.alt as string) || (uploadDoc as { alt?: string })?.alt || '',\n    )\n\n    const url = escapeHTML(uploadDoc.url ?? '')\n\n    // 1) If upload is NOT an image, return a link\n    if (!uploadDoc.mimeType.startsWith('image')) {\n      return `<a${providedStyleTag} href=\"${url}\" rel=\"noopener noreferrer\">${escapeHTML(uploadDoc.filename ?? '')}</a>`\n    }\n\n    // 2) If image has no different sizes, return a simple <img />\n    if (!uploadDoc.sizes || !Object.keys(uploadDoc.sizes).length) {\n      return `\n        <img${providedStyleTag}\n          alt=\"${alt}\"\n          height=\"${escapeHTML(String(uploadDoc.height ?? ''))}\"\n          src=\"${url}\"\n          width=\"${escapeHTML(String(uploadDoc.width ?? ''))}\"\n        />\n      `\n    }\n\n    // 3) If image has different sizes, build a <picture> element with <source> tags\n    let pictureHTML = ''\n\n    for (const size in uploadDoc.sizes) {\n      const imageSize = uploadDoc.sizes[size] as FileSizeImproved\n\n      if (\n        !imageSize ||\n        !imageSize.width ||\n        !imageSize.height ||\n        !imageSize.mimeType ||\n        !imageSize.filesize ||\n        !imageSize.filename ||\n        !imageSize.url\n      ) {\n        continue\n      }\n\n      pictureHTML += `\n        <source\n          media=\"(max-width: ${escapeHTML(String(imageSize.width))}px)\"\n          srcset=\"${escapeHTML(imageSize.url)}\"\n          type=\"${escapeHTML(imageSize.mimeType)}\"\n        />\n      `\n    }\n\n    pictureHTML += `\n      <img\n        alt=\"${alt}\"\n        height=\"${escapeHTML(String(uploadDoc.height ?? ''))}\"\n        src=\"${url}\"\n        width=\"${escapeHTML(String(uploadDoc.width ?? ''))}\"\n      />\n    `\n\n    return `<picture${providedStyleTag}>${pictureHTML}</picture>`\n  },\n}\n"],"mappings":"AAEA,OAAOA,UAAA,MAAgB;AAMvB,OAAO,MAAMC,mBAAA,GAA4D;EACvEC,MAAA,EAAQA,CAAC;IAAEC,IAAI;IAAEC;EAAgB,CAAE;IACjC,MAAMC,UAAA,GAAaF,IAAA;IAEnB,IAAIG,SAAA,GAAiDC,SAAA;IAErD;IACA,IAAI,OAAOF,UAAA,CAAWG,KAAK,KAAK,UAAU;MACxC,OAAO;IACT,OAAO;MACLF,SAAA,GAAYD,UAAA,CAAWG,KAAK;IAC9B;IAEA,IAAI,CAACF,SAAA,EAAW;MACd,OAAO;IACT;IAEA,MAAMG,GAAA,GAAMT,UAAA,CACVG,IAAC,CAAKO,MAAM,EAAED,GAAA,IAAmBH,SAAA,EAAgCG,GAAA,IAAO;IAG1E,MAAME,GAAA,GAAMX,UAAA,CAAWM,SAAA,CAAUK,GAAG,IAAI;IAExC;IACA,IAAI,CAACL,SAAA,CAAUM,QAAQ,CAACC,UAAU,CAAC,UAAU;MAC3C,OAAO,KAAKT,gBAAA,UAA0BO,GAAA,+BAAkCX,UAAA,CAAWM,SAAA,CAAUQ,QAAQ,IAAI,SAAS;IACpH;IAEA;IACA,IAAI,CAACR,SAAA,CAAUS,KAAK,IAAI,CAACC,MAAA,CAAOC,IAAI,CAACX,SAAA,CAAUS,KAAK,EAAEG,MAAM,EAAE;MAC5D,OAAO;cACCd,gBAAA;iBACGK,GAAA;oBACGT,UAAA,CAAWmB,MAAA,CAAOb,SAAA,CAAUc,MAAM,IAAI;iBACzCT,GAAA;mBACEX,UAAA,CAAWmB,MAAA,CAAOb,SAAA,CAAUe,KAAK,IAAI;;OAEjD;IACH;IAEA;IACA,IAAIC,WAAA,GAAc;IAElB,KAAK,MAAMC,IAAA,IAAQjB,SAAA,CAAUS,KAAK,EAAE;MAClC,MAAMS,SAAA,GAAYlB,SAAA,CAAUS,KAAK,CAACQ,IAAA,CAAK;MAEvC,IACE,CAACC,SAAA,IACD,CAACA,SAAA,CAAUH,KAAK,IAChB,CAACG,SAAA,CAAUJ,MAAM,IACjB,CAACI,SAAA,CAAUZ,QAAQ,IACnB,CAACY,SAAA,CAAUC,QAAQ,IACnB,CAACD,SAAA,CAAUV,QAAQ,IACnB,CAACU,SAAA,CAAUb,GAAG,EACd;QACA;MACF;MAEAW,WAAA,IAAe;;+BAEUtB,UAAA,CAAWmB,MAAA,CAAOK,SAAA,CAAUH,KAAK;oBAC5CrB,UAAA,CAAWwB,SAAA,CAAUb,GAAG;kBAC1BX,UAAA,CAAWwB,SAAA,CAAUZ,QAAQ;;OAExC;IACH;IAEAU,WAAA,IAAe;;eAEJb,GAAA;kBACGT,UAAA,CAAWmB,MAAA,CAAOb,SAAA,CAAUc,MAAM,IAAI;eACzCT,GAAA;iBACEX,UAAA,CAAWmB,MAAA,CAAOb,SAAA,CAAUe,KAAK,IAAI;;KAEjD;IAED,OAAO,WAAWjB,gBAAA,IAAoBkB,WAAA,YAAuB;EAC/D;AACF","ignoreList":[]}

package/dist/field/Diff/converters/link.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"link.d.ts","sourceRoot":"","sources":["../../../../src/field/Diff/converters/link.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,mBAAmB,EACnB,cAAc,EACf,MAAM,2DAA2D,CAAA;AAClE,OAAO,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAEvF,eAAO,MAAM,0BAA0B,EAAE,CAAC,IAAI,EAAE;IAC9C,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QACzB,QAAQ,EAAE,kBAAkB,CAAA;QAC5B,QAAQ,CAAC,EAAE,cAAc,CAAA;KAC1B,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;CAC/B,KAAK,mBAAmB,CAAC,sBAAsB,GAAG,kBAAkB,CA6CnE,CAAA"}
+{"version":3,"file":"link.d.ts","sourceRoot":"","sources":["../../../../src/field/Diff/converters/link.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,mBAAmB,EACnB,cAAc,EACf,MAAM,2DAA2D,CAAA;AAClE,OAAO,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAEvF,eAAO,MAAM,0BAA0B,EAAE,CAAC,IAAI,EAAE;IAC9C,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QACzB,QAAQ,EAAE,kBAAkB,CAAA;QAC5B,QAAQ,CAAC,EAAE,cAAc,CAAA;KAC1B,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;CAC/B,KAAK,mBAAmB,CAAC,sBAAsB,GAAG,kBAAkB,CAkDnE,CAAA"}

package/dist/field/Diff/converters/link.js

@@ -1,4 +1,6 @@
 import { createHash } from 'crypto';
+import escapeHTML from 'escape-html';
+import { sanitizeUrl } from 'payload/shared';
 export const LinkDiffHTMLConverterAsync = ({
   internalDocToHref
 }) => ({
@@ -12,7 +14,8 @@ export const LinkDiffHTMLConverterAsync = ({
     })).join('');
     // hash fields to ensure they are diffed if they change
     const nodeFieldsHash = createHash('sha256').update(JSON.stringify(node.fields)).digest('hex');
-    return `<a${providedStyleTag} data-fields-hash="${nodeFieldsHash}" data-enable-match="true" href="${node.fields.url}"${node.fields.newTab ? ' rel="noopener noreferrer" target="_blank"' : ''}>
+    const href = escapeHTML(sanitizeUrl(node.fields.url ?? ''));
+    return `<a${providedStyleTag} data-fields-hash="${nodeFieldsHash}" data-enable-match="true" href="${href}"${node.fields.newTab ? ' rel="noopener noreferrer" target="_blank"' : ''}>
         ${children}
       </a>`;
   },
@@ -33,13 +36,15 @@ export const LinkDiffHTMLConverterAsync = ({
           populate
         });
       } else {
+        // eslint-disable-next-line no-console
         console.error('Lexical => HTML converter: Link converter: found internal link, but internalDocToHref is not provided');
         href = '#'; // fallback
       }
     }
     // hash fields to ensure they are diffed if they change
     const nodeFieldsHash = createHash('sha256').update(JSON.stringify(node.fields ?? {})).digest('hex');
-    return `<a${providedStyleTag} data-fields-hash="${nodeFieldsHash}" data-enable-match="true" href="${href}"${node.fields.newTab ? ' rel="noopener noreferrer" target="_blank"' : ''}>
+    const safeHref = escapeHTML(sanitizeUrl(href));
+    return `<a${providedStyleTag} data-fields-hash="${nodeFieldsHash}" data-enable-match="true" href="${safeHref}"${node.fields.newTab ? ' rel="noopener noreferrer" target="_blank"' : ''}>
         ${children}
       </a>`;
   }

package/dist/field/Diff/converters/link.js.map

@@ -1 +1 @@
-{"version":3,"file":"link.js","names":["createHash","LinkDiffHTMLConverterAsync","internalDocToHref","autolink","node","nodesToHTML","providedStyleTag","children","nodes","join","nodeFieldsHash","update","JSON","stringify","fields","digest","url","newTab","link","populate","href","linkType","linkNode","console","error"],"sources":["../../../../src/field/Diff/converters/link.ts"],"sourcesContent":["import { createHash } from 'crypto'\n\nimport type {\n  HTMLConvertersAsync,\n  HTMLPopulateFn,\n} from '../../../features/converters/lexicalToHtml/async/types.js'\nimport type { SerializedAutoLinkNode, SerializedLinkNode } from '../../../nodeTypes.js'\n\nexport const LinkDiffHTMLConverterAsync: (args: {\n  internalDocToHref?: (args: {\n    linkNode: SerializedLinkNode\n    populate?: HTMLPopulateFn\n  }) => Promise<string> | string\n}) => HTMLConvertersAsync<SerializedAutoLinkNode | SerializedLinkNode> = ({\n  internalDocToHref,\n}) => ({\n  autolink: async ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = (\n      await nodesToHTML({\n        nodes: node.children,\n      })\n    ).join('')\n\n    // hash fields to ensure they are diffed if they change\n    const nodeFieldsHash = createHash('sha256').update(JSON.stringify(node.fields)).digest('hex')\n\n    return `<a${providedStyleTag} data-fields-hash=\"${nodeFieldsHash}\" data-enable-match=\"true\" href=\"${node.fields.url}\"${node.fields.newTab ? ' rel=\"noopener noreferrer\" target=\"_blank\"' : ''}>\n        ${children}\n      </a>`\n  },\n  link: async ({ node, nodesToHTML, populate, providedStyleTag }) => {\n    const children = (\n      await nodesToHTML({\n        nodes: node.children,\n      })\n    ).join('')\n\n    let href: string = node.fields.url ?? ''\n    if (node.fields.linkType === 'internal') {\n      if (internalDocToHref) {\n        href = await internalDocToHref({ linkNode: node, populate })\n      } else {\n        console.error(\n          'Lexical => HTML converter: Link converter: found internal link, but internalDocToHref is not provided',\n        )\n        href = '#' // fallback\n      }\n    }\n\n    // hash fields to ensure they are diffed if they change\n    const nodeFieldsHash = createHash('sha256')\n      .update(JSON.stringify(node.fields ?? {}))\n      .digest('hex')\n\n    return `<a${providedStyleTag} data-fields-hash=\"${nodeFieldsHash}\" data-enable-match=\"true\" href=\"${href}\"${node.fields.newTab ? ' rel=\"noopener noreferrer\" target=\"_blank\"' : ''}>\n        ${children}\n      </a>`\n  },\n})\n"],"mappings":"AAAA,SAASA,UAAU,QAAQ;AAQ3B,OAAO,MAAMC,0BAAA,GAK4DA,CAAC;EACxEC;AAAiB,CAClB,MAAM;EACLC,QAAA,EAAU,MAAAA,CAAO;IAAEC,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IACtD,MAAMC,QAAA,GAAW,CACf,MAAMF,WAAA,CAAY;MAChBG,KAAA,EAAOJ,IAAA,CAAKG;IACd,EAAC,EACDE,IAAI,CAAC;IAEP;IACA,MAAMC,cAAA,GAAiBV,UAAA,CAAW,UAAUW,MAAM,CAACC,IAAA,CAAKC,SAAS,CAACT,IAAA,CAAKU,MAAM,GAAGC,MAAM,CAAC;IAEvF,OAAO,KAAKT,gBAAA,sBAAsCI,cAAA,oCAAkDN,IAAA,CAAKU,MAAM,CAACE,GAAG,IAAIZ,IAAA,CAAKU,MAAM,CAACG,MAAM,GAAG,+CAA+C;UACrLV,QAAA;WACC;EACT;EACAW,IAAA,EAAM,MAAAA,CAAO;IAAEd,IAAI;IAAEC,WAAW;IAAEc,QAAQ;IAAEb;EAAgB,CAAE;IAC5D,MAAMC,QAAA,GAAW,CACf,MAAMF,WAAA,CAAY;MAChBG,KAAA,EAAOJ,IAAA,CAAKG;IACd,EAAC,EACDE,IAAI,CAAC;IAEP,IAAIW,IAAA,GAAehB,IAAA,CAAKU,MAAM,CAACE,GAAG,IAAI;IACtC,IAAIZ,IAAA,CAAKU,MAAM,CAACO,QAAQ,KAAK,YAAY;MACvC,IAAInB,iBAAA,EAAmB;QACrBkB,IAAA,GAAO,MAAMlB,iBAAA,CAAkB;UAAEoB,QAAA,EAAUlB,IAAA;UAAMe;QAAS;MAC5D,OAAO;QACLI,OAAA,CAAQC,KAAK,CACX;QAEFJ,IAAA,GAAO,KAAI;MACb;IACF;IAEA;IACA,MAAMV,cAAA,GAAiBV,UAAA,CAAW,UAC/BW,MAAM,CAACC,IAAA,CAAKC,SAAS,CAACT,IAAA,CAAKU,MAAM,IAAI,CAAC,IACtCC,MAAM,CAAC;IAEV,OAAO,KAAKT,gBAAA,sBAAsCI,cAAA,oCAAkDU,IAAA,IAAQhB,IAAA,CAAKU,MAAM,CAACG,MAAM,GAAG,+CAA+C;UAC1KV,QAAA;WACC;EACT;AACF","ignoreList":[]}
+{"version":3,"file":"link.js","names":["createHash","escapeHTML","sanitizeUrl","LinkDiffHTMLConverterAsync","internalDocToHref","autolink","node","nodesToHTML","providedStyleTag","children","nodes","join","nodeFieldsHash","update","JSON","stringify","fields","digest","href","url","newTab","link","populate","linkType","linkNode","console","error","safeHref"],"sources":["../../../../src/field/Diff/converters/link.ts"],"sourcesContent":["import { createHash } from 'crypto'\nimport escapeHTML from 'escape-html'\nimport { sanitizeUrl } from 'payload/shared'\n\nimport type {\n  HTMLConvertersAsync,\n  HTMLPopulateFn,\n} from '../../../features/converters/lexicalToHtml/async/types.js'\nimport type { SerializedAutoLinkNode, SerializedLinkNode } from '../../../nodeTypes.js'\n\nexport const LinkDiffHTMLConverterAsync: (args: {\n  internalDocToHref?: (args: {\n    linkNode: SerializedLinkNode\n    populate?: HTMLPopulateFn\n  }) => Promise<string> | string\n}) => HTMLConvertersAsync<SerializedAutoLinkNode | SerializedLinkNode> = ({\n  internalDocToHref,\n}) => ({\n  autolink: async ({ node, nodesToHTML, providedStyleTag }) => {\n    const children = (\n      await nodesToHTML({\n        nodes: node.children,\n      })\n    ).join('')\n\n    // hash fields to ensure they are diffed if they change\n    const nodeFieldsHash = createHash('sha256').update(JSON.stringify(node.fields)).digest('hex')\n\n    const href = escapeHTML(sanitizeUrl(node.fields.url ?? ''))\n\n    return `<a${providedStyleTag} data-fields-hash=\"${nodeFieldsHash}\" data-enable-match=\"true\" href=\"${href}\"${node.fields.newTab ? ' rel=\"noopener noreferrer\" target=\"_blank\"' : ''}>\n        ${children}\n      </a>`\n  },\n  link: async ({ node, nodesToHTML, populate, providedStyleTag }) => {\n    const children = (\n      await nodesToHTML({\n        nodes: node.children,\n      })\n    ).join('')\n\n    let href: string = node.fields.url ?? ''\n    if (node.fields.linkType === 'internal') {\n      if (internalDocToHref) {\n        href = await internalDocToHref({ linkNode: node, populate })\n      } else {\n        // eslint-disable-next-line no-console\n        console.error(\n          'Lexical => HTML converter: Link converter: found internal link, but internalDocToHref is not provided',\n        )\n        href = '#' // fallback\n      }\n    }\n\n    // hash fields to ensure they are diffed if they change\n    const nodeFieldsHash = createHash('sha256')\n      .update(JSON.stringify(node.fields ?? {}))\n      .digest('hex')\n\n    const safeHref = escapeHTML(sanitizeUrl(href))\n\n    return `<a${providedStyleTag} data-fields-hash=\"${nodeFieldsHash}\" data-enable-match=\"true\" href=\"${safeHref}\"${node.fields.newTab ? ' rel=\"noopener noreferrer\" target=\"_blank\"' : ''}>\n        ${children}\n      </a>`\n  },\n})\n"],"mappings":"AAAA,SAASA,UAAU,QAAQ;AAC3B,OAAOC,UAAA,MAAgB;AACvB,SAASC,WAAW,QAAQ;AAQ5B,OAAO,MAAMC,0BAAA,GAK4DA,CAAC;EACxEC;AAAiB,CAClB,MAAM;EACLC,QAAA,EAAU,MAAAA,CAAO;IAAEC,IAAI;IAAEC,WAAW;IAAEC;EAAgB,CAAE;IACtD,MAAMC,QAAA,GAAW,CACf,MAAMF,WAAA,CAAY;MAChBG,KAAA,EAAOJ,IAAA,CAAKG;IACd,EAAC,EACDE,IAAI,CAAC;IAEP;IACA,MAAMC,cAAA,GAAiBZ,UAAA,CAAW,UAAUa,MAAM,CAACC,IAAA,CAAKC,SAAS,CAACT,IAAA,CAAKU,MAAM,GAAGC,MAAM,CAAC;IAEvF,MAAMC,IAAA,GAAOjB,UAAA,CAAWC,WAAA,CAAYI,IAAA,CAAKU,MAAM,CAACG,GAAG,IAAI;IAEvD,OAAO,KAAKX,gBAAA,sBAAsCI,cAAA,oCAAkDM,IAAA,IAAQZ,IAAA,CAAKU,MAAM,CAACI,MAAM,GAAG,+CAA+C;UAC1KX,QAAA;WACC;EACT;EACAY,IAAA,EAAM,MAAAA,CAAO;IAAEf,IAAI;IAAEC,WAAW;IAAEe,QAAQ;IAAEd;EAAgB,CAAE;IAC5D,MAAMC,QAAA,GAAW,CACf,MAAMF,WAAA,CAAY;MAChBG,KAAA,EAAOJ,IAAA,CAAKG;IACd,EAAC,EACDE,IAAI,CAAC;IAEP,IAAIO,IAAA,GAAeZ,IAAA,CAAKU,MAAM,CAACG,GAAG,IAAI;IACtC,IAAIb,IAAA,CAAKU,MAAM,CAACO,QAAQ,KAAK,YAAY;MACvC,IAAInB,iBAAA,EAAmB;QACrBc,IAAA,GAAO,MAAMd,iBAAA,CAAkB;UAAEoB,QAAA,EAAUlB,IAAA;UAAMgB;QAAS;MAC5D,OAAO;QACL;QACAG,OAAA,CAAQC,KAAK,CACX;QAEFR,IAAA,GAAO,KAAI;MACb;IACF;IAEA;IACA,MAAMN,cAAA,GAAiBZ,UAAA,CAAW,UAC/Ba,MAAM,CAACC,IAAA,CAAKC,SAAS,CAACT,IAAA,CAAKU,MAAM,IAAI,CAAC,IACtCC,MAAM,CAAC;IAEV,MAAMU,QAAA,GAAW1B,UAAA,CAAWC,WAAA,CAAYgB,IAAA;IAExC,OAAO,KAAKV,gBAAA,sBAAsCI,cAAA,oCAAkDe,QAAA,IAAYrB,IAAA,CAAKU,MAAM,CAACI,MAAM,GAAG,+CAA+C;UAC9KX,QAAA;WACC;EACT;AACF","ignoreList":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/richtext-lexical",
-  "version": "3.80.0-canary.11",
+  "version": "3.80.0-canary.13",
   "description": "The officially supported Lexical richtext adapter for Payload",
   "homepage": "https://payloadcms.com",
   "repository": {
@@ -374,8 +374,8 @@
     "react-error-boundary": "4.1.2",
     "ts-essentials": "10.0.3",
     "uuid": "10.0.0",
-    "@payloadcms/ui": "3.80.0-canary.11",
-    "@payloadcms/translations": "3.80.0-canary.11"
+    "@payloadcms/translations": "3.80.0-canary.13",
+    "@payloadcms/ui": "3.80.0-canary.13"
   },
   "devDependencies": {
     "@babel/cli": "7.27.2",
@@ -394,7 +394,7 @@
     "esbuild": "0.27.1",
     "esbuild-sass-plugin": "3.3.1",
     "swc-plugin-transform-remove-imports": "8.3.0",
-    "payload": "3.80.0-canary.11",
+    "payload": "3.80.0-canary.13",
     "@payloadcms/eslint-config": "3.28.0"
   },
   "peerDependencies": {
@@ -402,8 +402,8 @@
     "@faceless-ui/scroll-info": "2.0.0",
     "react": "^19.0.1 || ^19.1.2 || ^19.2.1",
     "react-dom": "^19.0.1 || ^19.1.2 || ^19.2.1",
-    "@payloadcms/next": "3.80.0-canary.11",
-    "payload": "3.80.0-canary.11"
+    "@payloadcms/next": "3.80.0-canary.13",
+    "payload": "3.80.0-canary.13"
   },
   "engines": {
     "node": "^18.20.2 || >=20.9.0"