@todoist/remark-application-links 0.0.0-stage → 1.0.5

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020 Henning Muszynski
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,98 @@
-# Temporary Holding Version
+![logo](./.github/logo.png)
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# remark-application-links
+
+You want to allow your users to directly link deeply into their favorite applications like Notion or Mail. Per default remark only supports a handful of valid protocols when parsing links from text which makes this impossible. With the **remark-application-links** plugin you can support all the schemes and specify a block list of potentially dangerous ones.
+
+Turn
+
+```md
+Here's a link to my notion: notion://notion.so/user/123
+```
+
+into
+
+```html
+<p>
+    Here's a link to my notion:
+    <a href="notion://notion.so/user/123">notion://notion.so/user/123</a>
+</p>
+```
+
+Make sure you understand the security implications before using this plugin: [Security](#security)
+
+Heavily inspired by [remark-linkify-regex](https://gitlab.com/staltz/remark-linkify-regex) but different enough to justify a separate plugin.
+
+Bootstrapped and built with [tsdx](https://github.com/formium/tsdx).
+
+## Installation
+
+Use [npm](https://www.npmjs.com/get-npm) or [yarn](https://yarnpkg.com/lang/en/docs/install/) to install:
+
+```sh
+npm install @todoist/remark-application-links
+# or
+yarn add @todoist/remark-application-links
+```
+
+## Usage
+
+This plugin exposes a function which you need to call with the blocked URL schemes (or with nothing to accept the default ones).
+
+```js
+remark().use(remarkApplicationLinksPlugin())
+// or with custom schemes
+remark().use(remarkApplicationLinksPlugin(['javascript', 'notion']))
+```
+
+## Security
+
+Since this plugin is using a block list of URL schemes instead of explictly allowing explicit ones it potentially opens up your application for attackers. The general stance in the security community is that a complete block list is hard (read: impossible) to achieve. If you want to be on the safe side it's better to rely on an explicit allow list of supported URL schemes.
+
+Per default we're blocking these url schemes:
+
+```js
+const blockedUrlSchemes = ['data', 'jar', 'java', 'javascript', 'vbscript', 'view-source']
+```
+
+In general it's recommended to not only rely on your parser to prevent inline script executions but apply a Content-Security Policy (CSP) on your page as reliable catch-all.
+
+You're advised to thoroughly test your use cases to not open your users up to [cross-site scripting (XSS)](https://en.wikipedia.org/wiki/Cross-site_scripting) attacks. You might find additional tools like [rehype-sanitize](https://github.com/rehypejs/rehype-sanitize) helpful.
+
+### Markdown links and react-markdown
+
+This plugin will transform this text:
+
+```md
+[link](<javascript:alert(1)>)
+```
+
+into
+
+```html
+<p><a href="javascript:alert(1)">link</a></p>
+```
+
+Which is dangerous as it would execute JavaScript. If you allow users to enter the text this will open you up to cross-site scripting (XSS) attacks. As mentioned above a strong CSP will protect you from this and not allow the JavaScript to execute.
+
+This plugin can be used in combination with [react-markdown](https://github.com/rexxars/react-markdown). In order to prevent the example above being parsed as a link you need to supply the `transformLinkUri` prop.
+
+## Changelog
+
+We're maintaining a [changelog](./CHANGELOG.md) in this repository. Our versioning follows [semantic versioning](https://semver.org/).
+
+## Releasing
+
+Versions follow the explicit `package.json` semver value and `vVERSION` release record. The first new-scope release is `@todoist/remark-application-links@1.0.5`; previous packages and releases remain unchanged.
+
+The manual [release workflow](./.github/workflows/publish.yml) first builds and retains a checked tarball without publishing. An authorized maintainer then publishes that same artifact to npm and GitHub Packages. Mirror retries reuse the original artifact and version. Creating a GitHub release no longer rebuilds or publishes packages.
+
+See [the release runbook](./RELEASING.md) for the required upstream publication, first interactive npm publication, workflow setup, and recovery commands.
+
+## Contributing
+
+Contributions are welcome. Check our [contributing guide](./CONTRIBUTING.md).
+
+## License
+
+This project is distributed under the [MIT License](./LICENSE).

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * This is heavily inspired by `remark-linkify-regex`
+ * https://gitlab.com/staltz/remark-linkify-regex/blob/master/index.js
+ *
+ * remark-linkify-regex works on an allow list to support more protocols (url
+ * schemes). This plugin works with a block list to support everything that
+ * remotely looks like a link but blocks potentially dangerous schemes.
+ */
+import { Node } from 'unist';
+declare function remarkApplicationLinks(blockedUrlSchemes?: string[]): () => (ast: Node) => Node;
+export default remarkApplicationLinks;

package/dist/index.js

@@ -0,0 +1,8 @@
+
+'use strict'
+
+if (process.env.NODE_ENV === 'production') {
+  module.exports = require('./remark-application-links.cjs.production.min.js')
+} else {
+  module.exports = require('./remark-application-links.cjs.development.js')
+}

package/dist/remark-application-links.cjs.development.js

@@ -0,0 +1,112 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+function _interopDefault (ex) { return (ex && (typeof ex === 'object') && 'default' in ex) ? ex['default'] : ex; }
+
+var visitWithParents = _interopDefault(require('unist-util-visit-parents'));
+var flatMap = _interopDefault(require('unist-util-flatmap'));
+
+/**
+ * This is heavily inspired by `remark-linkify-regex`
+ * https://gitlab.com/staltz/remark-linkify-regex/blob/master/index.js
+ *
+ * remark-linkify-regex works on an allow list to support more protocols (url
+ * schemes). This plugin works with a block list to support everything that
+ * remotely looks like a link but blocks potentially dangerous schemes.
+ */
+/**
+ * Default collection of url schemes that will be blocked by this plugin. All
+ * others schemes are allowed.
+ */
+
+var BLOCKED_URL_SCHEMES = ['data', 'jar', 'java', 'javascript', 'vbscript', 'view-source'];
+
+function buildTextNode(content) {
+  return {
+    type: 'text',
+    value: content
+  };
+}
+
+function buildLinkNode(url, children) {
+  return {
+    type: 'link',
+    title: null,
+    url: url,
+    children: children
+  };
+} // looks for any non-whitespace character sequence that contains `://`
+
+
+var REGEX_POTENTIAL_URL = /\S+:\/\/\S+/g;
+
+function splitTextNode(textNode, blockedUrlSchemes) {
+  var content = textNode.value;
+  var result = [];
+  var textStartIndex = 0;
+  var match = [];
+
+  while ((match = REGEX_POTENTIAL_URL.exec(content)) !== null) {
+    var matchingText = match[0];
+    var matchStartIndex = match.index;
+    var urlScheme = matchingText.split('://')[0];
+    var isBlockedScheme = blockedUrlSchemes.includes(urlScheme); // create a new text node for everything before the match
+
+    if (textStartIndex !== matchStartIndex) {
+      result.push(buildTextNode(content.slice(textStartIndex, matchStartIndex)));
+    } // either insert another text node if the url scheme is blocked or insert a link
+
+
+    if (isBlockedScheme) {
+      result.push(buildTextNode(matchingText));
+    } else {
+      result.push(buildLinkNode(matchingText, [buildTextNode(matchingText)]));
+    } // move the pointer ahead so we can support multiple links
+
+
+    textStartIndex = matchStartIndex + matchingText.length;
+  } // this path will also be executed when no url has been found
+
+
+  var remainingText = content.slice(textStartIndex);
+
+  if (remainingText.length > 0) {
+    result.push(buildTextNode(remainingText));
+  }
+
+  return result;
+}
+
+function remarkApplicationLinks(blockedUrlSchemes) {
+  if (blockedUrlSchemes === void 0) {
+    blockedUrlSchemes = BLOCKED_URL_SCHEMES;
+  }
+
+  return function () {
+    return function (ast) {
+      visitWithParents(ast, 'text', function (textNode, parents) {
+        if (parents.length > 0 && parents[parents.length - 1].type === 'link') {
+          textNode._ignoreMe = true;
+          return;
+        }
+      });
+      flatMap(ast, function (node) {
+        if (node.type !== 'text') {
+          return [node];
+        }
+
+        if (node._ignoreMe) {
+          delete node._ignoreMe;
+          return [node];
+        }
+
+        return splitTextNode(node, blockedUrlSchemes);
+      });
+      return ast;
+    };
+  };
+}
+
+exports.default = remarkApplicationLinks;
+//# sourceMappingURL=remark-application-links.cjs.development.js.map

package/dist/remark-application-links.cjs.development.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remark-application-links.cjs.development.js","sources":["../src/index.ts"],"sourcesContent":["/**\n * This is heavily inspired by `remark-linkify-regex`\n * https://gitlab.com/staltz/remark-linkify-regex/blob/master/index.js\n *\n * remark-linkify-regex works on an allow list to support more protocols (url\n * schemes). This plugin works with a block list to support everything that\n * remotely looks like a link but blocks potentially dangerous schemes.\n */\n\nimport visitWithParents from 'unist-util-visit-parents'\nimport flatMap from 'unist-util-flatmap'\nimport { Node } from 'unist'\n\n/**\n * Default collection of url schemes that will be blocked by this plugin. All\n * others schemes are allowed.\n */\nconst BLOCKED_URL_SCHEMES = ['data', 'jar', 'java', 'javascript', 'vbscript', 'view-source']\n\nfunction buildTextNode(content: string) {\n    return { type: 'text', value: content }\n}\n\nfunction buildLinkNode(url: string, children: Node[]) {\n    return {\n        type: 'link',\n        title: null,\n        url,\n        children,\n    }\n}\n\n// looks for any non-whitespace character sequence that contains `://`\nconst REGEX_POTENTIAL_URL = /\\S+:\\/\\/\\S+/g\n\nfunction splitTextNode(textNode: Node, blockedUrlSchemes: string[]) {\n    const content = textNode.value as string\n    const result: Node[] = []\n    let textStartIndex = 0\n    let match: RegExpExecArray | null | never[] = []\n\n    while ((match = REGEX_POTENTIAL_URL.exec(content)) !== null) {\n        const matchingText = match[0]\n        const matchStartIndex = match.index\n        const urlScheme = matchingText.split('://')[0]\n        const isBlockedScheme = blockedUrlSchemes.includes(urlScheme)\n\n        // create a new text node for everything before the match\n        if (textStartIndex !== matchStartIndex) {\n            result.push(buildTextNode(content.slice(textStartIndex, matchStartIndex)))\n        }\n\n        // either insert another text node if the url scheme is blocked or insert a link\n        if (isBlockedScheme) {\n            result.push(buildTextNode(matchingText))\n        } else {\n            result.push(buildLinkNode(matchingText, [buildTextNode(matchingText)]))\n        }\n\n        // move the pointer ahead so we can support multiple links\n        textStartIndex = matchStartIndex + matchingText.length\n    }\n\n    // this path will also be executed when no url has been found\n    const remainingText = content.slice(textStartIndex)\n    if (remainingText.length > 0) {\n        result.push(buildTextNode(remainingText))\n    }\n\n    return result\n}\n\nfunction remarkApplicationLinks(blockedUrlSchemes = BLOCKED_URL_SCHEMES) {\n    return () => (ast: Node) => {\n        visitWithParents(ast, 'text', (textNode, parents) => {\n            if (parents.length > 0 && parents[parents.length - 1].type === 'link') {\n                textNode._ignoreMe = true\n                return\n            }\n        })\n\n        flatMap(ast, (node: Node) => {\n            if (node.type !== 'text') {\n                return [node]\n            }\n            if (node._ignoreMe) {\n                delete node._ignoreMe\n                return [node]\n            }\n            return splitTextNode(node, blockedUrlSchemes)\n        })\n\n        return ast\n    }\n}\n\nexport default remarkApplicationLinks\n"],"names":["BLOCKED_URL_SCHEMES","buildTextNode","content","type","value","buildLinkNode","url","children","title","REGEX_POTENTIAL_URL","splitTextNode","textNode","blockedUrlSchemes","result","textStartIndex","match","exec","matchingText","matchStartIndex","index","urlScheme","split","isBlockedScheme","includes","push","slice","length","remainingText","remarkApplicationLinks","ast","visitWithParents","parents","_ignoreMe","flatMap","node"],"mappings":";;;;;;;;;AAAA;;;;;;;;AAaA;;;;;AAIA,IAAMA,mBAAmB,GAAG,CAAC,MAAD,EAAS,KAAT,EAAgB,MAAhB,EAAwB,YAAxB,EAAsC,UAAtC,EAAkD,aAAlD,CAA5B;;AAEA,SAASC,aAAT,CAAuBC,OAAvB;AACI,SAAO;AAAEC,IAAAA,IAAI,EAAE,MAAR;AAAgBC,IAAAA,KAAK,EAAEF;AAAvB,GAAP;AACH;;AAED,SAASG,aAAT,CAAuBC,GAAvB,EAAoCC,QAApC;AACI,SAAO;AACHJ,IAAAA,IAAI,EAAE,MADH;AAEHK,IAAAA,KAAK,EAAE,IAFJ;AAGHF,IAAAA,GAAG,EAAHA,GAHG;AAIHC,IAAAA,QAAQ,EAARA;AAJG,GAAP;AAMH;;;AAGD,IAAME,mBAAmB,GAAG,cAA5B;;AAEA,SAASC,aAAT,CAAuBC,QAAvB,EAAuCC,iBAAvC;AACI,MAAMV,OAAO,GAAGS,QAAQ,CAACP,KAAzB;AACA,MAAMS,MAAM,GAAW,EAAvB;AACA,MAAIC,cAAc,GAAG,CAArB;AACA,MAAIC,KAAK,GAAqC,EAA9C;;AAEA,SAAO,CAACA,KAAK,GAAGN,mBAAmB,CAACO,IAApB,CAAyBd,OAAzB,CAAT,MAAgD,IAAvD,EAA6D;AACzD,QAAMe,YAAY,GAAGF,KAAK,CAAC,CAAD,CAA1B;AACA,QAAMG,eAAe,GAAGH,KAAK,CAACI,KAA9B;AACA,QAAMC,SAAS,GAAGH,YAAY,CAACI,KAAb,CAAmB,KAAnB,EAA0B,CAA1B,CAAlB;AACA,QAAMC,eAAe,GAAGV,iBAAiB,CAACW,QAAlB,CAA2BH,SAA3B,CAAxB,CAJyD;;AAOzD,QAAIN,cAAc,KAAKI,eAAvB,EAAwC;AACpCL,MAAAA,MAAM,CAACW,IAAP,CAAYvB,aAAa,CAACC,OAAO,CAACuB,KAAR,CAAcX,cAAd,EAA8BI,eAA9B,CAAD,CAAzB;AACH,KATwD;;;AAYzD,QAAII,eAAJ,EAAqB;AACjBT,MAAAA,MAAM,CAACW,IAAP,CAAYvB,aAAa,CAACgB,YAAD,CAAzB;AACH,KAFD,MAEO;AACHJ,MAAAA,MAAM,CAACW,IAAP,CAAYnB,aAAa,CAACY,YAAD,EAAe,CAAChB,aAAa,CAACgB,YAAD,CAAd,CAAf,CAAzB;AACH,KAhBwD;;;AAmBzDH,IAAAA,cAAc,GAAGI,eAAe,GAAGD,YAAY,CAACS,MAAhD;AACH;;;AAGD,MAAMC,aAAa,GAAGzB,OAAO,CAACuB,KAAR,CAAcX,cAAd,CAAtB;;AACA,MAAIa,aAAa,CAACD,MAAd,GAAuB,CAA3B,EAA8B;AAC1Bb,IAAAA,MAAM,CAACW,IAAP,CAAYvB,aAAa,CAAC0B,aAAD,CAAzB;AACH;;AAED,SAAOd,MAAP;AACH;;AAED,SAASe,sBAAT,CAAgChB,iBAAhC;MAAgCA;AAAAA,IAAAA,oBAAoBZ;;;AAChD,SAAO;AAAA,WAAM,UAAC6B,GAAD;AACTC,MAAAA,gBAAgB,CAACD,GAAD,EAAM,MAAN,EAAc,UAAClB,QAAD,EAAWoB,OAAX;AAC1B,YAAIA,OAAO,CAACL,MAAR,GAAiB,CAAjB,IAAsBK,OAAO,CAACA,OAAO,CAACL,MAAR,GAAiB,CAAlB,CAAP,CAA4BvB,IAA5B,KAAqC,MAA/D,EAAuE;AACnEQ,UAAAA,QAAQ,CAACqB,SAAT,GAAqB,IAArB;AACA;AACH;AACJ,OALe,CAAhB;AAOAC,MAAAA,OAAO,CAACJ,GAAD,EAAM,UAACK,IAAD;AACT,YAAIA,IAAI,CAAC/B,IAAL,KAAc,MAAlB,EAA0B;AACtB,iBAAO,CAAC+B,IAAD,CAAP;AACH;;AACD,YAAIA,IAAI,CAACF,SAAT,EAAoB;AAChB,iBAAOE,IAAI,CAACF,SAAZ;AACA,iBAAO,CAACE,IAAD,CAAP;AACH;;AACD,eAAOxB,aAAa,CAACwB,IAAD,EAAOtB,iBAAP,CAApB;AACH,OATM,CAAP;AAWA,aAAOiB,GAAP;AACH,KApBM;AAAA,GAAP;AAqBH;;;;"}

package/dist/remark-application-links.cjs.production.min.js

@@ -0,0 +1,2 @@
+"use strict";function e(e){return e&&"object"==typeof e&&"default"in e?e.default:e}Object.defineProperty(exports,"__esModule",{value:!0});var t=e(require("unist-util-visit-parents")),n=e(require("unist-util-flatmap")),r=["data","jar","java","javascript","vbscript","view-source"];function u(e){return{type:"text",value:e}}var i=/\S+:\/\/\S+/g;exports.default=function(e){return void 0===e&&(e=r),function(){return function(r){return t(r,"text",(function(e,t){t.length>0&&"link"===t[t.length-1].type&&(e._ignoreMe=!0)})),n(r,(function(t){return"text"!==t.type?[t]:t._ignoreMe?(delete t._ignoreMe,[t]):function(e,t){for(var n=e.value,r=[],l=0,a=[];null!==(a=i.exec(n));){var o=a[0],c=a.index,s=o.split("://")[0],p=t.includes(s);l!==c&&r.push(u(n.slice(l,c))),r.push(p?u(o):{type:"link",title:null,url:o,children:[u(o)]}),l=c+o.length}var f=n.slice(l);return f.length>0&&r.push(u(f)),r}(t,e)})),r}}};
+//# sourceMappingURL=remark-application-links.cjs.production.min.js.map

package/dist/remark-application-links.cjs.production.min.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remark-application-links.cjs.production.min.js","sources":["../src/index.ts"],"sourcesContent":["/**\n * This is heavily inspired by `remark-linkify-regex`\n * https://gitlab.com/staltz/remark-linkify-regex/blob/master/index.js\n *\n * remark-linkify-regex works on an allow list to support more protocols (url\n * schemes). This plugin works with a block list to support everything that\n * remotely looks like a link but blocks potentially dangerous schemes.\n */\n\nimport visitWithParents from 'unist-util-visit-parents'\nimport flatMap from 'unist-util-flatmap'\nimport { Node } from 'unist'\n\n/**\n * Default collection of url schemes that will be blocked by this plugin. All\n * others schemes are allowed.\n */\nconst BLOCKED_URL_SCHEMES = ['data', 'jar', 'java', 'javascript', 'vbscript', 'view-source']\n\nfunction buildTextNode(content: string) {\n    return { type: 'text', value: content }\n}\n\nfunction buildLinkNode(url: string, children: Node[]) {\n    return {\n        type: 'link',\n        title: null,\n        url,\n        children,\n    }\n}\n\n// looks for any non-whitespace character sequence that contains `://`\nconst REGEX_POTENTIAL_URL = /\\S+:\\/\\/\\S+/g\n\nfunction splitTextNode(textNode: Node, blockedUrlSchemes: string[]) {\n    const content = textNode.value as string\n    const result: Node[] = []\n    let textStartIndex = 0\n    let match: RegExpExecArray | null | never[] = []\n\n    while ((match = REGEX_POTENTIAL_URL.exec(content)) !== null) {\n        const matchingText = match[0]\n        const matchStartIndex = match.index\n        const urlScheme = matchingText.split('://')[0]\n        const isBlockedScheme = blockedUrlSchemes.includes(urlScheme)\n\n        // create a new text node for everything before the match\n        if (textStartIndex !== matchStartIndex) {\n            result.push(buildTextNode(content.slice(textStartIndex, matchStartIndex)))\n        }\n\n        // either insert another text node if the url scheme is blocked or insert a link\n        if (isBlockedScheme) {\n            result.push(buildTextNode(matchingText))\n        } else {\n            result.push(buildLinkNode(matchingText, [buildTextNode(matchingText)]))\n        }\n\n        // move the pointer ahead so we can support multiple links\n        textStartIndex = matchStartIndex + matchingText.length\n    }\n\n    // this path will also be executed when no url has been found\n    const remainingText = content.slice(textStartIndex)\n    if (remainingText.length > 0) {\n        result.push(buildTextNode(remainingText))\n    }\n\n    return result\n}\n\nfunction remarkApplicationLinks(blockedUrlSchemes = BLOCKED_URL_SCHEMES) {\n    return () => (ast: Node) => {\n        visitWithParents(ast, 'text', (textNode, parents) => {\n            if (parents.length > 0 && parents[parents.length - 1].type === 'link') {\n                textNode._ignoreMe = true\n                return\n            }\n        })\n\n        flatMap(ast, (node: Node) => {\n            if (node.type !== 'text') {\n                return [node]\n            }\n            if (node._ignoreMe) {\n                delete node._ignoreMe\n                return [node]\n            }\n            return splitTextNode(node, blockedUrlSchemes)\n        })\n\n        return ast\n    }\n}\n\nexport default remarkApplicationLinks\n"],"names":["BLOCKED_URL_SCHEMES","buildTextNode","content","type","value","REGEX_POTENTIAL_URL","blockedUrlSchemes","ast","visitWithParents","textNode","parents","length","_ignoreMe","flatMap","node","result","textStartIndex","match","exec","matchingText","matchStartIndex","index","urlScheme","split","isBlockedScheme","includes","push","slice","title","url","children","remainingText","splitTextNode"],"mappings":"0NAiBMA,EAAsB,CAAC,OAAQ,MAAO,OAAQ,aAAc,WAAY,eAE9E,SAASC,EAAcC,SACZ,CAAEC,KAAM,OAAQC,MAAOF,GAalC,IAAMG,EAAsB,+BAuC5B,SAAgCC,mBAAAA,IAAAA,EAAoBN,GACzC,kBAAM,SAACO,UACVC,EAAiBD,EAAK,QAAQ,SAACE,EAAUC,GACjCA,EAAQC,OAAS,GAA0C,SAArCD,EAAQA,EAAQC,OAAS,GAAGR,OAClDM,EAASG,WAAY,MAK7BC,EAAQN,GAAK,SAACO,SACQ,SAAdA,EAAKX,KACE,CAACW,GAERA,EAAKF,kBACEE,EAAKF,UACL,CAACE,IApDxB,SAAuBL,EAAgBH,WAC7BJ,EAAUO,EAASL,MACnBW,EAAiB,GACnBC,EAAiB,EACjBC,EAA0C,GAES,QAA/CA,EAAQZ,EAAoBa,KAAKhB,KAAoB,KACnDiB,EAAeF,EAAM,GACrBG,EAAkBH,EAAMI,MACxBC,EAAYH,EAAaI,MAAM,OAAO,GACtCC,EAAkBlB,EAAkBmB,SAASH,GAG/CN,IAAmBI,GACnBL,EAAOW,KAAKzB,EAAcC,EAAQyB,MAAMX,EAAgBI,KAKxDL,EAAOW,KADPF,EACYvB,EAAckB,GA9B3B,CACHhB,KAAM,OACNyB,MAAO,KACPC,IA6B8BV,EA5B9BW,SA4B4C,CAAC7B,EAAckB,MAI3DH,EAAiBI,EAAkBD,EAAaR,WAI9CoB,EAAgB7B,EAAQyB,MAAMX,UAChCe,EAAcpB,OAAS,GACvBI,EAAOW,KAAKzB,EAAc8B,IAGvBhB,EAoBQiB,CAAclB,EAAMR,MAGxBC"}

package/dist/remark-application-links.esm.js

@@ -0,0 +1,106 @@
+import visitWithParents from 'unist-util-visit-parents';
+import flatMap from 'unist-util-flatmap';
+
+/**
+ * This is heavily inspired by `remark-linkify-regex`
+ * https://gitlab.com/staltz/remark-linkify-regex/blob/master/index.js
+ *
+ * remark-linkify-regex works on an allow list to support more protocols (url
+ * schemes). This plugin works with a block list to support everything that
+ * remotely looks like a link but blocks potentially dangerous schemes.
+ */
+/**
+ * Default collection of url schemes that will be blocked by this plugin. All
+ * others schemes are allowed.
+ */
+
+var BLOCKED_URL_SCHEMES = ['data', 'jar', 'java', 'javascript', 'vbscript', 'view-source'];
+
+function buildTextNode(content) {
+  return {
+    type: 'text',
+    value: content
+  };
+}
+
+function buildLinkNode(url, children) {
+  return {
+    type: 'link',
+    title: null,
+    url: url,
+    children: children
+  };
+} // looks for any non-whitespace character sequence that contains `://`
+
+
+var REGEX_POTENTIAL_URL = /\S+:\/\/\S+/g;
+
+function splitTextNode(textNode, blockedUrlSchemes) {
+  var content = textNode.value;
+  var result = [];
+  var textStartIndex = 0;
+  var match = [];
+
+  while ((match = REGEX_POTENTIAL_URL.exec(content)) !== null) {
+    var matchingText = match[0];
+    var matchStartIndex = match.index;
+    var urlScheme = matchingText.split('://')[0];
+    var isBlockedScheme = blockedUrlSchemes.includes(urlScheme); // create a new text node for everything before the match
+
+    if (textStartIndex !== matchStartIndex) {
+      result.push(buildTextNode(content.slice(textStartIndex, matchStartIndex)));
+    } // either insert another text node if the url scheme is blocked or insert a link
+
+
+    if (isBlockedScheme) {
+      result.push(buildTextNode(matchingText));
+    } else {
+      result.push(buildLinkNode(matchingText, [buildTextNode(matchingText)]));
+    } // move the pointer ahead so we can support multiple links
+
+
+    textStartIndex = matchStartIndex + matchingText.length;
+  } // this path will also be executed when no url has been found
+
+
+  var remainingText = content.slice(textStartIndex);
+
+  if (remainingText.length > 0) {
+    result.push(buildTextNode(remainingText));
+  }
+
+  return result;
+}
+
+function remarkApplicationLinks(blockedUrlSchemes) {
+  if (blockedUrlSchemes === void 0) {
+    blockedUrlSchemes = BLOCKED_URL_SCHEMES;
+  }
+
+  return function () {
+    return function (ast) {
+      visitWithParents(ast, 'text', function (textNode, parents) {
+        if (parents.length > 0 && parents[parents.length - 1].type === 'link') {
+          textNode._ignoreMe = true;
+          return;
+        }
+      });
+      flatMap(ast, function (node) {
+        if (node.type !== 'text') {
+          return [node];
+        }
+
+        if (node._ignoreMe) {
+          delete node._ignoreMe;
+          return [node];
+        }
+
+        return splitTextNode(node, blockedUrlSchemes);
+      });
+      return ast;
+    };
+  };
+}
+
+export default remarkApplicationLinks;
+//# sourceMappingURL=remark-application-links.esm.js.map

package/dist/remark-application-links.esm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remark-application-links.esm.js","sources":["../src/index.ts"],"sourcesContent":["/**\n * This is heavily inspired by `remark-linkify-regex`\n * https://gitlab.com/staltz/remark-linkify-regex/blob/master/index.js\n *\n * remark-linkify-regex works on an allow list to support more protocols (url\n * schemes). This plugin works with a block list to support everything that\n * remotely looks like a link but blocks potentially dangerous schemes.\n */\n\nimport visitWithParents from 'unist-util-visit-parents'\nimport flatMap from 'unist-util-flatmap'\nimport { Node } from 'unist'\n\n/**\n * Default collection of url schemes that will be blocked by this plugin. All\n * others schemes are allowed.\n */\nconst BLOCKED_URL_SCHEMES = ['data', 'jar', 'java', 'javascript', 'vbscript', 'view-source']\n\nfunction buildTextNode(content: string) {\n    return { type: 'text', value: content }\n}\n\nfunction buildLinkNode(url: string, children: Node[]) {\n    return {\n        type: 'link',\n        title: null,\n        url,\n        children,\n    }\n}\n\n// looks for any non-whitespace character sequence that contains `://`\nconst REGEX_POTENTIAL_URL = /\\S+:\\/\\/\\S+/g\n\nfunction splitTextNode(textNode: Node, blockedUrlSchemes: string[]) {\n    const content = textNode.value as string\n    const result: Node[] = []\n    let textStartIndex = 0\n    let match: RegExpExecArray | null | never[] = []\n\n    while ((match = REGEX_POTENTIAL_URL.exec(content)) !== null) {\n        const matchingText = match[0]\n        const matchStartIndex = match.index\n        const urlScheme = matchingText.split('://')[0]\n        const isBlockedScheme = blockedUrlSchemes.includes(urlScheme)\n\n        // create a new text node for everything before the match\n        if (textStartIndex !== matchStartIndex) {\n            result.push(buildTextNode(content.slice(textStartIndex, matchStartIndex)))\n        }\n\n        // either insert another text node if the url scheme is blocked or insert a link\n        if (isBlockedScheme) {\n            result.push(buildTextNode(matchingText))\n        } else {\n            result.push(buildLinkNode(matchingText, [buildTextNode(matchingText)]))\n        }\n\n        // move the pointer ahead so we can support multiple links\n        textStartIndex = matchStartIndex + matchingText.length\n    }\n\n    // this path will also be executed when no url has been found\n    const remainingText = content.slice(textStartIndex)\n    if (remainingText.length > 0) {\n        result.push(buildTextNode(remainingText))\n    }\n\n    return result\n}\n\nfunction remarkApplicationLinks(blockedUrlSchemes = BLOCKED_URL_SCHEMES) {\n    return () => (ast: Node) => {\n        visitWithParents(ast, 'text', (textNode, parents) => {\n            if (parents.length > 0 && parents[parents.length - 1].type === 'link') {\n                textNode._ignoreMe = true\n                return\n            }\n        })\n\n        flatMap(ast, (node: Node) => {\n            if (node.type !== 'text') {\n                return [node]\n            }\n            if (node._ignoreMe) {\n                delete node._ignoreMe\n                return [node]\n            }\n            return splitTextNode(node, blockedUrlSchemes)\n        })\n\n        return ast\n    }\n}\n\nexport default remarkApplicationLinks\n"],"names":["BLOCKED_URL_SCHEMES","buildTextNode","content","type","value","buildLinkNode","url","children","title","REGEX_POTENTIAL_URL","splitTextNode","textNode","blockedUrlSchemes","result","textStartIndex","match","exec","matchingText","matchStartIndex","index","urlScheme","split","isBlockedScheme","includes","push","slice","length","remainingText","remarkApplicationLinks","ast","visitWithParents","parents","_ignoreMe","flatMap","node"],"mappings":";;;AAAA;;;;;;;;AAaA;;;;;AAIA,IAAMA,mBAAmB,GAAG,CAAC,MAAD,EAAS,KAAT,EAAgB,MAAhB,EAAwB,YAAxB,EAAsC,UAAtC,EAAkD,aAAlD,CAA5B;;AAEA,SAASC,aAAT,CAAuBC,OAAvB;AACI,SAAO;AAAEC,IAAAA,IAAI,EAAE,MAAR;AAAgBC,IAAAA,KAAK,EAAEF;AAAvB,GAAP;AACH;;AAED,SAASG,aAAT,CAAuBC,GAAvB,EAAoCC,QAApC;AACI,SAAO;AACHJ,IAAAA,IAAI,EAAE,MADH;AAEHK,IAAAA,KAAK,EAAE,IAFJ;AAGHF,IAAAA,GAAG,EAAHA,GAHG;AAIHC,IAAAA,QAAQ,EAARA;AAJG,GAAP;AAMH;;;AAGD,IAAME,mBAAmB,GAAG,cAA5B;;AAEA,SAASC,aAAT,CAAuBC,QAAvB,EAAuCC,iBAAvC;AACI,MAAMV,OAAO,GAAGS,QAAQ,CAACP,KAAzB;AACA,MAAMS,MAAM,GAAW,EAAvB;AACA,MAAIC,cAAc,GAAG,CAArB;AACA,MAAIC,KAAK,GAAqC,EAA9C;;AAEA,SAAO,CAACA,KAAK,GAAGN,mBAAmB,CAACO,IAApB,CAAyBd,OAAzB,CAAT,MAAgD,IAAvD,EAA6D;AACzD,QAAMe,YAAY,GAAGF,KAAK,CAAC,CAAD,CAA1B;AACA,QAAMG,eAAe,GAAGH,KAAK,CAACI,KAA9B;AACA,QAAMC,SAAS,GAAGH,YAAY,CAACI,KAAb,CAAmB,KAAnB,EAA0B,CAA1B,CAAlB;AACA,QAAMC,eAAe,GAAGV,iBAAiB,CAACW,QAAlB,CAA2BH,SAA3B,CAAxB,CAJyD;;AAOzD,QAAIN,cAAc,KAAKI,eAAvB,EAAwC;AACpCL,MAAAA,MAAM,CAACW,IAAP,CAAYvB,aAAa,CAACC,OAAO,CAACuB,KAAR,CAAcX,cAAd,EAA8BI,eAA9B,CAAD,CAAzB;AACH,KATwD;;;AAYzD,QAAII,eAAJ,EAAqB;AACjBT,MAAAA,MAAM,CAACW,IAAP,CAAYvB,aAAa,CAACgB,YAAD,CAAzB;AACH,KAFD,MAEO;AACHJ,MAAAA,MAAM,CAACW,IAAP,CAAYnB,aAAa,CAACY,YAAD,EAAe,CAAChB,aAAa,CAACgB,YAAD,CAAd,CAAf,CAAzB;AACH,KAhBwD;;;AAmBzDH,IAAAA,cAAc,GAAGI,eAAe,GAAGD,YAAY,CAACS,MAAhD;AACH;;;AAGD,MAAMC,aAAa,GAAGzB,OAAO,CAACuB,KAAR,CAAcX,cAAd,CAAtB;;AACA,MAAIa,aAAa,CAACD,MAAd,GAAuB,CAA3B,EAA8B;AAC1Bb,IAAAA,MAAM,CAACW,IAAP,CAAYvB,aAAa,CAAC0B,aAAD,CAAzB;AACH;;AAED,SAAOd,MAAP;AACH;;AAED,SAASe,sBAAT,CAAgChB,iBAAhC;MAAgCA;AAAAA,IAAAA,oBAAoBZ;;;AAChD,SAAO;AAAA,WAAM,UAAC6B,GAAD;AACTC,MAAAA,gBAAgB,CAACD,GAAD,EAAM,MAAN,EAAc,UAAClB,QAAD,EAAWoB,OAAX;AAC1B,YAAIA,OAAO,CAACL,MAAR,GAAiB,CAAjB,IAAsBK,OAAO,CAACA,OAAO,CAACL,MAAR,GAAiB,CAAlB,CAAP,CAA4BvB,IAA5B,KAAqC,MAA/D,EAAuE;AACnEQ,UAAAA,QAAQ,CAACqB,SAAT,GAAqB,IAArB;AACA;AACH;AACJ,OALe,CAAhB;AAOAC,MAAAA,OAAO,CAACJ,GAAD,EAAM,UAACK,IAAD;AACT,YAAIA,IAAI,CAAC/B,IAAL,KAAc,MAAlB,EAA0B;AACtB,iBAAO,CAAC+B,IAAD,CAAP;AACH;;AACD,YAAIA,IAAI,CAACF,SAAT,EAAoB;AAChB,iBAAOE,IAAI,CAACF,SAAZ;AACA,iBAAO,CAACE,IAAD,CAAP;AACH;;AACD,eAAOxB,aAAa,CAACwB,IAAD,EAAOtB,iBAAP,CAApB;AACH,OATM,CAAP;AAWA,aAAOiB,GAAP;AACH,KApBM;AAAA,GAAP;AAqBH;;;;"}

package/package.json

@@ -1,6 +1,56 @@
 {
-  "name": "@todoist/remark-application-links",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+    "version": "1.0.5",
+    "repository": "https://github.com/todoist/remark-application-links",
+    "license": "MIT",
+    "main": "dist/index.js",
+    "typings": "dist/index.d.ts",
+    "files": [
+        "dist",
+        "src"
+    ],
+    "engines": {
+        "node": ">=12"
+    },
+    "scripts": {
+        "start": "tsdx watch",
+        "build": "tsdx build",
+        "test": "tsdx test",
+        "test:ci": "tsdx test --ci --coverage --maxWorkers=2",
+        "test:watch": "tsdx test --watch",
+        "lint": "tsdx lint && prettier --check \"src/**/*.ts\" \"test/**/*.ts\"",
+        "prepare": "tsdx build",
+        "setup": "npm install && npm run validate",
+        "validate": "npm run lint && npm run test",
+        "test:release": "node --test scripts/*.test.mjs"
+    },
+    "peerDependencies": {},
+    "husky": {
+        "hooks": {
+            "pre-commit": "npm run lint"
+        }
+    },
+    "prettier": "@todoist/prettier-config",
+    "name": "@todoist/remark-application-links",
+    "author": "Henning Muszynski",
+    "module": "dist/remark-application-links.esm.js",
+    "devDependencies": {
+        "@todoist/prettier-config": "4.0.2",
+        "@types/unist": "^2.0.3",
+        "husky": "^4.3.0",
+        "prettier": "^3.0.0",
+        "remark": "^12.0.1",
+        "remark-html": "^12.0.0",
+        "tsdx": "^0.14.0",
+        "tslib": "^2.0.1",
+        "typescript": "^4.0.3"
+    },
+    "dependencies": {
+        "unist-util-flatmap": "^1.0.0",
+        "unist-util-visit-parents": "^3.1.0"
+    },
+    "eslint": {
+        "rules": {
+            "prettier/prettier": "off"
+        }
+    }
+}

package/src/index.ts

@@ -0,0 +1,97 @@
+/**
+ * This is heavily inspired by `remark-linkify-regex`
+ * https://gitlab.com/staltz/remark-linkify-regex/blob/master/index.js
+ *
+ * remark-linkify-regex works on an allow list to support more protocols (url
+ * schemes). This plugin works with a block list to support everything that
+ * remotely looks like a link but blocks potentially dangerous schemes.
+ */
+
+import visitWithParents from 'unist-util-visit-parents'
+import flatMap from 'unist-util-flatmap'
+import { Node } from 'unist'
+
+/**
+ * Default collection of url schemes that will be blocked by this plugin. All
+ * others schemes are allowed.
+ */
+const BLOCKED_URL_SCHEMES = ['data', 'jar', 'java', 'javascript', 'vbscript', 'view-source']
+
+function buildTextNode(content: string) {
+    return { type: 'text', value: content }
+}
+
+function buildLinkNode(url: string, children: Node[]) {
+    return {
+        type: 'link',
+        title: null,
+        url,
+        children,
+    }
+}
+
+// looks for any non-whitespace character sequence that contains `://`
+const REGEX_POTENTIAL_URL = /\S+:\/\/\S+/g
+
+function splitTextNode(textNode: Node, blockedUrlSchemes: string[]) {
+    const content = textNode.value as string
+    const result: Node[] = []
+    let textStartIndex = 0
+    let match: RegExpExecArray | null | never[] = []
+
+    while ((match = REGEX_POTENTIAL_URL.exec(content)) !== null) {
+        const matchingText = match[0]
+        const matchStartIndex = match.index
+        const urlScheme = matchingText.split('://')[0]
+        const isBlockedScheme = blockedUrlSchemes.includes(urlScheme)
+
+        // create a new text node for everything before the match
+        if (textStartIndex !== matchStartIndex) {
+            result.push(buildTextNode(content.slice(textStartIndex, matchStartIndex)))
+        }
+
+        // either insert another text node if the url scheme is blocked or insert a link
+        if (isBlockedScheme) {
+            result.push(buildTextNode(matchingText))
+        } else {
+            result.push(buildLinkNode(matchingText, [buildTextNode(matchingText)]))
+        }
+
+        // move the pointer ahead so we can support multiple links
+        textStartIndex = matchStartIndex + matchingText.length
+    }
+
+    // this path will also be executed when no url has been found
+    const remainingText = content.slice(textStartIndex)
+    if (remainingText.length > 0) {
+        result.push(buildTextNode(remainingText))
+    }
+
+    return result
+}
+
+function remarkApplicationLinks(blockedUrlSchemes = BLOCKED_URL_SCHEMES) {
+    return () => (ast: Node) => {
+        visitWithParents(ast, 'text', (textNode, parents) => {
+            if (parents.length > 0 && parents[parents.length - 1].type === 'link') {
+                textNode._ignoreMe = true
+                return
+            }
+        })
+
+        flatMap(ast, (node: Node) => {
+            if (node.type !== 'text') {
+                return [node]
+            }
+            if (node._ignoreMe) {
+                delete node._ignoreMe
+                return [node]
+            }
+            return splitTextNode(node, blockedUrlSchemes)
+        })
+
+        return ast
+    }
+}
+
+export default remarkApplicationLinks

package/src/unist-util-flatmap.d.ts

@@ -0,0 +1 @@
+declare module 'unist-util-flatmap'