@yoobic/yobi 8.3.0-43 → 8.3.0-46

package/dist/cjs/yoo-form-text-editor.cjs.entry.js

@@ -9,7 +9,7 @@ const lodash = require('./lodash-72d493b9.js');
 const overlays = require('./overlays-046b4f60.js');
 const bufferEs6 = require('./buffer-es6-f8668f31.js');
 const commonHelpers = require('./common-helpers-bfdca115.js');
-const entitiesHelpers = require('./entities-helpers-e77cfd61.js');
+const entitiesHelpers = require('./entities-helpers-99fc4a8a.js');
 const formInputHelpers = require('./form-input-helpers-651487c0.js');
 const formTextAreaHelpers = require('./form-text-area-helpers-4efd344d.js');
 const shadowDomHelper = require('./shadow-dom-helper-292b05ce.js');
@@ -20372,7 +20372,7 @@ NoWorkResult.default = NoWorkResult;
 
 class Processor {
   constructor(plugins = []) {
-    this.version = '8.4.13';
+    this.version = '8.4.14';
     this.plugins = this.normalize(plugins);
   }
 
@@ -20515,25 +20515,27 @@ function postcss(...plugins) {
 }
 
 postcss.plugin = function plugin(name, initializer) {
-  // eslint-disable-next-line no-console
-  if (console && console.warn) {
+  let warningPrinted = false;
+  function creator(...args) {
     // eslint-disable-next-line no-console
-    console.warn(
-      name +
-        ': postcss.plugin was deprecated. Migration guide:\n' +
-        'https://evilmartians.com/chronicles/postcss-8-plugin-migration'
-    );
-    if (overlays.process_1.env.LANG && overlays.process_1.env.LANG.startsWith('cn')) {
-      /* c8 ignore next 7 */
+    if (console && console.warn && !warningPrinted) {
+      warningPrinted = true;
       // eslint-disable-next-line no-console
       console.warn(
         name +
-          ': 里面 postcss.plugin 被弃用. 迁移指南:\n' +
-          'https://www.w3ctech.com/topic/2226'
+          ': postcss.plugin was deprecated. Migration guide:\n' +
+          'https://evilmartians.com/chronicles/postcss-8-plugin-migration'
       );
+      if (overlays.process_1.env.LANG && overlays.process_1.env.LANG.startsWith('cn')) {
+        /* c8 ignore next 7 */
+        // eslint-disable-next-line no-console
+        console.warn(
+          name +
+            ': 里面 postcss.plugin 被弃用. 迁移指南:\n' +
+            'https://www.w3ctech.com/topic/2226'
+        );
+      }
     }
-  }
-  function creator(...args) {
     let transformer = initializer(...args);
     transformer.postcssPlugin = name;
     transformer.postcssVersion = new processor().version;
@@ -20875,7 +20877,6 @@ function sanitizeHtml(html, options, _recursing) {
             delete frame.attribs[a];
             return;
           }
-          let parsed;
           // check allowedAttributesMap for the element and attribute and modify the value
           // as necessary if there are specific values defined.
           let passedAllowedAttributesMapCheck = false;
@@ -20923,14 +20924,14 @@ function sanitizeHtml(html, options, _recursing) {
               let allowed = true;
 
               try {
-                const parsed = new URL(value);
+                const parsed = parseUrl(value);
 
                 if (options.allowedScriptHostnames || options.allowedScriptDomains) {
                   const allowedHostname = (options.allowedScriptHostnames || []).find(function (hostname) {
-                    return hostname === parsed.hostname;
+                    return hostname === parsed.url.hostname;
                   });
                   const allowedDomain = (options.allowedScriptDomains || []).find(function(domain) {
-                    return parsed.hostname === domain || parsed.hostname.endsWith(`.${domain}`);
+                    return parsed.url.hostname === domain || parsed.url.hostname.endsWith(`.${domain}`);
                   });
                   allowed = allowedHostname || allowedDomain;
                 }
@@ -20947,29 +20948,9 @@ function sanitizeHtml(html, options, _recursing) {
             if (name === 'iframe' && a === 'src') {
               let allowed = true;
               try {
-                // Chrome accepts \ as a substitute for / in the // at the
-                // start of a URL, so rewrite accordingly to prevent exploit.
-                // Also drop any whitespace at that point in the URL
-                value = value.replace(/^(\w+:)?\s*[\\/]\s*[\\/]/, '$1//');
-                if (value.startsWith('relative:')) {
-                  // An attempt to exploit our workaround for base URLs being
-                  // mandatory for relative URL validation in the WHATWG
-                  // URL parser, reject it
-                  throw new Error('relative: exploit attempt');
-                }
-                // naughtyHref is in charge of whether protocol relative URLs
-                // are cool. Here we are concerned just with allowed hostnames and
-                // whether to allow relative URLs.
-                //
-                // Build a placeholder "base URL" against which any reasonable
-                // relative URL may be parsed successfully
-                let base = 'relative://relative-site';
-                for (let i = 0; (i < 100); i++) {
-                  base += `/${i}`;
-                }
-                const parsed = new URL(value, base);
-                const isRelativeUrl = parsed && parsed.hostname === 'relative-site' && parsed.protocol === 'relative:';
-                if (isRelativeUrl) {
+                const parsed = parseUrl(value);
+
+                if (parsed.isRelativeUrl) {
                   // default value of allowIframeRelativeUrls is true
                   // unless allowedIframeHostnames or allowedIframeDomains specified
                   allowed = has(options, 'allowIframeRelativeUrls')
@@ -20977,10 +20958,10 @@ function sanitizeHtml(html, options, _recursing) {
                     : (!options.allowedIframeHostnames && !options.allowedIframeDomains);
                 } else if (options.allowedIframeHostnames || options.allowedIframeDomains) {
                   const allowedHostname = (options.allowedIframeHostnames || []).find(function (hostname) {
-                    return hostname === parsed.hostname;
+                    return hostname === parsed.url.hostname;
                   });
                   const allowedDomain = (options.allowedIframeDomains || []).find(function(domain) {
-                    return parsed.hostname === domain || parsed.hostname.endsWith(`.${domain}`);
+                    return parsed.url.hostname === domain || parsed.url.hostname.endsWith(`.${domain}`);
                   });
                   allowed = allowedHostname || allowedDomain;
                 }
@@ -20995,7 +20976,7 @@ function sanitizeHtml(html, options, _recursing) {
             }
             if (a === 'srcset') {
               try {
-                parsed = parseSrcset(value);
+                let parsed = parseSrcset(value);
                 parsed.forEach(function(value) {
                   if (naughtyHref('srcset', value.url)) {
                     value.evil = true;
@@ -21221,7 +21202,17 @@ function sanitizeHtml(html, options, _recursing) {
     // Clobber any comments in URLs, which the browser might
     // interpret inside an XML data island, allowing
     // a javascript: URL to be snuck through
-    href = href.replace(/<!--.*?-->/g, '');
+    while (true) {
+      const firstIndex = href.indexOf('<!--');
+      if (firstIndex === -1) {
+        break;
+      }
+      const lastIndex = href.indexOf('-->', firstIndex + 4);
+      if (lastIndex === -1) {
+        break;
+      }
+      href = href.substring(0, firstIndex) + href.substring(lastIndex + 3);
+    }
     // Case insensitive so we don't get faked out by JAVASCRIPT #1
     // Allow more characters after the first so we don't get faked
     // out by certain schemes browsers accept
@@ -21244,6 +21235,33 @@ function sanitizeHtml(html, options, _recursing) {
     return !options.allowedSchemes || options.allowedSchemes.indexOf(scheme) === -1;
   }
 
+  function parseUrl(value) {
+    value = value.replace(/^(\w+:)?\s*[\\/]\s*[\\/]/, '$1//');
+    if (value.startsWith('relative:')) {
+      // An attempt to exploit our workaround for base URLs being
+      // mandatory for relative URL validation in the WHATWG
+      // URL parser, reject it
+      throw new Error('relative: exploit attempt');
+    }
+    // naughtyHref is in charge of whether protocol relative URLs
+    // are cool. Here we are concerned just with allowed hostnames and
+    // whether to allow relative URLs.
+    //
+    // Build a placeholder "base URL" against which any reasonable
+    // relative URL may be parsed successfully
+    let base = 'relative://relative-site';
+    for (let i = 0; (i < 100); i++) {
+      base += `/${i}`;
+    }
+
+    const parsed = new URL(value, base);
+
+    const isRelativeUrl = parsed && parsed.hostname === 'relative-site' && parsed.protocol === 'relative:';
+    return {
+      isRelativeUrl,
+      url: parsed
+    };
+  }
   /**
    * Filters user input css properties by allowlisted regex attributes.
    * Modifies the abstractSyntaxTree object.

package/dist/cjs/yoo-form-todo-task-list.cjs.entry.js

@@ -111,9 +111,8 @@ const YooFormTodoTaskListComponent = class {
     return updated;
   }
   async deleteTask(index, withConfirmation = true) {
-    var _a, _b;
     const result = withConfirmation
-      ? await overlays.showAlert(overlays.translate('DELETETASK'), [overlays.translate('CANCEL'), { cssClass: 'danger', text: overlays.translate('DELETE') }], overlays.translate('CONFIRMDELETETASK', { title: ((_b = (_a = this.value.values[index]) === null || _a === void 0 ? void 0 : _a.text) === null || _b === void 0 ? void 0 : _b.value) || '' }))
+      ? await overlays.showAlert(overlays.translate('DELETETASK'), [overlays.translate('CANCEL'), { cssClass: 'danger', text: overlays.translate('DELETE') }], overlays.translate('CONFIRMDELETETASK'))
       : true;
     if (result) {
       this.updateValue({ ...this.value, values: [...this.value.values.slice(0, index), ...this.value.values.slice(index + 1)] });

package/dist/cjs/yoo-grid.cjs.entry.js

@@ -11,7 +11,7 @@ require('./index-c1dbcd32.js');
 const button_factory = require('./button.factory-7f25fe7e.js');
 const index$2 = require('./index-8d435773.js');
 const commonHelpers = require('./common-helpers-bfdca115.js');
-const filtersHelpers = require('./filters-helpers-536b7b88.js');
+const filtersHelpers = require('./filters-helpers-63712f8d.js');
 const formInputHelpers = require('./form-input-helpers-651487c0.js');
 const gridRenderers = require('./grid-renderers-94c5b27d.js');
 const overlays = require('./overlays-046b4f60.js');