overtype 1.1.5 → 1.1.7

package/README.md

@@ -483,7 +483,10 @@ OverType uses a unique invisible textarea overlay approach:
 ## Contributors
 
 Special thanks to:
-- [Josh Doman](https://github.com/joshdoman) - Fixed inline code formatting preservation ([#6](https://github.com/panphora/overtype/pull/6))
+- [Josh Doman](https://github.com/joshdoman) - Fixed inline code formatting preservation ([#6](https://github.com/panphora/overtype/pull/6)), improved code fence detection ([#19](https://github.com/panphora/overtype/pull/19))
+- [kbhomes](https://github.com/kbhomes) - Fixed text selection desynchronization during overscroll ([#17](https://github.com/panphora/overtype/pull/17))
+- [merlinz01](https://github.com/merlinz01) - Initial TypeScript definitions implementation ([#20](https://github.com/panphora/overtype/pull/20))
+- [Max Bernstein](https://github.com/tekknolagi) - Fixed typo in website ([#11](https://github.com/panphora/overtype/pull/11))
 
 ## License
 

package/dist/overtype.esm.js

@@ -1,5 +1,5 @@
 /**
- * OverType v1.1.4
+ * OverType v1.1.7
  * A lightweight markdown editor library with perfect WYSIWYG alignment
  * @license MIT
  * @author Demo User
@@ -140,6 +140,28 @@ var MarkdownParser = class {
   static parseInlineCode(html) {
     return html.replace(new RegExp("(?<!`)(`+)(?!`)((?:(?!\\1).)+?)(\\1)(?!`)", "g"), '<code><span class="syntax-marker">$1</span>$2<span class="syntax-marker">$3</span></code>');
   }
+  /**
+   * Sanitize URL to prevent XSS attacks
+   * @param {string} url - URL to sanitize
+   * @returns {string} Safe URL or '#' if dangerous
+   */
+  static sanitizeUrl(url) {
+    const trimmed = url.trim();
+    const lower = trimmed.toLowerCase();
+    const safeProtocols = [
+      "http://",
+      "https://",
+      "mailto:",
+      "ftp://",
+      "ftps://"
+    ];
+    const hasSafeProtocol = safeProtocols.some((protocol) => lower.startsWith(protocol));
+    const isRelative = trimmed.startsWith("/") || trimmed.startsWith("#") || trimmed.startsWith("?") || trimmed.startsWith(".") || !trimmed.includes(":") && !trimmed.includes("//");
+    if (hasSafeProtocol || isRelative) {
+      return url;
+    }
+    return "#";
+  }
   /**
    * Parse links
    * @param {string} html - HTML with potential link markdown
@@ -148,7 +170,8 @@ var MarkdownParser = class {
   static parseLinks(html) {
     return html.replace(/\[(.+?)\]\((.+?)\)/g, (match, text, url) => {
       const anchorName = `--link-${this.linkIndex++}`;
-      return `<a href="${url}" style="anchor-name: ${anchorName}"><span class="syntax-marker">[</span>${text}<span class="syntax-marker">](</span><span class="syntax-marker">${url}</span><span class="syntax-marker">)</span></a>`;
+      const safeUrl = this.sanitizeUrl(url);
+      return `<a href="${safeUrl}" style="anchor-name: ${anchorName}"><span class="syntax-marker">[</span>${text}<span class="syntax-marker">](</span><span class="syntax-marker link-url">${url}</span><span class="syntax-marker">)</span></a>`;
     });
   }
   /**
@@ -159,17 +182,22 @@ var MarkdownParser = class {
   static parseInlineElements(text) {
     let html = text;
     html = this.parseInlineCode(html);
-    const codeBlocks = /* @__PURE__ */ new Map();
+    const sanctuaries = /* @__PURE__ */ new Map();
     html = html.replace(/(<code>.*?<\/code>)/g, (match) => {
-      const placeholder = `\uE000${codeBlocks.size}\uE001`;
-      codeBlocks.set(placeholder, match);
+      const placeholder = `\uE000${sanctuaries.size}\uE001`;
+      sanctuaries.set(placeholder, match);
       return placeholder;
     });
     html = this.parseLinks(html);
+    html = html.replace(/(<a[^>]*>.*?<\/a>)/g, (match) => {
+      const placeholder = `\uE000${sanctuaries.size}\uE001`;
+      sanctuaries.set(placeholder, match);
+      return placeholder;
+    });
     html = this.parseBold(html);
     html = this.parseItalic(html);
-    codeBlocks.forEach((codeBlock, placeholder) => {
-      html = html.replace(placeholder, codeBlock);
+    sanctuaries.forEach((content, placeholder) => {
+      html = html.replace(placeholder, content);
     });
     return html;
   }