securemark 0.254.2 → 0.255.0

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.255.0
+
+- Change html parser not to use backtracking.
+
 ## 0.254.2
 
 - Refactoring.

package/dist/index.js

@@ -1,4 +1,4 @@
-/*! securemark v0.254.2 https://github.com/falsandtru/securemark | (c) 2017, falsandtru | UNLICENSED License */
+/*! securemark v0.255.0 https://github.com/falsandtru/securemark | (c) 2017, falsandtru | UNLICENSED License */
 (function webpackUniversalModuleDefinition(root, factory) {
 	if(typeof exports === 'object' && typeof module === 'object')
 		module.exports = factory(require("DOMPurify"), require("Prism"));
@@ -6219,14 +6219,17 @@ const attrspecs = {
 global_1.Object.setPrototypeOf(attrspecs, null);
 global_1.Object.values(attrspecs).forEach(o => global_1.Object.setPrototypeOf(o, null));
 exports.html = (0, combinator_1.lazy)(() => (0, combinator_1.creator)((0, combinator_1.validate)('<', (0, combinator_1.validate)(/^<[a-z]+(?=[^\S\n]|>)/, (0, combinator_1.union)([(0, combinator_1.focus)('<wbr>', () => [[(0, dom_1.html)('wbr')], '']), (0, combinator_1.focus)( // https://html.spec.whatwg.org/multipage/syntax.html#void-elements
-/^<(?:area|base|br|col|embed|hr|img|input|link|meta|source|track|wbr)(?=[^\S\n]|>)/, source => [[source], '']), (0, combinator_1.match)(new RegExp(String.raw`^<(${TAGS.join('|')})(?=[^\S\n]|>)`), (0, memoize_1.memoize)(([, tag]) => (0, combinator_1.surround)((0, combinator_1.surround)((0, source_1.str)(`<${tag}`), (0, combinator_1.some)(exports.attribute), (0, source_1.str)(/^[^\S\n]*>/), true), (0, util_1.startLoose)((0, combinator_1.some)((0, combinator_1.union)([(0, combinator_1.open)(/^\n?/, (0, combinator_1.some)(inline_1.inline, (0, util_1.blankWith)('\n', `</${tag}>`)), true)])), `</${tag}>`), (0, source_1.str)(`</${tag}>`), false, ([as, bs, cs], rest) => [[elem(tag, as, bs, cs)], rest]), ([, tag]) => TAGS.indexOf(tag), [])), (0, combinator_1.match)(new RegExp(String.raw`^<(?!${TAGS.join('|')}\b)([a-z]+)(?=[^\S\n]|>)`), (0, memoize_1.memoize)(([, tag]) => (0, combinator_1.surround)((0, combinator_1.surround)((0, source_1.str)(`<${tag}`), (0, combinator_1.some)(exports.attribute), (0, source_1.str)(/^[^\S\n]*>/), true), (0, util_1.startLoose)((0, combinator_1.some)((0, combinator_1.union)([(0, combinator_1.open)(/^\n?/, (0, combinator_1.some)(inline_1.inline, (0, util_1.blankWith)('\n', `</${tag}>`)), true)])), `</${tag}>`), (0, source_1.str)(`</${tag}>`), false, ([as, bs, cs], rest) => [[elem(tag, as, bs, cs)], rest]), ([, tag]) => tag, new cache_1.Cache(10000)))])))));
+/^<(?:area|base|br|col|embed|hr|img|input|link|meta|source|track|wbr)(?=[^\S\n]|>)/, source => [[source], '']), (0, combinator_1.match)(new RegExp(String.raw`^<(${TAGS.join('|')})(?=[^\S\n]|>)`), (0, memoize_1.memoize)(([, tag]) => (0, combinator_1.surround)((0, combinator_1.surround)((0, source_1.str)(`<${tag}`), (0, combinator_1.some)(exports.attribute), (0, source_1.str)(/^[^\S\n]*>/), true), (0, combinator_1.subsequence)([(0, combinator_1.focus)(/^[^\S\n]*\n/, (0, combinator_1.some)(inline_1.inline)), (0, combinator_1.some)((0, combinator_1.open)(/^\n?/, (0, combinator_1.some)(inline_1.inline, (0, util_1.blankWith)('\n', `</${tag}>`)), true))]), (0, source_1.str)(`</${tag}>`), true, ([as, bs = [], cs], rest) => [[elem(tag, as, bs, cs)], rest], ([as, bs = []], rest) => [[elem(tag, as, bs, [])], rest]), ([, tag]) => TAGS.indexOf(tag), [])), (0, combinator_1.match)(/^<([a-z]+)(?=[^\S\n]|>)/, (0, memoize_1.memoize)(([, tag]) => (0, combinator_1.surround)((0, combinator_1.surround)((0, source_1.str)(`<${tag}`), (0, combinator_1.some)(exports.attribute), (0, source_1.str)(/^[^\S\n]*>/), true), (0, combinator_1.subsequence)([(0, combinator_1.focus)(/^[^\S\n]*\n/, (0, combinator_1.some)(inline_1.inline)), (0, combinator_1.some)(inline_1.inline, `</${tag}>`)]), (0, source_1.str)(`</${tag}>`), true, ([as, bs = [], cs], rest) => [[elem(tag, as, bs, cs)], rest], ([as, bs = []], rest) => [[elem(tag, as, bs, [])], rest]), ([, tag]) => tag, new cache_1.Cache(10000)))])))));
 exports.attribute = (0, combinator_1.union)([(0, source_1.str)(/^[^\S\n]+[a-z]+(?:-[a-z]+)*(?:="(?:\\[^\n]|[^\\\n"])*")?(?=[^\S\n]|>)/)]); // https://developer.mozilla.org/en-US/docs/Web/HTML/Element
 // [...document.querySelectorAll('tbody > tr > td:first-child')].map(el => el.textContent.slice(1, -1))
 
 const TAGS = global_1.Object.freeze(["html", "base", "head", "link", "meta", "style", "title", "body", "address", "article", "aside", "footer", "header", "h1", "h2", "h3", "h4", "h5", "h6", "main", "nav", "section", "blockquote", "dd", "div", "dl", "dt", "figcaption", "figure", "hr", "li", "menu", "ol", "p", "pre", "ul", "a", "abbr", "b", "bdi", "bdo", "br", "cite", "code", "data", "dfn", "em", "i", "kbd", "mark", "q", "rp", "rt", "ruby", "s", "samp", "small", "span", "strong", "sub", "sup", "time", "u", "var", "wbr", "area", "audio", "img", "map", "track", "video", "embed", "iframe", "object", "picture", "portal", "source", "svg", "math", "canvas", "noscript", "script", "del", "ins", "caption", "col", "colgroup", "table", "tbody", "td", "tfoot", "th", "thead", "tr", "button", "datalist", "fieldset", "form", "input", "label", "legend", "meter", "optgroup", "option", "output", "progress", "select", "textarea", "details", "dialog", "summary", "slot", "template", "acronym", "applet", "basefont", "bgsound", "big", "blink", "center", "content", "dir", "font", "frame", "frameset", "hgroup", "image", "keygen", "marquee", "menuitem", "nobr", "noembed", "noframes", "param", "plaintext", "rb", "rtc", "shadow", "spacer", "strike", "tt", "xmp"]);
 
 function elem(tag, as, bs, cs) {
-  if (!tags.includes(tag)) return invalid('tag', `Invalid HTML tag <${tag}>`, as, bs, cs);
+  if (!tags.includes(tag)) return invalid('tag', `Invalid HTML tag name "${tag}"`, as, bs, cs);
+  if (cs.length === 0) return invalid('tag', `Missing the closing HTML tag "</${tag}>"`, as, bs, cs);
+  if (bs.length === 0) return invalid('content', `Missing the content`, as, bs, cs);
+  if (!(0, util_1.isStartLooseNodes)(bs)) return invalid('content', `Missing the visible content in the same line`, as, bs, cs);
   const attrs = attributes('html', [], attrspecs[tag], as.slice(1, -1));
   return 'data-invalid-syntax' in attrs ? invalid('attribute', 'Invalid HTML attribute', as, bs, cs) : (0, dom_1.html)(tag, attrs, (0, dom_1.defrag)(bs));
 }
@@ -7773,7 +7776,7 @@ exports.unescsource = (0, combinator_1.creator)(source => {
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.stringify = exports.trimBlankEnd = exports.trimBlankStart = exports.trimBlank = exports.isStartTightNodes = exports.startTight = exports.startLoose = exports.visualize = exports.blankWith = exports.regBlankStart = void 0;
+exports.stringify = exports.trimBlankEnd = exports.trimBlankStart = exports.trimBlank = exports.isStartTightNodes = exports.isStartLooseNodes = exports.startTight = exports.startLoose = exports.visualize = exports.blankWith = exports.regBlankStart = void 0;
 
 const global_1 = __webpack_require__(4128);
 
@@ -7877,6 +7880,24 @@ const isStartTight = (0, memoize_1.reduce)((source, context, except) => {
   }
 }, (source, _, except = '') => `${source}\x1E${except}`);
 
+function isStartLooseNodes(nodes) {
+  if (nodes.length === 0) return true;
+
+  for (let i = 0; i < nodes.length; ++i) {
+    const node = nodes[i];
+    if (isVisible(node)) return true;
+
+    if (typeof node === 'object') {
+      if (node.tagName === 'BR') break;
+      if (node.className === 'linebreak') break;
+    }
+  }
+
+  return false;
+}
+
+exports.isStartLooseNodes = isStartLooseNodes;
+
 function isStartTightNodes(nodes) {
   if (nodes.length === 0) return true;
   return isVisible(nodes[0], 0);

package/markdown.d.ts

@@ -985,6 +985,7 @@ export namespace MarkdownParser {
         Inline<'html/tag'>,
         Parser<HTMLElement | string, Context, [
           InlineParser,
+          InlineParser,
         ]> {
       }
       export namespace TagParser {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securemark",
-  "version": "0.254.2",
+  "version": "0.255.0",
   "description": "Secure markdown renderer working on browsers for user input data.",
   "private": false,
   "homepage": "https://github.com/falsandtru/securemark",

package/src/parser/inline/html.test.ts

@@ -7,12 +7,12 @@ describe('Unit: parser/inline/html', () => {
     const parser = (source: string) => some(html)(source, {});
 
     it('xss', () => {
-      assert.deepStrictEqual(inspect(parser('<script>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<script>alert()<script>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<script>')), [['<span class="invalid">&lt;script&gt;</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('<script>alert()<script>')), [['<span class="invalid">&lt;script&gt;alert<span class="paren">()</span><span class="invalid">&lt;script&gt;</span></span>'], '']);
       assert.deepStrictEqual(inspect(parser('<script>alert()</script>')), [['<span class="invalid">&lt;script&gt;alert<span class="paren">()</span>&lt;/script&gt;</span>'], '']);
-      assert.deepStrictEqual(inspect(parser('<script src="\\""></script>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<bdi onclick="alert()">')), undefined);
-      assert.deepStrictEqual(inspect(parser('<bdi onclick="alert()"></bdi>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<script src="\\""></script>')), [['<span class="invalid">&lt;script src="\\""&gt;&lt;/script&gt;</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi onclick="alert()">')), [['<span class="invalid">&lt;bdi onclick="alert()"&gt;</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi onclick="alert()"></bdi>')), [['<span class="invalid">&lt;bdi onclick="alert()"&gt;&lt;/bdi&gt;</span>'], '']);
       assert.deepStrictEqual(inspect(parser('<bdi onclick="alert()">a</bdi>')), [['<span class="invalid">&lt;bdi onclick="alert()"&gt;a&lt;/bdi&gt;</span>'], '']);
       assert.deepStrictEqual(inspect(parser('<bdi><bdi onclick="alert()">a</bdi></bdi>')), [['<bdi><span class="invalid">&lt;bdi onclick="alert()"&gt;a&lt;/bdi&gt;</span></bdi>'], '']);
       assert.deepStrictEqual(inspect(parser('<bdo dir="rtl\\"><">a</bdo>')), [['<span class="invalid">&lt;bdo dir="rtl\\"&gt;&lt;"&gt;a&lt;/bdo&gt;</span>'], '']);
@@ -25,17 +25,19 @@ describe('Unit: parser/inline/html', () => {
       assert.deepStrictEqual(inspect(parser('<a,b>')), undefined);
       assert.deepStrictEqual(inspect(parser('<a, b>')), undefined);
       assert.deepStrictEqual(inspect(parser('<T>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<bdi>z')), undefined);
-      assert.deepStrictEqual(inspect(parser('<bdi></bdi>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<bdi> </bdi>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<bdi>\\ </bdi>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<bdi>&Tab;</bdi>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<bdi><wbr></bdi>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<bdi>\n</bdi>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<bdi>\na</bdi>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<bdi>\\\na</bdi>')), undefined);
-      assert.deepStrictEqual(inspect(parser('<bdi>a')), undefined);
-      assert.deepStrictEqual(inspect(parser('<bdi>a</BDO>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi>z')), [['<span class="invalid">&lt;bdi&gt;z</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi></bdi>')), [['<span class="invalid">&lt;bdi&gt;&lt;/bdi&gt;</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi> </bdi>')), [['<span class="invalid">&lt;bdi&gt; &lt;/bdi&gt;</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi> \n</bdi>')), [['<span class="invalid">&lt;bdi&gt;<br>&lt;/bdi&gt;</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi> \na</bdi>')), [['<span class="invalid">&lt;bdi&gt;<br>a&lt;/bdi&gt;</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi>\\ </bdi>')), [['<span class="invalid">&lt;bdi&gt; &lt;/bdi&gt;</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi>&Tab;</bdi>')), [['<span class="invalid">&lt;bdi&gt;\t&lt;/bdi&gt;</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi><wbr></bdi>')), [['<span class="invalid">&lt;bdi&gt;<wbr>&lt;/bdi&gt;</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi>\n</bdi>')), [['<span class="invalid">&lt;bdi&gt;<br>&lt;/bdi&gt;</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi>\na</bdi>')), [['<span class="invalid">&lt;bdi&gt;<br>a&lt;/bdi&gt;</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi>\\\na</bdi>')), [['<span class="invalid">&lt;bdi&gt;<span class="linebreak"> </span>a&lt;/bdi&gt;</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi>a')), [['<span class="invalid">&lt;bdi&gt;a</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi>a</BDO>')), [['<span class="invalid">&lt;bdi&gt;a&lt;/BDO&gt;</span>'], '']);
       assert.deepStrictEqual(inspect(parser('<BDI>a</BDI>')), undefined);
       assert.deepStrictEqual(inspect(parser('<BDI>a</bdo>')), undefined);
       assert.deepStrictEqual(inspect(parser('</bdi>')), undefined);
@@ -43,11 +45,11 @@ describe('Unit: parser/inline/html', () => {
       assert.deepStrictEqual(inspect(parser('<b><b><b>a</b></b></b>')), [['<span class="invalid">&lt;b&gt;<span class="invalid">&lt;b&gt;<span class="invalid">&lt;b&gt;a&lt;/b&gt;</span>&lt;/b&gt;</span>&lt;/b&gt;</span>'], '']);
       assert.deepStrictEqual(inspect(parser('<bdi><bdi><bdi>a</bdi></bdi></bdi>')), [['<bdi><bdi><bdi>a</bdi></bdi></bdi>'], '']);
       assert.deepStrictEqual(inspect(parser('<x a="*b*"')), undefined);
-      assert.deepStrictEqual(inspect(parser('<x a="*b*">')), undefined);
-      assert.deepStrictEqual(inspect(parser('<x a="*b*">c')), undefined);
+      assert.deepStrictEqual(inspect(parser('<x a="*b*">')), [['<span class="invalid">&lt;x a="*b*"&gt;</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('<x a="*b*">c')), [['<span class="invalid">&lt;x a="*b*"&gt;c</span>'], '']);
       assert.deepStrictEqual(inspect(parser('<bdi a="*b*"')), undefined);
-      assert.deepStrictEqual(inspect(parser('<bdi a="*b*">')), undefined);
-      assert.deepStrictEqual(inspect(parser('<bdi a="*b*">c')), undefined);
+      assert.deepStrictEqual(inspect(parser('<bdi a="*b*">')), [['<span class="invalid">&lt;bdi a="*b*"&gt;</span>'], '']);
+      assert.deepStrictEqual(inspect(parser('<bdi a="*b*">c')), [['<span class="invalid">&lt;bdi a="*b*"&gt;c</span>'], '']);
       assert.deepStrictEqual(inspect(parser('<bdi a b="*" *c*')), undefined);
       assert.deepStrictEqual(inspect(parser('<bdi a b="*" *c*>')), undefined);
       assert.deepStrictEqual(inspect(parser('<bdi a b="*" *c*>d</bdi>')), undefined);
@@ -80,7 +82,7 @@ describe('Unit: parser/inline/html', () => {
     });
 
     it('escape', () => {
-      assert.deepStrictEqual(inspect(parser('<a>')), undefined);
+      assert.deepStrictEqual(inspect(parser('<a>')), [['<span class="invalid">&lt;a&gt;</span>'], '']);
       assert.deepStrictEqual(inspect(parser('<bdi><a>a</a></bdi>')), [['<bdi><span class="invalid">&lt;a&gt;a&lt;/a&gt;</span></bdi>'], '']);
       assert.deepStrictEqual(inspect(parser('<bdi>a<a>b</a>c</bdi>')), [['<bdi>a<span class="invalid">&lt;a&gt;b&lt;/a&gt;</span>c</bdi>'], '']);
       assert.deepStrictEqual(inspect(parser('<img>')), [['<img'], '>']);

package/src/parser/inline/html.ts

@@ -1,9 +1,9 @@
 import { undefined, Object } from 'spica/global';
 import { HTMLParser } from '../inline';
-import { union, some, validate, focus, creator, surround, open, match, lazy } from '../../combinator';
+import { union, subsequence, some, validate, focus, creator, surround, open, match, lazy } from '../../combinator';
 import { inline } from '../inline';
 import { str } from '../source';
-import { startLoose, blankWith } from '../util';
+import { isStartLooseNodes, blankWith } from '../util';
 import { html as h, defrag } from 'typed-dom/dom';
 import { memoize } from 'spica/memoize';
 import { Cache } from 'spica/cache';
@@ -32,25 +32,31 @@ export const html: HTMLParser = lazy(() => creator(validate('<', validate(/^<[a-
     ([, tag]) =>
       surround<HTMLParser.TagParser, string>(surround(
         str(`<${tag}`), some(attribute), str(/^[^\S\n]*>/), true),
-        startLoose(some(union([
-          open(/^\n?/, some(inline, blankWith('\n', `</${tag}>`)), true),
-        ])), `</${tag}>`),
-        str(`</${tag}>`), false,
-        ([as, bs, cs], rest) =>
-          [[elem(tag, as, bs, cs)], rest]),
+        subsequence([
+          focus(/^[^\S\n]*\n/, some(inline)),
+          some(open(/^\n?/, some(inline, blankWith('\n', `</${tag}>`)), true)),
+        ]),
+        str(`</${tag}>`), true,
+        ([as, bs = [], cs], rest) =>
+          [[elem(tag, as, bs, cs)], rest],
+        ([as, bs = []], rest) =>
+          [[elem(tag, as, bs, [])], rest]),
     ([, tag]) => TAGS.indexOf(tag), [])),
   match(
-    new RegExp(String.raw`^<(?!${TAGS.join('|')}\b)([a-z]+)(?=[^\S\n]|>)`),
+    /^<([a-z]+)(?=[^\S\n]|>)/,
     memoize(
     ([, tag]) =>
       surround<HTMLParser.TagParser, string>(surround(
         str(`<${tag}`), some(attribute), str(/^[^\S\n]*>/), true),
-        startLoose(some(union([
-          open(/^\n?/, some(inline, blankWith('\n', `</${tag}>`)), true),
-        ])), `</${tag}>`),
-        str(`</${tag}>`), false,
-        ([as, bs, cs], rest) =>
-          [[elem(tag, as, bs, cs)], rest]),
+        subsequence([
+          focus(/^[^\S\n]*\n/, some(inline)),
+          some(inline, `</${tag}>`),
+        ]),
+        str(`</${tag}>`), true,
+        ([as, bs = [], cs], rest) =>
+          [[elem(tag, as, bs, cs)], rest],
+        ([as, bs = []], rest) =>
+          [[elem(tag, as, bs, [])], rest]),
     ([, tag]) => tag,
     new Cache(10000))),
 ])))));
@@ -204,8 +210,10 @@ const TAGS = Object.freeze([
 function elem(tag: string, as: string[], bs: (HTMLElement | string)[], cs: string[]): HTMLElement {
   assert(as.length > 0);
   assert(as[0][0] === '<' && as[as.length - 1].slice(-1) === '>');
-  assert(cs.length === 1);
-  if (!tags.includes(tag)) return invalid('tag', `Invalid HTML tag <${tag}>`, as, bs, cs);
+  if (!tags.includes(tag)) return invalid('tag', `Invalid HTML tag name "${tag}"`, as, bs, cs);
+  if (cs.length === 0) return invalid('tag', `Missing the closing HTML tag "</${tag}>"`, as, bs, cs);
+  if (bs.length === 0) return invalid('content', `Missing the content`, as, bs, cs);
+  if (!isStartLooseNodes(bs)) return invalid('content', `Missing the visible content in the same line`, as, bs, cs);
   const attrs = attributes('html', [], attrspecs[tag], as.slice(1, -1));
   return 'data-invalid-syntax' in attrs
     ? invalid('attribute', 'Invalid HTML attribute', as, bs, cs)

package/src/parser/util.ts

@@ -101,6 +101,19 @@ const isStartTight = reduce((source: string, context: MarkdownParser.Context, ex
       return source[0].trimStart() !== '';
   }
 }, (source, _, except = '') => `${source}\x1E${except}`);
+
+export function isStartLooseNodes(nodes: readonly (HTMLElement | string)[]): boolean {
+  if (nodes.length === 0) return true;
+  for (let i = 0; i < nodes.length; ++i) {
+    const node = nodes[i];
+    if (isVisible(node)) return true;
+    if (typeof node === 'object') {
+      if (node.tagName === 'BR') break;
+      if (node.className === 'linebreak') break;
+    }
+  }
+  return false;
+}
 export function isStartTightNodes(nodes: readonly (HTMLElement | string)[]): boolean {
   if (nodes.length === 0) return true;
   return isVisible(nodes[0], 0);