documentation-hub 5.7.2

package/src/utils/urlSanitizer.ts

@@ -0,0 +1,152 @@
+/**
+ * URL Sanitization Utility
+ *
+ * Protects against XSS attacks via malicious URLs in href attributes.
+ * Blocks dangerous protocols like javascript:, data:, vbscript:, file:
+ *
+ * Security Context:
+ * - Prevents DOM-based XSS vulnerabilities
+ * - Critical for Electron apps with IPC access
+ * - Blocks protocol smuggling attacks
+ *
+ * @module urlSanitizer
+ */
+
+import logger from './logger';
+
+/**
+ * List of allowed URL protocols that are safe for href attributes
+ */
+const ALLOWED_PROTOCOLS = ['http:', 'https:', 'mailto:', 'tel:', 'ftp:', 'ftps:'] as const;
+
+/**
+ * List of dangerous protocols that should be blocked
+ * These can execute code or access local resources
+ */
+const DANGEROUS_PROTOCOLS = [
+  'javascript:',
+  'data:',
+  'vbscript:',
+  'file:',
+  'about:',
+  'blob:',
+] as const;
+
+/**
+ * Sanitizes a URL to prevent XSS attacks via href attributes.
+ *
+ * Validates the URL protocol and structure to ensure it's safe for use
+ * in HTML href attributes. Blocks dangerous protocols that could execute
+ * arbitrary code or access local resources.
+ *
+ * @param url - The URL to sanitize (can be string, null, or undefined)
+ * @returns A safe URL string, or '#' if the URL is invalid/dangerous
+ *
+ * @example
+ * ```typescript
+ * sanitizeUrl('https://example.com')           // ✅ 'https://example.com'
+ * sanitizeUrl('javascript:alert("XSS")')       // ❌ '#'
+ * sanitizeUrl('data:text/html,<script>')       // ❌ '#'
+ * sanitizeUrl('mailto:user@example.com')       // ✅ 'mailto:user@example.com'
+ * sanitizeUrl(null)                            // ❌ '#'
+ * sanitizeUrl('')                              // ❌ '#'
+ * ```
+ */
+export function sanitizeUrl(url: string | null | undefined): string {
+  // Handle null, undefined, or empty strings
+  if (!url || typeof url !== 'string') {
+    return '#';
+  }
+
+  // Trim whitespace
+  const trimmedUrl = url.trim();
+
+  // Check for empty string after trimming
+  if (trimmedUrl === '' || trimmedUrl === '#') {
+    return '#';
+  }
+
+  // Handle relative URLs (consider safe if they don't start with dangerous patterns)
+  if (trimmedUrl.startsWith('/') || trimmedUrl.startsWith('./') || trimmedUrl.startsWith('../')) {
+    // Relative URLs are generally safe in web contexts
+    // But in Electron, we want to be cautious
+    return '#';
+  }
+
+  // Check if URL starts with a hash (anchor link - safe)
+  if (trimmedUrl.startsWith('#')) {
+    return trimmedUrl;
+  }
+
+  try {
+    // Parse the URL to extract protocol
+    // For URLs without protocol, URL constructor will throw
+    let parsedUrl: URL;
+
+    try {
+      parsedUrl = new URL(trimmedUrl);
+    } catch {
+      // If URL parsing fails, it might be a relative URL or malformed
+      // Check if it looks like it has a protocol
+      if (trimmedUrl.includes(':')) {
+        // Has a colon, might be a protocol - check if dangerous
+        const colonIndex = trimmedUrl.indexOf(':');
+        const possibleProtocol = trimmedUrl.substring(0, colonIndex + 1).toLowerCase();
+
+        // Check against dangerous protocols
+        if (DANGEROUS_PROTOCOLS.includes(possibleProtocol as any)) {
+          return '#';
+        }
+      }
+
+      // If no protocol or unknown format, return safe fallback
+      return '#';
+    }
+
+    // Convert protocol to lowercase for case-insensitive comparison
+    const protocol = parsedUrl.protocol.toLowerCase();
+
+    // Check against dangerous protocols
+    if (DANGEROUS_PROTOCOLS.includes(protocol as any)) {
+      return '#';
+    }
+
+    // Check if protocol is in allowed list
+    if (ALLOWED_PROTOCOLS.includes(protocol as any)) {
+      return trimmedUrl; // Return original URL (preserves casing)
+    }
+
+    // Unknown protocol - reject for safety
+    return '#';
+  } catch (error) {
+    // If any error occurs during parsing, return safe fallback
+    logger.warn('[URL Sanitizer] Failed to parse URL:', url, error);
+    return '#';
+  }
+}
+
+/**
+ * Checks if a URL is safe without modifying it.
+ *
+ * @param url - The URL to check
+ * @returns true if the URL is safe, false otherwise
+ *
+ * @example
+ * ```typescript
+ * isSafeUrl('https://example.com')           // true
+ * isSafeUrl('javascript:alert("XSS")')       // false
+ * ```
+ */
+export function isSafeUrl(url: string | null | undefined): boolean {
+  return sanitizeUrl(url) !== '#';
+}
+
+/**
+ * Sanitizes an array of URLs.
+ *
+ * @param urls - Array of URLs to sanitize
+ * @returns Array of sanitized URLs
+ */
+export function sanitizeUrls(urls: (string | null | undefined)[]): string[] {
+  return urls.map(sanitizeUrl);
+}

package/src/vite-env.d.ts

@@ -0,0 +1,11 @@
+/// <reference types="vite/client" />
+
+declare module '*.svg' {
+  const content: string;
+  export default content;
+}
+
+declare module '/icon.svg' {
+  const content: string;
+  export default content;
+}

package/tsconfig.electron.json

@@ -0,0 +1,19 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "commonjs",
+    "moduleResolution": "node",
+    "lib": ["ES2022"],
+    "types": ["node", "electron"],
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "strict": false,
+    "noEmit": true,
+    "resolveJsonModule": true,
+    "allowSyntheticDefaultImports": true,
+    "forceConsistentCasingInFileNames": true
+  },
+  "include": ["electron/**/*"],
+  "exclude": ["node_modules", "dist", "release"]
+}

package/tsconfig.json

@@ -0,0 +1,36 @@
+{
+  "_comment": "Force TypeScript reload",
+  "compilerOptions": {
+    "target": "ES2022",
+    "useDefineForClassFields": true,
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "skipLibCheck": true,
+    "moduleResolution": "bundler",
+    "allowImportingTsExtensions": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "noEmit": true,
+    "jsx": "react-jsx",
+    "strict": true,
+    "noUnusedLocals": false,
+    "noUnusedParameters": false,
+    "noFallthroughCasesInSwitch": true,
+    "esModuleInterop": true,
+    "forceConsistentCasingInFileNames": true,
+    "allowSyntheticDefaultImports": true,
+    "baseUrl": ".",
+    "paths": {
+      "@/*": ["./src/*"],
+      "@components/*": ["./src/components/*"],
+      "@hooks/*": ["./src/hooks/*"],
+      "@utils/*": ["./src/utils/*"],
+      "@styles/*": ["./src/styles/*"],
+      "@pages/*": ["./src/pages/*"],
+      "@contexts/*": ["./src/contexts/*"]
+    }
+  },
+  "include": ["src"],
+  "exclude": ["electron", "node_modules", "dist", "release", "src/**/__tests__", "src/**/*.test.ts", "src/**/*.test.tsx"],
+  "references": [{ "path": "./tsconfig.node.json" }]
+}

package/tsconfig.node.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "composite": true,
+    "skipLibCheck": true,
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "allowSyntheticDefaultImports": true,
+    "strict": true,
+    "forceConsistentCasingInFileNames": true
+  },
+  "include": ["vite.config.ts"]
+}

package/typedoc.json

@@ -0,0 +1,45 @@
+{
+  "$schema": "https://typedoc.org/schema.json",
+  "entryPoints": [
+    "./src/services/document/DocXMLaterProcessor.ts",
+    "./src/services/document/types/docx-processing.ts",
+    "./src/utils/textSanitizer.ts"
+  ],
+  "out": "./docs/api",
+  "plugin": [],
+  "compilerOptions": {
+    "skipLibCheck": true
+  },
+  "readme": "./docs/api/API_README.md",
+  "name": "Documentation Hub - API Documentation",
+  "includeVersion": true,
+  "entryPointStrategy": "expand",
+  "categorizeByGroup": true,
+  "sort": ["source-order"],
+  "groupOrder": [
+    "Document I/O",
+    "Style Operations",
+    "Table Operations",
+    "Paragraph Formatting",
+    "High-Level Operations",
+    "Hyperlink Operations",
+    "Search & Replace",
+    "Document Statistics",
+    "Utilities",
+    "*"
+  ],
+  "exclude": [
+    "**/*+(test|spec).ts",
+    "**/node_modules/**",
+    "**/dist/**"
+  ],
+  "excludePrivate": true,
+  "excludeProtected": false,
+  "excludeInternal": false,
+  "hideGenerator": false,
+  "disableSources": false,
+  "searchInComments": true,
+  "navigationLinks": {
+    "GitHub": "https://github.com/ItMeDiaTech/Documentation_Hub"
+  }
+}

package/vite.config.ts

@@ -0,0 +1,152 @@
+import { defineConfig } from 'vite';
+import react from '@vitejs/plugin-react';
+import electron from 'vite-plugin-electron';
+import renderer from 'vite-plugin-electron-renderer';
+import tailwindcss from '@tailwindcss/vite';
+import { resolve } from 'path';
+
+export default defineConfig({
+  optimizeDeps: {
+    include: ['lucide-react', 'docxmlater'],
+  },
+  plugins: [
+    tailwindcss(),
+    react(),
+    electron([
+      {
+        entry: 'electron/main.ts',
+        vite: {
+          resolve: {
+            alias: {
+              '@': resolve(__dirname, './src'),
+              '@components': resolve(__dirname, './src/components'),
+              '@hooks': resolve(__dirname, './src/hooks'),
+              '@utils': resolve(__dirname, './src/utils'),
+              '@styles': resolve(__dirname, './src/styles'),
+              '@pages': resolve(__dirname, './src/pages'),
+              '@contexts': resolve(__dirname, './src/contexts'),
+            },
+            preserveSymlinks: false,
+          },
+          build: {
+            outDir: 'dist/electron',
+            emptyOutDir: false,
+            minify: false, // Disable minification to debug electron import issues
+            commonjsOptions: {
+              include: [/node_modules/, /docxmlater/],
+            },
+            rollupOptions: {
+              external: [
+                'electron',
+                'canvas',
+                'docxmlater',
+                'xlsx',
+                'better-sqlite3',
+                '@azure/msal-node',
+                'electron-updater',
+                'electron-log',
+              ],
+              output: {
+                format: 'cjs', // Use CommonJS to support __dirname natively
+              },
+            },
+          },
+        },
+      },
+      {
+        entry: 'electron/preload.ts',
+        onstart(options) {
+          options.reload();
+        },
+        vite: {
+          resolve: {
+            alias: {
+              '@': resolve(__dirname, './src'),
+              '@components': resolve(__dirname, './src/components'),
+              '@hooks': resolve(__dirname, './src/hooks'),
+              '@utils': resolve(__dirname, './src/utils'),
+              '@styles': resolve(__dirname, './src/styles'),
+              '@pages': resolve(__dirname, './src/pages'),
+              '@contexts': resolve(__dirname, './src/contexts'),
+            },
+            preserveSymlinks: false,
+          },
+          build: {
+            outDir: 'dist/electron',
+            commonjsOptions: {
+              include: [/node_modules/, /docxmlater/],
+            },
+            rollupOptions: {
+              external: [
+                'electron',
+                'canvas',
+                'docxmlater',
+                'xlsx',
+                'better-sqlite3',
+                '@azure/msal-node',
+                'electron-updater',
+                'electron-log',
+              ],
+              output: {
+                format: 'cjs', // Use CommonJS to support __dirname natively
+              },
+            },
+          },
+        },
+      },
+    ]),
+    renderer(),
+  ],
+  resolve: {
+    alias: {
+      '@': resolve(__dirname, './src'),
+      '@components': resolve(__dirname, './src/components'),
+      '@hooks': resolve(__dirname, './src/hooks'),
+      '@utils': resolve(__dirname, './src/utils'),
+      '@styles': resolve(__dirname, './src/styles'),
+      '@pages': resolve(__dirname, './src/pages'),
+      '@contexts': resolve(__dirname, './src/contexts'),
+    },
+    preserveSymlinks: false,
+  },
+  server: {
+    port: 5173,
+    strictPort: true,
+  },
+  build: {
+    outDir: 'dist',
+    emptyOutDir: true,
+    chunkSizeWarningLimit: 600, // Increase from 500kb to 600kb
+    commonjsOptions: {
+      include: [/lucide-react/, /node_modules/, /docxmlater/],
+    },
+    // Use esbuild minification (faster and already included)
+    minify: 'esbuild',
+    rollupOptions: {
+      input: {
+        index: resolve(__dirname, 'index.html'),
+      },
+      output: {
+        // Manual chunk splitting for better caching and smaller bundles
+        manualChunks: {
+          // Core React libraries
+          'vendor-react': ['react', 'react-dom', 'react-router-dom'],
+
+          // Heavy charting library
+          'vendor-charts': ['recharts'],
+
+          // Search functionality
+          'vendor-search': ['fuse.js'],
+
+          // UI libraries
+          'vendor-ui': ['framer-motion', 'lucide-react', 'cmdk', '@radix-ui/react-dialog'],
+
+          // Database
+          'vendor-db': ['idb'],
+        },
+      },
+    },
+    // Use esbuild for CSS minification (Lightning CSS has issues with Tailwind escapes)
+    cssMinify: 'esbuild',
+  },
+});