@rowsncolumns/utils 9.5.0 → 9.5.3

package/dist/esm/string.js

@@ -118,13 +118,35 @@ export const cellRangeToAddress = (sheetName, range) => {
         columnIndex: range.endColumnIndex,
     })}`;
 };
-/* Sanitize sheet names */
+/** `A1`-style lookalike: 1–3 ASCII letters followed only by digits (`AB12`, `XFD1`). */
+const SHEET_NAME_A1_LOOKALIKE = /^[A-Za-z]{1,3}\d+$/;
+/** `R1C1`-style lookalike: an optional-digit `R` part and/or `C` part, nothing else (`R`, `C22`, `R1C1`). */
+const SHEET_NAME_R1C1_LOOKALIKE = /^(?:[Rr]\d*)?(?:[Cc]\d*)?$/;
+/**
+ * Must `name` be single-quoted as a sheet qualifier (`'My Data'!A1`)? Excel writes it bare only when
+ * it is a plain identifier — ASCII letters and digits, starting with a letter — and cannot be read
+ * as something else: a cell reference (`A1`, `XFD1`, `R1C1`), or a boolean (`TRUE`). A leading digit
+ * (`2024`, `1Sheet`) always quotes. Deliberately a superset of Excel's minimum (a `_`, `.` or
+ * non-ASCII letter also quotes): over-quoting is always valid, under-quoting makes `=2024!A1` a
+ * formula Excel rejects (rowsncolumns/spreadsheet#939 K-10).
+ */
+export const sheetNameNeedsQuoting = (name) => name.length === 0 ||
+    /[^A-Za-z0-9]/.test(name) ||
+    /^\d/.test(name) ||
+    SHEET_NAME_A1_LOOKALIKE.test(name) ||
+    SHEET_NAME_R1C1_LOOKALIKE.test(name) ||
+    /^(?:true|false)$/i.test(name);
+/**
+ * Quote a sheet name for use as a formula qualifier when Excel requires it (see
+ * {@link sheetNameNeedsQuoting}); apostrophes inside are doubled (`'O''Neil'`). Rename, cross-sheet
+ * reference generation and formula-bar insertion all quote through here so they agree.
+ */
 export const sanitizeSheetName = (name) => {
     if (name === void 0)
         return void 0;
     if (typeof name === "number")
         return name;
-    if (/\s+|[^a-z|A-Z|0-9]/.test(name)) {
+    if (sheetNameNeedsQuoting(name)) {
         // Escape single quotes by doubling them for valid sheet references.
         const escaped = name.replace(/'/g, "''");
         return `'${escaped}'`;
@@ -238,6 +260,44 @@ const URL_SCHEME = /^([a-zA-Z][a-zA-Z0-9+.-]*):/;
 // explicit scheme (javascript:, data:, vbscript:, …) is a script/content
 // injection vector and is rejected.
 const SAFE_URL_SCHEMES = new Set(["http", "https", "mailto", "tel", "ftp"]);
+/**
+ * Whether a hyperlink target read from untrusted markup (clipboard HTML) may
+ * be kept. A URL with an explicit scheme must use one of the safe schemes;
+ * scheme-less, protocol-relative, path and fragment references are allowed
+ * (they are normalized by {@link normalizeExternalUrl} before being opened).
+ * Applies the same tab/newline and C0-control stripping as the browser's URL
+ * canonicalization so `java\tscript:` cannot slip through.
+ */
+export const isSafeHyperlinkUri = (uri) => {
+    if (uri == null) {
+        return false;
+    }
+    const trimmed = uri
+        .replace(/[\t\n\r]/g, "")
+        .replace(/^[\u0000-\u0020]+|[\u0000-\u0020]+$/g, "")
+        .trim();
+    if (!trimmed) {
+        return false;
+    }
+    const schemeMatch = URL_SCHEME.exec(trimmed);
+    if (!schemeMatch) {
+        return true;
+    }
+    return SAFE_URL_SCHEMES.has(schemeMatch[1].toLowerCase());
+};
+/**
+ * Escape text for interpolation into an HTML text node (`text/html`
+ * clipboard fragments): a cell whose value is literally `<b>x</b>` must paste
+ * back as that text, not as bold "x".
+ */
+export const escapeHtmlText = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+/** Escape a value for interpolation into a quoted HTML attribute. */
+export const escapeHtmlAttribute = (value) => value
+    .replace(/&/g, "&amp;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;");
 /**
  * Normalize an external hyperlink target for the browser. A stored URL
  * without a scheme ("paradigm.xyz") would otherwise be resolved relative to

package/dist/esm/tsconfig.esm.tsbuildinfo

@@ -1 +1 @@
-{"root":["../../array.ts","../../cell-data-helpers.ts","../../color.ts","../../colors.ts","../../conditional-format.ts","../../content-hash.ts","../../data-validation.ts","../../date.ts","../../dom.ts","../../excel-number-format.ts","../../formatter.ts","../../formula-locale.ts","../../formula-refs.ts","../../formula.ts","../../index.ts","../../keyboard.ts","../../locale.ts","../../log.ts","../../memoize.ts","../../numbers.ts","../../rich-text-html.ts","../../rich-text-links.ts","../../selection.ts","../../shared-string-canonical.ts","../../sheet-span.ts","../../sort.ts","../../sparkline-groups.ts","../../string.ts","../../table-names.ts","../../table-styles.ts","../../table-totals.ts","../../typeguards.ts","../../uuid.ts","../../vitest.config.ts","../../formula-locale/formula-locale-data.generated.ts"],"version":"5.8.3"}
+{"root":["../../array.ts","../../cell-data-helpers.ts","../../clipboard-html-sanitize.ts","../../color.ts","../../colors.ts","../../condition-operand.ts","../../conditional-format.ts","../../content-hash.ts","../../data-validation.ts","../../date.ts","../../dom.ts","../../excel-number-format.ts","../../formatter.ts","../../formula-locale.ts","../../formula-refs.ts","../../formula.ts","../../index.ts","../../keyboard.ts","../../locale.ts","../../log.ts","../../memoize.ts","../../numbers.ts","../../rich-text-html.ts","../../rich-text-links.ts","../../selection.ts","../../shared-string-canonical.ts","../../sheet-names.ts","../../sheet-protection.ts","../../sheet-span.ts","../../sort.ts","../../sparkline-groups.ts","../../string.ts","../../table-names.ts","../../table-styles.ts","../../table-totals.ts","../../typeguards.ts","../../uuid.ts","../../vitest.config.ts","../../formula-locale/formula-locale-data.generated.ts"],"version":"5.8.3"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rowsncolumns/utils",
-  "version": "9.5.0",
+  "version": "9.5.3",
   "author": "Vinay M",
   "license": "SEE LICENSE IN LICENSE.md",
   "main": "./dist/cjs/index.js",
@@ -44,7 +44,7 @@
   },
   "dependencies": {
     "numfmt": "^3.2.2",
-    "@rowsncolumns/common-types": ">=5.3.0"
+    "@rowsncolumns/common-types": ">=5.3.2"
   },
   "devDependencies": {},
   "peerDependencies": {}