rimecms 0.25.5 → 0.25.6

package/dist/util/string.js

@@ -174,6 +174,7 @@ export const sanitize = (value) => {
         return value || '';
     if (!parser)
         parser = Parser();
+    const WHITESPACE_MARKER = '\uE000';
     const decode = (value) => value
         .replace(/&/g, '&')
         .replace(/"/g, '"')
@@ -182,12 +183,20 @@ export const sanitize = (value) => {
         .replace(/'/g, "'")
         .replace(/'/g, "'")
         .replace(/&/g, '&');
+    const encodeTextSpace = (html) => html
+        .split(/(<[^>]*>)/g)
+        .map((segment) => segment.startsWith('<') && segment.endsWith('>')
+        ? segment
+        : segment.replace(/ /g, WHITESPACE_MARKER))
+        .join('');
+    const restoreWhitespace = (str) => str.replace(new RegExp(WHITESPACE_MARKER, 'g'), ' ');
     // Decode multiple levels of encoding on input
     let decodedValue = value;
     while (decodedValue.match(/&amp;|&quot;|&lt;|&gt;|&#x27;|&#39;|&#38;/)) {
         decodedValue = decode(decodedValue);
     }
-    const { root } = parser.parseFromString(decodedValue);
+    const protectedInput = encodeTextSpace(decodedValue);
+    const { root } = parser.parseFromString(protectedInput);
     const allowedTags = new Set(['strong', 'b', 'em', 'i', 'u', 'br', 'a']);
     const dangerousTags = new Set(['script', 'style', 'iframe', 'object', 'embed', 'svg']);
     const eventHandlers = /^on[a-z]+$/i;
@@ -197,7 +206,7 @@ export const sanitize = (value) => {
             return '';
         // Handle text nodes
         if (node.nodeName === '#text') {
-            return node.nodeValue || '';
+            return (node.nodeValue || '').replace(new RegExp(WHITESPACE_MARKER, 'g'), ' ');
         }
         // Handle comment nodes - remove them
         if (node.nodeName === '#comment') {
@@ -260,5 +269,5 @@ export const sanitize = (value) => {
         return '';
     };
     const sanitized = root.children ? root.children.map(processNode).join('') : '';
-    return decode(sanitized);
+    return decode(restoreWhitespace(sanitized));
 };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "rimecms",
-	"version": "0.25.5",
+	"version": "0.25.6",
 	"homepage": "https://github.com/bienbiendev/rime",
 	"scripts": {
 		"dev": "vite dev",