decap-cms-widget-markdown 3.12.0 → 3.12.1

package/src/__tests__/renderer.spec.js

@@ -207,6 +207,74 @@ I get 10 times more traffic from [Google] than from [Yahoo] or [MSN].
       expect(img).not.toHaveAttribute('onerror');
     });
 
+    it('should preserve same-origin blob: URLs used for not-yet-committed asset previews', () => {
+      // Editors preview a selected-but-not-yet-committed image via URL.createObjectURL(),
+      // which produces a blob: URL - DOMPurify's default ALLOWED_URI_REGEXP doesn't include
+      // that scheme, so it silently stripped `src` here once sanitize_preview defaulted to
+      // true, even though the image itself is entirely local and safe. A real
+      // URL.createObjectURL() call always embeds the current document's own origin, so the
+      // fixture must too - a cross-origin value isn't something this exception should (or, per
+      // the test below, does) preserve.
+      const blobUrl = `blob:${window.location.origin}/1234-5678-90ab`;
+      const value = `<img src="${blobUrl}">`;
+      const field = Map({ sanitize_preview: true });
+
+      const { container } = render(
+        <MarkdownPreview
+          value={value}
+          getAsset={jest.fn()}
+          resolveWidget={jest.fn()}
+          field={field}
+        />,
+      );
+      const img = container.querySelector('img');
+      expect(img).toHaveAttribute('src', blobUrl);
+    });
+
+    it('should NOT preserve blob: URLs on non-<img> attributes', () => {
+      // The blob: exception above must be scoped to <img src>. Widening DOMPurify's global
+      // ALLOWED_URI_REGEXP instead of using a node-scoped hook would let blob: through on any
+      // URI-bearing attribute - including <a href> and <form action>, both of which could be
+      // used to smuggle attacker-controlled blob content (see PR review discussion). Uses a
+      // same-origin blob: URL so this test isolates the tag/attribute scoping specifically,
+      // independent of the separate cross-origin check below.
+      const blobUrl = `blob:${window.location.origin}/should-be-stripped`;
+      const value = [`<a href="${blobUrl}">click</a>`, `<form action="${blobUrl}"></form>`].join(
+        '',
+      );
+      const field = Map({ sanitize_preview: true });
+
+      const { container } = render(
+        <MarkdownPreview
+          value={value}
+          getAsset={jest.fn()}
+          resolveWidget={jest.fn()}
+          field={field}
+        />,
+      );
+      expect(container.querySelector('a')).not.toHaveAttribute('href');
+      expect(container.querySelector('form')).not.toHaveAttribute('action');
+    });
+
+    it('should NOT preserve a cross-origin blob: URL even on <img src>', () => {
+      // A blob: URL embeds the origin that created it and a browser already refuses to
+      // dereference one from a different origin, but the sanitizer should reject it outright
+      // rather than pass through a value that could not be one of this CMS instance's own
+      // asset previews.
+      const value = '<img src="blob:https://attacker.example/1234-5678-90ab">';
+      const field = Map({ sanitize_preview: true });
+
+      const { container } = render(
+        <MarkdownPreview
+          value={value}
+          getAsset={jest.fn()}
+          resolveWidget={jest.fn()}
+          field={field}
+        />,
+      );
+      expect(container.querySelector('img')).not.toHaveAttribute('src');
+    });
+
     it('should sanitize dangerous link protocols', () => {
       const value = '<a href="javascript:alert(1)">click</a>';
 

package/src/serializers/remarkRehypeShortcodes.js

@@ -1,8 +1,8 @@
-import React from 'react';
 import map from 'lodash/map';
 import has from 'lodash/has';
 import { renderToString } from 'react-dom/server';
 import u from 'unist-builder';
+import { createElement } from 'react';
 
 /**
  * This plugin doesn't actually transform Remark (MDAST) nodes to Rehype
@@ -58,7 +58,6 @@ export default function remarkToRehypeShortcodes({ plugins, getAsset, resolveWid
     if (toPreview) {
       return toPreview(shortcodeData, getAsset, fields);
     }
-
     /**
      * For editor components without a custom `toPreview` (e.g. container
      * components with nested markdown/richtext fields), render each sub-field
@@ -88,7 +87,7 @@ export default function remarkToRehypeShortcodes({ plugins, getAsset, resolveWid
      * Last resort fallback: try resolving the widget and rendering its preview.
      */
     const preview = resolveWidget(plugin.widget);
-    return React.createElement(preview.preview, {
+    return createElement(preview.preview, {
       value: shortcodeData,
       field: plugin,
       getAsset,

package/LICENSE

@@ -1,22 +0,0 @@
-Copyright (c) 2016 Netlify <decap@p-m.si>
-
-MIT License
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-"Software"), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/dist/esm/MarkdownControl/plugins/BreakToDefaultBlock.js

@@ -1,26 +0,0 @@
-import isHotkey from 'is-hotkey';
-function BreakToDefaultBlock({
-  defaultType
-}) {
-  return {
-    onKeyDown(event, editor, next) {
-      const {
-        selection,
-        startBlock
-      } = editor.value;
-      const isEnter = isHotkey('enter', event);
-      if (!isEnter) {
-        return next();
-      }
-      if (selection.isExpanded) {
-        editor.delete();
-        return next();
-      }
-      if (selection.start.isAtEndOfNode(startBlock) && startBlock.type !== defaultType) {
-        return editor.insertBlock(defaultType);
-      }
-      return next();
-    }
-  };
-}
-export default BreakToDefaultBlock;

package/dist/esm/MarkdownControl/plugins/CloseBlock.js

@@ -1,28 +0,0 @@
-import isHotkey from 'is-hotkey';
-function CloseBlock({
-  defaultType
-}) {
-  return {
-    onKeyDown(event, editor, next) {
-      const {
-        selection,
-        startBlock
-      } = editor.value;
-      const isBackspace = isHotkey('backspace', event);
-      if (!isBackspace) {
-        return next();
-      }
-      if (selection.isExpanded) {
-        return editor.delete();
-      }
-      if (!selection.start.isAtStartOfNode(startBlock) || startBlock.text.length > 0) {
-        return next();
-      }
-      if (startBlock.type !== defaultType) {
-        editor.setBlocks(defaultType);
-      }
-      return next();
-    }
-  };
-}
-export default CloseBlock;

package/dist/esm/MarkdownControl/plugins/CommandsAndQueries.js

@@ -1,180 +0,0 @@
-import isArray from 'lodash/isArray';
-import tail from 'lodash/tail';
-import castArray from 'lodash/castArray';
-function CommandsAndQueries({
-  defaultType
-}) {
-  return {
-    queries: {
-      atStartOf(editor, node) {
-        const {
-          selection
-        } = editor.value;
-        return selection.isCollapsed && selection.start.isAtStartOfNode(node);
-      },
-      getAncestor(editor, firstKey, lastKey) {
-        if (firstKey === lastKey) {
-          return editor.value.document.getParent(firstKey);
-        }
-        return editor.value.document.getCommonAncestor(firstKey, lastKey);
-      },
-      getOffset(editor, node) {
-        const parent = editor.value.document.getParent(node.key);
-        return parent.nodes.indexOf(node);
-      },
-      getSelectedChildren(editor, node) {
-        return node.nodes.filter(child => editor.isSelected(child));
-      },
-      getCommonAncestor(editor) {
-        const {
-          startBlock,
-          endBlock,
-          document: doc
-        } = editor.value;
-        return doc.getCommonAncestor(startBlock.key, endBlock.key);
-      },
-      getClosestType(editor, node, type) {
-        const types = castArray(type);
-        return editor.value.document.getClosest(node.key, n => types.includes(n.type));
-      },
-      getBlockContainer(editor, node) {
-        const targetTypes = ['bulleted-list', 'numbered-list', 'list-item', 'quote', 'table-cell'];
-        const {
-          startBlock,
-          selection
-        } = editor.value;
-        const target = node ? editor.value.document.getParent(node.key) : selection.isCollapsed && startBlock || editor.getCommonAncestor();
-        if (!target) {
-          return editor.value.document;
-        }
-        if (targetTypes.includes(target.type)) {
-          return target;
-        }
-        return editor.getBlockContainer(target);
-      },
-      isSelected(editor, nodes) {
-        return castArray(nodes).every(node => {
-          return editor.value.document.isInRange(node.key, editor.value.selection);
-        });
-      },
-      isFirstChild(editor, node) {
-        return editor.value.document.getParent(node.key).nodes.first().key === node.key;
-      },
-      areSiblings(editor, nodes) {
-        if (!isArray(nodes) || nodes.length < 2) {
-          return true;
-        }
-        const parent = editor.value.document.getParent(nodes[0].key);
-        return tail(nodes).every(node => {
-          return editor.value.document.getParent(node.key).key === parent.key;
-        });
-      },
-      everyBlock(editor, type) {
-        return editor.value.blocks.every(block => block.type === type);
-      },
-      hasMark(editor, type) {
-        return editor.value.activeMarks.some(mark => mark.type === type);
-      },
-      hasBlock(editor, type) {
-        return editor.value.blocks.some(node => node.type === type);
-      },
-      hasInline(editor, type) {
-        return editor.value.inlines.some(node => node.type === type);
-      },
-      hasQuote(editor, quoteLabel) {
-        const {
-          value
-        } = editor;
-        const {
-          document,
-          blocks
-        } = value;
-        return blocks.some(node => {
-          const {
-            key: descendantNodeKey
-          } = node;
-          /* When focusing a quote block, the actual block that gets the focus is the paragraph block whose parent is a `quote` block.
-          Hence, we need to get its parent and check if its type is `quote`. This parent will always be defined because every block in the editor
-          has a Document object as parent by default.
-          */
-          const parent = document.getParent(descendantNodeKey);
-          return parent.type === quoteLabel;
-        });
-      },
-      hasListItems(editor, listType) {
-        const {
-          value
-        } = editor;
-        const {
-          document,
-          blocks
-        } = value;
-        return blocks.some(node => {
-          const {
-            key: lowestNodeKey
-          } = node;
-          /* A list block has the following structure:
-          <ol>
-            <li>
-              <p>Coffee</p>
-            </li>
-            <li>
-              <p>Tea</p>
-            </li>
-          </ol>
-          */
-          const parent = document.getParent(lowestNodeKey);
-          const grandparent = document.getParent(parent.key);
-          return parent.type === 'list-item' && grandparent?.type === listType;
-        });
-      }
-    },
-    commands: {
-      toggleBlock(editor, type) {
-        switch (type) {
-          case 'heading-one':
-          case 'heading-two':
-          case 'heading-three':
-          case 'heading-four':
-          case 'heading-five':
-          case 'heading-six':
-            return editor.setBlocks(editor.everyBlock(type) ? defaultType : type);
-          case 'quote':
-            return editor.toggleQuoteBlock();
-          case 'numbered-list':
-          case 'bulleted-list':
-            {
-              return editor.toggleList(type);
-            }
-        }
-      },
-      unwrapBlockChildren(editor, block) {
-        if (!block || block.object !== 'block') {
-          throw Error(`Expected block but received ${block}.`);
-        }
-        const index = editor.value.document.getPath(block.key).last();
-        const parent = editor.value.document.getParent(block.key);
-        editor.withoutNormalizing(() => {
-          block.nodes.forEach((node, idx) => {
-            editor.moveNodeByKey(node.key, parent.key, index + idx);
-          });
-          editor.removeNodeByKey(block.key);
-        });
-      },
-      unwrapNodeToDepth(editor, node, depth) {
-        let currentDepth = 0;
-        editor.withoutNormalizing(() => {
-          while (currentDepth < depth) {
-            editor.unwrapNodeByKey(node.key);
-            currentDepth += 1;
-          }
-        });
-      },
-      unwrapNodeFromAncestor(editor, node, ancestor) {
-        const depth = ancestor.getDepth(node.key);
-        editor.unwrapNodeToDepth(node, depth);
-      }
-    }
-  };
-}
-export default CommandsAndQueries;

package/dist/esm/MarkdownControl/plugins/ForceInsert.js

@@ -1,42 +0,0 @@
-function ForceInsert({
-  defaultType
-}) {
-  return {
-    queries: {
-      canInsertBeforeNode(editor, node) {
-        if (!editor.isVoid(node)) {
-          return true;
-        }
-        return !!editor.value.document.getPreviousSibling(node.key);
-      },
-      canInsertAfterNode(editor, node) {
-        if (!editor.isVoid(node)) {
-          return true;
-        }
-        const nextSibling = editor.value.document.getNextSibling(node.key);
-        return nextSibling && !editor.isVoid(nextSibling);
-      }
-    },
-    commands: {
-      forceInsertBeforeNode(editor, node) {
-        const block = {
-          type: defaultType,
-          object: 'block'
-        };
-        const parent = editor.value.document.getParent(node.key);
-        return editor.insertNodeByKey(parent.key, 0, block).moveToStartOfNode(parent).focus();
-      },
-      forceInsertAfterNode(editor, node) {
-        return editor.moveToEndOfNode(node).insertBlock(defaultType).focus();
-      },
-      moveToEndOfDocument(editor) {
-        const lastBlock = editor.value.document.nodes.last();
-        if (editor.isVoid(lastBlock)) {
-          editor.insertBlock(defaultType);
-        }
-        return editor.moveToEndOfNode(lastBlock).focus();
-      }
-    }
-  };
-}
-export default ForceInsert;

package/dist/esm/MarkdownControl/plugins/Hotkey.js

@@ -1,26 +0,0 @@
-import isHotkey from 'is-hotkey';
-export const HOT_KEY_MAP = {
-  bold: 'mod+b',
-  code: 'mod+shift+c',
-  italic: 'mod+i',
-  strikethrough: 'mod+shift+s',
-  'heading-one': 'mod+1',
-  'heading-two': 'mod+2',
-  'heading-three': 'mod+3',
-  'heading-four': 'mod+4',
-  'heading-five': 'mod+5',
-  'heading-six': 'mod+6',
-  link: 'mod+k'
-};
-function Hotkey(key, fn) {
-  return {
-    onKeyDown(event, editor, next) {
-      if (!isHotkey(key, event)) {
-        return next();
-      }
-      event.preventDefault();
-      editor.command(fn);
-    }
-  };
-}
-export default Hotkey;

package/dist/esm/MarkdownControl/plugins/LineBreak.js

@@ -1,13 +0,0 @@
-import isHotkey from 'is-hotkey';
-function LineBreak() {
-  return {
-    onKeyDown(event, editor, next) {
-      const isShiftEnter = isHotkey('shift+enter', event);
-      if (!isShiftEnter) {
-        return next();
-      }
-      return editor.insertInline('break').insertText('').moveToStartOfNextText();
-    }
-  };
-}
-export default LineBreak;

package/dist/esm/MarkdownControl/plugins/Link.js

@@ -1,49 +0,0 @@
-function Link({
-  type
-}) {
-  return {
-    commands: {
-      toggleLink(editor, getUrl) {
-        const selection = editor.value.selection;
-        const isCollapsed = selection && selection.isCollapsed;
-        if (editor.hasInline(type)) {
-          const inlines = editor.value.inlines.toJSON();
-          const link = inlines.find(item => item.type === type);
-          const url = getUrl(link.data.url);
-          if (url) {
-            // replace the old link
-            return editor.setInlines({
-              data: {
-                url
-              }
-            });
-          } else {
-            // remove url if it was removed by the user
-            return editor.unwrapInline(type);
-          }
-        } else {
-          const url = getUrl();
-          if (!url) {
-            return;
-          }
-          return isCollapsed ? editor.insertInline({
-            type,
-            data: {
-              url
-            },
-            nodes: [{
-              object: 'text',
-              text: url
-            }]
-          }) : editor.wrapInline({
-            type,
-            data: {
-              url
-            }
-          }).moveToEnd();
-        }
-      }
-    }
-  };
-}
-export default Link;

package/dist/esm/MarkdownControl/plugins/lists/locations/isCursorInItemContainingNestedList.js

@@ -1,6 +0,0 @@
-import getListContainedInListItem from '../selectors/getListContainedInListItem';
-function isCursorInItemContainingNestedList(editor) {
-  const nestedList = getListContainedInListItem(editor);
-  return !!nestedList && `${nestedList[0].type}`.endsWith('-list');
-}
-export default isCursorInItemContainingNestedList;

package/dist/esm/MarkdownControl/plugins/util.js

@@ -1,11 +0,0 @@
-import castArray from 'lodash/castArray';
-import isArray from 'lodash/isArray';
-export function assertType(nodes, type) {
-  const nodesArray = castArray(nodes);
-  const validate = isArray(type) ? node => type.includes(node.type) : node => type === node.type;
-  const invalidNode = nodesArray.find(node => !validate(node));
-  if (invalidNode) {
-    throw Error(`Expected node of type "${type}", received "${invalidNode.type}".`);
-  }
-  return true;
-}

package/dist/esm/serializers/remarkImagesToText.js

@@ -1,31 +0,0 @@
-/**
- * Images must be parsed as shortcodes for asset proxying. This plugin converts
- * MDAST image nodes back to text to allow shortcode pattern matching. Note that
- * this transformation only occurs for images that are the sole child of a top
- * level paragraph - any other image is left alone and treated as an inline
- * image.
- */
-export default function remarkImagesToText() {
-  return transform;
-  function transform(node) {
-    const children = node.children.map(child => {
-      if (child.type === 'paragraph' && child.children.length === 1 && child.children[0].type === 'image') {
-        const {
-          alt,
-          url,
-          title
-        } = child.children[0];
-        const value = `![${alt || ''}](${url || ''}${title ? ` "${title}"` : ''})`;
-        child.children = [{
-          type: 'text',
-          value
-        }];
-      }
-      return child;
-    });
-    return {
-      ...node,
-      children
-    };
-  }
-}

package/dist/esm/types.js

@@ -1,2 +0,0 @@
-export const SLATE_DEFAULT_BLOCK_TYPE = 'paragraph';
-export const SLATE_BLOCK_PARENT_TYPES = ['list-item', 'quote'];