@wdprlib/render 1.4.0 → 2.1.0

package/dist/index.cjs

@@ -44,14 +44,14 @@ var __export = (target, all) => {
 var exports_src = {};
 __export(exports_src, {
   renderToHtml: () => renderToHtml,
-  createSettings: () => import_ast4.createSettings,
-  DEFAULT_SETTINGS: () => import_ast4.DEFAULT_SETTINGS,
+  createSettings: () => import_ast5.createSettings,
+  DEFAULT_SETTINGS: () => import_ast5.DEFAULT_SETTINGS,
   DEFAULT_EMBED_ALLOWLIST: () => DEFAULT_EMBED_ALLOWLIST
 });
 module.exports = __toCommonJS(exports_src);
 
 // packages/render/src/render.ts
-var import_ast3 = require("@wdprlib/ast");
+var import_ast4 = require("@wdprlib/ast");
 
 // packages/render/src/context.ts
 var import_ast = require("@wdprlib/ast");
@@ -356,10 +356,76 @@ function normalizeCssValue(value) {
   result = result.replace(/[\s\u0000-\u001f\u007f-\u009f]/g, "");
   return result.toLowerCase();
 }
+function isUrlAllowed(rawUrl) {
+  let url = rawUrl;
+  if (url.length >= 2) {
+    const first = url[0];
+    const last = url[url.length - 1];
+    if (first === '"' && last === '"' || first === "'" && last === "'") {
+      url = url.slice(1, -1);
+    }
+  }
+  if (url === "")
+    return true;
+  if (url.startsWith("#"))
+    return true;
+  if (url.startsWith("./") || url.startsWith("../"))
+    return true;
+  if (url.startsWith("//"))
+    return true;
+  if (url.startsWith("/"))
+    return true;
+  if (url.startsWith("http://") || url.startsWith("https://"))
+    return true;
+  if (url.startsWith("data:image/")) {
+    const after = url.slice("data:image/".length);
+    const sep = Math.min(after.indexOf(";") === -1 ? after.length : after.indexOf(";"), after.indexOf(",") === -1 ? after.length : after.indexOf(","));
+    const mime = after.slice(0, sep);
+    if (mime === "png" || mime === "jpeg" || mime === "jpg" || mime === "gif" || mime === "webp") {
+      return true;
+    }
+  }
+  return false;
+}
+function* iterateUrls(normalized) {
+  let searchPos = 0;
+  while (searchPos < normalized.length) {
+    const idx = normalized.indexOf("url(", searchPos);
+    if (idx === -1)
+      return;
+    let depth = 1;
+    let quoteChar = null;
+    let i = idx + 4;
+    while (i < normalized.length && depth > 0) {
+      const ch = normalized[i];
+      if (quoteChar !== null) {
+        if (ch === quoteChar)
+          quoteChar = null;
+      } else if (ch === '"' || ch === "'") {
+        quoteChar = ch;
+      } else if (ch === "(") {
+        depth++;
+      } else if (ch === ")") {
+        depth--;
+      }
+      i++;
+    }
+    if (depth > 0) {
+      yield { inner: normalized.slice(idx + 4), malformed: true };
+      return;
+    }
+    yield { inner: normalized.slice(idx + 4, i - 1), malformed: false };
+    searchPos = i;
+  }
+}
 function isDangerousCssValue(value) {
   const normalized = normalizeCssValue(value);
-  if (normalized.includes("url("))
-    return true;
+  for (const { inner, malformed } of iterateUrls(normalized)) {
+    if (malformed)
+      return true;
+    if (!isUrlAllowed(inner))
+      return true;
+  }
   if (normalized.includes("expression("))
     return true;
   if (normalized.includes("-moz-binding"))
@@ -370,21 +436,61 @@ function isDangerousCssValue(value) {
     return true;
   return false;
 }
+function splitDeclarations(style) {
+  const out = [];
+  let buf = "";
+  let parenDepth = 0;
+  let quoteChar = null;
+  for (const ch of style) {
+    if (quoteChar !== null) {
+      buf += ch;
+      if (ch === quoteChar)
+        quoteChar = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quoteChar = ch;
+      buf += ch;
+      continue;
+    }
+    if (ch === "(") {
+      parenDepth++;
+      buf += ch;
+      continue;
+    }
+    if (ch === ")") {
+      if (parenDepth > 0)
+        parenDepth--;
+      buf += ch;
+      continue;
+    }
+    if (ch === ";" && parenDepth === 0) {
+      out.push(buf);
+      buf = "";
+      continue;
+    }
+    buf += ch;
+  }
+  if (buf.length > 0)
+    out.push(buf);
+  return out;
+}
 function sanitizeStyleValue(style) {
   const endsWithSemicolon = style.trimEnd().endsWith(";");
-  const declarations = style.split(";").map((d) => d.trim()).filter(Boolean);
+  const declarations = splitDeclarations(style).map((d) => d.trim()).filter(Boolean);
   const safe = [];
   for (const decl of declarations) {
     const colonIdx = decl.indexOf(":");
     if (colonIdx === -1)
       continue;
-    const property = decl.slice(0, colonIdx).trim().toLowerCase();
+    const property = decl.slice(0, colonIdx).trim();
     const value = decl.slice(colonIdx + 1).trim();
     if (isDangerousCssValue(value))
       continue;
-    if (property.startsWith("-moz-binding"))
+    const normalisedProperty = normalizeCssValue(property);
+    if (normalisedProperty.startsWith("-moz-binding"))
       continue;
-    if (property === "behavior")
+    if (normalisedProperty === "behavior")
       continue;
     safe.push(decl);
   }
@@ -4610,6 +4716,9 @@ function generateDefaultUrl(pageName, contents) {
   return path;
 }
 function renderHtmlBlock(ctx, data) {
+  if (ctx.settings.allowHtmlBlocks === false) {
+    return;
+  }
   const index = ctx.nextHtmlBlockIndex();
   const pageName = ctx.page?.pageName ?? "";
   const callbackUrl = ctx.options.resolvers?.htmlBlockUrl?.(index);
@@ -4712,392 +4821,22 @@ function formatDate(date, format) {
   return format.replace(/%Y/g, String(date.getFullYear())).replace(/%m/g, String(date.getMonth() + 1).padStart(2, "0")).replace(/%d/g, String(date.getDate()).padStart(2, "0")).replace(/%H/g, String(date.getHours()).padStart(2, "0")).replace(/%M/g, String(date.getMinutes()).padStart(2, "0")).replace(/%S/g, String(date.getSeconds()).padStart(2, "0"));
 }
 
-// packages/render/src/utils/expr-eval.ts
-var FALSE_VALUES = new Set(["false", "null", "", "0"]);
-function isTruthy(value) {
-  return !FALSE_VALUES.has(value.toLowerCase().trim());
-}
-var MAX_EXPRESSION_LENGTH = 256;
-function isTruthyNum(n) {
-  return n !== 0 && !Number.isNaN(n);
-}
-function evaluateExpression(expr) {
-  try {
-    if (expr.length > MAX_EXPRESSION_LENGTH) {
-      return { success: false, error: "expression too long" };
-    }
-    if (expr.trim() === "") {
-      return { success: false, error: "empty expression" };
-    }
-    const tokens = tokenize2(expr);
-    if (tokens.length <= 1) {
-      return { success: false, error: "empty expression" };
-    }
-    const parser = new ExprParser(tokens);
-    const result = parser.parse();
-    if (!Number.isFinite(result)) {
-      return { success: false, error: "division by zero" };
-    }
-    return { success: true, value: result };
-  } catch (e) {
-    const msg = e instanceof Error ? e.message : "unknown error";
-    return { success: false, error: msg };
-  }
-}
-function tokenize2(expr) {
-  const tokens = [];
-  let i = 0;
-  while (i < expr.length) {
-    const ch = expr[i];
-    if (/\s/.test(ch)) {
-      i++;
-      continue;
-    }
-    if (/\d/.test(ch) || ch === "." && /\d/.test(expr[i + 1] ?? "")) {
-      let numStr = "";
-      let hasDot = false;
-      while (i < expr.length) {
-        const c = expr[i];
-        if (c === ".") {
-          if (hasDot)
-            break;
-          hasDot = true;
-        } else if (!/\d/.test(c)) {
-          break;
-        }
-        numStr += c;
-        i++;
-      }
-      const num = parseFloat(numStr);
-      if (!Number.isFinite(num)) {
-        throw new Error("Invalid number");
-      }
-      tokens.push({ kind: "NUMBER", value: num });
-      continue;
-    }
-    if (/[a-zA-Z_]/.test(ch)) {
-      let id = "";
-      while (i < expr.length) {
-        const c = expr[i];
-        if (!/[a-zA-Z0-9_]/.test(c))
-          break;
-        id += c;
-        i++;
-      }
-      tokens.push({ kind: "IDENTIFIER", value: id.toLowerCase() });
-      continue;
-    }
-    if (ch === "<" && expr[i + 1] === "=") {
-      tokens.push({ kind: "LE", value: "<=" });
-      i += 2;
-      continue;
-    }
-    if (ch === ">" && expr[i + 1] === "=") {
-      tokens.push({ kind: "GE", value: ">=" });
-      i += 2;
-      continue;
-    }
-    if (ch === "!" && expr[i + 1] === "=") {
-      tokens.push({ kind: "NE", value: "!=" });
-      i += 2;
-      continue;
-    }
-    if (ch === "<" && expr[i + 1] === ">") {
-      tokens.push({ kind: "NE", value: "<>" });
-      i += 2;
-      continue;
-    }
-    switch (ch) {
-      case "+":
-        tokens.push({ kind: "PLUS", value: "+" });
-        break;
-      case "-":
-        tokens.push({ kind: "MINUS", value: "-" });
-        break;
-      case "*":
-        tokens.push({ kind: "STAR", value: "*" });
-        break;
-      case "/":
-        tokens.push({ kind: "SLASH", value: "/" });
-        break;
-      case "%":
-        tokens.push({ kind: "PERCENT", value: "%" });
-        break;
-      case "^":
-        tokens.push({ kind: "CARET", value: "^" });
-        break;
-      case "(":
-        tokens.push({ kind: "LPAREN", value: "(" });
-        break;
-      case ")":
-        tokens.push({ kind: "RPAREN", value: ")" });
-        break;
-      case ",":
-        tokens.push({ kind: "COMMA", value: "," });
-        break;
-      case "<":
-        tokens.push({ kind: "LT", value: "<" });
-        break;
-      case ">":
-        tokens.push({ kind: "GT", value: ">" });
-        break;
-      case "=":
-        tokens.push({ kind: "EQ", value: "=" });
-        break;
-      default:
-        throw new Error(`Unknown character: ${ch}`);
-    }
-    i++;
-  }
-  tokens.push({ kind: "EOF", value: "" });
-  return tokens;
-}
-
-class ExprParser {
-  tokens;
-  pos = 0;
-  constructor(tokens) {
-    this.tokens = tokens;
-  }
-  parse() {
-    const result = this.parseOr();
-    if (this.current().kind !== "EOF") {
-      throw new Error("too many values in the stack");
-    }
-    return result;
-  }
-  current() {
-    return this.tokens[this.pos] ?? { kind: "EOF", value: "" };
-  }
-  advance() {
-    const token = this.current();
-    this.pos++;
-    return token;
-  }
-  parseOr() {
-    let left = this.parseAnd();
-    while (this.current().kind === "IDENTIFIER" && this.current().value === "or") {
-      this.advance();
-      const right = this.parseAnd();
-      left = isTruthyNum(left) || isTruthyNum(right) ? 1 : 0;
-    }
-    return left;
-  }
-  parseAnd() {
-    let left = this.parseNot();
-    while (this.current().kind === "IDENTIFIER" && this.current().value === "and") {
-      this.advance();
-      const right = this.parseNot();
-      left = isTruthyNum(left) && isTruthyNum(right) ? 1 : 0;
-    }
-    return left;
-  }
-  parseNot() {
-    if (this.current().kind === "IDENTIFIER" && this.current().value === "not") {
-      this.advance();
-      const value = this.parseNot();
-      return isTruthyNum(value) ? 0 : 1;
-    }
-    return this.parseComparison();
-  }
-  parseComparison() {
-    let left = this.parseAddition();
-    const kind = this.current().kind;
-    if (kind === "LT" || kind === "GT" || kind === "LE" || kind === "GE" || kind === "EQ" || kind === "NE") {
-      this.advance();
-      const right = this.parseAddition();
-      switch (kind) {
-        case "LT":
-          return left < right ? 1 : 0;
-        case "GT":
-          return left > right ? 1 : 0;
-        case "LE":
-          return left <= right ? 1 : 0;
-        case "GE":
-          return left >= right ? 1 : 0;
-        case "EQ":
-          return left === right ? 1 : 0;
-        case "NE":
-          return left !== right ? 1 : 0;
-      }
-    }
-    return left;
-  }
-  parseAddition() {
-    let left = this.parseMultiplication();
-    while (true) {
-      const kind = this.current().kind;
-      if (kind === "PLUS") {
-        this.advance();
-        left = left + this.parseMultiplication();
-      } else if (kind === "MINUS") {
-        this.advance();
-        left = left - this.parseMultiplication();
-      } else {
-        break;
-      }
-    }
-    return left;
-  }
-  parseMultiplication() {
-    let left = this.parsePower();
-    while (true) {
-      const kind = this.current().kind;
-      if (kind === "STAR") {
-        this.advance();
-        left = left * this.parsePower();
-      } else if (kind === "SLASH") {
-        this.advance();
-        left = left / this.parsePower();
-      } else if (kind === "PERCENT") {
-        this.advance();
-        left = left % this.parsePower();
-      } else {
-        break;
-      }
-    }
-    return left;
-  }
-  parsePower() {
-    const left = this.parseUnary();
-    if (this.current().kind === "CARET") {
-      this.advance();
-      const right = this.parsePower();
-      return Math.pow(left, right);
-    }
-    return left;
-  }
-  parseUnary() {
-    const kind = this.current().kind;
-    if (kind === "MINUS") {
-      this.advance();
-      return -this.parseUnary();
-    }
-    if (kind === "PLUS") {
-      this.advance();
-      return +this.parseUnary();
-    }
-    return this.parsePrimary();
-  }
-  parsePrimary() {
-    const token = this.current();
-    if (token.kind === "NUMBER") {
-      this.advance();
-      return token.value;
-    }
-    if (token.kind === "LPAREN") {
-      this.advance();
-      const value = this.parseOr();
-      if (this.current().kind !== "RPAREN") {
-        throw new Error("Expected )");
-      }
-      this.advance();
-      return value;
-    }
-    if (token.kind === "IDENTIFIER") {
-      const name = token.value;
-      this.advance();
-      if (this.current().kind === "LPAREN") {
-        return this.parseFunctionCall(name);
-      }
-      throw new Error(`undefined constant "${name}"`);
-    }
-    throw new Error("Expected expression");
-  }
-  parseFunctionCall(name) {
-    if (this.current().kind !== "LPAREN") {
-      throw new Error("Expected (");
-    }
-    this.advance();
-    const args = [];
-    if (this.current().kind !== "RPAREN") {
-      args.push(this.parseOr());
-      while (this.current().kind === "COMMA") {
-        this.advance();
-        args.push(this.parseOr());
-      }
-    }
-    if (this.current().kind !== "RPAREN") {
-      throw new Error("Expected )");
-    }
-    this.advance();
-    return this.callFunction(name, args);
-  }
-  callFunction(name, args) {
-    switch (name) {
-      case "abs":
-        this.checkArgs(name, args, 1);
-        return Math.abs(args[0]);
-      case "min":
-        this.checkArgsMin(name, args, 1);
-        return Math.min(...args);
-      case "max":
-        this.checkArgsMin(name, args, 1);
-        return Math.max(...args);
-      case "floor":
-        this.checkArgs(name, args, 1);
-        return Math.floor(args[0]);
-      case "ceil":
-        this.checkArgs(name, args, 1);
-        return Math.ceil(args[0]);
-      case "round":
-        this.checkArgs(name, args, 1);
-        return Math.round(args[0]);
-      case "sqrt":
-        this.checkArgs(name, args, 1);
-        return Math.sqrt(args[0]);
-      case "sin":
-        this.checkArgs(name, args, 1);
-        return Math.sin(args[0]);
-      case "cos":
-        this.checkArgs(name, args, 1);
-        return Math.cos(args[0]);
-      case "tan":
-        this.checkArgs(name, args, 1);
-        return Math.tan(args[0]);
-      case "ln":
-        this.checkArgs(name, args, 1);
-        return Math.log(args[0]);
-      case "log":
-        this.checkArgs(name, args, 1);
-        return Math.log10(args[0]);
-      case "exp":
-        this.checkArgs(name, args, 1);
-        return Math.exp(args[0]);
-      case "pow":
-        this.checkArgs(name, args, 2);
-        return Math.pow(args[0], args[1]);
-      default:
-        throw new Error(`undefined function "${name}"`);
-    }
-  }
-  checkArgs(name, args, expected) {
-    if (args.length !== expected) {
-      throw new Error(`${name}() expects ${expected} argument(s), got ${args.length}`);
-    }
-  }
-  checkArgsMin(name, args, min) {
-    if (args.length < min) {
-      throw new Error(`${name}() expects at least ${min} argument(s), got ${args.length}`);
-    }
-  }
-}
-
 // packages/render/src/elements/expr.ts
+var import_ast3 = require("@wdprlib/ast");
 function renderExpr(ctx, data) {
-  const result = evaluateExpression(data.expression);
+  const result = import_ast3.evaluateExpression(data.expression);
   if (result.success) {
-    ctx.pushEscaped(formatNumber(result.value));
+    ctx.pushEscaped(import_ast3.formatExprValue(result.value));
   } else if (result.error !== "empty expression") {
     ctx.pushEscaped(`run-time error: ${result.error}`);
   }
 }
 function renderIf(ctx, data) {
-  const elements = isTruthy(data.condition) ? data.then : data.else;
+  const elements = import_ast3.isTruthy(data.condition) ? data.then : data.else;
   renderBranchElements(ctx, elements);
 }
 function renderIfExpr(ctx, data) {
-  const result = evaluateExpression(data.expression);
+  const result = import_ast3.evaluateExpression(data.expression);
   if (!result.success) {
     ctx.pushEscaped(`run-time error: ${result.error}`);
     return;
@@ -5117,12 +4856,6 @@ function renderBranchElements(ctx, elements) {
   }
   renderElements(ctx, elements.slice(0, lastIdx + 1));
 }
-function formatNumber(n) {
-  if (Number.isInteger(n)) {
-    return String(n);
-  }
-  return n.toFixed(6).replace(/\.?0+$/, "");
-}
 
 // packages/render/src/render.ts
 function renderToHtml(tree, options = {}) {
@@ -5130,8 +4863,8 @@ function renderToHtml(tree, options = {}) {
   renderElements(ctx, tree.elements);
   if (ctx.settings.allowStyleElements && tree.styles?.length) {
     for (const style of tree.styles) {
-      if (style.startsWith(import_ast3.STYLE_SLOT_PREFIX)) {
-        const slotId = parseInt(style.slice(import_ast3.STYLE_SLOT_PREFIX.length), 10);
+      if (style.startsWith(import_ast4.STYLE_SLOT_PREFIX)) {
+        const slotId = parseInt(style.slice(import_ast4.STYLE_SLOT_PREFIX.length), 10);
         for (const css of ctx.getStyleSlotContents(slotId)) {
           ctx.push(`<style>${escapeStyleContent(css)}</style>`);
         }
@@ -5288,4 +5021,4 @@ function renderElement(ctx, element) {
 }
 
 // packages/render/src/index.ts
-var import_ast4 = require("@wdprlib/ast");
+var import_ast5 = require("@wdprlib/ast");