@wdprlib/render 1.3.3 → 2.0.0

package/dist/index.cjs

@@ -356,10 +356,76 @@ function normalizeCssValue(value) {
   result = result.replace(/[\s\u0000-\u001f\u007f-\u009f]/g, "");
   return result.toLowerCase();
 }
+function isUrlAllowed(rawUrl) {
+  let url = rawUrl;
+  if (url.length >= 2) {
+    const first = url[0];
+    const last = url[url.length - 1];
+    if (first === '"' && last === '"' || first === "'" && last === "'") {
+      url = url.slice(1, -1);
+    }
+  }
+  if (url === "")
+    return true;
+  if (url.startsWith("#"))
+    return true;
+  if (url.startsWith("./") || url.startsWith("../"))
+    return true;
+  if (url.startsWith("//"))
+    return true;
+  if (url.startsWith("/"))
+    return true;
+  if (url.startsWith("http://") || url.startsWith("https://"))
+    return true;
+  if (url.startsWith("data:image/")) {
+    const after = url.slice("data:image/".length);
+    const sep = Math.min(after.indexOf(";") === -1 ? after.length : after.indexOf(";"), after.indexOf(",") === -1 ? after.length : after.indexOf(","));
+    const mime = after.slice(0, sep);
+    if (mime === "png" || mime === "jpeg" || mime === "jpg" || mime === "gif" || mime === "webp") {
+      return true;
+    }
+  }
+  return false;
+}
+function* iterateUrls(normalized) {
+  let searchPos = 0;
+  while (searchPos < normalized.length) {
+    const idx = normalized.indexOf("url(", searchPos);
+    if (idx === -1)
+      return;
+    let depth = 1;
+    let quoteChar = null;
+    let i = idx + 4;
+    while (i < normalized.length && depth > 0) {
+      const ch = normalized[i];
+      if (quoteChar !== null) {
+        if (ch === quoteChar)
+          quoteChar = null;
+      } else if (ch === '"' || ch === "'") {
+        quoteChar = ch;
+      } else if (ch === "(") {
+        depth++;
+      } else if (ch === ")") {
+        depth--;
+      }
+      i++;
+    }
+    if (depth > 0) {
+      yield { inner: normalized.slice(idx + 4), malformed: true };
+      return;
+    }
+    yield { inner: normalized.slice(idx + 4, i - 1), malformed: false };
+    searchPos = i;
+  }
+}
 function isDangerousCssValue(value) {
   const normalized = normalizeCssValue(value);
-  if (normalized.includes("url("))
-    return true;
+  for (const { inner, malformed } of iterateUrls(normalized)) {
+    if (malformed)
+      return true;
+    if (!isUrlAllowed(inner))
+      return true;
+  }
   if (normalized.includes("expression("))
     return true;
   if (normalized.includes("-moz-binding"))
@@ -370,21 +436,61 @@ function isDangerousCssValue(value) {
     return true;
   return false;
 }
+function splitDeclarations(style) {
+  const out = [];
+  let buf = "";
+  let parenDepth = 0;
+  let quoteChar = null;
+  for (const ch of style) {
+    if (quoteChar !== null) {
+      buf += ch;
+      if (ch === quoteChar)
+        quoteChar = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quoteChar = ch;
+      buf += ch;
+      continue;
+    }
+    if (ch === "(") {
+      parenDepth++;
+      buf += ch;
+      continue;
+    }
+    if (ch === ")") {
+      if (parenDepth > 0)
+        parenDepth--;
+      buf += ch;
+      continue;
+    }
+    if (ch === ";" && parenDepth === 0) {
+      out.push(buf);
+      buf = "";
+      continue;
+    }
+    buf += ch;
+  }
+  if (buf.length > 0)
+    out.push(buf);
+  return out;
+}
 function sanitizeStyleValue(style) {
   const endsWithSemicolon = style.trimEnd().endsWith(";");
-  const declarations = style.split(";").map((d) => d.trim()).filter(Boolean);
+  const declarations = splitDeclarations(style).map((d) => d.trim()).filter(Boolean);
   const safe = [];
   for (const decl of declarations) {
     const colonIdx = decl.indexOf(":");
     if (colonIdx === -1)
       continue;
-    const property = decl.slice(0, colonIdx).trim().toLowerCase();
+    const property = decl.slice(0, colonIdx).trim();
     const value = decl.slice(colonIdx + 1).trim();
     if (isDangerousCssValue(value))
       continue;
-    if (property.startsWith("-moz-binding"))
+    const normalisedProperty = normalizeCssValue(property);
+    if (normalisedProperty.startsWith("-moz-binding"))
       continue;
-    if (property === "behavior")
+    if (normalisedProperty === "behavior")
       continue;
     safe.push(decl);
   }
@@ -833,7 +939,7 @@ function renderLink(ctx, data) {
   const attrs = [`href="${escapeAttr(href)}"`];
   if (data.type === "page" && typeof data.link === "object") {
     const page = data.link.page;
-    const isSpecialPage = page.startsWith("//") || page.includes(":") || page.includes("#/");
+    const isSpecialPage = page.startsWith("//") || page.includes("#/");
     if (!isSpecialPage) {
       const hashIdx = page.indexOf("#");
       const pageToCheck = hashIdx !== -1 ? page.slice(0, hashIdx) : page;
@@ -4610,6 +4716,9 @@ function generateDefaultUrl(pageName, contents) {
   return path;
 }
 function renderHtmlBlock(ctx, data) {
+  if (ctx.settings.allowHtmlBlocks === false) {
+    return;
+  }
   const index = ctx.nextHtmlBlockIndex();
   const pageName = ctx.page?.pageName ?? "";
   const callbackUrl = ctx.options.resolvers?.htmlBlockUrl?.(index);

package/dist/index.js

@@ -304,10 +304,76 @@ function normalizeCssValue(value) {
   result = result.replace(/[\s\u0000-\u001f\u007f-\u009f]/g, "");
   return result.toLowerCase();
 }
+function isUrlAllowed(rawUrl) {
+  let url = rawUrl;
+  if (url.length >= 2) {
+    const first = url[0];
+    const last = url[url.length - 1];
+    if (first === '"' && last === '"' || first === "'" && last === "'") {
+      url = url.slice(1, -1);
+    }
+  }
+  if (url === "")
+    return true;
+  if (url.startsWith("#"))
+    return true;
+  if (url.startsWith("./") || url.startsWith("../"))
+    return true;
+  if (url.startsWith("//"))
+    return true;
+  if (url.startsWith("/"))
+    return true;
+  if (url.startsWith("http://") || url.startsWith("https://"))
+    return true;
+  if (url.startsWith("data:image/")) {
+    const after = url.slice("data:image/".length);
+    const sep = Math.min(after.indexOf(";") === -1 ? after.length : after.indexOf(";"), after.indexOf(",") === -1 ? after.length : after.indexOf(","));
+    const mime = after.slice(0, sep);
+    if (mime === "png" || mime === "jpeg" || mime === "jpg" || mime === "gif" || mime === "webp") {
+      return true;
+    }
+  }
+  return false;
+}
+function* iterateUrls(normalized) {
+  let searchPos = 0;
+  while (searchPos < normalized.length) {
+    const idx = normalized.indexOf("url(", searchPos);
+    if (idx === -1)
+      return;
+    let depth = 1;
+    let quoteChar = null;
+    let i = idx + 4;
+    while (i < normalized.length && depth > 0) {
+      const ch = normalized[i];
+      if (quoteChar !== null) {
+        if (ch === quoteChar)
+          quoteChar = null;
+      } else if (ch === '"' || ch === "'") {
+        quoteChar = ch;
+      } else if (ch === "(") {
+        depth++;
+      } else if (ch === ")") {
+        depth--;
+      }
+      i++;
+    }
+    if (depth > 0) {
+      yield { inner: normalized.slice(idx + 4), malformed: true };
+      return;
+    }
+    yield { inner: normalized.slice(idx + 4, i - 1), malformed: false };
+    searchPos = i;
+  }
+}
 function isDangerousCssValue(value) {
   const normalized = normalizeCssValue(value);
-  if (normalized.includes("url("))
-    return true;
+  for (const { inner, malformed } of iterateUrls(normalized)) {
+    if (malformed)
+      return true;
+    if (!isUrlAllowed(inner))
+      return true;
+  }
   if (normalized.includes("expression("))
     return true;
   if (normalized.includes("-moz-binding"))
@@ -318,21 +384,61 @@ function isDangerousCssValue(value) {
     return true;
   return false;
 }
+function splitDeclarations(style) {
+  const out = [];
+  let buf = "";
+  let parenDepth = 0;
+  let quoteChar = null;
+  for (const ch of style) {
+    if (quoteChar !== null) {
+      buf += ch;
+      if (ch === quoteChar)
+        quoteChar = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quoteChar = ch;
+      buf += ch;
+      continue;
+    }
+    if (ch === "(") {
+      parenDepth++;
+      buf += ch;
+      continue;
+    }
+    if (ch === ")") {
+      if (parenDepth > 0)
+        parenDepth--;
+      buf += ch;
+      continue;
+    }
+    if (ch === ";" && parenDepth === 0) {
+      out.push(buf);
+      buf = "";
+      continue;
+    }
+    buf += ch;
+  }
+  if (buf.length > 0)
+    out.push(buf);
+  return out;
+}
 function sanitizeStyleValue(style) {
   const endsWithSemicolon = style.trimEnd().endsWith(";");
-  const declarations = style.split(";").map((d) => d.trim()).filter(Boolean);
+  const declarations = splitDeclarations(style).map((d) => d.trim()).filter(Boolean);
   const safe = [];
   for (const decl of declarations) {
     const colonIdx = decl.indexOf(":");
     if (colonIdx === -1)
       continue;
-    const property = decl.slice(0, colonIdx).trim().toLowerCase();
+    const property = decl.slice(0, colonIdx).trim();
     const value = decl.slice(colonIdx + 1).trim();
     if (isDangerousCssValue(value))
       continue;
-    if (property.startsWith("-moz-binding"))
+    const normalisedProperty = normalizeCssValue(property);
+    if (normalisedProperty.startsWith("-moz-binding"))
       continue;
-    if (property === "behavior")
+    if (normalisedProperty === "behavior")
       continue;
     safe.push(decl);
   }
@@ -781,7 +887,7 @@ function renderLink(ctx, data) {
   const attrs = [`href="${escapeAttr(href)}"`];
   if (data.type === "page" && typeof data.link === "object") {
     const page = data.link.page;
-    const isSpecialPage = page.startsWith("//") || page.includes(":") || page.includes("#/");
+    const isSpecialPage = page.startsWith("//") || page.includes("#/");
     if (!isSpecialPage) {
       const hashIdx = page.indexOf("#");
       const pageToCheck = hashIdx !== -1 ? page.slice(0, hashIdx) : page;
@@ -4558,6 +4664,9 @@ function generateDefaultUrl(pageName, contents) {
   return path;
 }
 function renderHtmlBlock(ctx, data) {
+  if (ctx.settings.allowHtmlBlocks === false) {
+    return;
+  }
   const index = ctx.nextHtmlBlockIndex();
   const pageName = ctx.page?.pageName ?? "";
   const callbackUrl = ctx.options.resolvers?.htmlBlockUrl?.(index);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wdprlib/render",
-  "version": "1.3.3",
+  "version": "2.0.0",
   "description": "HTML renderer for Wikidot markup",
   "keywords": [
     "html",
@@ -39,7 +39,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@wdprlib/ast": "1.2.1",
+    "@wdprlib/ast": "2.0.0",
     "domhandler": "^5.0.3",
     "htmlparser2": "^10.0.0",
     "sanitize-html": "^2.14.0",