@pixerate/editor 0.14.1 → 0.14.2

package/dist/index.cjs

@@ -2698,6 +2698,114 @@ md2.validateLink = (url) => {
   }
   return defaultValidateLink.call(md2, url);
 };
+var ALLOWED_HTML_TAGS = /* @__PURE__ */ new Set([
+  "a",
+  "abbr",
+  "b",
+  "blockquote",
+  "br",
+  "code",
+  "del",
+  "details",
+  "div",
+  "em",
+  "h1",
+  "h2",
+  "h3",
+  "h4",
+  "h5",
+  "h6",
+  "hr",
+  "i",
+  "img",
+  "input",
+  "kbd",
+  "li",
+  "mark",
+  "ol",
+  "p",
+  "pre",
+  "s",
+  "span",
+  "strong",
+  "sub",
+  "summary",
+  "sup",
+  "table",
+  "tbody",
+  "td",
+  "tfoot",
+  "th",
+  "thead",
+  "tr",
+  "u",
+  "ul"
+]);
+var ALLOWED_HTML_ATTRS = /* @__PURE__ */ new Set([
+  "alt",
+  "align",
+  "checked",
+  "class",
+  "colspan",
+  "disabled",
+  "height",
+  "href",
+  "rel",
+  "rowspan",
+  "src",
+  "start",
+  "target",
+  "title",
+  "type",
+  "width"
+]);
+var HTML_TAG_REGEX = /<(\/?)([a-zA-Z][a-zA-Z0-9-]*)((?:\s+[^\s"'>\/=]+(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s"'=<>`]+))?)*)\s*\/?>/g;
+var HTML_ATTR_REGEX = /([^\s"'>\/=]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g;
+function sanitizeTag(tagText, isClosing, rawTagName, rawAttrs) {
+  const tagName = rawTagName.toLowerCase();
+  if (!ALLOWED_HTML_TAGS.has(tagName)) return escapeHtml(tagText);
+  if (isClosing) return `</${tagName}>`;
+  if (tagName === "input" && !/\stype\s*=\s*["']?checkbox["']?[\s>/]/i.test(tagText)) {
+    return escapeHtml(tagText);
+  }
+  let attrs = "";
+  let attrMatch;
+  HTML_ATTR_REGEX.lastIndex = 0;
+  while ((attrMatch = HTML_ATTR_REGEX.exec(rawAttrs)) !== null) {
+    const name = attrMatch[1].toLowerCase();
+    if (!ALLOWED_HTML_ATTRS.has(name) && !/^data-[a-z0-9_.-]+$/.test(name)) {
+      continue;
+    }
+    const rawValue = attrMatch[2] ?? attrMatch[3] ?? attrMatch[4];
+    if (rawValue === void 0) {
+      attrs += ` ${name}`;
+      continue;
+    }
+    const value = md2.utils.unescapeAll(rawValue);
+    if ((name === "href" || name === "src") && // Browsers ignore control characters and whitespace inside schemes.
+    !md2.validateLink(value.replace(/[\u0000-\u0020\u007f]/g, ""))) {
+      continue;
+    }
+    attrs += ` ${name}="${escapeHtml(value)}"`;
+  }
+  return `<${tagName}${attrs}>`;
+}
+function sanitizeEmbeddedHtml(html) {
+  let result = "";
+  let lastIndex = 0;
+  let match;
+  HTML_TAG_REGEX.lastIndex = 0;
+  while ((match = HTML_TAG_REGEX.exec(html)) !== null) {
+    result += html.slice(lastIndex, match.index).replace(/</g, "&lt;");
+    result += sanitizeTag(match[0], match[1], match[2], match[3]);
+    lastIndex = match.index + match[0].length;
+  }
+  return result + html.slice(lastIndex).replace(/</g, "&lt;");
+}
+var defaultHtmlInline = md2.renderer.rules.html_inline;
+var defaultHtmlBlock = md2.renderer.rules.html_block;
+md2.renderer.rules.html_inline = (tokens, idx, options, env, self) => env?.allowUnsafeHtml ? defaultHtmlInline(tokens, idx, options, env, self) : sanitizeEmbeddedHtml(tokens[idx].content);
+md2.renderer.rules.html_block = (tokens, idx, options, env, self) => env?.allowUnsafeHtml ? defaultHtmlBlock(tokens, idx, options, env, self) : sanitizeEmbeddedHtml(tokens[idx].content);
 function preprocessMarkdownFileLinks(content) {
   if (!content) return "";
   return content.replace(
@@ -2705,8 +2813,8 @@ function preprocessMarkdownFileLinks(content) {
     (_match, rawLabel, href) => {
       const trimmed = rawLabel.trim();
       const codeMatch = trimmed.match(/^`([^`]+)`$/);
-      const labelContent = codeMatch ? `<code>${codeMatch[1]}</code>` : trimmed;
-      return `<a href="${href}" data-file-link="true" title="Click to copy file path">${labelContent}</a>`;
+      const labelContent = codeMatch ? `<code>${escapeHtml(codeMatch[1])}</code>` : escapeHtml(trimmed);
+      return `<a href="${escapeHtml(href)}" data-file-link="true" title="Click to copy file path">${labelContent}</a>`;
     }
   );
 }
@@ -2722,7 +2830,7 @@ function markdownToTipTapHtml(markdown, options) {
     };
     content = preprocessMarkdownMentions(content, mentionOpts);
   }
-  return md2.render(content);
+  return md2.render(content, { allowUnsafeHtml: options?.allowUnsafeHtml });
 }
 function getEditorMarkdown(editor) {
   if (!editor) return "";