pptx-angular-viewer 1.13.0 → 1.13.1

package/CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to this project are documented here.
 This file is generated from [Conventional Commits](https://www.conventionalcommits.org)
 by [git-cliff](https://git-cliff.org); do not edit it by hand.
 
+## [1.13.0](https://github.com/ChristopherVR/pptx-viewer/releases/tag/pptx-angular-viewer@1.13.0) - 2026-07-09
+
+### Other
+
+- Reconcile with origin/main before push (by @ChristopherVR) ([ef5fc85](https://github.com/ChristopherVR/pptx-viewer/commit/ef5fc85dca2e20ff3e105d622594e0f65d010fb0))
+- Reconcile with origin/main before push (by @ChristopherVR) ([030b28b](https://github.com/ChristopherVR/pptx-viewer/commit/030b28bb21697ed681e4e59aa40db29f4b4a18d0))
+
 ## [1.12.0](https://github.com/ChristopherVR/pptx-viewer/releases/tag/pptx-angular-viewer@1.12.0) - 2026-07-09
 
 ### Features

package/fesm2022/pptx-angular-viewer.mjs

@@ -34036,20 +34036,47 @@ function sanitizeCssDeclaration(value) {
  * JS callers, so a runtime check keeps the value that reaches `@page` /
  * `<style>` interpolation confined to those two known-safe strings.
  */
-function sanitizeOrientation(value) {
+function sanitizeOrientation$1(value) {
     return value === 'portrait' ? 'portrait' : 'landscape';
 }
+/** Element/attribute shapes that are never legitimate in a rendered slide SVG. */
+const UNSAFE_SVG_SUBSTRINGS = [
+    '</section',
+    '<script',
+    '<foreignobject',
+    '<iframe',
+    '<embed',
+    '<object',
+    // eslint-disable-next-line no-script-url -- security deny-list entry: verifies the scheme is rejected, never executed.
+    'javascript:',
+];
+/** Matches an `on<event>=` handler attribute, e.g. `onload=`, `onclick=`. */
+const EVENT_HANDLER_ATTR_RE$1 = /\son\w+\s*=/iu;
 /**
  * Guard against a malformed or tampered per-slide SVG string breaking out
  * of the `<section>` wrapper it's embedded in (unescaped) by
- * {@link buildPrintDocument}. Legitimate SVG produced by this library's own
- * `SvgExporter` render path is well-formed markup that never contains a
- * `</section` or `<script` substring, so this only ever rejects input that
- * has been corrupted or crafted to inject sibling markup.
+ * {@link buildPrintDocument}.
+ *
+ * This is deliberately an allow-list first, deny-list second check, not
+ * just a deny-list: legitimate SVG produced by this library's own
+ * `SvgExporter` render path is always a single well-formed `<svg>...</svg>`
+ * root element, so anything that doesn't structurally look like that is
+ * rejected outright. The deny-list then additionally screens for common
+ * SVG-based script-injection vectors (`<script>`, `<foreignObject>` (which
+ * can embed arbitrary HTML), `on*=` event handler attributes, `javascript:`
+ * URIs) so a crafted-but-still-`<svg>...</svg>`-shaped payload is also
+ * rejected.
  */
 function isSafeSvgMarkup(svg) {
-    const lower = svg.toLowerCase();
-    return !lower.includes('</section') && !lower.includes('<script');
+    const trimmed = svg.trim();
+    if (!trimmed.toLowerCase().startsWith('<svg') || !trimmed.toLowerCase().endsWith('</svg>')) {
+        return false;
+    }
+    const lower = trimmed.toLowerCase();
+    if (UNSAFE_SVG_SUBSTRINGS.some((needle) => lower.includes(needle))) {
+        return false;
+    }
+    return !EVENT_HANDLER_ATTR_RE$1.test(trimmed);
 }
 /* ------------------------------------------------------------------ */
 /*  Print stylesheet / document construction                           */
@@ -34091,7 +34118,7 @@ function buildPrintStyleSheet(width, height, customCss) {
  */
 function buildPrintDocument(svgs, width, height, options = {}) {
     const { title = 'Print', orientation = 'landscape', colorFilter = '' } = options;
-    const safeOrientation = sanitizeOrientation(orientation);
+    const safeOrientation = sanitizeOrientation$1(orientation);
     const safeColorFilter = sanitizeCssDeclaration(colorFilter);
     const slidePages = svgs
         .map((svg, i) => {
@@ -35558,12 +35585,51 @@ function buildHandoutsHtml(slideImages, slideIndices, slidesPerPage) {
     }
     return pages.join('');
 }
+/**
+ * `orientation` is typed as a union at compile time, but `buildPrintHtmlDocument`
+ * is a public export reachable from plain JS callers, so a runtime check keeps
+ * the value that reaches `@page` / `<style>` interpolation confined to those
+ * two known-safe strings.
+ */
+function sanitizeOrientation(value) {
+    return value === 'portrait' ? 'portrait' : 'landscape';
+}
+/** Element/attribute shapes that must never appear in assembled print-window body HTML. */
+const UNSAFE_BODY_HTML_SUBSTRINGS = [
+    '<script',
+    '<iframe',
+    '<embed',
+    '<object',
+    '<foreignobject',
+    // eslint-disable-next-line no-script-url -- security deny-list entry: verifies the scheme is rejected, never executed.
+    'javascript:',
+];
+/** Matches an `on<event>=` handler attribute, e.g. `onload=`, `onclick=`. */
+const EVENT_HANDLER_ATTR_RE = /\son\w+\s*=/iu;
+/**
+ * Defense-in-depth guard for the assembled print-window body HTML. Every
+ * dynamic value the `build*Html` helpers above embed (titles, notes, image
+ * `src`) is already escaped via {@link escapeHtml} / {@link safeDataImageSrc}
+ * before it's spliced into `bodyHtml`; this additionally screens the
+ * assembled fragment for script-injection shapes, so a future caller that
+ * forgets to escape a new field doesn't reach the printed window unnoticed.
+ */
+function isSafePrintBodyHtml(html) {
+    const lower = html.toLowerCase();
+    if (UNSAFE_BODY_HTML_SUBSTRINGS.some((needle) => lower.includes(needle))) {
+        return false;
+    }
+    return !EVENT_HANDLER_ATTR_RE.test(html);
+}
 /**
  * Assemble the complete printable HTML document string (doctype + head with
  * print CSS + body). Pure: the caller writes it into a print window.
  */
 function buildPrintHtmlDocument(options) {
-    const { title, bodyHtml, orientation, colorFilter, frameSlides } = options;
+    const { title, bodyHtml, frameSlides } = options;
+    const orientation = sanitizeOrientation(options.orientation);
+    const colorFilter = options.colorFilter;
+    const safeBodyHtml = isSafePrintBodyHtml(bodyHtml) ? bodyHtml : '';
     const frameStyle = frameSlides
         ? 'img.slide-img, .notes-slide, .handout-cell img { border: 2px solid #000 !important; }'
         : '';
@@ -35611,7 +35677,7 @@ function buildPrintHtmlDocument(options) {
       ${frameStyle}
     </style>
   </head>
-  <body>${bodyHtml}</body>
+  <body>${safeBodyHtml}</body>
 </html>`;
 }