@transferwise/components 0.0.0-experimental-c388243 → 0.0.0-experimental-18063d6

package/src/markup/utils/parseMarkup.ts

@@ -1,228 +0,0 @@
-import { ALLOWED_TARGETS, MAX_NESTING_DEPTH, TAG_ALIASES, TAG_REGEX } from '../constants';
-import { MarkupNode } from '../Markup.types';
-
-export { MAX_NESTING_DEPTH };
-
-const OBJECT_PROTOTYPE_KEYS = new Set(Object.getOwnPropertyNames(Object.prototype));
-
-// eslint-disable-next-line regexp/no-control-character
-const CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
-const HTML_METACHAR = /[<>"']/g;
-
-type Token =
-  | { type: 'text'; content: string }
-  | { type: 'newline' }
-  | { type: 'open'; tag: string; attrs: string }
-  | { type: 'close'; tag: string };
-
-/**
- * Splits the input string into a flat list of tokens by scanning for known tags.
- * Text between tags is emitted as text/newline tokens. Unrecognised tags are never
- * tokenised — they remain part of the surrounding text content.
- */
-function tokenise(input: string): Token[] {
-  const tokens: Token[] = [];
-  let lastIndex = 0;
-
-  TAG_REGEX.lastIndex = 0;
-  let match = TAG_REGEX.exec(input);
-
-  while (match !== null) {
-    if (match.index > lastIndex) {
-      pushTextWithNewlines(tokens, input.slice(lastIndex, match.index));
-    }
-
-    const isClose = match[1] === '/';
-    const tag = match[2];
-    const attrs = match[3] || '';
-
-    if (isClose) {
-      tokens.push({ type: 'close', tag });
-    } else {
-      tokens.push({ type: 'open', tag, attrs });
-    }
-
-    lastIndex = TAG_REGEX.lastIndex;
-    match = TAG_REGEX.exec(input);
-  }
-
-  if (lastIndex < input.length) {
-    pushTextWithNewlines(tokens, input.slice(lastIndex));
-  }
-
-  return tokens;
-}
-
-/** Splits a text fragment on newline characters, interleaving newline tokens between parts. */
-function pushTextWithNewlines(tokens: Token[], text: string): void {
-  const parts = text.split('\n');
-  for (let index = 0; index < parts.length; index += 1) {
-    if (index > 0) {
-      tokens.push({ type: 'newline' });
-    }
-    if (parts[index]) {
-      tokens.push({ type: 'text', content: parts[index] });
-    }
-  }
-}
-
-type ParseResult = { closed: true; nodes: MarkupNode[] } | { closed: false; nodes: MarkupNode[] };
-
-/**
- * Recursive descent parser that consumes tokens and builds a MarkupNode tree.
- *
- * When `untilTag` is provided, the function collects nodes until it finds a matching
- * close token — returning `{ closed: true }`. If it exhausts all tokens without finding
- * the close, it returns `{ closed: false }` so the caller can fall back to plain text
- * (graceful degradation for malformed input).
- *
- * The shared `position` object acts as a cursor across recursive calls, avoiding the
- * need to slice or copy the token array.
- */
-function parse(
-  tokens: Token[],
-  position: { index: number },
-  untilTag?: string,
-  depth = 0,
-): ParseResult {
-  const nodes: MarkupNode[] = [];
-
-  while (position.index < tokens.length) {
-    const token = tokens[position.index];
-
-    if (token.type === 'text') {
-      nodes.push({ type: 'text', content: token.content });
-      position.index += 1;
-    } else if (token.type === 'newline') {
-      nodes.push({ type: 'newline' });
-      position.index += 1;
-    } else if (token.type === 'close') {
-      if (token.tag === untilTag) {
-        position.index += 1;
-        return { closed: true, nodes };
-      }
-      // Mismatched close tag — render as literal text
-      nodes.push({ type: 'text', content: `</${token.tag}>` });
-      position.index += 1;
-    } else if (token.type === 'open') {
-      if (depth >= MAX_NESTING_DEPTH) {
-        nodes.push({ type: 'text', content: `<${token.tag}${token.attrs}>` });
-        position.index += 1;
-      } else {
-        position.index += 1;
-        const result = parse(tokens, position, token.tag, depth + 1);
-
-        if (result.closed) {
-          const node = buildNode(token.tag, token.attrs, result.nodes);
-          nodes.push(node);
-        } else {
-          nodes.push({ type: 'text', content: `<${token.tag}${token.attrs}>` });
-          nodes.push(...result.nodes);
-        }
-      }
-    }
-  }
-
-  if (untilTag) {
-    return { closed: false, nodes };
-  }
-
-  return { closed: true, nodes };
-}
-
-/**
- * Maps a raw tag name to a typed MarkupNode. Resolves aliases first (p→paragraph, a→link),
- * then builds the appropriate node shape. Link nodes carry full attributes; other element
- * nodes extract only accessibilityLabel.
- */
-function buildNode(rawTag: string, attrs: string, children: MarkupNode[]): MarkupNode {
-  const tag = TAG_ALIASES[rawTag] || rawTag;
-
-  if (tag === 'link') {
-    return { type: 'link', children, ...parseAttributes(attrs) };
-  }
-
-  if (tag === 'paragraph') {
-    return { type: 'paragraph', children };
-  }
-
-  const { accessibilityLabel } = parseAttributes(attrs);
-
-  return {
-    type: tag as MarkupNode['type'],
-    children,
-    ...(accessibilityLabel && { accessibilityLabel }),
-  } as MarkupNode;
-}
-
-const ATTR_REGEX = /(?<=\s)(href|action|target|accessibilityLabel)=(?:"([^"]*)"|'([^']*)')/g;
-
-type ParsedAttributes = {
-  href?: string;
-  action?: string;
-  target?: string;
-  accessibilityLabel?: string;
-};
-
-/**
- * Extracts allowed attributes from a raw attribute string.
- * Supports both double- and single-quoted values. Any attribute not in the
- * allow-list (href, action, target, accessibilityLabel) is silently discarded.
- * First occurrence wins — duplicates are ignored.
- */
-function parseAttributes(attrs: string): ParsedAttributes {
-  const result: ParsedAttributes = {};
-  ATTR_REGEX.lastIndex = 0;
-  let match = ATTR_REGEX.exec(attrs);
-
-  while (match !== null) {
-    const key = match[1] as 'href' | 'action' | 'target' | 'accessibilityLabel';
-    const value = match[2] ?? match[3];
-
-    if (!(key in result)) {
-      const sanitized = sanitizeAttributeValue(key, value);
-      if (sanitized !== undefined) {
-        result[key] = sanitized;
-      }
-    }
-
-    match = ATTR_REGEX.exec(attrs);
-  }
-
-  return result;
-}
-
-function sanitizeAttributeValue(
-  key: 'href' | 'action' | 'target' | 'accessibilityLabel',
-  value: string,
-): string | undefined {
-  switch (key) {
-    case 'href':
-      return value.replace(CONTROL_CHARS, '');
-    case 'action':
-      if (OBJECT_PROTOTYPE_KEYS.has(value)) {
-        return undefined;
-      }
-      return value;
-    case 'target':
-      if (!ALLOWED_TARGETS.includes(value)) {
-        return undefined;
-      }
-      return value;
-    case 'accessibilityLabel':
-      return value.replace(HTML_METACHAR, '');
-    default:
-      return value;
-  }
-}
-
-/** Entry point: tokenises the input string, then parses the token stream into a MarkupNode tree. */
-export function parseMarkup(input: string): MarkupNode[] {
-  if (!input) {
-    return [];
-  }
-
-  const tokens = tokenise(input);
-  const position = { index: 0 };
-  return parse(tokens, position).nodes;
-}

package/src/markup/utils/sanitise.test.ts

@@ -1,375 +0,0 @@
-import { isAllowedHref } from './sanitise';
-
-describe('isAllowedHref', () => {
-  describe('allowed protocols', () => {
-    it('allows https URLs', () => {
-      expect(isAllowedHref('https://example.com')).toBe(true);
-    });
-
-    it('allows mailto URLs', () => {
-      expect(isAllowedHref('mailto:user@example.com')).toBe(true);
-    });
-
-    it('blocks http URLs', () => {
-      expect(isAllowedHref('http://example.com')).toBe(false);
-    });
-
-    it('blocks tel URLs', () => {
-      expect(isAllowedHref('tel:+1234567890')).toBe(false);
-    });
-  });
-
-  describe('allowed relative paths', () => {
-    it('allows root-relative paths', () => {
-      expect(isAllowedHref('/settings')).toBe(true);
-    });
-
-    it('allows hash fragments', () => {
-      expect(isAllowedHref('#section')).toBe(true);
-    });
-  });
-
-  describe('blocked relative paths', () => {
-    it('blocks dot-relative paths', () => {
-      expect(isAllowedHref('./page')).toBe(false);
-    });
-
-    it('blocks parent-relative paths', () => {
-      expect(isAllowedHref('../page')).toBe(false);
-    });
-
-    it('blocks dot-relative paths with query parameters', () => {
-      expect(isAllowedHref('./page?time=10:30')).toBe(false);
-    });
-
-    it('blocks bare relative paths with colons in segments', () => {
-      expect(isAllowedHref('page?key=value:other')).toBe(false);
-    });
-  });
-
-  describe('blocked protocols', () => {
-    it('blocks javascript: protocol', () => {
-      // eslint-disable-next-line no-script-url
-      expect(isAllowedHref('javascript:alert(1)')).toBe(false);
-    });
-
-    it('blocks javascript: with mixed case', () => {
-      // eslint-disable-next-line no-script-url
-      expect(isAllowedHref('JavaScript:alert(1)')).toBe(false);
-    });
-
-    it('blocks data: protocol', () => {
-      expect(isAllowedHref('data:text/html,<script>alert(1)</script>')).toBe(false);
-    });
-
-    it('blocks vbscript: protocol', () => {
-      expect(isAllowedHref('vbscript:MsgBox("xss")')).toBe(false);
-    });
-
-    it('blocks unknown protocols', () => {
-      expect(isAllowedHref('ftp://evil.com')).toBe(false);
-    });
-  });
-
-  describe('protocol-relative URLs', () => {
-    it('blocks protocol-relative URLs', () => {
-      expect(isAllowedHref('//evil.com/phishing')).toBe(false);
-    });
-
-    it('blocks protocol-relative URLs with whitespace', () => {
-      expect(isAllowedHref('  //evil.com  ')).toBe(false);
-    });
-  });
-
-  describe('edge cases', () => {
-    it('handles empty string', () => {
-      expect(isAllowedHref('')).toBe(false);
-    });
-
-    it('handles whitespace-padded URLs', () => {
-      expect(isAllowedHref('  https://example.com  ')).toBe(true);
-    });
-
-    it('handles whitespace-padded dangerous URLs', () => {
-      expect(isAllowedHref('  javascript:alert(1)  ')).toBe(false);
-    });
-  });
-
-  describe('control characters in scheme — XSS bypass via URL parser throw', () => {
-    it('blocks null byte mid-scheme (java\\x00script:)', () => {
-      expect(isAllowedHref('java\x00script:alert(1)')).toBe(false);
-    });
-
-    it('blocks null byte between s and c (javas\\x00cript:)', () => {
-      expect(isAllowedHref('javas\x00cript:alert(1)')).toBe(false);
-    });
-
-    it('blocks SOH prefix before javascript:', () => {
-      expect(isAllowedHref('\x01javascript:alert(1)')).toBe(false);
-    });
-
-    it('blocks vertical tab prefix before javascript:', () => {
-      expect(isAllowedHref('\x0Bjavascript:alert(1)')).toBe(false);
-    });
-
-    it('blocks form feed prefix before javascript:', () => {
-      expect(isAllowedHref('\x0Cjavascript:alert(1)')).toBe(false);
-    });
-
-    it('blocks tab mid-scheme (java\\tscript:)', () => {
-      expect(isAllowedHref('java\tscript:alert(1)')).toBe(false);
-    });
-
-    it('blocks CRLF mid-scheme (java\\r\\nscript:)', () => {
-      expect(isAllowedHref('java\r\nscript:alert(1)')).toBe(false);
-    });
-
-    it('blocks LF mid-scheme (j\\navascript:)', () => {
-      expect(isAllowedHref('j\navascript:alert(1)')).toBe(false);
-    });
-  });
-
-  describe('zero-width and invisible character bypass', () => {
-    it('blocks zero-width space prefix before javascript:', () => {
-      expect(isAllowedHref('​javascript:alert(1)')).toBe(false);
-    });
-
-    it('blocks zero-width space only (invisible link)', () => {
-      expect(isAllowedHref('​')).toBe(false);
-    });
-
-    it('blocks BOM-only string (invisible link)', () => {
-      expect(isAllowedHref('')).toBe(false);
-    });
-
-    it('blocks BOM prefix before javascript:', () => {
-      expect(isAllowedHref('javascript:alert(1)')).toBe(false);
-    });
-
-    it('blocks zero-width non-joiner prefix before javascript:', () => {
-      expect(isAllowedHref('‌javascript:alert(1)')).toBe(false);
-    });
-
-    it('blocks zero-width joiner prefix before javascript:', () => {
-      expect(isAllowedHref('‍javascript:alert(1)')).toBe(false);
-    });
-  });
-
-  describe('non-ASCII whitespace prefix bypass', () => {
-    it('blocks NBSP prefix before javascript:', () => {
-      expect(isAllowedHref(' javascript:alert(1)')).toBe(false);
-    });
-
-    it('blocks line separator prefix before javascript:', () => {
-      expect(isAllowedHref('\u2028javascript:alert(1)')).toBe(false);
-    });
-
-    it('blocks paragraph separator prefix before javascript:', () => {
-      expect(isAllowedHref('\u2029javascript:alert(1)')).toBe(false);
-    });
-
-    it('blocks NBSP before protocol-relative URL', () => {
-      expect(isAllowedHref(' //evil.com')).toBe(false);
-    });
-
-    it('blocks NBSP-only string', () => {
-      expect(isAllowedHref(' ')).toBe(false);
-    });
-  });
-
-  describe('backslash-based open redirect', () => {
-    it('blocks /\\evil.com (browsers normalize \\ to /)', () => {
-      expect(isAllowedHref('/\\evil.com')).toBe(false);
-    });
-
-    it('blocks /\\\\evil.com (double backslash)', () => {
-      expect(isAllowedHref('/\\\\evil.com')).toBe(false);
-    });
-
-    it('allows /path\\with\\backslash (not at position 1)', () => {
-      expect(isAllowedHref('/path\\with\\backslash')).toBe(true);
-    });
-  });
-
-  describe('URL-encoded dangerous schemes', () => {
-    it('blocks javascript with URL-encoded colon (%3A)', () => {
-      expect(isAllowedHref('javascript%3Aalert(1)')).toBe(false);
-    });
-
-    it('blocks javascript with lowercase URL-encoded colon (%3a)', () => {
-      expect(isAllowedHref('javascript%3aalert(1)')).toBe(false);
-    });
-  });
-
-  describe('credential confusion / phishing via userinfo', () => {
-    it('blocks https URLs with misleading userinfo (good.com@evil.com)', () => {
-      expect(isAllowedHref('https://good.com@evil.com')).toBe(false);
-    });
-
-    it('blocks https URLs with port-like credentials', () => {
-      expect(isAllowedHref('https://evil.com:443@good.com')).toBe(false);
-    });
-
-    it('allows https URLs without userinfo', () => {
-      expect(isAllowedHref('https://example.com/path')).toBe(true);
-    });
-
-    it('allows mailto with @ (expected in email addresses)', () => {
-      expect(isAllowedHref('mailto:user@example.com')).toBe(true);
-    });
-  });
-
-  describe('degenerate HTTPS URLs', () => {
-    it('blocks https:evil.com (no slashes — ambiguous host)', () => {
-      expect(isAllowedHref('https:evil.com')).toBe(false);
-    });
-
-    it('blocks https:/evil.com (single slash — ambiguous)', () => {
-      expect(isAllowedHref('https:/evil.com')).toBe(false);
-    });
-
-    it('blocks https:// (no host)', () => {
-      expect(isAllowedHref('https://')).toBe(false);
-    });
-
-    it('blocks https:/// (empty host)', () => {
-      expect(isAllowedHref('https:///')).toBe(false);
-    });
-  });
-
-  describe('internal network / SSRF via allowed HTTPS', () => {
-    it('blocks https://127.0.0.1 (localhost)', () => {
-      expect(isAllowedHref('https://127.0.0.1/')).toBe(false);
-    });
-
-    it('blocks https://[::1] (IPv6 localhost)', () => {
-      expect(isAllowedHref('https://[::1]/')).toBe(false);
-    });
-
-    it('blocks hex-encoded IP (0x7f000001)', () => {
-      expect(isAllowedHref('https://0x7f000001/')).toBe(false);
-    });
-
-    it('blocks decimal IP (2130706433)', () => {
-      expect(isAllowedHref('https://2130706433/')).toBe(false);
-    });
-
-    it('blocks octal IP (0177.0.0.1)', () => {
-      expect(isAllowedHref('https://0177.0.0.1/')).toBe(false);
-    });
-
-    it('blocks AWS metadata endpoint', () => {
-      expect(isAllowedHref('https://169.254.169.254/')).toBe(false);
-    });
-
-    it('blocks GCP metadata endpoint', () => {
-      expect(isAllowedHref('https://metadata.google.internal/')).toBe(false);
-    });
-  });
-
-  describe('XSS payloads in fragment and path', () => {
-    it('blocks XSS payload in hash fragment', () => {
-      expect(isAllowedHref('#<img onerror=alert(1)>')).toBe(false);
-    });
-
-    it('blocks XSS payload in path', () => {
-      expect(isAllowedHref('/<img onerror=alert(1)>')).toBe(false);
-    });
-
-    it('blocks attribute injection in hash fragment', () => {
-      expect(isAllowedHref('#" onclick="alert(1)')).toBe(false);
-    });
-
-    it('allows normal hash fragments', () => {
-      expect(isAllowedHref('#section-1')).toBe(true);
-    });
-
-    it('allows normal root-relative paths', () => {
-      expect(isAllowedHref('/normal/path?query=value')).toBe(true);
-    });
-  });
-
-  describe('UNC paths (Windows network shares)', () => {
-    it('blocks UNC path to external server', () => {
-      expect(isAllowedHref('\\\\evil.com\\share')).toBe(false);
-    });
-  });
-
-  describe('space before colon in scheme', () => {
-    it('blocks "javascript :alert(1)" (space before colon)', () => {
-      expect(isAllowedHref('javascript :alert(1)')).toBe(false);
-    });
-  });
-
-  describe('mailto abuse', () => {
-    it('blocks mailto with XSS in body parameter', () => {
-      expect(isAllowedHref('mailto:evil@evil.com?body=<script>alert(1)</script>')).toBe(false);
-    });
-
-    it('blocks mailto with header injection (cc/bcc)', () => {
-      expect(isAllowedHref('mailto:evil@evil.com?cc=victim@good.com&bcc=spy@evil.com')).toBe(false);
-    });
-
-    it('blocks mailto with no recipient (social engineering)', () => {
-      expect(isAllowedHref('mailto:?subject=urgent&body=click%20here')).toBe(false);
-    });
-
-    it('allows simple mailto with just an address', () => {
-      expect(isAllowedHref('mailto:support@example.com')).toBe(true);
-    });
-  });
-
-  describe('additional blocked protocols (regression)', () => {
-    it('blocks file: protocol', () => {
-      expect(isAllowedHref('file:///etc/passwd')).toBe(false);
-    });
-
-    it('blocks ws: protocol', () => {
-      expect(isAllowedHref('ws://evil.com')).toBe(false);
-    });
-
-    it('blocks wss: protocol', () => {
-      expect(isAllowedHref('wss://evil.com')).toBe(false);
-    });
-
-    it('blocks blob: protocol', () => {
-      expect(isAllowedHref('blob:https://evil.com/uuid')).toBe(false);
-    });
-
-    it('blocks data: with SVG XSS', () => {
-      expect(isAllowedHref('data:image/svg+xml,<svg onload=alert(1)>')).toBe(false);
-    });
-
-    it('blocks data: with base64-encoded script', () => {
-      expect(isAllowedHref('data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==')).toBe(
-        false,
-      );
-    });
-
-    it('blocks view-source: protocol', () => {
-      expect(isAllowedHref('view-source:https://evil.com')).toBe(false);
-    });
-
-    it('blocks custom protocol (foo:bar)', () => {
-      expect(isAllowedHref('foo:bar')).toBe(false);
-    });
-
-    it('blocks minimal protocol pattern (a:b)', () => {
-      expect(isAllowedHref('a:b')).toBe(false);
-    });
-
-    it('blocks customprotocol:payload', () => {
-      expect(isAllowedHref('customprotocol:payload')).toBe(false);
-    });
-  });
-
-  describe('whitespace-only inputs', () => {
-    it('blocks spaces only', () => {
-      expect(isAllowedHref('   ')).toBe(false);
-    });
-
-    it('blocks tab/newline/CR only', () => {
-      expect(isAllowedHref('\t\n\r')).toBe(false);
-    });
-  });
-});

package/src/markup/utils/sanitise.ts

@@ -1,107 +0,0 @@
-import { ALLOWED_PROTOCOLS } from '../constants';
-
-const INVISIBLE_CHARS = /[\u200b\u200c\u200d\ufeff\u00ad\u2060\u180e]/g;
-// eslint-disable-next-line regexp/no-control-character
-const CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f]/;
-const DANGEROUS_HTML_CHARS = /[<>"']/;
-const DANGEROUS_SCHEME = /^(?:javascript|vbscript|data|jscript)\s*:/i;
-// eslint-disable-next-line regexp/no-useless-non-capturing-group
-const ENCODED_COLON_SCHEME = /^(?:javascript|vbscript|data|jscript)(?:%3a)/i;
-const IPV6_BRACKETS = /^\[|\]$/g;
-const NUMERIC_IP = /^[\d.]+$/;
-const HEX_IP = /^0x[0-9a-f]+$/i;
-
-export function isAllowedHref(href: string): boolean {
-  const cleaned = href.replace(INVISIBLE_CHARS, '');
-  const trimmed = cleaned.trim();
-
-  if (!trimmed) {
-    return false;
-  }
-
-  if (CONTROL_CHARS.test(trimmed)) {
-    return false;
-  }
-
-  if (DANGEROUS_HTML_CHARS.test(trimmed)) {
-    return false;
-  }
-
-  if (DANGEROUS_SCHEME.test(trimmed)) {
-    return false;
-  }
-
-  if (ENCODED_COLON_SCHEME.test(trimmed)) {
-    return false;
-  }
-
-  if (trimmed.startsWith('//')) {
-    return false;
-  }
-
-  if (trimmed.startsWith('\\')) {
-    return false;
-  }
-
-  if (trimmed.startsWith('/')) {
-    return trimmed[1] !== '\\';
-  }
-
-  if (trimmed.startsWith('#')) {
-    return true;
-  }
-
-  if (trimmed.startsWith('./') || trimmed.startsWith('../')) {
-    return false;
-  }
-
-  try {
-    const url = new URL(trimmed);
-
-    if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {
-      return false;
-    }
-
-    if (url.protocol === 'https:') {
-      if (!trimmed.startsWith('https://')) {
-        return false;
-      }
-
-      if (!url.hostname) {
-        return false;
-      }
-
-      if (url.username || url.password) {
-        return false;
-      }
-
-      if (isInternalHost(url.hostname)) {
-        return false;
-      }
-    }
-
-    if (url.protocol === 'mailto:') {
-      if (url.search) {
-        return false;
-      }
-
-      if (!url.pathname) {
-        return false;
-      }
-    }
-
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function isInternalHost(hostname: string): boolean {
-  const host = hostname.replace(IPV6_BRACKETS, '');
-  if (NUMERIC_IP.test(host)) return true;
-  if (HEX_IP.test(host)) return true;
-  if (host === '::1') return true;
-  if (host === 'localhost') return true;
-  if (host.endsWith('.internal')) return true;
-  return false;
-}