@zvndev/darkmown 2.12.2 → 2.13.0

package/src/builder.js

@@ -1343,7 +1343,12 @@ function match(pathname) {
 
 export default {
   async fetch(request, env, ctx) {
-    const matched = match(new URL(request.url).pathname);
+    let matched;
+    try {
+      matched = match(new URL(request.url).pathname);
+    } catch {
+      return Response.json({ ok: false, error: "Malformed URL encoding" }, { status: 400 });
+    }
     if (!matched) return env.ASSETS.fetch(request);
     try {
       const response = await matched.handler(request, { params: matched.params, env });

package/src/cli.js

@@ -16,7 +16,8 @@ import {
   devClientPath,
   devClientScript,
   devEventsPath,
-  injectDevClient
+  injectDevClient,
+  refuseLocalRequest
 } from "./dev.js";
 import { createDispatcher, serveMcp } from "./mcp.js";
 import { mcpConfig } from "./mcp-tools.js";
@@ -421,6 +422,7 @@ function startDevServer({ cwd, log, warn, error }) {
 
   const apiDir = path.join(cwd, "api");
   const server = http.createServer((req, res) => {
+    if (refuseForeign(req, res, host)) return;
     const url = req.url || "/";
     if (url.split("?")[0] === devEventsPath) {
       res.writeHead(200, {
@@ -486,6 +488,25 @@ function startDevServer({ cwd, log, warn, error }) {
   });
 }
 
+/**
+ * Answer 403 when `refuseLocalRequest` rejects the request (DNS rebinding or a
+ * cross-site call into `api/`). Shared by `dev` and `serve`.
+ * @param {import("node:http").IncomingMessage} req
+ * @param {import("node:http").ServerResponse} res
+ * @param {string} bindHost
+ * @returns {boolean} true when the request was refused and answered
+ */
+function refuseForeign(req, res, bindHost) {
+  const reason = refuseLocalRequest(req, {
+    bindHost,
+    allowedHosts: process.env.DARKMOWN_ALLOWED_HOSTS || ""
+  });
+  if (!reason) return false;
+  res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
+  res.end(`${reason}\n`);
+  return true;
+}
+
 /**
  * Start the static preview server for an existing `dist/`. Throws `CliError`
  * when there is nothing built to serve.
@@ -510,6 +531,7 @@ function startPreviewServer({ cwd, log, error }) {
   }
   const apiDir = path.join(cwd, "api");
   const server = http.createServer((req, res) => {
+    if (refuseForeign(req, res, host)) return;
     const acceptEncoding = req.headers["accept-encoding"];
     // Serverless parity, exactly as in dev: run a project api/*.js function when
     // the path matches; otherwise serve static (compressed when negotiated).

package/src/compiler/context.js

@@ -64,6 +64,8 @@
  * @property {Assets} assets
  * @property {Map<string, unknown>} state Declared state keys → initial values.
  * @property {Set<string>} stores Page-global store names (a subset of state keys).
+ * @property {{ name: string, url: string, at: string }[]} fetchPlaceholders Every
+ *   `{ name }` a `:fetch` URL reads, checked once the whole page has declared its state.
  * @property {Set<string>} fetchKeys Base state keys declared by `:fetch`, so
  *   bare `:if <key>_loading` / `:if <key>_error` regions get compile-time
  *   `role`/`aria-live` announcements.
@@ -320,6 +322,7 @@ export function createCompilation(reader) {
     state: new Map(),
     stores: new Set(),
     fetchKeys: new Set(),
+    fetchPlaceholders: [],
     warnings: [],
     sectionCounter: 0,
     headingSlugs: new Map(),

package/src/compiler/fetch.js

@@ -117,6 +117,7 @@ export function handleFetch(line, ctx, index) {
     validatePath(dep[1], ctx, FETCH_USE);
     const headKey = dep[1].split(".")[0];
     if (!deps.includes(headKey)) deps.push(headKey);
+    ctx.comp.fetchPlaceholders.push({ name: headKey, url, at: at(ctx, index) });
   }
 
   // Auto-declare the lifecycle keys. `name` is declared via declareState

package/src/compiler/format.js

@@ -67,8 +67,9 @@ const dateOnlyTZ = (v) =>
 export const AGGREGATES = {
   sum: (list, f) => nums(list, f || "").reduce((a, n) => a + n, 0),
   avg: (list, f) => (list.length ? AGGREGATES.sum(list, f) / list.length : 0),
-  min: (list, f) => (list.length ? Math.min(...nums(list, f || "")) : 0),
-  max: (list, f) => (list.length ? Math.max(...nums(list, f || "")) : 0),
+  // reduce, not spread: `Math.max(...list)` throws RangeError past ~100k items.
+  min: (list, f) => (list.length ? nums(list, f || "").reduce((a, n) => Math.min(a, n)) : 0),
+  max: (list, f) => (list.length ? nums(list, f || "").reduce((a, n) => Math.max(a, n)) : 0),
   count: (list) => list.length
 };
 

package/src/compiler/frontmatter.js

@@ -56,7 +56,8 @@ export function parseFrontmatter(raw, file) {
   const quotedKeys = new Set();
   for (const line of front.split("\n")) {
     const match = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);
-    if (!match) continue;
+    // `__proto__: [a]` would swap meta's prototype rather than set a key.
+    if (!match || match[1] === "__proto__") continue;
     const parsed = parseFrontmatterValue(match[2]);
     meta[match[1]] = parsed.value;
     if (parsed.quoted) quotedKeys.add(match[1]);

package/src/compiler/markdown.js

@@ -11,6 +11,7 @@ import { highlightCode } from "../highlight.js";
 import { LOOP_META, lineOf, recordRead, wdError } from "./context.js";
 import { applyPipeline, fmtAttr, validatePipes } from "./format.js";
 import { imageSize } from "./image-size.js";
+import { isAllowedInclude } from "./includes.js";
 import {
   escapeHtml,
   getPath,
@@ -37,6 +38,8 @@ export { unsafeUrlValue };
 // instances share it so `html: false` pages highlight too.
 const md = new MarkdownIt({ html: false, highlight: highlightCode });
 md.use(bindingPlugin);
+md.use(unresolvedPlugin);
+md.use(taskListPlugin);
 md.use(attrsPlugin);
 md.use(attrBindPlugin);
 md.use(imageVariantsPlugin);
@@ -62,6 +65,8 @@ export function selectMd(meta) {
   if (!mdRawHtml) {
     mdRawHtml = new MarkdownIt({ html: true, highlight: highlightCode });
     mdRawHtml.use(bindingPlugin);
+    mdRawHtml.use(unresolvedPlugin);
+    mdRawHtml.use(taskListPlugin);
     mdRawHtml.use(attrsPlugin);
     mdRawHtml.use(attrBindPlugin);
     mdRawHtml.use(imageVariantsPlugin);
@@ -144,6 +149,61 @@ function warnUnbindable(ctx, index, expr, painted) {
   );
 }
 
+/**
+ * Names in reach of `head`, for the "did you mean" in {@link warnUnresolved}.
+ * @param {Ctx} ctx
+ * @returns {string[]}
+ */
+function knownNames(ctx) {
+  const names = new Set([...ctx.comp.state.keys()].map((key) => key.split(":").pop() ?? key));
+  /** @type {typeof ctx.scope | null} */
+  let scope = ctx.scope;
+  for (; scope; scope = scope.parent) {
+    for (const name of Object.keys(scope.vars)) names.add(name);
+  }
+  return [...names];
+}
+
+/**
+ * Levenshtein distance, stopping the moment it can no longer be 2 or less.
+ * @param {string} a
+ * @param {string} b
+ * @returns {number}
+ */
+function editDistance(a, b) {
+  if (Math.abs(a.length - b.length) > 2) return 3;
+  let row = Array.from({ length: b.length + 1 }, (_, i) => i);
+  for (let i = 1; i <= a.length; i++) {
+    const next = [i];
+    for (let j = 1; j <= b.length; j++) {
+      next[j] = Math.min(row[j] + 1, next[j - 1] + 1, row[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+    }
+    row = next;
+  }
+  return row[b.length];
+}
+
+/**
+ * Warn once that `{ expr }` matched nothing, so it ships as the literal braces.
+ * A real page has no reason to show them, and `\{ name }` says it on purpose.
+ * @param {Ctx} ctx
+ * @param {number} index 0-based line index, for `file:line`.
+ * @param {string} expr
+ * @returns {void}
+ */
+function warnUnresolved(ctx, index, expr) {
+  const head = expr.split(/[.|\s]/)[0];
+  const near = knownNames(ctx)
+    .map((name) => /** @type {[string, number]} */ ([name, editDistance(head, name)]))
+    .filter(([, distance]) => distance <= 2)
+    .sort((a, b) => a[1] - b[1])[0];
+  const hint = near ? `Did you mean "${near[0]}"? ` : "";
+  const message =
+    `${ctx.file}:${lineOf(ctx, index)}: "{ ${expr} }" matches no :state, include argument or in-scope value, so it ships as literal text. ` +
+    `${hint}Declare it above this line, or write \\{ ${expr} } if the braces are meant to show.`;
+  if (!ctx.comp.warnings.includes(message)) ctx.comp.warnings.push(message);
+}
+
 // ---------------------------------------------------------------------------
 // REACTIVE ATTRIBUTE BINDING (a link/image destination).
 //
@@ -267,7 +327,10 @@ function resolveDestinationBindings(text, ctx, attrs, index) {
         /\{\s*([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)\s*\}/g,
         (/** @type {string} */ brace, /** @type {string} */ expr) => {
           const found = resolveBinding(expr, ctx);
-          if (!found) return brace; // not in scope — leave the author's text alone
+          if (!found) {
+            warnUnresolved(ctx, index + i, expr);
+            return brace; // not in scope — leave the author's text alone
+          }
           if (found.kind === "static") {
             // The scheme test runs on the RAW value, before encoding, because
             // that is the string the runtime's guard sees. Encoding first would
@@ -487,11 +550,14 @@ function buildSrcset(src, ctx) {
     return null;
   }
   const reader = ctx.comp.reader;
+  // Same sandbox as measureImage/@include: a data-driven `/../../x.png` must not
+  // probe (or read the header of) files outside site/pages and site/_.
+  if (!isAllowedInclude(path.join(root, `${relBase}${ext}`), ctx.context, reader)) return null;
   /** @type {{ href: string, width: number }[]} */
   const candidates = [];
   for (const width of VARIANT_WIDTHS) {
     const abs = path.join(root, `${relBase}@${width}${ext}`);
-    if (!reader.exists(abs)) continue;
+    if (!isAllowedInclude(abs, ctx.context, reader) || !reader.exists(abs)) continue;
     candidates.push({ href: `${base}@${width}${ext}`, width: measureWidth(abs, reader) ?? width });
   }
   // Builder-generated variants (2.9.0): resized into dist by the pre-pass, so
@@ -681,8 +747,128 @@ function rawHtmlPlugin(mdInstance) {
 // happened to resolve to. Escaping is no defense here: `href` and friends
 // resolve `javascript:` without any quote breakout, and unlike a markdown
 // destination nothing upstream vets an author's own raw `<a href="…">`.
-const URL_ATTR_TAIL =
-  /\b(?:href|src|action|formaction|xlink:href)\s*=\s*(?:"([^"]*)|'([^']*)|([^\s>"']*))$/i;
+const URL_ATTRS = new Set([
+  "href",
+  "src",
+  "action",
+  "formaction",
+  "xlink:href",
+  "data",
+  "poster",
+  "cite",
+  "background",
+  "ping",
+  "to",
+  "from",
+  "by"
+]);
+
+// `{ path }` plus an optional `| pipe:arg` chain, as the inline binding rule reads it.
+const BINDING_BRACE = /\{\s*([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*\s*(?:\|[^}]*)?)\}/g;
+
+/** @param {string | undefined} c */
+const isHtmlSpace = (c) => c === " " || c === "\t" || c === "\n" || c === "\f" || c === "\r";
+const TEXT_CONTEXT = /** @type {RawContext} */ ({ kind: "text" });
+
+/**
+ * @typedef {{ kind: "text" }
+ *   | { kind: "tag" }
+ *   | { kind: "value", name: string, head: string, quoted: boolean }
+ *   | { kind: "rawtext", tag: string, type: string }} RawContext
+ */
+
+/**
+ * Where the end of a raw-HTML fragment sits, as the browser's tokenizer would
+ * read it: in text, inside a tag but between attributes, inside an attribute
+ * value (with the value so far), or inside a `<script>`/`<style>` body. It walks
+ * quoted values rather than pattern-matching back from the end, because a `>`
+ * inside `title=">"` does not close the tag.
+ * @param {string} html
+ * @returns {RawContext}
+ */
+function rawHtmlContext(html) {
+  const n = html.length;
+  let i = 0;
+  for (;;) {
+    const lt = html.indexOf("<", i);
+    if (lt < 0) return TEXT_CONTEXT;
+    const next = html[lt + 1];
+    // `<` then the value: whatever the value starts with decides the tag name.
+    if (next === undefined) return { kind: "tag" };
+    if (html.startsWith("<!--", lt)) {
+      const end = html.indexOf("-->", lt + 4);
+      if (end < 0) return TEXT_CONTEXT;
+      i = end + 3;
+      continue;
+    }
+    if (next === "/" && lt + 2 === n) return { kind: "tag" };
+    const closing = next === "/" && /[A-Za-z]/.test(html[lt + 2]);
+    if (!closing && !/[A-Za-z]/.test(next)) {
+      if (next !== "!" && next !== "?" && next !== "/") {
+        i = lt + 1;
+        continue;
+      }
+      // A bogus comment runs to the next `>`, and an escaped value cannot hold one.
+      const end = html.indexOf(">", lt + 2);
+      if (end < 0) return TEXT_CONTEXT;
+      i = end + 1;
+      continue;
+    }
+    let j = lt + (closing ? 2 : 1);
+    const nameStart = j;
+    while (j < n && !isHtmlSpace(html[j]) && html[j] !== "/" && html[j] !== ">") j++;
+    const tag = html.slice(nameStart, j).toLowerCase();
+    let type = "";
+    for (;;) {
+      while (j < n && (isHtmlSpace(html[j]) || html[j] === "/")) j++;
+      if (j >= n) return { kind: "tag" };
+      if (html[j] === ">") {
+        j++;
+        break;
+      }
+      const attrStart = j++;
+      while (j < n && !isHtmlSpace(html[j]) && !"/>=".includes(html[j])) j++;
+      const name = html.slice(attrStart, j).toLowerCase();
+      while (j < n && isHtmlSpace(html[j])) j++;
+      if (j >= n) return { kind: "tag" };
+      if (html[j] !== "=") continue;
+      j++;
+      while (j < n && isHtmlSpace(html[j])) j++;
+      if (j >= n) return { kind: "value", name, head: "", quoted: false };
+      let value;
+      const quote = html[j];
+      if (quote === '"' || quote === "'") {
+        const end = html.indexOf(quote, j + 1);
+        if (end < 0) return { kind: "value", name, head: html.slice(j + 1), quoted: true };
+        value = html.slice(j + 1, end);
+        j = end + 1;
+      } else {
+        const valueStart = j;
+        while (j < n && !isHtmlSpace(html[j]) && html[j] !== ">") j++;
+        value = html.slice(valueStart, j);
+        if (j >= n) return { kind: "value", name, head: value, quoted: false };
+      }
+      if (name === "type") type = value.trim().toLowerCase();
+    }
+    if (!closing && (tag === "script" || tag === "style")) {
+      const end = html.slice(j).search(new RegExp(`</${tag}[\\s/>]`, "i"));
+      if (end < 0) return { kind: "rawtext", tag, type };
+      i = j + end + 2;
+      continue;
+    }
+    i = j;
+  }
+}
+
+/**
+ * A JSON `<script>` is data the browser never runs, and an escaped value cannot
+ * close it, so a binding there is safe. Every other script or style body is code.
+ * @param {string} type
+ * @returns {boolean}
+ */
+function isDataScript(type) {
+  return /^application\/(?:[\w.-]+\+)?json$/.test(type);
+}
 
 /**
  * Warn that a value in URL position carries a scheme the browser would execute.
@@ -698,6 +884,22 @@ function warnUnsafeUrl(ctx, index, expr) {
   );
 }
 
+/**
+ * Warn that a value landed where HTML escaping cannot contain it (an event
+ * handler, `srcdoc`, or bare tag position), so it was dropped.
+ * @param {Ctx} ctx
+ * @param {number} index 0-based line index, for `file:line`.
+ * @param {string} expr
+ * @param {string} where
+ * @returns {void}
+ */
+function warnUnsafeSlot(ctx, index, expr, where) {
+  ctx.comp.warnings.push(
+    `${ctx.file}:${lineOf(ctx, index)}: "{ ${expr} }" sits ${where}, where escaping cannot stop a value from running as code, so it is emitted empty. ` +
+      `Put the value in a quoted attribute such as data-*, or render it as text, and read it from a colocated .js file.`
+  );
+}
+
 /**
  * Substitute every `{ expr }` in a raw-HTML fragment with its escaped value.
  *
@@ -716,7 +918,7 @@ function fillRawHtml(html, ctx, index) {
   // The capture mirrors the inline `wd_binding` rule: path plus an optional
   // `| pipe:arg` chain. A pipe-only divergence here left `{ d | date }` literal
   // in raw HTML while the same expression folded in prose.
-  const brace = /\{\s*([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*\s*(?:\|[^}]*)?)\}/g;
+  const brace = new RegExp(BINDING_BRACE);
   let out = "";
   let last = 0;
   /** @type {RegExpExecArray | null} */
@@ -726,7 +928,10 @@ function fillRawHtml(html, ctx, index) {
     last = hit.index + hit[0].length;
     const expr = hit[1].trim();
     const found = resolveBinding(expr, ctx);
+    const context = rawHtmlContext(out);
     if (!found) {
+      // Inside a script or style, `{ x }` is usually the language's own braces.
+      if (context.kind !== "rawtext") warnUnresolved(ctx, index, expr);
       out += hit[0];
       continue;
     }
@@ -736,18 +941,103 @@ function fillRawHtml(html, ctx, index) {
       continue;
     }
     if (found.kind === "state") warnUnbindable(ctx, index, expr, true);
-    const open = URL_ATTR_TAIL.exec(out);
-    const head = open ? (open[1] ?? open[2] ?? open[3]) : "";
-    if (open && unsafeUrlValue(head + found.text)) {
+    // Escaping only holds inside a quoted attribute or text. In a script-valued
+    // attribute the browser entity-decodes `&#39;` back into a live quote, and
+    // in bare tag position (`<div { x }>`) the value IS markup.
+    if (context.kind === "tag") {
+      warnUnsafeSlot(ctx, index, expr, "inside a tag but outside any attribute value");
+      continue;
+    }
+    if (context.kind === "rawtext") {
+      if (context.tag === "style" || !isDataScript(context.type)) {
+        warnUnsafeSlot(ctx, index, expr, `in a <${context.tag}> body`);
+        continue;
+      }
+      out += escapeHtml(found.text);
+      continue;
+    }
+    if (context.kind === "text") {
+      out += escapeHtml(found.text);
+      continue;
+    }
+    const { name, head, quoted } = context;
+    if (name.startsWith("on") || name === "srcdoc") {
+      warnUnsafeSlot(ctx, index, expr, `in the ${name}= attribute`);
+      continue;
+    }
+    // SVG `values` is a `;`-separated list, and any entry can animate a link's href.
+    const assembled = head + found.text;
+    const unsafe =
+      name === "values"
+        ? assembled.split(";").some(unsafeUrlValue)
+        : URL_ATTRS.has(name) && unsafeUrlValue(assembled);
+    if (unsafe) {
       warnUnsafeUrl(ctx, index, expr);
       out = out.slice(0, out.length - head.length); // the head belongs to the refused value
       continue;
     }
-    out += escapeHtml(found.text);
+    // An unquoted value ends at whitespace, so `x onmouseover=…` would open a
+    // new attribute. Entities keep it one value and decode back to the text.
+    out += quoted
+      ? escapeHtml(found.text)
+      : escapeHtml(found.text).replace(/[\s=`]/g, (c) => `&#${c.charCodeAt(0)};`);
   }
   return out + html.slice(last);
 }
 
+/**
+ * markdown-it plugin (core rule): a `{ name }` still in a text token after the
+ * inline pass is one {@link bindingPlugin} could not resolve. Runs before
+ * `text_join`, which would merge an escaped `\{` back in and make it look unresolved.
+ * @param {MarkdownIt} mdInstance
+ * @returns {void}
+ */
+function unresolvedPlugin(mdInstance) {
+  mdInstance.core.ruler.after("inline", "wd_unresolved", (state) => {
+    const wd = state.env?.wd;
+    if (!wd) return false;
+    for (const block of state.tokens) {
+      const line = wd.index + (block.map ? block.map[0] : 0);
+      let offset = 0;
+      for (const child of block.children ?? []) {
+        if (child.type === "softbreak" || child.type === "hardbreak") offset++;
+        if (child.type !== "text") continue;
+        for (const hit of child.content.matchAll(BINDING_BRACE)) {
+          warnUnresolved(wd.ctx, line + offset, hit[1].trim());
+        }
+      }
+    }
+    return false;
+  });
+}
+
+/**
+ * markdown-it plugin (core rule): `- [ ] item` in a `.wd` renders a read-only
+ * checkbox, so a checklist survives a markdown document becoming a `.wd`. `.md`
+ * stays strict CommonMark: it renders with no `wd` env, and this rule is a no-op
+ * without one. Static output, so a static page stays `runtime: false`. A checkbox
+ * the reader can tick is `:checkbox`.
+ * @param {MarkdownIt} mdInstance
+ * @returns {void}
+ */
+function taskListPlugin(mdInstance) {
+  mdInstance.core.ruler.after("wd_unresolved", "wd_task_list", (state) => {
+    if (!state.env?.wd) return false;
+    state.tokens.forEach((block, i) => {
+      if (block.type !== "inline" || state.tokens[i - 2]?.type !== "list_item_open") return;
+      const first = block.children?.[0];
+      const box = first?.type === "text" ? /^\[([ xX])\](?=\s|$)\s*/.exec(first.content) : null;
+      if (!first || !box) return;
+      first.content = first.content.slice(box[0].length);
+      const input = new state.Token("html_inline", "", 0);
+      input.content = `<input type="checkbox" disabled${box[1] === " " ? "" : " checked"}> `;
+      input.meta = { wdText: "" };
+      block.children?.unshift(input);
+    });
+    return false;
+  });
+}
+
 /**
  * markdown-it plugin: turns `{ name.path }` into an inline `html_inline` token
  * whose content comes from the env's `resolveBinding` callback.

package/src/compiler/page.js

@@ -489,6 +489,15 @@ export function compileDocument(
     0,
     null
   );
+  // Checked after the whole page, not at the :fetch line: the runtime reads state
+  // when the request fires, so a :state further down still fills the placeholder.
+  for (const { name, url, at } of comp.fetchPlaceholders) {
+    if (!comp.state.has(name)) {
+      comp.warnings.push(
+        `${at}: :fetch "${url}" reads "{ ${name} }", but the page declares no :state ${name}, so the request never fires until something sets it. Declare it with :state ${name} = …, or set it from a colocated .js.`
+      );
+    }
+  }
   // Shared skins (frontmatter `skins:`) join the page's asset set through the
   // exact same pipeline as colocated skins (compile through compileSkin at emit,
   // scoping honored), and the CSS cascade is then ordered so the page always

package/src/dev.js

@@ -1,8 +1,87 @@
+import { isIP } from "node:net";
 import { escapeHtml } from "./compiler.js";
 
 export const devClientPath = "/__wd/dev-client.js";
 export const devEventsPath = "/__wd/dev-events";
 
+/** @param {string} h */
+const isLoopbackName = (h) =>
+  h === "localhost" || h.endsWith(".localhost") || h === "::1" || /^127\.\d+\.\d+\.\d+$/.test(h);
+
+/** `Host`/`Origin` → bare lowercase hostname (`[::1]:5173` → `::1`), or null. @param {string} value */
+function hostnameOf(value) {
+  try {
+    return new URL(value.includes("://") ? value : `http://${value}`).hostname
+      .toLowerCase()
+      .replace(/^\[|\]$/g, "");
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The local dev/preview servers bind to loopback, but loopback alone does not
+ * keep a website you are visiting out. Two attacks reach it from a browser:
+ *
+ * - DNS rebinding: `evil.example` re-resolves to 127.0.0.1, after which the
+ *   page can READ every response (drafts, the dep map, the SSE stream, and
+ *   `api/*` handlers, which run with the full `process.env`). The browser still
+ *   sends `Host: evil.example`, so only hostnames that cannot be rebound pass:
+ *   `localhost`/`*.localhost`, IP literals (a rebinding needs a domain), the
+ *   bind address, and the `DARKMOWN_ALLOWED_HOSTS` list (a tunnel's domain).
+ * - Cross-site requests: any page can fire a simple POST at
+ *   `http://127.0.0.1:5173/api/x` without reading the reply, so the handler's
+ *   side effects run. `/api/*` therefore also refuses `Sec-Fetch-Site:
+ *   cross-site` and an `Origin` that is not loopback, the request's own host,
+ *   or allow-listed.
+ *
+ * `DARKMOWN_ALLOWED_HOSTS=*` turns the guard off.
+ * @param {{ url?: string, headers: Record<string, string | string[] | undefined> }} req
+ * @param {{ bindHost?: string, allowedHosts?: string }} [options]
+ * @returns {string | null} why the request is refused, or null to serve it
+ */
+export function refuseLocalRequest(req, { bindHost = "", allowedHosts = "" } = {}) {
+  const allowed = allowedHosts
+    .split(",")
+    .map((h) => hostnameOf(h.trim()) ?? "")
+    .filter(Boolean);
+  if (allowedHosts.split(",").some((h) => h.trim() === "*")) return null;
+  const bind = hostnameOf(bindHost) ?? "";
+  const host = hostnameOf(String(req.headers.host ?? ""));
+  if (!host || !(isLoopbackName(host) || isIP(host) || host === bind || allowed.includes(host))) {
+    return `Host "${req.headers.host ?? ""}" is not allowed. Set DARKMOWN_ALLOWED_HOSTS to permit it.`;
+  }
+  if (!isApiPath(req.url || "/")) return null;
+  if (req.headers["sec-fetch-site"] === "cross-site") return "Cross-site request to /api/ refused.";
+  const origin = req.headers.origin;
+  if (origin !== undefined) {
+    const from = origin === "null" ? null : hostnameOf(String(origin));
+    if (
+      !from ||
+      !(isLoopbackName(from) || from === host || from === bind || allowed.includes(from))
+    ) {
+      return `Origin "${origin}" may not call /api/ on this server.`;
+    }
+  }
+  return null;
+}
+
+/**
+ * Whether a request reaches the `api/` runner: the same URL parse and the same
+ * test as `handleApiRequest`, so `/api`, `/api?x` and `/./api/x` are all guarded.
+ * A URL it cannot parse gets the stricter answer.
+ * @param {string} url
+ * @returns {boolean}
+ */
+function isApiPath(url) {
+  try {
+    const { pathname } = new URL(url, "http://localhost");
+    return pathname === "/api" || pathname.startsWith("/api/");
+  } catch {
+    return true;
+  }
+}
+
 /**
  * Serialize the dev server's rebuilds: at most ONE child build runs at a time.
  * Every build read-modify-writes the dependency map (`dist/.wd-dev-deps.json`),

package/src/feeds.js

@@ -27,14 +27,23 @@ import { wdError } from "./compiler/context.js";
  * @property {string} lastmod ISO date (`yyyy-mm-dd`).
  */
 
+// Characters XML 1.0 cannot carry (see escapeXml).
+const XML_INVALID =
+  // biome-ignore lint/suspicious/noControlCharactersInRegex: these are exactly the characters being removed.
+  /[\u0000-\u0008\u000B\u000C\u000E-\u001F\uFFFE\uFFFF]|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
+
 /**
  * XML-escape a text value for use inside an element or attribute. Covers the
- * five predefined XML entities — the same set RSS/sitemap consumers expect.
+ * five predefined XML entities — the same set RSS/sitemap consumers expect —
+ * and drops the characters XML 1.0 cannot carry at all (C0 controls other than
+ * tab/LF/CR, U+FFFE/U+FFFF, lone surrogates): one in a single post title makes
+ * the whole feed malformed, and readers reject it outright.
  * @param {string} value
  * @returns {string}
  */
 export function escapeXml(value) {
   return String(value)
+    .replace(XML_INVALID, "")
     .replaceAll("&", "&amp;")
     .replaceAll("<", "&lt;")
     .replaceAll(">", "&gt;")
@@ -174,14 +183,20 @@ export function firstParagraph(body) {
   /** @type {string[]} */
   const collected = [];
   for (let j = i; j < lines.length && lines[j].trim(); j++) collected.push(lines[j].trim());
-  return collected
-    .join(" ")
-    .replace(/`([^`]+)`/g, "$1") // inline code → its text
-    .replace(/\*\*([^*]+)\*\*/g, "$1") // bold
-    .replace(/\*([^*]+)\*/g, "$1") // italic
-    .replace(/\[([^\]]*)\]\([^)]*\)/g, "$1") // [text](url) → text
-    .replace(/\s+/g, " ")
-    .trim();
+  return (
+    collected
+      .join(" ")
+      .replace(/`([^`]+)`/g, "$1") // inline code → its text
+      .replace(/\*\*([^*]+)\*\*/g, "$1") // bold
+      .replace(/\*([^*]+)\*/g, "$1") // italic
+      // [text](url) → text. The classes also exclude the OPENING bracket/paren:
+      // with `[^\]]*` a body of 200k `[` rescans to the end from every `[`
+      // (quadratic, 17 s per call), and any one collection author can write it.
+      // One level of parens is kept for URLs like `/wiki/Foo_(bar)`.
+      .replace(/\[([^[\]]*)\]\([^()]*(?:\([^()]*\)[^()]*)*\)/g, "$1")
+      .replace(/\s+/g, " ")
+      .trim()
+  );
 }
 
 /**