@sonicjs-cms/core 2.8.1 → 2.8.3

package/dist/chunk-MNWKYY5E.cjs

@@ -0,0 +1,44 @@
+'use strict';
+
+// src/utils/sanitize.ts
+function escapeHtml(text) {
+  if (typeof text !== "string") {
+    return "";
+  }
+  const map = {
+    "&": "&",
+    "<": "&lt;",
+    ">": "&gt;",
+    '"': "&quot;",
+    "'": "&#039;"
+  };
+  return text.replace(/[&<>"']/g, (char) => map[char] || char);
+}
+function sanitizeInput(input) {
+  if (!input) {
+    return "";
+  }
+  return escapeHtml(String(input).trim());
+}
+function sanitizeRichText(html) {
+  if (typeof html !== "string") {
+    return "";
+  }
+  return html.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, "").replace(/\s+on\w+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, "").replace(/(href|src|action)\s*=\s*"javascript:[^"]*"/gi, '$1=""').replace(/(href|src|action)\s*=\s*'javascript:[^']*'/gi, "$1=''");
+}
+function sanitizeObject(obj, fields) {
+  const sanitized = { ...obj };
+  for (const field of fields) {
+    if (typeof obj[field] === "string") {
+      sanitized[field] = sanitizeInput(obj[field]);
+    }
+  }
+  return sanitized;
+}
+
+exports.escapeHtml = escapeHtml;
+exports.sanitizeInput = sanitizeInput;
+exports.sanitizeObject = sanitizeObject;
+exports.sanitizeRichText = sanitizeRichText;
+//# sourceMappingURL=chunk-MNWKYY5E.cjs.map
+//# sourceMappingURL=chunk-MNWKYY5E.cjs.map

package/dist/chunk-MNWKYY5E.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/utils/sanitize.ts"],"names":[],"mappings":";;;AASO,SAAS,WAAW,IAAA,EAAsB;AAC/C,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,IAAA,OAAO,EAAA;AAAA,EACT;AAEA,EAAA,MAAM,GAAA,GAA8B;AAAA,IAClC,GAAA,EAAK,OAAA;AAAA,IACL,GAAA,EAAK,MAAA;AAAA,IACL,GAAA,EAAK,MAAA;AAAA,IACL,GAAA,EAAK,QAAA;AAAA,IACL,GAAA,EAAK;AAAA,GACP;AAEA,EAAA,OAAO,IAAA,CAAK,QAAQ,UAAA,EAAY,CAAC,SAAS,GAAA,CAAI,IAAI,KAAK,IAAI,CAAA;AAC7D;AAQO,SAAS,cAAc,KAAA,EAA0C;AACtE,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,EAAA;AAAA,EACT;AACA,EAAA,OAAO,UAAA,CAAW,MAAA,CAAO,KAAK,CAAA,CAAE,MAAM,CAAA;AACxC;AAQO,SAAS,iBAAiB,IAAA,EAAsB;AACrD,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,IAAA,OAAO,EAAA;AAAA,EACT;AAEA,EAAA,OAAO,IAAA,CAEJ,OAAA,CAAQ,qDAAA,EAAuD,EAAE,EAEjE,OAAA,CAAQ,8CAAA,EAAgD,EAAE,CAAA,CAE1D,QAAQ,8CAAA,EAAgD,OAAO,CAAA,CAC/D,OAAA,CAAQ,gDAAgD,OAAO,CAAA;AACpE;AAQO,SAAS,cAAA,CACd,KACA,MAAA,EACG;AACH,EAAA,MAAM,SAAA,GAAY,EAAE,GAAG,GAAA,EAAI;AAE3B,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,IAAI,OAAO,GAAA,CAAI,KAAK,CAAA,KAAM,QAAA,EAAU;AAClC,MAAA,SAAA,CAAU,KAAK,CAAA,GAAI,aAAA,CAAc,GAAA,CAAI,KAAK,CAAC,CAAA;AAAA,IAC7C;AAAA,EACF;AAEA,EAAA,OAAO,SAAA;AACT","file":"chunk-MNWKYY5E.cjs","sourcesContent":["/**\n * HTML sanitization utilities for preventing XSS attacks\n */\n\n/**\n * Escapes HTML special characters to prevent XSS attacks\n * @param text - The text to escape\n * @returns The escaped text safe for HTML output\n */\nexport function escapeHtml(text: string): string {\n  if (typeof text !== 'string') {\n    return ''\n  }\n\n  const map: Record<string, string> = {\n    '&': '&amp;',\n    '<': '&lt;',\n    '>': '&gt;',\n    '\"': '&quot;',\n    \"'\": '&#039;'\n  }\n\n  return text.replace(/[&<>\"']/g, (char) => map[char] || char)\n}\n\n/**\n * Sanitizes user input by escaping HTML special characters\n * This should be used for all user-provided text fields to prevent XSS\n * @param input - The input string to sanitize\n * @returns The sanitized string\n */\nexport function sanitizeInput(input: string | null | undefined): string {\n  if (!input) {\n    return ''\n  }\n  return escapeHtml(String(input).trim())\n}\n\n/**\n * Sanitizes rich text HTML by stripping dangerous elements while preserving\n * legitimate formatting. Removes script tags, event handlers, and javascript: URLs.\n * @param html - The rich text HTML to sanitize\n * @returns Sanitized HTML safe for rendering\n */\nexport function sanitizeRichText(html: string): string {\n  if (typeof html !== 'string') {\n    return ''\n  }\n\n  return html\n    // Remove script tags and their contents\n    .replace(/<script\\b[^<]*(?:(?!<\\/script>)<[^<]*)*<\\/script>/gi, '')\n    // Remove event handler attributes (on*)\n    .replace(/\\s+on\\w+\\s*=\\s*(?:\"[^\"]*\"|'[^']*'|[^\\s>]+)/gi, '')\n    // Remove javascript: URLs in href/src/action attributes\n    .replace(/(href|src|action)\\s*=\\s*\"javascript:[^\"]*\"/gi, '$1=\"\"')\n    .replace(/(href|src|action)\\s*=\\s*'javascript:[^']*'/gi, \"$1=''\")\n}\n\n/**\n * Sanitizes an object's string properties\n * @param obj - Object with string properties to sanitize\n * @param fields - Array of field names to sanitize\n * @returns New object with sanitized fields\n */\nexport function sanitizeObject<T extends Record<string, any>>(\n  obj: T,\n  fields: (keyof T)[]\n): T {\n  const sanitized = { ...obj }\n\n  for (const field of fields) {\n    if (typeof obj[field] === 'string') {\n      sanitized[field] = sanitizeInput(obj[field]) as T[keyof T]\n    }\n  }\n\n  return sanitized\n}\n"]}