@wdprlib/parser 3.2.0 → 4.0.0

package/src/parser/rules/block/iframe.ts

@@ -1,239 +0,0 @@
-/**
- *
- * Block rule for the Wikidot iframe block: `[[iframe URL attributes]]`.
- *
- * The `[[iframe]]` tag is a self-closing block that embeds an external
- * page in an `<iframe>`. The first argument after the block name is the
- * URL, followed by optional attributes.
- *
- * Security measures:
- * - Only `http://` and `https://` URLs are accepted.
- * - `javascript:`, `data:`, and `vbscript:` schemes are rejected.
- * - URL normalisation strips whitespace and control characters to prevent
- *   evasion via character insertion.
- * - Only a specific set of HTML attributes is allowed (Wikidot filters
- *   out `id` but permits `class`).
- *
- * Allowed attributes: `align`, `class`, `frameborder`, `height`,
- * `scrolling`, `style`, `width`.
- *
- * @module
- */
-import type { AttributeMap, Element } from "@wdprlib/ast";
-import type { BlockRule, ParseContext, RuleResult } from "../types";
-import { currentToken } from "../types";
-import { parseBlockName } from "./utils";
-
-/**
- * Whitelist of attributes permitted on `[[iframe]]`. Wikidot strips
- * `id` but permits `class`.
- */
-const ALLOWED_IFRAME_ATTRS = new Set([
-  "align",
-  "class",
-  "frameborder",
-  "height",
-  "scrolling",
-  "style",
-  "width",
-]);
-
-/**
- * Normalises a URL string for security checks by removing whitespace and
- * control characters (U+0000--U+001F, U+007F--U+009F) that could be used
- * to evade scheme detection, then lowercasing the result.
- *
- * @param url - The raw URL string.
- * @returns The normalised, lowercased URL.
- */
-function normalizeUrl(url: string): string {
-  return url.replace(/[\s\u0000-\u001f\u007f-\u009f]/g, "").toLowerCase();
-}
-
-/**
- * Tests whether a normalised URL begins with a dangerous scheme
- * (`javascript:`, `data:`, `vbscript:`) that must be rejected.
- *
- * @param normalizedUrl - The URL after {@link normalizeUrl} processing.
- * @returns `true` if the URL has a dangerous scheme.
- */
-function isDangerousUrl(normalizedUrl: string): boolean {
-  return /^(javascript|data|vbscript):/i.test(normalizedUrl);
-}
-
-/**
- * Block rule for `[[iframe URL ...attributes]]`.
- *
- * Parsing strategy:
- * 1. Match BLOCK_OPEN + name "iframe".
- * 2. Consume the URL (all tokens until whitespace, BLOCK_CLOSE, or newline).
- * 3. Validate the URL: normalise, reject dangerous schemes, require http(s).
- * 4. Parse key/value attributes, filtering through `ALLOWED_IFRAME_ATTRS`.
- * 5. Consume closing `]]` and optional trailing newline.
- * 6. Emit an `iframe` element with `url` and `attributes`.
- */
-export const iframeRule: BlockRule = {
-  name: "iframe",
-  startTokens: ["BLOCK_OPEN"],
-  requiresLineStart: false,
-
-  parse(ctx: ParseContext): RuleResult<Element> {
-    const openToken = currentToken(ctx);
-    if (openToken.type !== "BLOCK_OPEN") {
-      return { success: false };
-    }
-
-    let pos = ctx.pos + 1;
-    let consumed = 1;
-
-    // Parse block name
-    const nameResult = parseBlockName(ctx, pos);
-    if (!nameResult || nameResult.name.toLowerCase() !== "iframe") {
-      return { success: false };
-    }
-    pos += nameResult.consumed;
-    consumed += nameResult.consumed;
-
-    // Skip whitespace
-    while (ctx.tokens[pos]?.type === "WHITESPACE") {
-      pos++;
-      consumed++;
-    }
-
-    // Parse URL (first argument)
-    let url = "";
-    while (pos < ctx.tokens.length) {
-      const token = ctx.tokens[pos];
-      if (!token) break;
-      if (token.type === "BLOCK_CLOSE" || token.type === "WHITESPACE" || token.type === "NEWLINE") {
-        break;
-      }
-      url += token.value;
-      pos++;
-      consumed++;
-    }
-
-    if (!url) {
-      return { success: false };
-    }
-
-    // Normalize URL for consistent security checks
-    const normalizedUrl = normalizeUrl(url);
-
-    // Reject dangerous URLs (javascript:, data:, vbscript:)
-    // These will fall back to text rendering
-    if (isDangerousUrl(normalizedUrl)) {
-      return { success: false };
-    }
-
-    // Only allow http:// and https:// URLs (checked against normalized URL)
-    // This blocks relative URLs and other schemes
-    if (!/^https?:\/\//i.test(normalizedUrl)) {
-      return { success: false };
-    }
-
-    // Parse attributes
-    const attributes: AttributeMap = {};
-
-    while (pos < ctx.tokens.length) {
-      const token = ctx.tokens[pos];
-      if (!token || token.type === "BLOCK_CLOSE") break;
-
-      if (token.type === "NEWLINE") {
-        break;
-      }
-
-      if (token.type === "WHITESPACE") {
-        pos++;
-        consumed++;
-        continue;
-      }
-
-      // Parse key=value or key="value"
-      if (token.type === "IDENTIFIER" || token.type === "TEXT") {
-        const key = token.value;
-        pos++;
-        consumed++;
-
-        // Skip whitespace
-        while (ctx.tokens[pos]?.type === "WHITESPACE") {
-          pos++;
-          consumed++;
-        }
-
-        // Expect =
-        if (ctx.tokens[pos]?.type === "EQUALS") {
-          pos++;
-          consumed++;
-
-          // Skip whitespace
-          while (ctx.tokens[pos]?.type === "WHITESPACE") {
-            pos++;
-            consumed++;
-          }
-
-          // Parse value
-          let value = "";
-          const valueToken = ctx.tokens[pos];
-          if (valueToken?.type === "QUOTED_STRING") {
-            // Remove quotes
-            value = valueToken.value.slice(1, -1);
-            pos++;
-            consumed++;
-          } else {
-            // Unquoted value
-            while (pos < ctx.tokens.length) {
-              const vt = ctx.tokens[pos];
-              if (
-                !vt ||
-                vt.type === "BLOCK_CLOSE" ||
-                vt.type === "WHITESPACE" ||
-                vt.type === "NEWLINE"
-              ) {
-                break;
-              }
-              value += vt.value;
-              pos++;
-              consumed++;
-            }
-          }
-
-          // Only allow specific attributes (Wikidot filters out class/id)
-          if (ALLOWED_IFRAME_ATTRS.has(key.toLowerCase())) {
-            attributes[key.toLowerCase()] = value;
-          }
-        }
-      } else {
-        pos++;
-        consumed++;
-      }
-    }
-
-    // Expect ]]
-    if (ctx.tokens[pos]?.type !== "BLOCK_CLOSE") {
-      return { success: false };
-    }
-    pos++;
-    consumed++;
-
-    // Skip trailing newline
-    if (ctx.tokens[pos]?.type === "NEWLINE") {
-      pos++;
-      consumed++;
-    }
-
-    return {
-      success: true,
-      elements: [
-        {
-          element: "iframe",
-          data: {
-            url,
-            attributes,
-          },
-        },
-      ],
-      consumed,
-    };
-  },
-};

package/src/parser/rules/block/include.ts

@@ -1,179 +0,0 @@
-import type { Element, PageRef, VariableMap } from "@wdprlib/ast";
-import type { BlockRule, ParseContext, RuleResult } from "../types";
-import { currentToken } from "../types";
-import { parseBlockName } from "./utils";
-
-/**
- * Parse page reference from include target
- * Formats:
- *   - "page" -> { site: null, page: "page" }
- *   - ":site:page" -> { site: "site", page: "page" }
- *   - "fragment:name" -> { site: null, page: "fragment:name" }
- */
-function parsePageRef(target: string): PageRef {
-  // Check for :site:page format
-  if (target.startsWith(":")) {
-    const rest = target.slice(1);
-    const colonIndex = rest.indexOf(":");
-    if (colonIndex !== -1) {
-      return {
-        site: rest.slice(0, colonIndex),
-        page: rest.slice(colonIndex + 1),
-      };
-    }
-  }
-  return { site: null, page: target };
-}
-
-/**
- * Parse variables from include arguments
- * Format: key=value separated by |
- */
-function parseVariables(tokens: string[]): VariableMap {
-  const vars: VariableMap = {};
-
-  let current = "";
-  for (const token of tokens) {
-    if (token === "|") {
-      if (current.trim()) {
-        const eqIndex = current.indexOf("=");
-        if (eqIndex !== -1) {
-          const key = current.slice(0, eqIndex).trim();
-          const value = current.slice(eqIndex + 1).trim();
-          if (key) {
-            vars[key] = value;
-          }
-        }
-      }
-      current = "";
-    } else {
-      current += token;
-    }
-  }
-
-  // Handle last segment
-  if (current.trim()) {
-    const eqIndex = current.indexOf("=");
-    if (eqIndex !== -1) {
-      const key = current.slice(0, eqIndex).trim();
-      const value = current.slice(eqIndex + 1).trim();
-      if (key) {
-        vars[key] = value;
-      }
-    }
-  }
-
-  return vars;
-}
-
-export const includeRule: BlockRule = {
-  name: "include",
-  startTokens: ["BLOCK_OPEN"],
-  requiresLineStart: false,
-
-  parse(ctx: ParseContext): RuleResult<Element> {
-    const openToken = currentToken(ctx);
-    if (openToken.type !== "BLOCK_OPEN") {
-      return { success: false };
-    }
-
-    let pos = ctx.pos + 1;
-    let consumed = 1;
-
-    // Parse block name
-    const nameResult = parseBlockName(ctx, pos);
-    if (!nameResult || nameResult.name.toLowerCase() !== "include") {
-      return { success: false };
-    }
-
-    // Page syntax disabled (e.g., forum-post mode)
-    if (!ctx.settings.enablePageSyntax) {
-      return { success: false };
-    }
-
-    pos += nameResult.consumed;
-    consumed += nameResult.consumed;
-
-    // Skip whitespace
-    while (ctx.tokens[pos]?.type === "WHITESPACE") {
-      pos++;
-      consumed++;
-    }
-
-    // Collect target and arguments until ]]
-    const argTokens: string[] = [];
-    let target = "";
-    let inTarget = true;
-
-    while (pos < ctx.tokens.length) {
-      const token = ctx.tokens[pos];
-      if (!token) break;
-
-      if (token.type === "BLOCK_CLOSE") {
-        break;
-      }
-
-      // Newlines are allowed in include arguments
-      if (token.type === "NEWLINE") {
-        pos++;
-        consumed++;
-        continue;
-      }
-
-      if (inTarget) {
-        // First non-whitespace segment is the target
-        if (token.type === "WHITESPACE") {
-          if (target) {
-            inTarget = false;
-          }
-        } else if (token.type === "PIPE") {
-          inTarget = false;
-          argTokens.push("|");
-        } else {
-          target += token.value;
-        }
-      } else {
-        argTokens.push(token.value);
-      }
-
-      pos++;
-      consumed++;
-    }
-
-    // Expect ]]
-    if (ctx.tokens[pos]?.type !== "BLOCK_CLOSE") {
-      return { success: false };
-    }
-    pos++;
-    consumed++;
-
-    // Skip trailing newline
-    if (ctx.tokens[pos]?.type === "NEWLINE") {
-      pos++;
-      consumed++;
-    }
-
-    if (!target) {
-      return { success: false };
-    }
-
-    const location = parsePageRef(target);
-    const variables = parseVariables(argTokens);
-
-    return {
-      success: true,
-      elements: [
-        {
-          element: "include",
-          data: {
-            "paragraph-safe": false,
-            variables,
-            location,
-            elements: [],
-          },
-        },
-      ],
-      consumed,
-    };
-  },
-};

package/src/parser/rules/block/list.ts

@@ -1,244 +0,0 @@
-/**
- *
- * Block rule for Wikidot marker-based lists (`* item`, `# item`).
- *
- * Wikidot lists use leading `*` (bullet) or `#` (numbered) markers at the
- * start of a line. Nesting is achieved by prepending spaces:
- *
- * ```
- * * Item 1
- *  * Nested bullet
- *  # Nested numbered
- * * Item 2
- * ```
- *
- * The depth of each item is determined by the number of leading spaces
- * before the marker. Mixed bullet/numbered lists are supported: when the
- * list type changes at the same depth, a new sub-list is created.
- *
- * The flat depth-annotated items are converted into a recursive tree by
- * `processDepths()`, then transformed into nested `list` AST elements
- * by `buildListElement()`.
- *
- * Maximum nesting depth is capped at `MAX_LIST_DEPTH` (20).
- *
- * @module
- */
-import type { Element, ListData, ListItem, ListType } from "@wdprlib/ast";
-import type { BlockRule, ParseContext, RuleResult } from "../types";
-import { currentToken } from "../types";
-import { parseInlineUntil } from "../inline/utils";
-import { processDepths, type DepthList } from "../../depth";
-
-/**
- * Safety limit for list nesting depth.
- * Items deeper than this are not parsed, preventing stack overflow on
- * deeply nested or adversarial input.
- */
-const MAX_LIST_DEPTH = 20;
-
-/** Internal discriminated type for bullet vs numbered items during parsing. */
-type InternalListType = "bullet" | "numbered";
-
-/**
- * Default list type used as the top-level placeholder in
- * `processDepths()`. The actual type of each sub-list is determined
- * by its first item's marker.
- */
-const GENERIC_LIST_TYPE: InternalListType = "bullet";
-
-/**
- * Block rule for marker-based lists (`* ` bullet, `# ` numbered).
- *
- * Parsing strategy:
- * 1. Verify the first token is LIST_BULLET or LIST_NUMBER at line start.
- * 2. Collect consecutive list lines, recording each item's depth (number
- *    of leading spaces), type (bullet/numbered), and inline content.
- * 3. Feed the flat depth array into `processDepths()` with type
- *    comparison, producing a nested tree.
- * 4. Convert the tree into `list` AST elements via `buildListElement()`.
- */
-export const listRule: BlockRule = {
-  name: "list",
-  startTokens: ["LIST_BULLET", "LIST_NUMBER"],
-  requiresLineStart: true,
-
-  parse(ctx: ParseContext): RuleResult<Element> {
-    const firstToken = currentToken(ctx);
-
-    if (!firstToken.lineStart) {
-      return { success: false };
-    }
-
-    // Wikidot: list must start with list marker directly (no leading whitespace)
-    if (firstToken.type !== "LIST_BULLET" && firstToken.type !== "LIST_NUMBER") {
-      return { success: false };
-    }
-
-    // Collect depth-annotated items
-    const depths: Array<{
-      depth: number;
-      ltype: InternalListType;
-      value: Element[];
-    }> = [];
-    let pos = ctx.pos;
-    let consumed = 0;
-
-    while (pos < ctx.tokens.length) {
-      const token = ctx.tokens[pos];
-
-      if (!token || !token.lineStart) {
-        break;
-      }
-
-      // Determine depth from leading whitespace
-      let depth = 0;
-      if (token.type === "WHITESPACE") {
-        // Count spaces for depth (each space is 1 level)
-        depth = token.value.length;
-        pos++;
-        consumed++;
-      }
-
-      // Check for list marker
-      const markerToken = ctx.tokens[pos];
-      if (
-        !markerToken ||
-        (markerToken.type !== "LIST_BULLET" && markerToken.type !== "LIST_NUMBER")
-      ) {
-        // Undo whitespace consumption if not followed by list marker
-        if (depth > 0) {
-          pos--;
-          consumed--;
-        }
-        break;
-      }
-
-      // Check maximum depth
-      if (depth > MAX_LIST_DEPTH) {
-        break;
-      }
-
-      // Get list type
-      const ltype: InternalListType = markerToken.type === "LIST_BULLET" ? "bullet" : "numbered";
-
-      // Skip marker
-      pos++;
-      consumed++;
-
-      // Expect whitespace after marker
-      if (ctx.tokens[pos]?.type === "WHITESPACE") {
-        pos++;
-        consumed++;
-      }
-
-      // Parse inline content until newline
-      const inlineCtx: ParseContext = { ...ctx, pos };
-      const inlineResult = parseInlineUntil(inlineCtx, "NEWLINE");
-      const elements: Element[] = inlineResult.elements;
-      consumed += inlineResult.consumed;
-      pos += inlineResult.consumed;
-
-      // Consume newline
-      if (ctx.tokens[pos]?.type === "NEWLINE") {
-        pos++;
-        consumed++;
-      }
-
-      // Add to depths
-      depths.push({
-        depth,
-        ltype,
-        value: elements,
-      });
-    }
-
-    // No items parsed - rule fails
-    if (depths.length === 0) {
-      return { success: false };
-    }
-
-    // Process depths with list type comparison
-    const depthTrees = processDepths<InternalListType, Element[]>(
-      GENERIC_LIST_TYPE,
-      depths,
-      (a, b) => a === b,
-    );
-
-    // Convert depth trees to list elements
-    const lists = depthTrees.map(({ ltype, list }) => buildListElement(ltype, list));
-
-    return {
-      success: true,
-      elements: lists,
-      consumed,
-    };
-  },
-};
-
-/**
- * Converts the internal list type enum to the AST's {@link ListType}.
- *
- * @param ltype - Internal "bullet" or "numbered".
- * @returns The corresponding AST list type.
- */
-function toListType(ltype: InternalListType): ListType {
-  return ltype === "numbered" ? "numbered" : "bullet";
-}
-
-/**
- * Builds a `list` AST element from a depth tree produced by
- * `processDepths()`.
- *
- * @param topLtype - The list type for the top-level list.
- * @param list     - The depth tree of items and sub-lists.
- * @returns A `list` element.
- */
-function buildListElement(
-  topLtype: InternalListType,
-  list: DepthList<InternalListType, Element[]>,
-): Element {
-  return {
-    element: "list",
-    data: buildListData(topLtype, list),
-  };
-}
-
-/**
- * Recursively builds the {@link ListData} payload from a depth tree.
- *
- * Leaf items become `"elements"` list items; nested sub-trees become
- * `"sub-list"` items with their own recursive {@link ListData}.
- *
- * @param topLtype - List type for this level.
- * @param list     - The depth tree nodes at this level.
- * @returns Fully constructed {@link ListData}.
- */
-function buildListData(
-  topLtype: InternalListType,
-  list: DepthList<InternalListType, Element[]>,
-): ListData {
-  const items: ListItem[] = [];
-
-  for (const item of list) {
-    if (item.kind === "item") {
-      items.push({
-        "item-type": "elements",
-        attributes: {},
-        elements: item.value,
-      });
-    } else {
-      items.push({
-        "item-type": "sub-list",
-        element: "list",
-        data: buildListData(item.ltype, item.children),
-      });
-    }
-  }
-
-  return {
-    type: toListType(topLtype),
-    attributes: {},
-    items,
-  };
-}