@reckona/mreact-shared 0.0.66 → 0.0.67

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reckona/mreact-shared",
-  "version": "0.0.66",
+  "version": "0.0.67",
   "description": "Shared runtime utilities used by mreact packages.",
   "keywords": [
     "jsx",
@@ -23,7 +23,8 @@
     "dist/**/*.js",
     "dist/**/*.js.map",
     "dist/**/*.d.ts",
-    "dist/**/*.d.ts.map"
+    "dist/**/*.d.ts.map",
+    "src/**/*"
   ],
   "type": "module",
   "sideEffects": false,

package/src/html-escape.ts

@@ -0,0 +1,14 @@
+export function escapeHtmlText(value: unknown): string {
+  return String(value)
+    .replaceAll("&", "&")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;");
+}
+
+export function escapeHtmlAttribute(value: unknown): string {
+  return escapeHtmlText(value).replaceAll("\"", "&quot;");
+}
+
+export function escapeHtmlQuotedAttribute(value: unknown): string {
+  return String(value).replaceAll("&", "&amp;").replaceAll("\"", "&quot;");
+}

package/src/index.ts

@@ -0,0 +1,2 @@
+export * from "./html-escape.js";
+export * from "./url-safety.js";

package/src/url-safety.ts

@@ -0,0 +1,115 @@
+// Canonical URL and HTML-attribute safety helpers shared across server,
+// React compatibility, and reactive DOM render paths.
+
+const URL_ATTRIBUTE_NAMES = new Set([
+  "href",
+  "src",
+  "action",
+  "formaction",
+  "xlink:href",
+  "ping",
+  "poster",
+  "background",
+  "manifest",
+]);
+
+const SRCSET_ATTRIBUTE_NAMES = new Set(["srcset", "imagesrcset"]);
+
+const DANGEROUS_HTML_ATTRIBUTE_NAMES = new Set(["srcdoc"]);
+
+const UNSAFE_URL_SCHEMES = new Set([
+  "javascript",
+  "data",
+  "vbscript",
+  "livescript",
+  "mhtml",
+  "file",
+]);
+
+export function isDangerousHtmlAttribute(name: string): boolean {
+  return DANGEROUS_HTML_ATTRIBUTE_NAMES.has(name);
+}
+
+export function isDangerousHtmlOptIn(
+  value: unknown,
+): value is { __html: string } {
+  return (
+    typeof value === "object" &&
+    value !== null &&
+    "__html" in value &&
+    typeof (value as { __html?: unknown }).__html === "string"
+  );
+}
+
+export function isUrlAttribute(name: string): boolean {
+  return URL_ATTRIBUTE_NAMES.has(name);
+}
+
+export function isSrcsetAttribute(name: string): boolean {
+  return SRCSET_ATTRIBUTE_NAMES.has(name);
+}
+
+export function isUnsafeUrlAttribute(name: string, value: string): boolean {
+  if (isUrlAttribute(name)) {
+    return isUnsafeUrlValueForName(name, value);
+  }
+  if (isSrcsetAttribute(name)) {
+    const canonical = canonicalizeUrlForSchemeCheck(value);
+    for (const candidate of canonical.split(",")) {
+      const url = candidate.trim().split(/\s+/)[0] ?? "";
+      if (url === "") continue;
+      if (isUnsafeUrlValueForName("src", url)) return true;
+    }
+    return false;
+  }
+  return false;
+}
+
+export function safeUrlAttributeValue(name: string, value: string): string | undefined {
+  return isUnsafeUrlAttribute(name, value) ? undefined : value;
+}
+
+export function isUnsafeMetaRefreshContent(httpEquiv: string, content: string): boolean {
+  if (httpEquiv.toLowerCase() !== "refresh") return false;
+  const match = /^[^;]*;\s*url\s*=\s*([\s\S]+)$/iu.exec(content);
+  if (match === null || match[1] === undefined) return false;
+  return isUnsafeUrlValueForName("href", stripSurroundingQuotes(match[1].trim()));
+}
+
+function stripSurroundingQuotes(value: string): string {
+  if (value.length < 2) return value;
+
+  const quote = value[0];
+  if ((quote === '"' || quote === "'") && value[value.length - 1] === quote) {
+    return value.slice(1, -1).trim();
+  }
+
+  return value;
+}
+
+function canonicalizeUrlForSchemeCheck(value: string): string {
+  let start = 0;
+
+  while (start < value.length && value.charCodeAt(start) <= 0x20) {
+    start += 1;
+  }
+
+  return value.slice(start).replace(/[\t\r\n]/g, "");
+}
+
+function schemeOf(value: string): string | undefined {
+  const match = /^([a-zA-Z][a-zA-Z0-9+.-]*):/.exec(value);
+  if (match === null || match[1] === undefined) return undefined;
+  return match[1].toLowerCase();
+}
+
+function isUnsafeUrlValueForName(name: string, value: string): boolean {
+  const canonical = canonicalizeUrlForSchemeCheck(value);
+  const scheme = schemeOf(canonical);
+  if (scheme === undefined) return false;
+  if (!UNSAFE_URL_SCHEMES.has(scheme)) return false;
+  if (scheme === "data" && (name === "src" || name === "poster")) {
+    if (/^data:image\/(?!svg\+xml(?:[;,]|$))/i.test(canonical)) return false;
+  }
+  return true;
+}