@wdprlib/parser 3.2.0 → 4.1.0

package/src/parser/rules/block/html/body.ts

@@ -0,0 +1,114 @@
+import type { ParseContext } from "../../types";
+import { parseBlockName } from "../utils";
+
+export interface HtmlBodyResult {
+  contents: string;
+  consumed: number;
+  foundClose: boolean;
+}
+
+/**
+ * Scan forward from `from` to see whether a real `[[/html]]` close tag
+ * exists later in the token stream.
+ */
+export function lookaheadHasHtmlClose(ctx: ParseContext, from: number): boolean {
+  for (let i = from; i < ctx.tokens.length; i++) {
+    const token = ctx.tokens[i];
+    if (!token || token.type === "EOF") return false;
+    if (token.type !== "BLOCK_END_OPEN") continue;
+
+    const closeName = parseBlockName(ctx, i + 1);
+    if (closeName?.name.toLowerCase() !== "html") continue;
+
+    let closePos = i + 1 + closeName.consumed;
+    while (ctx.tokens[closePos]?.type === "WHITESPACE") closePos++;
+    if (ctx.tokens[closePos]?.type === "BLOCK_CLOSE") return true;
+  }
+  return false;
+}
+
+export function collectHtmlBody(
+  ctx: ParseContext,
+  startPos: number,
+  disabled: boolean,
+): HtmlBodyResult {
+  const hasCloseAhead = disabled && lookaheadHasHtmlClose(ctx, startPos);
+  const contentParts: string[] = [];
+  let pos = startPos;
+  let consumed = 0;
+
+  while (pos < ctx.tokens.length) {
+    const token = ctx.tokens[pos];
+    if (!token || token.type === "EOF") break;
+
+    if (
+      disabled &&
+      !hasCloseAhead &&
+      token.type === "NEWLINE" &&
+      ctx.tokens[pos + 1]?.type === "NEWLINE"
+    ) {
+      break;
+    }
+
+    if (isHtmlCloseAt(ctx, pos)) {
+      return { contents: contentParts.join(""), consumed, foundClose: true };
+    }
+
+    if (!disabled) {
+      contentParts.push(token.value);
+    }
+    pos++;
+    consumed++;
+  }
+
+  return { contents: contentParts.join(""), consumed, foundClose: false };
+}
+
+export function consumeHtmlClose(ctx: ParseContext, startPos: number): number {
+  let pos = startPos;
+  let consumed = 0;
+
+  if (ctx.tokens[pos]?.type !== "BLOCK_END_OPEN") {
+    return 0;
+  }
+
+  pos++;
+  consumed++;
+
+  const closeNameResult = parseBlockName(ctx, pos);
+  if (closeNameResult) {
+    pos += closeNameResult.consumed;
+    consumed += closeNameResult.consumed;
+  }
+
+  while (ctx.tokens[pos]?.type === "WHITESPACE") {
+    pos++;
+    consumed++;
+  }
+
+  if (ctx.tokens[pos]?.type === "BLOCK_CLOSE") {
+    pos++;
+    consumed++;
+  }
+
+  if (ctx.tokens[pos]?.type === "NEWLINE") {
+    consumed++;
+  }
+
+  return consumed;
+}
+
+function isHtmlCloseAt(ctx: ParseContext, pos: number): boolean {
+  if (ctx.tokens[pos]?.type !== "BLOCK_END_OPEN") {
+    return false;
+  }
+
+  const closeNameResult = parseBlockName(ctx, pos + 1);
+  if (closeNameResult?.name.toLowerCase() !== "html") {
+    return false;
+  }
+
+  let checkPos = pos + 1 + closeNameResult.consumed;
+  while (ctx.tokens[checkPos]?.type === "WHITESPACE") checkPos++;
+  return ctx.tokens[checkPos]?.type === "BLOCK_CLOSE";
+}

package/src/parser/rules/block/html/diagnostics.ts

@@ -0,0 +1,11 @@
+import type { Position } from "@wdprlib/ast";
+import type { ParseContext } from "../../types";
+
+export function addHtmlDisabledDiagnostic(ctx: ParseContext, position: Position): void {
+  ctx.diagnostics.push({
+    severity: "info",
+    code: "html-block-disabled",
+    message: "[[html]] block ignored: disabled by settings",
+    position,
+  });
+}

package/src/parser/rules/block/html/index.ts

@@ -0,0 +1,95 @@
+/**
+ *
+ * Block rule for the Wikidot HTML block: `[[html]]...[[/html]]`.
+ *
+ * An HTML block embeds raw HTML that Wikidot renders inside a sandboxed
+ * `<iframe>`. The content between the tags is captured verbatim (no inline
+ * parsing) and stored as an `html` element in the AST.
+ *
+ * Supported attributes on the opening tag:
+ * - `style` -- applied to the containing iframe. Other attributes are
+ *   parsed but only `style` is used by Wikidot's renderer.
+ *
+ * The raw content is also pushed into `ctx.htmlBlocks` for document-level
+ * enumeration.
+ *
+ * If no `[[/html]]` closing tag is found, the rule fails and the opening
+ * tag falls through to text rendering (matching Wikidot behaviour).
+ *
+ * @module
+ */
+import type { Element } from "@wdprlib/ast";
+import type { BlockRule, ParseContext, RuleResult } from "../../types";
+import { currentToken } from "../../types";
+import { collectHtmlBody, consumeHtmlClose } from "./body";
+import { addHtmlDisabledDiagnostic } from "./diagnostics";
+import { parseHtmlOpen } from "./open";
+
+export { lookaheadHasHtmlClose } from "./body";
+
+/**
+ * Block rule for `[[html]]...[[/html]]`.
+ *
+ * Body content is stored as raw text. The optional `style` attribute is
+ * passed through to the AST element for iframe styling.
+ */
+export const htmlBlockRule: BlockRule = {
+  name: "html",
+  startTokens: ["BLOCK_OPEN"],
+  requiresLineStart: false,
+
+  parse(ctx: ParseContext): RuleResult<Element> {
+    const openToken = currentToken(ctx);
+    if (openToken.type !== "BLOCK_OPEN") {
+      return { success: false };
+    }
+
+    const openResult = parseHtmlOpen(ctx, ctx.pos);
+    if (!openResult) {
+      return { success: false };
+    }
+
+    const disabled = ctx.settings.allowHtmlBlocks === false;
+    const bodyStart = ctx.pos + openResult.consumed;
+    const bodyResult = collectHtmlBody(ctx, bodyStart, disabled);
+    let consumed = openResult.consumed + bodyResult.consumed;
+
+    if (!bodyResult.foundClose) {
+      ctx.diagnostics.push({
+        severity: "warning",
+        code: "unclosed-block",
+        message: "Missing closing tag [[/html]] for [[html]]",
+        position: openToken.position,
+      });
+      if (!disabled) {
+        return { success: false };
+      }
+      addHtmlDisabledDiagnostic(ctx, openToken.position);
+      return { success: true, elements: [], consumed };
+    }
+
+    consumed += consumeHtmlClose(ctx, bodyStart + bodyResult.consumed);
+
+    if (disabled) {
+      addHtmlDisabledDiagnostic(ctx, openToken.position);
+      return { success: true, elements: [], consumed };
+    }
+
+    const contents = bodyResult.contents.trim();
+    ctx.htmlBlocks.push(contents);
+
+    return {
+      success: true,
+      elements: [
+        {
+          element: "html",
+          data: {
+            contents,
+            ...(openResult.style && { style: openResult.style }),
+          },
+        },
+      ],
+      consumed,
+    };
+  },
+};

package/src/parser/rules/block/html/open.ts

@@ -0,0 +1,36 @@
+import type { ParseContext } from "../../types";
+import { parseAttributesRaw, parseBlockName } from "../utils";
+
+export interface HtmlOpenResult {
+  style: string | undefined;
+  consumed: number;
+}
+
+export function parseHtmlOpen(ctx: ParseContext, startPos: number): HtmlOpenResult | null {
+  if (ctx.tokens[startPos]?.type !== "BLOCK_OPEN") {
+    return null;
+  }
+
+  let pos = startPos + 1;
+  let consumed = 1;
+
+  const nameResult = parseBlockName(ctx, pos);
+  if (!nameResult || nameResult.name.toLowerCase() !== "html") {
+    return null;
+  }
+  pos += nameResult.consumed;
+  consumed += nameResult.consumed;
+
+  const attrResult = parseAttributesRaw(ctx, pos);
+  pos += attrResult.consumed;
+  consumed += attrResult.consumed;
+
+  if (ctx.tokens[pos]?.type !== "BLOCK_CLOSE") {
+    return null;
+  }
+
+  return {
+    style: attrResult.attrs.style,
+    consumed: consumed + 1,
+  };
+}

package/src/parser/rules/block/iframe/attributes.ts

@@ -0,0 +1,106 @@
+import type { AttributeMap } from "@wdprlib/ast";
+import type { ParseContext } from "../../types";
+
+/**
+ * Whitelist of attributes permitted on `[[iframe]]`. Wikidot strips
+ * `id` but permits `class`.
+ */
+const ALLOWED_IFRAME_ATTRS = new Set([
+  "align",
+  "class",
+  "frameborder",
+  "height",
+  "scrolling",
+  "style",
+  "width",
+]);
+
+export function parseIframeAttributes(
+  ctx: ParseContext,
+  startPos: number,
+): { attributes: AttributeMap; consumed: number } {
+  const attributes: AttributeMap = {};
+  let pos = startPos;
+  let consumed = 0;
+
+  while (pos < ctx.tokens.length) {
+    const token = ctx.tokens[pos];
+    if (!token || token.type === "BLOCK_CLOSE") break;
+
+    if (token.type === "NEWLINE") {
+      break;
+    }
+
+    if (token.type === "WHITESPACE") {
+      pos++;
+      consumed++;
+      continue;
+    }
+
+    if (token.type === "IDENTIFIER" || token.type === "TEXT") {
+      const key = token.value;
+      pos++;
+      consumed++;
+
+      while (ctx.tokens[pos]?.type === "WHITESPACE") {
+        pos++;
+        consumed++;
+      }
+
+      if (ctx.tokens[pos]?.type === "EQUALS") {
+        pos++;
+        consumed++;
+
+        while (ctx.tokens[pos]?.type === "WHITESPACE") {
+          pos++;
+          consumed++;
+        }
+
+        const valueResult = parseIframeAttributeValue(ctx, pos);
+        pos += valueResult.consumed;
+        consumed += valueResult.consumed;
+
+        const normalizedKey = key.toLowerCase();
+        if (ALLOWED_IFRAME_ATTRS.has(normalizedKey)) {
+          attributes[normalizedKey] = valueResult.value;
+        }
+      }
+    } else {
+      pos++;
+      consumed++;
+    }
+  }
+
+  return { attributes, consumed };
+}
+
+function parseIframeAttributeValue(
+  ctx: ParseContext,
+  startPos: number,
+): { value: string; consumed: number } {
+  const valueToken = ctx.tokens[startPos];
+  if (valueToken?.type === "QUOTED_STRING") {
+    return { value: valueToken.value.slice(1, -1), consumed: 1 };
+  }
+
+  let value = "";
+  let pos = startPos;
+  let consumed = 0;
+
+  while (pos < ctx.tokens.length) {
+    const token = ctx.tokens[pos];
+    if (
+      !token ||
+      token.type === "BLOCK_CLOSE" ||
+      token.type === "WHITESPACE" ||
+      token.type === "NEWLINE"
+    ) {
+      break;
+    }
+    value += token.value;
+    pos++;
+    consumed++;
+  }
+
+  return { value, consumed };
+}

package/src/parser/rules/block/iframe/index.ts

@@ -0,0 +1,73 @@
+/**
+ *
+ * Block rule for the Wikidot iframe block: `[[iframe URL attributes]]`.
+ *
+ * The `[[iframe]]` tag is a self-closing block that embeds an external
+ * page in an `<iframe>`. The first argument after the block name is the
+ * URL, followed by optional attributes.
+ *
+ * Security measures:
+ * - Only `http://` and `https://` URLs are accepted.
+ * - `javascript:`, `data:`, and `vbscript:` schemes are rejected.
+ * - URL normalisation strips whitespace and control characters to prevent
+ *   evasion via character insertion.
+ * - Only a specific set of HTML attributes is allowed (Wikidot filters
+ *   out `id` but permits `class`).
+ *
+ * Allowed attributes: `align`, `class`, `frameborder`, `height`,
+ * `scrolling`, `style`, `width`.
+ *
+ * @module
+ */
+import type { Element } from "@wdprlib/ast";
+import type { BlockRule, ParseContext, RuleResult } from "../../types";
+import { currentToken } from "../../types";
+import { parseIframeOpen } from "./open";
+import { isAllowedIframeUrl } from "./url";
+
+/**
+ * Block rule for `[[iframe URL ...attributes]]`.
+ *
+ * Parsing strategy:
+ * 1. Match BLOCK_OPEN + name "iframe".
+ * 2. Consume the URL (all tokens until whitespace, BLOCK_CLOSE, or newline).
+ * 3. Validate the URL: normalise, reject dangerous schemes, require http(s).
+ * 4. Parse key/value attributes, filtering through `ALLOWED_IFRAME_ATTRS`.
+ * 5. Consume closing `]]` and optional trailing newline.
+ * 6. Emit an `iframe` element with `url` and `attributes`.
+ */
+export const iframeRule: BlockRule = {
+  name: "iframe",
+  startTokens: ["BLOCK_OPEN"],
+  requiresLineStart: false,
+
+  parse(ctx: ParseContext): RuleResult<Element> {
+    const openToken = currentToken(ctx);
+    if (openToken.type !== "BLOCK_OPEN") {
+      return { success: false };
+    }
+
+    const openResult = parseIframeOpen(ctx);
+    if (!openResult) {
+      return { success: false };
+    }
+
+    if (!isAllowedIframeUrl(openResult.url)) {
+      return { success: false };
+    }
+
+    return {
+      success: true,
+      elements: [
+        {
+          element: "iframe",
+          data: {
+            url: openResult.url,
+            attributes: openResult.attributes,
+          },
+        },
+      ],
+      consumed: openResult.consumed,
+    };
+  },
+};

package/src/parser/rules/block/iframe/open.ts

@@ -0,0 +1,58 @@
+import type { AttributeMap } from "@wdprlib/ast";
+import type { ParseContext } from "../../types";
+import { parseBlockName } from "../utils";
+import { parseIframeAttributes } from "./attributes";
+import { parseIframeSource } from "./source";
+
+export interface IframeOpenResult {
+  url: string;
+  attributes: AttributeMap;
+  consumed: number;
+}
+
+export function parseIframeOpen(ctx: ParseContext): IframeOpenResult | null {
+  if (ctx.tokens[ctx.pos]?.type !== "BLOCK_OPEN") {
+    return null;
+  }
+
+  let pos = ctx.pos + 1;
+  let consumed = 1;
+
+  const nameResult = parseBlockName(ctx, pos);
+  if (!nameResult || nameResult.name.toLowerCase() !== "iframe") {
+    return null;
+  }
+
+  pos += nameResult.consumed;
+  consumed += nameResult.consumed;
+
+  while (ctx.tokens[pos]?.type === "WHITESPACE") {
+    pos++;
+    consumed++;
+  }
+
+  const sourceResult = parseIframeSource(ctx, pos);
+  if (!sourceResult) {
+    return null;
+  }
+
+  pos += sourceResult.consumed;
+  consumed += sourceResult.consumed;
+
+  const attrResult = parseIframeAttributes(ctx, pos);
+  pos += attrResult.consumed;
+  consumed += attrResult.consumed;
+
+  if (ctx.tokens[pos]?.type !== "BLOCK_CLOSE") {
+    return null;
+  }
+
+  pos++;
+  consumed++;
+
+  if (ctx.tokens[pos]?.type === "NEWLINE") {
+    consumed++;
+  }
+
+  return { url: sourceResult.url, attributes: attrResult.attributes, consumed };
+}

package/src/parser/rules/block/iframe/source.ts

@@ -0,0 +1,24 @@
+import type { ParseContext } from "../../types";
+
+export interface IframeSourceResult {
+  url: string;
+  consumed: number;
+}
+
+export function parseIframeSource(ctx: ParseContext, startPos: number): IframeSourceResult | null {
+  let pos = startPos;
+  let url = "";
+
+  while (pos < ctx.tokens.length) {
+    const token = ctx.tokens[pos];
+    if (!token) break;
+    if (token.type === "BLOCK_CLOSE" || token.type === "WHITESPACE" || token.type === "NEWLINE") {
+      break;
+    }
+    url += token.value;
+    pos++;
+  }
+
+  if (!url) return null;
+  return { url, consumed: pos - startPos };
+}

package/src/parser/rules/block/iframe/url.ts

@@ -0,0 +1,38 @@
+/**
+ * Normalises a URL string for security checks by removing whitespace and
+ * control characters that could be used to evade scheme detection, then
+ * lowercasing the result.
+ */
+export function normalizeIframeUrl(url: string): string {
+  return stripControlAndWhitespace(url).toLowerCase();
+}
+
+const WHITESPACE = /\s/;
+
+function stripControlAndWhitespace(value: string): string {
+  let result = "";
+  for (const char of value) {
+    const code = char.charCodeAt(0);
+    if (WHITESPACE.test(char) || code <= 0x1f || (code >= 0x7f && code <= 0x9f)) {
+      continue;
+    }
+    result += char;
+  }
+  return result;
+}
+
+/**
+ * Tests whether a normalised URL begins with a dangerous scheme that must
+ * be rejected.
+ */
+export function isDangerousIframeUrl(normalizedUrl: string): boolean {
+  return /^(javascript|data|vbscript):/i.test(normalizedUrl);
+}
+
+export function isAllowedIframeUrl(url: string): boolean {
+  const normalizedUrl = normalizeIframeUrl(url);
+  if (isDangerousIframeUrl(normalizedUrl)) {
+    return false;
+  }
+  return /^https?:\/\//i.test(normalizedUrl);
+}

package/src/parser/rules/block/iftags/body.ts

@@ -0,0 +1,48 @@
+import type { Element } from "@wdprlib/ast";
+import type { ParseContext } from "../../types";
+import { parseBlockName, parseBlocksUntil } from "../utils";
+
+export interface IftagsBodyResult {
+  elements: Element[];
+  consumed: number;
+}
+
+export function parseIftagsBody(ctx: ParseContext, startPos: number): IftagsBodyResult {
+  const bodyCtx: ParseContext = { ...ctx, pos: startPos };
+  const bodyResult = parseBlocksUntil(bodyCtx, (checkCtx) => isIftagsClose(checkCtx, checkCtx.pos));
+
+  return {
+    elements: bodyResult.elements,
+    consumed: bodyResult.consumed,
+  };
+}
+
+export function isIftagsClose(ctx: ParseContext, pos: number): boolean {
+  const token = ctx.tokens[pos];
+  if (token?.type !== "BLOCK_END_OPEN") {
+    return false;
+  }
+
+  const closeNameResult = parseBlockName(ctx, pos + 1);
+  return closeNameResult?.name.toLowerCase() === "iftags";
+}
+
+export function consumeIftagsClose(ctx: ParseContext, startPos: number): number {
+  let pos = startPos + 1;
+  let consumed = 1;
+
+  const closeNameResult = parseBlockName(ctx, pos);
+  if (closeNameResult) {
+    pos += closeNameResult.consumed;
+    consumed += closeNameResult.consumed;
+  }
+  if (ctx.tokens[pos]?.type === "BLOCK_CLOSE") {
+    pos++;
+    consumed++;
+  }
+  if (ctx.tokens[pos]?.type === "NEWLINE") {
+    consumed++;
+  }
+
+  return consumed;
+}

package/src/parser/rules/block/iftags/condition.ts

@@ -0,0 +1,24 @@
+import type { ParseContext } from "../../types";
+
+export interface IftagsConditionResult {
+  condition: string;
+  consumed: number;
+}
+
+export function collectIftagsCondition(ctx: ParseContext, startPos: number): IftagsConditionResult {
+  let condition = "";
+  let pos = startPos;
+  let consumed = 0;
+
+  while (pos < ctx.tokens.length) {
+    const token = ctx.tokens[pos];
+    if (!token || token.type === "BLOCK_CLOSE" || token.type === "NEWLINE") {
+      break;
+    }
+    condition += token.value;
+    pos++;
+    consumed++;
+  }
+
+  return { condition, consumed };
+}