kordoc 4.15.7 → 4.16.0

package/dist/{chunk-O5SDUPB2.js → chunk-46DZF3RK.js}

@@ -2,7 +2,7 @@
 import {
   KordocError,
   unzipLimitBytes
-} from "./chunk-F5FHYJKJ.js";
+} from "./chunk-RC4C7Q33.js";
 
 // src/hwpx/parser-shared.ts
 import { DOMParser } from "@xmldom/xmldom";
@@ -336,4 +336,4 @@ export {
   hwpFaceToCssStack,
   parseRenderStyles
 };
-//# sourceMappingURL=chunk-O5SDUPB2.js.map
+//# sourceMappingURL=chunk-46DZF3RK.js.map

package/dist/{chunk-C572DIHX.js → chunk-476OYHGZ.js}

@@ -6,7 +6,7 @@ import {
   HEADING_RATIO_H1,
   HEADING_RATIO_H2,
   HEADING_RATIO_H3
-} from "./chunk-NVG2GQNA.js";
+} from "./chunk-UQ6TZDW6.js";
 import {
   parsePageRange
 } from "./chunk-VQFA55IC.js";
@@ -19,7 +19,7 @@ import {
   findChildByLocalName,
   hwpFaceToCssStack,
   parseRenderStyles
-} from "./chunk-O5SDUPB2.js";
+} from "./chunk-46DZF3RK.js";
 import {
   MAX_COLS,
   MAX_ROWS,
@@ -30,18 +30,18 @@ import {
   flattenLayoutTables,
   mapPuaText,
   markNonLayoutTable
-} from "./chunk-WHZUJH2O.js";
+} from "./chunk-TGD7UFHD.js";
 import {
   loadSharp,
   rasterizePageSvg
-} from "./chunk-YFHV4QP3.js";
+} from "./chunk-3JWMDL3S.js";
 import {
   KordocError,
   escapeHtml,
   precheckZipSize,
   sanitizeHref,
   toArrayBuffer
-} from "./chunk-F5FHYJKJ.js";
+} from "./chunk-RC4C7Q33.js";
 
 // src/render/svg-render.ts
 import JSZip from "jszip";
@@ -7010,6 +7010,12 @@ var md = new MarkdownIt({
   linkify: true,
   breaks: false
 });
+var SAFE_RAW_TAG = /^(?:<\/?(?:table|thead|tbody|tfoot|tr|th|td|u)>|<br\s*\/?>|<(?:th|td)(?: (?:colspan|rowspan)="[1-9]\d*"){1,2}>|<img src="(?:images\/(?:[^"'<>\/\s]+\/)?)?image_\d+\.(?:png|jpe?g|gif|webp|bmp)" alt="image">)$/i;
+function sanitizeRawHtml(raw) {
+  return raw.replace(/<[^>]*>|</g, (tag) => SAFE_RAW_TAG.test(tag) ? tag : escapeHtml(tag));
+}
+md.renderer.rules.html_block = (tokens, idx) => sanitizeRawHtml(tokens[idx].content);
+md.renderer.rules.html_inline = (tokens, idx) => sanitizeRawHtml(tokens[idx].content);
 function renderHtml(markdown, options) {
   const preset = options?.preset ?? "default";
   const css = PRESETS[preset] + (options?.extraCss ?? "");
@@ -7030,6 +7036,7 @@ function renderHtml(markdown, options) {
 <html lang="ko">
 <head>
 <meta charset="utf-8">
+<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src 'self' data:; font-src 'self' data:; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'">
 <style>${css}${watermarkCss}</style>
 </head>
 <body>
@@ -7331,4 +7338,4 @@ export {
   cropRect,
   extractRenderedRegions
 };
-//# sourceMappingURL=chunk-C572DIHX.js.map
+//# sourceMappingURL=chunk-476OYHGZ.js.map