ssml-builder-js 2.11.0 → 2.12.0

package/dist/core.mjs

@@ -11,10 +11,11 @@ import {
   mapSsmlTextNodes,
   normalizeAzureLanguage,
   parseSsml,
+  splitSsmlDocument,
   validateAzureSsml,
   validateSsml,
   validateSsmlStructureIntegrity
-} from "./chunk-SNRI43QJ.mjs";
+} from "./chunk-4BVNAUVR.mjs";
 import "./chunk-6S5ODO6A.mjs";
 export {
   areAzureLanguagesEquivalent,
@@ -29,6 +30,7 @@ export {
   mapSsmlTextNodes,
   normalizeAzureLanguage,
   parseSsml,
+  splitSsmlDocument,
   validateAzureSsml,
   validateSsml,
   validateSsmlStructureIntegrity

package/dist/elements.js

@@ -1133,6 +1133,7 @@ function tokenizeElements(source) {
       attributes,
       childElementIndex,
       end,
+      depth: openElements.length + 1,
       name: tokenName,
       parentName: parent?.name,
       parentVoiceName,
@@ -1313,13 +1314,18 @@ function validateAudioSource(token, source, diagnostics, options, elementName2)
     addDiagnostic(diagnostics, source, token.start, `<${elementName2} src> must be an absolute HTTP(S) URL.`);
     return;
   }
+  if (parsed.username || parsed.password)
+    addDiagnostic(diagnostics, source, token.start, `<${elementName2} src> must not contain URL credentials.`);
   if (parsed.protocol !== "https:" && !(options.allowHttpAudio && parsed.protocol === "http:"))
     addDiagnostic(diagnostics, source, token.start, `<${elementName2} src> must use HTTPS.`);
   const isAllowedOrigin = options.allowedAudioOrigins?.some((allowedOrigin) => {
     try {
-      return new URL(allowedOrigin).origin === parsed.origin;
+      const configured = new URL(allowedOrigin);
+      if (configured.protocol !== "https:" && configured.protocol !== "http:" || configured.username || configured.password || configured.pathname !== "/" || configured.search || configured.hash)
+        return false;
+      return configured.origin === parsed.origin;
     } catch {
-      return allowedOrigin === parsed.origin;
+      return false;
     }
   }) ?? false;
   if (options.allowedAudioOrigins && !isAllowedOrigin)
@@ -1527,6 +1533,9 @@ function validateAzureSsml(ssml, options = {}) {
   const maxLength = options.maxLength ?? 1e4;
   if (ssml.length > maxLength)
     addDiagnostic(diagnostics, ssml, maxLength, `SSML exceeds the maximum length of ${maxLength} characters.`);
+  if (options.maxXmlDepth !== void 0 && (!Number.isInteger(options.maxXmlDepth) || options.maxXmlDepth <= 0)) {
+    addDiagnostic(diagnostics, ssml, 0, "maxXmlDepth must be a positive integer.");
+  }
   try {
     parseSsml(ssml);
   } catch (error) {
@@ -1536,6 +1545,18 @@ function validateAzureSsml(ssml, options = {}) {
     return diagnostics;
   }
   const tokens = tokenizeElements(ssml);
+  if (options.maxXmlDepth !== void 0) {
+    for (const token of tokens) {
+      if (token.depth > options.maxXmlDepth) {
+        addDiagnostic(
+          diagnostics,
+          ssml,
+          token.start,
+          `XML nesting depth ${token.depth} exceeds the configured maximum of ${options.maxXmlDepth}.`
+        );
+      }
+    }
+  }
   const speak = tokens.find((token) => token.name.toLowerCase() === "speak");
   const voices = tokens.filter((token) => token.name.toLowerCase() === "voice");
   const backgroundAudioTokens = tokens.filter((token) => token.name.toLowerCase() === "mstts:backgroundaudio");