@slidev/parser 52.16.0 → 52.17.1

package/dist/core.d.mts

@@ -1,6 +1,5 @@
-import { a as TimesplitOutput, i as TimesplitInput, n as parseRangeString, o as parseTimesplits, r as parseTimeString, t as parseAspectRatio } from "./utils-DpcPp-I0.mjs";
+import { a as TimesplitInput, i as parseTimeString, n as parseAspectRatio, o as TimesplitOutput, r as parseRangeString, s as parseTimesplits, t as isPathInsideRoots } from "./utils-CmpEoa5K.mjs";
 import { FontOptions, ResolvedFontOptions, SlidevConfig, SlidevDetectedFeatures, SlidevMarkdown, SlidevPreparserExtension, SlidevThemeMeta, SourceSlideInfo } from "@slidev/types";
-
 //#region src/config.d.ts
 declare function getDefaultConfig(): SlidevConfig;
 declare function resolveConfig(headmatter: any, themeMeta?: SlidevThemeMeta, filepath?: string, verify?: boolean): SlidevConfig;
@@ -26,4 +25,4 @@ declare function parseSlide(raw: string, options?: SlidevParserOptions): Omit<So
 declare function parse(markdown: string, filepath: string, extensions?: SlidevPreparserExtension[], options?: SlidevParserOptions): Promise<SlidevMarkdown>;
 declare function parseSync(markdown: string, filepath: string, options?: SlidevParserOptions): SlidevMarkdown;
 //#endregion
-export { SlidevParserOptions, TimesplitInput, TimesplitOutput, detectFeatures, extractImagesUsage, getDefaultConfig, parse, parseAspectRatio, parseRangeString, parseSlide, parseSync, parseTimeString, parseTimesplits, prettify, prettifySlide, resolveConfig, resolveFonts, stringify, stringifySlide, verifyConfig };
+export { SlidevParserOptions, TimesplitInput, TimesplitOutput, detectFeatures, extractImagesUsage, getDefaultConfig, isPathInsideRoots, parse, parseAspectRatio, parseRangeString, parseSlide, parseSync, parseTimeString, parseTimesplits, prettify, prettifySlide, resolveConfig, resolveFonts, stringify, stringifySlide, verifyConfig };

package/dist/core.mjs

@@ -1,4 +1,4 @@
-import { parseAspectRatio, parseRangeString, parseTimeString, parseTimesplits } from "./utils.mjs";
+import { isPathInsideRoots, parseAspectRatio, parseRangeString, parseTimeString, parseTimesplits } from "./utils.mjs";
 import { ensurePrefix, toArray, uniq } from "@antfu/utils";
 import YAML from "yaml";
 //#region src/config.ts
@@ -44,8 +44,10 @@ function getDefaultConfig() {
 		htmlAttrs: {},
 		transition: null,
 		editor: true,
+		mcp: true,
 		contextMenu: null,
 		wakeLock: true,
+		pwa: false,
 		remote: false,
 		mdc: false,
 		comark: false,
@@ -476,4 +478,4 @@ function hash(str) {
 	return hash.toString(36).slice(0, 12);
 }
 //#endregion
-export { detectFeatures, extractImagesUsage, getDefaultConfig, parse, parseAspectRatio, parseRangeString, parseSlide, parseSync, parseTimeString, parseTimesplits, prettify, prettifySlide, resolveConfig, resolveFonts, stringify, stringifySlide, verifyConfig };
+export { detectFeatures, extractImagesUsage, getDefaultConfig, isPathInsideRoots, parse, parseAspectRatio, parseRangeString, parseSlide, parseSync, parseTimeString, parseTimesplits, prettify, prettifySlide, resolveConfig, resolveFonts, stringify, stringifySlide, verifyConfig };

package/dist/fs.d.mts

@@ -1,12 +1,17 @@
-import { a as TimesplitOutput, i as TimesplitInput, n as parseRangeString, o as parseTimesplits, r as parseTimeString, t as parseAspectRatio } from "./utils-DpcPp-I0.mjs";
+import { a as TimesplitInput, i as parseTimeString, n as parseAspectRatio, o as TimesplitOutput, r as parseRangeString, s as parseTimesplits, t as isPathInsideRoots } from "./utils-CmpEoa5K.mjs";
 import { SlidevParserOptions, detectFeatures, extractImagesUsage, getDefaultConfig, parse, parseSlide, parseSync, prettify, prettifySlide, resolveConfig, resolveFonts, stringify, stringifySlide, verifyConfig } from "./core.mjs";
 import { PreparserExtensionLoader, SlidevData, SlidevMarkdown } from "@slidev/types";
-
 //#region src/fs.d.ts
 declare function injectPreparserExtensionLoader(fn: PreparserExtensionLoader): void;
 interface LoadRootsInfo {
   roots: string[];
   userRoot: string;
+  /**
+   * When provided, `src:` includes resolving outside these roots are
+   * rejected (recorded as an error) instead of being loaded. Optional for
+   * backward compatibility with other `@slidev/parser` consumers.
+   */
+  allowedRoots?: string[];
 }
 /**
  * Slidev data without config and themeMeta,
@@ -16,4 +21,4 @@ type LoadedSlidevData = Omit<SlidevData, 'config' | 'themeMeta'>;
 declare function load(options: LoadRootsInfo, filepath: string, sources?: Record<string, string> | ((path: string) => Promise<string>), mode?: string): Promise<LoadedSlidevData>;
 declare function save(markdown: SlidevMarkdown): Promise<string>;
 //#endregion
-export { LoadRootsInfo, LoadedSlidevData, SlidevParserOptions, TimesplitInput, TimesplitOutput, detectFeatures, extractImagesUsage, getDefaultConfig, injectPreparserExtensionLoader, load, parse, parseAspectRatio, parseRangeString, parseSlide, parseSync, parseTimeString, parseTimesplits, prettify, prettifySlide, resolveConfig, resolveFonts, save, stringify, stringifySlide, verifyConfig };
+export { LoadRootsInfo, LoadedSlidevData, SlidevParserOptions, TimesplitInput, TimesplitOutput, detectFeatures, extractImagesUsage, getDefaultConfig, injectPreparserExtensionLoader, isPathInsideRoots, load, parse, parseAspectRatio, parseRangeString, parseSlide, parseSync, parseTimeString, parseTimesplits, prettify, prettifySlide, resolveConfig, resolveFonts, save, stringify, stringifySlide, verifyConfig };

package/dist/fs.mjs

@@ -1,10 +1,10 @@
-import { parseAspectRatio, parseRangeString, parseTimeString, parseTimesplits } from "./utils.mjs";
+import { isPathInsideRoots, parseAspectRatio, parseRangeString, parseTimeString, parseTimesplits } from "./utils.mjs";
 import { detectFeatures, extractImagesUsage, getDefaultConfig, parse, parseSlide, parseSync, prettify, prettifySlide, resolveConfig, resolveFonts, stringify, stringifySlide, verifyConfig } from "./core.mjs";
 import { slash } from "@antfu/utils";
 import YAML from "yaml";
+import { dirname, resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { readFile, writeFile } from "node:fs/promises";
-import { dirname, resolve } from "node:path";
 //#region src/fs.ts
 const RE_FRONTMATTER_START = /^---(?:[^-].*)?$/;
 const RE_BLANK_LINE = /^\s*$/;
@@ -66,7 +66,22 @@ async function load(options, filepath, sources = {}, mode) {
 				...frontmatterOverride
 			};
 			delete frontmatterOverride.src;
-			if (!existsSync(path)) {
+			const ancestorPaths = new Set((importChain ?? []).map((s) => s.filepath));
+			if (path === slide.filepath || ancestorPaths.has(path)) {
+				md.errors ??= [];
+				md.errors.push({
+					row: slide.start,
+					message: `Circular import detected for "${slide.frontmatter.src}" (${path})`
+				});
+				return;
+			}
+			if (options.allowedRoots && !isPathInsideRoots(path, options.allowedRoots)) {
+				md.errors ??= [];
+				md.errors.push({
+					row: slide.start,
+					message: `Imported markdown escapes the project root: ${path}`
+				});
+			} else if (!existsSync(path)) {
 				md.errors ??= [];
 				md.errors.push({
 					row: slide.start,
@@ -107,4 +122,4 @@ async function save(markdown) {
 	return fileContent;
 }
 //#endregion
-export { detectFeatures, extractImagesUsage, getDefaultConfig, injectPreparserExtensionLoader, load, parse, parseAspectRatio, parseRangeString, parseSlide, parseSync, parseTimeString, parseTimesplits, prettify, prettifySlide, resolveConfig, resolveFonts, save, stringify, stringifySlide, verifyConfig };
+export { detectFeatures, extractImagesUsage, getDefaultConfig, injectPreparserExtensionLoader, isPathInsideRoots, load, parse, parseAspectRatio, parseRangeString, parseSlide, parseSync, parseTimeString, parseTimesplits, prettify, prettifySlide, resolveConfig, resolveFonts, save, stringify, stringifySlide, verifyConfig };

package/dist/index.d.mts

@@ -1,3 +1,3 @@
-import { a as TimesplitOutput, i as TimesplitInput, n as parseRangeString, o as parseTimesplits, r as parseTimeString, t as parseAspectRatio } from "./utils-DpcPp-I0.mjs";
+import { a as TimesplitInput, i as parseTimeString, n as parseAspectRatio, o as TimesplitOutput, r as parseRangeString, s as parseTimesplits, t as isPathInsideRoots } from "./utils-CmpEoa5K.mjs";
 import { SlidevParserOptions, detectFeatures, extractImagesUsage, getDefaultConfig, parse, parseSlide, parseSync, prettify, prettifySlide, resolveConfig, resolveFonts, stringify, stringifySlide, verifyConfig } from "./core.mjs";
-export { SlidevParserOptions, TimesplitInput, TimesplitOutput, detectFeatures, extractImagesUsage, getDefaultConfig, parse, parseAspectRatio, parseRangeString, parseSlide, parseSync, parseTimeString, parseTimesplits, prettify, prettifySlide, resolveConfig, resolveFonts, stringify, stringifySlide, verifyConfig };
+export { SlidevParserOptions, TimesplitInput, TimesplitOutput, detectFeatures, extractImagesUsage, getDefaultConfig, isPathInsideRoots, parse, parseAspectRatio, parseRangeString, parseSlide, parseSync, parseTimeString, parseTimesplits, prettify, prettifySlide, resolveConfig, resolveFonts, stringify, stringifySlide, verifyConfig };

package/dist/index.mjs

@@ -1,3 +1,3 @@
-import { parseAspectRatio, parseRangeString, parseTimeString, parseTimesplits } from "./utils.mjs";
+import { isPathInsideRoots, parseAspectRatio, parseRangeString, parseTimeString, parseTimesplits } from "./utils.mjs";
 import { detectFeatures, extractImagesUsage, getDefaultConfig, parse, parseSlide, parseSync, prettify, prettifySlide, resolveConfig, resolveFonts, stringify, stringifySlide, verifyConfig } from "./core.mjs";
-export { detectFeatures, extractImagesUsage, getDefaultConfig, parse, parseAspectRatio, parseRangeString, parseSlide, parseSync, parseTimeString, parseTimesplits, prettify, prettifySlide, resolveConfig, resolveFonts, stringify, stringifySlide, verifyConfig };
+export { detectFeatures, extractImagesUsage, getDefaultConfig, isPathInsideRoots, parse, parseAspectRatio, parseRangeString, parseSlide, parseSync, parseTimeString, parseTimesplits, prettify, prettifySlide, resolveConfig, resolveFonts, stringify, stringifySlide, verifyConfig };

package/dist/{utils-DpcPp-I0.d.mts → utils-CmpEoa5K.d.mts}

@@ -20,6 +20,12 @@ declare function parseTimeString(timestamp: string | number): {
 };
 //#endregion
 //#region src/utils.d.ts
+/**
+ * Whether `filePath` resolves inside any of `roots` (no `..` escape).
+ * Inlined here (rather than imported from the `slidev` package) because
+ * `@slidev/parser` must stay independent of `@slidev/slidev`.
+ */
+declare function isPathInsideRoots(filePath: string, roots: string[]): boolean;
 /**
  * 1,3-5,8 => [1, 3, 4, 5, 8]
  */
@@ -29,4 +35,4 @@ declare function parseRangeString(total: number, rangeStr?: string): number[];
  */
 declare function parseAspectRatio(str: string | number): number;
 //#endregion
-export { TimesplitOutput as a, TimesplitInput as i, parseRangeString as n, parseTimesplits as o, parseTimeString as r, parseAspectRatio as t };
+export { TimesplitInput as a, parseTimeString as i, parseAspectRatio as n, TimesplitOutput as o, parseRangeString as r, parseTimesplits as s, isPathInsideRoots as t };

package/dist/utils.d.mts

@@ -1,2 +1,2 @@
-import { a as TimesplitOutput, i as TimesplitInput, n as parseRangeString, o as parseTimesplits, r as parseTimeString, t as parseAspectRatio } from "./utils-DpcPp-I0.mjs";
-export { TimesplitInput, TimesplitOutput, parseAspectRatio, parseRangeString, parseTimeString, parseTimesplits };
+import { a as TimesplitInput, i as parseTimeString, n as parseAspectRatio, o as TimesplitOutput, r as parseRangeString, s as parseTimesplits, t as isPathInsideRoots } from "./utils-CmpEoa5K.mjs";
+export { TimesplitInput, TimesplitOutput, isPathInsideRoots, parseAspectRatio, parseRangeString, parseTimeString, parseTimesplits };

package/dist/utils.mjs

@@ -1,4 +1,5 @@
 import { isNumber, range, uniq } from "@antfu/utils";
+import { isAbsolute, relative } from "node:path";
 //#region src/timesplit/timestring.ts
 /**
 * Parse timestamp into seconds
@@ -113,6 +114,17 @@ function parseTimesplits(inputs) {
 }
 //#endregion
 //#region src/utils.ts
+/**
+* Whether `filePath` resolves inside any of `roots` (no `..` escape).
+* Inlined here (rather than imported from the `slidev` package) because
+* `@slidev/parser` must stay independent of `@slidev/slidev`.
+*/
+function isPathInsideRoots(filePath, roots) {
+	return roots.some((root) => {
+		const rel = relative(root, filePath);
+		return rel === "" || !!rel && !rel.startsWith("..") && !isAbsolute(rel);
+	});
+}
 const RE_ASPECT_RATIO_SEPARATOR = /[:/x|]/;
 /**
 * 1,3-5,8 => [1, 3, 4, 5, 8]
@@ -141,4 +153,4 @@ function parseAspectRatio(str) {
 	return w / h;
 }
 //#endregion
-export { parseAspectRatio, parseRangeString, parseTimeString, parseTimesplits };
+export { isPathInsideRoots, parseAspectRatio, parseRangeString, parseTimeString, parseTimesplits };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@slidev/parser",
-  "version": "52.16.0",
+  "version": "52.17.1",
   "description": "Markdown parser for Slidev",
   "author": "Anthony Fu <anthonyfu117@hotmail.com>",
   "license": "MIT",
@@ -31,7 +31,7 @@
   "dependencies": {
     "@antfu/utils": "^9.3.0",
     "yaml": "^2.9.0",
-    "@slidev/types": "52.16.0"
+    "@slidev/types": "52.17.1"
   },
   "devDependencies": {
     "tsdown-stale-guard": "^0.1.2"