pptx-angular-viewer 1.13.0 → 1.13.2

package/CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to this project are documented here.
 This file is generated from [Conventional Commits](https://www.conventionalcommits.org)
 by [git-cliff](https://git-cliff.org); do not edit it by hand.
 
+## [1.13.1](https://github.com/ChristopherVR/pptx-viewer/releases/tag/pptx-angular-viewer@1.13.1) - 2026-07-09
+
+## [1.13.0](https://github.com/ChristopherVR/pptx-viewer/releases/tag/pptx-angular-viewer@1.13.0) - 2026-07-09
+
+### Other
+
+- Reconcile with origin/main before push (by @ChristopherVR) ([ef5fc85](https://github.com/ChristopherVR/pptx-viewer/commit/ef5fc85dca2e20ff3e105d622594e0f65d010fb0))
+- Reconcile with origin/main before push (by @ChristopherVR) ([030b28b](https://github.com/ChristopherVR/pptx-viewer/commit/030b28bb21697ed681e4e59aa40db29f4b4a18d0))
+
 ## [1.12.0](https://github.com/ChristopherVR/pptx-viewer/releases/tag/pptx-angular-viewer@1.12.0) - 2026-07-09
 
 ### Features

package/fesm2022/pptx-angular-viewer.mjs

@@ -20400,6 +20400,39 @@ function buildRunEffectStyle(style) {
     return css;
 }
 
+/**
+ * DOMPurify wrappers shared by every markup-sanitising call site (MathML/SVG
+ * equation rendering, print-document/SVG assembly). DOMPurify's factory has
+ * no working `sanitize` until handed a `window`, so in non-DOM contexts
+ * (node-based tests, SSR without jsdom) these degrade rather than throw.
+ *
+ * Two degradation strategies, picked per call site by how the sanitised
+ * output is used:
+ *  - {@link sanitizeMarkupOrRaw}: returns the untouched input outside a DOM.
+ *    Safe when the caller only ever renders the result in the browser (e.g.
+ *    `dangerouslySetInnerHTML` / `v-html`), so the fallback path never
+ *    reaches a real sink.
+ *  - {@link sanitizeMarkupOrEmpty}: returns `''` outside a DOM (fail closed).
+ *    Used where the sanitised string is unconditionally spliced into a
+ *    larger assembled document (print HTML/SVG) with no further gate, so a
+ *    silent pass-through of the raw, unsanitised input would defeat the
+ *    sanitisation entirely.
+ */
+function purifyFn() {
+    const purify = DOMPurify;
+    return typeof purify.sanitize === 'function' ? purify.sanitize : undefined;
+}
+/** Sanitise `markup`; outside a DOM, returns the raw input unchanged. */
+function sanitizeMarkupOrRaw(markup, config) {
+    const sanitize = purifyFn();
+    return sanitize ? sanitize(markup, config) : markup;
+}
+/** Sanitise `markup`; outside a DOM, returns `''` (fail closed). */
+function sanitizeMarkupOrEmpty(markup, config) {
+    const sanitize = purifyFn();
+    return sanitize ? sanitize(markup, config) : '';
+}
+
 /**
  * MathML / SVG markup sanitisation, shared by every binding's equation
  * renderer.
@@ -20418,20 +20451,15 @@ function buildRunEffectStyle(style) {
  * Safely sanitise a MathML/SVG markup string.
  *
  * In browser environments DOMPurify ships with `sanitize` ready to go. In
- * non-DOM contexts (node-based tests, SSR without jsdom) DOMPurify returns a
- * factory that lacks `sanitize` until handed a window; there we fall back to
- * the raw input. The XSS surface only matters in the browser, so this fallback
+ * non-DOM contexts (node-based tests, SSR without jsdom) it falls back to the
+ * raw input; the XSS surface only matters in the browser, so this fallback
  * is safe for non-DOM consumers.
  *
  * @param markup - MathML (optionally with embedded SVG) markup to sanitise.
  * @returns The sanitised markup, or the raw input when no DOM is available.
  */
 function sanitizeMathMl(markup) {
-    const purify = DOMPurify;
-    if (typeof purify.sanitize !== 'function') {
-        return markup;
-    }
-    return purify.sanitize(markup, { USE_PROFILES: { mathMl: true, svg: true } });
+    return sanitizeMarkupOrRaw(markup, { USE_PROFILES: { mathMl: true, svg: true } });
 }
 
 /**
@@ -33982,13 +34010,13 @@ function buildNotesTextStream(lines, startY) {
 }
 
 /**
- * Pure SVG-print string helpers — shared by bindings that offer a vector print
+ * Pure SVG-print string helpers, shared by bindings that offer a vector print
  * path (currently React). These build self-contained SVG / print-HTML strings
  * and escape text; they touch no DOM.
  *
  * The DOM-bound driver pieces (cloning the live element tree, reading
  * `getComputedStyle`, fetching images to base64, `Blob` wrapping) stay in the
- * binding — only the string assembly and escaping live here.
+ * binding; only the string assembly and escaping live here.
  */
 /* ------------------------------------------------------------------ */
 /*  XML escaping                                                       */
@@ -34036,20 +34064,47 @@ function sanitizeCssDeclaration(value) {
  * JS callers, so a runtime check keeps the value that reaches `@page` /
  * `<style>` interpolation confined to those two known-safe strings.
  */
-function sanitizeOrientation(value) {
+function sanitizeOrientation$1(value) {
     return value === 'portrait' ? 'portrait' : 'landscape';
 }
+/** Element/attribute shapes that are never legitimate in a rendered slide SVG. */
+const UNSAFE_SVG_SUBSTRINGS = [
+    '</section',
+    '<script',
+    '<foreignobject',
+    '<iframe',
+    '<embed',
+    '<object',
+    // eslint-disable-next-line no-script-url -- security deny-list entry: verifies the scheme is rejected, never executed.
+    'javascript:',
+];
+/** Matches an `on<event>=` handler attribute, e.g. `onload=`, `onclick=`. */
+const EVENT_HANDLER_ATTR_RE$1 = /\son\w+\s*=/iu;
 /**
  * Guard against a malformed or tampered per-slide SVG string breaking out
  * of the `<section>` wrapper it's embedded in (unescaped) by
- * {@link buildPrintDocument}. Legitimate SVG produced by this library's own
- * `SvgExporter` render path is well-formed markup that never contains a
- * `</section` or `<script` substring, so this only ever rejects input that
- * has been corrupted or crafted to inject sibling markup.
+ * {@link buildPrintDocument}.
+ *
+ * This is deliberately an allow-list first, deny-list second check, not
+ * just a deny-list: legitimate SVG produced by this library's own
+ * `SvgExporter` render path is always a single well-formed `<svg>...</svg>`
+ * root element, so anything that doesn't structurally look like that is
+ * rejected outright. The deny-list then additionally screens for common
+ * SVG-based script-injection vectors (`<script>`, `<foreignObject>` (which
+ * can embed arbitrary HTML), `on*=` event handler attributes, `javascript:`
+ * URIs) so a crafted-but-still-`<svg>...</svg>`-shaped payload is also
+ * rejected.
  */
 function isSafeSvgMarkup(svg) {
-    const lower = svg.toLowerCase();
-    return !lower.includes('</section') && !lower.includes('<script');
+    const trimmed = svg.trim();
+    if (!trimmed.toLowerCase().startsWith('<svg') || !trimmed.toLowerCase().endsWith('</svg>')) {
+        return false;
+    }
+    const lower = trimmed.toLowerCase();
+    if (UNSAFE_SVG_SUBSTRINGS.some((needle) => lower.includes(needle))) {
+        return false;
+    }
+    return !EVENT_HANDLER_ATTR_RE$1.test(trimmed);
 }
 /* ------------------------------------------------------------------ */
 /*  Print stylesheet / document construction                           */
@@ -34091,11 +34146,18 @@ function buildPrintStyleSheet(width, height, customCss) {
  */
 function buildPrintDocument(svgs, width, height, options = {}) {
     const { title = 'Print', orientation = 'landscape', colorFilter = '' } = options;
-    const safeOrientation = sanitizeOrientation(orientation);
+    const safeOrientation = sanitizeOrientation$1(orientation);
     const safeColorFilter = sanitizeCssDeclaration(colorFilter);
     const slidePages = svgs
         .map((svg, i) => {
-        const safeSvg = isSafeSvgMarkup(svg) ? svg : '';
+        // Belt-and-suspenders: the structural allow/deny-list guard runs
+        // first, then DOMPurify's SVG profile actually transforms the
+        // markup (stripping `<script>`/`<foreignObject>`/event handlers/
+        // `javascript:` URIs) before it is spliced in, rather than merely
+        // gating the raw, untransformed string behind a boolean check.
+        const safeSvg = isSafeSvgMarkup(svg)
+            ? sanitizeMarkupOrEmpty(svg, { USE_PROFILES: { svg: true } })
+            : '';
         return `<section class="print-slide-page" aria-label="Slide ${i + 1}">
   ${safeSvg}
 </section>`;
@@ -35558,12 +35620,59 @@ function buildHandoutsHtml(slideImages, slideIndices, slidesPerPage) {
     }
     return pages.join('');
 }
+/**
+ * `orientation` is typed as a union at compile time, but `buildPrintHtmlDocument`
+ * is a public export reachable from plain JS callers, so a runtime check keeps
+ * the value that reaches `@page` / `<style>` interpolation confined to those
+ * two known-safe strings.
+ */
+function sanitizeOrientation(value) {
+    return value === 'portrait' ? 'portrait' : 'landscape';
+}
+/** Element/attribute shapes that must never appear in assembled print-window body HTML. */
+const UNSAFE_BODY_HTML_SUBSTRINGS = [
+    '<script',
+    '<iframe',
+    '<embed',
+    '<object',
+    '<foreignobject',
+    // eslint-disable-next-line no-script-url -- security deny-list entry: verifies the scheme is rejected, never executed.
+    'javascript:',
+];
+/** Matches an `on<event>=` handler attribute, e.g. `onload=`, `onclick=`. */
+const EVENT_HANDLER_ATTR_RE = /\son\w+\s*=/iu;
+/**
+ * Defense-in-depth guard for the assembled print-window body HTML. Every
+ * dynamic value the `build*Html` helpers above embed (titles, notes, image
+ * `src`) is already escaped via {@link escapeHtml} / {@link safeDataImageSrc}
+ * before it's spliced into `bodyHtml`; this additionally screens the
+ * assembled fragment for script-injection shapes, so a future caller that
+ * forgets to escape a new field doesn't reach the printed window unnoticed.
+ */
+function isSafePrintBodyHtml(html) {
+    const lower = html.toLowerCase();
+    if (UNSAFE_BODY_HTML_SUBSTRINGS.some((needle) => lower.includes(needle))) {
+        return false;
+    }
+    return !EVENT_HANDLER_ATTR_RE.test(html);
+}
+/** DOMPurify config for the assembled print-window body: plain HTML, no MathML/SVG needed. */
+const PRINT_BODY_SANITIZE_CONFIG = { USE_PROFILES: { html: true } };
 /**
  * Assemble the complete printable HTML document string (doctype + head with
  * print CSS + body). Pure: the caller writes it into a print window.
  */
 function buildPrintHtmlDocument(options) {
-    const { title, bodyHtml, orientation, colorFilter, frameSlides } = options;
+    const { title, bodyHtml, frameSlides } = options;
+    const orientation = sanitizeOrientation(options.orientation);
+    const colorFilter = options.colorFilter;
+    // Belt-and-suspenders: the deny-list guard runs first, then DOMPurify
+    // actually transforms the markup (stripping `<script>`/`<iframe>`/event
+    // handlers/`javascript:` URIs) before it is spliced in, rather than
+    // merely gating the raw, untransformed string behind a boolean check.
+    const safeBodyHtml = isSafePrintBodyHtml(bodyHtml)
+        ? sanitizeMarkupOrEmpty(bodyHtml, PRINT_BODY_SANITIZE_CONFIG)
+        : '';
     const frameStyle = frameSlides
         ? 'img.slide-img, .notes-slide, .handout-cell img { border: 2px solid #000 !important; }'
         : '';
@@ -35611,7 +35720,7 @@ function buildPrintHtmlDocument(options) {
       ${frameStyle}
     </style>
   </head>
-  <body>${bodyHtml}</body>
+  <body>${safeBodyHtml}</body>
 </html>`;
 }
 
@@ -75803,7 +75912,7 @@ class RibbonComponent {
 
 			<!-- ── Ribbon content (collapsible via the ribbon toggle) ──────────── -->
 			<div
-				class="flex flex-nowrap items-stretch gap-1.5 overflow-x-auto px-2 py-1.5"
+				class="flex flex-nowrap items-center gap-1.5 overflow-x-auto px-2 py-1"
 				[style.display]="ribbonExpanded() ? null : 'none'"
 			>
 				@switch (activeTab()) {
@@ -76109,7 +76218,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.5", ngImpor
 
 			<!-- ── Ribbon content (collapsible via the ribbon toggle) ──────────── -->
 			<div
-				class="flex flex-nowrap items-stretch gap-1.5 overflow-x-auto px-2 py-1.5"
+				class="flex flex-nowrap items-center gap-1.5 overflow-x-auto px-2 py-1"
 				[style.display]="ribbonExpanded() ? null : 'none'"
 			>
 				@switch (activeTab()) {