@uniformdev/richtext 20.72.2-alpha.3 → 20.72.3-alpha.14

package/dist/index.d.mts

@@ -28,6 +28,29 @@ type NodeStringRenderer = (props: NodeStringRendererProps) => string;
 type ParameterRichTextValue = SerializedEditorState | undefined | null;
 type RichTextBuiltInFormat = 'code' | 'bold' | 'italic' | 'underline' | 'strikethrough' | 'superscript' | 'subscript';
 type RichTextBuiltInElement = 'h1' | 'h2' | 'h3' | 'h4' | 'h5' | 'h6' | 'unorderedList' | 'orderedList' | 'link' | 'quote' | 'code' | 'variable' | 'table' | 'asset';
+/**
+ * One entry in the link-attributes config list.
+ * `options`, `label`, and `helpText` are optional presentation hints.
+ * The React SDK translates the literal `class` key to `className` on output.
+ */
+interface LinkAttrConfig {
+    key: string;
+    /** When present, the editor renders a select; the value must be one of these. */
+    options?: Array<{
+        name: string;
+        value: string;
+    }>;
+    label?: string;
+    helpText?: string;
+}
+interface LinkAttributesConfiguration {
+    /** When true, the editor sees an Anchor input; the fragment lives on value.path. */
+    enableAnchor?: boolean;
+    /** Flat, ordered list of attribute entries a project wants on its links. */
+    entries?: Array<LinkAttrConfig>;
+}
+/** Normalize a stored entry for rendering — fills in a default label. */
+declare function resolveLinkAttrConfig(entry: LinkAttrConfig): Required<Pick<LinkAttrConfig, 'key' | 'label'>> & Pick<LinkAttrConfig, 'options' | 'helpText'>;
 interface RichTextParamConfiguration {
     required?: boolean;
     formatting?: {
@@ -40,6 +63,8 @@ interface RichTextParamConfiguration {
         asset?: {
             allowedTypes?: AssetDefinitionType[];
         };
+        /** Optional anchor (fragment) toggle and custom attribute config for the link element. */
+        link?: LinkAttributesConfiguration;
     };
 }
 
@@ -65,12 +90,34 @@ type ProjectMapLinkParamValue = {
     nodeId: string;
     path: string;
     dynamicInputValues?: Record<string, string>;
+    attributes?: Record<string, string>;
 };
 type NonProjectMapLinkParamValue = {
     type: Exclude<LinkParameterType, 'projectMapNode'>;
     path: string;
+    attributes?: Record<string, string>;
 };
 type LinkParamValue = ProjectMapLinkParamValue | NonProjectMapLinkParamValue | undefined;
+/**
+ * True for attribute keys the Uniform web SDKs strip at render time: inline event
+ * handlers (`on*`) and dangerous attribute names (href, src, style, formaction).
+ * Authoring UIs should use this to warn before such keys are ever persisted.
+ */
+declare function isDangerousLinkAttributeKey(key: string): boolean;
+/**
+ * Converts a link parameter value into a plain HTML attribute bag suitable for
+ * an `<a>` element. Applies a web-channel security denylist (event handlers,
+ * script-executing URL schemes on the href and any value, dangerous attribute names) and auto-adds
+ * `rel="noopener noreferrer"` for any case variant of `target="_blank"`.
+ */
+declare function linkParamValueToHtmlAttributes(link: LinkParamValue): Record<string, string>;
+/**
+ * Converts a link parameter value into a React-compatible anchor prop bag.
+ * Delegates to `linkParamValueToHtmlAttributes` for the security denylist /
+ * auto-rel logic, then renames the literal `class` key to `className` for React.
+ */
+declare function linkParamValueToAnchorProps(link: LinkParamValue): Record<string, string>;
+/** Derives the href string from a link parameter value. */
 declare function linkParamValueToHref(link: LinkParamValue): string | undefined;
 
 interface ListNode extends RichTextNode {
@@ -223,4 +270,4 @@ declare const emptyRichTextValue: {
 };
 declare const defaultParameterConfiguration: RichTextParamConfiguration;
 
-export { type AssetNode, type HeadingNode, type LinkNode, type ListItemNode, type ListNode, type NodeStringRenderer, type NodeStringRendererProps, type ParagraphNode, type ParameterRichTextValue, type ResolveStringRenderer, type RichTextBuiltInElement, type RichTextBuiltInFormat, type RichTextNode, type RichTextNodeWithChildren, type RichTextParamConfiguration, type StringRenderContext, type TableCellNode, type TableNode, type TableRowNode, type TextNode, assetHtmlRenderer, defaultParameterConfiguration, emptyRichTextValue, getLabelForElement, getLabelForFormat, getRichTextTagFromTableCellHeaderState, getRichTextTagsFromTextFormat, hasChildren, headingHtmlRenderer, isArrayWithLength, isPureDirection, isPureTextAlign, isRichTextNode, isRichTextNodeType, isRichTextValue, isRichTextValueConsideredEmpty, linkHtmlRenderer, linkParamValueToHref, listHtmlRenderer, listitemHtmlRenderer, paragraphHtmlRenderer, purifyText, renderChildrenToHtml, renderChildrenToText, renderHtmlElement, renderToHtml, renderToText, resolveDefaultRenderer$1 as resolveDefaultHtmlRenderer, resolveDefaultRenderer as resolveDefaultTextRenderer, richTextBuiltInElements, richTextBuiltInFormats, rootHtmlRenderer, tableHtmlRenderer, tablecellHtmlRenderer, tablerowHtmlRenderer, textHtmlRenderer, walkRichTextTree };
+export { type AssetNode, type HeadingNode, type LinkAttrConfig, type LinkAttributesConfiguration, type LinkNode, type ListItemNode, type ListNode, type NodeStringRenderer, type NodeStringRendererProps, type ParagraphNode, type ParameterRichTextValue, type ResolveStringRenderer, type RichTextBuiltInElement, type RichTextBuiltInFormat, type RichTextNode, type RichTextNodeWithChildren, type RichTextParamConfiguration, type StringRenderContext, type TableCellNode, type TableNode, type TableRowNode, type TextNode, assetHtmlRenderer, defaultParameterConfiguration, emptyRichTextValue, getLabelForElement, getLabelForFormat, getRichTextTagFromTableCellHeaderState, getRichTextTagsFromTextFormat, hasChildren, headingHtmlRenderer, isArrayWithLength, isDangerousLinkAttributeKey, isPureDirection, isPureTextAlign, isRichTextNode, isRichTextNodeType, isRichTextValue, isRichTextValueConsideredEmpty, linkHtmlRenderer, linkParamValueToAnchorProps, linkParamValueToHref, linkParamValueToHtmlAttributes, listHtmlRenderer, listitemHtmlRenderer, paragraphHtmlRenderer, purifyText, renderChildrenToHtml, renderChildrenToText, renderHtmlElement, renderToHtml, renderToText, resolveDefaultRenderer$1 as resolveDefaultHtmlRenderer, resolveDefaultRenderer as resolveDefaultTextRenderer, resolveLinkAttrConfig, richTextBuiltInElements, richTextBuiltInFormats, rootHtmlRenderer, tableHtmlRenderer, tablecellHtmlRenderer, tablerowHtmlRenderer, textHtmlRenderer, walkRichTextTree };

package/dist/index.d.ts

@@ -28,6 +28,29 @@ type NodeStringRenderer = (props: NodeStringRendererProps) => string;
 type ParameterRichTextValue = SerializedEditorState | undefined | null;
 type RichTextBuiltInFormat = 'code' | 'bold' | 'italic' | 'underline' | 'strikethrough' | 'superscript' | 'subscript';
 type RichTextBuiltInElement = 'h1' | 'h2' | 'h3' | 'h4' | 'h5' | 'h6' | 'unorderedList' | 'orderedList' | 'link' | 'quote' | 'code' | 'variable' | 'table' | 'asset';
+/**
+ * One entry in the link-attributes config list.
+ * `options`, `label`, and `helpText` are optional presentation hints.
+ * The React SDK translates the literal `class` key to `className` on output.
+ */
+interface LinkAttrConfig {
+    key: string;
+    /** When present, the editor renders a select; the value must be one of these. */
+    options?: Array<{
+        name: string;
+        value: string;
+    }>;
+    label?: string;
+    helpText?: string;
+}
+interface LinkAttributesConfiguration {
+    /** When true, the editor sees an Anchor input; the fragment lives on value.path. */
+    enableAnchor?: boolean;
+    /** Flat, ordered list of attribute entries a project wants on its links. */
+    entries?: Array<LinkAttrConfig>;
+}
+/** Normalize a stored entry for rendering — fills in a default label. */
+declare function resolveLinkAttrConfig(entry: LinkAttrConfig): Required<Pick<LinkAttrConfig, 'key' | 'label'>> & Pick<LinkAttrConfig, 'options' | 'helpText'>;
 interface RichTextParamConfiguration {
     required?: boolean;
     formatting?: {
@@ -40,6 +63,8 @@ interface RichTextParamConfiguration {
         asset?: {
             allowedTypes?: AssetDefinitionType[];
         };
+        /** Optional anchor (fragment) toggle and custom attribute config for the link element. */
+        link?: LinkAttributesConfiguration;
     };
 }
 
@@ -65,12 +90,34 @@ type ProjectMapLinkParamValue = {
     nodeId: string;
     path: string;
     dynamicInputValues?: Record<string, string>;
+    attributes?: Record<string, string>;
 };
 type NonProjectMapLinkParamValue = {
     type: Exclude<LinkParameterType, 'projectMapNode'>;
     path: string;
+    attributes?: Record<string, string>;
 };
 type LinkParamValue = ProjectMapLinkParamValue | NonProjectMapLinkParamValue | undefined;
+/**
+ * True for attribute keys the Uniform web SDKs strip at render time: inline event
+ * handlers (`on*`) and dangerous attribute names (href, src, style, formaction).
+ * Authoring UIs should use this to warn before such keys are ever persisted.
+ */
+declare function isDangerousLinkAttributeKey(key: string): boolean;
+/**
+ * Converts a link parameter value into a plain HTML attribute bag suitable for
+ * an `<a>` element. Applies a web-channel security denylist (event handlers,
+ * script-executing URL schemes on the href and any value, dangerous attribute names) and auto-adds
+ * `rel="noopener noreferrer"` for any case variant of `target="_blank"`.
+ */
+declare function linkParamValueToHtmlAttributes(link: LinkParamValue): Record<string, string>;
+/**
+ * Converts a link parameter value into a React-compatible anchor prop bag.
+ * Delegates to `linkParamValueToHtmlAttributes` for the security denylist /
+ * auto-rel logic, then renames the literal `class` key to `className` for React.
+ */
+declare function linkParamValueToAnchorProps(link: LinkParamValue): Record<string, string>;
+/** Derives the href string from a link parameter value. */
 declare function linkParamValueToHref(link: LinkParamValue): string | undefined;
 
 interface ListNode extends RichTextNode {
@@ -223,4 +270,4 @@ declare const emptyRichTextValue: {
 };
 declare const defaultParameterConfiguration: RichTextParamConfiguration;
 
-export { type AssetNode, type HeadingNode, type LinkNode, type ListItemNode, type ListNode, type NodeStringRenderer, type NodeStringRendererProps, type ParagraphNode, type ParameterRichTextValue, type ResolveStringRenderer, type RichTextBuiltInElement, type RichTextBuiltInFormat, type RichTextNode, type RichTextNodeWithChildren, type RichTextParamConfiguration, type StringRenderContext, type TableCellNode, type TableNode, type TableRowNode, type TextNode, assetHtmlRenderer, defaultParameterConfiguration, emptyRichTextValue, getLabelForElement, getLabelForFormat, getRichTextTagFromTableCellHeaderState, getRichTextTagsFromTextFormat, hasChildren, headingHtmlRenderer, isArrayWithLength, isPureDirection, isPureTextAlign, isRichTextNode, isRichTextNodeType, isRichTextValue, isRichTextValueConsideredEmpty, linkHtmlRenderer, linkParamValueToHref, listHtmlRenderer, listitemHtmlRenderer, paragraphHtmlRenderer, purifyText, renderChildrenToHtml, renderChildrenToText, renderHtmlElement, renderToHtml, renderToText, resolveDefaultRenderer$1 as resolveDefaultHtmlRenderer, resolveDefaultRenderer as resolveDefaultTextRenderer, richTextBuiltInElements, richTextBuiltInFormats, rootHtmlRenderer, tableHtmlRenderer, tablecellHtmlRenderer, tablerowHtmlRenderer, textHtmlRenderer, walkRichTextTree };
+export { type AssetNode, type HeadingNode, type LinkAttrConfig, type LinkAttributesConfiguration, type LinkNode, type ListItemNode, type ListNode, type NodeStringRenderer, type NodeStringRendererProps, type ParagraphNode, type ParameterRichTextValue, type ResolveStringRenderer, type RichTextBuiltInElement, type RichTextBuiltInFormat, type RichTextNode, type RichTextNodeWithChildren, type RichTextParamConfiguration, type StringRenderContext, type TableCellNode, type TableNode, type TableRowNode, type TextNode, assetHtmlRenderer, defaultParameterConfiguration, emptyRichTextValue, getLabelForElement, getLabelForFormat, getRichTextTagFromTableCellHeaderState, getRichTextTagsFromTextFormat, hasChildren, headingHtmlRenderer, isArrayWithLength, isDangerousLinkAttributeKey, isPureDirection, isPureTextAlign, isRichTextNode, isRichTextNodeType, isRichTextValue, isRichTextValueConsideredEmpty, linkHtmlRenderer, linkParamValueToAnchorProps, linkParamValueToHref, linkParamValueToHtmlAttributes, listHtmlRenderer, listitemHtmlRenderer, paragraphHtmlRenderer, purifyText, renderChildrenToHtml, renderChildrenToText, renderHtmlElement, renderToHtml, renderToText, resolveDefaultRenderer$1 as resolveDefaultHtmlRenderer, resolveDefaultRenderer as resolveDefaultTextRenderer, resolveLinkAttrConfig, richTextBuiltInElements, richTextBuiltInFormats, rootHtmlRenderer, tableHtmlRenderer, tablecellHtmlRenderer, tablerowHtmlRenderer, textHtmlRenderer, walkRichTextTree };

package/dist/index.esm.js

@@ -29,7 +29,7 @@ var voidElements = /* @__PURE__ */ new Set([
   "wbr"
 ]);
 function renderHtmlElement(tag, attributes, children) {
-  const attributesString = attributes && attributes.size > 0 ? " " + Array.from(attributes).reduce((result, [key, value]) => [...result, `${key}="${value}"`], []).join(" ") : "";
+  const attributesString = attributes && attributes.size > 0 ? " " + Array.from(attributes).reduce((result, [key, value]) => [...result, `${key}="${purifyText(value)}"`], []).join(" ") : "";
   return voidElements.has(tag) ? `<${tag}${attributesString}>` : `<${tag}${attributesString}>${children != null ? children : ""}</${tag}>`;
 }
 
@@ -99,13 +99,68 @@ var headingTextRenderer = ({ context, renderChildren }) => {
 // src/nodes/link.ts
 var linkHtmlRenderer = ({ context, renderChildren }) => {
   const node = context.currentNode;
-  const attributes = /* @__PURE__ */ new Map();
-  const href = linkParamValueToHref(node.link);
-  if (href) {
-    attributes.set("href", href);
-  }
+  const htmlAttrs = linkParamValueToHtmlAttributes(node.link);
+  const attributes = new Map(Object.entries(htmlAttrs));
   return renderHtmlElement("a", attributes, renderChildren(context.currentNode.children));
 };
+var DENYLIST_EXACT = /* @__PURE__ */ new Set(["href", "src", "style", "formaction"]);
+var EVENT_HANDLER_PATTERN = /^on/i;
+var SAFE_ATTRIBUTE_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9:_.-]*$/;
+var DANGEROUS_SCHEME_PATTERN = /^(?:javascript|data|vbscript):/i;
+function hasDangerousScheme(value) {
+  const normalized = value.replace(/[\u0000-\u0020\u007f-\u00a0]+/g, "").toLowerCase();
+  return DANGEROUS_SCHEME_PATTERN.test(normalized);
+}
+function isDangerousLinkAttributeKey(key) {
+  return EVENT_HANDLER_PATTERN.test(key) || DENYLIST_EXACT.has(key.toLowerCase());
+}
+function linkParamValueToHtmlAttributes(link) {
+  var _a;
+  const result = {};
+  const href = linkParamValueToHref(link);
+  if (href) {
+    result.href = href;
+  }
+  if (!(link == null ? void 0 : link.attributes)) {
+    return result;
+  }
+  for (const [key, value] of Object.entries(link.attributes)) {
+    if (!key || typeof value !== "string") {
+      continue;
+    }
+    if (!SAFE_ATTRIBUTE_NAME_PATTERN.test(key)) {
+      continue;
+    }
+    if (EVENT_HANDLER_PATTERN.test(key)) {
+      continue;
+    }
+    if (DENYLIST_EXACT.has(key.toLowerCase())) {
+      continue;
+    }
+    if (hasDangerousScheme(value)) {
+      continue;
+    }
+    result[key] = value;
+  }
+  const targetEntry = Object.entries(result).find(([key]) => key.toLowerCase() === "target");
+  const hasRel = Object.keys(result).some((key) => key.toLowerCase() === "rel");
+  if (((_a = targetEntry == null ? void 0 : targetEntry[1]) == null ? void 0 : _a.toLowerCase()) === "_blank" && !hasRel) {
+    result.rel = "noopener noreferrer";
+  }
+  return result;
+}
+function linkParamValueToAnchorProps(link) {
+  const raw = linkParamValueToHtmlAttributes(link);
+  const result = {};
+  for (const [key, value] of Object.entries(raw)) {
+    if (key === "class") {
+      result["className"] = value;
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+}
 function linkParamValueToHref(link) {
   switch (link == null ? void 0 : link.type) {
     case "email":
@@ -113,8 +168,11 @@ function linkParamValueToHref(link) {
     case "tel":
       return `tel:${link.path}`;
     case "url":
-      return link.path;
     case "projectMapNode":
+      if (hasDangerousScheme(link.path)) {
+        console.warn(`[richtext] Dropped disallowed link URL scheme: "${link.path}"`);
+        return void 0;
+      }
       return link.path;
   }
 }
@@ -387,6 +445,17 @@ function renderChildrenToText(children, context) {
   return Array.isArray(children) ? children.map((node) => renderToText(node, context)).join("") : "";
 }
 
+// src/types.ts
+function resolveLinkAttrConfig(entry) {
+  var _a;
+  return {
+    key: entry.key,
+    options: entry.options,
+    label: (_a = entry.label) != null ? _a : entry.key,
+    helpText: entry.helpText
+  };
+}
+
 // src/utils.ts
 var walkRichTextTree = (node, callback, parent) => {
   if (!isRichTextNode(node)) {
@@ -548,6 +617,7 @@ export {
   hasChildren,
   headingHtmlRenderer,
   isArrayWithLength,
+  isDangerousLinkAttributeKey,
   isPureDirection,
   isPureTextAlign,
   isRichTextNode,
@@ -555,7 +625,9 @@ export {
   isRichTextValue,
   isRichTextValueConsideredEmpty,
   linkHtmlRenderer,
+  linkParamValueToAnchorProps,
   linkParamValueToHref,
+  linkParamValueToHtmlAttributes,
   listHtmlRenderer,
   listitemHtmlRenderer,
   paragraphHtmlRenderer,
@@ -567,6 +639,7 @@ export {
   renderToText,
   resolveDefaultRenderer as resolveDefaultHtmlRenderer,
   resolveDefaultRenderer2 as resolveDefaultTextRenderer,
+  resolveLinkAttrConfig,
   richTextBuiltInElements,
   richTextBuiltInFormats,
   rootHtmlRenderer,

package/dist/index.js

@@ -30,6 +30,7 @@ __export(index_exports, {
   hasChildren: () => hasChildren,
   headingHtmlRenderer: () => headingHtmlRenderer,
   isArrayWithLength: () => isArrayWithLength,
+  isDangerousLinkAttributeKey: () => isDangerousLinkAttributeKey,
   isPureDirection: () => isPureDirection,
   isPureTextAlign: () => isPureTextAlign,
   isRichTextNode: () => isRichTextNode,
@@ -37,7 +38,9 @@ __export(index_exports, {
   isRichTextValue: () => isRichTextValue,
   isRichTextValueConsideredEmpty: () => isRichTextValueConsideredEmpty,
   linkHtmlRenderer: () => linkHtmlRenderer,
+  linkParamValueToAnchorProps: () => linkParamValueToAnchorProps,
   linkParamValueToHref: () => linkParamValueToHref,
+  linkParamValueToHtmlAttributes: () => linkParamValueToHtmlAttributes,
   listHtmlRenderer: () => listHtmlRenderer,
   listitemHtmlRenderer: () => listitemHtmlRenderer,
   paragraphHtmlRenderer: () => paragraphHtmlRenderer,
@@ -49,6 +52,7 @@ __export(index_exports, {
   renderToText: () => renderToText,
   resolveDefaultHtmlRenderer: () => resolveDefaultRenderer,
   resolveDefaultTextRenderer: () => resolveDefaultRenderer2,
+  resolveLinkAttrConfig: () => resolveLinkAttrConfig,
   richTextBuiltInElements: () => richTextBuiltInElements,
   richTextBuiltInFormats: () => richTextBuiltInFormats,
   rootHtmlRenderer: () => rootHtmlRenderer,
@@ -91,7 +95,7 @@ var voidElements = /* @__PURE__ */ new Set([
   "wbr"
 ]);
 function renderHtmlElement(tag, attributes, children) {
-  const attributesString = attributes && attributes.size > 0 ? " " + Array.from(attributes).reduce((result, [key, value]) => [...result, `${key}="${value}"`], []).join(" ") : "";
+  const attributesString = attributes && attributes.size > 0 ? " " + Array.from(attributes).reduce((result, [key, value]) => [...result, `${key}="${purifyText(value)}"`], []).join(" ") : "";
   return voidElements.has(tag) ? `<${tag}${attributesString}>` : `<${tag}${attributesString}>${children != null ? children : ""}</${tag}>`;
 }
 
@@ -161,13 +165,68 @@ var headingTextRenderer = ({ context, renderChildren }) => {
 // src/nodes/link.ts
 var linkHtmlRenderer = ({ context, renderChildren }) => {
   const node = context.currentNode;
-  const attributes = /* @__PURE__ */ new Map();
-  const href = linkParamValueToHref(node.link);
-  if (href) {
-    attributes.set("href", href);
-  }
+  const htmlAttrs = linkParamValueToHtmlAttributes(node.link);
+  const attributes = new Map(Object.entries(htmlAttrs));
   return renderHtmlElement("a", attributes, renderChildren(context.currentNode.children));
 };
+var DENYLIST_EXACT = /* @__PURE__ */ new Set(["href", "src", "style", "formaction"]);
+var EVENT_HANDLER_PATTERN = /^on/i;
+var SAFE_ATTRIBUTE_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9:_.-]*$/;
+var DANGEROUS_SCHEME_PATTERN = /^(?:javascript|data|vbscript):/i;
+function hasDangerousScheme(value) {
+  const normalized = value.replace(/[\u0000-\u0020\u007f-\u00a0]+/g, "").toLowerCase();
+  return DANGEROUS_SCHEME_PATTERN.test(normalized);
+}
+function isDangerousLinkAttributeKey(key) {
+  return EVENT_HANDLER_PATTERN.test(key) || DENYLIST_EXACT.has(key.toLowerCase());
+}
+function linkParamValueToHtmlAttributes(link) {
+  var _a;
+  const result = {};
+  const href = linkParamValueToHref(link);
+  if (href) {
+    result.href = href;
+  }
+  if (!(link == null ? void 0 : link.attributes)) {
+    return result;
+  }
+  for (const [key, value] of Object.entries(link.attributes)) {
+    if (!key || typeof value !== "string") {
+      continue;
+    }
+    if (!SAFE_ATTRIBUTE_NAME_PATTERN.test(key)) {
+      continue;
+    }
+    if (EVENT_HANDLER_PATTERN.test(key)) {
+      continue;
+    }
+    if (DENYLIST_EXACT.has(key.toLowerCase())) {
+      continue;
+    }
+    if (hasDangerousScheme(value)) {
+      continue;
+    }
+    result[key] = value;
+  }
+  const targetEntry = Object.entries(result).find(([key]) => key.toLowerCase() === "target");
+  const hasRel = Object.keys(result).some((key) => key.toLowerCase() === "rel");
+  if (((_a = targetEntry == null ? void 0 : targetEntry[1]) == null ? void 0 : _a.toLowerCase()) === "_blank" && !hasRel) {
+    result.rel = "noopener noreferrer";
+  }
+  return result;
+}
+function linkParamValueToAnchorProps(link) {
+  const raw = linkParamValueToHtmlAttributes(link);
+  const result = {};
+  for (const [key, value] of Object.entries(raw)) {
+    if (key === "class") {
+      result["className"] = value;
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+}
 function linkParamValueToHref(link) {
   switch (link == null ? void 0 : link.type) {
     case "email":
@@ -175,8 +234,11 @@ function linkParamValueToHref(link) {
     case "tel":
       return `tel:${link.path}`;
     case "url":
-      return link.path;
     case "projectMapNode":
+      if (hasDangerousScheme(link.path)) {
+        console.warn(`[richtext] Dropped disallowed link URL scheme: "${link.path}"`);
+        return void 0;
+      }
       return link.path;
   }
 }
@@ -449,6 +511,17 @@ function renderChildrenToText(children, context) {
   return Array.isArray(children) ? children.map((node) => renderToText(node, context)).join("") : "";
 }
 
+// src/types.ts
+function resolveLinkAttrConfig(entry) {
+  var _a;
+  return {
+    key: entry.key,
+    options: entry.options,
+    label: (_a = entry.label) != null ? _a : entry.key,
+    helpText: entry.helpText
+  };
+}
+
 // src/utils.ts
 var walkRichTextTree = (node, callback, parent) => {
   if (!isRichTextNode(node)) {
@@ -611,6 +684,7 @@ var defaultParameterConfiguration = {
   hasChildren,
   headingHtmlRenderer,
   isArrayWithLength,
+  isDangerousLinkAttributeKey,
   isPureDirection,
   isPureTextAlign,
   isRichTextNode,
@@ -618,7 +692,9 @@ var defaultParameterConfiguration = {
   isRichTextValue,
   isRichTextValueConsideredEmpty,
   linkHtmlRenderer,
+  linkParamValueToAnchorProps,
   linkParamValueToHref,
+  linkParamValueToHtmlAttributes,
   listHtmlRenderer,
   listitemHtmlRenderer,
   paragraphHtmlRenderer,
@@ -630,6 +706,7 @@ var defaultParameterConfiguration = {
   renderToText,
   resolveDefaultHtmlRenderer,
   resolveDefaultTextRenderer,
+  resolveLinkAttrConfig,
   richTextBuiltInElements,
   richTextBuiltInFormats,
   rootHtmlRenderer,

package/dist/index.mjs

@@ -29,7 +29,7 @@ var voidElements = /* @__PURE__ */ new Set([
   "wbr"
 ]);
 function renderHtmlElement(tag, attributes, children) {
-  const attributesString = attributes && attributes.size > 0 ? " " + Array.from(attributes).reduce((result, [key, value]) => [...result, `${key}="${value}"`], []).join(" ") : "";
+  const attributesString = attributes && attributes.size > 0 ? " " + Array.from(attributes).reduce((result, [key, value]) => [...result, `${key}="${purifyText(value)}"`], []).join(" ") : "";
   return voidElements.has(tag) ? `<${tag}${attributesString}>` : `<${tag}${attributesString}>${children != null ? children : ""}</${tag}>`;
 }
 
@@ -99,13 +99,68 @@ var headingTextRenderer = ({ context, renderChildren }) => {
 // src/nodes/link.ts
 var linkHtmlRenderer = ({ context, renderChildren }) => {
   const node = context.currentNode;
-  const attributes = /* @__PURE__ */ new Map();
-  const href = linkParamValueToHref(node.link);
-  if (href) {
-    attributes.set("href", href);
-  }
+  const htmlAttrs = linkParamValueToHtmlAttributes(node.link);
+  const attributes = new Map(Object.entries(htmlAttrs));
   return renderHtmlElement("a", attributes, renderChildren(context.currentNode.children));
 };
+var DENYLIST_EXACT = /* @__PURE__ */ new Set(["href", "src", "style", "formaction"]);
+var EVENT_HANDLER_PATTERN = /^on/i;
+var SAFE_ATTRIBUTE_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9:_.-]*$/;
+var DANGEROUS_SCHEME_PATTERN = /^(?:javascript|data|vbscript):/i;
+function hasDangerousScheme(value) {
+  const normalized = value.replace(/[\u0000-\u0020\u007f-\u00a0]+/g, "").toLowerCase();
+  return DANGEROUS_SCHEME_PATTERN.test(normalized);
+}
+function isDangerousLinkAttributeKey(key) {
+  return EVENT_HANDLER_PATTERN.test(key) || DENYLIST_EXACT.has(key.toLowerCase());
+}
+function linkParamValueToHtmlAttributes(link) {
+  var _a;
+  const result = {};
+  const href = linkParamValueToHref(link);
+  if (href) {
+    result.href = href;
+  }
+  if (!(link == null ? void 0 : link.attributes)) {
+    return result;
+  }
+  for (const [key, value] of Object.entries(link.attributes)) {
+    if (!key || typeof value !== "string") {
+      continue;
+    }
+    if (!SAFE_ATTRIBUTE_NAME_PATTERN.test(key)) {
+      continue;
+    }
+    if (EVENT_HANDLER_PATTERN.test(key)) {
+      continue;
+    }
+    if (DENYLIST_EXACT.has(key.toLowerCase())) {
+      continue;
+    }
+    if (hasDangerousScheme(value)) {
+      continue;
+    }
+    result[key] = value;
+  }
+  const targetEntry = Object.entries(result).find(([key]) => key.toLowerCase() === "target");
+  const hasRel = Object.keys(result).some((key) => key.toLowerCase() === "rel");
+  if (((_a = targetEntry == null ? void 0 : targetEntry[1]) == null ? void 0 : _a.toLowerCase()) === "_blank" && !hasRel) {
+    result.rel = "noopener noreferrer";
+  }
+  return result;
+}
+function linkParamValueToAnchorProps(link) {
+  const raw = linkParamValueToHtmlAttributes(link);
+  const result = {};
+  for (const [key, value] of Object.entries(raw)) {
+    if (key === "class") {
+      result["className"] = value;
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+}
 function linkParamValueToHref(link) {
   switch (link == null ? void 0 : link.type) {
     case "email":
@@ -113,8 +168,11 @@ function linkParamValueToHref(link) {
     case "tel":
       return `tel:${link.path}`;
     case "url":
-      return link.path;
     case "projectMapNode":
+      if (hasDangerousScheme(link.path)) {
+        console.warn(`[richtext] Dropped disallowed link URL scheme: "${link.path}"`);
+        return void 0;
+      }
       return link.path;
   }
 }
@@ -387,6 +445,17 @@ function renderChildrenToText(children, context) {
   return Array.isArray(children) ? children.map((node) => renderToText(node, context)).join("") : "";
 }
 
+// src/types.ts
+function resolveLinkAttrConfig(entry) {
+  var _a;
+  return {
+    key: entry.key,
+    options: entry.options,
+    label: (_a = entry.label) != null ? _a : entry.key,
+    helpText: entry.helpText
+  };
+}
+
 // src/utils.ts
 var walkRichTextTree = (node, callback, parent) => {
   if (!isRichTextNode(node)) {
@@ -548,6 +617,7 @@ export {
   hasChildren,
   headingHtmlRenderer,
   isArrayWithLength,
+  isDangerousLinkAttributeKey,
   isPureDirection,
   isPureTextAlign,
   isRichTextNode,
@@ -555,7 +625,9 @@ export {
   isRichTextValue,
   isRichTextValueConsideredEmpty,
   linkHtmlRenderer,
+  linkParamValueToAnchorProps,
   linkParamValueToHref,
+  linkParamValueToHtmlAttributes,
   listHtmlRenderer,
   listitemHtmlRenderer,
   paragraphHtmlRenderer,
@@ -567,6 +639,7 @@ export {
   renderToText,
   resolveDefaultRenderer as resolveDefaultHtmlRenderer,
   resolveDefaultRenderer2 as resolveDefaultTextRenderer,
+  resolveLinkAttrConfig,
   richTextBuiltInElements,
   richTextBuiltInFormats,
   rootHtmlRenderer,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniformdev/richtext",
-  "version": "20.72.2-alpha.3+a1f072e7b4",
+  "version": "20.72.3-alpha.14+1e232e59cd",
   "description": "Common functionality and types for Uniform Rich Text parameters",
   "license": "SEE LICENSE IN LICENSE.txt",
   "main": "./dist/index.js",
@@ -44,7 +44,7 @@
     "@lexical/link": "0.45.0",
     "@lexical/list": "0.45.0",
     "@lexical/rich-text": "0.45.0",
-    "@uniformdev/assets": "20.72.2-alpha.3+a1f072e7b4",
+    "@uniformdev/assets": "20.72.3-alpha.14+1e232e59cd",
     "lexical": "0.45.0"
   },
   "files": [
@@ -53,5 +53,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "a1f072e7b42ac4b3c694ebdd2e75216efd74a9c2"
+  "gitHead": "1e232e59cd3ded97b85b063986cc95e954b8c937"
 }