pptx-angular-viewer 1.13.1 → 1.13.2

package/CHANGELOG.md

@@ -4,6 +4,8 @@ All notable changes to this project are documented here.
 This file is generated from [Conventional Commits](https://www.conventionalcommits.org)
 by [git-cliff](https://git-cliff.org); do not edit it by hand.
 
+## [1.13.1](https://github.com/ChristopherVR/pptx-viewer/releases/tag/pptx-angular-viewer@1.13.1) - 2026-07-09
+
 ## [1.13.0](https://github.com/ChristopherVR/pptx-viewer/releases/tag/pptx-angular-viewer@1.13.0) - 2026-07-09
 
 ### Other

package/fesm2022/pptx-angular-viewer.mjs

@@ -20400,6 +20400,39 @@ function buildRunEffectStyle(style) {
     return css;
 }
 
+/**
+ * DOMPurify wrappers shared by every markup-sanitising call site (MathML/SVG
+ * equation rendering, print-document/SVG assembly). DOMPurify's factory has
+ * no working `sanitize` until handed a `window`, so in non-DOM contexts
+ * (node-based tests, SSR without jsdom) these degrade rather than throw.
+ *
+ * Two degradation strategies, picked per call site by how the sanitised
+ * output is used:
+ *  - {@link sanitizeMarkupOrRaw}: returns the untouched input outside a DOM.
+ *    Safe when the caller only ever renders the result in the browser (e.g.
+ *    `dangerouslySetInnerHTML` / `v-html`), so the fallback path never
+ *    reaches a real sink.
+ *  - {@link sanitizeMarkupOrEmpty}: returns `''` outside a DOM (fail closed).
+ *    Used where the sanitised string is unconditionally spliced into a
+ *    larger assembled document (print HTML/SVG) with no further gate, so a
+ *    silent pass-through of the raw, unsanitised input would defeat the
+ *    sanitisation entirely.
+ */
+function purifyFn() {
+    const purify = DOMPurify;
+    return typeof purify.sanitize === 'function' ? purify.sanitize : undefined;
+}
+/** Sanitise `markup`; outside a DOM, returns the raw input unchanged. */
+function sanitizeMarkupOrRaw(markup, config) {
+    const sanitize = purifyFn();
+    return sanitize ? sanitize(markup, config) : markup;
+}
+/** Sanitise `markup`; outside a DOM, returns `''` (fail closed). */
+function sanitizeMarkupOrEmpty(markup, config) {
+    const sanitize = purifyFn();
+    return sanitize ? sanitize(markup, config) : '';
+}
+
 /**
  * MathML / SVG markup sanitisation, shared by every binding's equation
  * renderer.
@@ -20418,20 +20451,15 @@ function buildRunEffectStyle(style) {
  * Safely sanitise a MathML/SVG markup string.
  *
  * In browser environments DOMPurify ships with `sanitize` ready to go. In
- * non-DOM contexts (node-based tests, SSR without jsdom) DOMPurify returns a
- * factory that lacks `sanitize` until handed a window; there we fall back to
- * the raw input. The XSS surface only matters in the browser, so this fallback
+ * non-DOM contexts (node-based tests, SSR without jsdom) it falls back to the
+ * raw input; the XSS surface only matters in the browser, so this fallback
  * is safe for non-DOM consumers.
  *
  * @param markup - MathML (optionally with embedded SVG) markup to sanitise.
  * @returns The sanitised markup, or the raw input when no DOM is available.
  */
 function sanitizeMathMl(markup) {
-    const purify = DOMPurify;
-    if (typeof purify.sanitize !== 'function') {
-        return markup;
-    }
-    return purify.sanitize(markup, { USE_PROFILES: { mathMl: true, svg: true } });
+    return sanitizeMarkupOrRaw(markup, { USE_PROFILES: { mathMl: true, svg: true } });
 }
 
 /**
@@ -33982,13 +34010,13 @@ function buildNotesTextStream(lines, startY) {
 }
 
 /**
- * Pure SVG-print string helpers — shared by bindings that offer a vector print
+ * Pure SVG-print string helpers, shared by bindings that offer a vector print
  * path (currently React). These build self-contained SVG / print-HTML strings
  * and escape text; they touch no DOM.
  *
  * The DOM-bound driver pieces (cloning the live element tree, reading
  * `getComputedStyle`, fetching images to base64, `Blob` wrapping) stay in the
- * binding — only the string assembly and escaping live here.
+ * binding; only the string assembly and escaping live here.
  */
 /* ------------------------------------------------------------------ */
 /*  XML escaping                                                       */
@@ -34122,7 +34150,14 @@ function buildPrintDocument(svgs, width, height, options = {}) {
     const safeColorFilter = sanitizeCssDeclaration(colorFilter);
     const slidePages = svgs
         .map((svg, i) => {
-        const safeSvg = isSafeSvgMarkup(svg) ? svg : '';
+        // Belt-and-suspenders: the structural allow/deny-list guard runs
+        // first, then DOMPurify's SVG profile actually transforms the
+        // markup (stripping `<script>`/`<foreignObject>`/event handlers/
+        // `javascript:` URIs) before it is spliced in, rather than merely
+        // gating the raw, untransformed string behind a boolean check.
+        const safeSvg = isSafeSvgMarkup(svg)
+            ? sanitizeMarkupOrEmpty(svg, { USE_PROFILES: { svg: true } })
+            : '';
         return `<section class="print-slide-page" aria-label="Slide ${i + 1}">
   ${safeSvg}
 </section>`;
@@ -35621,6 +35656,8 @@ function isSafePrintBodyHtml(html) {
     }
     return !EVENT_HANDLER_ATTR_RE.test(html);
 }
+/** DOMPurify config for the assembled print-window body: plain HTML, no MathML/SVG needed. */
+const PRINT_BODY_SANITIZE_CONFIG = { USE_PROFILES: { html: true } };
 /**
  * Assemble the complete printable HTML document string (doctype + head with
  * print CSS + body). Pure: the caller writes it into a print window.
@@ -35629,7 +35666,13 @@ function buildPrintHtmlDocument(options) {
     const { title, bodyHtml, frameSlides } = options;
     const orientation = sanitizeOrientation(options.orientation);
     const colorFilter = options.colorFilter;
-    const safeBodyHtml = isSafePrintBodyHtml(bodyHtml) ? bodyHtml : '';
+    // Belt-and-suspenders: the deny-list guard runs first, then DOMPurify
+    // actually transforms the markup (stripping `<script>`/`<iframe>`/event
+    // handlers/`javascript:` URIs) before it is spliced in, rather than
+    // merely gating the raw, untransformed string behind a boolean check.
+    const safeBodyHtml = isSafePrintBodyHtml(bodyHtml)
+        ? sanitizeMarkupOrEmpty(bodyHtml, PRINT_BODY_SANITIZE_CONFIG)
+        : '';
     const frameStyle = frameSlides
         ? 'img.slide-img, .notes-slide, .handout-cell img { border: 2px solid #000 !important; }'
         : '';
@@ -75869,7 +75912,7 @@ class RibbonComponent {
 
 			<!-- ── Ribbon content (collapsible via the ribbon toggle) ──────────── -->
 			<div
-				class="flex flex-nowrap items-stretch gap-1.5 overflow-x-auto px-2 py-1.5"
+				class="flex flex-nowrap items-center gap-1.5 overflow-x-auto px-2 py-1"
 				[style.display]="ribbonExpanded() ? null : 'none'"
 			>
 				@switch (activeTab()) {
@@ -76175,7 +76218,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.5", ngImpor
 
 			<!-- ── Ribbon content (collapsible via the ribbon toggle) ──────────── -->
 			<div
-				class="flex flex-nowrap items-stretch gap-1.5 overflow-x-auto px-2 py-1.5"
+				class="flex flex-nowrap items-center gap-1.5 overflow-x-auto px-2 py-1"
 				[style.display]="ribbonExpanded() ? null : 'none'"
 			>
 				@switch (activeTab()) {