sourcey 3.6.0 → 3.6.1

package/dist/utils/code-samples.js

@@ -4,11 +4,11 @@ import { generateExample } from "./example-generator.js";
 // ---------------------------------------------------------------------------
 const generators = {
     curl({ url, method, contentType, body }) {
-        const parts = [`curl -X ${method} '${url}'`];
+        const parts = [`curl -X ${method} ${shellSingleQuoted(url)}`];
         if (contentType)
-            parts.push(`  -H 'Content-Type: ${contentType}'`);
+            parts.push(`  -H ${shellSingleQuoted(`Content-Type: ${contentType}`)}`);
         if (body)
-            parts.push(`  -d '${indent(body, 2)}'`);
+            parts.push(`  -d ${shellSingleQuoted(indent(body, 2))}`);
         return { lang: "bash", label: "cURL", source: parts.join(" \\\n") };
     },
     javascript({ url, method, contentType, body }) {
@@ -51,7 +51,7 @@ const generators = {
         return { lang: "python", label: "Python", source: lines.join("\n") };
     },
     go({ url, method, body }) {
-        const lines = ["package main", "", "import (", `  "fmt"`, `  "io"`, `  "net/http"`,];
+        const lines = ["package main", "", "import (", `  "fmt"`, `  "io"`, `  "net/http"`];
         if (body)
             lines.push(`  "strings"`);
         lines.push(")", "");
@@ -63,7 +63,8 @@ const generators = {
         else {
             lines.push(`  req, _ := http.NewRequest("${method}", "${url}", nil)`);
         }
-        lines.push(`  req.Header.Set("Content-Type", "application/json")`);
+        if (body)
+            lines.push(`  req.Header.Set("Content-Type", "application/json")`);
         lines.push(`  resp, _ := http.DefaultClient.Do(req)`);
         lines.push(`  defer resp.Body.Close()`);
         lines.push(`  data, _ := io.ReadAll(resp.Body)`);
@@ -76,21 +77,23 @@ const generators = {
             `require 'net/http'`,
             `require 'json'`,
             ``,
-            `uri = URI('${url}')`,
+            `uri = URI('${rubySingleQuoted(url)}')`,
         ];
         const methodClass = rubyShortcutMethod(method);
         if (methodClass) {
             lines.push(`request = Net::HTTP::${methodClass}.new(uri)`);
             if (contentType)
-                lines.push(`request['Content-Type'] = '${contentType}'`);
+                lines.push(`request['Content-Type'] = '${rubySingleQuoted(contentType)}'`);
             if (body)
-                lines.push(`request.body = '${indent(body, 2)}'`);
+                lines.push(`request.body = '${rubySingleQuoted(indent(body, 2))}'`);
         }
         else {
-            const headers = contentType ? `{ 'Content-Type' => '${contentType}' }` : "{}";
+            const headers = contentType
+                ? `{ 'Content-Type' => '${rubySingleQuoted(contentType)}' }`
+                : "{}";
             lines.push(`request = Net::HTTPGenericRequest.new('${method}', ${body ? "true" : "false"}, true, uri.request_uri, ${headers})`);
             if (body)
-                lines.push(`request.body = '${indent(body, 2)}'`);
+                lines.push(`request.body = '${rubySingleQuoted(indent(body, 2))}'`);
         }
         lines.push(``, `response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(request) }`);
         lines.push(`data = JSON.parse(response.body)`);
@@ -121,16 +124,16 @@ const generators = {
         return { lang: "java", label: "Java", source: lines.join("\n") };
     },
     php({ url, method, contentType, body }) {
-        const lines = [`<?php`, `$ch = curl_init('${url}');`];
+        const lines = [`<?php`, `$ch = curl_init('${phpSingleQuoted(url)}');`];
         lines.push(`curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);`);
         if (method !== "GET") {
-            lines.push(`curl_setopt($ch, CURLOPT_CUSTOMREQUEST, '${method}');`);
+            lines.push(`curl_setopt($ch, CURLOPT_CUSTOMREQUEST, '${phpSingleQuoted(method)}');`);
         }
         if (contentType) {
-            lines.push(`curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: ${contentType}']);`);
+            lines.push(`curl_setopt($ch, CURLOPT_HTTPHEADER, ['${phpSingleQuoted(`Content-Type: ${contentType}`)}']);`);
         }
         if (body) {
-            lines.push(`curl_setopt($ch, CURLOPT_POSTFIELDS, '${indent(body, 2)}');`);
+            lines.push(`curl_setopt($ch, CURLOPT_POSTFIELDS, '${phpSingleQuoted(indent(body, 2))}');`);
         }
         lines.push(``, `$response = curl_exec($ch);`, `curl_close($ch);`);
         lines.push(`$data = json_decode($response, true);`);
@@ -165,10 +168,7 @@ const generators = {
         return { lang: "rust", label: "Rust", source: lines.join("\n") };
     },
     csharp({ url, method, body }) {
-        const lines = [
-            `using var client = new HttpClient();`,
-            ``,
-        ];
+        const lines = [`using var client = new HttpClient();`, ``];
         const httpMethod = csharpShortcutMethod(method)
             ? `HttpMethod.${method[0] + method.slice(1).toLowerCase()}`
             : `new HttpMethod("${method}")`;
@@ -185,6 +185,7 @@ const generators = {
 };
 /** Default languages when none configured. */
 export const DEFAULT_CODE_SAMPLE_LANGS = ["curl", "javascript", "python"];
+export const SUPPORTED_CODE_SAMPLE_LANGS = Object.freeze(Object.keys(generators));
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
@@ -203,14 +204,12 @@ export function generateCodeSamples(op, serverUrl, langs = DEFAULT_CODE_SAMPLE_L
     const method = op.method.toUpperCase();
     const hasBody = !!op.requestBody;
     const contentType = hasBody
-        ? Object.keys(op.requestBody.content)[0] ?? "application/json"
+        ? (Object.keys(op.requestBody.content)[0] ?? "application/json")
         : undefined;
     const bodyExample = hasBody ? getRequestBodyExample(op) : undefined;
     const body = bodyExample ? JSON.stringify(bodyExample, null, 2) : undefined;
     const req = { url, method, contentType, body };
-    return langs
-        .map((lang) => generators[lang]?.(req))
-        .filter((s) => !!s);
+    return langs.map((lang) => generators[lang]?.(req)).filter((s) => !!s);
 }
 // ---------------------------------------------------------------------------
 // Helpers
@@ -259,6 +258,15 @@ function rustShortcutMethod(method) {
 function csharpShortcutMethod(method) {
     return ["GET", "POST", "PUT", "DELETE", "PATCH"].includes(method);
 }
+function shellSingleQuoted(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function rubySingleQuoted(value) {
+    return value.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+}
+function phpSingleQuoted(value) {
+    return value.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+}
 /** Indent all lines of a multi-line string except the first. */
 function indent(str, spaces) {
     const pad = " ".repeat(spaces);

package/dist/utils/html.d.ts

@@ -0,0 +1,10 @@
+export interface SafeUrlOptions {
+    allowedProtocols?: readonly string[];
+    allowRelative?: boolean;
+    allowAnchor?: boolean;
+}
+export declare function escapeHtml(value: string): string;
+export declare function escapeAttr(value: string): string;
+export declare function safeUrl(input: string, options?: SafeUrlOptions): string | null;
+export declare function sanitizeRenderedHtml(input: string): string;
+//# sourceMappingURL=html.d.ts.map

package/dist/utils/html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../src/utils/html.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,cAAc;IAC7B,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOhD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,MAAM,GAAG,IAAI,CAkBlF;AAUD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA2G1D"}

package/dist/utils/html.js

@@ -0,0 +1,152 @@
+import sanitizeHtml from "sanitize-html";
+const BASE_URL = "https://sourcey.invalid/";
+const EXPLICIT_SCHEME_RE = /^[a-z][a-z\d+.-]*:/i;
+export function escapeHtml(value) {
+    return value
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+export function escapeAttr(value) {
+    return escapeHtml(value);
+}
+export function safeUrl(input, options = {}) {
+    const allowedProtocols = options.allowedProtocols ?? ["http:", "https:", "mailto:"];
+    const allowRelative = options.allowRelative ?? true;
+    const allowAnchor = options.allowAnchor ?? true;
+    const value = input.trim();
+    if (!value || hasRawControlOrSpace(value))
+        return null;
+    if (value.startsWith("#"))
+        return allowAnchor ? value : null;
+    if (value.startsWith("//"))
+        return null;
+    try {
+        const parsed = new URL(value, BASE_URL);
+        const hasExplicitScheme = EXPLICIT_SCHEME_RE.test(value);
+        if (!hasExplicitScheme)
+            return allowRelative ? value : null;
+        return allowedProtocols.includes(parsed.protocol) ? parsed.href : null;
+    }
+    catch {
+        return null;
+    }
+}
+function hasRawControlOrSpace(value) {
+    for (const char of value) {
+        const code = char.charCodeAt(0);
+        if (code <= 0x20 || code === 0x7f)
+            return true;
+    }
+    return false;
+}
+export function sanitizeRenderedHtml(input) {
+    return sanitizeHtml(input, {
+        allowedTags: [
+            ...sanitizeHtml.defaults.allowedTags,
+            "button",
+            "details",
+            "iframe",
+            "img",
+            "path",
+            "source",
+            "summary",
+            "svg",
+            "video",
+        ],
+        allowedAttributes: {
+            "*": [
+                "class",
+                "id",
+                "role",
+                "tabindex",
+                "title",
+                "aria-expanded",
+                "aria-hidden",
+                "aria-label",
+                "aria-selected",
+                "data-clipboard-target",
+                "data-cols",
+                "data-copy-source",
+                "data-display",
+                "data-tab-group",
+                "data-tab-index",
+                "data-target",
+                "data-traverse-target",
+            ],
+            a: ["href", "name", "target", "rel", "title", "class", "id"],
+            button: [
+                "type",
+                "class",
+                "aria-expanded",
+                "aria-label",
+                "aria-selected",
+                "data-copy-source",
+                "data-tab-group",
+                "data-tab-index",
+            ],
+            div: [
+                "class",
+                "id",
+                "role",
+                "style",
+                "data-cols",
+                "data-tab-group",
+                "data-tab-index",
+                "data-traverse-target",
+            ],
+            details: ["class", "id", "open"],
+            h1: ["id", "class"],
+            h2: ["id", "class"],
+            h3: ["id", "class"],
+            h4: ["id", "class"],
+            h5: ["id", "class"],
+            h6: ["id", "class"],
+            iframe: ["src", "title", "frameborder", "allow", "allowfullscreen", "loading", "class", "id"],
+            img: ["src", "alt", "title", "width", "height", "loading", "class", "id"],
+            path: ["d", "fill", "stroke", "stroke-width", "stroke-linecap", "stroke-linejoin"],
+            pre: ["class", "tabindex", "style"],
+            source: ["src", "type"],
+            span: ["class", "style", "title"],
+            svg: [
+                "xmlns",
+                "width",
+                "height",
+                "viewBox",
+                "fill",
+                "stroke",
+                "stroke-width",
+                "stroke-linecap",
+                "stroke-linejoin",
+                "class",
+                "aria-hidden",
+                "focusable",
+            ],
+            table: ["class"],
+            td: ["class", "colspan", "rowspan"],
+            th: ["class", "colspan", "rowspan", "scope"],
+            video: ["controls", "preload", "title", "class", "id"],
+        },
+        allowedSchemes: ["http", "https", "mailto"],
+        allowedSchemesByTag: {
+            iframe: ["http", "https"],
+            img: ["http", "https"],
+            source: ["http", "https"],
+        },
+        allowProtocolRelative: false,
+        allowedStyles: {
+            "*": {
+                background: [/^transparent$/, /^#[0-9a-fA-F]{3,8}$/],
+                "background-color": [/^#[0-9a-fA-F]{3,8}$/],
+                color: [/^#[0-9a-fA-F]{3,8}$/],
+                height: [/^\d{1,4}px$/],
+                "--shiki-dark": [/^#[0-9a-fA-F]{3,8}$/],
+                "--shiki-dark-bg": [/^#[0-9a-fA-F]{3,8}$/],
+                "--shiki-light": [/^#[0-9a-fA-F]{3,8}$/],
+                "--shiki-light-bg": [/^#[0-9a-fA-F]{3,8}$/],
+            },
+        },
+    });
+}

package/dist/utils/http.d.ts

@@ -9,6 +9,4 @@ export declare function schemaRange(schema: {
     exclusiveMinimum?: number | boolean;
     exclusiveMaximum?: number | boolean;
 }): string | undefined;
-/** HTTP method color classes for badges */
-export declare function methodColor(method: string): string;
 //# sourceMappingURL=http.d.ts.map

package/dist/utils/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/utils/http.ts"],"names":[],"mappings":"AAiDA,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACpC,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACrC,GAAG,MAAM,GAAG,SAAS,CA0BrB;AAED,2CAA2C;AAC3C,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAmBlD"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/utils/http.ts"],"names":[],"mappings":"AAiDA,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACpC,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACrC,GAAG,MAAM,GAAG,SAAS,CA4BrB"}

package/dist/utils/http.js

@@ -54,43 +54,28 @@ export function httpStatusText(code) {
  * Fixes legacy bug where maximumExclusive was checked with minimumExclusive.
  */
 export function schemaRange(schema) {
-    const parts = [];
+    let min;
+    let max;
     if (schema.minimum !== undefined) {
-        const exclusive = schema.exclusiveMinimum === true ||
-            typeof schema.exclusiveMinimum === "number";
-        const min = typeof schema.exclusiveMinimum === "number"
-            ? schema.exclusiveMinimum
-            : schema.minimum;
-        parts.push(`${exclusive ? "(" : "["}${min}`);
+        const exclusive = schema.exclusiveMinimum === true || typeof schema.exclusiveMinimum === "number";
+        min = {
+            value: typeof schema.exclusiveMinimum === "number" ? schema.exclusiveMinimum : schema.minimum,
+            exclusive,
+        };
     }
     if (schema.maximum !== undefined) {
-        const exclusive = schema.exclusiveMaximum === true ||
-            typeof schema.exclusiveMaximum === "number";
-        const max = typeof schema.exclusiveMaximum === "number"
-            ? schema.exclusiveMaximum
-            : schema.maximum;
-        parts.push(`${max}${exclusive ? ")" : "]"}`);
+        const exclusive = schema.exclusiveMaximum === true || typeof schema.exclusiveMaximum === "number";
+        max = {
+            value: typeof schema.exclusiveMaximum === "number" ? schema.exclusiveMaximum : schema.maximum,
+            exclusive,
+        };
     }
-    return parts.length === 2 ? parts.join(", ") : undefined;
-}
-/** HTTP method color classes for badges */
-export function methodColor(method) {
-    switch (method.toLowerCase()) {
-        case "get":
-            return "bg-emerald-600";
-        case "post":
-            return "bg-blue-600";
-        case "put":
-            return "bg-amber-600";
-        case "delete":
-            return "bg-red-600";
-        case "patch":
-            return "bg-purple-600";
-        case "options":
-            return "bg-gray-500";
-        case "head":
-            return "bg-gray-600";
-        default:
-            return "bg-gray-500";
+    if (min && max) {
+        return `${min.exclusive ? "(" : "["}${min.value}, ${max.value}${max.exclusive ? ")" : "]"}`;
     }
+    if (min)
+        return `${min.exclusive ? ">" : ">="} ${min.value}`;
+    if (max)
+        return `${max.exclusive ? "<" : "<="} ${max.value}`;
+    return undefined;
 }

package/dist/utils/markdown.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../src/utils/markdown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,KAAK,EAAe,MAAM,QAAQ,CAAC;AAOzD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CASnE;AAED,4CAA4C;AAC5C,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AA2JD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,EAAE,CAGnD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,EAAE,CAe5D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAY5D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAGzD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAG3D"}
+{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../src/utils/markdown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,KAAK,EAAe,MAAM,QAAQ,CAAC;AAMzD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CASnE;AAED,4CAA4C;AAC5C,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAkLD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,EAAE,CAGnD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,EAAE,CAe5D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAY5D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CA2BzD;AAsBD;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAGrD;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAG3D"}

package/dist/utils/markdown.js

@@ -2,7 +2,7 @@ import { Marked } from "marked";
 import { highlightCode } from "./highlighter.js";
 import { COPY_ICON_SVG } from "./copy-svg.js";
 import { htmlId } from "./html-id.js";
-const MARKDOWN_LINK_RE = /\[((?:`[^`]*`|[^\]])+)\]\(([^)]+)\)/g;
+import { escapeAttr, safeUrl, sanitizeRenderedHtml } from "./html.js";
 /**
  * Shared code block renderer used by all markdown rendering.
  * Outputs the prose-code-block wrapper with copy button and Shiki highlighting.
@@ -24,33 +24,46 @@ function parseDirectiveAttrs(raw) {
         attrs[k] = v;
     return attrs;
 }
-function escAttr(s) {
-    return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;");
-}
-function requireHttps(url) {
-    try {
-        const u = new URL(url);
-        if (u.protocol !== "https:" && u.protocol !== "http:")
-            return null;
-        return u.href;
+function parseVideoUrl(url) {
+    const webUrl = safeUrl(url, {
+        allowedProtocols: ["http:", "https:"],
+        allowRelative: false,
+        allowAnchor: false,
+    });
+    if (webUrl) {
+        const parsed = new URL(webUrl);
+        const hostname = parsed.hostname.replace(/^www\./, "");
+        if (hostname === "youtube.com" || hostname === "m.youtube.com") {
+            const id = parsed.searchParams.get("v");
+            if (id && /^[\w-]+$/.test(id)) {
+                return { src: `https://www.youtube-nocookie.com/embed/${id}`, type: "iframe" };
+            }
+        }
+        if (hostname === "youtu.be") {
+            const id = parsed.pathname.split("/").filter(Boolean)[0];
+            if (id && /^[\w-]+$/.test(id)) {
+                return { src: `https://www.youtube-nocookie.com/embed/${id}`, type: "iframe" };
+            }
+        }
+        if (hostname === "vimeo.com" || hostname.endsWith(".vimeo.com")) {
+            const id = parsed.pathname
+                .split("/")
+                .filter(Boolean)
+                .find((segment) => /^\d+$/.test(segment));
+            if (id)
+                return { src: `https://player.vimeo.com/video/${id}`, type: "iframe" };
+        }
     }
-    catch {
+    const rawVideoUrl = safeUrl(url, {
+        allowedProtocols: ["http:", "https:"],
+        allowRelative: true,
+        allowAnchor: false,
+    });
+    if (!rawVideoUrl)
         return null;
-    }
-}
-function parseVideoUrl(url) {
-    // YouTube
-    let m = url.match(/(?:youtube\.com\/watch\?v=|youtu\.be\/)([\w-]+)/);
-    if (m)
-        return { src: `https://www.youtube-nocookie.com/embed/${m[1]}`, type: "iframe" };
-    // Vimeo
-    m = url.match(/vimeo\.com\/(\d+)/);
-    if (m)
-        return { src: `https://player.vimeo.com/video/${m[1]}`, type: "iframe" };
-    // Raw video
-    const ext = url.split(".").pop()?.toLowerCase();
+    const ext = rawVideoUrl.split(/[?#]/)[0]?.split(".").pop()?.toLowerCase();
     const mime = ext === "webm" ? "video/webm" : "video/mp4";
-    return { src: url, type: "video", mime };
+    return { src: rawVideoUrl, type: "video", mime };
 }
 const videoExtension = {
     extensions: [
@@ -70,15 +83,17 @@ const videoExtension = {
             renderer(token) {
                 const { url, title } = token;
                 const parsed = parseVideoUrl(url);
-                const safeTitle = escAttr(title);
+                if (!parsed)
+                    return `<p>[video: invalid URL]</p>\n`;
+                const safeTitle = escapeAttr(title);
                 if (parsed.type === "iframe") {
                     return `<div class="prose-video not-prose">
-<iframe src="${parsed.src}" title="${safeTitle}" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen loading="lazy"></iframe>
+<iframe src="${escapeAttr(parsed.src)}" title="${safeTitle}" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen loading="lazy"></iframe>
 </div>\n`;
                 }
                 return `<div class="prose-video not-prose">
 <video controls preload="metadata" title="${safeTitle}">
-<source src="${parsed.src}" type="${parsed.mime}" />
+<source src="${escapeAttr(parsed.src)}" type="${escapeAttr(parsed.mime ?? "video/mp4")}" />
 </video>
 </div>\n`;
             },
@@ -109,11 +124,15 @@ const iframeExtension = {
             },
             renderer(token) {
                 const { url, title, height } = token;
-                const safeUrl = requireHttps(url);
-                if (!safeUrl)
+                const iframeUrl = safeUrl(url, {
+                    allowedProtocols: ["http:", "https:"],
+                    allowRelative: false,
+                    allowAnchor: false,
+                });
+                if (!iframeUrl)
                     return `<p>[iframe: invalid URL]</p>\n`;
                 return `<div class="prose-iframe not-prose" style="height:${height}px">
-<iframe src="${escAttr(safeUrl)}" title="${escAttr(title)}" frameborder="0" loading="lazy" allowfullscreen></iframe>
+<iframe src="${escapeAttr(iframeUrl)}" title="${escapeAttr(title)}" frameborder="0" loading="lazy" allowfullscreen></iframe>
 </div>\n`;
             },
         },
@@ -141,10 +160,13 @@ const marked = new Marked(videoExtension, iframeExtension, {
         },
         link({ href, title, tokens }) {
             const text = this.parser.parseInline(tokens);
-            const titleAttr = title ? ` title="${title}"` : "";
-            const isExternal = href.startsWith("http://") || href.startsWith("https://");
+            const linkUrl = safeUrl(href);
+            if (!linkUrl)
+                return text;
+            const titleAttr = title ? ` title="${escapeAttr(title)}"` : "";
+            const isExternal = linkUrl.startsWith("http://") || linkUrl.startsWith("https://");
             const target = isExternal ? ' target="_blank" rel="noopener noreferrer"' : "";
-            return `<a href="${href}"${titleAttr}${target}>${text}</a>`;
+            return `<a href="${escapeAttr(linkUrl)}"${titleAttr}${target}>${text}</a>`;
         },
     },
 });
@@ -204,7 +226,50 @@ export function extractFirstParagraph(input) {
 export function stripMarkdownLinks(input) {
     if (!input)
         return "";
-    return input.replace(MARKDOWN_LINK_RE, "$1");
+    let output = "";
+    let index = 0;
+    while (index < input.length) {
+        const isImage = input[index] === "!" && input[index + 1] === "[";
+        const isLink = input[index] === "[";
+        const labelStart = isImage ? index + 2 : isLink ? index + 1 : -1;
+        if (labelStart !== -1) {
+            const labelEnd = findMarkdownLabelEnd(input, labelStart);
+            if (labelEnd !== -1 && input[labelEnd + 1] === "(") {
+                const hrefEnd = findMarkdownHrefEnd(input, labelEnd + 2);
+                if (hrefEnd !== -1) {
+                    output += input.slice(labelStart, labelEnd);
+                    index = hrefEnd + 1;
+                    continue;
+                }
+            }
+        }
+        output += input[index];
+        index += 1;
+    }
+    return output;
+}
+function findMarkdownLabelEnd(input, start) {
+    let inCode = false;
+    for (let i = start; i < input.length; i += 1) {
+        const char = input[i];
+        if (char === "`")
+            inCode = !inCode;
+        if (char === "\n")
+            return -1;
+        if (char === "]" && !inCode)
+            return i;
+    }
+    return -1;
+}
+function findMarkdownHrefEnd(input, start) {
+    for (let i = start; i < input.length; i += 1) {
+        const char = input[i];
+        if (char === "\n")
+            return -1;
+        if (char === ")")
+            return i;
+    }
+    return -1;
 }
 /**
  * Render Markdown to HTML.
@@ -212,7 +277,7 @@ export function stripMarkdownLinks(input) {
 export function renderMarkdown(input) {
     if (!input)
         return "";
-    return marked.parse(input, { async: false });
+    return sanitizeRenderedHtml(marked.parse(input, { async: false }));
 }
 /**
  * Render Markdown to inline HTML (strip wrapping <p> tags).
@@ -220,5 +285,5 @@ export function renderMarkdown(input) {
 export function renderMarkdownInline(input) {
     if (!input)
         return "";
-    return marked.parseInline(input, { async: false });
+    return sanitizeRenderedHtml(marked.parseInline(input, { async: false }));
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sourcey",
-  "version": "3.6.0",
-  "description": "Precision documentation from OpenAPI, MCP, Doxygen, godoc, and Markdown. Static HTML you own.",
+  "version": "3.6.1",
+  "description": "Precision documentation from OpenAPI, MCP, Doxygen, godoc, rustdoc, and Markdown. Static HTML you own.",
   "type": "module",
   "engines": {
     "node": ">=20"
@@ -20,7 +20,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "build": "tsc && cp -r src/themes dist/ && cp src/client/*.js dist/client/ && cp -r src/og/fonts dist/og/ && rm -rf dist/core/sourcey-godoc dist/core/godoc-introspect && mkdir -p dist/core/sourcey-godoc && cp -R go/sourcey-godoc/go.mod go/sourcey-godoc/doc.go go/sourcey-godoc/cmd dist/core/sourcey-godoc/",
+    "build": "tsc && cp -r src/themes dist/ && cp src/client/*.js dist/client/ && cp -r src/og/fonts dist/og/ && rm -rf dist/core/sourcey-godoc dist/core/godoc-introspect && mkdir -p dist/core/sourcey-godoc && cp -R go/sourcey-godoc/go.mod go/sourcey-godoc/doc.go go/sourcey-godoc/cmd dist/core/sourcey-godoc/ && rm -rf dist/core/sourcey-rustdoc && mkdir -p dist/core/sourcey-rustdoc && cp -R rust/sourcey-rustdoc/Cargo.toml rust/sourcey-rustdoc/Cargo.lock rust/sourcey-rustdoc/README.md rust/sourcey-rustdoc/src rust/sourcey-rustdoc/tests dist/core/sourcey-rustdoc/",
     "watch": "npm run build && tsc --watch --preserveWatchOutput",
     "test": "vitest run",
     "test:watch": "vitest",
@@ -37,7 +37,6 @@
   "dependencies": {
     "@apidevtools/json-schema-ref-parser": "^13.0.5",
     "@preact/preset-vite": "^2.10.4",
-    "@readme/openapi-parser": "^4.0.0",
     "@resvg/resvg-js": "^2.6.2",
     "@tailwindcss/typography": "^0.5.19",
     "@tailwindcss/vite": "^4.2.2",
@@ -50,6 +49,7 @@
     "moxygen": "^2.1.8",
     "preact": "^10.28.4",
     "preact-render-to-string": "^6.6.6",
+    "sanitize-html": "^2.17.4",
     "satori": "^0.26.0",
     "shiki": "^4.0.2",
     "swagger2openapi": "^7.0.8",
@@ -57,8 +57,10 @@
     "vite": "^8.0.9"
   },
   "devDependencies": {
+    "@eslint/js": "^9.39.4",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.19.15",
+    "@types/sanitize-html": "^2.16.1",
     "eslint": "^9.0.0",
     "eslint-config-prettier": "^10.0.0",
     "prettier": "^3.4.0",
@@ -78,9 +80,12 @@
     "developer-documentation",
     "doxygen",
     "godoc",
+    "rustdoc",
     "golang",
+    "rust",
     "go-docs",
     "go-documentation",
+    "rust-docs",
     "mcp",
     "llms-txt",
     "static-docs"