@wavemaker-ai/react-runtime 1.0.0-rc.312 → 1.0.0-rc.317

package/core/formatter/security-formatters.js

@@ -1,321 +1,271 @@
-"use strict";
-
-var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");
-var _typeof3 = require("@babel/runtime/helpers/typeof");
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.TrustedContent = exports.TrustAsFormatter = exports.SanitizeFormatter = void 0;
-var _typeof2 = _interopRequireDefault(require("@babel/runtime/helpers/typeof"));
-var _classCallCheck2 = _interopRequireDefault(require("@babel/runtime/helpers/classCallCheck"));
-var _createClass2 = _interopRequireDefault(require("@babel/runtime/helpers/createClass"));
-var _dompurify = _interopRequireDefault(require("dompurify"));
-var React = _interopRequireWildcard(require("react"));
-var _types = require("./types");
-function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function _interopRequireWildcard(e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, "default": e }; if (null === e || "object" != _typeof3(e) && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (var _t2 in e) "default" !== _t2 && {}.hasOwnProperty.call(e, _t2) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, _t2)) && (i.get || i.set) ? o(f, _t2, i) : f[_t2] = e[_t2]); return f; })(e, t); }
-// @ts-ignore
-var TrustAsFormatter = exports.TrustAsFormatter = /*#__PURE__*/function () {
-  function TrustAsFormatter() {
-    (0, _classCallCheck2["default"])(this, TrustAsFormatter);
-  }
-  return (0, _createClass2["default"])(TrustAsFormatter, [{
-    key: "format",
-    value: function format(content) {
-      var context = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : "html";
-      if (content === null || content === undefined) {
-        return "";
-      }
-
-      // Convert context to string if it's a SecurityContext enum
-      var contextStr;
-      switch (context) {
-        case "html":
-        case _types.SecurityContext.HTML:
-          contextStr = "html";
-          break;
-        case "style":
-        case _types.SecurityContext.STYLE:
-          contextStr = "style";
-          break;
-        case "script":
-        case _types.SecurityContext.SCRIPT:
-          contextStr = "script";
-          break;
-        case "url":
-        case _types.SecurityContext.URL:
-          contextStr = "url";
-          break;
-        case "resource":
-        case "resourceUrl":
-        case _types.SecurityContext.RESOURCE_URL:
-          contextStr = "resource";
-          break;
-        default:
-          contextStr = "html";
-      }
-
-      // Return trusted value directly based on context
-      switch (contextStr) {
-        case "html":
-          return this.bypassSecurityTrustHtml(content);
-        case "style":
-          return this.bypassSecurityTrustStyle(content);
-        case "script":
-          return this.bypassSecurityTrustScript(content);
-        case "url":
-          return this.bypassSecurityTrustUrl(content);
-        case "resource":
-          return this.bypassSecurityTrustResourceUrl(content);
-        default:
-          return content;
-      }
+import DOMPurify from "dompurify";
+import * as React from "react";
+import {
+  SecurityContext
+} from "./types";
+class TrustAsFormatter {
+  format(content, context = "html") {
+    if (content === null || content === void 0) {
+      return "";
     }
-  }, {
-    key: "bypassSecurityTrustHtml",
-    value: function bypassSecurityTrustHtml(value) {
-      return value;
+    let contextStr;
+    switch (context) {
+      case "html":
+      case SecurityContext.HTML:
+        contextStr = "html";
+        break;
+      case "style":
+      case SecurityContext.STYLE:
+        contextStr = "style";
+        break;
+      case "script":
+      case SecurityContext.SCRIPT:
+        contextStr = "script";
+        break;
+      case "url":
+      case SecurityContext.URL:
+        contextStr = "url";
+        break;
+      case "resource":
+      case "resourceUrl":
+      case SecurityContext.RESOURCE_URL:
+        contextStr = "resource";
+        break;
+      default:
+        contextStr = "html";
     }
-  }, {
-    key: "bypassSecurityTrustStyle",
-    value: function bypassSecurityTrustStyle(value) {
-      return value;
+    switch (contextStr) {
+      case "html":
+        return this.bypassSecurityTrustHtml(content);
+      case "style":
+        return this.bypassSecurityTrustStyle(content);
+      case "script":
+        return this.bypassSecurityTrustScript(content);
+      case "url":
+        return this.bypassSecurityTrustUrl(content);
+      case "resource":
+        return this.bypassSecurityTrustResourceUrl(content);
+      default:
+        return content;
     }
-  }, {
-    key: "bypassSecurityTrustScript",
-    value: function bypassSecurityTrustScript(value) {
-      console.warn("Bypassing script security. Make sure you trust the content.");
+  }
+  bypassSecurityTrustHtml(value) {
+    return value;
+  }
+  bypassSecurityTrustStyle(value) {
+    return value;
+  }
+  bypassSecurityTrustScript(value) {
+    console.warn("Bypassing script security. Make sure you trust the content.");
+    return value;
+  }
+  bypassSecurityTrustUrl(value) {
+    try {
+      new URL(value, typeof window !== "undefined" ? window.location.origin : "http://localhost");
       return value;
+    } catch (e) {
+      console.warn("Invalid URL provided to trustAs formatter:", value);
+      return "";
     }
-  }, {
-    key: "bypassSecurityTrustUrl",
-    value: function bypassSecurityTrustUrl(value) {
-      // Basic URL validation
-      try {
-        new URL(value, typeof window !== "undefined" ? window.location.origin : "http://localhost");
-        return value;
-      } catch (_unused) {
-        console.warn("Invalid URL provided to trustAs formatter:", value);
-        return "";
-      }
+  }
+  bypassSecurityTrustResourceUrl(value) {
+    try {
+      new URL(value, typeof window !== "undefined" ? window.location.origin : "http://localhost");
+      return value;
+    } catch (e) {
+      console.warn("Invalid resource URL provided to trustAs formatter:", value);
+      return "";
     }
-  }, {
-    key: "bypassSecurityTrustResourceUrl",
-    value: function bypassSecurityTrustResourceUrl(value) {
-      // Basic URL validation for resource URLs
-      try {
-        new URL(value, typeof window !== "undefined" ? window.location.origin : "http://localhost");
-        return value;
-      } catch (_unused2) {
-        console.warn("Invalid resource URL provided to trustAs formatter:", value);
-        return "";
-      }
+  }
+  // Helper method to check if a value is trusted
+  static isTrustedValue(value) {
+    return value && typeof value === "object" && "__trustAs" in value && "__trustedValue" in value;
+  }
+  // Helper method to extract trusted value
+  static getTrustedValue(value) {
+    if (this.isTrustedValue(value)) {
+      return value.__trustedValue;
     }
-
-    // Helper method to check if a value is trusted
-  }], [{
-    key: "isTrustedValue",
-    value: function isTrustedValue(value) {
-      return value && (0, _typeof2["default"])(value) === "object" && "__trustAs" in value && "__trustedValue" in value;
+    return value;
+  }
+  // Helper method to get trust type
+  static getTrustType(value) {
+    if (this.isTrustedValue(value)) {
+      return value.__trustAs;
     }
-
-    // Helper method to extract trusted value
-  }, {
-    key: "getTrustedValue",
-    value: function getTrustedValue(value) {
-      if (this.isTrustedValue(value)) {
-        return value.__trustedValue;
-      }
-      return value;
+    return null;
+  }
+}
+class SanitizeFormatter {
+  format(input, sanitizeType = "html") {
+    if (!input) return input;
+    if (TrustAsFormatter.isTrustedValue(input)) {
+      return TrustAsFormatter.getTrustedValue(input);
     }
-
-    // Helper method to get trust type
-  }, {
-    key: "getTrustType",
-    value: function getTrustType(value) {
-      if (this.isTrustedValue(value)) {
-        return value.__trustAs;
-      }
-      return null;
+    switch (sanitizeType) {
+      case "html":
+        return this.sanitizeHtml(input);
+      case "script":
+        return "";
+      case "style":
+        return this.sanitizeStyle(input);
+      case "url":
+      case "resourceUrl":
+        return this.sanitizeUrl(input);
+      default:
+        return this.sanitizeHtml(input);
     }
-  }]);
-}();
-var SanitizeFormatter = exports.SanitizeFormatter = /*#__PURE__*/function () {
-  function SanitizeFormatter() {
-    (0, _classCallCheck2["default"])(this, SanitizeFormatter);
   }
-  return (0, _createClass2["default"])(SanitizeFormatter, [{
-    key: "format",
-    value: function format(input) {
-      var sanitizeType = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : "html";
-      if (!input) return input;
-
-      // Check if input is already trusted - if so, return the trusted value
-      if (TrustAsFormatter.isTrustedValue(input)) {
-        return TrustAsFormatter.getTrustedValue(input);
-      }
-      switch (sanitizeType) {
-        case "html":
-          return this.sanitizeHtml(input);
-        case "script":
-          // Scripts should be completely removed for security
-          return "";
-        case "style":
-          return this.sanitizeStyle(input);
-        case "url":
-        case "resourceUrl":
-          return this.sanitizeUrl(input);
-        default:
-          return this.sanitizeHtml(input);
-        // Default to HTML sanitization
-      }
-    }
-  }, {
-    key: "sanitizeHtml",
-    value: function sanitizeHtml(html) {
-      try {
-        // Check if we're in a browser environment and DOMPurify is available
-        if (typeof window !== "undefined" && _dompurify["default"] && typeof _dompurify["default"].sanitize === "function") {
-          // Use DOMPurify for robust HTML sanitization
-          // Configure DOMPurify to allow common safe tags and attributes
-          var cleanHtml = _dompurify["default"].sanitize(html, {
-            ALLOWED_TAGS: ["p", "div", "span", "a", "strong", "em", "u", "b", "i", "ul", "ol", "li", "br", "h1", "h2", "h3", "h4", "h5", "h6", "blockquote", "pre", "code", "table", "thead", "tbody", "tr", "td", "th", "img", "video", "audio", "source"],
-            ALLOWED_ATTR: ["href", "title", "alt", "src", "width", "height", "class", "id", "style", "target", "rel", "data-*"],
-            ALLOW_DATA_ATTR: true,
-            ALLOWED_URI_REGEXP: /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|cid|xmpp|data):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i
-          });
-          return cleanHtml;
-        } else {
-          // Fallback to basic sanitization if DOMPurify is not available (e.g., in Node.js)
-          return this.basicHtmlSanitization(html);
-        }
-      } catch (error) {
-        console.error("HTML sanitization failed:", error);
-        // Fallback to basic sanitization if DOMPurify fails
+  sanitizeHtml(html) {
+    try {
+      if (typeof window !== "undefined" && DOMPurify && typeof DOMPurify.sanitize === "function") {
+        const cleanHtml = DOMPurify.sanitize(html, {
+          ALLOWED_TAGS: [
+            "p",
+            "div",
+            "span",
+            "a",
+            "strong",
+            "em",
+            "u",
+            "b",
+            "i",
+            "ul",
+            "ol",
+            "li",
+            "br",
+            "h1",
+            "h2",
+            "h3",
+            "h4",
+            "h5",
+            "h6",
+            "blockquote",
+            "pre",
+            "code",
+            "table",
+            "thead",
+            "tbody",
+            "tr",
+            "td",
+            "th",
+            "img",
+            "video",
+            "audio",
+            "source"
+          ],
+          ALLOWED_ATTR: [
+            "href",
+            "title",
+            "alt",
+            "src",
+            "width",
+            "height",
+            "class",
+            "id",
+            "style",
+            "target",
+            "rel",
+            "data-*"
+          ],
+          ALLOW_DATA_ATTR: true,
+          ALLOWED_URI_REGEXP: /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|cid|xmpp|data):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i
+        });
+        return cleanHtml;
+      } else {
         return this.basicHtmlSanitization(html);
       }
+    } catch (error) {
+      console.error("HTML sanitization failed:", error);
+      return this.basicHtmlSanitization(html);
     }
-  }, {
-    key: "basicHtmlSanitization",
-    value: function basicHtmlSanitization(html) {
-      // Fallback basic HTML sanitization
-      return html.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, "").replace(/\s*on\w+\s*=\s*["'][^"']*["']/gi, "") // Remove event handlers
-      .replace(/\s*javascript:\s*[^"'\s>]*/gi, "") // Remove javascript: URLs
-      .replace(/<iframe\b[^>]*>/gi, "") // Remove iframes
-      .replace(/<object\b[^>]*>/gi, "") // Remove objects
-      .replace(/<embed\b[^>]*>/gi, ""); // Remove embeds
-    }
-  }, {
-    key: "sanitizeStyle",
-    value: function sanitizeStyle(style) {
-      try {
-        // Check if we're in a browser environment and DOMPurify is available
-        if (typeof window !== "undefined" && _dompurify["default"] && typeof _dompurify["default"].sanitize === "function") {
-          // Use DOMPurify for CSS sanitization
-          var cleanStyle = _dompurify["default"].sanitize("<div style=\"".concat(style, "\"></div>"), {
-            ALLOWED_TAGS: ["div"],
-            ALLOWED_ATTR: ["style"]
-          });
-
-          // Extract the style attribute value
-          var match = cleanStyle.match(/style="([^"]*)"/);
-          return match ? match[1] : "";
-        } else {
-          // Fallback to basic style sanitization
-          return style.replace(/expression\s*\(/gi, "").replace(/javascript:/gi, "").replace(/url\s*\(\s*["']?\s*javascript:/gi, "");
-        }
-      } catch (error) {
-        console.error("Style sanitization failed:", error);
-        // Fallback to basic style sanitization
+  }
+  basicHtmlSanitization(html) {
+    return html.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, "").replace(/\s*on\w+\s*=\s*["'][^"']*["']/gi, "").replace(/\s*javascript:\s*[^"'\s>]*/gi, "").replace(/<iframe\b[^>]*>/gi, "").replace(/<object\b[^>]*>/gi, "").replace(/<embed\b[^>]*>/gi, "");
+  }
+  sanitizeStyle(style) {
+    try {
+      if (typeof window !== "undefined" && DOMPurify && typeof DOMPurify.sanitize === "function") {
+        const cleanStyle = DOMPurify.sanitize(`<div style="${style}"></div>`, {
+          ALLOWED_TAGS: ["div"],
+          ALLOWED_ATTR: ["style"]
+        });
+        const match = cleanStyle.match(/style="([^"]*)"/);
+        return match ? match[1] : "";
+      } else {
         return style.replace(/expression\s*\(/gi, "").replace(/javascript:/gi, "").replace(/url\s*\(\s*["']?\s*javascript:/gi, "");
       }
+    } catch (error) {
+      console.error("Style sanitization failed:", error);
+      return style.replace(/expression\s*\(/gi, "").replace(/javascript:/gi, "").replace(/url\s*\(\s*["']?\s*javascript:/gi, "");
     }
-  }, {
-    key: "sanitizeUrl",
-    value: function sanitizeUrl(url) {
-      try {
-        // Check if we're in a browser environment and DOMPurify is available
-        if (typeof window !== "undefined" && _dompurify["default"] && typeof _dompurify["default"].sanitize === "function") {
-          // Use DOMPurify for URL sanitization
-          var cleanUrl = _dompurify["default"].sanitize("<a href=\"".concat(url, "\"></a>"), {
-            ALLOWED_TAGS: ["a"],
-            ALLOWED_ATTR: ["href"]
-          });
-
-          // Extract the href attribute value
-          var match = cleanUrl.match(/href="([^"]*)"/);
-          var sanitizedUrl = match ? match[1] : "";
-
-          // Additional validation
-          if (sanitizedUrl && this.isValidUrl(sanitizedUrl)) {
-            return sanitizedUrl;
-          }
-          return "";
-        } else {
-          // Fallback to basic URL validation
-          return this.basicUrlSanitization(url);
+  }
+  sanitizeUrl(url) {
+    try {
+      if (typeof window !== "undefined" && DOMPurify && typeof DOMPurify.sanitize === "function") {
+        const cleanUrl = DOMPurify.sanitize(`<a href="${url}"></a>`, {
+          ALLOWED_TAGS: ["a"],
+          ALLOWED_ATTR: ["href"]
+        });
+        const match = cleanUrl.match(/href="([^"]*)"/);
+        const sanitizedUrl = match ? match[1] : "";
+        if (sanitizedUrl && this.isValidUrl(sanitizedUrl)) {
+          return sanitizedUrl;
         }
-      } catch (error) {
-        console.error("URL sanitization failed:", error);
-        // Fallback to basic URL validation
+        return "";
+      } else {
         return this.basicUrlSanitization(url);
       }
+    } catch (error) {
+      console.error("URL sanitization failed:", error);
+      return this.basicUrlSanitization(url);
     }
-  }, {
-    key: "basicUrlSanitization",
-    value: function basicUrlSanitization(url) {
-      // Allow only safe URL schemes
-      var safeSchemes = /^(https?|ftp|mailto|tel):/i;
-      var dataScheme = /^data:[^;]+;base64,/i;
-      if (safeSchemes.test(url) || dataScheme.test(url) || url.startsWith("/") || url.startsWith("./") || url.startsWith("../")) {
-        return url;
-      }
-
-      // If URL doesn't match safe patterns, return empty string
-      return "";
+  }
+  basicUrlSanitization(url) {
+    const safeSchemes = /^(https?|ftp|mailto|tel):/i;
+    const dataScheme = /^data:[^;]+;base64,/i;
+    if (safeSchemes.test(url) || dataScheme.test(url) || url.startsWith("/") || url.startsWith("./") || url.startsWith("../")) {
+      return url;
     }
-  }, {
-    key: "isValidUrl",
-    value: function isValidUrl(url) {
-      try {
-        var urlObj = new URL(url, typeof window !== "undefined" ? window.location.origin : "http://localhost");
-        var allowedProtocols = ["http:", "https:", "mailto:", "tel:", "ftp:"];
-        return allowedProtocols.includes(urlObj.protocol);
-      } catch (_unused3) {
-        // Check for relative URLs
-        return url.startsWith("/") || url.startsWith("./") || url.startsWith("../");
-      }
+    return "";
+  }
+  isValidUrl(url) {
+    try {
+      const urlObj = new URL(
+        url,
+        typeof window !== "undefined" ? window.location.origin : "http://localhost"
+      );
+      const allowedProtocols = ["http:", "https:", "mailto:", "tel:", "ftp:"];
+      return allowedProtocols.includes(urlObj.protocol);
+    } catch (e) {
+      return url.startsWith("/") || url.startsWith("./") || url.startsWith("../");
     }
-  }]);
-}(); // React utility component to safely render trusted content
-var TrustedContent = exports.TrustedContent = function TrustedContent(_ref) {
-  var value = _ref.value,
-    _ref$fallback = _ref.fallback,
-    fallback = _ref$fallback === void 0 ? "" : _ref$fallback;
+  }
+}
+const TrustedContent = ({ value, fallback = "" }) => {
   if (TrustAsFormatter.isTrustedValue(value)) {
-    var trustType = TrustAsFormatter.getTrustType(value);
-    var trustedValue = TrustAsFormatter.getTrustedValue(value);
+    const trustType = TrustAsFormatter.getTrustType(value);
+    const trustedValue = TrustAsFormatter.getTrustedValue(value);
     switch (trustType) {
       case "html":
-        // For HTML content, use dangerouslySetInnerHTML
-        return /*#__PURE__*/React.createElement("div", {
-          dangerouslySetInnerHTML: {
-            __html: trustedValue
-          }
+        return React.createElement("div", {
+          dangerouslySetInnerHTML: { __html: trustedValue }
         });
       case "style":
-        // For style content, return as style attribute
-        return /*#__PURE__*/React.createElement("div", {
+        return React.createElement("div", {
           style: trustedValue
         });
       case "url":
       case "resource":
-        // For URLs, return as href or src depending on usage
         return trustedValue;
       default:
         return trustedValue || fallback;
     }
   }
-
-  // For non-trusted content, return as plain text or fallback
   return value || fallback;
-};
+};
+export {
+  SanitizeFormatter,
+  TrustAsFormatter,
+  TrustedContent
+};

package/core/formatter/string-formatters.js

@@ -1,49 +1,27 @@
-"use strict";
-
-var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.TemplateReplaceFormatter = exports.PrependFormatter = exports.AppendFormatter = void 0;
-var _classCallCheck2 = _interopRequireDefault(require("@babel/runtime/helpers/classCallCheck"));
-var _createClass2 = _interopRequireDefault(require("@babel/runtime/helpers/createClass"));
-var _util = require("../util");
-var PrependFormatter = exports.PrependFormatter = /*#__PURE__*/function () {
-  function PrependFormatter() {
-    (0, _classCallCheck2["default"])(this, PrependFormatter);
+import { replace } from "../util";
+class PrependFormatter {
+  format(input, prefix) {
+    return (prefix || "") + (input !== null || input != void 0 ? input : "");
   }
-  return (0, _createClass2["default"])(PrependFormatter, [{
-    key: "format",
-    value: function format(input, prefix) {
-      return (prefix || "") + (input !== null || input != undefined ? input : "");
-    }
-  }]);
-}();
-var AppendFormatter = exports.AppendFormatter = /*#__PURE__*/function () {
-  function AppendFormatter() {
-    (0, _classCallCheck2["default"])(this, AppendFormatter);
+}
+class AppendFormatter {
+  format(input, suffix) {
+    return (input !== null || input != void 0 ? input : "") + (suffix || "");
   }
-  return (0, _createClass2["default"])(AppendFormatter, [{
-    key: "format",
-    value: function format(input, suffix) {
-      return (input !== null || input != undefined ? input : "") + (suffix || "");
+}
+class TemplateReplaceFormatter {
+  format(template, replacements) {
+    if (!template) return template;
+    try {
+      return replace(template, replacements) || "";
+    } catch (error) {
+      console.error("Template replacement failed:", error);
+      return template;
     }
-  }]);
-}();
-var TemplateReplaceFormatter = exports.TemplateReplaceFormatter = /*#__PURE__*/function () {
-  function TemplateReplaceFormatter() {
-    (0, _classCallCheck2["default"])(this, TemplateReplaceFormatter);
   }
-  return (0, _createClass2["default"])(TemplateReplaceFormatter, [{
-    key: "format",
-    value: function format(template, replacements) {
-      if (!template) return template;
-      try {
-        return (0, _util.replace)(template, replacements) || "";
-      } catch (error) {
-        console.error("Template replacement failed:", error);
-        return template; // Return original template if replacement fails
-      }
-    }
-  }]);
-}();
+}
+export {
+  AppendFormatter,
+  PrependFormatter,
+  TemplateReplaceFormatter
+};