@transferwise/components 0.0.0-experimental-3586f3f → 0.0.0-experimental-a06eb0d

package/build/Markup/utils/sanitise.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"sanitise.mjs","sources":["../../../src/Markup/utils/sanitise.ts"],"sourcesContent":["import { ALLOWED_PROTOCOLS } from '../constants';\n\nconst INVISIBLE_CHARS = /[\\u200b\\u200c\\u200d\\ufeff\\u00ad\\u2060\\u180e]/g;\n// eslint-disable-next-line regexp/no-control-character\nconst CONTROL_CHARS = /[\\u0000-\\u001f\\u007f-\\u009f]/;\nconst DANGEROUS_HTML_CHARS = /[<>\"']/;\nconst DANGEROUS_SCHEME = /^(?:javascript|vbscript|data|jscript)\\s*:/i;\n// eslint-disable-next-line regexp/no-useless-non-capturing-group\nconst ENCODED_COLON_SCHEME = /^(?:javascript|vbscript|data|jscript)(?:%3a)/i;\nconst IPV6_BRACKETS = /^\\[|\\]$/g;\nconst NUMERIC_IP = /^[\\d.]+$/;\nconst HEX_IP = /^0x[0-9a-f]+$/i;\n\nexport function isAllowedHref(href: string): boolean {\n  const cleaned = href.replace(INVISIBLE_CHARS, '');\n  const trimmed = cleaned.trim();\n\n  if (!trimmed) {\n    return false;\n  }\n\n  if (CONTROL_CHARS.test(trimmed)) {\n    return false;\n  }\n\n  if (DANGEROUS_HTML_CHARS.test(trimmed)) {\n    return false;\n  }\n\n  if (DANGEROUS_SCHEME.test(trimmed)) {\n    return false;\n  }\n\n  if (ENCODED_COLON_SCHEME.test(trimmed)) {\n    return false;\n  }\n\n  if (trimmed.startsWith('//')) {\n    return false;\n  }\n\n  if (trimmed.startsWith('\\\\')) {\n    return false;\n  }\n\n  if (trimmed.startsWith('/')) {\n    return trimmed[1] !== '\\\\';\n  }\n\n  if (trimmed.startsWith('#')) {\n    return true;\n  }\n\n  if (trimmed.startsWith('./') || trimmed.startsWith('../')) {\n    return false;\n  }\n\n  try {\n    const url = new URL(trimmed);\n\n    if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {\n      return false;\n    }\n\n    if (url.protocol === 'https:') {\n      if (!trimmed.startsWith('https://')) {\n        return false;\n      }\n\n      if (!url.hostname) {\n        return false;\n      }\n\n      if (url.username || url.password) {\n        return false;\n      }\n\n      if (isInternalHost(url.hostname)) {\n        return false;\n      }\n    }\n\n    if (url.protocol === 'mailto:') {\n      if (url.search) {\n        return false;\n      }\n\n      if (!url.pathname) {\n        return false;\n      }\n    }\n\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport type AllowLinksMode = 'internal' | 'all' | 'none';\n\n// Synthetic origin used to resolve relative paths via the WHATWG URL parser.\n// If the resolved origin still equals this sentinel, the path stays on-origin.\nconst SSR_SENTINEL_ORIGIN = 'https://internal.invalid';\n\nexport function isHrefAllowedByMode(href: string, mode: AllowLinksMode): boolean {\n  switch (mode) {\n    case 'none':\n      return false;\n    case 'all':\n      return true;\n    case 'internal':\n      try {\n        if (!href.startsWith('/')) {\n          const parsed = new URL(href);\n          return parsed.protocol === 'https:' && parsed.hostname === 'wise.com';\n        }\n        const parsed = new URL(href, SSR_SENTINEL_ORIGIN);\n        return parsed.origin === SSR_SENTINEL_ORIGIN;\n      } catch {\n        return false;\n      }\n  }\n}\n\nfunction isInternalHost(hostname: string): boolean {\n  const stripped = hostname.replace(IPV6_BRACKETS, '');\n  const host = stripped.endsWith('.') ? stripped.slice(0, -1) : stripped;\n  if (NUMERIC_IP.test(host)) return true;\n  if (HEX_IP.test(host)) return true;\n  if (host === '::1' || host === '0:0:0:0:0:0:0:1') return true;\n  if (host === 'localhost') return true;\n  if (host.endsWith('.internal')) return true;\n  return false;\n}\n"],"names":["INVISIBLE_CHARS","CONTROL_CHARS","DANGEROUS_HTML_CHARS","DANGEROUS_SCHEME","ENCODED_COLON_SCHEME","IPV6_BRACKETS","NUMERIC_IP","HEX_IP","isAllowedHref","href","cleaned","replace","trimmed","trim","test","startsWith","url","URL","ALLOWED_PROTOCOLS","includes","protocol","hostname","username","password","isInternalHost","search","pathname","SSR_SENTINEL_ORIGIN","isHrefAllowedByMode","mode","parsed","origin","stripped","host","endsWith","slice"],"mappings":";;AAEA,MAAMA,eAAe,GAAG,+CAA+C;AACvE;AACA,MAAMC,aAAa,GAAG,8BAA8B;AACpD,MAAMC,oBAAoB,GAAG,QAAQ;AACrC,MAAMC,gBAAgB,GAAG,4CAA4C;AACrE;AACA,MAAMC,oBAAoB,GAAG,+CAA+C;AAC5E,MAAMC,aAAa,GAAG,UAAU;AAChC,MAAMC,UAAU,GAAG,UAAU;AAC7B,MAAMC,MAAM,GAAG,gBAAgB;AAEzB,SAAUC,aAAaA,CAACC,IAAY,EAAA;EACxC,MAAMC,OAAO,GAAGD,IAAI,CAACE,OAAO,CAACX,eAAe,EAAE,EAAE,CAAC;AACjD,EAAA,MAAMY,OAAO,GAAGF,OAAO,CAACG,IAAI,EAAE;EAE9B,IAAI,CAACD,OAAO,EAAE;AACZ,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIX,aAAa,CAACa,IAAI,CAACF,OAAO,CAAC,EAAE;AAC/B,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIV,oBAAoB,CAACY,IAAI,CAACF,OAAO,CAAC,EAAE;AACtC,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIT,gBAAgB,CAACW,IAAI,CAACF,OAAO,CAAC,EAAE;AAClC,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIR,oBAAoB,CAACU,IAAI,CAACF,OAAO,CAAC,EAAE;AACtC,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIA,OAAO,CAACG,UAAU,CAAC,IAAI,CAAC,EAAE;AAC5B,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIH,OAAO,CAACG,UAAU,CAAC,IAAI,CAAC,EAAE;AAC5B,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIH,OAAO,CAACG,UAAU,CAAC,GAAG,CAAC,EAAE;AAC3B,IAAA,OAAOH,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;AAC5B,EAAA;AAEA,EAAA,IAAIA,OAAO,CAACG,UAAU,CAAC,GAAG,CAAC,EAAE;AAC3B,IAAA,OAAO,IAAI;AACb,EAAA;AAEA,EAAA,IAAIH,OAAO,CAACG,UAAU,CAAC,IAAI,CAAC,IAAIH,OAAO,CAACG,UAAU,CAAC,KAAK,CAAC,EAAE;AACzD,IAAA,OAAO,KAAK;AACd,EAAA;EAEA,IAAI;AACF,IAAA,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAACL,OAAO,CAAC;IAE5B,IAAI,CAACM,iBAAiB,CAACC,QAAQ,CAACH,GAAG,CAACI,QAAQ,CAAC,EAAE;AAC7C,MAAA,OAAO,KAAK;AACd,IAAA;AAEA,IAAA,IAAIJ,GAAG,CAACI,QAAQ,KAAK,QAAQ,EAAE;AAC7B,MAAA,IAAI,CAACR,OAAO,CAACG,UAAU,CAAC,UAAU,CAAC,EAAE;AACnC,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAI,CAACC,GAAG,CAACK,QAAQ,EAAE;AACjB,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAIL,GAAG,CAACM,QAAQ,IAAIN,GAAG,CAACO,QAAQ,EAAE;AAChC,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAIC,cAAc,CAACR,GAAG,CAACK,QAAQ,CAAC,EAAE;AAChC,QAAA,OAAO,KAAK;AACd,MAAA;AACF,IAAA;AAEA,IAAA,IAAIL,GAAG,CAACI,QAAQ,KAAK,SAAS,EAAE;MAC9B,IAAIJ,GAAG,CAACS,MAAM,EAAE;AACd,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAI,CAACT,GAAG,CAACU,QAAQ,EAAE;AACjB,QAAA,OAAO,KAAK;AACd,MAAA;AACF,IAAA;AAEA,IAAA,OAAO,IAAI;AACb,EAAA,CAAC,CAAC,MAAM;AACN,IAAA,OAAO,KAAK;AACd,EAAA;AACF;AAIA;AACA;AACA,MAAMC,mBAAmB,GAAG,0BAA0B;AAEhD,SAAUC,mBAAmBA,CAACnB,IAAY,EAAEoB,IAAoB,EAAA;AACpE,EAAA,QAAQA,IAAI;AACV,IAAA,KAAK,MAAM;AACT,MAAA,OAAO,KAAK;AACd,IAAA,KAAK,KAAK;AACR,MAAA,OAAO,IAAI;AACb,IAAA,KAAK,UAAU;MACb,IAAI;AACF,QAAA,IAAI,CAACpB,IAAI,CAACM,UAAU,CAAC,GAAG,CAAC,EAAE;AACzB,UAAA,MAAMe,MAAM,GAAG,IAAIb,GAAG,CAACR,IAAI,CAAC;UAC5B,OAAOqB,MAAM,CAACV,QAAQ,KAAK,QAAQ,IAAIU,MAAM,CAACT,QAAQ,KAAK,UAAU;AACvE,QAAA;QACA,MAAMS,MAAM,GAAG,IAAIb,GAAG,CAACR,IAAI,EAAEkB,mBAAmB,CAAC;AACjD,QAAA,OAAOG,MAAM,CAACC,MAAM,KAAKJ,mBAAmB;AAC9C,MAAA,CAAC,CAAC,MAAM;AACN,QAAA,OAAO,KAAK;AACd,MAAA;AACJ;AACF;AAEA,SAASH,cAAcA,CAACH,QAAgB,EAAA;EACtC,MAAMW,QAAQ,GAAGX,QAAQ,CAACV,OAAO,CAACN,aAAa,EAAE,EAAE,CAAC;AACpD,EAAA,MAAM4B,IAAI,GAAGD,QAAQ,CAACE,QAAQ,CAAC,GAAG,CAAC,GAAGF,QAAQ,CAACG,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAGH,QAAQ;EACtE,IAAI1B,UAAU,CAACQ,IAAI,CAACmB,IAAI,CAAC,EAAE,OAAO,IAAI;EACtC,IAAI1B,MAAM,CAACO,IAAI,CAACmB,IAAI,CAAC,EAAE,OAAO,IAAI;EAClC,IAAIA,IAAI,KAAK,KAAK,IAAIA,IAAI,KAAK,iBAAiB,EAAE,OAAO,IAAI;AAC7D,EAAA,IAAIA,IAAI,KAAK,WAAW,EAAE,OAAO,IAAI;EACrC,IAAIA,IAAI,CAACC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,IAAI;AAC3C,EAAA,OAAO,KAAK;AACd;;;;"}
+{"version":3,"file":"sanitise.mjs","sources":["../../../src/Markup/utils/sanitise.ts"],"sourcesContent":["import { ALLOWED_PROTOCOLS } from '../constants';\n\nconst INVISIBLE_CHARS = /[\\u200b\\u200c\\u200d\\ufeff\\u00ad\\u2060\\u180e]/g;\n// eslint-disable-next-line regexp/no-control-character\nconst CONTROL_CHARS = /[\\u0000-\\u001f\\u007f-\\u009f]/;\nconst DANGEROUS_HTML_CHARS = /[<>\"']/;\nconst DANGEROUS_SCHEME = /^(?:javascript|vbscript|data|jscript)\\s*:/i;\n// eslint-disable-next-line regexp/no-useless-non-capturing-group\nconst ENCODED_COLON_SCHEME = /^(?:javascript|vbscript|data|jscript)(?:%3a)/i;\nconst IPV6_BRACKETS = /^\\[|\\]$/g;\nconst NUMERIC_IP = /^[\\d.]+$/;\nconst HEX_IP = /^0x[0-9a-f]+$/i;\n\nexport function sanitiseHref(href: string): string | undefined {\n  const cleaned = href.replace(INVISIBLE_CHARS, '');\n  const trimmed = cleaned.trim();\n\n  if (!trimmed) {\n    return undefined;\n  }\n\n  if (CONTROL_CHARS.test(trimmed)) {\n    return undefined;\n  }\n\n  if (DANGEROUS_HTML_CHARS.test(trimmed)) {\n    return undefined;\n  }\n\n  if (DANGEROUS_SCHEME.test(trimmed)) {\n    return undefined;\n  }\n\n  if (ENCODED_COLON_SCHEME.test(trimmed)) {\n    return undefined;\n  }\n\n  if (trimmed.startsWith('//')) {\n    return undefined;\n  }\n\n  if (trimmed.startsWith('\\\\')) {\n    return undefined;\n  }\n\n  if (trimmed.startsWith('/')) {\n    return trimmed[1] !== '\\\\' ? trimmed : undefined;\n  }\n\n  if (trimmed.startsWith('#')) {\n    return trimmed;\n  }\n\n  if (trimmed.startsWith('./') || trimmed.startsWith('../')) {\n    return undefined;\n  }\n\n  try {\n    const url = new URL(trimmed);\n\n    if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {\n      return undefined;\n    }\n\n    if (url.protocol === 'https:') {\n      if (!trimmed.startsWith('https://')) {\n        return undefined;\n      }\n\n      if (!url.hostname) {\n        return undefined;\n      }\n\n      if (url.username || url.password) {\n        return undefined;\n      }\n\n      if (isInternalHost(url.hostname)) {\n        return undefined;\n      }\n    }\n\n    if (url.protocol === 'mailto:') {\n      if (url.search) {\n        return undefined;\n      }\n\n      if (!url.pathname) {\n        return undefined;\n      }\n    }\n\n    return trimmed;\n  } catch {\n    return undefined;\n  }\n}\n\nexport type AllowLinksMode = 'internal' | 'all' | 'none';\n\n// Synthetic origin used to resolve relative paths via the WHATWG URL parser.\n// If the resolved origin still equals this sentinel, the path stays on-origin.\nconst SSR_SENTINEL_ORIGIN = 'https://internal.invalid';\n\nexport function isHrefAllowedByMode(href: string, mode: AllowLinksMode): boolean {\n  switch (mode) {\n    case 'none':\n      return false;\n    case 'all':\n      return true;\n    case 'internal':\n      try {\n        if (!href.startsWith('/')) {\n          const parsed = new URL(href);\n          return parsed.protocol === 'https:' && parsed.hostname === 'wise.com';\n        }\n        const parsed = new URL(href, SSR_SENTINEL_ORIGIN);\n        return parsed.origin === SSR_SENTINEL_ORIGIN;\n      } catch {\n        return false;\n      }\n  }\n}\n\nfunction isInternalHost(hostname: string): boolean {\n  const stripped = hostname.replace(IPV6_BRACKETS, '');\n  const host = stripped.endsWith('.') ? stripped.slice(0, -1) : stripped;\n  if (NUMERIC_IP.test(host)) return true;\n  if (HEX_IP.test(host)) return true;\n  if (host === '::1' || host === '0:0:0:0:0:0:0:1') return true;\n  if (host === 'localhost') return true;\n  if (host.endsWith('.internal')) return true;\n  return false;\n}\n"],"names":["INVISIBLE_CHARS","CONTROL_CHARS","DANGEROUS_HTML_CHARS","DANGEROUS_SCHEME","ENCODED_COLON_SCHEME","IPV6_BRACKETS","NUMERIC_IP","HEX_IP","sanitiseHref","href","cleaned","replace","trimmed","trim","undefined","test","startsWith","url","URL","ALLOWED_PROTOCOLS","includes","protocol","hostname","username","password","isInternalHost","search","pathname","SSR_SENTINEL_ORIGIN","isHrefAllowedByMode","mode","parsed","origin","stripped","host","endsWith","slice"],"mappings":";;AAEA,MAAMA,eAAe,GAAG,+CAA+C;AACvE;AACA,MAAMC,aAAa,GAAG,8BAA8B;AACpD,MAAMC,oBAAoB,GAAG,QAAQ;AACrC,MAAMC,gBAAgB,GAAG,4CAA4C;AACrE;AACA,MAAMC,oBAAoB,GAAG,+CAA+C;AAC5E,MAAMC,aAAa,GAAG,UAAU;AAChC,MAAMC,UAAU,GAAG,UAAU;AAC7B,MAAMC,MAAM,GAAG,gBAAgB;AAEzB,SAAUC,YAAYA,CAACC,IAAY,EAAA;EACvC,MAAMC,OAAO,GAAGD,IAAI,CAACE,OAAO,CAACX,eAAe,EAAE,EAAE,CAAC;AACjD,EAAA,MAAMY,OAAO,GAAGF,OAAO,CAACG,IAAI,EAAE;EAE9B,IAAI,CAACD,OAAO,EAAE;AACZ,IAAA,OAAOE,SAAS;AAClB,EAAA;AAEA,EAAA,IAAIb,aAAa,CAACc,IAAI,CAACH,OAAO,CAAC,EAAE;AAC/B,IAAA,OAAOE,SAAS;AAClB,EAAA;AAEA,EAAA,IAAIZ,oBAAoB,CAACa,IAAI,CAACH,OAAO,CAAC,EAAE;AACtC,IAAA,OAAOE,SAAS;AAClB,EAAA;AAEA,EAAA,IAAIX,gBAAgB,CAACY,IAAI,CAACH,OAAO,CAAC,EAAE;AAClC,IAAA,OAAOE,SAAS;AAClB,EAAA;AAEA,EAAA,IAAIV,oBAAoB,CAACW,IAAI,CAACH,OAAO,CAAC,EAAE;AACtC,IAAA,OAAOE,SAAS;AAClB,EAAA;AAEA,EAAA,IAAIF,OAAO,CAACI,UAAU,CAAC,IAAI,CAAC,EAAE;AAC5B,IAAA,OAAOF,SAAS;AAClB,EAAA;AAEA,EAAA,IAAIF,OAAO,CAACI,UAAU,CAAC,IAAI,CAAC,EAAE;AAC5B,IAAA,OAAOF,SAAS;AAClB,EAAA;AAEA,EAAA,IAAIF,OAAO,CAACI,UAAU,CAAC,GAAG,CAAC,EAAE;IAC3B,OAAOJ,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,GAAGA,OAAO,GAAGE,SAAS;AAClD,EAAA;AAEA,EAAA,IAAIF,OAAO,CAACI,UAAU,CAAC,GAAG,CAAC,EAAE;AAC3B,IAAA,OAAOJ,OAAO;AAChB,EAAA;AAEA,EAAA,IAAIA,OAAO,CAACI,UAAU,CAAC,IAAI,CAAC,IAAIJ,OAAO,CAACI,UAAU,CAAC,KAAK,CAAC,EAAE;AACzD,IAAA,OAAOF,SAAS;AAClB,EAAA;EAEA,IAAI;AACF,IAAA,MAAMG,GAAG,GAAG,IAAIC,GAAG,CAACN,OAAO,CAAC;IAE5B,IAAI,CAACO,iBAAiB,CAACC,QAAQ,CAACH,GAAG,CAACI,QAAQ,CAAC,EAAE;AAC7C,MAAA,OAAOP,SAAS;AAClB,IAAA;AAEA,IAAA,IAAIG,GAAG,CAACI,QAAQ,KAAK,QAAQ,EAAE;AAC7B,MAAA,IAAI,CAACT,OAAO,CAACI,UAAU,CAAC,UAAU,CAAC,EAAE;AACnC,QAAA,OAAOF,SAAS;AAClB,MAAA;AAEA,MAAA,IAAI,CAACG,GAAG,CAACK,QAAQ,EAAE;AACjB,QAAA,OAAOR,SAAS;AAClB,MAAA;AAEA,MAAA,IAAIG,GAAG,CAACM,QAAQ,IAAIN,GAAG,CAACO,QAAQ,EAAE;AAChC,QAAA,OAAOV,SAAS;AAClB,MAAA;AAEA,MAAA,IAAIW,cAAc,CAACR,GAAG,CAACK,QAAQ,CAAC,EAAE;AAChC,QAAA,OAAOR,SAAS;AAClB,MAAA;AACF,IAAA;AAEA,IAAA,IAAIG,GAAG,CAACI,QAAQ,KAAK,SAAS,EAAE;MAC9B,IAAIJ,GAAG,CAACS,MAAM,EAAE;AACd,QAAA,OAAOZ,SAAS;AAClB,MAAA;AAEA,MAAA,IAAI,CAACG,GAAG,CAACU,QAAQ,EAAE;AACjB,QAAA,OAAOb,SAAS;AAClB,MAAA;AACF,IAAA;AAEA,IAAA,OAAOF,OAAO;AAChB,EAAA,CAAC,CAAC,MAAM;AACN,IAAA,OAAOE,SAAS;AAClB,EAAA;AACF;AAIA;AACA;AACA,MAAMc,mBAAmB,GAAG,0BAA0B;AAEhD,SAAUC,mBAAmBA,CAACpB,IAAY,EAAEqB,IAAoB,EAAA;AACpE,EAAA,QAAQA,IAAI;AACV,IAAA,KAAK,MAAM;AACT,MAAA,OAAO,KAAK;AACd,IAAA,KAAK,KAAK;AACR,MAAA,OAAO,IAAI;AACb,IAAA,KAAK,UAAU;MACb,IAAI;AACF,QAAA,IAAI,CAACrB,IAAI,CAACO,UAAU,CAAC,GAAG,CAAC,EAAE;AACzB,UAAA,MAAMe,MAAM,GAAG,IAAIb,GAAG,CAACT,IAAI,CAAC;UAC5B,OAAOsB,MAAM,CAACV,QAAQ,KAAK,QAAQ,IAAIU,MAAM,CAACT,QAAQ,KAAK,UAAU;AACvE,QAAA;QACA,MAAMS,MAAM,GAAG,IAAIb,GAAG,CAACT,IAAI,EAAEmB,mBAAmB,CAAC;AACjD,QAAA,OAAOG,MAAM,CAACC,MAAM,KAAKJ,mBAAmB;AAC9C,MAAA,CAAC,CAAC,MAAM;AACN,QAAA,OAAO,KAAK;AACd,MAAA;AACJ;AACF;AAEA,SAASH,cAAcA,CAACH,QAAgB,EAAA;EACtC,MAAMW,QAAQ,GAAGX,QAAQ,CAACX,OAAO,CAACN,aAAa,EAAE,EAAE,CAAC;AACpD,EAAA,MAAM6B,IAAI,GAAGD,QAAQ,CAACE,QAAQ,CAAC,GAAG,CAAC,GAAGF,QAAQ,CAACG,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAGH,QAAQ;EACtE,IAAI3B,UAAU,CAACS,IAAI,CAACmB,IAAI,CAAC,EAAE,OAAO,IAAI;EACtC,IAAI3B,MAAM,CAACQ,IAAI,CAACmB,IAAI,CAAC,EAAE,OAAO,IAAI;EAClC,IAAIA,IAAI,KAAK,KAAK,IAAIA,IAAI,KAAK,iBAAiB,EAAE,OAAO,IAAI;AAC7D,EAAA,IAAIA,IAAI,KAAK,WAAW,EAAE,OAAO,IAAI;EACrC,IAAIA,IAAI,CAACC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,IAAI;AAC3C,EAAA,OAAO,KAAK;AACd;;;;"}

package/build/types/Markup/Markup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Markup.d.ts","sourceRoot":"","sources":["../../../src/Markup/Markup.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA4B,MAAM,OAAO,CAAC;AAMjD,OAAO,KAAK,EAA6B,WAAW,EAAE,MAAM,gBAAgB,CAAC;AA+G7E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAoCxC,CAAC;AAEF,eAAe,MAAM,CAAC"}
+{"version":3,"file":"Markup.d.ts","sourceRoot":"","sources":["../../../src/Markup/Markup.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA4B,MAAM,OAAO,CAAC;AAMjD,OAAO,KAAK,EAA6B,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAqH7E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAoCxC,CAAC;AAEF,eAAe,MAAM,CAAC"}

package/build/types/Markup/utils/parseMarkup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parseMarkup.d.ts","sourceRoot":"","sources":["../../../../src/Markup/utils/parseMarkup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,iBAAiB,EAAe,MAAM,cAAc,CAAC;AAC7F,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC7B,eAAO,MAAM,gBAAgB,QAAS,CAAC;AACvC,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAyOlD,oGAAoG;AACpG,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,EAAE,CAYvD"}
+{"version":3,"file":"parseMarkup.d.ts","sourceRoot":"","sources":["../../../../src/Markup/utils/parseMarkup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,iBAAiB,EAAe,MAAM,cAAc,CAAC;AAC7F,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC7B,eAAO,MAAM,gBAAgB,QAAS,CAAC;AACvC,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAsPlD,oGAAoG;AACpG,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,EAAE,CAYvD"}

package/build/types/Markup/utils/sanitise.d.ts

@@ -1,4 +1,4 @@
-export declare function isAllowedHref(href: string): boolean;
+export declare function sanitiseHref(href: string): string | undefined;
 export type AllowLinksMode = 'internal' | 'all' | 'none';
 export declare function isHrefAllowedByMode(href: string, mode: AllowLinksMode): boolean;
 //# sourceMappingURL=sanitise.d.ts.map

package/build/types/Markup/utils/sanitise.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitise.d.ts","sourceRoot":"","sources":["../../../../src/Markup/utils/sanitise.ts"],"names":[],"mappings":"AAaA,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAmFnD;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,KAAK,GAAG,MAAM,CAAC;AAMzD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAkB/E"}
+{"version":3,"file":"sanitise.d.ts","sourceRoot":"","sources":["../../../../src/Markup/utils/sanitise.ts"],"names":[],"mappings":"AAaA,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAmF7D;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,KAAK,GAAG,MAAM,CAAC;AAMzD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAkB/E"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@transferwise/components",
-  "version": "0.0.0-experimental-3586f3f",
+  "version": "0.0.0-experimental-a06eb0d",
   "description": "Neptune React components",
   "license": "Apache-2.0",
   "repository": {

package/src/Markup/Markup.tsx

@@ -3,7 +3,7 @@ import React, { Fragment, useMemo } from 'react';
 import Link from '../Link';
 
 import { parseMarkup } from './utils/parseMarkup';
-import { type AllowLinksMode, isAllowedHref, isHrefAllowedByMode } from './utils/sanitise';
+import { type AllowLinksMode, isHrefAllowedByMode, sanitiseHref } from './utils/sanitise';
 import type { MarkupActions, MarkupNode, MarkupProps } from './Markup.types';
 
 const PLACEHOLDER_REGEX = /\{\{(\w+)\}\}/g;
@@ -43,9 +43,15 @@ function renderLinkNode(
     );
   }
 
-  if (node.href && isAllowedHref(node.href) && isHrefAllowedByMode(node.href, allowLinks)) {
+  const sanitisedHref = node.href ? sanitiseHref(node.href) : undefined;
+  if (sanitisedHref && isHrefAllowedByMode(sanitisedHref, allowLinks)) {
     return (
-      <Link key={key} href={node.href} target={node.target} aria-label={node.accessibilityLabel}>
+      <Link
+        key={key}
+        href={sanitisedHref}
+        target={node.target}
+        aria-label={node.accessibilityLabel}
+      >
         {children}
       </Link>
     );

package/src/Markup/utils/parseMarkup.test.ts

@@ -495,7 +495,7 @@ describe('parseMarkup', () => {
     it('captures full href even when it contains > inside quotes', () => {
       const result = parseMarkup('<link href="</link>">remaining text</link>');
       // TAG_REGEX sees through > inside quotes — full href is captured
-      // isAllowedHref (at render time) blocks it because it contains <
+      // sanitiseHref (at render time) blocks it because it contains <
       expect(result).toEqual([
         {
           type: 'link',
@@ -636,10 +636,10 @@ describe('parseMarkup', () => {
   });
 
   describe('SVG/IMG in attribute values', () => {
-    it('extracts href containing img tag (blocked by isAllowedHref at render)', () => {
+    it('extracts href containing img tag (blocked by sanitiseHref at render)', () => {
       const result = parseMarkup('<link href="<img src=x onerror=alert(1)>">text</link>');
       // TAG_REGEX now captures > inside quotes — full href is extracted
-      // isAllowedHref blocks it at render time (contains < and >)
+      // sanitiseHref blocks it at render time (contains < and >)
       expect(result).toEqual([
         {
           type: 'link',
@@ -668,13 +668,13 @@ describe('parseMarkup', () => {
     });
 
     it('parses normally at exactly MAX_INPUT_LENGTH', () => {
-      const input = `<important>${  'x'.repeat(MAX_INPUT_LENGTH - 24)  }</important>`;
+      const input = `<important>${'x'.repeat(MAX_INPUT_LENGTH - 24)}</important>`;
       const result = parseMarkup(input);
       expect(result[0]).toHaveProperty('type', 'important');
     });
 
     it('does not parse markup tags in oversized input', () => {
-      const input = `<important>text</important>${  'x'.repeat(MAX_INPUT_LENGTH)}`;
+      const input = `<important>text</important>${'x'.repeat(MAX_INPUT_LENGTH)}`;
       const result = parseMarkup(input);
       expect(result).toEqual([{ type: 'text', content: input }]);
     });

package/src/Markup/utils/parseMarkup.ts

@@ -175,6 +175,19 @@ function buildNode(rawTag: string, attrs: string, children: MarkupNode[]): Marku
   } as MarkupNode;
 }
 
+/**
+ * Matches allow-listed attributes from the raw attribute string captured by TAG_REGEX.
+ * Requires whitespace before each attribute name to prevent matching inside quoted values.
+ *
+ * Example: for input ` href="https://wise.com" target="_blank"`
+ *  - Match 1: groups = ['href', 'https://wise.com', undefined]
+ *  - Match 2: groups = ['target', '_blank', undefined]
+ *
+ * Capture groups:
+ *  1. Attribute name (href, action, target, or accessibilityLabel)
+ *  2. Double-quoted value (if present)
+ *  3. Single-quoted value (if present)
+ */
 const ATTR_REGEX = /(?<=\s)(href|action|target|accessibilityLabel)=(?:"([^"]*)"|'([^']*)')/g;
 
 type ParsedAttributes = {