@wakastellar/ui 2.1.2 → 2.3.2

package/dist/utils/security.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Security utilities for sanitizing user input and preventing XSS/injection attacks.
+ *
+ * @module security
+ */
+/**
+ * Validates and sanitizes a URL to prevent javascript: protocol attacks.
+ *
+ * @param url - The URL to validate
+ * @returns The sanitized URL if safe, or undefined if potentially malicious
+ *
+ * @example
+ * ```ts
+ * const safeUrl = sanitizeUrl("https://example.com") // "https://example.com"
+ * const blocked = sanitizeUrl("javascript:alert(1)") // undefined
+ * ```
+ *
+ * @security
+ * This function blocks:
+ * - javascript: protocol URLs
+ * - data: protocol URLs (except data:image for specific use cases)
+ * - vbscript: protocol URLs
+ * - URLs with encoded dangerous protocols
+ */
+export declare function sanitizeUrl(url: string | undefined | null): string | undefined;
+/**
+ * Safely navigates to a URL after validation.
+ * Use this instead of directly assigning to window.location.href.
+ *
+ * @param url - The URL to navigate to
+ * @returns true if navigation was performed, false if blocked
+ *
+ * @example
+ * ```ts
+ * // Safe navigation
+ * safeNavigate("https://example.com") // navigates
+ * safeNavigate("javascript:alert(1)") // blocked, returns false
+ * ```
+ */
+export declare function safeNavigate(url: string | undefined | null): boolean;
+/**
+ * Escapes special regex characters in a string.
+ * Use this when creating RegExp from user input to prevent ReDoS attacks.
+ *
+ * @param str - The string to escape
+ * @returns The escaped string safe for use in RegExp
+ *
+ * @example
+ * ```ts
+ * const pattern = escapeRegex("user.name") // "user\\.name"
+ * const regex = new RegExp(pattern, "i")
+ * ```
+ *
+ * @security
+ * This prevents:
+ * - ReDoS (Regular Expression Denial of Service) attacks
+ * - Unintended regex matching due to special characters
+ */
+export declare function escapeRegex(str: string): string;
+/**
+ * Creates a safe RegExp from user input by escaping special characters.
+ *
+ * @param pattern - The pattern string (will be escaped)
+ * @param flags - Optional regex flags
+ * @returns A safe RegExp instance
+ *
+ * @example
+ * ```ts
+ * const regex = createSafeRegex("search.term", "gi")
+ * // Matches literal "search.term" not "search" + any char + "term"
+ * ```
+ */
+export declare function createSafeRegex(pattern: string, flags?: string): RegExp;
+/**
+ * Creates a RegExp for highlighting text in search results.
+ * Escapes the search term and wraps in capture group for splitting.
+ *
+ * @param searchTerm - The term to highlight
+ * @returns A case-insensitive RegExp for highlighting
+ *
+ * @example
+ * ```ts
+ * const regex = createHighlightRegex("search")
+ * const parts = "Search results".split(regex)
+ * // ["", "Search", " results"]
+ * ```
+ */
+export declare function createHighlightRegex(searchTerm: string): RegExp;
+/**
+ * Sanitizes HTML content by escaping dangerous characters.
+ * Use when displaying user-generated content.
+ *
+ * @param html - The HTML string to sanitize
+ * @returns Escaped HTML safe for display
+ */
+export declare function escapeHtml(html: string): string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wakastellar/ui",
-  "version": "2.1.2",
+  "version": "2.3.2",
   "description": "Zero-config UI Library for Next.js with TweakCN theming and i18n support",
   "keywords": [
     "ui",
@@ -107,7 +107,7 @@
     "@tiptap/extension-underline": "^2.0.0 || ^3.0.0",
     "@tiptap/react": "^2.0.0 || ^3.0.0",
     "@tiptap/starter-kit": "^2.0.0 || ^3.0.0",
-    "jspdf": "*",
+    "jspdf": ">=4.0.0",
     "jspdf-autotable": "*",
     "next": ">=14.0.0",
     "react": ">=18.0.0",
@@ -165,12 +165,12 @@
     "@vitest/coverage-v8": "^3.2.4",
     "@vitest/ui": "^3.2.4",
     "autoprefixer": "^10.4.16",
-    "esbuild": "^0.24.2",
+    "esbuild": "^0.25.0",
     "jsdom": "^23.0.1",
     "playwright": "^1.56.0",
     "postcss": "^8.4.31",
     "react-hook-form": "^7.70.0",
-    "storybook": "^9.1.10",
+    "storybook": "^9.1.17",
     "tailwindcss": "^4.1.8",
     "typescript": "^5.5.0",
     "vite": "^7.1.9",