module-develop-kit 1.0.6 → 1.1.0

package/dist/commonjs-virtual-dir/index2.js

@@ -1,7 +1,5 @@
-import { getDefaultExportFromCjs as r } from "./_commonjsHelpers.js";
-import { __require as o } from "../vendor/sdp-transform/lib/index.js";
-var t = o();
-const a = /* @__PURE__ */ r(t);
+import { __require as r } from "../vendor/gm-crypt/index.js";
+var p = r();
 export {
-  a as default
+  p as g
 };

package/dist/commonjs-virtual-dir/index3.js

@@ -1,5 +1,7 @@
-import { __require as r } from "../vendor/gm-crypt/index.js";
-var p = r();
+import { getDefaultExportFromCjs as r } from "./_commonjsHelpers.js";
+import { __require as o } from "../vendor/sdp-transform/lib/index.js";
+var t = o();
+const a = /* @__PURE__ */ r(t);
 export {
-  p as g
+  a as default
 };

package/dist/main.d.ts

@@ -231,6 +231,14 @@ export declare interface ISm4Params {
     key: string;
 }
 
+/**
+ * 检测 URL 是否包含 XSS 攻击
+ * @param url - 需要检测的 URL
+ * @param options - 配置选项
+ * @returns 是否安全
+ */
+export declare function isUrlSafe(url: unknown, options?: UrlSanitizeOptions): boolean;
+
 /**
  * 请求数据加密
  * @param publicKey 公钥
@@ -254,6 +262,22 @@ export declare function responseDataEncryption<T>(stepCb: (_headers: {
     [EHeaderKey.publicKey]: string;
 }) => Promise<IResponseDataEncryptionStep>): Promise<T>;
 
+/**
+ * 消毒 URL，返回安全的 URL 或替代 URL
+ * @param url - 需要消毒的 URL
+ * @param options - 配置选项
+ * @returns 安全的 URL
+ */
+export declare function sanitizeUrl(url: unknown, options?: UrlSanitizeOptions): string;
+
+/**
+ * 批量消毒 URL 列表
+ * @param urls - URL 列表
+ * @param options - 配置选项
+ * @returns 消毒后的 URL 列表
+ */
+export declare function sanitizeUrls(urls: string[], options?: UrlSanitizeOptions): string[];
+
 /**
  * sip code对应的的状态，优先处理 code 对应的提示文案，如果不存在则按照 causes 状态去处理
  */
@@ -324,6 +348,32 @@ export declare type TObj<K extends keyof any = string, T = any> = Record<K, T>;
 
 export declare type TUndefinable<T> = T | undefined;
 
+/**
+ * URL XSS 防护工具
+ * 用于检测和拦截包含 XSS 攻击的 URL
+ */
+/**
+ * URL 消毒选项
+ */
+export declare interface UrlSanitizeOptions {
+    /**
+     * 是否允许相对路径 URL，默认 true
+     */
+    allowRelative?: boolean;
+    /**
+     * 额外的安全协议
+     */
+    extraSafeProtocols?: string[];
+    /**
+     * 当检测到 XSS 时的替代 URL，默认 '#'
+     */
+    fallbackUrl?: string;
+    /**
+     * 是否严格模式，严格模式下只允许 http/https，默认 false
+     */
+    strictMode?: boolean;
+}
+
 /**
  * 打电话
  * FIXME： callBack 为什么存在？zyy 中通过 useCall 拿到的变量无法实现响应式，所以通过 callback 的方式更新外部依赖。

package/dist/main.js

@@ -1,21 +1,25 @@
 import { useCall as e } from "./src/outside-call/index.js";
 import { antiReplyAttackStrategy as a, requestDataEncryption as E, responseDataEncryption as p } from "./src/shield/crypto/index.js";
-import { htmlSanitize as l } from "./src/shield/html-sanitize.js";
+import { htmlSanitize as s } from "./src/shield/html-sanitize.js";
 import { startNoDebugger as n } from "./src/shield/no-debugger.js";
-import { EventBus as s } from "./src/utils/eventBus.js";
-import { CallLogger as _ } from "./src/outside-call/utils.js";
-import { ECallStatus as i, EMIT_EVENT_NAME as u, SIP_CODE_MESSAGE as C, SIP_ERROR_CAUSES as y } from "./src/outside-call/constants.js";
+import { isUrlSafe as f, sanitizeUrl as m, sanitizeUrls as x } from "./src/shield/url-sanitize.js";
+import { EventBus as g } from "./src/utils/eventBus.js";
+import { CallLogger as C } from "./src/outside-call/utils.js";
+import { ECallStatus as A, EMIT_EVENT_NAME as D, SIP_CODE_MESSAGE as R, SIP_ERROR_CAUSES as U } from "./src/outside-call/constants.js";
 export {
-  _ as CallLogger,
-  i as ECallStatus,
-  u as EMIT_EVENT_NAME,
-  s as EventBus,
-  C as SIP_CODE_MESSAGE,
-  y as SIP_ERROR_CAUSES,
+  C as CallLogger,
+  A as ECallStatus,
+  D as EMIT_EVENT_NAME,
+  g as EventBus,
+  R as SIP_CODE_MESSAGE,
+  U as SIP_ERROR_CAUSES,
   a as antiReplyAttackStrategy,
-  l as htmlSanitize,
+  s as htmlSanitize,
+  f as isUrlSafe,
   E as requestDataEncryption,
   p as responseDataEncryption,
+  m as sanitizeUrl,
+  x as sanitizeUrls,
   n as startNoDebugger,
   e as useCall
 };

package/dist/src/outside-call/utils.js

@@ -1,4 +1,4 @@
-import c from "../../commonjs-virtual-dir/index2.js";
+import c from "../../commonjs-virtual-dir/index3.js";
 const g = {
   log(e, ...r) {
     console.log(`%c【${(/* @__PURE__ */ new Date()).toLocaleString()}】`, "color: green; font-weight: bold;", e, ...r);

package/dist/src/shield/crypto/sm4.js

@@ -1,4 +1,4 @@
-import { g as o } from "../../../commonjs-virtual-dir/index3.js";
+import { g as o } from "../../../commonjs-virtual-dir/index2.js";
 import { dataToStr as r } from "./util.js";
 const c = "cbc", n = (t, e) => new o.sm4({
   key: t.key,

package/dist/src/shield/url-sanitize.js

@@ -0,0 +1,59 @@
+const i = ["http:", "https:", "mailto:", "tel:", "sms:", "ftp:", "ftps:"], o = [
+  // eslint-disable-next-line no-script-url
+  "javascript:",
+  "data:",
+  "vbscript:",
+  "file:",
+  "about:",
+  "blob:"
+];
+function l(t) {
+  return t.replace(/[​-‍]/g, "").replace(/\s+/g, "").trim();
+}
+function n(t) {
+  const e = t.toLowerCase();
+  return [
+    /javascript:/i,
+    /data:text\/html/i,
+    /vbscript:/i,
+    /on\w+\s*=/i,
+    // HTML 事件处理器，如 onclick=, onload=
+    /<script/i,
+    /&#/i,
+    // HTML 实体编码
+    /%6a%61%76%61%73%63%72%69%70%74/i,
+    // URL 编码的 javascript
+    /\\u006a\\u0061\\u0076\\u0061/i
+    // Unicode 编码
+  ].some((s) => s.test(e) || s.test(t));
+}
+function c(t, e = {}) {
+  if (!t || typeof t != "string")
+    return !1;
+  const r = t.trim();
+  if (!r)
+    return !1;
+  if (r.startsWith("/") || r.startsWith("./") || r.startsWith("../"))
+    return e.allowRelative === !1 ? !1 : !n(r);
+  const s = l(r);
+  if (n(s))
+    return !1;
+  try {
+    const a = new URL(s, "http://example.com").protocol.toLowerCase();
+    return e.strictMode ? a === "http:" || a === "https:" : o.includes(a) ? !1 : [...i, ...e.extraSafeProtocols || []].includes(a);
+  } catch {
+    return !1;
+  }
+}
+function f(t, e = {}) {
+  const r = e.fallbackUrl || "#";
+  return c(t, e) ? t.trim() : r;
+}
+function m(t, e = {}) {
+  return t.map((r) => f(r, e));
+}
+export {
+  c as isUrlSafe,
+  f as sanitizeUrl,
+  m as sanitizeUrls
+};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "module-develop-kit",
   "author": "Front-End team",
-  "version": "1.0.6",
+  "version": "1.1.0",
   "type": "module",
   "description": "前端项目通用工具包",
   "module": "dist/main.js",