reviw 0.10.5 → 0.10.7

package/cli.cjs

@@ -20,17 +20,157 @@ const iconv = require("iconv-lite");
 const marked = require("marked");
 const yaml = require("js-yaml");
 
+// --- XSS Protection for marked (Whitelist approach) ---
+// 許可タグリスト（Markdown由来の安全なタグのみ）
+const allowedTags = new Set([
+  'p', 'br', 'hr',
+  'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
+  'ul', 'ol', 'li',
+  'blockquote', 'pre', 'code',
+  'em', 'strong', 'del', 's',
+  'a', 'img',
+  'table', 'thead', 'tbody', 'tr', 'th', 'td',
+  'div', 'span', // Markdown拡張用
+]);
+
+// 許可属性リスト（タグごとに定義）
+const allowedAttributes = {
+  'a': ['href', 'title', 'target', 'rel'],
+  'img': ['src', 'alt', 'title', 'width', 'height'],
+  'code': ['class'], // 言語ハイライト用
+  'pre': ['class'],
+  'div': ['class'],
+  'span': ['class'],
+  'th': ['align'],
+  'td': ['align'],
+};
+
+// HTMLエスケープ関数（XSS対策用）
+function escapeHtmlForXss(html) {
+  return html
+    .replace(/&/g, "&")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
+}
+
+// href/src属性のURLバリデーション
+function isSafeUrl(url) {
+  if (!url) return true;
+  // 空白・制御文字を除去して正規化
+  var normalized = url.toLowerCase().replace(/[\s\x00-\x1f]/g, '');
+  // HTMLエンティティのデコード（&#x0a; &#10; など）
+  var decoded = normalized.replace(/&#x?[0-9a-f]+;?/gi, '');
+  if (decoded.startsWith('javascript:')) return false;
+  if (decoded.startsWith('vbscript:')) return false;
+  if (decoded.startsWith('data:') && !decoded.startsWith('data:image/')) return false;
+  return true;
+}
+
+// HTML文字列をサニタイズ（ホワイトリストに含まれないタグ/属性を除去）
+function sanitizeHtml(html) {
+  // より堅牢なタグマッチング：属性値内の < > を考慮
+  // 引用符で囲まれた属性値を正しく処理するパターン
+  var tagPattern = /<\/?([a-z][a-z0-9]*)((?:\s+[a-z][a-z0-9-]*(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>"']*))?)*)\s*\/?>/gi;
+
+  return html.replace(tagPattern, function(match, tag, attrsStr) {
+    var tagLower = tag.toLowerCase();
+
+    // 許可されていないタグはエスケープ
+    if (!allowedTags.has(tagLower)) {
+      return escapeHtmlForXss(match);
+    }
+
+    // 終了タグはそのまま
+    if (match.startsWith('</')) {
+      return '</' + tagLower + '>';
+    }
+
+    // 属性をフィルタリング
+    var allowed = allowedAttributes[tagLower] || [];
+    var safeAttrs = [];
+
+    // 属性を解析（引用符で囲まれた値を正しく処理）
+    var attrRegex = /([a-z][a-z0-9-]*)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>"']*))/gi;
+    var attrMatch;
+    while ((attrMatch = attrRegex.exec(attrsStr)) !== null) {
+      var attrName = attrMatch[1].toLowerCase();
+      var attrValue = attrMatch[2] !== undefined ? attrMatch[2] :
+                      attrMatch[3] !== undefined ? attrMatch[3] :
+                      attrMatch[4] || '';
+
+      // on*イベントハンドラは常に拒否
+      if (attrName.startsWith('on')) continue;
+
+      // 許可属性のみ
+      if (!allowed.includes(attrName)) continue;
+
+      // href/srcのURL検証
+      if ((attrName === 'href' || attrName === 'src') && !isSafeUrl(attrValue)) {
+        continue;
+      }
+
+      safeAttrs.push(attrName + '="' + attrValue.replace(/"/g, '&quot;') + '"');
+    }
+
+    var finalAttrs = safeAttrs.length > 0 ? ' ' + safeAttrs.join(' ') : '';
+    return '<' + tagLower + finalAttrs + '>';
+  });
+}
+
+marked.use({
+  renderer: {
+    // 生HTMLブロックをサニタイズ
+    html: function(token) {
+      var text = token.raw || token.text || token;
+      return sanitizeHtml(text);
+    },
+    // リンクに安全なURL検証を追加（別タブで開く）
+    link: function(href, title, text) {
+      href = href || "";
+      title = title || "";
+      text = text || "";
+      if (!isSafeUrl(href)) {
+        // 危険なURLはプレーンテキストとして表示
+        return escapeHtmlForXss(text);
+      }
+      var titleAttr = title ? ' title="' + escapeHtmlForXss(title) + '"' : "";
+      return '<a href="' + escapeHtmlForXss(href) + '"' + titleAttr + ' target="_blank" rel="noopener noreferrer">' + text + '</a>';
+    },
+    // 画像にも安全なURL検証を追加
+    image: function(href, title, text) {
+      href = href || "";
+      title = title || "";
+      text = text || "";
+      if (!isSafeUrl(href)) {
+        return escapeHtmlForXss(text || "image");
+      }
+      var titleAttr = title ? ' title="' + escapeHtmlForXss(title) + '"' : "";
+      var altAttr = text ? ' alt="' + escapeHtmlForXss(text) + '"' : "";
+      return '<img src="' + escapeHtmlForXss(href) + '"' + altAttr + titleAttr + '>';
+    }
+  }
+});
+
 // --- CLI arguments ---------------------------------------------------------
 const VERSION = require("./package.json").version;
-const args = process.argv.slice(2);
 
-const filePaths = [];
-let basePort = 4989;
-let encodingOpt = null;
-let noOpen = false;
+// ===== CLI設定のデフォルト値（import時に使用） =====
+const DEFAULT_CONFIG = {
+  basePort: 4989,
+  encodingOpt: null,
+  noOpen: false,
+};
+
+// ===== グローバル設定変数（デフォルト値で初期化、require.main時に更新） =====
+let basePort = DEFAULT_CONFIG.basePort;
+let encodingOpt = DEFAULT_CONFIG.encodingOpt;
+let noOpen = DEFAULT_CONFIG.noOpen;
 let stdinMode = false;
 let diffMode = false;
 let stdinContent = null;
+let resolvedPaths = [];  // ファイルパス（require.main時に設定）
 
 function showHelp() {
   console.log(`reviw v${VERSION} - Lightweight file reviewer with in-browser comments
@@ -75,25 +215,55 @@ function showVersion() {
   console.log(VERSION);
 }
 
-for (let i = 0; i < args.length; i += 1) {
-  const arg = args[i];
-  if (arg === "--port" && args[i + 1]) {
-    basePort = Number(args[i + 1]);
-    i += 1;
-  } else if ((arg === "--encoding" || arg === "-e") && args[i + 1]) {
-    encodingOpt = args[i + 1];
-    i += 1;
-  } else if (arg === "--no-open") {
-    noOpen = true;
-  } else if (arg === "--help" || arg === "-h") {
-    showHelp();
-    process.exit(0);
-  } else if (arg === "--version" || arg === "-v") {
-    showVersion();
-    process.exit(0);
-  } else if (!arg.startsWith("-")) {
-    filePaths.push(arg);
+// ===== CLI引数パース関数（require.main時のみ呼ばれる） =====
+function parseCliArgs(argv) {
+  const args = argv.slice(2);
+  const config = { ...DEFAULT_CONFIG };
+  const filePaths = [];
+
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === "--port" && args[i + 1]) {
+      config.basePort = Number(args[i + 1]);
+      i += 1;
+    } else if ((arg === "--encoding" || arg === "-e") && args[i + 1]) {
+      config.encodingOpt = args[i + 1];
+      i += 1;
+    } else if (arg === "--no-open") {
+      config.noOpen = true;
+    } else if (arg === "--help" || arg === "-h") {
+      showHelp();
+      process.exit(0);
+    } else if (arg === "--version" || arg === "-v") {
+      showVersion();
+      process.exit(0);
+    } else if (!arg.startsWith("-")) {
+      filePaths.push(arg);
+    }
+  }
+
+  return { config, filePaths };
+}
+
+// ===== ファイルパス検証・解決関数（require.main時のみ呼ばれる） =====
+function validateAndResolvePaths(filePaths) {
+  const resolved = [];
+  for (const fp of filePaths) {
+    const resolvedPath = path.resolve(fp);
+    if (!fs.existsSync(resolvedPath)) {
+      console.error(`File not found: ${resolvedPath}`);
+      process.exit(1);
+    }
+    const stat = fs.statSync(resolvedPath);
+    if (stat.isDirectory()) {
+      console.error(`Cannot open directory: ${resolvedPath}`);
+      console.error(`Usage: reviw <file> [file2...]`);
+      console.error(`Please specify a file, not a directory.`);
+      process.exit(1);
+    }
+    resolved.push(resolvedPath);
   }
+  return resolved;
 }
 
 // Check if stdin has data (pipe mode)
@@ -148,24 +318,6 @@ function runGitDiff() {
   });
 }
 
-// Validate all files exist and are not directories (if files specified)
-const resolvedPaths = [];
-for (const fp of filePaths) {
-  const resolved = path.resolve(fp);
-  if (!fs.existsSync(resolved)) {
-    console.error(`File not found: ${resolved}`);
-    process.exit(1);
-  }
-  const stat = fs.statSync(resolved);
-  if (stat.isDirectory()) {
-    console.error(`Cannot open directory: ${resolved}`);
-    console.error(`Usage: reviw <file> [file2...]`);
-    console.error(`Please specify a file, not a directory.`);
-    process.exit(1);
-  }
-  resolvedPaths.push(resolved);
-}
-
 // --- Diff parsing -----------------------------------------------------------
 function parseDiff(diffText) {
   const files = [];
@@ -1387,7 +1539,19 @@ function diffHtmlTemplate(diffData) {
       globalComment = globalCommentInput.value;
       hideSubmitModal();
       sendAndExit('button');
-      setTimeout(() => window.close(), 200);
+      // Try to close window; if it fails (browser security), show completion message
+      setTimeout(() => {
+        window.close();
+        // If window.close() didn't work, show a completion message
+        setTimeout(() => {
+          document.body.innerHTML = \`
+            <div style="display:flex;flex-direction:column;align-items:center;justify-content:center;height:100vh;background:var(--bg,#1a1a2e);color:var(--text,#e0e0e0);font-family:system-ui,sans-serif;">
+              <h1 style="font-size:2rem;margin-bottom:1rem;">✅ Review Submitted</h1>
+              <p style="color:var(--muted,#888);">You can close this tab now.</p>
+            </div>
+          \`;
+        }, 100);
+      }, 200);
     }
     document.getElementById('modal-submit').addEventListener('click', doSubmit);
     globalCommentInput.addEventListener('keydown', e => {
@@ -1470,6 +1634,7 @@ function htmlTemplate(dataRows, cols, title, mode, previewHtml) {
       --hover-bg: rgba(96,165,250,0.08);
       --shadow-color: rgba(0,0,0,0.35);
       --code-bg: #1e293b;
+      --error: #dc3545;
     }
     /* Light theme */
     [data-theme="light"] {
@@ -1496,6 +1661,7 @@ function htmlTemplate(dataRows, cols, title, mode, previewHtml) {
       --hover-bg: rgba(59,130,246,0.06);
       --shadow-color: rgba(0,0,0,0.1);
       --code-bg: #f1f5f9;
+      --error: #dc3545;
     }
     * { box-sizing: border-box; }
     body {
@@ -1973,9 +2139,6 @@ function htmlTemplate(dataRows, cols, title, mode, previewHtml) {
       text-align: left;
       border-bottom: 1px solid var(--border);
     }
-    .md-preview table:not(.frontmatter-table table) th {
-      background: rgba(255,255,255,0.05);
-    }
     .md-preview table:not(.frontmatter-table table) th {
       background: var(--panel);
       font-weight: 600;
@@ -2305,13 +2468,46 @@ function htmlTemplate(dataRows, cols, title, mode, previewHtml) {
     .fullscreen-content .mermaid svg {
       display: block;
     }
+    /* Minimap */
+    .minimap {
+      position: absolute;
+      top: 70px;
+      right: 20px;
+      width: 200px;
+      height: 150px;
+      background: var(--panel-alpha);
+      border: 1px solid var(--border);
+      border-radius: 8px;
+      overflow: hidden;
+      box-shadow: 0 4px 12px rgba(0,0,0,0.15);
+    }
+    .minimap-content {
+      width: 100%;
+      height: 100%;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      padding: 8px;
+    }
+    .minimap-content svg {
+      max-width: 100%;
+      max-height: 100%;
+      opacity: 0.6;
+    }
+    .minimap-viewport {
+      position: absolute;
+      border: 2px solid var(--accent);
+      background: rgba(102, 126, 234, 0.2);
+      pointer-events: none;
+      border-radius: 2px;
+    }
     /* Error toast */
     .mermaid-error-toast {
       position: fixed;
       bottom: 20px;
       left: 50%;
       transform: translateX(-50%);
-      background: #dc3545;
+      background: var(--error);
       color: white;
       padding: 12px 24px;
       border-radius: 8px;
@@ -2470,6 +2666,10 @@ function htmlTemplate(dataRows, cols, title, mode, previewHtml) {
     <div class="fullscreen-content" id="fs-content">
       <div class="mermaid-wrapper" id="fs-wrapper"></div>
     </div>
+    <div class="minimap" id="fs-minimap">
+      <div class="minimap-content" id="fs-minimap-content"></div>
+      <div class="minimap-viewport" id="fs-minimap-viewport"></div>
+    </div>
   </div>
   <div class="mermaid-error-toast" id="mermaid-error-toast"></div>
   <div class="copy-toast" id="copy-toast">Copied to clipboard!</div>
@@ -3388,7 +3588,19 @@ function htmlTemplate(dataRows, cols, title, mode, previewHtml) {
       globalComment = globalCommentInput.value;
       hideSubmitModal();
       sendAndExit('button');
-      setTimeout(() => window.close(), 200);
+      // Try to close window; if it fails (browser security), show completion message
+      setTimeout(() => {
+        window.close();
+        // If window.close() didn't work, show a completion message
+        setTimeout(() => {
+          document.body.innerHTML = \`
+            <div style="display:flex;flex-direction:column;align-items:center;justify-content:center;height:100vh;background:var(--bg,#1a1a2e);color:var(--text,#e0e0e0);font-family:system-ui,sans-serif;">
+              <h1 style="font-size:2rem;margin-bottom:1rem;">✅ Review Submitted</h1>
+              <p style="color:var(--muted,#888);">You can close this tab now.</p>
+            </div>
+          \`;
+        }, 100);
+      }, 200);
     }
     modalSubmit.addEventListener('click', doSubmit);
     globalCommentInput.addEventListener('keydown', (e) => {
@@ -3578,12 +3790,15 @@ function htmlTemplate(dataRows, cols, title, mode, previewHtml) {
       const fsWrapper = document.getElementById('fs-wrapper');
       const fsContent = document.getElementById('fs-content');
       const fsZoomInfo = document.getElementById('fs-zoom-info');
+      const minimapContent = document.getElementById('fs-minimap-content');
+      const minimapViewport = document.getElementById('fs-minimap-viewport');
       let currentZoom = 1;
       let initialZoom = 1;
       let panX = 0, panY = 0;
       let isPanning = false;
       let startX, startY;
       let svgNaturalWidth = 0, svgNaturalHeight = 0;
+      let minimapScale = 1;
 
       function openFullscreen(mermaidEl) {
         const svg = mermaidEl.querySelector('svg');
@@ -3592,6 +3807,11 @@ function htmlTemplate(dataRows, cols, title, mode, previewHtml) {
         const clonedSvg = svg.cloneNode(true);
         fsWrapper.appendChild(clonedSvg);
 
+        // Setup minimap
+        minimapContent.innerHTML = '';
+        const minimapSvg = svg.cloneNode(true);
+        minimapContent.appendChild(minimapSvg);
+
         // Get SVG's intrinsic/natural size from viewBox or attributes
         const viewBox = svg.getAttribute('viewBox');
         let naturalWidth, naturalHeight;
@@ -3608,6 +3828,11 @@ function htmlTemplate(dataRows, cols, title, mode, previewHtml) {
         svgNaturalWidth = naturalWidth;
         svgNaturalHeight = naturalHeight;
 
+        // Calculate minimap scale
+        const minimapMaxWidth = 184; // 200 - 16 padding
+        const minimapMaxHeight = 134; // 150 - 16 padding
+        minimapScale = Math.min(minimapMaxWidth / naturalWidth, minimapMaxHeight / naturalHeight);
+
         clonedSvg.style.width = naturalWidth + 'px';
         clonedSvg.style.height = naturalHeight + 'px';
 
@@ -3628,8 +3853,11 @@ function htmlTemplate(dataRows, cols, title, mode, previewHtml) {
         panX = (viewportWidth - scaledWidth) / 2 + 20;
         panY = (viewportHeight - scaledHeight) / 2 + 60;
 
-        updateTransform();
         fsOverlay.classList.add('visible');
+        // Wait for DOM to render before calculating minimap position
+        requestAnimationFrame(() => {
+          updateTransform();
+        });
       }
 
       function closeFullscreen() {
@@ -3639,6 +3867,71 @@ function htmlTemplate(dataRows, cols, title, mode, previewHtml) {
       function updateTransform() {
         fsWrapper.style.transform = 'translate(' + panX + 'px, ' + panY + 'px) scale(' + currentZoom + ')';
         fsZoomInfo.textContent = Math.round(currentZoom * 100) + '%';
+        updateMinimap();
+      }
+
+      function updateMinimap() {
+        if (!svgNaturalWidth || !svgNaturalHeight) return;
+
+        const viewportWidth = fsContent.clientWidth;
+        const viewportHeight = fsContent.clientHeight;
+
+        // Minimap container dimensions (inner area)
+        const mmWidth = 184;  // 200 - 16 padding
+        const mmHeight = 134; // 150 - 16 padding
+        const mmPadding = 8;
+
+        // SVG thumbnail size in minimap (scaled to fit)
+        const mmSvgWidth = svgNaturalWidth * minimapScale;
+        const mmSvgHeight = svgNaturalHeight * minimapScale;
+        // SVG thumbnail position (centered in minimap)
+        const mmSvgLeft = (mmWidth - mmSvgWidth) / 2 + mmPadding;
+        const mmSvgTop = (mmHeight - mmSvgHeight) / 2 + mmPadding;
+
+        // Calculate which part of the SVG is visible in the viewport
+        // transform: translate(panX, panY) scale(currentZoom)
+        // The viewport shows SVG region starting at (-panX/zoom, -panY/zoom)
+        const svgVisibleLeft = -panX / currentZoom;
+        const svgVisibleTop = -panY / currentZoom;
+        const svgVisibleWidth = viewportWidth / currentZoom;
+        const svgVisibleHeight = viewportHeight / currentZoom;
+
+        // Convert to minimap coordinates
+        let vpLeft = mmSvgLeft + svgVisibleLeft * minimapScale;
+        let vpTop = mmSvgTop + svgVisibleTop * minimapScale;
+        let vpWidth = svgVisibleWidth * minimapScale;
+        let vpHeight = svgVisibleHeight * minimapScale;
+
+        // Clamp to minimap bounds (the viewport rect should stay within minimap)
+        const mmLeft = mmPadding;
+        const mmTop = mmPadding;
+        const mmRight = mmWidth + mmPadding;
+        const mmBottom = mmHeight + mmPadding;
+
+        // Adjust if viewport extends beyond minimap bounds
+        if (vpLeft < mmLeft) {
+          vpWidth -= (mmLeft - vpLeft);
+          vpLeft = mmLeft;
+        }
+        if (vpTop < mmTop) {
+          vpHeight -= (mmTop - vpTop);
+          vpTop = mmTop;
+        }
+        if (vpLeft + vpWidth > mmRight) {
+          vpWidth = mmRight - vpLeft;
+        }
+        if (vpTop + vpHeight > mmBottom) {
+          vpHeight = mmBottom - vpTop;
+        }
+
+        // Ensure minimum size and positive dimensions
+        vpWidth = Math.max(20, vpWidth);
+        vpHeight = Math.max(15, vpHeight);
+
+        minimapViewport.style.left = vpLeft + 'px';
+        minimapViewport.style.top = vpTop + 'px';
+        minimapViewport.style.width = vpWidth + 'px';
+        minimapViewport.style.height = vpHeight + 'px';
       }
 
       // Use multiplicative zoom for consistent behavior
@@ -3916,13 +4209,11 @@ function htmlTemplate(dataRows, cols, title, mode, previewHtml) {
             }
           }
 
-          // Check for markdown list items: strip list markers and formatting
-          if (lineText.match(/^[-*+]\\s|^\\d+\\.\\s/)) {
-            const strippedLine = stripMarkdown(lineText).replace(/\\s+/g, ' ').slice(0, 100);
-            if (strippedLine === normalized) return i + 1;
-            if (strippedLine.includes(normalized.slice(0, 30)) && normalized.length > 5) return i + 1;
-            if (normalized.includes(strippedLine.slice(0, 30)) && strippedLine.length > 5) return i + 1;
-          }
+          // Try stripping all markdown formatting (links, bold, italic, etc.)
+          const strippedLine = stripMarkdown(lineText).replace(/\\s+/g, ' ').slice(0, 100);
+          if (strippedLine === normalized) return i + 1;
+          if (strippedLine.includes(normalized.slice(0, 30)) && normalized.length > 5) return i + 1;
+          if (normalized.includes(strippedLine.slice(0, 30)) && strippedLine.length > 5) return i + 1;
         }
         return -1;
       }
@@ -4069,8 +4360,24 @@ function htmlTemplate(dataRows, cols, title, mode, previewHtml) {
           return;
         }
 
-        // Ignore clicks on links, mermaid, video overlay
-        if (e.target.closest('a, .mermaid-container, .video-fullscreen-overlay')) return;
+        // Handle links - sync to source but let link work normally
+        const link = e.target.closest('a');
+        if (link) {
+          // Find the parent block element containing this link
+          const parentBlock = link.closest('p, h1, h2, h3, h4, h5, h6, li, blockquote, td, th');
+          if (parentBlock) {
+            const isTableCell = parentBlock.tagName === 'TD' || parentBlock.tagName === 'TH';
+            const line = isTableCell ? findTableSourceLine(parentBlock.textContent) : findSourceLine(parentBlock.textContent);
+            if (line > 0) {
+              selectSourceRange(line);
+            }
+          }
+          // Let the link open naturally (target="_blank" is set by marked)
+          return;
+        }
+
+        // Ignore clicks on mermaid, video overlay
+        if (e.target.closest('.mermaid-container, .video-fullscreen-overlay')) return;
 
         // Handle code blocks - select entire block
         const pre = e.target.closest('pre');
@@ -4591,7 +4898,18 @@ function createDiffServer(diffContent) {
   });
 }
 
-// Main entry point
+// Main entry point - only run when executed directly (not when required for testing)
+if (require.main === module) {
+  // Parse CLI arguments and apply configuration
+  const { config, filePaths } = parseCliArgs(process.argv);
+  basePort = config.basePort;
+  encodingOpt = config.encodingOpt;
+  noOpen = config.noOpen;
+  nextPort = config.basePort;  // Update nextPort to match configured basePort
+
+  // Validate and resolve file paths
+  resolvedPaths = validateAndResolvePaths(filePaths);
+
 (async () => {
   // Check for stdin input first
   const stdinData = await checkStdin();
@@ -4660,3 +4978,9 @@ function createDiffServer(diffContent) {
     }
   }
 })();
+}
+
+// Export parser functions for testing
+if (typeof module !== "undefined" && module.exports) {
+  module.exports = { parseDiff, parseCsv, DEFAULT_CONFIG };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "reviw",
-  "version": "0.10.5",
+  "version": "0.10.7",
   "description": "Lightweight file reviewer with in-browser comments for CSV, TSV, Markdown, and Git diffs.",
   "type": "module",
   "bin": {