@wdprlib/ast 2.4.0 → 4.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/README.md +15 -0
  2. package/dist/index.cjs +1 -1
  3. package/dist/index.d.cts +4 -4
  4. package/dist/index.d.ts +4 -4
  5. package/dist/index.js +1 -1
  6. package/package.json +1 -1
  7. package/src/settings.ts +5 -5
package/README.md CHANGED
@@ -20,6 +20,21 @@ const tree: SyntaxTree = {
20
20
  };
21
21
  ```
22
22
 
23
+ ## Security-sensitive settings
24
+
25
+ `createSettings(mode)` supplies safe defaults for parser and renderer capabilities. In every mode,
26
+ including `"page"`, `allowStyleElements` defaults to `false` because `[[module CSS]]` affects the
27
+ entire host page. Callers may override it to `true` only for trusted CSS:
28
+
29
+ ```ts
30
+ import { createSettings } from "@wdprlib/ast";
31
+
32
+ const settings = {
33
+ ...createSettings("page"),
34
+ allowStyleElements: true,
35
+ };
36
+ ```
37
+
23
38
  ## Exports
24
39
 
25
40
  Types: `SyntaxTree`, `Element`, `ElementName`, `ContainerType`, `AttributeMap`, `LinkType`, `ListType`, `Module`, etc.
package/dist/index.cjs CHANGED
@@ -706,7 +706,7 @@ function createSettings(mode) {
706
706
  enablePageSyntax: true,
707
707
  allowLocalPaths: true,
708
708
  useTrueIds: true,
709
- allowStyleElements: true,
709
+ allowStyleElements: false,
710
710
  allowHtmlBlocks: true
711
711
  };
712
712
  case "draft":
package/dist/index.d.cts CHANGED
@@ -1262,7 +1262,7 @@ declare const STYLE_ANCHOR_PREFIX = "\0__STYLE_ANCHOR__";
1262
1262
  *
1263
1263
  * | Mode | Page syntax | Local paths | True IDs | Style elements | HTML blocks |
1264
1264
  * |--------------------|:-----------:|:-----------:|:--------:|:--------------:|:-----------:|
1265
- * | `"page"` | yes | yes | yes | yes | yes |
1265
+ * | `"page"` | yes | yes | yes | no | yes |
1266
1266
  * | `"draft"` | yes | yes | no | no | no |
1267
1267
  * | `"forum-post"` | no | no | no | no | no |
1268
1268
  * | `"direct-message"` | no | no | no | no | no |
@@ -1311,9 +1311,9 @@ interface WikitextSettings {
1311
1311
  /**
1312
1312
  * Whether `[[module CSS]]` blocks are rendered as `<style>` tags.
1313
1313
  *
1314
- * User-authored CSS can break page layout, so it is allowed only on
1315
- * full wiki pages. In draft previews, forum posts, and direct messages
1316
- * the CSS module is silently ignored.
1314
+ * User-authored CSS can break page layout and leak page data, so it is
1315
+ * disabled by default in every mode. Callers may explicitly enable it
1316
+ * only for trusted CSS.
1317
1317
  */
1318
1318
  allowStyleElements: boolean;
1319
1319
  /**
package/dist/index.d.ts CHANGED
@@ -1262,7 +1262,7 @@ declare const STYLE_ANCHOR_PREFIX = "\0__STYLE_ANCHOR__";
1262
1262
  *
1263
1263
  * | Mode | Page syntax | Local paths | True IDs | Style elements | HTML blocks |
1264
1264
  * |--------------------|:-----------:|:-----------:|:--------:|:--------------:|:-----------:|
1265
- * | `"page"` | yes | yes | yes | yes | yes |
1265
+ * | `"page"` | yes | yes | yes | no | yes |
1266
1266
  * | `"draft"` | yes | yes | no | no | no |
1267
1267
  * | `"forum-post"` | no | no | no | no | no |
1268
1268
  * | `"direct-message"` | no | no | no | no | no |
@@ -1311,9 +1311,9 @@ interface WikitextSettings {
1311
1311
  /**
1312
1312
  * Whether `[[module CSS]]` blocks are rendered as `<style>` tags.
1313
1313
  *
1314
- * User-authored CSS can break page layout, so it is allowed only on
1315
- * full wiki pages. In draft previews, forum posts, and direct messages
1316
- * the CSS module is silently ignored.
1314
+ * User-authored CSS can break page layout and leak page data, so it is
1315
+ * disabled by default in every mode. Callers may explicitly enable it
1316
+ * only for trusted CSS.
1317
1317
  */
1318
1318
  allowStyleElements: boolean;
1319
1319
  /**
package/dist/index.js CHANGED
@@ -644,7 +644,7 @@ function createSettings(mode) {
644
644
  enablePageSyntax: true,
645
645
  allowLocalPaths: true,
646
646
  useTrueIds: true,
647
- allowStyleElements: true,
647
+ allowStyleElements: false,
648
648
  allowHtmlBlocks: true
649
649
  };
650
650
  case "draft":
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@wdprlib/ast",
3
- "version": "2.4.0",
3
+ "version": "4.0.1",
4
4
  "description": "AST types for Wikidot markup",
5
5
  "keywords": [
6
6
  "ast",
package/src/settings.ts CHANGED
@@ -22,7 +22,7 @@
22
22
  *
23
23
  * | Mode | Page syntax | Local paths | True IDs | Style elements | HTML blocks |
24
24
  * |--------------------|:-----------:|:-----------:|:--------:|:--------------:|:-----------:|
25
- * | `"page"` | yes | yes | yes | yes | yes |
25
+ * | `"page"` | yes | yes | yes | no | yes |
26
26
  * | `"draft"` | yes | yes | no | no | no |
27
27
  * | `"forum-post"` | no | no | no | no | no |
28
28
  * | `"direct-message"` | no | no | no | no | no |
@@ -76,9 +76,9 @@ export interface WikitextSettings {
76
76
  /**
77
77
  * Whether `[[module CSS]]` blocks are rendered as `<style>` tags.
78
78
  *
79
- * User-authored CSS can break page layout, so it is allowed only on
80
- * full wiki pages. In draft previews, forum posts, and direct messages
81
- * the CSS module is silently ignored.
79
+ * User-authored CSS can break page layout and leak page data, so it is
80
+ * disabled by default in every mode. Callers may explicitly enable it
81
+ * only for trusted CSS.
82
82
  */
83
83
  allowStyleElements: boolean;
84
84
 
@@ -121,7 +121,7 @@ export function createSettings(mode: WikitextMode): WikitextSettings {
121
121
  enablePageSyntax: true,
122
122
  allowLocalPaths: true,
123
123
  useTrueIds: true,
124
- allowStyleElements: true,
124
+ allowStyleElements: false,
125
125
  allowHtmlBlocks: true,
126
126
  };
127
127
  case "draft":