@weapp-core/shared 3.2.8 → 3.3.0

package/README.md

@@ -11,6 +11,7 @@
 - 对象合并与判定工具
 - 统一导出常用第三方工具（`defu`、`get`、`set`）
 - 通过 `@weapp-core/shared/node` 提供 Node 专用哈希与文件系统能力
+- 通过独立、浏览器安全的 `@weapp-core/shared/rich-text` 子入口提供富文本安全树规范化，根入口不加载 HTML 解析器
 
 ## 安装
 
@@ -35,6 +36,16 @@ const hash = objectHash({ foo: 'bar' })
 const exists = await fs.pathExists('app.json')
 ```
 
+### 富文本安全树
+
+```ts
+import { normalizeRichTextNodes } from '@weapp-core/shared/rich-text'
+
+const nodes = normalizeRichTextNodes('<p>Hello <strong>world</strong></p>')
+```
+
+该子入口接受 HTML 字符串或结构化节点，返回命名的 `SafeRichTextNode` 文本/元素联合类型。Web 原生组件与 headless 模拟器共用同一份标签、属性、URL 和样式规则；输出是惰性的内容树，不执行脚本或模板。宿主保留自己的元数据边界，例如模拟器另外拒绝外部 `data-sim-*` 属性。
+
 ## 配置
 
 暂无额外配置。

package/dist/_virtual/_rolldown/runtime.js

@@ -5,7 +5,7 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod, mod.exports), cb = null), mod.exports);
 var __copyProps = (to, from, except, desc) => {
 	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
 		key = keys[i];

package/dist/fs/index.d.ts

@@ -88,4 +88,5 @@ export declare const fs: {
 };
 export type FsDirent = Dirent;
 export type FsStats = Stats;
-//#endregion
+//#endregion
+export {};

package/dist/index.js

@@ -6,8 +6,8 @@ import { MINI_PROGRAM_PLATFORM_DESCRIPTORS } from "./platforms/descriptors.js";
 import { MINI_PROGRAM_PLATFORM_ALIASES, getDefaultMiniProgramPlatform, getDefaultMiniProgramRuntimeGlobalKey, getMiniProgramPlatformByRuntimeGlobalKey, getMiniProgramRouteRuntimeGlobalKeys, getMiniProgramRuntimeCapabilities, getMiniProgramRuntimeGlobalKey, getMiniProgramRuntimeGlobalKeys, getMiniProgramRuntimeGlobalKeysByResolvePriority, getMiniProgramRuntimeHostConfigKey, getSupportedMiniProgramPlatforms, normalizeMiniProgramPlatform, resolveMiniProgramPageKeys, resolveMiniProgramPlatform, supportsMiniProgramRuntimeCapability } from "./platforms/runtime/helpers.js";
 import { getMiniProgramAppTypesPackage, getMiniProgramDefaultBuildTarget, getMiniProgramPlatformDescriptor, getMiniProgramTemplatePreset, supportsMiniProgramAutoTouchAppStyle } from "./platforms/helpers.js";
 import { escapeWxmlAttribute, escapeWxmlText } from "./wxml.js";
-import index_default from "./node_modules/.pnpm/get-value@4.1.0/node_modules/get-value/dist/index.js";
 import { require_set_value } from "./node_modules/.pnpm/set-value@4.1.0/node_modules/set-value/index.js";
+import get from "get-value";
 //#region src/index.ts
 var import_set_value = /* @__PURE__ */ __toESM(require_set_value(), 1);
 const SPECIAL_CHARS_RE = /[|\\{}()[\]^$+*?.]/g;
@@ -79,4 +79,4 @@ function isEmptyObject(obj) {
 }
 //#endregion
 var set = import_set_value.default;
-export { MINI_PROGRAM_PLATFORM_ALIASES, MINI_PROGRAM_PLATFORM_DESCRIPTORS, addExtension, arrify, createMiniProgramLayoutHostRegistry, defu, defuOverrideArray, escapeStringRegexp, escapeWxmlAttribute, escapeWxmlText, index_default as get, getDefaultMiniProgramPlatform, getDefaultMiniProgramRuntimeGlobalKey, getMiniProgramAppTypesPackage, getMiniProgramDefaultBuildTarget, getMiniProgramDirectivePrefix, getMiniProgramPlatformByRuntimeGlobalKey, getMiniProgramPlatformDescriptor, getMiniProgramRouteRuntimeGlobalKeys, getMiniProgramRuntimeCapabilities, getMiniProgramRuntimeGlobalKey, getMiniProgramRuntimeGlobalKeys, getMiniProgramRuntimeGlobalKeysByResolvePriority, getMiniProgramRuntimeHostConfigKey, getMiniProgramTemplatePreset, getSupportedMiniProgramDirectivePrefixes, getSupportedMiniProgramPlatforms, isEmptyObject, isObject, normalizeMiniProgramLayoutHostKeys, normalizeMiniProgramPlatform, removeExtension, removeExtensionDeep, resolveMiniProgramPageKeys, resolveMiniProgramPlatform, set, supportsMiniProgramAutoTouchAppStyle, supportsMiniProgramRuntimeCapability };
+export { MINI_PROGRAM_PLATFORM_ALIASES, MINI_PROGRAM_PLATFORM_DESCRIPTORS, addExtension, arrify, createMiniProgramLayoutHostRegistry, defu, defuOverrideArray, escapeStringRegexp, escapeWxmlAttribute, escapeWxmlText, get, getDefaultMiniProgramPlatform, getDefaultMiniProgramRuntimeGlobalKey, getMiniProgramAppTypesPackage, getMiniProgramDefaultBuildTarget, getMiniProgramDirectivePrefix, getMiniProgramPlatformByRuntimeGlobalKey, getMiniProgramPlatformDescriptor, getMiniProgramRouteRuntimeGlobalKeys, getMiniProgramRuntimeCapabilities, getMiniProgramRuntimeGlobalKey, getMiniProgramRuntimeGlobalKeys, getMiniProgramRuntimeGlobalKeysByResolvePriority, getMiniProgramRuntimeHostConfigKey, getMiniProgramTemplatePreset, getSupportedMiniProgramDirectivePrefixes, getSupportedMiniProgramPlatforms, isEmptyObject, isObject, normalizeMiniProgramLayoutHostKeys, normalizeMiniProgramPlatform, removeExtension, removeExtensionDeep, resolveMiniProgramPageKeys, resolveMiniProgramPlatform, set, supportsMiniProgramAutoTouchAppStyle, supportsMiniProgramRuntimeCapability };

package/dist/rich-text.d.ts

@@ -0,0 +1,21 @@
+//#region src/rich-text.d.ts
+export interface RichTextSourceNode {
+  type?: string;
+  name?: string;
+  attrs?: Record<string, unknown>;
+  children?: RichTextSourceNode[];
+  text?: string;
+}
+export type SafeRichTextNode = {
+  type: 'text';
+  text: string;
+} | {
+  type: 'element';
+  name: string;
+  attrs: Record<string, string>;
+  children: SafeRichTextNode[];
+};
+export declare function sanitizeRichTextStyle(value: unknown): string;
+export declare function sanitizeRichTextAttributes(value: unknown, tagName: string): Record<string, string>;
+export declare function normalizeRichTextNodes(value: unknown): SafeRichTextNode[];
+//#endregion

package/dist/rich-text.js

@@ -0,0 +1,227 @@
+import { parseDocument } from "htmlparser2";
+//#region src/rich-text.ts
+const ALLOWED_TAGS = /* @__PURE__ */ new Set([
+	"a",
+	"abbr",
+	"address",
+	"article",
+	"aside",
+	"b",
+	"bdi",
+	"bdo",
+	"big",
+	"blockquote",
+	"br",
+	"caption",
+	"center",
+	"cite",
+	"code",
+	"col",
+	"colgroup",
+	"dd",
+	"del",
+	"div",
+	"dl",
+	"dt",
+	"em",
+	"fieldset",
+	"font",
+	"h1",
+	"h2",
+	"h3",
+	"h4",
+	"h5",
+	"h6",
+	"header",
+	"hr",
+	"i",
+	"img",
+	"ins",
+	"label",
+	"legend",
+	"li",
+	"mark",
+	"ol",
+	"p",
+	"pre",
+	"q",
+	"rt",
+	"ruby",
+	"s",
+	"section",
+	"small",
+	"span",
+	"strong",
+	"sub",
+	"sup",
+	"table",
+	"tbody",
+	"td",
+	"tfoot",
+	"th",
+	"thead",
+	"tr",
+	"tt",
+	"u",
+	"ul"
+]);
+const ALLOWED_ATTRIBUTES = /* @__PURE__ */ new Set([
+	"abbr",
+	"align",
+	"alt",
+	"axis",
+	"bgcolor",
+	"border",
+	"cellpadding",
+	"cellspacing",
+	"class",
+	"colspan",
+	"dir",
+	"height",
+	"href",
+	"id",
+	"lang",
+	"rowspan",
+	"scope",
+	"span",
+	"start",
+	"style",
+	"summary",
+	"target",
+	"title",
+	"type",
+	"valign",
+	"width"
+]);
+const URL_ATTRIBUTES = /* @__PURE__ */ new Set(["href", "src"]);
+const ALLOWED_STYLE_PROPERTIES = /* @__PURE__ */ new Set([
+	"background",
+	"background-color",
+	"border",
+	"border-bottom",
+	"border-color",
+	"border-left",
+	"border-radius",
+	"border-right",
+	"border-style",
+	"border-top",
+	"border-width",
+	"color",
+	"display",
+	"font-family",
+	"font-size",
+	"font-style",
+	"font-weight",
+	"height",
+	"letter-spacing",
+	"line-height",
+	"margin",
+	"margin-bottom",
+	"margin-left",
+	"margin-right",
+	"margin-top",
+	"max-height",
+	"max-width",
+	"min-height",
+	"min-width",
+	"opacity",
+	"overflow",
+	"padding",
+	"padding-bottom",
+	"padding-left",
+	"padding-right",
+	"padding-top",
+	"text-align",
+	"text-decoration",
+	"text-indent",
+	"text-overflow",
+	"text-transform",
+	"vertical-align",
+	"white-space",
+	"width",
+	"word-break",
+	"word-wrap"
+]);
+function isRecord(value) {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function isSafeUrl(value, attribute) {
+	const normalized = Array.from(value).filter((character) => character.charCodeAt(0) > 32).join("").toLowerCase();
+	if (!normalized || normalized.startsWith("#") || normalized.startsWith("/") || normalized.startsWith("./") || normalized.startsWith("../")) return true;
+	if (/^(?:https?:|mailto:|tel:)/.test(normalized)) return true;
+	return attribute === "src" && /^data:image\/(?:gif|jpe?g|png|webp);base64,/.test(normalized);
+}
+function isSafeStyleValue(value) {
+	const normalized = value.toLowerCase().replace(/\s+/g, "");
+	return !normalized.includes("url(") && !normalized.includes("expression(") && !normalized.includes("javascript:") && !normalized.includes("behavior:") && !normalized.includes("-moz-binding");
+}
+function sanitizeRichTextStyle(value) {
+	const source = isRecord(value) ? Object.entries(value).map(([property, propertyValue]) => `${property}:${String(propertyValue)}`).join(";") : String(value ?? "");
+	const declarations = [];
+	for (const declaration of source.split(";")) {
+		const separator = declaration.indexOf(":");
+		if (separator <= 0) continue;
+		const property = declaration.slice(0, separator).trim().toLowerCase();
+		const propertyValue = declaration.slice(separator + 1).trim();
+		if (ALLOWED_STYLE_PROPERTIES.has(property) && propertyValue && isSafeStyleValue(propertyValue)) declarations.push(`${property}: ${propertyValue}`);
+	}
+	return declarations.join("; ");
+}
+function sanitizeRichTextAttributes(value, tagName) {
+	if (!isRecord(value)) return {};
+	const attributes = {};
+	for (const [rawName, rawValue] of Object.entries(value)) {
+		const name = rawName.trim().toLowerCase();
+		if (name.startsWith("on") || name === "srcdoc") continue;
+		if (!ALLOWED_ATTRIBUTES.has(name) && name !== "src" && !name.startsWith("aria-") && !name.startsWith("data-")) continue;
+		if (name === "src" && tagName !== "img") continue;
+		const serialized = name === "style" ? sanitizeRichTextStyle(rawValue) : String(rawValue ?? "");
+		if (!serialized || URL_ATTRIBUTES.has(name) && !isSafeUrl(serialized, name)) continue;
+		attributes[name] = serialized;
+	}
+	if (tagName === "a") attributes.rel = "noopener noreferrer";
+	return attributes;
+}
+function convertSourceNode(value) {
+	if (!isRecord(value)) return [];
+	if (value.type === "text" || !value.name && typeof value.text === "string") return [{
+		type: "text",
+		text: String(value.text ?? "")
+	}];
+	const children = Array.isArray(value.children) ? value.children.flatMap(convertSourceNode) : [];
+	const name = String(value.name ?? "").toLowerCase();
+	if (!ALLOWED_TAGS.has(name)) return children;
+	return [{
+		type: "element",
+		name,
+		attrs: sanitizeRichTextAttributes(value.attrs, name),
+		children
+	}];
+}
+function convertParsedNode(node) {
+	if (node.type === "text") return [{
+		type: "text",
+		text: node.data
+	}];
+	if (node.type !== "tag") return [];
+	const element = node;
+	const children = element.children.flatMap(convertParsedNode);
+	const name = element.name.toLowerCase();
+	if (!ALLOWED_TAGS.has(name)) return children;
+	return [{
+		type: "element",
+		name,
+		attrs: sanitizeRichTextAttributes(element.attribs, name),
+		children
+	}];
+}
+function normalizeRichTextNodes(value) {
+	if (typeof value === "string") return parseDocument(value, {
+		decodeEntities: true,
+		lowerCaseAttributeNames: true,
+		lowerCaseTags: true
+	}).children.flatMap(convertParsedNode);
+	return (Array.isArray(value) ? value : [value]).flatMap(convertSourceNode);
+}
+//#endregion
+export { normalizeRichTextNodes, sanitizeRichTextAttributes, sanitizeRichTextStyle };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@weapp-core/shared",
   "type": "module",
-  "version": "3.2.8",
+  "version": "3.3.0",
   "description": "Shared runtime-safe utilities and platform contracts for the weapp-vite ecosystem.",
   "author": "ice breaker <1324318532@qq.com>",
   "license": "MIT",
@@ -36,6 +36,10 @@
         "types": "./src/index.ts",
         "default": "./src/index.ts"
       },
+      "./rich-text": {
+        "types": "./src/rich-text.ts",
+        "default": "./src/rich-text.ts"
+      },
       "./node": {
         "types": "./src/node.ts",
         "default": "./src/node.ts"
@@ -62,6 +66,10 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
     },
+    "./rich-text": {
+      "types": "./dist/rich-text.d.ts",
+      "import": "./dist/rich-text.js"
+    },
     "./node": {
       "types": "./dist/node.d.ts",
       "import": "./dist/node.js"
@@ -88,6 +96,12 @@
   "engines": {
     "node": "^20.19.0 || >=22.12.0"
   },
+  "dependencies": {
+    "@types/set-value": "^4.0.3",
+    "domhandler": "^6.0.1",
+    "get-value": "^4.1.0",
+    "htmlparser2": "^12.0.0"
+  },
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org"

package/dist/node_modules/.pnpm/get-value@4.1.0/node_modules/get-value/dist/index.js

@@ -1,75 +0,0 @@
-//#region ../../node_modules/.pnpm/get-value@4.1.0/node_modules/get-value/dist/index.mjs
-var __defProp = Object.defineProperty;
-var __name = (target, value) => __defProp(target, "name", {
-	value,
-	configurable: true
-});
-var isObject = /* @__PURE__ */ __name((v) => v !== null && typeof v === "object", "isObject");
-var join = /* @__PURE__ */ __name((segs, joinChar, options) => {
-	if (typeof options.join === "function") return options.join(segs);
-	return segs[0] + joinChar + segs[1];
-}, "join");
-var split = /* @__PURE__ */ __name((path, splitChar, options) => {
-	if (typeof options.split === "function") return options.split(path);
-	return path.split(splitChar);
-}, "split");
-var isValid = /* @__PURE__ */ __name((key, target = {}, options) => {
-	if (typeof options?.isValid === "function") return options.isValid(key, target);
-	return true;
-}, "isValid");
-var isValidObject = /* @__PURE__ */ __name((v) => {
-	return isObject(v) || typeof v === "function";
-}, "isValidObject");
-var getValue = /* @__PURE__ */ __name((target, path, options = {}) => {
-	if (!isObject(options)) options = { default: options };
-	if (!isValidObject(target)) return typeof options.default !== "undefined" ? options.default : target;
-	if (typeof path === "number") path = String(path);
-	const pathIsArray = Array.isArray(path);
-	const pathIsString = typeof path === "string";
-	const splitChar = options.separator || ".";
-	const joinChar = options.joinChar || (typeof splitChar === "string" ? splitChar : ".");
-	if (!pathIsString && !pathIsArray) return target;
-	let value = target[path];
-	if (value === void 0 && typeof target.get === "function") value = target.get(path);
-	if (value !== void 0) return isValid(path, target, options) ? value : options.default;
-	const segs = pathIsArray ? path : split(path, splitChar, options);
-	const len = segs.length;
-	let idx = 0;
-	do {
-		let prop = segs[idx];
-		if (typeof prop !== "string") prop = String(prop);
-		while (prop && prop.slice(-1) === "\\") prop = join([prop.slice(0, -1), segs[++idx] || ""], joinChar, options);
-		value = target[prop];
-		if (value === void 0 && typeof target.get === "function") value = target.get(prop);
-		if (value !== void 0) {
-			if (!isValid(prop, target, options)) return options.default;
-			target = value;
-		} else {
-			let hasProp = false;
-			let n = idx + 1;
-			while (n < len) {
-				prop = join([prop, segs[n++]], joinChar, options);
-				value = target[prop];
-				if (value === void 0 && typeof target.get === "function") value = target.get(prop);
-				if (hasProp = value !== void 0) {
-					if (!isValid(prop, target, options)) return options.default;
-					target = value;
-					idx = n - 1;
-					break;
-				}
-			}
-			if (!hasProp) return options.default;
-		}
-	} while (++idx < len && isValidObject(target));
-	if (idx === len) return target;
-	return options.default;
-}, "getValue");
-var index_default = getValue;
-/*!
-* get-value <https://github.com/jonschlinkert/get-value>
-*
-* Copyright (c) 2014-present, Jon Schlinkert.
-* Released under the MIT License.
-*/
-//#endregion
-export { index_default as default, getValue };