@zeropress/build-core 0.6.10 → 0.6.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zeropress/build-core",
-  "version": "0.6.10",
+  "version": "0.6.11",
   "description": "Shared ZeroPress build core",
   "type": "module",
   "license": "MIT",

package/src/render/content-renderer.js

@@ -336,14 +336,14 @@ function sanitizeHtml(html) {
   ]);
 
   const allowedAttributes = {
-    a: new Set(['href', 'title', 'class', 'id']),
+    a: new Set(['href', 'title', 'class', 'id', 'target', 'rel']),
     aside: new Set(['role', 'class', 'id']),
     img: new Set(['src', 'srcset', 'sizes', 'alt', 'title', 'class', 'id', 'width', 'height', 'loading', 'decoding']),
     iframe: new Set(['src', 'width', 'height', 'frameborder', 'allowfullscreen', 'class', 'title']),
     input: new Set(['type', 'checked', 'disabled', 'class', 'id', 'aria-label']),
     source: new Set(['src', 'srcset', 'sizes', 'type', 'media', 'width', 'height', 'class', 'id']),
-    video: new Set(['src', 'controls', 'autoplay', 'loop', 'muted', 'playsinline', 'poster', 'preload', 'width', 'height', 'class', 'id', 'title']),
-    audio: new Set(['src', 'controls', 'autoplay', 'loop', 'muted', 'preload', 'class', 'id', 'title']),
+    video: new Set(['src', 'controls', 'controlslist', 'autoplay', 'loop', 'muted', 'playsinline', 'poster', 'preload', 'width', 'height', 'class', 'id', 'title']),
+    audio: new Set(['src', 'controls', 'controlslist', 'autoplay', 'loop', 'muted', 'preload', 'class', 'id', 'title']),
     track: new Set(['src', 'kind', 'srclang', 'label', 'default', 'class', 'id']),
     '*': new Set(['class', 'id']),
   };
@@ -368,6 +368,8 @@ function sanitizeHtml(html) {
     const tagAllowedAttributes = allowedAttributes[normalizedTag] || new Set();
     const globalAllowedAttributes = allowedAttributes['*'];
     const filteredAttributes = [];
+    let anchorTarget = '';
+    let anchorRel = '';
 
     if (attributeString) {
       const attributePattern = /([a-zA-Z][a-zA-Z0-9-]*)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|(\S+)))?/g;
@@ -385,10 +387,37 @@ function sanitizeHtml(html) {
           continue;
         }
 
+        if (normalizedTag === 'a' && attributeName === 'target') {
+          const target = sanitizeAnchorTarget(attributeValue);
+          if (!target) {
+            continue;
+          }
+          anchorTarget = target;
+          continue;
+        }
+
+        if (normalizedTag === 'a' && attributeName === 'rel') {
+          const rel = sanitizeRelList(attributeValue);
+          if (!rel) {
+            continue;
+          }
+          anchorRel = rel;
+          continue;
+        }
+
         if (attributeName === 'srcset' && !isSafeSrcset(attributeValue, safeUriPattern)) {
           continue;
         }
 
+        if (attributeName === 'controlslist') {
+          const controlsList = sanitizeControlsList(attributeValue);
+          if (!controlsList) {
+            continue;
+          }
+          filteredAttributes.push(`${attributeName}="${controlsList}"`);
+          continue;
+        }
+
         if (normalizedTag === 'input' && attributeName === 'type' && attributeValue !== 'checkbox') {
           continue;
         }
@@ -397,6 +426,18 @@ function sanitizeHtml(html) {
       }
     }
 
+    if (normalizedTag === 'a') {
+      if (anchorTarget) {
+        filteredAttributes.push(`target="${anchorTarget}"`);
+      }
+      if (anchorTarget === '_blank') {
+        anchorRel = ensureBlankTargetRel(anchorRel);
+      }
+      if (anchorRel) {
+        filteredAttributes.push(`rel="${anchorRel}"`);
+      }
+    }
+
     const isSelfClosing = match.endsWith('/>') || normalizedTag === 'br' || normalizedTag === 'hr' || normalizedTag === 'img' || normalizedTag === 'input' || normalizedTag === 'source' || normalizedTag === 'track';
     const attributeSuffix = filteredAttributes.length > 0 ? ` ${filteredAttributes.join(' ')}` : '';
     return isSelfClosing ? `<${normalizedTag}${attributeSuffix} />` : `<${normalizedTag}${attributeSuffix}>`;
@@ -414,6 +455,52 @@ function sanitizeHtml(html) {
     .join('');
 }
 
+function sanitizeAnchorTarget(value) {
+  const normalized = String(value).trim().toLowerCase();
+  return normalized === '_blank' ? '_blank' : '';
+}
+
+function sanitizeRelList(value) {
+  const allowedTokens = new Set(['noopener', 'noreferrer', 'nofollow', 'ugc', 'sponsored', 'external']);
+  const tokens = String(value)
+    .toLowerCase()
+    .split(/\s+/)
+    .filter((token, index, allTokens) => (
+      allowedTokens.has(token)
+      && allTokens.indexOf(token) === index
+    ));
+
+  return tokens.join(' ');
+}
+
+function ensureBlankTargetRel(value) {
+  const tokens = String(value)
+    .toLowerCase()
+    .split(/\s+/)
+    .filter(Boolean);
+
+  for (const requiredToken of ['noopener', 'noreferrer']) {
+    if (!tokens.includes(requiredToken)) {
+      tokens.push(requiredToken);
+    }
+  }
+
+  return tokens.join(' ');
+}
+
+function sanitizeControlsList(value) {
+  const allowedTokens = new Set(['nodownload', 'nofullscreen', 'noremoteplayback']);
+  const tokens = String(value)
+    .toLowerCase()
+    .split(/\s+/)
+    .filter((token, index, allTokens) => (
+      allowedTokens.has(token)
+      && allTokens.indexOf(token) === index
+    ));
+
+  return tokens.join(' ');
+}
+
 function isSafeSrcset(value, safeUriPattern) {
   const candidates = String(value)
     .split(',')