overtype 1.1.5 → 1.1.7

package/dist/overtype.js

@@ -1,5 +1,5 @@
 /**
- * OverType v1.1.4
+ * OverType v1.1.7
  * A lightweight markdown editor library with perfect WYSIWYG alignment
  * @license MIT
  * @author Demo User
@@ -164,6 +164,28 @@ var OverType = (() => {
     static parseInlineCode(html) {
       return html.replace(new RegExp("(?<!`)(`+)(?!`)((?:(?!\\1).)+?)(\\1)(?!`)", "g"), '<code><span class="syntax-marker">$1</span>$2<span class="syntax-marker">$3</span></code>');
     }
+    /**
+     * Sanitize URL to prevent XSS attacks
+     * @param {string} url - URL to sanitize
+     * @returns {string} Safe URL or '#' if dangerous
+     */
+    static sanitizeUrl(url) {
+      const trimmed = url.trim();
+      const lower = trimmed.toLowerCase();
+      const safeProtocols = [
+        "http://",
+        "https://",
+        "mailto:",
+        "ftp://",
+        "ftps://"
+      ];
+      const hasSafeProtocol = safeProtocols.some((protocol) => lower.startsWith(protocol));
+      const isRelative = trimmed.startsWith("/") || trimmed.startsWith("#") || trimmed.startsWith("?") || trimmed.startsWith(".") || !trimmed.includes(":") && !trimmed.includes("//");
+      if (hasSafeProtocol || isRelative) {
+        return url;
+      }
+      return "#";
+    }
     /**
      * Parse links
      * @param {string} html - HTML with potential link markdown
@@ -172,7 +194,8 @@ var OverType = (() => {
     static parseLinks(html) {
       return html.replace(/\[(.+?)\]\((.+?)\)/g, (match, text, url) => {
         const anchorName = `--link-${this.linkIndex++}`;
-        return `<a href="${url}" style="anchor-name: ${anchorName}"><span class="syntax-marker">[</span>${text}<span class="syntax-marker">](</span><span class="syntax-marker">${url}</span><span class="syntax-marker">)</span></a>`;
+        const safeUrl = this.sanitizeUrl(url);
+        return `<a href="${safeUrl}" style="anchor-name: ${anchorName}"><span class="syntax-marker">[</span>${text}<span class="syntax-marker">](</span><span class="syntax-marker link-url">${url}</span><span class="syntax-marker">)</span></a>`;
       });
     }
     /**
@@ -183,17 +206,22 @@ var OverType = (() => {
     static parseInlineElements(text) {
       let html = text;
       html = this.parseInlineCode(html);
-      const codeBlocks = /* @__PURE__ */ new Map();
+      const sanctuaries = /* @__PURE__ */ new Map();
       html = html.replace(/(<code>.*?<\/code>)/g, (match) => {
-        const placeholder = `\uE000${codeBlocks.size}\uE001`;
-        codeBlocks.set(placeholder, match);
+        const placeholder = `\uE000${sanctuaries.size}\uE001`;
+        sanctuaries.set(placeholder, match);
         return placeholder;
       });
       html = this.parseLinks(html);
+      html = html.replace(/(<a[^>]*>.*?<\/a>)/g, (match) => {
+        const placeholder = `\uE000${sanctuaries.size}\uE001`;
+        sanctuaries.set(placeholder, match);
+        return placeholder;
+      });
       html = this.parseBold(html);
       html = this.parseItalic(html);
-      codeBlocks.forEach((codeBlock, placeholder) => {
-        html = html.replace(placeholder, codeBlock);
+      sanctuaries.forEach((content, placeholder) => {
+        html = html.replace(placeholder, content);
       });
       return html;
     }