kempo-inventory 0.5.8 → 0.5.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kempo-inventory",
-  "version": "0.5.8",
+  "version": "0.5.9",
   "description": "A basic inventory management system for kempo cms",
   "license": "MIT",
   "author": "Dustin Poissant <dustinpoissant@gmail.com>",

package/public-items/[id]/index.page.html

@@ -45,6 +45,15 @@
 		}
 
 		/* The category is a built-in property of every item; '' means uncategorised. */
+		/* Only web addresses become links; anything else (a javascript: or data: address, say) shows as plain text. */
+		function isWebLink(value){
+			try {
+				const { protocol } = new URL(String(value).trim());
+				return protocol === 'http:' || protocol === 'https:';
+			} catch {
+				return false;
+			}
+		}
 		function categoryOf(item){ return (item.category ?? '').trim(); }
 		function categoryHref(name){ return name ? `/category?name=${encodeURIComponent(name)}` : '/category?uncategorised=1'; }
 		function tagChips(tags){ return tags?.length ? html`<div class="tag-list">${tags.map(tag => html`<a class="tag-chip" href="/search?tag=${encodeURIComponent(tag)}">${tag}</a>`)}</div>` : ''; }
@@ -112,7 +121,7 @@
 								? html`<span style="display: inline-block; width: 4rem; height: 4rem; vertical-align: middle; margin-right: var(--spacer_h); border: 1px solid var(--c_border); border-radius: var(--radius); background: ${item.fields[f.key]};"></span>${item.fields[f.key]}`
 								: f.type === 'item' && linked[item.fields[f.key]]
 								? html`<a href="/items/${item.fields[f.key]}">${displayValue(f, item.fields[f.key], context)}</a>`
-								: f.type === 'url'
+								: f.type === 'url' && isWebLink(item.fields[f.key])
 									? html`<a href=${item.fields[f.key]} target="_blank" rel="noopener">${item.fields[f.key]}</a>`
 									: f.type === 'longtext'
 									? html`<span style="white-space: pre-wrap;">${item.fields[f.key]}</span>`

package/server/utils/fieldTypes.js

@@ -28,6 +28,11 @@ export const CONVERSIONS = { select: ['text'], text: ['longtext', 'url'] };
 
 export const canConvert = (from, to) => from === to || (CONVERSIONS[from] ?? []).includes(to);
 
+/* A javascript: link runs code when clicked. Browsers ignore spaces and control characters inside the scheme, so they are allowed for. */
+const SCRIPT_SCHEME = /^[\s\x00-\x1f\x7f]*j[\s\x00-\x1f\x7f]*a[\s\x00-\x1f\x7f]*v[\s\x00-\x1f\x7f]*a[\s\x00-\x1f\x7f]*s[\s\x00-\x1f\x7f]*c[\s\x00-\x1f\x7f]*r[\s\x00-\x1f\x7f]*i[\s\x00-\x1f\x7f]*p[\s\x00-\x1f\x7f]*t[\s\x00-\x1f\x7f]*:/i;
+export const hasScriptScheme = value => SCRIPT_SCHEME.test(String(value));
+export const stripScriptScheme = value => String(value).replace(SCRIPT_SCHEME, '');
+
 /*
   A `media` value is a list of ids, each saying where the file lives. A bare id is a kempo-media
   asset; "files:<id>" is a kempo-files file.

package/server/utils/fields.js

@@ -3,7 +3,7 @@ import { eq, and, asc, sql } from 'drizzle-orm';
 import crypto from 'crypto';
 import { kempoInventoryField, kempoInventoryItem, kempoInventoryCategory } from '../db/schema.js';
 import { categoryKey, tidyCategory, MAX_CATEGORY } from './categoryLogic.js';
-import { normalizeFieldDefinition, OPTIONAL_TYPES, canConvert, coerceValue } from './fieldTypes.js';
+import { normalizeFieldDefinition, OPTIONAL_TYPES, canConvert, coerceValue, hasScriptScheme, stripScriptScheme } from './fieldTypes.js';
 import { mediaAvailable } from './media.js';
 import { EVENTS, guard, notify } from './hooks.js';
 
@@ -20,10 +20,12 @@ const addressesOf = async (key, label) => {
     .where(sql`${kempoInventoryItem.data}->>${key} IS NOT NULL`);
   const rewrites = [];
   for(const row of rows){
-    const value = row.data[key];
-    if(value === '' || value === null) continue;
-    const [invalid, address] = coerceValue({ type: 'url', label }, value);
-    if(!invalid && address && address !== value) rewrites.push({ id: row.id, data: { ...row.data, [key]: address } });
+    const original = row.data[key];
+    if(original === '' || original === null) continue;
+    const cleaned = hasScriptScheme(original) ? stripScriptScheme(original) : original;
+    const [invalid, address] = coerceValue({ type: 'url', label }, cleaned);
+    const value = !invalid && address ? address : cleaned;
+    if(value !== original) rewrites.push({ id: row.id, data: { ...row.data, [key]: value } });
   }
   return rewrites;
 };