html2canvas-pro 2.1.0 → 2.2.0

package/src/core/__tests__/validator.ts

@@ -1,359 +0,0 @@
-import { strictEqual } from 'assert';
-import { createDefaultValidator, createStrictValidator } from '../validator';
-
-describe('Validator', () => {
-    describe('URL validation', () => {
-        const validator = createDefaultValidator();
-
-        it('should accept valid HTTP URLs', () => {
-            const result = validator.validateUrl('http://example.com/test.jpg', 'image');
-            strictEqual(result.valid, true);
-        });
-
-        it('should accept valid HTTPS URLs', () => {
-            const result = validator.validateUrl('https://example.com/test.jpg', 'image');
-            strictEqual(result.valid, true);
-        });
-
-        it('should accept data URLs by default', () => {
-            const result = validator.validateUrl('data:image/png;base64,iVBORw0KGgo=', 'image');
-            strictEqual(result.valid, true);
-        });
-
-        it('should accept blob URLs', () => {
-            const result = validator.validateUrl('blob:http://example.com/uuid', 'image');
-            strictEqual(result.valid, true);
-        });
-
-        it('should reject invalid protocols', () => {
-            const result = validator.validateUrl('ftp://example.com/test.jpg', 'image');
-            strictEqual(result.valid, false);
-            strictEqual(result.error?.includes('Protocol'), true);
-        });
-
-        it('should reject file:// URLs', () => {
-            const result = validator.validateUrl('file:///etc/passwd', 'image');
-            strictEqual(result.valid, false);
-        });
-
-        it('should reject javascript: URLs', () => {
-            const result = validator.validateUrl('javascript:alert(1)', 'general');
-            strictEqual(result.valid, false);
-        });
-
-        it('should reject empty URLs', () => {
-            const result = validator.validateUrl('', 'image');
-            strictEqual(result.valid, false);
-        });
-
-        it('should reject non-string URLs', () => {
-            const result = validator.validateUrl(null as any, 'image');
-            strictEqual(result.valid, false);
-        });
-
-        it('should reject malformed URLs', () => {
-            const result = validator.validateUrl('not a url', 'image');
-            strictEqual(result.valid, false);
-            strictEqual(result.error?.includes('Invalid URL'), true);
-        });
-    });
-
-    describe('Proxy URL validation (SSRF prevention)', () => {
-        it('should reject localhost for proxy URLs', () => {
-            const validator = createDefaultValidator();
-            const result = validator.validateUrl('http://localhost:8080/proxy', 'proxy');
-            strictEqual(result.valid, false);
-            strictEqual(result.error?.includes('Localhost'), true);
-        });
-
-        it('should reject 127.0.0.1 for proxy URLs', () => {
-            const validator = createDefaultValidator();
-            const result = validator.validateUrl('http://127.0.0.1/proxy', 'proxy');
-            strictEqual(result.valid, false);
-        });
-
-        it('should reject ::1 for proxy URLs', () => {
-            const validator = createDefaultValidator();
-            const result = validator.validateUrl('http://[::1]/proxy', 'proxy');
-            strictEqual(result.valid, false);
-        });
-
-        it('should reject private IP ranges (10.x.x.x)', () => {
-            const validator = createDefaultValidator();
-            const result = validator.validateUrl('http://10.0.0.1/proxy', 'proxy');
-            strictEqual(result.valid, false);
-            strictEqual(result.error?.includes('Private IP'), true);
-        });
-
-        it('should reject private IP ranges (172.16-31.x.x)', () => {
-            const validator = createDefaultValidator();
-            const results = [
-                validator.validateUrl('http://172.16.0.1/proxy', 'proxy'),
-                validator.validateUrl('http://172.20.0.1/proxy', 'proxy'),
-                validator.validateUrl('http://172.31.255.254/proxy', 'proxy')
-            ];
-            results.forEach((result) => strictEqual(result.valid, false));
-        });
-
-        it('should reject private IP ranges (192.168.x.x)', () => {
-            const validator = createDefaultValidator();
-            const result = validator.validateUrl('http://192.168.1.1/proxy', 'proxy');
-            strictEqual(result.valid, false);
-        });
-
-        it('should reject link-local addresses', () => {
-            const validator = createDefaultValidator();
-            const result = validator.validateUrl('http://169.254.1.1/proxy', 'proxy');
-            strictEqual(result.valid, false);
-        });
-
-        it('should accept public IPs for proxy URLs', () => {
-            const validator = createDefaultValidator();
-            const result = validator.validateUrl('https://8.8.8.8/proxy', 'proxy');
-            strictEqual(result.valid, true);
-        });
-
-        it('should enforce proxy domain whitelist', () => {
-            const validator = createStrictValidator(['example.com', 'trusted.org']);
-
-            const allowed = validator.validateUrl('https://example.com/proxy', 'proxy');
-            strictEqual(allowed.valid, true);
-
-            const notAllowed = validator.validateUrl('https://evil.com/proxy', 'proxy');
-            strictEqual(notAllowed.valid, false);
-            strictEqual(notAllowed.error?.includes('not in the allowed list'), true);
-        });
-
-        it('should allow subdomains of whitelisted domains', () => {
-            const validator = createStrictValidator(['example.com']);
-            const result = validator.validateUrl('https://api.example.com/proxy', 'proxy');
-            strictEqual(result.valid, true);
-        });
-    });
-
-    describe('CSP nonce validation', () => {
-        const validator = createDefaultValidator();
-
-        it('should accept valid nonce', () => {
-            const result = validator.validateCspNonce('ABC123def456GHI789jkl');
-            strictEqual(result.valid, true);
-        });
-
-        it('should reject empty nonce', () => {
-            const result = validator.validateCspNonce('');
-            strictEqual(result.valid, false);
-        });
-
-        it('should reject non-string nonce', () => {
-            const result = validator.validateCspNonce(123 as any);
-            strictEqual(result.valid, false);
-        });
-
-        it('should reject too short nonce', () => {
-            const result = validator.validateCspNonce('short');
-            strictEqual(result.valid, false);
-            strictEqual(result.error?.includes('too short'), true);
-        });
-
-        it('should reject nonce with invalid characters', () => {
-            const result = validator.validateCspNonce('ABC<script>alert(1)</script>');
-            strictEqual(result.valid, false);
-            strictEqual(result.error?.includes('invalid characters'), true);
-        });
-
-        it('should accept base64-like nonces', () => {
-            const result = validator.validateCspNonce('AbCdEfGhIjKlMnOpQrStUvWxYz0123456789+/=');
-            strictEqual(result.valid, true);
-        });
-    });
-
-    describe('Image timeout validation', () => {
-        const validator = createDefaultValidator();
-
-        it('should accept valid timeout', () => {
-            const result = validator.validateImageTimeout(15000);
-            strictEqual(result.valid, true);
-        });
-
-        it('should reject negative timeout', () => {
-            const result = validator.validateImageTimeout(-1000);
-            strictEqual(result.valid, false);
-        });
-
-        it('should reject non-number timeout', () => {
-            const result = validator.validateImageTimeout('15000' as any);
-            strictEqual(result.valid, false);
-        });
-
-        it('should reject NaN timeout', () => {
-            const result = validator.validateImageTimeout(NaN);
-            strictEqual(result.valid, false);
-        });
-
-        it('should enforce maximum timeout', () => {
-            const strictValidator = createStrictValidator([]);
-            const result = strictValidator.validateImageTimeout(120000); // 2 minutes
-            strictEqual(result.valid, false);
-            strictEqual(result.error?.includes('exceeds maximum'), true);
-        });
-
-        it('should accept timeout within limit', () => {
-            const strictValidator = createStrictValidator([]);
-            const result = strictValidator.validateImageTimeout(30000); // 30 seconds
-            strictEqual(result.valid, true);
-        });
-    });
-
-    describe('Dimensions validation', () => {
-        const validator = createDefaultValidator();
-
-        it('should accept valid dimensions', () => {
-            const result = validator.validateDimensions(800, 600);
-            strictEqual(result.valid, true);
-        });
-
-        it('should reject zero dimensions', () => {
-            const result = validator.validateDimensions(0, 600);
-            strictEqual(result.valid, false);
-        });
-
-        it('should reject negative dimensions', () => {
-            const result = validator.validateDimensions(800, -100);
-            strictEqual(result.valid, false);
-        });
-
-        it('should reject NaN dimensions', () => {
-            const result = validator.validateDimensions(NaN, 600);
-            strictEqual(result.valid, false);
-        });
-
-        it('should reject non-number dimensions', () => {
-            const result = validator.validateDimensions('800' as any, 600);
-            strictEqual(result.valid, false);
-        });
-
-        it('should reject dimensions exceeding maximum', () => {
-            const result = validator.validateDimensions(40000, 600);
-            strictEqual(result.valid, false);
-            strictEqual(result.error?.includes('exceed maximum'), true);
-        });
-
-        it('should accept dimensions at the limit', () => {
-            const result = validator.validateDimensions(32767, 32767);
-            strictEqual(result.valid, true);
-        });
-    });
-
-    describe('Scale validation', () => {
-        const validator = createDefaultValidator();
-
-        it('should accept valid scale', () => {
-            const result = validator.validateScale(2);
-            strictEqual(result.valid, true);
-        });
-
-        it('should accept fractional scale', () => {
-            const result = validator.validateScale(0.5);
-            strictEqual(result.valid, true);
-        });
-
-        it('should reject zero scale', () => {
-            const result = validator.validateScale(0);
-            strictEqual(result.valid, false);
-        });
-
-        it('should reject negative scale', () => {
-            const result = validator.validateScale(-2);
-            strictEqual(result.valid, false);
-        });
-
-        it('should reject too large scale', () => {
-            const result = validator.validateScale(20);
-            strictEqual(result.valid, false);
-            strictEqual(result.error?.includes('too large'), true);
-        });
-
-        it('should reject NaN scale', () => {
-            const result = validator.validateScale(NaN);
-            strictEqual(result.valid, false);
-        });
-    });
-
-    describe('Element validation', () => {
-        const validator = createDefaultValidator();
-
-        it('should reject null element', () => {
-            const result = validator.validateElement(null);
-            strictEqual(result.valid, false);
-        });
-
-        it('should reject undefined element', () => {
-            const result = validator.validateElement(undefined);
-            strictEqual(result.valid, false);
-        });
-
-        it('should reject non-object element', () => {
-            const result = validator.validateElement('not an element' as any);
-            strictEqual(result.valid, false);
-        });
-
-        // Note: Full HTMLElement testing requires DOM environment (jsdom/browser)
-    });
-
-    describe('Options validation', () => {
-        const validator = createDefaultValidator();
-
-        it('should accept valid options', () => {
-            const options = {
-                scale: 2,
-                width: 800,
-                height: 600,
-                imageTimeout: 15000
-            };
-            const result = validator.validateOptions(options);
-            strictEqual(result.valid, true);
-        });
-
-        it('should collect multiple errors', () => {
-            const options = {
-                scale: -1,
-                width: -800,
-                imageTimeout: -5000
-            };
-            const result = validator.validateOptions(options);
-            strictEqual(result.valid, false);
-            // Should contain multiple error messages
-            strictEqual(result.error?.includes('Scale'), true);
-            strictEqual(result.error?.includes('Dimensions'), true);
-            strictEqual(result.error?.includes('timeout'), true);
-        });
-
-        it('should allow missing optional fields', () => {
-            const options = {};
-            const result = validator.validateOptions(options);
-            strictEqual(result.valid, true);
-        });
-    });
-
-    describe('Strict validator', () => {
-        const strictValidator = createStrictValidator(['trusted.com']);
-
-        it('should reject data URLs in strict mode', () => {
-            // Note: This would need implementation in createStrictValidator
-            // Currently it doesn't disable data URLs
-        });
-
-        it('should enforce shorter timeout in strict mode', () => {
-            const result = strictValidator.validateImageTimeout(120000);
-            strictEqual(result.valid, false);
-        });
-
-        it('should enforce proxy whitelist in strict mode', () => {
-            const allowed = strictValidator.validateUrl('https://trusted.com/proxy', 'proxy');
-            strictEqual(allowed.valid, true);
-
-            const denied = strictValidator.validateUrl('https://untrusted.com/proxy', 'proxy');
-            strictEqual(denied.valid, false);
-        });
-    });
-});

package/src/core/bitwise.ts

@@ -1 +0,0 @@
-export const contains = (bit: number, value: number): boolean => (bit & value) !== 0;

package/src/core/cache-storage.ts

@@ -1,315 +0,0 @@
-import { FEATURES } from './features';
-import { Context } from './context';
-
-/**
- * CacheStorage (Deprecated static methods)
- *
- * @deprecated The static methods of CacheStorage are deprecated.
- * Use OriginChecker class instead for instance-based origin checking.
- *
- * For backward compatibility, these methods remain but should not be used in new code.
- */
-export class CacheStorage {
-    private static _link?: HTMLAnchorElement;
-    private static _origin = 'about:blank';
-
-    /**
-     * @deprecated Use OriginChecker.getOrigin() instead
-     */
-    static getOrigin(url: string): string {
-        const link = CacheStorage._link;
-        if (!link) {
-            return 'about:blank';
-        }
-
-        link.href = url;
-        link.href = link.href; // IE9, LOL! - http://jsfiddle.net/niklasvh/2e48b/
-        return link.protocol + link.hostname + link.port;
-    }
-
-    /**
-     * @deprecated Use OriginChecker.isSameOrigin() instead
-     */
-    static isSameOrigin(src: string): boolean {
-        return CacheStorage.getOrigin(src) === CacheStorage._origin;
-    }
-
-    /**
-     * @deprecated No longer needed. OriginChecker is created per Context.
-     */
-    static setContext(window: Window): void {
-        CacheStorage._link = window.document.createElement('a');
-        CacheStorage._origin = CacheStorage.getOrigin(window.location.href);
-    }
-}
-
-export interface ResourceOptions {
-    imageTimeout: number;
-    useCORS: boolean;
-    allowTaint: boolean;
-    proxy?: string;
-    customIsSameOrigin?: (this: void, src: string, oldFn: (src: string) => boolean) => boolean | Promise<boolean>;
-    maxCacheSize?: number; // Maximum cache size (default: 100, max: 10000)
-}
-
-interface CacheEntry {
-    value: Promise<HTMLImageElement | HTMLCanvasElement | undefined>;
-}
-
-export class Cache {
-    private readonly _cache: Map<string, CacheEntry> = new Map();
-    private readonly maxSize: number;
-    private readonly _pendingOperations: Map<string, Promise<void>> = new Map();
-
-    constructor(
-        private readonly context: Context,
-        private readonly _options: ResourceOptions
-    ) {
-        // Default cache size: 100 items
-        this.maxSize = _options.maxCacheSize ?? 100;
-
-        if (this.maxSize < 1) {
-            throw new Error('Cache maxSize must be at least 1');
-        }
-
-        if (this.maxSize > 10000) {
-            this.context.logger.warn(
-                `Cache maxSize ${this.maxSize} is very large and may cause memory issues. ` +
-                    `Consider using a smaller value (recommended: 100-1000).`
-            );
-        }
-    }
-
-    addImage(src: string): Promise<void> {
-        // Wait for any pending operations on this key
-        const pending = this._pendingOperations.get(src);
-        if (pending) {
-            return pending;
-        }
-
-        if (this.has(src)) {
-            // Move to end for LRU ordering
-            const entry = this._cache.get(src)!;
-            this._cache.delete(src);
-            this._cache.set(src, entry);
-            return Promise.resolve();
-        }
-
-        if (isBlobImage(src) || isRenderable(src)) {
-            // Create a pending operation to ensure atomicity
-            const operation = this._addImageInternal(src);
-            this._pendingOperations.set(src, operation);
-            operation.finally(() => {
-                this._pendingOperations.delete(src);
-            });
-
-            return operation;
-        }
-
-        return Promise.resolve();
-    }
-
-    private async _addImageInternal(src: string): Promise<void> {
-        const timeoutMs = this._options.imageTimeout ?? 15000;
-        const imageWithTimeout = this.withTimeout(
-            this.loadImage(src),
-            timeoutMs,
-            `Timed out (${timeoutMs}ms) loading image`
-        );
-
-        // Handle errors to prevent unhandled rejections
-        imageWithTimeout.catch((error) => {
-            this.context.logger.error(
-                `Failed to load image ${src}: ${error instanceof Error ? error.message : 'Unknown error'}`
-            );
-        });
-
-        // Store the promise with timeout in cache
-        this.set(src, imageWithTimeout);
-    }
-
-    private withTimeout<T>(promise: Promise<T>, timeoutMs: number, message: string): Promise<T> {
-        if (timeoutMs <= 0) {
-            return promise;
-        }
-
-        let timeoutId: ReturnType<typeof setTimeout> | undefined;
-        const timeout = new Promise<never>((_, reject) => {
-            timeoutId = setTimeout(() => reject(new Error(message)), timeoutMs);
-        });
-
-        return Promise.race([promise, timeout]).finally(() => {
-            if (timeoutId !== undefined) {
-                clearTimeout(timeoutId);
-            }
-        });
-    }
-
-    match(src: string): Promise<HTMLImageElement | HTMLCanvasElement | undefined> | undefined {
-        const entry = this._cache.get(src);
-        if (entry) {
-            // Move to end for LRU ordering (O(1))
-            this._cache.delete(src);
-            this._cache.set(src, entry);
-            return entry.value;
-        }
-        return undefined;
-    }
-
-    /**
-     * Set a value in cache with LRU eviction (O(1) via Map insertion order).
-     * Map preserves insertion order; delete+set on access moves items to the end.
-     * The first key in Map.keys() is always the least recently used.
-     */
-    private set(key: string, value: Promise<HTMLImageElement | HTMLCanvasElement | undefined>): void {
-        if (this._cache.has(key)) {
-            // Update existing entry: move to end of Map
-            this._cache.delete(key);
-        } else if (this._cache.size >= this.maxSize) {
-            // Evict LRU (first key = least recently used) — O(1)
-            const lruKey = this._cache.keys().next().value;
-            if (lruKey !== undefined) {
-                this._cache.delete(lruKey);
-                this.context.logger.debug(`Cache: Evicted LRU entry: ${lruKey}`);
-            }
-        }
-
-        this._cache.set(key, { value });
-    }
-
-    /**
-     * Get cache size
-     */
-    size(): number {
-        return this._cache.size;
-    }
-
-    /**
-     * Get max cache size
-     */
-    getMaxSize(): number {
-        return this.maxSize;
-    }
-
-    /**
-     * Clear all cache entries
-     */
-    clear(): void {
-        this._cache.clear();
-    }
-
-    private async loadImage(key: string): Promise<HTMLImageElement | undefined> {
-        const originChecker = this.context.originChecker;
-        const defaultIsSameOrigin = (src: string) => originChecker.isSameOrigin(src);
-
-        const isSameOrigin: boolean =
-            typeof this._options.customIsSameOrigin === 'function'
-                ? await this._options.customIsSameOrigin(key, defaultIsSameOrigin)
-                : defaultIsSameOrigin(key);
-        const useCORS =
-            !isInlineImage(key) && this._options.useCORS === true && FEATURES.SUPPORT_CORS_IMAGES && !isSameOrigin;
-        const useProxy =
-            !isInlineImage(key) &&
-            !isSameOrigin &&
-            !isBlobImage(key) &&
-            typeof this._options.proxy === 'string' &&
-            FEATURES.SUPPORT_CORS_XHR &&
-            !useCORS;
-        if (
-            !isSameOrigin &&
-            this._options.allowTaint === false &&
-            !isInlineImage(key) &&
-            !isBlobImage(key) &&
-            !useProxy &&
-            !useCORS
-        ) {
-            return;
-        }
-
-        let src = key;
-        if (useProxy) {
-            src = await this.proxy(src);
-        }
-
-        this.context.logger.debug(`Added image ${key.substring(0, 256)}`);
-
-        return await new Promise((resolve, reject) => {
-            const img = new Image();
-            img.onload = () => resolve(img);
-            img.onerror = reject;
-            //ios safari 10.3 taints canvas with data urls unless crossOrigin is set to anonymous
-            if (isInlineBase64Image(src) || useCORS) {
-                img.crossOrigin = 'anonymous';
-            }
-            img.src = src;
-            if (img.complete === true) {
-                // Inline XML images may fail to parse, throwing an Error later on
-                setTimeout(() => resolve(img), 500);
-            }
-        });
-    }
-
-    private has(key: string): boolean {
-        return this._cache.has(key);
-    }
-
-    keys(): Promise<string[]> {
-        return Promise.resolve(Array.from(this._cache.keys()));
-    }
-
-    private proxy(src: string): Promise<string> {
-        const proxy = this._options.proxy;
-
-        if (!proxy) {
-            throw new Error('No proxy defined');
-        }
-
-        const key = src.substring(0, 256);
-
-        return new Promise((resolve, reject) => {
-            const responseType = FEATURES.SUPPORT_RESPONSE_TYPE ? 'blob' : 'text';
-            const xhr = new XMLHttpRequest();
-            xhr.onload = () => {
-                if (xhr.status === 200) {
-                    if (responseType === 'text') {
-                        resolve(xhr.response);
-                    } else {
-                        const reader = new FileReader();
-                        reader.addEventListener('load', () => resolve(reader.result as string), false);
-                        reader.addEventListener('error', (e) => reject(e), false);
-                        reader.readAsDataURL(xhr.response);
-                    }
-                } else {
-                    reject(`Failed to proxy resource ${key} with status code ${xhr.status}`);
-                }
-            };
-
-            xhr.onerror = reject;
-            const queryString = proxy.indexOf('?') > -1 ? '&' : '?';
-            xhr.open('GET', `${proxy}${queryString}url=${encodeURIComponent(src)}&responseType=${responseType}`);
-
-            if (responseType !== 'text' && xhr instanceof XMLHttpRequest) {
-                xhr.responseType = responseType;
-            }
-
-            if (this._options.imageTimeout) {
-                const timeout = this._options.imageTimeout;
-                xhr.timeout = timeout;
-                xhr.ontimeout = () => reject(`Timed out (${timeout}ms) proxying ${key}`);
-            }
-
-            xhr.send();
-        });
-    }
-}
-
-const INLINE_SVG = /^data:image\/svg\+xml/i;
-const INLINE_BASE64 = /^data:image\/.*;base64,/i;
-const INLINE_IMG = /^data:image\/.*/i;
-
-const isRenderable = (src: string): boolean => FEATURES.SUPPORT_SVG_DRAWING || !isSVG(src);
-const isInlineImage = (src: string): boolean => INLINE_IMG.test(src);
-const isInlineBase64Image = (src: string): boolean => INLINE_BASE64.test(src);
-const isBlobImage = (src: string): boolean => src.substr(0, 4) === 'blob';
-
-const isSVG = (src: string): boolean => src.substr(-3).toLowerCase() === 'svg' || INLINE_SVG.test(src);