@stacksjs/sanitizer 0.2.413 → 0.2.415

package/dist/index.js

@@ -1,2 +1,2 @@
 // @bun
-var L={allowedTags:["p","br","strong","em","u","span","h1","h2","h3","h4","h5","h6","ul","ol","li","code","pre"],allowedAttributes:{"*":["class","id"]},allowedSchemes:["http","https","mailto"],allowDataAttributes:!1,allowAriaAttributes:!0,stripTags:!0,allowComments:!1},B={allowedTags:["p","br","strong","em","u","span","div","h1","h2","h3","h4","h5","h6","ul","ol","li","a","img","code","pre","blockquote","table","thead","tbody","tr","th","td"],allowedAttributes:{"*":["class","id"],a:["class","id","href","title","target","rel"],img:["class","id","src","alt","title","width","height"],td:["class","id","colspan","rowspan","align"],th:["class","id","colspan","rowspan","align","scope"]},allowedSchemes:["http","https","mailto","tel"],allowDataAttributes:!1,allowAriaAttributes:!0,stripTags:!0,allowComments:!1},x={allowedTags:["p","br","strong","em","u","span","div","section","article","aside","h1","h2","h3","h4","h5","h6","ul","ol","li","dl","dt","dd","a","img","figure","figcaption","code","pre","kbd","samp","var","blockquote","q","cite","table","thead","tbody","tfoot","tr","th","td","caption","del","ins","sub","sup","abbr","address","time","hr","video","audio","source","track"],allowedAttributes:{"*":["class","id","title"],a:["class","id","href","title","target","rel"],img:["class","id","src","srcset","alt","title","width","height","loading"],video:["class","id","src","width","height","controls","preload","poster"],audio:["class","id","src","controls","preload"],source:["src","type"],track:["src","kind","srclang","label"],td:["class","id","colspan","rowspan","align"],th:["class","id","colspan","rowspan","align","scope"],time:["class","id","datetime"],abbr:["class","id","title"]},allowedSchemes:["http","https","mailto","tel","data"],allowDataAttributes:!0,allowAriaAttributes:!0,stripTags:!0,allowComments:!1},_={allowedTags:["p","br","strong","em","span","h1","h2","h3","h4","h5","h6","ul","ol","li","a","img","code","pre","blockquote","table","thead","tbody","tr","th","td","del","ins","hr","input"],allowedAttributes:{"*":["class","id"],a:["class","id","href","title"],img:["class","id","src","alt","title"],code:["class"],td:["align"],th:["align","scope"],input:["type","checked","disabled"]},allowedSchemes:["http","https","mailto"],allowDataAttributes:!1,allowAriaAttributes:!1,stripTags:!0,allowComments:!1};function M(q){switch(q){case"strict":return L;case"basic":return B;case"relaxed":return x;case"markdown":return _;default:return B}}var I={allowedTags:[],allowedAttributes:{},allowedSchemes:["http","https","mailto"],allowDataAttributes:!1,allowAriaAttributes:!0,stripTags:!0,allowComments:!1},z=["script","iframe","object","embed","applet","base","link","meta","style"],E=["href","src","action","formaction","data","poster","cite","background","longdesc"],R=/^on\w+/i;function W(q,C){return k(q,C).html}function k(q,C){let D=typeof C==="string"?M(C):{...I,...C},j=[],K=[],J=q,Q=!1;if(!D.allowComments){let P=/<!--[\s\S]*?-->/g;if(P.test(J))J=J.replace(P,""),Q=!0}let Y=/<(\/?)([a-zA-Z][\w-]*)([^>]*)>/g;return J=J.replace(Y,(P,y,O,F)=>{let X=O.toLowerCase();if(z.includes(X)){if(!j.includes(X))j.push(X);return Q=!0,D.stripTags?"":V(P)}let G=D.allowedTags||[];if(G.length>0&&!G.includes(X)){if(!j.includes(X))j.push(X);return Q=!0,D.stripTags?"":V(P)}if(y)return P;let $=S(F,X,D,K);if($!==F)Q=!0;if(D.transformTag){let H=f($),Z=D.transformTag(X,H);if(Z===null){if(!j.includes(X))j.push(X);return Q=!0,""}if(Z.tagName!==X||JSON.stringify(Z.attributes)!==JSON.stringify(H))return Q=!0,v(Z.tagName,Z.attributes)}return`<${O}${$}>`}),{html:J,modified:Q,removedTags:j.length>0?j:void 0,removedAttributes:K.length>0?K:void 0}}function S(q,C,D,j){if(!q.trim())return q;let K=f(q),J={};for(let[Q,Y]of Object.entries(K)){let P=Q.toLowerCase();if(R.test(P)){if(!j.includes(P))j.push(P);continue}if(!h(P,C,D)){if(!j.includes(P))j.push(P);continue}if(E.includes(P)){if(!c(Y,D)){if(!j.includes(P))j.push(P);continue}}if(P==="style"&&D.allowedStyles)J[Q]=w(Y,D.allowedStyles);else J[Q]=Y}return U(J)}function h(q,C,D){let j=D.allowedAttributes;if(!j)return!1;if(q.startsWith("data-"))return D.allowDataAttributes||!1;if(q.startsWith("aria-"))return D.allowAriaAttributes||!1;if(Array.isArray(j))return j.includes(q);if(j[C]?.includes(q))return!0;if(j["*"]?.includes(q))return!0;return!1}function c(q,C){if(C.urlValidator)return C.urlValidator(q);let j=q.trim().toLowerCase().replace(/[\s\x00-\x1F]/g,""),K=["javascript:","data:text/html","vbscript:","file:"];for(let J of K)if(j.startsWith(J))return!1;if(C.allowedSchemes&&C.allowedSchemes.length>0){if(!j.includes(":"))return!0;if(!C.allowedSchemes.some((Q)=>{return j.startsWith(`${Q}:`)}))return!1}return!0}function w(q,C){let D=q.split(";").filter((K)=>K.trim()),j=[];for(let K of D){let J=K.indexOf(":");if(J===-1)continue;let Q=K.substring(0,J).trim().toLowerCase(),Y=K.substring(J+1).trim();if(C.includes(Q)){if(!Y.toLowerCase().includes("javascript:")&&!Y.toLowerCase().includes("expression("))j.push(`${Q}: ${Y}`)}}return j.join("; ")}function f(q){let C={},D=/([\w-]+)(?:=(?:"([^"]*)"|'([^']*)'|([^\s>]+)))?/g,j;while(j=D.exec(q)){let K=j[1],J=j[2]||j[3]||j[4]||"";C[K]=J}return C}function U(q){let C=[];for(let[D,j]of Object.entries(q))if(j==="")C.push(D);else{let K=j.replace(/"/g,"&quot;");C.push(`${D}="${K}"`)}return C.length>0?` ${C.join(" ")}`:""}function v(q,C){return`<${q}${U(C)}>`}function V(q){return q.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;")}function T(q,C){return!k(q,C).modified}function N(q){return q.replace(/<[^>]*>/g,"")}function A(q){return V(q)}var s=W;export{N as stripTags,L as strict,k as sanitizeWithInfo,W as sanitize,x as relaxed,_ as markdown,T as isSafe,M as getPreset,A as escape,s as default,B as basic};
+var T={allowedTags:["p","br","strong","em","u","span","h1","h2","h3","h4","h5","h6","ul","ol","li","code","pre"],allowedAttributes:{"*":["class","id"]},allowedSchemes:["http","https","mailto"],allowDataAttributes:!1,allowAriaAttributes:!0,stripTags:!0,allowComments:!1},g={allowedTags:["p","br","strong","em","u","span","div","h1","h2","h3","h4","h5","h6","ul","ol","li","a","img","code","pre","blockquote","table","thead","tbody","tr","th","td"],allowedAttributes:{"*":["class","id"],a:["class","id","href","title","target","rel"],img:["class","id","src","alt","title","width","height"],td:["class","id","colspan","rowspan","align"],th:["class","id","colspan","rowspan","align","scope"]},allowedSchemes:["http","https","mailto","tel"],allowDataAttributes:!1,allowAriaAttributes:!0,stripTags:!0,allowComments:!1},z={allowedTags:["p","br","strong","em","u","span","div","section","article","aside","h1","h2","h3","h4","h5","h6","ul","ol","li","dl","dt","dd","a","img","figure","figcaption","code","pre","kbd","samp","var","blockquote","q","cite","table","thead","tbody","tfoot","tr","th","td","caption","del","ins","sub","sup","abbr","address","time","hr","video","audio","source","track"],allowedAttributes:{"*":["class","id","title"],a:["class","id","href","title","target","rel"],img:["class","id","src","srcset","alt","title","width","height","loading"],video:["class","id","src","width","height","controls","preload","poster"],audio:["class","id","src","controls","preload"],source:["src","type"],track:["src","kind","srclang","label"],td:["class","id","colspan","rowspan","align"],th:["class","id","colspan","rowspan","align","scope"],time:["class","id","datetime"],abbr:["class","id","title"]},allowedSchemes:["http","https","mailto","tel","data"],allowDataAttributes:!0,allowAriaAttributes:!0,stripTags:!0,allowComments:!1},x={allowedTags:["p","br","strong","em","span","h1","h2","h3","h4","h5","h6","ul","ol","li","a","img","code","pre","blockquote","table","thead","tbody","tr","th","td","del","ins","hr","input"],allowedAttributes:{"*":["class","id"],a:["class","id","href","title"],img:["class","id","src","alt","title"],code:["class"],td:["align"],th:["align","scope"],input:["type","checked","disabled"]},allowedSchemes:["http","https","mailto"],allowDataAttributes:!1,allowAriaAttributes:!1,stripTags:!0,allowComments:!1};function p(e){switch(e){case"strict":return T;case"basic":return g;case"relaxed":return z;case"markdown":return x;default:return g}}var k={allowedTags:[],allowedAttributes:{},allowedSchemes:["http","https","mailto"],allowDataAttributes:!1,allowAriaAttributes:!0,stripTags:!0,allowComments:!1},v=["script","iframe","object","embed","applet","base","link","meta","style"],C=["href","src","action","formaction","data","poster","cite","background","longdesc"],P=/^on\w+/i;function h(e,s){return m(e,s).html}function m(e,s){let r=typeof s==="string"?p(s):{...k,...s},t=[],a=[],i=e,l=!1;if(!r.allowComments){let n=/<!--[\s\S]*?-->/g;if(n.test(i))i=i.replace(n,""),l=!0}let c=/<(\/?)([a-zA-Z][\w-]*)([^>]*)>/g;return i=i.replace(c,(n,R,w,b)=>{let o=w.toLowerCase();if(v.includes(o)){if(!t.includes(o))t.push(o);return l=!0,r.stripTags?"":f(n)}let S=r.allowedTags||[];if(S.length>0&&!S.includes(o)){if(!t.includes(o))t.push(o);return l=!0,r.stripTags?"":f(n)}if(R)return n;let d=D(b,o,r,a);if(d!==b)l=!0;if(r.transformTag){let A=O(d),u=r.transformTag(o,A);if(u===null){if(!t.includes(o))t.push(o);return l=!0,""}if(u.tagName!==o||JSON.stringify(u.attributes)!==JSON.stringify(A))return l=!0,q(u.tagName,u.attributes)}return`<${w}${d}>`}),{html:i,modified:l,removedTags:t.length>0?t:void 0,removedAttributes:a.length>0?a:void 0}}function D(e,s,r,t){if(!e.trim())return e;let a=O(e),i={};for(let[l,c]of Object.entries(a)){let n=l.toLowerCase();if(P.test(n)){if(!t.includes(n))t.push(n);continue}if(!E(n,s,r)){if(!t.includes(n))t.push(n);continue}if(C.includes(n)){if(!L(c,r)){if(!t.includes(n))t.push(n);continue}}if(n==="style"&&r.allowedStyles)i[l]=j(c,r.allowedStyles);else i[l]=c}return y(i)}function E(e,s,r){let t=r.allowedAttributes;if(!t)return!1;if(e.startsWith("data-"))return r.allowDataAttributes||!1;if(e.startsWith("aria-"))return r.allowAriaAttributes||!1;if(Array.isArray(t))return t.includes(e);if(t[s]?.includes(e))return!0;if(t["*"]?.includes(e))return!0;return!1}function L(e,s){if(s.urlValidator)return s.urlValidator(e);let t=e.trim().toLowerCase().replace(/[\s\x00-\x1F]/g,""),a=["javascript:","data:text/html","vbscript:","file:"];for(let i of a)if(t.startsWith(i))return!1;if(s.allowedSchemes&&s.allowedSchemes.length>0){if(!t.includes(":"))return!0;if(!s.allowedSchemes.some((l)=>t.startsWith(`${l}:`)))return!1}return!0}function j(e,s){let r=e.split(";").filter((a)=>a.trim()),t=[];for(let a of r){let i=a.indexOf(":");if(i===-1)continue;let l=a.substring(0,i).trim().toLowerCase(),c=a.substring(i+1).trim();if(s.includes(l)){if(!c.toLowerCase().includes("javascript:")&&!c.toLowerCase().includes("expression("))t.push(`${l}: ${c}`)}}return t.join("; ")}function O(e){let s={},r=/([\w-]+)(?:=(?:"([^"]*)"|'([^']*)'|([^\s>]+)))?/g,t;while(t=r.exec(e)){let a=t[1],i=t[2]||t[3]||t[4]||"";s[a]=i}return s}function y(e){let s=[];for(let[r,t]of Object.entries(e))if(t==="")s.push(r);else{let a=t.replace(/"/g,"&quot;");s.push(`${r}="${a}"`)}return s.length>0?` ${s.join(" ")}`:""}function q(e,s){return`<${e}${y(s)}>`}function f(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;")}function I(e,s){return!m(e,s).modified}function U(e){return e.replace(/<[^>]*>/g,"")}function W(e){return f(e)}var K=h;export{g as basic,K as default,W as escape,p as getPreset,I as isSafe,x as markdown,z as relaxed,h as sanitize,m as sanitizeWithInfo,T as strict,U as stripTags};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stacksjs/sanitizer",
   "type": "module",
-  "version": "0.2.413",
+  "version": "0.2.415",
   "description": "A fast, native Bun-powered HTML sanitizer with DOMPurify-like features. Protection against XSS and malicious content.",
   "author": "Chris Breuer <chris@stacksjs.org>",
   "license": "MIT",