marked-cs 0.0.1-security → 2.2.0

package/LICENSE.md

@@ -0,0 +1,44 @@
+# License information
+
+## Contribution License Agreement
+
+If you contribute code to this project, you are implicitly allowing your code
+to be distributed under the MIT license. You are also implicitly verifying that
+all code is your original work. `</legalese>`
+
+## Marked
+
+Copyright (c) 2018+, MarkedJS (https://github.com/markedjs/)
+Copyright (c) 2011-2018, Christopher Jeffrey (https://github.com/chjj/)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+## Markdown
+
+Copyright © 2004, John Gruber
+http://daringfireball.net/
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+* Neither the name “Markdown” nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+
+This software is provided by the copyright holders and contributors “as is” and any express or implied warranties, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose are disclaimed. In no event shall the copyright owner or contributors be liable for any direct, indirect, incidental, special, exemplary, or consequential damages (including, but not limited to, procurement of substitute goods or services; loss of use, data, or profits; or business interruption) however caused and on any theory of liability, whether in contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use of this software, even if advised of the possibility of such damage.

package/README.md

@@ -1,5 +1,106 @@
-# Security holding package
+<a href="https://marked.js.org">
+  <img width="60px" height="60px" src="https://marked.js.org/img/logo-black.svg" align="right" />
+</a>
 
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
+# Marked
 
-Please refer to www.npmjs.com/advisories?search=marked-cs for more information.
+[![npm](https://badgen.net/npm/v/marked)](https://www.npmjs.com/package/marked)
+[![install size](https://badgen.net/packagephobia/install/marked)](https://packagephobia.now.sh/result?p=marked)
+[![downloads](https://badgen.net/npm/dt/marked)](https://www.npmjs.com/package/marked)
+[![github actions](https://github.com/markedjs/marked/workflows/Tests/badge.svg)](https://github.com/markedjs/marked/actions)
+[![snyk](https://snyk.io/test/npm/marked/badge.svg)](https://snyk.io/test/npm/marked)
+
+- ⚡ built for speed
+- ⬇️ low-level compiler for parsing markdown without caching or blocking for long periods of time
+- ⚖️ light-weight while implementing all markdown features from the supported flavors & specifications
+- 🌐 works in a browser, on a server, or from a command line interface (CLI)
+
+## Demo
+
+Checkout the [demo page](https://marked.js.org/demo/) to see marked in action ⛹️
+
+## Docs
+
+Our [documentation pages](https://marked.js.org) are also rendered using marked 💯
+
+Also read about:
+
+* [Options](https://marked.js.org/using_advanced)
+* [Extensibility](https://marked.js.org/using_pro)
+
+## Compatibility
+
+**Node.js:** Only [current and LTS](https://nodejs.org/en/about/releases/) Node.js versions are supported. End of life Node.js versions may become incompatible with Marked at any point in time.
+
+**Browser:** Not IE11 :)
+
+## Installation
+
+**CLI:**
+
+```sh
+npm install -g marked
+```
+
+**In-browser:**
+
+```sh
+npm install marked
+```
+
+## Usage
+
+### Warning: 🚨 Marked does not [sanitize](https://marked.js.org/using_advanced#options) the output HTML. Please use a sanitize library, like [DOMPurify](https://github.com/cure53/DOMPurify) (recommended), [sanitize-html](https://github.com/apostrophecms/sanitize-html) or [insane](https://github.com/bevacqua/insane) on the *output* HTML! 🚨
+
+```
+DOMPurify.sanitize(marked.parse(`<img src="x" onerror="alert('not happening')">`));
+```
+
+**CLI**
+
+``` bash
+# Example with stdin input
+$ marked -o hello.html
+hello world
+^D
+$ cat hello.html
+<p>hello world</p>
+```
+
+```bash
+# Print all options
+$ marked --help
+```
+
+**Browser**
+
+```html
+<!doctype html>
+<html>
+<head>
+  <meta charset="utf-8"/>
+  <title>Marked in the browser</title>
+</head>
+<body>
+  <div id="content"></div>
+  <script src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>
+  <script>
+    document.getElementById('content').innerHTML =
+      marked.parse('# Marked in the browser\n\nRendered by **marked**.');
+  </script>
+</body>
+</html>
+```
+or import esm module
+
+```html
+<script type="module">
+  import { marked } from "https://cdn.jsdelivr.net/npm/marked/lib/marked.esm.js";
+  document.getElementById('content').innerHTML =
+    marked.parse('# Marked in the browser\n\nRendered by **marked**.');
+</script>
+```
+
+## License
+
+Copyright (c) 2011-2022, Christopher Jeffrey. (MIT License)

package/bin/main.js

@@ -0,0 +1,282 @@
+#!/usr/bin/env node
+
+/**
+ * Marked CLI
+ * Copyright (c) 2011-2013, Christopher Jeffrey (MIT License)
+ */
+
+import { promises } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { homedir } from 'node:os';
+import { createRequire } from 'node:module';
+import { marked } from '../lib/marked.esm.js';
+
+const { access, readFile, writeFile } = promises;
+const require = createRequire(import.meta.url);
+
+/**
+ * @param {Process} nodeProcess inject process so it can be mocked in tests.
+ */
+export async function main(nodeProcess) {
+  /**
+   * Man Page
+   */
+  async function help() {
+    const { spawn } = await import('child_process');
+    const { fileURLToPath } = await import('url');
+
+    const options = {
+      cwd: nodeProcess.cwd(),
+      env: nodeProcess.env,
+      stdio: 'inherit',
+    };
+
+    const __dirname = dirname(fileURLToPath(import.meta.url));
+    const helpText = await readFile(resolve(__dirname, '../man/marked.1.md'), 'utf8');
+
+    await new Promise(res => {
+      const manProcess = spawn('man', [resolve(__dirname, '../man/marked.1')], options);
+      nodeProcess.on('SIGINT', () => {
+        manProcess.kill('SIGINT');
+      });
+
+      manProcess.on('error', () => {
+        console.log(helpText);
+      })
+        .on('close', res);
+    });
+  }
+
+  async function version() {
+    const pkg = require('../package.json');
+    console.log(pkg.version);
+  }
+
+  /**
+   * Main
+   */
+  async function start(argv) {
+    const files = [];
+    const options = {};
+    let input;
+    let output;
+    let string;
+    let arg;
+    let tokens;
+    let config;
+    let opt;
+    let noclobber;
+
+    function getArg() {
+      let arg = argv.shift();
+
+      if (arg.indexOf('--') === 0) {
+        // e.g. --opt
+        arg = arg.split('=');
+        if (arg.length > 1) {
+          // e.g. --opt=val
+          argv.unshift(arg.slice(1).join('='));
+        }
+        arg = arg[0];
+      } else if (arg[0] === '-') {
+        if (arg.length > 2) {
+          // e.g. -abc
+          argv = arg.substring(1).split('').map(function(ch) {
+            return '-' + ch;
+          }).concat(argv);
+          arg = argv.shift();
+        } else {
+          // e.g. -a
+        }
+      } else {
+        // e.g. foo
+      }
+
+      return arg;
+    }
+
+    while (argv.length) {
+      arg = getArg();
+      switch (arg) {
+        case '-o':
+        case '--output':
+          output = argv.shift();
+          break;
+        case '-i':
+        case '--input':
+          input = argv.shift();
+          break;
+        case '-s':
+        case '--string':
+          string = argv.shift();
+          break;
+        case '-t':
+        case '--tokens':
+          tokens = true;
+          break;
+        case '-c':
+        case '--config':
+          config = argv.shift();
+          break;
+        case '-n':
+        case '--no-clobber':
+          noclobber = true;
+          break;
+        case '-h':
+        case '--help':
+          return await help();
+        case '-v':
+        case '--version':
+          return await version();
+        default:
+          if (arg.indexOf('--') === 0) {
+            opt = camelize(arg.replace(/^--(no-)?/, ''));
+            if (!(opt in marked.defaults)) {
+              continue;
+            }
+            if (arg.indexOf('--no-') === 0) {
+              options[opt] = typeof marked.defaults[opt] !== 'boolean'
+                ? null
+                : false;
+            } else {
+              options[opt] = typeof marked.defaults[opt] !== 'boolean'
+                ? argv.shift()
+                : true;
+            }
+          } else {
+            files.push(arg);
+          }
+          break;
+      }
+    }
+
+    async function getData() {
+      if (!input) {
+        if (files.length <= 2) {
+          if (string) {
+            return string;
+          }
+          return await getStdin();
+        }
+        input = files.pop();
+      }
+      return await readFile(input, 'utf8');
+    }
+
+    function resolveFile(file) {
+      return resolve(file.replace(/^~/, homedir));
+    }
+
+    function fileExists(file) {
+      return access(resolveFile(file)).then(() => true, () => false);
+    }
+
+    async function runConfig(file) {
+      const configFile = resolveFile(file);
+      let markedConfig;
+      try {
+        // try require for json
+        markedConfig = require(configFile);
+      } catch (err) {
+        if (err.code !== 'ERR_REQUIRE_ESM') {
+          throw err;
+        }
+        // must import esm
+        markedConfig = await import('file:///' + configFile);
+      }
+
+      if (markedConfig.default) {
+        markedConfig = markedConfig.default;
+      }
+
+      if (typeof markedConfig === 'function') {
+        markedConfig(marked);
+      } else {
+        marked.use(markedConfig);
+      }
+    }
+
+    const data = await getData();
+
+    if (config) {
+      if (!await fileExists(config)) {
+        throw Error(`Cannot load config file '${config}'`);
+      }
+
+      await runConfig(config);
+    } else {
+      const defaultConfig = [
+        '~/.marked.json',
+        '~/.marked.js',
+        '~/.marked/index.js',
+      ];
+
+      for (const configFile of defaultConfig) {
+        if (await fileExists(configFile)) {
+          await runConfig(configFile);
+          break;
+        }
+      }
+    }
+
+    const html = tokens
+      ? JSON.stringify(marked.lexer(data, options), null, 2)
+      : await marked.parse(data, options);
+
+    if (output) {
+      if (noclobber && await fileExists(output)) {
+        throw Error('marked: output file \'' + output + '\' already exists, disable the \'-n\' / \'--no-clobber\' flag to overwrite\n');
+      }
+      return await writeFile(output, html);
+    }
+
+    nodeProcess.stdout.write(html + '\n');
+  }
+
+  /**
+   * Helpers
+   */
+  function getStdin() {
+    return new Promise((resolve, reject) => {
+      const stdin = nodeProcess.stdin;
+      let buff = '';
+
+      stdin.setEncoding('utf8');
+
+      stdin.on('data', function(data) {
+        buff += data;
+      });
+
+      stdin.on('error', function(err) {
+        reject(err);
+      });
+
+      stdin.on('end', function() {
+        resolve(buff);
+      });
+
+      stdin.resume();
+    });
+  }
+
+  /**
+   * @param {string} text
+   */
+  function camelize(text) {
+    return text.replace(/(\w)-(\w)/g, function(_, a, b) {
+      return a + b.toUpperCase();
+    });
+  }
+
+  try {
+    await start(nodeProcess.argv.slice());
+    nodeProcess.exit(0);
+  } catch (err) {
+    if (err.code === 'ENOENT') {
+      nodeProcess.stderr.write('marked: ' + err.path + ': No such file or directory');
+    } else {
+      nodeProcess.stderr.write(err.message);
+    }
+    return nodeProcess.exit(1);
+  }
+}

package/bin/marked.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+
+/**
+ * Marked CLI
+ * Copyright (c) 2011-2013, Christopher Jeffrey (MIT License)
+ */
+
+import { main } from './main.js';
+
+/**
+ * Expose / Entry Point
+ */
+
+process.title = 'marked';
+main(process);