@primitivedotdev/sdk 1.0.0 → 1.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/dist/parser/index.js +39 -31
  2. package/package.json +3 -2
package/dist/parser/index.js CHANGED
@@ -3,7 +3,7 @@ import { createHash } from "node:crypto";
3
3
  import { createGzip } from "node:zlib";
4
4
  import { pack } from "tar-stream";
5
5
  import { simpleParser } from "mailparser";
6
- import DOMPurify from "isomorphic-dompurify";
6
+ import sanitizeHtmlLib from "sanitize-html";
7
7
  //#region src/parser/attachment-bundler.ts
8
8
  function appendTarEntry(archive, name, content) {
9
9
  return new Promise((resolve, reject) => {
@@ -171,7 +171,6 @@ const ALLOWED_ATTRS = [
171
171
  "lang",
172
172
  "href",
173
173
  "title",
174
- "target",
175
174
  "rel",
176
175
  "src",
177
176
  "alt",
@@ -190,44 +189,53 @@ const ALLOWED_ATTRS = [
190
189
  "size",
191
190
  "face"
192
191
  ];
193
- const ALLOWED_URI_REGEXP = /^(https?:|data:image\/(?!svg\+xml)[a-z0-9][a-z0-9+.-]*[;,]|mailto:|cid:|#)/i;
194
192
  const SVG_DATA_URI_RE = /^data:image\/svg\+xml/i;
195
- DOMPurify.addHook("uponSanitizeAttribute", (_node, data) => {
196
- if (data.attrName.startsWith("on")) data.keepAttr = false;
197
- if (data.attrName === "style") data.keepAttr = false;
198
- if ((data.attrName === "src" || data.attrName === "href") && SVG_DATA_URI_RE.test(data.attrValue)) data.keepAttr = false;
199
- });
200
- DOMPurify.addHook("afterSanitizeAttributes", (node) => {
201
- if (node.tagName === "A") {
202
- if (node.getAttribute("target") === "_blank") node.setAttribute("rel", "noopener noreferrer");
203
- }
204
- });
205
- const SANITIZE_OPTIONS = {
206
- ALLOWED_TAGS,
207
- ALLOWED_ATTR: ALLOWED_ATTRS,
208
- ALLOW_DATA_ATTR: false,
209
- ALLOW_UNKNOWN_PROTOCOLS: false,
210
- ALLOWED_URI_REGEXP,
211
- FORBID_TAGS: [
212
- "style",
193
+ const OPTIONS = {
194
+ allowedTags: ALLOWED_TAGS,
195
+ allowedAttributes: { "*": ALLOWED_ATTRS },
196
+ allowedSchemes: [
197
+ "http",
198
+ "https",
199
+ "mailto",
200
+ "cid"
201
+ ],
202
+ allowedSchemesByTag: { img: [
203
+ "http",
204
+ "https",
205
+ "cid",
206
+ "data"
207
+ ] },
208
+ allowedSchemesAppliedToAttributes: ["href", "src"],
209
+ allowProtocolRelative: false,
210
+ nonTextTags: [
213
211
  "script",
212
+ "style",
213
+ "textarea",
214
+ "option",
215
+ "noscript",
216
+ "title",
214
217
  "iframe",
215
218
  "object",
216
219
  "embed",
220
+ "svg",
221
+ "math",
217
222
  "form",
218
- "input",
219
- "button",
220
223
  "select",
221
- "textarea",
222
- "link",
223
- "meta",
224
- "base",
225
- "svg",
226
- "math"
227
- ]
224
+ "button",
225
+ "input"
226
+ ],
227
+ disallowedTagsMode: "discard",
228
+ transformTags: { img: (tagName, attribs) => {
229
+ const next = { ...attribs };
230
+ if (next.src && SVG_DATA_URI_RE.test(next.src)) delete next.src;
231
+ return {
232
+ tagName,
233
+ attribs: next
234
+ };
235
+ } }
228
236
  };
229
237
  function sanitizeHtml(html) {
230
- return DOMPurify.sanitize(html, SANITIZE_OPTIONS);
238
+ return sanitizeHtmlLib(html, OPTIONS);
231
239
  }
232
240
  //#endregion
233
241
  //#region src/parser/attachment-parser.ts
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@primitivedotdev/sdk",
3
- "version": "1.0.0",
3
+ "version": "1.0.1",
4
4
  "description": "Official Primitive Node.js SDK: webhook, api, openapi, contract, and parser runtime modules.",
5
5
  "type": "module",
6
6
  "module": "./dist/index.js",
@@ -87,9 +87,9 @@
87
87
  },
88
88
  "dependencies": {
89
89
  "ajv": "^8.17.1",
90
- "isomorphic-dompurify": "^3.8.0",
91
90
  "mailparser": "^3.9.0",
92
91
  "nodemailer": "^8.0.7",
92
+ "sanitize-html": "^2.14.0",
93
93
  "tar-stream": "^3.1.8",
94
94
  "validator": "^13.15.35"
95
95
  },
@@ -100,6 +100,7 @@
100
100
  "@types/mailparser": "^3.4.6",
101
101
  "@types/node": "^22.10.2",
102
102
  "@types/nodemailer": "^8.0.0",
103
+ "@types/sanitize-html": "^2.13.0",
103
104
  "@types/tar-stream": "^3.1.4",
104
105
  "@types/validator": "^13.15.10",
105
106
  "@vitest/coverage-v8": "^4.1.4",