@transferwise/components 0.0.0-experimental-c388243 → 0.0.0-experimental-18063d6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (75) hide show
  1. package/build/chips/Chip.js.map +1 -1
  2. package/build/chips/Chip.mjs.map +1 -1
  3. package/build/chips/Chips.js.map +1 -1
  4. package/build/chips/Chips.mjs.map +1 -1
  5. package/build/index.js +0 -2
  6. package/build/index.js.map +1 -1
  7. package/build/index.mjs +0 -1
  8. package/build/index.mjs.map +1 -1
  9. package/build/main.css +0 -35
  10. package/build/styles/main.css +0 -35
  11. package/build/types/body/Body.d.ts +2 -2
  12. package/build/types/chips/Chip.d.ts +3 -3
  13. package/build/types/chips/Chip.d.ts.map +1 -1
  14. package/build/types/chips/Chips.d.ts +10 -9
  15. package/build/types/chips/Chips.d.ts.map +1 -1
  16. package/build/types/iconButton/IconButton.d.ts +1 -1
  17. package/build/types/index.d.ts +0 -2
  18. package/build/types/index.d.ts.map +1 -1
  19. package/build/types/title/Title.d.ts +2 -2
  20. package/build/types/upload/steps/uploadImageStep/uploadImageStep.d.ts +1 -1
  21. package/build/types/uploadInput/uploadItem/UploadItemLink.d.ts +1 -1
  22. package/package.json +3 -3
  23. package/src/chips/Chip.tsx +4 -4
  24. package/src/chips/Chips.tsx +13 -18
  25. package/src/index.ts +0 -2
  26. package/src/main.css +0 -35
  27. package/src/main.less +0 -1
  28. package/build/markup/Markup.js +0 -128
  29. package/build/markup/Markup.js.map +0 -1
  30. package/build/markup/Markup.mjs +0 -126
  31. package/build/markup/Markup.mjs.map +0 -1
  32. package/build/markup/constants.js +0 -36
  33. package/build/markup/constants.js.map +0 -1
  34. package/build/markup/constants.mjs +0 -29
  35. package/build/markup/constants.mjs.map +0 -1
  36. package/build/markup/utils/parseMarkup.js +0 -226
  37. package/build/markup/utils/parseMarkup.js.map +0 -1
  38. package/build/markup/utils/parseMarkup.mjs +0 -223
  39. package/build/markup/utils/parseMarkup.mjs.map +0 -1
  40. package/build/markup/utils/sanitise.js +0 -91
  41. package/build/markup/utils/sanitise.js.map +0 -1
  42. package/build/markup/utils/sanitise.mjs +0 -89
  43. package/build/markup/utils/sanitise.mjs.map +0 -1
  44. package/build/styles/markup/Markup.css +0 -28
  45. package/build/styles/markup/_stories/Vulnerability/Vulnerability.css +0 -70
  46. package/build/types/markup/Markup.d.ts +0 -4
  47. package/build/types/markup/Markup.d.ts.map +0 -1
  48. package/build/types/markup/Markup.types.d.ts +0 -63
  49. package/build/types/markup/Markup.types.d.ts.map +0 -1
  50. package/build/types/markup/_stories/Vulnerability/Vulnerability.d.ts +0 -12
  51. package/build/types/markup/_stories/Vulnerability/Vulnerability.d.ts.map +0 -1
  52. package/build/types/markup/constants.d.ts +0 -20
  53. package/build/types/markup/constants.d.ts.map +0 -1
  54. package/build/types/markup/index.d.ts +0 -3
  55. package/build/types/markup/index.d.ts.map +0 -1
  56. package/build/types/markup/utils/parseMarkup.d.ts +0 -6
  57. package/build/types/markup/utils/parseMarkup.d.ts.map +0 -1
  58. package/build/types/markup/utils/sanitise.d.ts +0 -2
  59. package/build/types/markup/utils/sanitise.d.ts.map +0 -1
  60. package/src/markup/Markup.css +0 -28
  61. package/src/markup/Markup.less +0 -29
  62. package/src/markup/Markup.test.tsx +0 -330
  63. package/src/markup/Markup.tsx +0 -144
  64. package/src/markup/Markup.types.ts +0 -48
  65. package/src/markup/_stories/Markup.docs.mdx +0 -75
  66. package/src/markup/_stories/Markup.security.docs.mdx +0 -256
  67. package/src/markup/_stories/Markup.story.tsx +0 -198
  68. package/src/markup/_stories/Vulnerability/Vulnerability.css +0 -70
  69. package/src/markup/_stories/Vulnerability/Vulnerability.tsx +0 -30
  70. package/src/markup/constants.ts +0 -41
  71. package/src/markup/index.ts +0 -2
  72. package/src/markup/utils/parseMarkup.test.ts +0 -658
  73. package/src/markup/utils/parseMarkup.ts +0 -228
  74. package/src/markup/utils/sanitise.test.ts +0 -375
  75. package/src/markup/utils/sanitise.ts +0 -107
@@ -1,223 +0,0 @@
1
- import { TAG_REGEX, MAX_NESTING_DEPTH, TAG_ALIASES, ALLOWED_TARGETS } from '../constants.mjs';
2
-
3
- const OBJECT_PROTOTYPE_KEYS = new Set(Object.getOwnPropertyNames(Object.prototype));
4
- // eslint-disable-next-line regexp/no-control-character
5
- const CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
6
- const HTML_METACHAR = /[<>"']/g;
7
- /**
8
- * Splits the input string into a flat list of tokens by scanning for known tags.
9
- * Text between tags is emitted as text/newline tokens. Unrecognised tags are never
10
- * tokenised — they remain part of the surrounding text content.
11
- */
12
- function tokenise(input) {
13
- const tokens = [];
14
- let lastIndex = 0;
15
- TAG_REGEX.lastIndex = 0;
16
- let match = TAG_REGEX.exec(input);
17
- while (match !== null) {
18
- if (match.index > lastIndex) {
19
- pushTextWithNewlines(tokens, input.slice(lastIndex, match.index));
20
- }
21
- const isClose = match[1] === '/';
22
- const tag = match[2];
23
- const attrs = match[3] || '';
24
- if (isClose) {
25
- tokens.push({
26
- type: 'close',
27
- tag
28
- });
29
- } else {
30
- tokens.push({
31
- type: 'open',
32
- tag,
33
- attrs
34
- });
35
- }
36
- lastIndex = TAG_REGEX.lastIndex;
37
- match = TAG_REGEX.exec(input);
38
- }
39
- if (lastIndex < input.length) {
40
- pushTextWithNewlines(tokens, input.slice(lastIndex));
41
- }
42
- return tokens;
43
- }
44
- /** Splits a text fragment on newline characters, interleaving newline tokens between parts. */
45
- function pushTextWithNewlines(tokens, text) {
46
- const parts = text.split('\n');
47
- for (let index = 0; index < parts.length; index += 1) {
48
- if (index > 0) {
49
- tokens.push({
50
- type: 'newline'
51
- });
52
- }
53
- if (parts[index]) {
54
- tokens.push({
55
- type: 'text',
56
- content: parts[index]
57
- });
58
- }
59
- }
60
- }
61
- /**
62
- * Recursive descent parser that consumes tokens and builds a MarkupNode tree.
63
- *
64
- * When `untilTag` is provided, the function collects nodes until it finds a matching
65
- * close token — returning `{ closed: true }`. If it exhausts all tokens without finding
66
- * the close, it returns `{ closed: false }` so the caller can fall back to plain text
67
- * (graceful degradation for malformed input).
68
- *
69
- * The shared `position` object acts as a cursor across recursive calls, avoiding the
70
- * need to slice or copy the token array.
71
- */
72
- function parse(tokens, position, untilTag, depth = 0) {
73
- const nodes = [];
74
- while (position.index < tokens.length) {
75
- const token = tokens[position.index];
76
- if (token.type === 'text') {
77
- nodes.push({
78
- type: 'text',
79
- content: token.content
80
- });
81
- position.index += 1;
82
- } else if (token.type === 'newline') {
83
- nodes.push({
84
- type: 'newline'
85
- });
86
- position.index += 1;
87
- } else if (token.type === 'close') {
88
- if (token.tag === untilTag) {
89
- position.index += 1;
90
- return {
91
- closed: true,
92
- nodes
93
- };
94
- }
95
- // Mismatched close tag — render as literal text
96
- nodes.push({
97
- type: 'text',
98
- content: `</${token.tag}>`
99
- });
100
- position.index += 1;
101
- } else if (token.type === 'open') {
102
- if (depth >= MAX_NESTING_DEPTH) {
103
- nodes.push({
104
- type: 'text',
105
- content: `<${token.tag}${token.attrs}>`
106
- });
107
- position.index += 1;
108
- } else {
109
- position.index += 1;
110
- const result = parse(tokens, position, token.tag, depth + 1);
111
- if (result.closed) {
112
- const node = buildNode(token.tag, token.attrs, result.nodes);
113
- nodes.push(node);
114
- } else {
115
- nodes.push({
116
- type: 'text',
117
- content: `<${token.tag}${token.attrs}>`
118
- });
119
- nodes.push(...result.nodes);
120
- }
121
- }
122
- }
123
- }
124
- if (untilTag) {
125
- return {
126
- closed: false,
127
- nodes
128
- };
129
- }
130
- return {
131
- closed: true,
132
- nodes
133
- };
134
- }
135
- /**
136
- * Maps a raw tag name to a typed MarkupNode. Resolves aliases first (p→paragraph, a→link),
137
- * then builds the appropriate node shape. Link nodes carry full attributes; other element
138
- * nodes extract only accessibilityLabel.
139
- */
140
- function buildNode(rawTag, attrs, children) {
141
- const tag = TAG_ALIASES[rawTag] || rawTag;
142
- if (tag === 'link') {
143
- return {
144
- type: 'link',
145
- children,
146
- ...parseAttributes(attrs)
147
- };
148
- }
149
- if (tag === 'paragraph') {
150
- return {
151
- type: 'paragraph',
152
- children
153
- };
154
- }
155
- const {
156
- accessibilityLabel
157
- } = parseAttributes(attrs);
158
- return {
159
- type: tag,
160
- children,
161
- ...(accessibilityLabel && {
162
- accessibilityLabel
163
- })
164
- };
165
- }
166
- const ATTR_REGEX = /(?<=\s)(href|action|target|accessibilityLabel)=(?:"([^"]*)"|'([^']*)')/g;
167
- /**
168
- * Extracts allowed attributes from a raw attribute string.
169
- * Supports both double- and single-quoted values. Any attribute not in the
170
- * allow-list (href, action, target, accessibilityLabel) is silently discarded.
171
- * First occurrence wins — duplicates are ignored.
172
- */
173
- function parseAttributes(attrs) {
174
- const result = {};
175
- ATTR_REGEX.lastIndex = 0;
176
- let match = ATTR_REGEX.exec(attrs);
177
- while (match !== null) {
178
- const key = match[1];
179
- const value = match[2] ?? match[3];
180
- if (!(key in result)) {
181
- const sanitized = sanitizeAttributeValue(key, value);
182
- if (sanitized !== undefined) {
183
- result[key] = sanitized;
184
- }
185
- }
186
- match = ATTR_REGEX.exec(attrs);
187
- }
188
- return result;
189
- }
190
- function sanitizeAttributeValue(key, value) {
191
- switch (key) {
192
- case 'href':
193
- return value.replace(CONTROL_CHARS, '');
194
- case 'action':
195
- if (OBJECT_PROTOTYPE_KEYS.has(value)) {
196
- return undefined;
197
- }
198
- return value;
199
- case 'target':
200
- if (!ALLOWED_TARGETS.includes(value)) {
201
- return undefined;
202
- }
203
- return value;
204
- case 'accessibilityLabel':
205
- return value.replace(HTML_METACHAR, '');
206
- default:
207
- return value;
208
- }
209
- }
210
- /** Entry point: tokenises the input string, then parses the token stream into a MarkupNode tree. */
211
- function parseMarkup(input) {
212
- if (!input) {
213
- return [];
214
- }
215
- const tokens = tokenise(input);
216
- const position = {
217
- index: 0
218
- };
219
- return parse(tokens, position).nodes;
220
- }
221
-
222
- export { MAX_NESTING_DEPTH, parseMarkup };
223
- //# sourceMappingURL=parseMarkup.mjs.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"parseMarkup.mjs","sources":["../../../src/markup/utils/parseMarkup.ts"],"sourcesContent":["import { ALLOWED_TARGETS, MAX_NESTING_DEPTH, TAG_ALIASES, TAG_REGEX } from '../constants';\nimport { MarkupNode } from '../Markup.types';\n\nexport { MAX_NESTING_DEPTH };\n\nconst OBJECT_PROTOTYPE_KEYS = new Set(Object.getOwnPropertyNames(Object.prototype));\n\n// eslint-disable-next-line regexp/no-control-character\nconst CONTROL_CHARS = /[\\x00-\\x1f\\x7f-\\x9f]/g;\nconst HTML_METACHAR = /[<>\"']/g;\n\ntype Token =\n | { type: 'text'; content: string }\n | { type: 'newline' }\n | { type: 'open'; tag: string; attrs: string }\n | { type: 'close'; tag: string };\n\n/**\n * Splits the input string into a flat list of tokens by scanning for known tags.\n * Text between tags is emitted as text/newline tokens. Unrecognised tags are never\n * tokenised — they remain part of the surrounding text content.\n */\nfunction tokenise(input: string): Token[] {\n const tokens: Token[] = [];\n let lastIndex = 0;\n\n TAG_REGEX.lastIndex = 0;\n let match = TAG_REGEX.exec(input);\n\n while (match !== null) {\n if (match.index > lastIndex) {\n pushTextWithNewlines(tokens, input.slice(lastIndex, match.index));\n }\n\n const isClose = match[1] === '/';\n const tag = match[2];\n const attrs = match[3] || '';\n\n if (isClose) {\n tokens.push({ type: 'close', tag });\n } else {\n tokens.push({ type: 'open', tag, attrs });\n }\n\n lastIndex = TAG_REGEX.lastIndex;\n match = TAG_REGEX.exec(input);\n }\n\n if (lastIndex < input.length) {\n pushTextWithNewlines(tokens, input.slice(lastIndex));\n }\n\n return tokens;\n}\n\n/** Splits a text fragment on newline characters, interleaving newline tokens between parts. */\nfunction pushTextWithNewlines(tokens: Token[], text: string): void {\n const parts = text.split('\\n');\n for (let index = 0; index < parts.length; index += 1) {\n if (index > 0) {\n tokens.push({ type: 'newline' });\n }\n if (parts[index]) {\n tokens.push({ type: 'text', content: parts[index] });\n }\n }\n}\n\ntype ParseResult = { closed: true; nodes: MarkupNode[] } | { closed: false; nodes: MarkupNode[] };\n\n/**\n * Recursive descent parser that consumes tokens and builds a MarkupNode tree.\n *\n * When `untilTag` is provided, the function collects nodes until it finds a matching\n * close token — returning `{ closed: true }`. If it exhausts all tokens without finding\n * the close, it returns `{ closed: false }` so the caller can fall back to plain text\n * (graceful degradation for malformed input).\n *\n * The shared `position` object acts as a cursor across recursive calls, avoiding the\n * need to slice or copy the token array.\n */\nfunction parse(\n tokens: Token[],\n position: { index: number },\n untilTag?: string,\n depth = 0,\n): ParseResult {\n const nodes: MarkupNode[] = [];\n\n while (position.index < tokens.length) {\n const token = tokens[position.index];\n\n if (token.type === 'text') {\n nodes.push({ type: 'text', content: token.content });\n position.index += 1;\n } else if (token.type === 'newline') {\n nodes.push({ type: 'newline' });\n position.index += 1;\n } else if (token.type === 'close') {\n if (token.tag === untilTag) {\n position.index += 1;\n return { closed: true, nodes };\n }\n // Mismatched close tag — render as literal text\n nodes.push({ type: 'text', content: `</${token.tag}>` });\n position.index += 1;\n } else if (token.type === 'open') {\n if (depth >= MAX_NESTING_DEPTH) {\n nodes.push({ type: 'text', content: `<${token.tag}${token.attrs}>` });\n position.index += 1;\n } else {\n position.index += 1;\n const result = parse(tokens, position, token.tag, depth + 1);\n\n if (result.closed) {\n const node = buildNode(token.tag, token.attrs, result.nodes);\n nodes.push(node);\n } else {\n nodes.push({ type: 'text', content: `<${token.tag}${token.attrs}>` });\n nodes.push(...result.nodes);\n }\n }\n }\n }\n\n if (untilTag) {\n return { closed: false, nodes };\n }\n\n return { closed: true, nodes };\n}\n\n/**\n * Maps a raw tag name to a typed MarkupNode. Resolves aliases first (p→paragraph, a→link),\n * then builds the appropriate node shape. Link nodes carry full attributes; other element\n * nodes extract only accessibilityLabel.\n */\nfunction buildNode(rawTag: string, attrs: string, children: MarkupNode[]): MarkupNode {\n const tag = TAG_ALIASES[rawTag] || rawTag;\n\n if (tag === 'link') {\n return { type: 'link', children, ...parseAttributes(attrs) };\n }\n\n if (tag === 'paragraph') {\n return { type: 'paragraph', children };\n }\n\n const { accessibilityLabel } = parseAttributes(attrs);\n\n return {\n type: tag as MarkupNode['type'],\n children,\n ...(accessibilityLabel && { accessibilityLabel }),\n } as MarkupNode;\n}\n\nconst ATTR_REGEX = /(?<=\\s)(href|action|target|accessibilityLabel)=(?:\"([^\"]*)\"|'([^']*)')/g;\n\ntype ParsedAttributes = {\n href?: string;\n action?: string;\n target?: string;\n accessibilityLabel?: string;\n};\n\n/**\n * Extracts allowed attributes from a raw attribute string.\n * Supports both double- and single-quoted values. Any attribute not in the\n * allow-list (href, action, target, accessibilityLabel) is silently discarded.\n * First occurrence wins — duplicates are ignored.\n */\nfunction parseAttributes(attrs: string): ParsedAttributes {\n const result: ParsedAttributes = {};\n ATTR_REGEX.lastIndex = 0;\n let match = ATTR_REGEX.exec(attrs);\n\n while (match !== null) {\n const key = match[1] as 'href' | 'action' | 'target' | 'accessibilityLabel';\n const value = match[2] ?? match[3];\n\n if (!(key in result)) {\n const sanitized = sanitizeAttributeValue(key, value);\n if (sanitized !== undefined) {\n result[key] = sanitized;\n }\n }\n\n match = ATTR_REGEX.exec(attrs);\n }\n\n return result;\n}\n\nfunction sanitizeAttributeValue(\n key: 'href' | 'action' | 'target' | 'accessibilityLabel',\n value: string,\n): string | undefined {\n switch (key) {\n case 'href':\n return value.replace(CONTROL_CHARS, '');\n case 'action':\n if (OBJECT_PROTOTYPE_KEYS.has(value)) {\n return undefined;\n }\n return value;\n case 'target':\n if (!ALLOWED_TARGETS.includes(value)) {\n return undefined;\n }\n return value;\n case 'accessibilityLabel':\n return value.replace(HTML_METACHAR, '');\n default:\n return value;\n }\n}\n\n/** Entry point: tokenises the input string, then parses the token stream into a MarkupNode tree. */\nexport function parseMarkup(input: string): MarkupNode[] {\n if (!input) {\n return [];\n }\n\n const tokens = tokenise(input);\n const position = { index: 0 };\n return parse(tokens, position).nodes;\n}\n"],"names":["OBJECT_PROTOTYPE_KEYS","Set","Object","getOwnPropertyNames","prototype","CONTROL_CHARS","HTML_METACHAR","tokenise","input","tokens","lastIndex","TAG_REGEX","match","exec","index","pushTextWithNewlines","slice","isClose","tag","attrs","push","type","length","text","parts","split","content","parse","position","untilTag","depth","nodes","token","closed","MAX_NESTING_DEPTH","result","node","buildNode","rawTag","children","TAG_ALIASES","parseAttributes","accessibilityLabel","ATTR_REGEX","key","value","sanitized","sanitizeAttributeValue","undefined","replace","has","ALLOWED_TARGETS","includes","parseMarkup"],"mappings":";;AAKA,MAAMA,qBAAqB,GAAG,IAAIC,GAAG,CAACC,MAAM,CAACC,mBAAmB,CAACD,MAAM,CAACE,SAAS,CAAC,CAAC;AAEnF;AACA,MAAMC,aAAa,GAAG,uBAAuB;AAC7C,MAAMC,aAAa,GAAG,SAAS;AAQ/B;;;;AAIG;AACH,SAASC,QAAQA,CAACC,KAAa,EAAA;EAC7B,MAAMC,MAAM,GAAY,EAAE;EAC1B,IAAIC,SAAS,GAAG,CAAC;EAEjBC,SAAS,CAACD,SAAS,GAAG,CAAC;AACvB,EAAA,IAAIE,KAAK,GAAGD,SAAS,CAACE,IAAI,CAACL,KAAK,CAAC;EAEjC,OAAOI,KAAK,KAAK,IAAI,EAAE;AACrB,IAAA,IAAIA,KAAK,CAACE,KAAK,GAAGJ,SAAS,EAAE;AAC3BK,MAAAA,oBAAoB,CAACN,MAAM,EAAED,KAAK,CAACQ,KAAK,CAACN,SAAS,EAAEE,KAAK,CAACE,KAAK,CAAC,CAAC;AACnE,IAAA;AAEA,IAAA,MAAMG,OAAO,GAAGL,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;AAChC,IAAA,MAAMM,GAAG,GAAGN,KAAK,CAAC,CAAC,CAAC;AACpB,IAAA,MAAMO,KAAK,GAAGP,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;AAE5B,IAAA,IAAIK,OAAO,EAAE;MACXR,MAAM,CAACW,IAAI,CAAC;AAAEC,QAAAA,IAAI,EAAE,OAAO;AAAEH,QAAAA;AAAG,OAAE,CAAC;AACrC,IAAA,CAAC,MAAM;MACLT,MAAM,CAACW,IAAI,CAAC;AAAEC,QAAAA,IAAI,EAAE,MAAM;QAAEH,GAAG;AAAEC,QAAAA;AAAK,OAAE,CAAC;AAC3C,IAAA;IAEAT,SAAS,GAAGC,SAAS,CAACD,SAAS;AAC/BE,IAAAA,KAAK,GAAGD,SAAS,CAACE,IAAI,CAACL,KAAK,CAAC;AAC/B,EAAA;AAEA,EAAA,IAAIE,SAAS,GAAGF,KAAK,CAACc,MAAM,EAAE;IAC5BP,oBAAoB,CAACN,MAAM,EAAED,KAAK,CAACQ,KAAK,CAACN,SAAS,CAAC,CAAC;AACtD,EAAA;AAEA,EAAA,OAAOD,MAAM;AACf;AAEA;AACA,SAASM,oBAAoBA,CAACN,MAAe,EAAEc,IAAY,EAAA;AACzD,EAAA,MAAMC,KAAK,GAAGD,IAAI,CAACE,KAAK,CAAC,IAAI,CAAC;AAC9B,EAAA,KAAK,IAAIX,KAAK,GAAG,CAAC,EAAEA,KAAK,GAAGU,KAAK,CAACF,MAAM,EAAER,KAAK,IAAI,CAAC,EAAE;IACpD,IAAIA,KAAK,GAAG,CAAC,EAAE;MACbL,MAAM,CAACW,IAAI,CAAC;AAAEC,QAAAA,IAAI,EAAE;AAAS,OAAE,CAAC;AAClC,IAAA;AACA,IAAA,IAAIG,KAAK,CAACV,KAAK,CAAC,EAAE;MAChBL,MAAM,CAACW,IAAI,CAAC;AAAEC,QAAAA,IAAI,EAAE,MAAM;QAAEK,OAAO,EAAEF,KAAK,CAACV,KAAK;AAAC,OAAE,CAAC;AACtD,IAAA;AACF,EAAA;AACF;AAIA;;;;;;;;;;AAUG;AACH,SAASa,KAAKA,CACZlB,MAAe,EACfmB,QAA2B,EAC3BC,QAAiB,EACjBC,KAAK,GAAG,CAAC,EAAA;EAET,MAAMC,KAAK,GAAiB,EAAE;AAE9B,EAAA,OAAOH,QAAQ,CAACd,KAAK,GAAGL,MAAM,CAACa,MAAM,EAAE;AACrC,IAAA,MAAMU,KAAK,GAAGvB,MAAM,CAACmB,QAAQ,CAACd,KAAK,CAAC;AAEpC,IAAA,IAAIkB,KAAK,CAACX,IAAI,KAAK,MAAM,EAAE;MACzBU,KAAK,CAACX,IAAI,CAAC;AAAEC,QAAAA,IAAI,EAAE,MAAM;QAAEK,OAAO,EAAEM,KAAK,CAACN;AAAO,OAAE,CAAC;MACpDE,QAAQ,CAACd,KAAK,IAAI,CAAC;AACrB,IAAA,CAAC,MAAM,IAAIkB,KAAK,CAACX,IAAI,KAAK,SAAS,EAAE;MACnCU,KAAK,CAACX,IAAI,CAAC;AAAEC,QAAAA,IAAI,EAAE;AAAS,OAAE,CAAC;MAC/BO,QAAQ,CAACd,KAAK,IAAI,CAAC;AACrB,IAAA,CAAC,MAAM,IAAIkB,KAAK,CAACX,IAAI,KAAK,OAAO,EAAE;AACjC,MAAA,IAAIW,KAAK,CAACd,GAAG,KAAKW,QAAQ,EAAE;QAC1BD,QAAQ,CAACd,KAAK,IAAI,CAAC;QACnB,OAAO;AAAEmB,UAAAA,MAAM,EAAE,IAAI;AAAEF,UAAAA;SAAO;AAChC,MAAA;AACA;MACAA,KAAK,CAACX,IAAI,CAAC;AAAEC,QAAAA,IAAI,EAAE,MAAM;AAAEK,QAAAA,OAAO,EAAE,CAAA,EAAA,EAAKM,KAAK,CAACd,GAAG,CAAA,CAAA;AAAG,OAAE,CAAC;MACxDU,QAAQ,CAACd,KAAK,IAAI,CAAC;AACrB,IAAA,CAAC,MAAM,IAAIkB,KAAK,CAACX,IAAI,KAAK,MAAM,EAAE;MAChC,IAAIS,KAAK,IAAII,iBAAiB,EAAE;QAC9BH,KAAK,CAACX,IAAI,CAAC;AAAEC,UAAAA,IAAI,EAAE,MAAM;UAAEK,OAAO,EAAE,IAAIM,KAAK,CAACd,GAAG,CAAA,EAAGc,KAAK,CAACb,KAAK,CAAA,CAAA;AAAG,SAAE,CAAC;QACrES,QAAQ,CAACd,KAAK,IAAI,CAAC;AACrB,MAAA,CAAC,MAAM;QACLc,QAAQ,CAACd,KAAK,IAAI,CAAC;AACnB,QAAA,MAAMqB,MAAM,GAAGR,KAAK,CAAClB,MAAM,EAAEmB,QAAQ,EAAEI,KAAK,CAACd,GAAG,EAAEY,KAAK,GAAG,CAAC,CAAC;QAE5D,IAAIK,MAAM,CAACF,MAAM,EAAE;AACjB,UAAA,MAAMG,IAAI,GAAGC,SAAS,CAACL,KAAK,CAACd,GAAG,EAAEc,KAAK,CAACb,KAAK,EAAEgB,MAAM,CAACJ,KAAK,CAAC;AAC5DA,UAAAA,KAAK,CAACX,IAAI,CAACgB,IAAI,CAAC;AAClB,QAAA,CAAC,MAAM;UACLL,KAAK,CAACX,IAAI,CAAC;AAAEC,YAAAA,IAAI,EAAE,MAAM;YAAEK,OAAO,EAAE,IAAIM,KAAK,CAACd,GAAG,CAAA,EAAGc,KAAK,CAACb,KAAK,CAAA,CAAA;AAAG,WAAE,CAAC;AACrEY,UAAAA,KAAK,CAACX,IAAI,CAAC,GAAGe,MAAM,CAACJ,KAAK,CAAC;AAC7B,QAAA;AACF,MAAA;AACF,IAAA;AACF,EAAA;AAEA,EAAA,IAAIF,QAAQ,EAAE;IACZ,OAAO;AAAEI,MAAAA,MAAM,EAAE,KAAK;AAAEF,MAAAA;KAAO;AACjC,EAAA;EAEA,OAAO;AAAEE,IAAAA,MAAM,EAAE,IAAI;AAAEF,IAAAA;GAAO;AAChC;AAEA;;;;AAIG;AACH,SAASM,SAASA,CAACC,MAAc,EAAEnB,KAAa,EAAEoB,QAAsB,EAAA;AACtE,EAAA,MAAMrB,GAAG,GAAGsB,WAAW,CAACF,MAAM,CAAC,IAAIA,MAAM;EAEzC,IAAIpB,GAAG,KAAK,MAAM,EAAE;IAClB,OAAO;AAAEG,MAAAA,IAAI,EAAE,MAAM;MAAEkB,QAAQ;MAAE,GAAGE,eAAe,CAACtB,KAAK;KAAG;AAC9D,EAAA;EAEA,IAAID,GAAG,KAAK,WAAW,EAAE;IACvB,OAAO;AAAEG,MAAAA,IAAI,EAAE,WAAW;AAAEkB,MAAAA;KAAU;AACxC,EAAA;EAEA,MAAM;AAAEG,IAAAA;AAAkB,GAAE,GAAGD,eAAe,CAACtB,KAAK,CAAC;EAErD,OAAO;AACLE,IAAAA,IAAI,EAAEH,GAAyB;IAC/BqB,QAAQ;AACR,IAAA,IAAIG,kBAAkB,IAAI;AAAEA,MAAAA;KAAoB;GACnC;AACjB;AAEA,MAAMC,UAAU,GAAG,yEAAyE;AAS5F;;;;;AAKG;AACH,SAASF,eAAeA,CAACtB,KAAa,EAAA;EACpC,MAAMgB,MAAM,GAAqB,EAAE;EACnCQ,UAAU,CAACjC,SAAS,GAAG,CAAC;AACxB,EAAA,IAAIE,KAAK,GAAG+B,UAAU,CAAC9B,IAAI,CAACM,KAAK,CAAC;EAElC,OAAOP,KAAK,KAAK,IAAI,EAAE;AACrB,IAAA,MAAMgC,GAAG,GAAGhC,KAAK,CAAC,CAAC,CAAwD;IAC3E,MAAMiC,KAAK,GAAGjC,KAAK,CAAC,CAAC,CAAC,IAAIA,KAAK,CAAC,CAAC,CAAC;AAElC,IAAA,IAAI,EAAEgC,GAAG,IAAIT,MAAM,CAAC,EAAE;AACpB,MAAA,MAAMW,SAAS,GAAGC,sBAAsB,CAACH,GAAG,EAAEC,KAAK,CAAC;MACpD,IAAIC,SAAS,KAAKE,SAAS,EAAE;AAC3Bb,QAAAA,MAAM,CAACS,GAAG,CAAC,GAAGE,SAAS;AACzB,MAAA;AACF,IAAA;AAEAlC,IAAAA,KAAK,GAAG+B,UAAU,CAAC9B,IAAI,CAACM,KAAK,CAAC;AAChC,EAAA;AAEA,EAAA,OAAOgB,MAAM;AACf;AAEA,SAASY,sBAAsBA,CAC7BH,GAAwD,EACxDC,KAAa,EAAA;AAEb,EAAA,QAAQD,GAAG;AACT,IAAA,KAAK,MAAM;AACT,MAAA,OAAOC,KAAK,CAACI,OAAO,CAAC5C,aAAa,EAAE,EAAE,CAAC;AACzC,IAAA,KAAK,QAAQ;AACX,MAAA,IAAIL,qBAAqB,CAACkD,GAAG,CAACL,KAAK,CAAC,EAAE;AACpC,QAAA,OAAOG,SAAS;AAClB,MAAA;AACA,MAAA,OAAOH,KAAK;AACd,IAAA,KAAK,QAAQ;AACX,MAAA,IAAI,CAACM,eAAe,CAACC,QAAQ,CAACP,KAAK,CAAC,EAAE;AACpC,QAAA,OAAOG,SAAS;AAClB,MAAA;AACA,MAAA,OAAOH,KAAK;AACd,IAAA,KAAK,oBAAoB;AACvB,MAAA,OAAOA,KAAK,CAACI,OAAO,CAAC3C,aAAa,EAAE,EAAE,CAAC;AACzC,IAAA;AACE,MAAA,OAAOuC,KAAK;AAChB;AACF;AAEA;AACM,SAAUQ,WAAWA,CAAC7C,KAAa,EAAA;EACvC,IAAI,CAACA,KAAK,EAAE;AACV,IAAA,OAAO,EAAE;AACX,EAAA;AAEA,EAAA,MAAMC,MAAM,GAAGF,QAAQ,CAACC,KAAK,CAAC;AAC9B,EAAA,MAAMoB,QAAQ,GAAG;AAAEd,IAAAA,KAAK,EAAE;GAAG;AAC7B,EAAA,OAAOa,KAAK,CAAClB,MAAM,EAAEmB,QAAQ,CAAC,CAACG,KAAK;AACtC;;;;"}
@@ -1,91 +0,0 @@
1
- 'use strict';
2
-
3
- var constants = require('../constants.js');
4
-
5
- const INVISIBLE_CHARS = /[\u200b\u200c\u200d\ufeff\u00ad\u2060\u180e]/g;
6
- // eslint-disable-next-line regexp/no-control-character
7
- const CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f]/;
8
- const DANGEROUS_HTML_CHARS = /[<>"']/;
9
- const DANGEROUS_SCHEME = /^(?:javascript|vbscript|data|jscript)\s*:/i;
10
- // eslint-disable-next-line regexp/no-useless-non-capturing-group
11
- const ENCODED_COLON_SCHEME = /^(?:javascript|vbscript|data|jscript)(?:%3a)/i;
12
- const IPV6_BRACKETS = /^\[|\]$/g;
13
- const NUMERIC_IP = /^[\d.]+$/;
14
- const HEX_IP = /^0x[0-9a-f]+$/i;
15
- function isAllowedHref(href) {
16
- const cleaned = href.replace(INVISIBLE_CHARS, '');
17
- const trimmed = cleaned.trim();
18
- if (!trimmed) {
19
- return false;
20
- }
21
- if (CONTROL_CHARS.test(trimmed)) {
22
- return false;
23
- }
24
- if (DANGEROUS_HTML_CHARS.test(trimmed)) {
25
- return false;
26
- }
27
- if (DANGEROUS_SCHEME.test(trimmed)) {
28
- return false;
29
- }
30
- if (ENCODED_COLON_SCHEME.test(trimmed)) {
31
- return false;
32
- }
33
- if (trimmed.startsWith('//')) {
34
- return false;
35
- }
36
- if (trimmed.startsWith('\\')) {
37
- return false;
38
- }
39
- if (trimmed.startsWith('/')) {
40
- return trimmed[1] !== '\\';
41
- }
42
- if (trimmed.startsWith('#')) {
43
- return true;
44
- }
45
- if (trimmed.startsWith('./') || trimmed.startsWith('../')) {
46
- return false;
47
- }
48
- try {
49
- const url = new URL(trimmed);
50
- if (!constants.ALLOWED_PROTOCOLS.includes(url.protocol)) {
51
- return false;
52
- }
53
- if (url.protocol === 'https:') {
54
- if (!trimmed.startsWith('https://')) {
55
- return false;
56
- }
57
- if (!url.hostname) {
58
- return false;
59
- }
60
- if (url.username || url.password) {
61
- return false;
62
- }
63
- if (isInternalHost(url.hostname)) {
64
- return false;
65
- }
66
- }
67
- if (url.protocol === 'mailto:') {
68
- if (url.search) {
69
- return false;
70
- }
71
- if (!url.pathname) {
72
- return false;
73
- }
74
- }
75
- return true;
76
- } catch {
77
- return false;
78
- }
79
- }
80
- function isInternalHost(hostname) {
81
- const host = hostname.replace(IPV6_BRACKETS, '');
82
- if (NUMERIC_IP.test(host)) return true;
83
- if (HEX_IP.test(host)) return true;
84
- if (host === '::1') return true;
85
- if (host === 'localhost') return true;
86
- if (host.endsWith('.internal')) return true;
87
- return false;
88
- }
89
-
90
- exports.isAllowedHref = isAllowedHref;
91
- //# sourceMappingURL=sanitise.js.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"sanitise.js","sources":["../../../src/markup/utils/sanitise.ts"],"sourcesContent":["import { ALLOWED_PROTOCOLS } from '../constants';\n\nconst INVISIBLE_CHARS = /[\\u200b\\u200c\\u200d\\ufeff\\u00ad\\u2060\\u180e]/g;\n// eslint-disable-next-line regexp/no-control-character\nconst CONTROL_CHARS = /[\\u0000-\\u001f\\u007f-\\u009f]/;\nconst DANGEROUS_HTML_CHARS = /[<>\"']/;\nconst DANGEROUS_SCHEME = /^(?:javascript|vbscript|data|jscript)\\s*:/i;\n// eslint-disable-next-line regexp/no-useless-non-capturing-group\nconst ENCODED_COLON_SCHEME = /^(?:javascript|vbscript|data|jscript)(?:%3a)/i;\nconst IPV6_BRACKETS = /^\\[|\\]$/g;\nconst NUMERIC_IP = /^[\\d.]+$/;\nconst HEX_IP = /^0x[0-9a-f]+$/i;\n\nexport function isAllowedHref(href: string): boolean {\n const cleaned = href.replace(INVISIBLE_CHARS, '');\n const trimmed = cleaned.trim();\n\n if (!trimmed) {\n return false;\n }\n\n if (CONTROL_CHARS.test(trimmed)) {\n return false;\n }\n\n if (DANGEROUS_HTML_CHARS.test(trimmed)) {\n return false;\n }\n\n if (DANGEROUS_SCHEME.test(trimmed)) {\n return false;\n }\n\n if (ENCODED_COLON_SCHEME.test(trimmed)) {\n return false;\n }\n\n if (trimmed.startsWith('//')) {\n return false;\n }\n\n if (trimmed.startsWith('\\\\')) {\n return false;\n }\n\n if (trimmed.startsWith('/')) {\n return trimmed[1] !== '\\\\';\n }\n\n if (trimmed.startsWith('#')) {\n return true;\n }\n\n if (trimmed.startsWith('./') || trimmed.startsWith('../')) {\n return false;\n }\n\n try {\n const url = new URL(trimmed);\n\n if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {\n return false;\n }\n\n if (url.protocol === 'https:') {\n if (!trimmed.startsWith('https://')) {\n return false;\n }\n\n if (!url.hostname) {\n return false;\n }\n\n if (url.username || url.password) {\n return false;\n }\n\n if (isInternalHost(url.hostname)) {\n return false;\n }\n }\n\n if (url.protocol === 'mailto:') {\n if (url.search) {\n return false;\n }\n\n if (!url.pathname) {\n return false;\n }\n }\n\n return true;\n } catch {\n return false;\n }\n}\n\nfunction isInternalHost(hostname: string): boolean {\n const host = hostname.replace(IPV6_BRACKETS, '');\n if (NUMERIC_IP.test(host)) return true;\n if (HEX_IP.test(host)) return true;\n if (host === '::1') return true;\n if (host === 'localhost') return true;\n if (host.endsWith('.internal')) return true;\n return false;\n}\n"],"names":["INVISIBLE_CHARS","CONTROL_CHARS","DANGEROUS_HTML_CHARS","DANGEROUS_SCHEME","ENCODED_COLON_SCHEME","IPV6_BRACKETS","NUMERIC_IP","HEX_IP","isAllowedHref","href","cleaned","replace","trimmed","trim","test","startsWith","url","URL","ALLOWED_PROTOCOLS","includes","protocol","hostname","username","password","isInternalHost","search","pathname","host","endsWith"],"mappings":";;;;AAEA,MAAMA,eAAe,GAAG,+CAA+C;AACvE;AACA,MAAMC,aAAa,GAAG,8BAA8B;AACpD,MAAMC,oBAAoB,GAAG,QAAQ;AACrC,MAAMC,gBAAgB,GAAG,4CAA4C;AACrE;AACA,MAAMC,oBAAoB,GAAG,+CAA+C;AAC5E,MAAMC,aAAa,GAAG,UAAU;AAChC,MAAMC,UAAU,GAAG,UAAU;AAC7B,MAAMC,MAAM,GAAG,gBAAgB;AAEzB,SAAUC,aAAaA,CAACC,IAAY,EAAA;EACxC,MAAMC,OAAO,GAAGD,IAAI,CAACE,OAAO,CAACX,eAAe,EAAE,EAAE,CAAC;AACjD,EAAA,MAAMY,OAAO,GAAGF,OAAO,CAACG,IAAI,EAAE;EAE9B,IAAI,CAACD,OAAO,EAAE;AACZ,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIX,aAAa,CAACa,IAAI,CAACF,OAAO,CAAC,EAAE;AAC/B,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIV,oBAAoB,CAACY,IAAI,CAACF,OAAO,CAAC,EAAE;AACtC,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIT,gBAAgB,CAACW,IAAI,CAACF,OAAO,CAAC,EAAE;AAClC,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIR,oBAAoB,CAACU,IAAI,CAACF,OAAO,CAAC,EAAE;AACtC,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIA,OAAO,CAACG,UAAU,CAAC,IAAI,CAAC,EAAE;AAC5B,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIH,OAAO,CAACG,UAAU,CAAC,IAAI,CAAC,EAAE;AAC5B,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIH,OAAO,CAACG,UAAU,CAAC,GAAG,CAAC,EAAE;AAC3B,IAAA,OAAOH,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;AAC5B,EAAA;AAEA,EAAA,IAAIA,OAAO,CAACG,UAAU,CAAC,GAAG,CAAC,EAAE;AAC3B,IAAA,OAAO,IAAI;AACb,EAAA;AAEA,EAAA,IAAIH,OAAO,CAACG,UAAU,CAAC,IAAI,CAAC,IAAIH,OAAO,CAACG,UAAU,CAAC,KAAK,CAAC,EAAE;AACzD,IAAA,OAAO,KAAK;AACd,EAAA;EAEA,IAAI;AACF,IAAA,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAACL,OAAO,CAAC;IAE5B,IAAI,CAACM,2BAAiB,CAACC,QAAQ,CAACH,GAAG,CAACI,QAAQ,CAAC,EAAE;AAC7C,MAAA,OAAO,KAAK;AACd,IAAA;AAEA,IAAA,IAAIJ,GAAG,CAACI,QAAQ,KAAK,QAAQ,EAAE;AAC7B,MAAA,IAAI,CAACR,OAAO,CAACG,UAAU,CAAC,UAAU,CAAC,EAAE;AACnC,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAI,CAACC,GAAG,CAACK,QAAQ,EAAE;AACjB,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAIL,GAAG,CAACM,QAAQ,IAAIN,GAAG,CAACO,QAAQ,EAAE;AAChC,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAIC,cAAc,CAACR,GAAG,CAACK,QAAQ,CAAC,EAAE;AAChC,QAAA,OAAO,KAAK;AACd,MAAA;AACF,IAAA;AAEA,IAAA,IAAIL,GAAG,CAACI,QAAQ,KAAK,SAAS,EAAE;MAC9B,IAAIJ,GAAG,CAACS,MAAM,EAAE;AACd,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAI,CAACT,GAAG,CAACU,QAAQ,EAAE;AACjB,QAAA,OAAO,KAAK;AACd,MAAA;AACF,IAAA;AAEA,IAAA,OAAO,IAAI;AACb,EAAA,CAAC,CAAC,MAAM;AACN,IAAA,OAAO,KAAK;AACd,EAAA;AACF;AAEA,SAASF,cAAcA,CAACH,QAAgB,EAAA;EACtC,MAAMM,IAAI,GAAGN,QAAQ,CAACV,OAAO,CAACN,aAAa,EAAE,EAAE,CAAC;EAChD,IAAIC,UAAU,CAACQ,IAAI,CAACa,IAAI,CAAC,EAAE,OAAO,IAAI;EACtC,IAAIpB,MAAM,CAACO,IAAI,CAACa,IAAI,CAAC,EAAE,OAAO,IAAI;AAClC,EAAA,IAAIA,IAAI,KAAK,KAAK,EAAE,OAAO,IAAI;AAC/B,EAAA,IAAIA,IAAI,KAAK,WAAW,EAAE,OAAO,IAAI;EACrC,IAAIA,IAAI,CAACC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,IAAI;AAC3C,EAAA,OAAO,KAAK;AACd;;;;"}
@@ -1,89 +0,0 @@
1
- import { ALLOWED_PROTOCOLS } from '../constants.mjs';
2
-
3
- const INVISIBLE_CHARS = /[\u200b\u200c\u200d\ufeff\u00ad\u2060\u180e]/g;
4
- // eslint-disable-next-line regexp/no-control-character
5
- const CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f]/;
6
- const DANGEROUS_HTML_CHARS = /[<>"']/;
7
- const DANGEROUS_SCHEME = /^(?:javascript|vbscript|data|jscript)\s*:/i;
8
- // eslint-disable-next-line regexp/no-useless-non-capturing-group
9
- const ENCODED_COLON_SCHEME = /^(?:javascript|vbscript|data|jscript)(?:%3a)/i;
10
- const IPV6_BRACKETS = /^\[|\]$/g;
11
- const NUMERIC_IP = /^[\d.]+$/;
12
- const HEX_IP = /^0x[0-9a-f]+$/i;
13
- function isAllowedHref(href) {
14
- const cleaned = href.replace(INVISIBLE_CHARS, '');
15
- const trimmed = cleaned.trim();
16
- if (!trimmed) {
17
- return false;
18
- }
19
- if (CONTROL_CHARS.test(trimmed)) {
20
- return false;
21
- }
22
- if (DANGEROUS_HTML_CHARS.test(trimmed)) {
23
- return false;
24
- }
25
- if (DANGEROUS_SCHEME.test(trimmed)) {
26
- return false;
27
- }
28
- if (ENCODED_COLON_SCHEME.test(trimmed)) {
29
- return false;
30
- }
31
- if (trimmed.startsWith('//')) {
32
- return false;
33
- }
34
- if (trimmed.startsWith('\\')) {
35
- return false;
36
- }
37
- if (trimmed.startsWith('/')) {
38
- return trimmed[1] !== '\\';
39
- }
40
- if (trimmed.startsWith('#')) {
41
- return true;
42
- }
43
- if (trimmed.startsWith('./') || trimmed.startsWith('../')) {
44
- return false;
45
- }
46
- try {
47
- const url = new URL(trimmed);
48
- if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {
49
- return false;
50
- }
51
- if (url.protocol === 'https:') {
52
- if (!trimmed.startsWith('https://')) {
53
- return false;
54
- }
55
- if (!url.hostname) {
56
- return false;
57
- }
58
- if (url.username || url.password) {
59
- return false;
60
- }
61
- if (isInternalHost(url.hostname)) {
62
- return false;
63
- }
64
- }
65
- if (url.protocol === 'mailto:') {
66
- if (url.search) {
67
- return false;
68
- }
69
- if (!url.pathname) {
70
- return false;
71
- }
72
- }
73
- return true;
74
- } catch {
75
- return false;
76
- }
77
- }
78
- function isInternalHost(hostname) {
79
- const host = hostname.replace(IPV6_BRACKETS, '');
80
- if (NUMERIC_IP.test(host)) return true;
81
- if (HEX_IP.test(host)) return true;
82
- if (host === '::1') return true;
83
- if (host === 'localhost') return true;
84
- if (host.endsWith('.internal')) return true;
85
- return false;
86
- }
87
-
88
- export { isAllowedHref };
89
- //# sourceMappingURL=sanitise.mjs.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"sanitise.mjs","sources":["../../../src/markup/utils/sanitise.ts"],"sourcesContent":["import { ALLOWED_PROTOCOLS } from '../constants';\n\nconst INVISIBLE_CHARS = /[\\u200b\\u200c\\u200d\\ufeff\\u00ad\\u2060\\u180e]/g;\n// eslint-disable-next-line regexp/no-control-character\nconst CONTROL_CHARS = /[\\u0000-\\u001f\\u007f-\\u009f]/;\nconst DANGEROUS_HTML_CHARS = /[<>\"']/;\nconst DANGEROUS_SCHEME = /^(?:javascript|vbscript|data|jscript)\\s*:/i;\n// eslint-disable-next-line regexp/no-useless-non-capturing-group\nconst ENCODED_COLON_SCHEME = /^(?:javascript|vbscript|data|jscript)(?:%3a)/i;\nconst IPV6_BRACKETS = /^\\[|\\]$/g;\nconst NUMERIC_IP = /^[\\d.]+$/;\nconst HEX_IP = /^0x[0-9a-f]+$/i;\n\nexport function isAllowedHref(href: string): boolean {\n const cleaned = href.replace(INVISIBLE_CHARS, '');\n const trimmed = cleaned.trim();\n\n if (!trimmed) {\n return false;\n }\n\n if (CONTROL_CHARS.test(trimmed)) {\n return false;\n }\n\n if (DANGEROUS_HTML_CHARS.test(trimmed)) {\n return false;\n }\n\n if (DANGEROUS_SCHEME.test(trimmed)) {\n return false;\n }\n\n if (ENCODED_COLON_SCHEME.test(trimmed)) {\n return false;\n }\n\n if (trimmed.startsWith('//')) {\n return false;\n }\n\n if (trimmed.startsWith('\\\\')) {\n return false;\n }\n\n if (trimmed.startsWith('/')) {\n return trimmed[1] !== '\\\\';\n }\n\n if (trimmed.startsWith('#')) {\n return true;\n }\n\n if (trimmed.startsWith('./') || trimmed.startsWith('../')) {\n return false;\n }\n\n try {\n const url = new URL(trimmed);\n\n if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {\n return false;\n }\n\n if (url.protocol === 'https:') {\n if (!trimmed.startsWith('https://')) {\n return false;\n }\n\n if (!url.hostname) {\n return false;\n }\n\n if (url.username || url.password) {\n return false;\n }\n\n if (isInternalHost(url.hostname)) {\n return false;\n }\n }\n\n if (url.protocol === 'mailto:') {\n if (url.search) {\n return false;\n }\n\n if (!url.pathname) {\n return false;\n }\n }\n\n return true;\n } catch {\n return false;\n }\n}\n\nfunction isInternalHost(hostname: string): boolean {\n const host = hostname.replace(IPV6_BRACKETS, '');\n if (NUMERIC_IP.test(host)) return true;\n if (HEX_IP.test(host)) return true;\n if (host === '::1') return true;\n if (host === 'localhost') return true;\n if (host.endsWith('.internal')) return true;\n return false;\n}\n"],"names":["INVISIBLE_CHARS","CONTROL_CHARS","DANGEROUS_HTML_CHARS","DANGEROUS_SCHEME","ENCODED_COLON_SCHEME","IPV6_BRACKETS","NUMERIC_IP","HEX_IP","isAllowedHref","href","cleaned","replace","trimmed","trim","test","startsWith","url","URL","ALLOWED_PROTOCOLS","includes","protocol","hostname","username","password","isInternalHost","search","pathname","host","endsWith"],"mappings":";;AAEA,MAAMA,eAAe,GAAG,+CAA+C;AACvE;AACA,MAAMC,aAAa,GAAG,8BAA8B;AACpD,MAAMC,oBAAoB,GAAG,QAAQ;AACrC,MAAMC,gBAAgB,GAAG,4CAA4C;AACrE;AACA,MAAMC,oBAAoB,GAAG,+CAA+C;AAC5E,MAAMC,aAAa,GAAG,UAAU;AAChC,MAAMC,UAAU,GAAG,UAAU;AAC7B,MAAMC,MAAM,GAAG,gBAAgB;AAEzB,SAAUC,aAAaA,CAACC,IAAY,EAAA;EACxC,MAAMC,OAAO,GAAGD,IAAI,CAACE,OAAO,CAACX,eAAe,EAAE,EAAE,CAAC;AACjD,EAAA,MAAMY,OAAO,GAAGF,OAAO,CAACG,IAAI,EAAE;EAE9B,IAAI,CAACD,OAAO,EAAE;AACZ,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIX,aAAa,CAACa,IAAI,CAACF,OAAO,CAAC,EAAE;AAC/B,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIV,oBAAoB,CAACY,IAAI,CAACF,OAAO,CAAC,EAAE;AACtC,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIT,gBAAgB,CAACW,IAAI,CAACF,OAAO,CAAC,EAAE;AAClC,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIR,oBAAoB,CAACU,IAAI,CAACF,OAAO,CAAC,EAAE;AACtC,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIA,OAAO,CAACG,UAAU,CAAC,IAAI,CAAC,EAAE;AAC5B,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIH,OAAO,CAACG,UAAU,CAAC,IAAI,CAAC,EAAE;AAC5B,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIH,OAAO,CAACG,UAAU,CAAC,GAAG,CAAC,EAAE;AAC3B,IAAA,OAAOH,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;AAC5B,EAAA;AAEA,EAAA,IAAIA,OAAO,CAACG,UAAU,CAAC,GAAG,CAAC,EAAE;AAC3B,IAAA,OAAO,IAAI;AACb,EAAA;AAEA,EAAA,IAAIH,OAAO,CAACG,UAAU,CAAC,IAAI,CAAC,IAAIH,OAAO,CAACG,UAAU,CAAC,KAAK,CAAC,EAAE;AACzD,IAAA,OAAO,KAAK;AACd,EAAA;EAEA,IAAI;AACF,IAAA,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAACL,OAAO,CAAC;IAE5B,IAAI,CAACM,iBAAiB,CAACC,QAAQ,CAACH,GAAG,CAACI,QAAQ,CAAC,EAAE;AAC7C,MAAA,OAAO,KAAK;AACd,IAAA;AAEA,IAAA,IAAIJ,GAAG,CAACI,QAAQ,KAAK,QAAQ,EAAE;AAC7B,MAAA,IAAI,CAACR,OAAO,CAACG,UAAU,CAAC,UAAU,CAAC,EAAE;AACnC,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAI,CAACC,GAAG,CAACK,QAAQ,EAAE;AACjB,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAIL,GAAG,CAACM,QAAQ,IAAIN,GAAG,CAACO,QAAQ,EAAE;AAChC,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAIC,cAAc,CAACR,GAAG,CAACK,QAAQ,CAAC,EAAE;AAChC,QAAA,OAAO,KAAK;AACd,MAAA;AACF,IAAA;AAEA,IAAA,IAAIL,GAAG,CAACI,QAAQ,KAAK,SAAS,EAAE;MAC9B,IAAIJ,GAAG,CAACS,MAAM,EAAE;AACd,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAI,CAACT,GAAG,CAACU,QAAQ,EAAE;AACjB,QAAA,OAAO,KAAK;AACd,MAAA;AACF,IAAA;AAEA,IAAA,OAAO,IAAI;AACb,EAAA,CAAC,CAAC,MAAM;AACN,IAAA,OAAO,KAAK;AACd,EAAA;AACF;AAEA,SAASF,cAAcA,CAACH,QAAgB,EAAA;EACtC,MAAMM,IAAI,GAAGN,QAAQ,CAACV,OAAO,CAACN,aAAa,EAAE,EAAE,CAAC;EAChD,IAAIC,UAAU,CAACQ,IAAI,CAACa,IAAI,CAAC,EAAE,OAAO,IAAI;EACtC,IAAIpB,MAAM,CAACO,IAAI,CAACa,IAAI,CAAC,EAAE,OAAO,IAAI;AAClC,EAAA,IAAIA,IAAI,KAAK,KAAK,EAAE,OAAO,IAAI;AAC/B,EAAA,IAAIA,IAAI,KAAK,WAAW,EAAE,OAAO,IAAI;EACrC,IAAIA,IAAI,CAACC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,IAAI;AAC3C,EAAA,OAAO,KAAK;AACd;;;;"}
@@ -1,28 +0,0 @@
1
- .wds-markup-emphasis {
2
- font-weight: 600;
3
- font-weight: var(--font-weight-semi-bold);
4
- font-style: normal;
5
- }
6
- .wds-markup-emphasis--important {
7
- color: #37517e;
8
- color: var(--color-content-primary);
9
- }
10
- .wds-markup-emphasis--positive {
11
- color: #008026;
12
- color: var(--color-content-positive);
13
- }
14
- .wds-markup-emphasis--negative {
15
- color: #cf2929;
16
- color: var(--color-content-negative);
17
- }
18
- .wds-markup-strong {
19
- font-weight: 600;
20
- font-weight: var(--font-weight-semi-bold);
21
- }
22
- .wds-markup-strikethrough {
23
- -webkit-text-decoration: line-through;
24
- text-decoration: line-through;
25
- }
26
- .wds-markup-paragraph {
27
- margin: 0;
28
- }
@@ -1,70 +0,0 @@
1
- .vulnerability {
2
- display: grid;
3
- grid-template-columns: minmax(0, 1fr) minmax(0, 1fr);
4
- gap: 4px 16px;
5
- margin-bottom: 32px;
6
- }
7
-
8
- .vulnerability__label {
9
- font-size: 11px;
10
- font-weight: 600;
11
- color: #64748b;
12
- text-transform: uppercase;
13
- }
14
-
15
- .vulnerability__input {
16
- font-family: ui-monospace, SFMono-Regular, Consolas, 'Liberation Mono', Menlo, monospace;
17
- width: 100%;
18
- min-height: 56px;
19
- padding: 10px;
20
- font-size: 12px;
21
- border-radius: 4px;
22
- border: 1px solid #e2e8f0;
23
- background: #000000d9;
24
- color: #ededed;
25
- field-sizing: content;
26
- resize: none;
27
- overflow-wrap: break-word;
28
- }
29
-
30
- .vulnerability__output {
31
- font-family: ui-monospace, SFMono-Regular, Consolas, 'Liberation Mono', Menlo, monospace;
32
- padding: 10px;
33
- min-height: 56px;
34
- border-radius: 4px;
35
- border: 1px solid #e2e8f0;
36
- background: #ffffff;
37
- font-size: 14px;
38
- line-height: 1.5;
39
- overflow-wrap: break-word;
40
- }
41
-
42
- .vulnerability__badge {
43
- display: inline-block;
44
- padding: 3px 8px;
45
- border-radius: 3em;
46
- font-size: 11px;
47
- line-height: 0.75rem;
48
- font-weight: 700;
49
- margin-left: 8px;
50
- vertical-align: middle;
51
- text-align: center;
52
- background-color: var(--badge-bg);
53
- color: var(--badge-color);
54
- box-shadow: color-mix(in srgb, var(--badge-color) 10%, transparent) 0 0 0 1px inset;
55
- }
56
-
57
- .vulnerability__badge--high {
58
- --badge-bg: #ffe8ea;
59
- --badge-color: #f30010;
60
- }
61
-
62
- .vulnerability__badge--medium {
63
- --badge-bg: #fff7cf;
64
- --badge-color: #51390d;
65
- }
66
-
67
- .vulnerability__badge--low {
68
- --badge-bg: #d7f8ce;
69
- --badge-color: #00511e;
70
- }
@@ -1,4 +0,0 @@
1
- import React from 'react';
2
- import type { MarkupProps } from './Markup.types';
3
- export declare const Markup: React.FC<MarkupProps>;
4
- //# sourceMappingURL=Markup.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"Markup.d.ts","sourceRoot":"","sources":["../../../src/markup/Markup.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA4B,MAAM,OAAO,CAAC;AAMjD,OAAO,KAAK,EAA6B,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAuG7E,eAAO,MAAM,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAkCxC,CAAC"}
@@ -1,63 +0,0 @@
1
- import React from 'react';
2
- import type { LinkProps } from '../link';
3
- export type MarkupNode = {
4
- type: 'text';
5
- content: string;
6
- } | {
7
- type: 'newline';
8
- } | {
9
- type: 'important';
10
- accessibilityLabel?: string;
11
- children: MarkupNode[];
12
- } | {
13
- type: 'positive';
14
- accessibilityLabel?: string;
15
- children: MarkupNode[];
16
- } | {
17
- type: 'negative';
18
- accessibilityLabel?: string;
19
- children: MarkupNode[];
20
- } | {
21
- type: 'strong';
22
- accessibilityLabel?: string;
23
- children: MarkupNode[];
24
- } | {
25
- type: 'strikethrough';
26
- accessibilityLabel?: string;
27
- children: MarkupNode[];
28
- } | {
29
- type: 'paragraph';
30
- children: MarkupNode[];
31
- } | {
32
- type: 'link';
33
- href?: string;
34
- action?: string;
35
- target?: string;
36
- accessibilityLabel?: string;
37
- children: MarkupNode[];
38
- };
39
- export type MarkupActionHandler = NonNullable<LinkProps['onClick']>;
40
- export type MarkupActions = Record<string, MarkupActionHandler>;
41
- export interface MarkupProps {
42
- /**
43
- * Markup string to parse and render, or arbitrary JSX to pass through unchanged.
44
- * Parsing only occurs when children is a string.
45
- * */
46
- children?: React.ReactNode;
47
- /**
48
- * Map of action names to click handlers for `<link action="name">` button-mode links.
49
- * */
50
- actions?: MarkupActions;
51
- /**
52
- * Wrapper element. Defaults to `div` when the parsed tree contains `<paragraph>` nodes,
53
- * `span` otherwise. Set explicitly to override auto-detection.
54
- * When passing a custom React component, it must accept a `className` prop.
55
- * */
56
- as?: React.ElementType;
57
- className?: string;
58
- /**
59
- * When using a custom React component via `as`, it must also accept a `data-testid` prop.
60
- * */
61
- 'data-testid'?: string;
62
- }
63
- //# sourceMappingURL=Markup.types.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"Markup.types.d.ts","sourceRoot":"","sources":["../../../src/markup/Markup.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;CAAE,GAC1E;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;CAAE,GACzE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;CAAE,GACzE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;CAAE,GACvE;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;CAAE,GAC9E;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;CAAE,GAC7C;IACE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,UAAU,EAAE,CAAC;CACxB,CAAC;AAEN,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;AAEpE,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;AAEhE,MAAM,WAAW,WAAW;IAC1B;;;SAGK;IACL,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAC3B;;SAEK;IACL,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB;;;;SAIK;IACL,EAAE,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;SAEK;IACL,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB"}
@@ -1,12 +0,0 @@
1
- import './Vulnerability.css';
2
- type Severity = 'High' | 'Medium' | 'Low';
3
- interface VulnerabilityProps {
4
- markup: string;
5
- }
6
- export declare const Vulnerability: ({ markup }: VulnerabilityProps) => import("react").JSX.Element;
7
- interface BadgeProps {
8
- severity: Severity;
9
- }
10
- export declare const Badge: ({ severity }: BadgeProps) => import("react").JSX.Element;
11
- export {};
12
- //# sourceMappingURL=Vulnerability.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"Vulnerability.d.ts","sourceRoot":"","sources":["../../../../../src/markup/_stories/Vulnerability/Vulnerability.tsx"],"names":[],"mappings":"AAEA,OAAO,qBAAqB,CAAC;AAE7B,KAAK,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE1C,UAAU,kBAAkB;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,aAAa,GAAI,YAAY,kBAAkB,gCAS3D,CAAC;AAEF,UAAU,UAAU;IAClB,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,eAAO,MAAM,KAAK,GAAI,cAAc,UAAU,gCAI7C,CAAC"}