coralite 0.14.0 → 0.14.2

package/lib/parse.js

@@ -1,5 +1,5 @@
 import { Parser } from 'htmlparser2'
-import { invalidCustomTags, validTags } from './tags.js'
+import { isValidCustomElementName, VALID_TAGS } from './tags.js'
 
 /**
  * @import {
@@ -15,9 +15,6 @@ import { invalidCustomTags, validTags } from './tags.js'
  *  ParseHTMLResult} from '#types'
  */
 
-const customElementTagRegExp = /^[^-].*[-._a-z0-9\u00B7\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u037D\u037F-\u1FFF\u200C-\u200D\u203F-\u2040\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD\u{10000}-\u{EFFFF}]*$/ui
-const customElementTagTokenRegExp = /^[^-].*[-._a-z0-9\u00B7\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u037D\u037F-\u1FFF\u200C-\u200D\u203F-\u2040\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD\u{10000}-\u{EFFFF}\{\}]*$/ui
-
 /**
  * Parse HTML content and return a CoraliteDocument object representing the parsed document structure
  *
@@ -180,13 +177,13 @@ export function parseModule (string, { ignoreByAttribute }) {
   const customElements = []
   /** @type {Object.<string, Object.<string,CoraliteModuleSlotElement>>} */
   const slotElements = {}
-  let isTemplate = false
-
   /** @type {CoraliteDocumentValues} */
   const documentValues = {
     attributes: [],
     textNodes: []
   }
+  let isScript = false
+  let isTemplate = false
   let templateId = ''
 
   const parser = new Parser({
@@ -206,7 +203,9 @@ export function parseModule (string, { ignoreByAttribute }) {
       // push element to stack as it may have children
       stack.push(element)
 
-      if (element.name === 'template') {
+      if (element.name === 'script') {
+        isScript = true
+      } else if (element.name === 'template') {
         // enter template tag
         isTemplate = true
 
@@ -214,19 +213,7 @@ export function parseModule (string, { ignoreByAttribute }) {
           throw new Error('Template requires an "id"')
         }
 
-        let idHasToken = false
-        // check if template id contains a token
-        for (let i = 0; i < documentValues.attributes.length; i++) {
-          const token = documentValues.attributes[i]
-
-          if (token.name === 'id') {
-            idHasToken = true
-            break
-          }
-        }
-
-        if (!customElementTagRegExp.test(attributes.id)
-          || (idHasToken && !customElementTagTokenRegExp.test(attributes.id))) {
+        if (!isValidCustomElementName(attributes.id)) {
           throw new Error('Invalid template id: "' + originalName + '" it must match following the pattern https://html.spec.whatwg.org/multipage/custom-elements.html#valid-custom-element-name')
         }
 
@@ -275,7 +262,7 @@ export function parseModule (string, { ignoreByAttribute }) {
       const parent = stack[stack.length - 1]
       const textNode = createTextNode(text, parent)
 
-      if (text.trim()) {
+      if (isTemplate && !isScript && text.trim()) {
         const tokens = getTokensFromString(text)
 
         // store tokens
@@ -298,6 +285,8 @@ export function parseModule (string, { ignoreByAttribute }) {
       if (name === 'template') {
         // exit template tag
         isTemplate = false
+      } else if (name === 'script') {
+        isScript = false
       }
 
       // remove current element from stack as we're done with its children
@@ -435,12 +424,9 @@ export function createElement ({
     }
   }
 
-  if (!validTags[sanitisedName]) {
-    if (invalidCustomTags[sanitisedName]) {
-      throw new Error('Element name is reserved: "'+ sanitisedName +'"')
-    }
-
-    if (customElementTagRegExp.test(sanitisedName)) {
+  if (!VALID_TAGS[sanitisedName]) {
+    // check if the tag name matches the regex for valid custom elements
+    if (isValidCustomElementName(sanitisedName)) {
       // store custom elements
       element.slots = []
     } else {
@@ -501,7 +487,11 @@ function findAttributesToIgnore (ignoreByAttribute, attributes) {
  * @returns {CoraliteToken[]}
  */
 function getTokensFromString (string) {
-  const matches = string.matchAll(/\{{[^}]*\}}/g)
+  if (string.length > 100) {
+    console.warn(`Token "${string}" is too long`)
+  }
+
+  const matches = string.matchAll(/\{\{[^}]{0,100}?\}\}/g)
   const result = []
 
   for (const match of matches) {

package/lib/tags.js

@@ -1,4 +1,4 @@
-export const validTags = {
+export const VALID_TAGS = {
   a: true,
   abbr: true,
   acronym: true, // deprecated
@@ -193,8 +193,7 @@ export const validTags = {
   view: true
 }
 
-
-export const invalidCustomTags = {
+export const RESERVED_ELEMENT_NAMES = {
   'annotation-xml': true,
   'color-profile': true,
   'font-face': true,
@@ -204,3 +203,37 @@ export const invalidCustomTags = {
   'font-face-name': true,
   'missing-glyph': true
 }
+
+const CUSTOM_ELEMENT_TAG = /^[a-z](?:[-.\w\u00B7\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u037D\u037F-\u1FFF\u200C-\u200D\u203F-\u2040\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD])*?-(?:[-.\w\u00B7\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u037D\u037F-\u1FFF\u200C-\u200D\u203F-\u2040\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD])*$/;
+
+/**
+ * Validates a custom element name
+ * @param {string} name - The custom element name to validate
+ * @param {number} [maxLength=100] - Max length of the tag name
+ * @returns {boolean} - True if valid, false otherwise
+ * @throws {Error} - If the element name is reserved
+ */
+export function isValidCustomElementName(name, maxLength = 100) {
+  // Check if string is empty or not a string
+  if (!name || typeof name !== 'string') {
+    return false;
+  }
+  
+  // Check against reserved names first (case-insensitive)
+  if (RESERVED_ELEMENT_NAMES[name.toLowerCase()]) {
+    throw new Error('Element name is reserved: "'+ name +'"')
+  }
+  
+  // Length check to prevent ReDoS
+  if (name.length > maxLength) {
+    return false;
+  }
+
+  // check for obviously invalid patterns that could cause backtracking
+  if (name.includes('--') || name.startsWith('-') || name.endsWith('-')) {
+    return false;
+  }
+
+  // Test against the regex
+  return CUSTOM_ELEMENT_TAG.test(name);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coralite",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "description": "HTML modules static site generator",
   "main": "./lib/coralite.js",
   "type": "module",

package/.continue/rules/javascript.md

@@ -1,5 +0,0 @@
----
-description: Javascript
----
-
-Ensure to use Javascript and JSDoc annotations to provide type information.