discord-message-transcript 1.2.0 → 1.3.0

package/dist/core/cdnResolver.d.ts

@@ -1,5 +1,5 @@
 import { CDNOptions } from "../types/types.js";
 import { TranscriptOptionsBase } from "discord-message-transcript-base";
 export declare function cdnResolver(url: string, options: TranscriptOptionsBase, cdnOptions: CDNOptions): Promise<string>;
-export declare function uploadCareResolver(url: string, publicKey: string, cdnDomain: string): Promise<string>;
-export declare function cloudinaryResolver(url: string, fileName: string, cloudName: string, apiKey: string, apiSecret: string): Promise<string>;
+export declare function uploadCareResolver(url: string, publicKey: string, cdnDomain: string, disableWarnings: boolean): Promise<string>;
+export declare function cloudinaryResolver(url: string, fileName: string, cloudName: string, apiKey: string, apiSecret: string, disableWarnings: boolean): Promise<string>;

package/dist/core/cdnResolver.js

@@ -15,7 +15,7 @@ export async function cdnResolver(url, options, cdnOptions) {
                 if (response.statusCode !== 200) {
                     response.destroy();
                     CustomWarn(`This is not an issue with the package. Using the original URL as fallback instead of uploading to CDN.
-Failed to fetch attachment with status code: ${response.statusCode} from ${url}.`);
+Failed to fetch attachment with status code: ${response.statusCode} from ${url}.`, options.disableWarnings);
                     return resolve(url);
                 }
                 const contentType = response.headers["content-type"];
@@ -23,7 +23,7 @@ Failed to fetch attachment with status code: ${response.statusCode} from ${url}.
                 if (!contentType || splitContentType.length != 2 || splitContentType[0].length == 0 || splitContentType[1].length == 0) {
                     response.destroy();
                     CustomWarn(`This is not an issue with the package. Using the original URL as fallback instead of uploading to CDN.
-Failed to receive a valid content-type from ${url}.`);
+Failed to receive a valid content-type from ${url}.`, options.disableWarnings);
                     return resolve(url);
                 }
                 response.destroy();
@@ -40,13 +40,13 @@ Failed to receive a valid content-type from ${url}.`);
             });
             request.on('error', (err) => {
                 CustomWarn(`This is not an issue with the package. Using the original URL as fallback instead of uploading to CDN.
-Error: ${err.message}`);
+Error: ${err.message}`, options.disableWarnings);
                 return resolve(url);
             });
             request.setTimeout(15000, () => {
                 request.destroy();
                 CustomWarn(`This is not an issue with the package. Using the original URL as fallback instead of uploading to CDN.
-Request timeout for ${url}.`);
+Request timeout for ${url}.`, options.disableWarnings);
                 resolve(url);
             });
             request.end();
@@ -54,32 +54,38 @@ Request timeout for ${url}.`);
     });
 }
 async function cdnRedirectType(url, options, contentType, cdnOptions) {
+    let newUrl;
     switch (cdnOptions.provider) {
         case "CUSTOM": {
             try {
-                return await cdnOptions.resolver(url, contentType, cdnOptions.customData);
+                newUrl = await cdnOptions.resolver(url, contentType, cdnOptions.customData);
+                break;
             }
             catch (error) {
                 CustomWarn(`Custom CDN resolver threw an error. Falling back to original URL.
 This is most likely an issue in the custom CDN implementation provided by the user.
 URL: ${url}
-Error: ${error?.message ?? error}`);
+Error: ${error?.message ?? error}`, options.disableWarnings);
                 return url;
             }
         }
         case "CLOUDINARY": {
-            return await cloudinaryResolver(url, options.fileName, cdnOptions.cloudName, cdnOptions.apiKey, cdnOptions.apiSecret);
-            ;
+            newUrl = await cloudinaryResolver(url, options.fileName, cdnOptions.cloudName, cdnOptions.apiKey, cdnOptions.apiSecret, options.disableWarnings);
+            break;
         }
         case "UPLOADCARE": {
-            return await uploadCareResolver(url, cdnOptions.publicKey, cdnOptions.cdnDomain);
+            newUrl = await uploadCareResolver(url, cdnOptions.publicKey, cdnOptions.cdnDomain, options.disableWarnings);
+            break;
         }
     }
+    if (validateCdnUrl(newUrl, options.disableWarnings))
+        return newUrl;
+    return url;
 }
 function sleep(ms) {
     return new Promise(r => setTimeout(r, ms));
 }
-export async function uploadCareResolver(url, publicKey, cdnDomain) {
+export async function uploadCareResolver(url, publicKey, cdnDomain, disableWarnings) {
     try {
         const form = new FormData();
         form.append("pub_key", publicKey);
@@ -135,11 +141,11 @@ export async function uploadCareResolver(url, publicKey, cdnDomain) {
         CustomWarn(`Uploadcare CDN upload failed. Using original URL as fallback.
 Check Uploadcare public key, CDN domain, project settings, rate limits, and network access.
 URL: ${url}
-Error: ${error?.message ?? error}`);
+Error: ${error?.message ?? error}`, disableWarnings);
         return url;
     }
 }
-export async function cloudinaryResolver(url, fileName, cloudName, apiKey, apiSecret) {
+export async function cloudinaryResolver(url, fileName, cloudName, apiKey, apiSecret, disableWarnings) {
     try {
         const paramsToSign = {
             folder: `discord-message-transcript/${fileName}`,
@@ -148,9 +154,9 @@ export async function cloudinaryResolver(url, fileName, cloudName, apiKey, apiSe
             use_filename: "true",
         };
         const stringToSign = Object.keys(paramsToSign).sort().map(k => `${k}=${paramsToSign[k]}`).join("&");
-        // signature SHA1
+        // signature SHA256
         const signature = crypto
-            .createHash("sha1")
+            .createHash("sha256")
             .update(stringToSign + apiSecret)
             .digest("hex");
         const form = new FormData();
@@ -190,8 +196,15 @@ export async function cloudinaryResolver(url, fileName, cloudName, apiKey, apiSe
         CustomWarn(`Failed to upload asset to Cloudinary CDN. Using original URL as fallback.
 Check Cloudinary configuration (cloud name, API key, API secret) and network access.
 URL: ${url}
-Error: ${error?.message ?? error}`);
+Error: ${error?.message ?? error}`, disableWarnings);
         return url;
     }
 }
 // Note: for debug use ${JSON.stringify(await res.json())} to understand the error
+function validateCdnUrl(url, disableWarnings) {
+    if (url.includes('"') || url.includes('<') || url.includes('>')) {
+        CustomWarn(`Unsafe URL received from CDN, using fallback.\nURL: ${url}`, disableWarnings);
+        return false;
+    }
+    return true;
+}

package/dist/core/componentToJson.js

@@ -1,6 +1,7 @@
 import { ComponentType } from "discord.js";
 import { mapButtonStyle, mapSelectorType, mapSeparatorSpacing } from "./mappers.js";
 import { JsonComponentType } from "discord-message-transcript-base";
+import { isValidHexColor } from "../../../discord-message-transcript-base/src/core/sanitizer.js";
 export async function componentsToJson(components, options) {
     const processedComponents = await Promise.all(components.filter(component => !(!options.includeV2Components && component.type != ComponentType.ActionRow))
         .map(async (component) => {
@@ -57,7 +58,7 @@ export async function componentsToJson(components, options) {
                 return {
                     type: JsonComponentType.Container,
                     components: componentsJson.filter(isJsonComponentInContainer), // Input components that are container-safe must always produce container-safe output.
-                    hexAccentColor: component.hexAccentColor,
+                    hexAccentColor: isValidHexColor(component.hexAccentColor, false),
                     spoiler: component.spoiler,
                 };
             }

package/dist/core/fetchMessages.js

@@ -1,6 +1,7 @@
 import { EmbedType } from "discord.js";
 import { componentsToJson } from "./componentToJson.js";
 import { getMentions } from "./getMentions.js";
+import { isValidHexColor, sanitize } from "../../../discord-message-transcript-base/src/core/sanitizer.js";
 export async function fetchMessages(ctx) {
     const { channel, options, transcriptState, lastMessageId } = ctx;
     const { authors, mentions } = transcriptState;
@@ -24,7 +25,7 @@ export async function fetchMessages(ctx) {
                     description: embed.description ?? null,
                     fields: embed.fields.map(field => ({ inline: field.inline ?? false, name: field.name, value: field.value })),
                     footer: embed.footer ? { iconURL: embed.footer?.iconURL ?? null, text: embed.footer.text } : null,
-                    hexColor: embed.hexColor ?? null,
+                    hexColor: isValidHexColor(embed.hexColor, true),
                     image: embed.image?.url ? { url: embed.image.url } : null,
                     thumbnail: embed.thumbnail?.url ? { url: embed.thumbnail.url } : null,
                     timestamp: embed.timestamp,
@@ -37,11 +38,11 @@ export async function fetchMessages(ctx) {
             authors.set(message.author.id, {
                 avatarURL: message.author.displayAvatarURL(),
                 bot: message.author.bot,
-                displayName: message.author.displayName,
+                displayName: sanitize(message.author.displayName),
                 guildTag: message.author.primaryGuild?.tag ?? null,
                 id: message.author.id,
                 member: message.member ? {
-                    displayHexColor: message.member.displayHexColor,
+                    displayHexColor: isValidHexColor(message.member.displayHexColor, false),
                     displayName: message.member.displayName,
                 } : null,
                 system: message.author.system,

package/dist/core/getMentions.js

@@ -1,10 +1,12 @@
 import { ChannelType } from "discord.js";
+import { isValidHexColor, sanitize } from "../../../discord-message-transcript-base/src/core/sanitizer.js";
 export async function getMentions(message, mentions) {
     message.mentions.channels.forEach(channel => {
         if (!mentions.channels.has(channel.id)) {
             mentions.channels.set(channel.id, {
                 id: channel.id,
-                name: channel.type !== ChannelType.DM ? channel.name : channel.recipient?.displayName ?? null
+                name: channel.type !== ChannelType.DM ? channel.name ? sanitize(channel.name) : null
+                    : channel.recipient?.displayName ? sanitize(channel.recipient?.displayName) : null
             });
         }
     });
@@ -12,8 +14,8 @@ export async function getMentions(message, mentions) {
         if (!mentions.roles.has(role.id)) {
             mentions.roles.set(role.id, {
                 id: role.id,
-                color: role.hexColor,
-                name: role.name
+                color: isValidHexColor(role.hexColor, false),
+                name: sanitize(role.name)
             });
         }
     });
@@ -22,8 +24,8 @@ export async function getMentions(message, mentions) {
             if (!mentions.users.has(member.id)) {
                 mentions.users.set(member.id, {
                     id: member.id,
-                    color: member.displayHexColor,
-                    name: member.displayName
+                    color: isValidHexColor(member.displayHexColor, true),
+                    name: sanitize(member.displayName)
                 });
             }
         });
@@ -33,8 +35,8 @@ export async function getMentions(message, mentions) {
             if (!mentions.users.has(user.id)) {
                 mentions.users.set(user.id, {
                     id: user.id,
-                    color: user.hexAccentColor ?? null,
-                    name: user.displayName
+                    color: isValidHexColor(user.hexAccentColor ?? null, true),
+                    name: sanitize(user.displayName)
                 });
             }
         });
@@ -55,7 +57,7 @@ async function fetchRoleMention(message, mentions) {
             const role = await message.guild?.roles.fetch(id);
             if (!role)
                 continue;
-            mentions.roles.set(role.id, { id: role.id, color: role.hexColor, name: role.name });
+            mentions.roles.set(role.id, { id: role.id, color: isValidHexColor(role.hexColor, false), name: sanitize(role.name) });
         }
         catch { } // Role may not exist
     }
@@ -73,7 +75,7 @@ async function fetchUserMention(message, mentions) {
             try {
                 const user = await message.guild.members.fetch(id);
                 if (user) {
-                    mentions.users.set(user.id, { id: user.id, color: user.displayHexColor, name: user.displayName });
+                    mentions.users.set(user.id, { id: user.id, color: isValidHexColor(user.displayHexColor, true), name: sanitize(user.displayName) });
                     continue; // Continue inside if to allow fallback to regular user fetch
                 }
             }
@@ -83,7 +85,7 @@ async function fetchUserMention(message, mentions) {
             const user = await message.client.users.fetch(id);
             if (!user)
                 continue;
-            mentions.users.set(user.id, { id: user.id, color: message.guild ? null : user.hexAccentColor ?? null, name: user.displayName });
+            mentions.users.set(user.id, { id: user.id, color: message.guild ? null : isValidHexColor(user.hexAccentColor ?? null, true) ?? null, name: sanitize(user.displayName) });
         }
         catch { } // User may not exist
     }
@@ -101,7 +103,7 @@ async function fetchChannelMention(message, mentions) {
             const channel = await message.guild?.channels.fetch(id);
             if (!channel)
                 continue;
-            mentions.channels.set(channel.id, { id: channel.id, name: channel.name });
+            mentions.channels.set(channel.id, { id: channel.id, name: sanitize(channel.name) });
         }
         catch { } // Channel may not exist
     }

package/dist/core/imageToBase64.d.ts

@@ -1 +1 @@
-export declare function imageToBase64(url: string): Promise<string>;
+export declare function imageToBase64(url: string, disableWarnings: boolean): Promise<string>;

package/dist/core/imageToBase64.js

@@ -2,7 +2,7 @@ import https from 'https';
 import http from 'http';
 import { CustomWarn } from 'discord-message-transcript-base';
 import { getBase64Limiter } from './limiter.js';
-export async function imageToBase64(url) {
+export async function imageToBase64(url, disableWarnings) {
     const limit = getBase64Limiter();
     return limit(async () => {
         return new Promise((resolve, reject) => {
@@ -11,7 +11,7 @@ export async function imageToBase64(url) {
                 if (response.statusCode !== 200) {
                     response.destroy();
                     CustomWarn(`This is not an issue with the package. Using the original URL as fallback instead of converting to base64.
-Failed to fetch image with status code: ${response.statusCode} from ${url}.`);
+Failed to fetch image with status code: ${response.statusCode} from ${url}.`, disableWarnings);
                     return resolve(url);
                 }
                 const contentType = response.headers['content-type'];
@@ -31,20 +31,20 @@ Failed to fetch image with status code: ${response.statusCode} from ${url}.`);
                 response.on('error', (err) => {
                     CustomWarn(`This is not an issue with the package. Using the original URL as fallback instead of converting to base64.
 Stream error while fetching from ${url}.
-Error: ${err.message}`);
+Error: ${err.message}`, disableWarnings);
                     resolve(url);
                 });
             });
             request.on('error', (err) => {
                 CustomWarn(`This is not an issue with the package. Using the original URL as fallback instead of converting to base64.
 Error fetching image from ${url}
-Error: ${err.message}`);
+Error: ${err.message}`, disableWarnings);
                 return resolve(url);
             });
             request.setTimeout(15000, () => {
                 request.destroy();
                 CustomWarn(`This is not an issue with the package. Using the original URL as fallback instead of converting to base64.
-Request timeout for ${url}.`);
+Request timeout for ${url}.`, disableWarnings);
                 resolve(url);
             });
             request.end();

package/dist/core/urlResolver.js

@@ -2,7 +2,10 @@ import { JsonComponentType } from "discord-message-transcript-base";
 import { cdnResolver } from "./cdnResolver.js";
 import { imageToBase64 } from "./imageToBase64.js";
 import { isJsonComponentInContainer } from "./componentToJson.js";
+import { FALLBACK_PIXEL, isSafeForHTML, resolveImageURL } from "../../../discord-message-transcript-base/src/core/sanitizer.js";
 export async function urlResolver(url, options, cdnOptions, urlCache) {
+    if (url == FALLBACK_PIXEL || url == "")
+        return url;
     if (urlCache.has(url)) {
         const cache = urlCache.get(url);
         if (cache)
@@ -12,7 +15,7 @@ export async function urlResolver(url, options, cdnOptions, urlCache) {
     if (cdnOptions)
         returnUrl = cdnResolver(url, options, cdnOptions);
     else if (options.saveImages)
-        returnUrl = imageToBase64(url);
+        returnUrl = imageToBase64(url, options.disableWarnings);
     if (returnUrl) {
         urlCache.set(url, returnUrl);
         return await returnUrl;
@@ -21,19 +24,31 @@ export async function urlResolver(url, options, cdnOptions, urlCache) {
 }
 export async function messagesUrlResolver(messages, options, cdnOptions, urlCache) {
     return await Promise.all(messages.map(async (message) => {
-        const attachmentsPromise = Promise.all(message.attachments.map(async (attachment) => {
+        // Needs to wait for resolve correct when used attachment://
+        const attachments = await Promise.all(message.attachments.map(async (attachment) => {
+            let url;
+            if (attachment.contentType?.startsWith("image/")) {
+                url = await resolveImageURL(attachment.url, options, false, message.attachments);
+            }
+            else {
+                url = await isSafeForHTML(attachment.url, options) ? attachment.url : "";
+            }
             return {
                 ...attachment,
-                url: await urlResolver(attachment.url, options, cdnOptions, urlCache)
+                url: await urlResolver(url, options, cdnOptions, urlCache)
             };
         }));
         const embedsPromise = Promise.all(message.embeds.map(async (embed) => {
+            const authorIconUrl = embed.author?.iconURL ? await resolveImageURL(embed.author.iconURL, options, true, attachments) : null;
+            const footerIconUrl = embed.footer?.iconURL ? await resolveImageURL(embed.footer.iconURL, options, true, attachments) : null;
+            const imageUrl = embed.image?.url ? await resolveImageURL(embed.image.url, options, true, attachments) : null;
+            const thumbnailUrl = embed.thumbnail?.url ? await resolveImageURL(embed.thumbnail.url, options, true, attachments) : null;
             return {
                 ...embed,
-                author: embed.author ? { ...embed.author, iconURL: embed.author.iconURL ? await urlResolver(embed.author.iconURL, options, cdnOptions, urlCache) : null } : null,
-                footer: embed.footer ? { ...embed.footer, iconURL: embed.footer.iconURL ? await urlResolver(embed.footer.iconURL, options, cdnOptions, urlCache) : null } : null,
-                image: embed.image?.url ? { url: await urlResolver(embed.image.url, options, cdnOptions, urlCache) } : null,
-                thumbnail: embed.thumbnail?.url ? { url: await urlResolver(embed.thumbnail.url, options, cdnOptions, urlCache) } : null,
+                author: embed.author ? { ...embed.author, iconURL: authorIconUrl ? await urlResolver(authorIconUrl, options, cdnOptions, urlCache) : null } : null,
+                footer: embed.footer ? { ...embed.footer, iconURL: footerIconUrl ? await urlResolver(footerIconUrl, options, cdnOptions, urlCache) : null } : null,
+                image: embed.image?.url && imageUrl ? { url: await urlResolver(imageUrl, options, cdnOptions, urlCache) } : null,
+                thumbnail: embed.thumbnail?.url && thumbnailUrl ? { url: await urlResolver(thumbnailUrl, options, cdnOptions, urlCache) } : null,
             };
         }));
         async function componentsFunction(components) {
@@ -45,7 +60,7 @@ export async function messagesUrlResolver(messages, options, cdnOptions, urlCach
                             accessory: {
                                 ...component.accessory,
                                 media: {
-                                    url: await urlResolver(component.accessory.media.url, options, cdnOptions, urlCache),
+                                    url: await urlResolver((await resolveImageURL(component.accessory.media.url, options, false, attachments)), options, cdnOptions, urlCache),
                                 }
                             }
                         };
@@ -57,7 +72,7 @@ export async function messagesUrlResolver(messages, options, cdnOptions, urlCach
                         items: await Promise.all(component.items.map(async (item) => {
                             return {
                                 ...item,
-                                media: { url: await urlResolver(item.media.url, options, cdnOptions, urlCache) },
+                                media: { url: await urlResolver((await resolveImageURL(item.media.url, options, false, attachments)), options, cdnOptions, urlCache) },
                             };
                         }))
                     };
@@ -65,7 +80,7 @@ export async function messagesUrlResolver(messages, options, cdnOptions, urlCach
                 if (component.type == JsonComponentType.File) {
                     return {
                         ...component,
-                        url: await urlResolver(component.url, options, cdnOptions, urlCache),
+                        url: await urlResolver((await isSafeForHTML(component.url, options) ? component.url : ""), options, cdnOptions, urlCache),
                     };
                 }
                 if (component.type == JsonComponentType.Container) {
@@ -78,8 +93,7 @@ export async function messagesUrlResolver(messages, options, cdnOptions, urlCach
             }));
         }
         const componentsPromise = componentsFunction(message.components);
-        const [attachments, embeds, components] = await Promise.all([
-            attachmentsPromise,
+        const [embeds, components] = await Promise.all([
             embedsPromise,
             componentsPromise
         ]);
@@ -95,7 +109,7 @@ export async function authorUrlResolver(authors, options, cdnOptions, urlCache)
     return await Promise.all(Array.from(authors.values()).map(async (author) => {
         return {
             ...author,
-            avatarURL: await urlResolver(author.avatarURL, options, cdnOptions, urlCache),
+            avatarURL: await urlResolver((await resolveImageURL(author.avatarURL, options, false)), options, cdnOptions, urlCache),
         };
     }));
 }

package/dist/index.js

@@ -27,15 +27,16 @@ export async function createTranscript(channel, options = {}) {
             }
         }
         const artificialReturnType = options.returnType == ReturnType.Attachment ? ReturnTypeBase.Buffer : options.returnType ? returnTypeMapper(options.returnType) : ReturnTypeBase.Buffer;
-        const { fileName = null, includeAttachments = true, includeButtons = true, includeComponents = true, includeEmpty = false, includeEmbeds = true, includePolls = true, includeReactions = true, includeV2Components = true, localDate = 'en-GB', quantity = 0, returnFormat = ReturnFormat.HTML, saveImages = false, selfContained = false, timeZone = 'UTC', watermark = true, } = options;
+        const { fileName = null, disableWarnings = false, includeAttachments = true, includeButtons = true, includeComponents = true, includeEmpty = false, includeEmbeds = true, includePolls = true, includeReactions = true, includeV2Components = true, localDate = 'en-GB', quantity = 0, returnFormat = ReturnFormat.HTML, safeMode = true, saveImages = false, selfContained = false, timeZone = 'UTC', watermark = true, } = options;
         const checkedFileName = (fileName ?? `Transcript-${channel.isDMBased() ? "DirectMessage" : channel.name}-${channel.id}`);
         let validQuantity = true;
         if (quantity < 0) {
-            CustomWarn("Quantity can't be a negative number, please use 0 for unlimited messages.\nUsing 0 as fallback!");
+            CustomWarn("Quantity can't be a negative number, please use 0 for unlimited messages.\nUsing 0 as fallback!", options.disableWarnings ?? false);
             validQuantity = false;
         }
         const internalOptions = {
             fileName: checkedFileName,
+            disableWarnings,
             includeAttachments,
             includeButtons,
             includeComponents,
@@ -48,6 +49,7 @@ export async function createTranscript(channel, options = {}) {
             quantity: validQuantity ? quantity : 0,
             returnFormat,
             returnType: artificialReturnType,
+            safeMode,
             saveImages,
             selfContained,
             timeZone,
@@ -90,23 +92,21 @@ export async function createTranscript(channel, options = {}) {
                 ...options.cdnOptions
             };
         }
-        if (options.cdnOptions || options.saveImages) {
-            await Promise.all([
-                (async () => {
-                    jsonTranscript.setAuthors(await authorUrlResolver(authors, internalOptions, options.cdnOptions ?? null, urlCache));
-                    authors.clear();
-                })(),
-                (() => {
-                    jsonTranscript.setMentions({ channels: Array.from(mentions.channels.values()), roles: Array.from(mentions.roles.values()), users: Array.from(mentions.users.values()) });
-                    mentions.channels.clear();
-                    mentions.roles.clear();
-                    mentions.users.clear();
-                })(),
-                (async () => {
-                    jsonTranscript.setMessages(await messagesUrlResolver(jsonTranscript.getMessages(), internalOptions, options.cdnOptions ?? null, urlCache));
-                })()
-            ]);
-        }
+        await Promise.all([
+            (async () => {
+                jsonTranscript.setAuthors(await authorUrlResolver(authors, internalOptions, options.cdnOptions ?? null, urlCache));
+                authors.clear();
+            })(),
+            (() => {
+                jsonTranscript.setMentions({ channels: Array.from(mentions.channels.values()), roles: Array.from(mentions.roles.values()), users: Array.from(mentions.users.values()) });
+                mentions.channels.clear();
+                mentions.roles.clear();
+                mentions.users.clear();
+            })(),
+            (async () => {
+                jsonTranscript.setMessages(await messagesUrlResolver(jsonTranscript.getMessages(), internalOptions, options.cdnOptions ?? null, urlCache));
+            })()
+        ]);
         const outputJson = await jsonTranscript.toJson();
         urlCache.clear();
         const result = await output(outputJson);

package/dist/renderers/json/json.js

@@ -1,5 +1,6 @@
 import { BaseGuildTextChannel, DMChannel } from "discord.js";
 import { urlResolver } from "../../core/urlResolver.js";
+import { resolveImageURL } from "../../../../discord-message-transcript-base/src/core/sanitizer.js";
 export class Json {
     guild;
     channel;
@@ -43,8 +44,9 @@ export class Json {
     async toJson() {
         const channel = await this.channel.fetch();
         const channelImg = channel instanceof DMChannel ? channel.recipient?.displayAvatarURL() ?? "cdn.discordapp.com/embed/avatars/4.png" : channel.isDMBased() ? channel.iconURL() ?? (await channel.fetchOwner()).displayAvatarURL() : null;
+        const safeChannelImg = await resolveImageURL(channelImg, this.options, true);
         const guild = !channel.isDMBased() ? this.guild : null;
-        const guildIcon = guild?.iconURL();
+        const guildIcon = guild ? await resolveImageURL(guild.iconURL(), this.options, true) : null;
         const guildJson = !guild ? null : {
             name: guild.name,
             id: guild.id,
@@ -58,7 +60,7 @@ export class Json {
                 parent: channel.isDMBased() ? null : (channel.parent ? { name: channel.parent.name, id: channel.parent.id } : null),
                 topic: (channel instanceof BaseGuildTextChannel) ? channel.topic : null,
                 id: channel.id,
-                img: channelImg ? await urlResolver(channelImg, this.options, this.cdnOptions, this.urlCache) : null,
+                img: safeChannelImg ? await urlResolver(safeChannelImg, this.options, this.cdnOptions, this.urlCache) : null,
             },
             authors: this.authors,
             messages: this.messages.reverse(),

package/dist/types/types.d.ts

@@ -73,6 +73,12 @@ export interface TranscriptOptions<T extends ReturnType> {
      * Configuration for uploading attachments and other assets to a CDN.
      */
     cdnOptions: CDNOptions;
+    /**
+     * Disable all warnings to keep console output clean.
+     * ⚠️ Can hide issues like unsafe URLs or fallback usage.
+     * @default false
+     */
+    disableWarnings: boolean;
     /**
      * The name of the generated file (without extension).
      * @default `Transcript-channel-name-channel-id`
@@ -146,6 +152,14 @@ export interface TranscriptOptions<T extends ReturnType> {
      * @default ReturnType.Attachment
      */
     returnType: T;
+    /**
+     * Enables safe mode, blocking potentially unsafe URLs and content.
+     * Prevents suspicious links, images, or HTML from being included in the final transcript.
+     *
+     * ⚠️ Disabling may allow unsafe content to appear in the transcript.
+     * @default true
+     */
+    safeMode: boolean;
     /**
      * Whether to save images as base64 data directly in the transcript.
      * This is an alternative to using a CDN and results in larger file sizes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "discord-message-transcript",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -48,7 +48,7 @@
     "typescript": "^5.9.3"
   },
   "dependencies": {
-    "discord-message-transcript-base": "1.2.0"
+    "discord-message-transcript-base": "1.3.0"
   },
   "peerDependencies": {
     "discord.js": ">=14.19.0 <15"