@superbuilders/incept-renderer 0.1.13 → 0.1.15

package/dist/actions/index.js

@@ -7,214 +7,9 @@ import * as logger2 from '@superbuilders/slog';
 // src/parser.ts
 
 // src/html/sanitize.ts
-var DEFAULT_CONFIG = {
-  // HTML content tags
-  allowedTags: /* @__PURE__ */ new Set([
-    // Text content
-    "p",
-    "span",
-    "div",
-    "br",
-    "hr",
-    // Headings
-    "h1",
-    "h2",
-    "h3",
-    "h4",
-    "h5",
-    "h6",
-    // Formatting
-    "b",
-    "i",
-    "u",
-    "strong",
-    "em",
-    "mark",
-    "small",
-    "sub",
-    "sup",
-    "code",
-    "pre",
-    "kbd",
-    // Lists
-    "ul",
-    "ol",
-    "li",
-    "dl",
-    "dt",
-    "dd",
-    // Tables
-    "table",
-    "thead",
-    "tbody",
-    "tfoot",
-    "tr",
-    "th",
-    "td",
-    "caption",
-    "colgroup",
-    "col",
-    // Media
-    "img",
-    "audio",
-    "video",
-    "source",
-    "track",
-    // Semantic
-    "article",
-    "section",
-    "nav",
-    "aside",
-    "header",
-    "footer",
-    "main",
-    "figure",
-    "figcaption",
-    "blockquote",
-    "cite",
-    // Interactive
-    "details",
-    "summary",
-    // Links
-    "a",
-    // Forms (for future interactive elements)
-    "label",
-    "button"
-  ]),
-  allowedAttributes: {
-    // Global attributes
-    "*": /* @__PURE__ */ new Set(["class", "id", "lang", "dir", "title", "style"]),
-    // Specific attributes
-    img: /* @__PURE__ */ new Set(["src", "alt", "width", "height", "style"]),
-    a: /* @__PURE__ */ new Set(["href", "target", "rel"]),
-    audio: /* @__PURE__ */ new Set(["src", "controls", "loop", "muted"]),
-    video: /* @__PURE__ */ new Set(["src", "controls", "loop", "muted", "width", "height", "poster"]),
-    source: /* @__PURE__ */ new Set(["src", "type"]),
-    track: /* @__PURE__ */ new Set(["src", "kind", "srclang", "label"])
-  },
-  allowDataAttributes: false,
-  allowMathML: true
-};
-var MATHML_TAGS = /* @__PURE__ */ new Set([
-  // Root
-  "math",
-  // Token elements
-  "mi",
-  "mn",
-  "mo",
-  "mtext",
-  "mspace",
-  "ms",
-  // Layout
-  "mrow",
-  "mfrac",
-  "msqrt",
-  "mroot",
-  "mstyle",
-  "merror",
-  "mpadded",
-  "mphantom",
-  "mfenced",
-  "menclose",
-  // Scripts and limits
-  "msub",
-  "msup",
-  "msubsup",
-  "munder",
-  "mover",
-  "munderover",
-  "mmultiscripts",
-  "mprescripts",
-  "none",
-  // Tables
-  "mtable",
-  "mtr",
-  "mtd",
-  "maligngroup",
-  "malignmark",
-  // Elementary math
-  "mstack",
-  "mlongdiv",
-  "msgroup",
-  "msrow",
-  "mscarries",
-  "mscarry",
-  "msline",
-  // Semantic
-  "semantics",
-  "annotation",
-  "annotation-xml"
-]);
-function sanitizeHtml(html, config = {}) {
-  const cfg = { ...DEFAULT_CONFIG, ...config };
-  const dangerousPatterns = [
-    /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi,
-    /javascript:/gi,
-    /on\w+\s*=/gi,
-    // Event handlers
-    /<iframe\b/gi,
-    /<embed\b/gi,
-    /<object\b/gi,
-    /data:text\/html/gi
-  ];
-  let sanitized = html;
-  for (const pattern of dangerousPatterns) {
-    sanitized = sanitized.replace(pattern, "");
-  }
-  const cleaned = cleanHtml(sanitized, cfg);
-  return cleaned;
-}
-function cleanHtml(html, config) {
-  let cleaned = html;
-  const tagPattern = /<\/?([a-zA-Z][a-zA-Z0-9-]*)([^>]*)>/g;
-  cleaned = cleaned.replace(tagPattern, (match, tagName, _attrs) => {
-    const tag = tagName.toLowerCase();
-    const isMathML = tag === "math" || cleaned.includes("<math");
-    if (isMathML && config.allowMathML && MATHML_TAGS.has(tag)) {
-      return match;
-    }
-    if (config.allowedTags.has(tag)) {
-      return cleanAttributesString(match, tag, config);
-    }
-    return "";
-  });
-  return cleaned;
-}
-function cleanAttributesString(tagString, tagName, config) {
-  const attrPattern = /\s+([a-zA-Z][a-zA-Z0-9-:]*)(?:="([^"]*)"|'([^']*)'|=([^\s>]+)|(?=\s|>))/g;
-  let cleanedTag = `<${tagString.startsWith("</") ? "/" : ""}${tagName}`;
-  let match = attrPattern.exec(tagString);
-  while (match !== null) {
-    const attrName = (match[1] || "").toLowerCase();
-    const attrValue = match[2] || match[3] || match[4] || "";
-    const globalAttrs = config.allowedAttributes["*"] || /* @__PURE__ */ new Set();
-    const tagAttrs = config.allowedAttributes[tagName] || /* @__PURE__ */ new Set();
-    let isAllowed = globalAttrs.has(attrName) || tagAttrs.has(attrName);
-    if (tagName === "img" && (attrName === "width" || attrName === "height" || attrName === "style")) {
-      isAllowed = false;
-    }
-    if (!isAllowed && config.allowDataAttributes && attrName.startsWith("data-")) {
-      isAllowed = true;
-    }
-    if (isAllowed && !isDangerousAttributeValue(attrName, attrValue)) {
-      cleanedTag += ` ${attrName}="${attrValue.replace(/"/g, "&quot;")}"`;
-    }
-    match = attrPattern.exec(tagString);
-  }
-  cleanedTag += ">";
-  return cleanedTag;
-}
-function isDangerousAttributeValue(name, value) {
-  const valueLower = value.toLowerCase().trim();
-  if (name === "href" || name === "src") {
-    if (valueLower.startsWith("javascript:") || valueLower.startsWith("data:text/html")) {
-      return true;
-    }
-  }
-  if (valueLower.includes("javascript:") || valueLower.includes("onerror=")) {
-    return true;
-  }
-  return false;
+function sanitizeHtml(html) {
+  if (!html) return html;
+  return html.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, "").replace(/\s+on\w+\s*=\s*["'][^"']*["']/gi, "").replace(/\s+on\w+\s*=\s*[^\s>]+/gi, "").replace(/\b(href|src)\s*=\s*["']?\s*javascript:[^"'>\s]*/gi, "").replace(/\b(href|src)\s*=\s*["']?\s*data:text\/html[^"'>\s]*/gi, "").replace(/<(iframe|embed|object)\b[^>]*>[\s\S]*?<\/\1>/gi, "").replace(/<(iframe|embed|object)\b[^>]*\/?>/gi, "");
 }
 
 // src/html/serialize.ts
@@ -1300,7 +1095,7 @@ function buildDisplayModelFromXml(qtiXml) {
       return { type: "stimulus", html: sanitizeHtml(block.html) };
     }
     if (block.type === "richStimulus") {
-      const html = sanitizeHtml(block.html, { allowDataAttributes: true });
+      const html = sanitizeHtml(block.html);
       const inlineEmbeds = {};
       for (const [key, embed] of Object.entries(block.inlineEmbeds)) {
         inlineEmbeds[key] = {
@@ -1399,7 +1194,7 @@ function buildDisplayModelFromXml(qtiXml) {
           responseId: interaction.responseIdentifier,
           gapTexts,
           gaps,
-          contentHtml: sanitizeHtml(interaction.contentHtml, { allowDataAttributes: true })
+          contentHtml: sanitizeHtml(interaction.contentHtml)
         }
       };
     }