@truedat/core 8.3.4 → 8.3.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@truedat/core",
-  "version": "8.3.4",
+  "version": "8.3.6",
   "description": "Truedat Web Core",
   "sideEffects": false,
   "module": "src/index.js",
@@ -51,7 +51,7 @@
     "@testing-library/jest-dom": "^6.6.3",
     "@testing-library/react": "^16.3.0",
     "@testing-library/user-event": "^14.6.1",
-    "@truedat/test": "8.3.4",
+    "@truedat/test": "8.3.6",
     "identity-obj-proxy": "^3.0.0",
     "jest": "^29.7.0",
     "redux-saga-test-plan": "^4.0.6"
@@ -66,6 +66,7 @@
     "@tiptap/starter-kit": "^3.20.0",
     "@xyflow/react": "^12.6.4",
     "axios": "^1.13.5",
+    "dompurify": "^3.3.3",
     "elkjs": "^0.10.0",
     "graphql": "^16.11.0",
     "immutable": "^4.3.7",
@@ -96,5 +97,5 @@
     "swr": "^2.3.3",
     "turndown": "^7.2.2"
   },
-  "gitHead": "6c7f4ef08bac69f8b642fa788ebb426a5a103314"
+  "gitHead": "767585383b6373e75fa50d7440e9ecf67b0573c2"
 }

package/src/components/Markdown.js

@@ -8,6 +8,7 @@ import Heading from "@tiptap/extension-heading";
 import { Menu, Icon } from "semantic-ui-react";
 import { FormattedMessage } from "react-intl";
 import { marked } from "marked";
+import DOMPurify from "dompurify";
 import TurndownService from "turndown";
 import TextPromptModal from "./TextPromptModal";
 
@@ -27,7 +28,7 @@ const extensions = [
       rel: "noopener noreferrer",
       target: "_blank",
     },
-  }), 
+  }),
 ];
 
 const validateUrl = (value, allowEmpty = false) => {
@@ -38,48 +39,68 @@ const validateUrl = (value, allowEmpty = false) => {
     };
   }
 
-  // URLs con espacios no son válidas
   if (value.includes(" ")) {
     return { valid: false, error: "markdown.editor.invalidUrl" };
   }
 
-  // Regex más estricto: requiere dominio.tld válido
-  // - Dominio: al menos 2 caracteres antes del último punto
-  // - TLD: 2-6 letras
   const parts = value.split(".");
   if (parts.length < 2) {
     return { valid: false, error: "markdown.editor.invalidUrl" };
   }
-  
+
   const tld = parts[parts.length - 1].split("/")[0];
   const domain = parts.slice(0, -1).join(".");
-  
-  // Validar TLD: 2-6 letras
+
   if (!/^[a-z]{2,6}$/i.test(tld)) {
     return { valid: false, error: "markdown.editor.invalidUrl" };
   }
-  
-  // Validar dominio: al menos 4 caracteres si el TLD tiene 3 letras o menos
-  // Esto evita www.peo, www.xyz, etc. pero permite example.com
+
   if (tld.length <= 3 && domain.length < 4) {
     return { valid: false, error: "markdown.editor.invalidUrl" };
   }
-  
-  // Validar dominio: al menos 2 caracteres, sin empezar/terminar con punto o guión
-  if (domain.length < 2 || domain.startsWith("-") || domain.endsWith("-") || domain.endsWith(".")) {
+
+  if (
+    domain.length < 2 ||
+    domain.startsWith("-") ||
+    domain.endsWith("-") ||
+    domain.endsWith(".")
+  ) {
     return { valid: false, error: "markdown.editor.invalidUrl" };
   }
 
-  const urlWithProtocol = value.match(/^https?:\/\//i) ? value : `https://${value}`;
+  const urlWithProtocol = value.match(/^https?:\/\//i)
+    ? value
+    : `https://${value}`;
+
   return { valid: true, value: urlWithProtocol };
 };
 
+function stripOuterCodeFence(text) {
+  const match = text.match(/^\s*```(?:markdown)?\s*\n([\s\S]*?)\n\s*```\s*$/);
+  return match ? match[1] : text;
+}
+
 function markdownToHtml(markdown) {
   if (!markdown || (typeof markdown === "string" && markdown.trim() === "")) {
     return "<p></p>";
   }
-  const html = marked.parse(markdown, { async: false });
-  return html.replace(/<a (?=[^>]*href=)/gi, `<a target="_blank" rel="noopener noreferrer" `);
+
+  const cleaned = stripOuterCodeFence(markdown);
+
+  const withLinks = marked
+    .parse(cleaned, { async: false })
+    .replace(
+      /<a (?=[^>]*href=)/gi,
+      `<a target="_blank" rel="noopener noreferrer" `,
+    )
+    .replace(
+      /href="(?!https?:\/\/|mailto:)([^"]+)"/gi,
+      (match, url) => `href="https://${url}"`,
+    );
+
+  const safeHtml = DOMPurify.sanitize(withLinks, { ADD_ATTR: ["target"] });
+
+  return safeHtml;
 }
 
 function htmlToMarkdown(html) {
@@ -195,44 +216,55 @@ export function MarkdownEditor({
     };
   }, [editor]);
 
-  const openLinkModal = useCallback((url = null) => {
-    let linkUrl;
-
-    if (url !== null) {
-      linkUrl = url.replace(/^https?:\/\//i, "");
-    } else {
+  const openLinkModal = useCallback(
+    (url = null) => {
       const previousUrl = editor.getAttributes("link").href || "";
-      linkUrl = previousUrl.replace(/^https?:\/\//i, "");
-    }
+      const tempUrl = url !== null ? url : previousUrl;
+      const linkUrl = tempUrl.replace(/^https?:\/\//i, "");
 
-    setLinkUrl(linkUrl);
-    setLinkModalOpen(true);
-  }, [editor]);
+      setLinkUrl(linkUrl);
+      setLinkModalOpen(true);
+    },
+    [editor],
+  );
+
+  const handleLinkAccept = useCallback(
+    ({ valid, value: url }) => {
+      if (!valid) return;
+
+      if (!url || url.trim() === "") {
+        editor.chain().focus().extendMarkRange("link").unsetLink().run();
+        setLinkModalOpen(false);
+        setLinkUrl("");
+        return;
+      }
 
-  const handleLinkAccept = useCallback(({ valid, value: url }) => {
-    if (!valid) return;
+      const finalUrl = url.startsWith("http") ? url : `https://${url}`;
 
-    if (!url || url.trim() === "") {
-      editor.chain().focus().extendMarkRange("link").unsetLink().run();
+      editor
+        .chain()
+        .focus()
+        .extendMarkRange("link")
+        .setLink({ href: finalUrl })
+        .run();
       setLinkModalOpen(false);
       setLinkUrl("");
-      return;
-    }
-
-    editor.chain().focus().extendMarkRange("link").setLink({ href: url }).run();
-    setLinkModalOpen(false);
-    setLinkUrl("");
-  }, [editor]);
+    },
+    [editor],
+  );
 
   const handleLinkCancel = useCallback(() => {
     setLinkModalOpen(false);
     setLinkUrl("");
   }, []);
 
-  const validateLinkUrl = useCallback((value) => {
-    const hasPreviousLink = editor?.isActive("link");
-    return validateUrl(value, hasPreviousLink);
-  }, [editor]);
+  const validateLinkUrl = useCallback(
+    (value) => {
+      const hasPreviousLink = editor?.isActive("link");
+      return validateUrl(value, hasPreviousLink);
+    },
+    [editor],
+  );
 
   if (!editor) {
     return null;
@@ -327,7 +359,10 @@ export function MarkdownEditor({
             <FormattedMessage id="markdown.editor.insertLink" />
           </>
         }
-        label={formatMessage({ id: "markdown.editor.urlLabel", defaultMessage: "URL" })}
+        label={formatMessage({
+          id: "markdown.editor.urlLabel",
+          defaultMessage: "URL",
+        })}
         placeholder="https://"
       />
     </div>