@roster-lock/shared 0.1.0 → 0.2.0

package/dist/match-lock-file/match-config/version-1/lock/rosters/caster-json-schema/human.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.humanInfoSchema = exports.friendlyStringSchemaValidator = exports.urlSchemaValidator = void 0;
+exports.humanInfoSchema = exports.friendlyStringSchemaValidator = exports.imageDataURISchemaValidator = exports.urlSchemaValidator = void 0;
 const json_schema_1 = require("../../../../../util-types/json-schema");
 const validate_1 = require("../validate");
 exports.urlSchemaValidator = (0, json_schema_1.defineKeyword)({
@@ -8,6 +8,11 @@ exports.urlSchemaValidator = (0, json_schema_1.defineKeyword)({
     type: "string",
     validate: validate_1.validateURL
 });
+exports.imageDataURISchemaValidator = (0, json_schema_1.defineKeyword)({
+    keyword: "imageDataURI",
+    type: "string",
+    validate: validate_1.validateImageDataURI
+});
 const human_1 = require("../validate/human");
 exports.friendlyStringSchemaValidator = (0, json_schema_1.defineKeyword)({
     keyword: "friendlyString",
@@ -22,7 +27,7 @@ exports.humanInfoSchema = {
         name: { type: "string", [exports.friendlyStringSchemaValidator.keyword]: true },
         author: { type: "string", [exports.friendlyStringSchemaValidator.keyword]: true },
         url: { type: "string", [exports.urlSchemaValidator.keyword]: true },
-        image: { type: "string", [exports.urlSchemaValidator.keyword]: true, nullable: true },
+        image: { type: "string", [exports.imageDataURISchemaValidator.keyword]: true, nullable: true },
     },
 };
 //# sourceMappingURL=human.js.map

package/dist/match-lock-file/match-config/version-1/lock/rosters/caster-json-schema/human.js.map

@@ -1 +1 @@
-{"version":3,"file":"human.js","sourceRoot":"","sources":["../../../../../../../src/match-lock-file/match-config/version-1/lock/rosters/caster-json-schema/human.ts"],"names":[],"mappings":";;;AAGA,uEAAsE;AAGtE,0CAA0C;AAC7B,QAAA,kBAAkB,GAAG,IAAA,2BAAa,EAAC;IAC9C,OAAO,EAAE,KAAK;IACd,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,sBAAW;CACtB,CAAC,CAAC;AAEH,6CAA2D;AAC9C,QAAA,6BAA6B,GAAG,IAAA,2BAAa,EAAC;IACzD,OAAO,EAAE,gBAAgB;IACzB,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,8BAAsB;CACjC,CAAC,CAAC;AAGU,QAAA,eAAe,GAAiD;IAC3E,IAAI,EAAE,QAAQ;IACd,oBAAoB,EAAE,KAAK;IAC3B,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC;IACnC,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,QAAA,6BAA6B,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE;QACvE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,QAAA,6BAA6B,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE;QACzE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,QAAA,kBAAkB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE;QAC3D,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,QAAA,kBAAkB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC9E;CACF,CAAA"}
+{"version":3,"file":"human.js","sourceRoot":"","sources":["../../../../../../../src/match-lock-file/match-config/version-1/lock/rosters/caster-json-schema/human.ts"],"names":[],"mappings":";;;AAGA,uEAAsE;AAGtE,0CAAgE;AACnD,QAAA,kBAAkB,GAAG,IAAA,2BAAa,EAAC;IAC9C,OAAO,EAAE,KAAK;IACd,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,sBAAW;CACtB,CAAC,CAAC;AAEU,QAAA,2BAA2B,GAAG,IAAA,2BAAa,EAAC;IACvD,OAAO,EAAE,cAAc;IACvB,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,+BAAoB;CAC/B,CAAC,CAAC;AAEH,6CAA2D;AAC9C,QAAA,6BAA6B,GAAG,IAAA,2BAAa,EAAC;IACzD,OAAO,EAAE,gBAAgB;IACzB,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,8BAAsB;CACjC,CAAC,CAAC;AAGU,QAAA,eAAe,GAAiD;IAC3E,IAAI,EAAE,QAAQ;IACd,oBAAoB,EAAE,KAAK;IAC3B,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC;IACnC,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,QAAA,6BAA6B,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE;QACvE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,QAAA,6BAA6B,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE;QACzE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,QAAA,kBAAkB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE;QAC3D,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,QAAA,2BAA2B,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;KACvF;CACF,CAAA"}

package/dist/match-lock-file/match-config/version-1/lock/rosters/caster-json-schema/index.js

@@ -52,6 +52,7 @@ exports.rostersSchema = {
 exports.rosterKeywords = [
     downloadableSources_1.downloadableSourceListSchemaValidator,
     human_1.urlSchemaValidator,
+    human_1.imageDataURISchemaValidator,
     human_1.friendlyStringSchemaValidator,
     id_1.idSchemaValidator,
     id_1.idUniquenessSchemaValidator,

package/dist/match-lock-file/match-config/version-1/lock/rosters/caster-json-schema/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/match-lock-file/match-config/version-1/lock/rosters/caster-json-schema/index.ts"],"names":[],"mappings":";;;AACA,uEAAsE;AAItE,6BAAgF;AAChF,uCAAiE;AACjE,mCAA6F;AAC7F,+DAG+B;AAC/B,mDAKyB;AACzB,qDAK0B;AAG1B,MAAM,gCAAgC,GAAG,IAAA,2BAAa,EAAC;IACrD,OAAO,EAAE,yBAAyB;IAClC,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,UAAU,KAAsB,EAAE,EAAE,MAAM,EAAsB,EAAE,IAAI;QAE9E,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,IAAG,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QAC/C,IAAA,gCAAqB,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;CACF,CAAC,CAAC;AAEU,QAAA,eAAe,GAAoC;IAC9D,IAAI,EAAE,QAAQ;IACd,CAAC,gCAAgC,CAAC,OAAO,CAAC,EAAE,IAAI;IAChD,QAAQ,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,CAAC;IAC9F,oBAAoB,EAAE,KAAK;IAC3B,UAAU,EAAE;QACV,EAAE,EAAE,aAAQ;QACZ,OAAO,EAAE,uBAAa;QACtB,SAAS,EAAE,uBAAe;QAC1B,eAAe,EAAE,+CAAyB;QAC1C,aAAa,EAAE,mCAAmB;QAClC,cAAc,EAAE,qCAAoB;KACrC;CACF,CAAC;AAGF,0CAAoF;AACpF,MAAM,oCAAoC,GAAG,IAAA,2BAAa,EAAC;IACzD,OAAO,EAAE,6BAA6B;IACtC,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,UAAU,OAAsC,EAAE,EAAE,MAAM,EAAsB,EAAE,IAAI;QAC9F,IAAA,yCAA8B,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;CACF,CAAC,CAAC;AAEU,QAAA,aAAa,GAAkD;IAC1E,IAAI,EAAE,QAAQ;IACd,CAAC,oCAAoC,CAAC,OAAO,CAAC,EAAE,IAAI;IACpD,QAAQ,EAAE,EAAE;IACZ,oBAAoB,EAAE;QACpB,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,QAAA,eAAe;KACvB;CACF,CAAC;AAGW,QAAA,cAAc,GAAG;IAE5B,2DAAqC;IAGrC,0BAAkB;IAClB,qCAA6B;IAG7B,sBAAiB;IACjB,gCAA2B;IAG3B,+CAA+B;IAC/B,gDAAgC;IAChC,qDAAqC;IAGrC,wDAAuC;IACvC,kDAAiC;IACjC,iDAAgC;IAGhC,+BAAqB;IAIrB,oCAAoC;IACpC,gCAAgC;CACjC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../src/match-lock-file/match-config/version-1/lock/rosters/caster-json-schema/index.ts"],"names":[],"mappings":";;;AACA,uEAAsE;AAItE,6BAAgF;AAChF,uCAAiE;AACjE,mCAA0H;AAC1H,+DAG+B;AAC/B,mDAKyB;AACzB,qDAK0B;AAG1B,MAAM,gCAAgC,GAAG,IAAA,2BAAa,EAAC;IACrD,OAAO,EAAE,yBAAyB;IAClC,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,UAAU,KAAsB,EAAE,EAAE,MAAM,EAAsB,EAAE,IAAI;QAE9E,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,IAAG,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QAC/C,IAAA,gCAAqB,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;CACF,CAAC,CAAC;AAEU,QAAA,eAAe,GAAoC;IAC9D,IAAI,EAAE,QAAQ;IACd,CAAC,gCAAgC,CAAC,OAAO,CAAC,EAAE,IAAI;IAChD,QAAQ,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,CAAC;IAC9F,oBAAoB,EAAE,KAAK;IAC3B,UAAU,EAAE;QACV,EAAE,EAAE,aAAQ;QACZ,OAAO,EAAE,uBAAa;QACtB,SAAS,EAAE,uBAAe;QAC1B,eAAe,EAAE,+CAAyB;QAC1C,aAAa,EAAE,mCAAmB;QAClC,cAAc,EAAE,qCAAoB;KACrC;CACF,CAAC;AAGF,0CAAoF;AACpF,MAAM,oCAAoC,GAAG,IAAA,2BAAa,EAAC;IACzD,OAAO,EAAE,6BAA6B;IACtC,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,UAAU,OAAsC,EAAE,EAAE,MAAM,EAAsB,EAAE,IAAI;QAC9F,IAAA,yCAA8B,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;CACF,CAAC,CAAC;AAEU,QAAA,aAAa,GAAkD;IAC1E,IAAI,EAAE,QAAQ;IACd,CAAC,oCAAoC,CAAC,OAAO,CAAC,EAAE,IAAI;IACpD,QAAQ,EAAE,EAAE;IACZ,oBAAoB,EAAE;QACpB,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,QAAA,eAAe;KACvB;CACF,CAAC;AAGW,QAAA,cAAc,GAAG;IAE5B,2DAAqC;IAGrC,0BAAkB;IAClB,mCAA2B;IAC3B,qCAA6B;IAG7B,sBAAiB;IACjB,gCAA2B;IAG3B,+CAA+B;IAC/B,gDAAgC;IAChC,qDAAqC;IAGrC,wDAAuC;IACvC,kDAAiC;IACjC,iDAAgC;IAGhC,+BAAqB;IAIrB,oCAAoC;IACpC,gCAAgC;CACjC,CAAC"}

package/dist/match-lock-file/match-config/version-1/lock/rosters/validate/human.js

@@ -8,7 +8,7 @@ function validateHumanInfo(humanInfo) {
     validateFriendlyString(humanInfo.author);
     (0, utils_1.validateURL)(humanInfo.url);
     if (humanInfo.image)
-        (0, utils_1.validateURL)(humanInfo.image);
+        (0, utils_1.validateImageDataURI)(humanInfo.image);
 }
 function validateFriendlyString(value) {
     if (!value.trim())

package/dist/match-lock-file/match-config/version-1/lock/rosters/validate/human.js.map

@@ -1 +1 @@
-{"version":3,"file":"human.js","sourceRoot":"","sources":["../../../../../../../src/match-lock-file/match-config/version-1/lock/rosters/validate/human.ts"],"names":[],"mappings":";;;;AACA,mCAAsC;AAGtC,2BACE,SAAgE;IAEhE,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACvC,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzC,IAAA,mBAAW,EAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAG,SAAS,CAAC,KAAK;QAAE,IAAA,mBAAW,EAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,gCAAuC,KAAa;IAClD,IAAG,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxD,IAAG,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC7D,IAAG,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAE5D,IAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACvE,IAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACxF,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;AACtF,CAAC"}
+{"version":3,"file":"human.js","sourceRoot":"","sources":["../../../../../../../src/match-lock-file/match-config/version-1/lock/rosters/validate/human.ts"],"names":[],"mappings":";;;;AACA,mCAA4D;AAG5D,2BACE,SAAgE;IAEhE,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACvC,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzC,IAAA,mBAAW,EAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAG,SAAS,CAAC,KAAK;QAAE,IAAA,4BAAoB,EAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,gCAAuC,KAAa;IAClD,IAAG,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxD,IAAG,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC7D,IAAG,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAE5D,IAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACvE,IAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACxF,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;AACtF,CAAC"}

package/dist/match-lock-file/match-config/version-1/lock/rosters/validate/utils.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.IMAGE_DATA_URI_MAX_BYTES = void 0;
 exports.validateSha256 = validateSha256;
 exports.validateURL = validateURL;
+exports.validateImageDataURI = validateImageDataURI;
 function validateSha256(value) {
     if (/^[0-9a-f]{64}$/i.test(value))
         return;
@@ -20,4 +22,27 @@ function validateURL(value) {
     if (!["https:"].includes(url.protocol))
         throw new Error(`${value} is not a valid https`);
 }
+const IMAGE_DATA_URI_PATTERN = /^data:image\/(png|jpeg|jpg|gif|webp|svg\+xml);base64,([A-Za-z0-9+/]+=*)$/;
+exports.IMAGE_DATA_URI_MAX_BYTES = 64 * 1024;
+const UNSAFE_SVG_CONTENT_PATTERN = /<\s*script\b|<\s*iframe\b|<\s*embed\b|<\s*object\b|<\s*foreignobject\b|on[a-z]+\s*=|javascript:/i;
+function validateImageDataURI(value) {
+    const match = IMAGE_DATA_URI_PATTERN.exec(value);
+    if (!match)
+        throw new Error(`${value.slice(0, 32)}... is not a valid "data:image/<type>;base64,..." URI`);
+    const [, mimeSubtype, base64Data] = match;
+    const decodedByteLength = Math.floor(base64Data.length * 3 / 4) - (base64Data.match(/=+$/)?.[0].length ?? 0);
+    if (decodedByteLength > exports.IMAGE_DATA_URI_MAX_BYTES) {
+        throw new Error(`Embedded image is ${decodedByteLength} bytes, which exceeds the ${exports.IMAGE_DATA_URI_MAX_BYTES}-byte limit`);
+    }
+    if (mimeSubtype === "svg+xml") {
+        const svgText = base64ToUtf8(base64Data);
+        if (UNSAFE_SVG_CONTENT_PATTERN.test(svgText)) {
+            throw new Error("Embedded SVG must not contain scripts, event handler attributes, or embedded documents");
+        }
+    }
+}
+function base64ToUtf8(base64) {
+    const bytes = Uint8Array.from(atob(base64), (c) => c.charCodeAt(0));
+    return new TextDecoder("utf-8").decode(bytes);
+}
 //# sourceMappingURL=utils.js.map

package/dist/match-lock-file/match-config/version-1/lock/rosters/validate/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../../../../../src/match-lock-file/match-config/version-1/lock/rosters/validate/utils.ts"],"names":[],"mappings":";;;;AACA,wBAA+B,KAAa;IAE1C,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO;IAC1C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uCAAuC,CAAC,CAAC;AACnE,CAAC;AAED,qBAA4B,KAAa;IACvC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACjD,CAAC;IACD,IAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW;QAAE,OAAO;IACpE,IAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uBAAuB,CAAC,CAAC;AAC1F,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../../../../../src/match-lock-file/match-config/version-1/lock/rosters/validate/utils.ts"],"names":[],"mappings":";;;;;;AACA,wBAA+B,KAAa;IAE1C,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO;IAC1C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uCAAuC,CAAC,CAAC;AACnE,CAAC;AAED,qBAA4B,KAAa;IACvC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACjD,CAAC;IACD,IAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW;QAAE,OAAO;IACpE,IAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uBAAuB,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,sBAAsB,GAAG,0EAA0E,CAAC;AAC7F,QAAA,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;AAKlD,MAAM,0BAA0B,GAAG,kGAAkG,CAAC;AAEtI,8BAAqC,KAAa;IAChD,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,IAAG,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,uDAAuD,CAAC,CAAC;IAEzG,MAAM,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,GAAG,KAAK,CAAC;IAC1C,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IAC7G,IAAG,iBAAiB,GAAG,QAAA,wBAAwB,EAAC,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,qBAAqB,iBAAiB,6BAA6B,QAAA,wBAAwB,aAAa,CACzG,CAAC;IACJ,CAAC;IAED,IAAG,WAAW,KAAK,SAAS,EAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACzC,IAAG,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAC,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC"}

package/dist/match-lock-file/match-config/version-1/piece-info/keywords.js

@@ -8,6 +8,7 @@ const json_schema_1 = require("../../../util-types/json-schema");
 function ignore() { return true; }
 exports.rosterLockPieceInfoKeywords = [
     human_1.urlSchemaValidator,
+    human_1.imageDataURISchemaValidator,
     human_1.friendlyStringSchemaValidator,
     downloadableSources_1.downloadableSourceListSchemaValidator,
     (0, json_schema_1.defineKeyword)({

package/dist/match-lock-file/match-config/version-1/piece-info/keywords.js.map

@@ -1 +1 @@
-{"version":3,"file":"keywords.js","sourceRoot":"","sources":["../../../../../src/match-lock-file/match-config/version-1/piece-info/keywords.ts"],"names":[],"mappings":";;;AACA,oEAGkD;AAClD,gGAEgE;AAChE,oFAI0D;AAE1D,iEAAgE;AAEhE,SAAS,MAAM,KAAI,OAAO,IAAI,CAAC,CAAC,CAAC;AAEpB,QAAA,2BAA2B,GAAG;IACzC,0BAAkB;IAClB,qCAA6B;IAE7B,2DAAqC;IACrC,IAAA,2BAAa,EAAC;QACZ,OAAO,EAAE,+CAA+B,CAAC,OAAO;QAChD,IAAI,EAAE,+CAA+B,CAAC,IAAI;QAC1C,QAAQ,EAAE,MAAM;KACjB,CAAC;IACF,IAAA,2BAAa,EAAC;QACZ,OAAO,EAAE,gDAAgC,CAAC,OAAO;QACjD,IAAI,EAAE,gDAAgC,CAAC,IAAI;QAC3C,QAAQ,EAAE,MAAM;KACjB,CAAC;IACF,IAAA,2BAAa,EAAC;QACZ,OAAO,EAAE,qDAAqC,CAAC,OAAO;QACtD,IAAI,EAAE,qDAAqC,CAAC,IAAI;QAChD,QAAQ,EAAE,MAAM;KACjB,CAAC;CACH,CAAC"}
+{"version":3,"file":"keywords.js","sourceRoot":"","sources":["../../../../../src/match-lock-file/match-config/version-1/piece-info/keywords.ts"],"names":[],"mappings":";;;AACA,oEAIkD;AAClD,gGAEgE;AAChE,oFAI0D;AAE1D,iEAAgE;AAEhE,SAAS,MAAM,KAAI,OAAO,IAAI,CAAC,CAAC,CAAC;AAEpB,QAAA,2BAA2B,GAAG;IACzC,0BAAkB;IAClB,mCAA2B;IAC3B,qCAA6B;IAE7B,2DAAqC;IACrC,IAAA,2BAAa,EAAC;QACZ,OAAO,EAAE,+CAA+B,CAAC,OAAO;QAChD,IAAI,EAAE,+CAA+B,CAAC,IAAI;QAC1C,QAAQ,EAAE,MAAM;KACjB,CAAC;IACF,IAAA,2BAAa,EAAC;QACZ,OAAO,EAAE,gDAAgC,CAAC,OAAO;QACjD,IAAI,EAAE,gDAAgC,CAAC,IAAI;QAC3C,QAAQ,EAAE,MAAM;KACjB,CAAC;IACF,IAAA,2BAAa,EAAC;QACZ,OAAO,EAAE,qDAAqC,CAAC,OAAO;QACtD,IAAI,EAAE,qDAAqC,CAAC,IAAI;QAChD,QAAQ,EAAE,MAAM;KACjB,CAAC;CACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@roster-lock/shared",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Shared utilities, variables, etc between client and server",
   "keywords": [
     "roster-lock",
@@ -39,7 +39,7 @@
     "magnet-uri": "^7.0.7",
     "micromatch": "^4.0.8",
     "runtypes": "^7.0.4",
-    "@roster-lock/types": "1.0.0",
+    "@roster-lock/types": "1.1.0",
     "@roster-lock/utils": "1.0.0"
   },
   "scripts": {

package/src/match-lock-file/match-config/version-1/lock/rosters/caster-json-schema/human.ts

@@ -4,13 +4,19 @@ type RosterLockPiece = RosterLockV1Config["rosters"][string][number];
 import { defineKeyword } from "../../../../../util-types/json-schema";
 
 
-import { validateURL } from "../validate";
+import { validateURL, validateImageDataURI } from "../validate";
 export const urlSchemaValidator = defineKeyword({
   keyword: "URL",
   type: "string",
   validate: validateURL
 });
 
+export const imageDataURISchemaValidator = defineKeyword({
+  keyword: "imageDataURI",
+  type: "string",
+  validate: validateImageDataURI
+});
+
 import { validateFriendlyString } from "../validate/human";
 export const friendlyStringSchemaValidator = defineKeyword({
   keyword: "friendlyString",
@@ -27,7 +33,7 @@ export const humanInfoSchema: JSONSchemaType<RosterLockPiece["humanInfo"]> = {
     name: { type: "string", [friendlyStringSchemaValidator.keyword]: true },
     author: { type: "string", [friendlyStringSchemaValidator.keyword]: true },
     url: { type: "string", [urlSchemaValidator.keyword]: true },
-    image: { type: "string", [urlSchemaValidator.keyword]: true, nullable: true },
+    image: { type: "string", [imageDataURISchemaValidator.keyword]: true, nullable: true },
   },
 }
 

package/src/match-lock-file/match-config/version-1/lock/rosters/caster-json-schema/index.ts

@@ -5,7 +5,7 @@ type RosterLockPiece = RosterLockV1Config["rosters"][string][number];
 
 import { idSchema, idUniquenessSchemaValidator, idSchemaValidator } from "./id";
 import { versionSchema, sha256SchemaValidator } from "./version";
-import { humanInfoSchema, urlSchemaValidator, friendlyStringSchemaValidator } from "./human";
+import { humanInfoSchema, urlSchemaValidator, imageDataURISchemaValidator, friendlyStringSchemaValidator } from "./human";
 import {
   downloadableSourcesSchema,
   downloadableSourceListSchemaValidator,
@@ -77,6 +77,7 @@ export const rosterKeywords = [
 
   // Human Related
   urlSchemaValidator,
+  imageDataURISchemaValidator,
   friendlyStringSchemaValidator,
 
   // Id Related

package/src/match-lock-file/match-config/version-1/lock/rosters/validate/human.ts

@@ -1,5 +1,5 @@
 import { RosterLockV1Config } from "@roster-lock/types";
-import { validateURL } from "./utils";
+import { validateURL, validateImageDataURI } from "./utils";
 
 
 export function validateHumanInfo(
@@ -8,7 +8,7 @@ export function validateHumanInfo(
   validateFriendlyString(humanInfo.name);
   validateFriendlyString(humanInfo.author);
   validateURL(humanInfo.url);
-  if(humanInfo.image) validateURL(humanInfo.image);
+  if(humanInfo.image) validateImageDataURI(humanInfo.image);
 }
 
 export function validateFriendlyString(value: string){

package/src/match-lock-file/match-config/version-1/lock/rosters/validate/utils.ts

@@ -15,3 +15,36 @@ export function validateURL(value: string){
   if(url.protocol === "http:" && url.hostname === "localhost") return;
   if(!["https:"].includes(url.protocol)) throw new Error(`${value} is not a valid https`);
 }
+
+const IMAGE_DATA_URI_PATTERN = /^data:image\/(png|jpeg|jpg|gif|webp|svg\+xml);base64,([A-Za-z0-9+/]+=*)$/;
+export const IMAGE_DATA_URI_MAX_BYTES = 64 * 1024;
+
+// Scripts/event handlers wouldn't execute from an <img src="data:...">, but pieces can
+// come from third-party downloadSources - reject anything that would be dangerous if a
+// future consumer ever rendered the SVG a different way (e.g. inline in the DOM).
+const UNSAFE_SVG_CONTENT_PATTERN = /<\s*script\b|<\s*iframe\b|<\s*embed\b|<\s*object\b|<\s*foreignobject\b|on[a-z]+\s*=|javascript:/i;
+
+export function validateImageDataURI(value: string){
+  const match = IMAGE_DATA_URI_PATTERN.exec(value);
+  if(!match) throw new Error(`${value.slice(0, 32)}... is not a valid "data:image/<type>;base64,..." URI`);
+
+  const [, mimeSubtype, base64Data] = match;
+  const decodedByteLength = Math.floor(base64Data.length * 3 / 4) - (base64Data.match(/=+$/)?.[0].length ?? 0);
+  if(decodedByteLength > IMAGE_DATA_URI_MAX_BYTES){
+    throw new Error(
+      `Embedded image is ${decodedByteLength} bytes, which exceeds the ${IMAGE_DATA_URI_MAX_BYTES}-byte limit`
+    );
+  }
+
+  if(mimeSubtype === "svg+xml"){
+    const svgText = base64ToUtf8(base64Data);
+    if(UNSAFE_SVG_CONTENT_PATTERN.test(svgText)){
+      throw new Error("Embedded SVG must not contain scripts, event handler attributes, or embedded documents");
+    }
+  }
+}
+
+function base64ToUtf8(base64: string): string {
+  const bytes = Uint8Array.from(atob(base64), (c) => c.charCodeAt(0));
+  return new TextDecoder("utf-8").decode(bytes);
+}

package/src/match-lock-file/match-config/version-1/piece-info/keywords.ts

@@ -1,6 +1,7 @@
 
 import {
   urlSchemaValidator,
+  imageDataURISchemaValidator,
   friendlyStringSchemaValidator,
 } from "../lock/rosters/caster-json-schema/human";
 import {
@@ -18,6 +19,7 @@ function ignore(){ return true; }
 
 export const rosterLockPieceInfoKeywords = [
   urlSchemaValidator,
+  imageDataURISchemaValidator,
   friendlyStringSchemaValidator,
 
   downloadableSourceListSchemaValidator,