markdown_convert 2.0.8__tar.gz → 2.0.10__tar.gz

{markdown_convert-2.0.8 → markdown_convert-2.0.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: markdown_convert
-Version: 2.0.8
+Version: 2.0.10
 Summary: Convert Markdown files to PDF from your command line.
 Project-URL: homepage, https://github.com/Julynx/markdown_convert
 Author-email: Julio Cabria <juliocabria@tutanota.com>
@@ -67,7 +67,7 @@ Unlike other similar tools, `markdown-convert`:
   | **LaTeX Math Equations**                              | `$E=mc^2$` is rendered as a math equation.                                                         |
   | **Mermaid, Vega-Lite and Schemdraw Diagrams**         | ` ```mermaid ...` is rendered as a diagram.                                                        |
   | **Syntax-Highlighted Code Blocks**                    | ` ```python ...` gets syntax highlighting.                                                         |
-  | **Admonitions**                                       | `!!! note ...` is styled as a note box.                                                                |
+  | **Admonitions**                                       | `!!! note ...` is styled as a note box.                                                            |
   | **Dynamic Table of Contents**                         | `[TOC]` inserts a Table of Contents.                                                               |
   | **Image Attributes**                                  | `![::shadow::](sky.png)` shows a shadow behind the image.                                          |
   | **Captions**                                          | `![sky](sky.png)_A beautiful sky_` shows a caption, centered below the image.                      |
@@ -112,11 +112,23 @@ Options:
         admonitions,anchors,task-lists,math,custom-spans,highlights,
         syntax-highlighting,table-of-contents,vega-lite,inline-math,
         block-math,schemdraw,mermaid,dynamic-tables,dynamic-queries
-  --security=default|strict
+  --security=basic|default|strict
       Specify the security level.
-      Strict mode disables inline HTML, internet access and JS,
-      but local files can still be referenced.
-      This improves security, but will break some extras.
+      Basic:
+        - Inline HTML:   No restrictions.
+        - JS:            Restricted to extras.
+        - Remote files:  Restricted to images and fonts via https.
+        - Local files:   No restrictions.
+      Default:
+        - Inline HTML:   Disabled.
+        - JS:            Restricted to extras.
+        - Remote files:  Restricted to images and fonts via https.
+        - Local files:   Restricted to files inside the base directory.
+      Strict:
+        - Inline HTML:   Disabled.
+        - JS:            Disabled (may break some extras).
+        - Remote files:  Disabled (internet access completely disabled).
+        - Local files:   Restricted to files inside the base directory.
 ```
 
 For example: `markdown-convert README.md --mode=live --css=style.css --out=output.pdf` will convert `README.md` to `output.pdf` using `style.css` and update the PDF live as you edit the Markdown file.

{markdown_convert-2.0.8 → markdown_convert-2.0.10}/README.md

@@ -38,7 +38,7 @@ Unlike other similar tools, `markdown-convert`:
   | **LaTeX Math Equations**                              | `$E=mc^2$` is rendered as a math equation.                                                         |
   | **Mermaid, Vega-Lite and Schemdraw Diagrams**         | ` ```mermaid ...` is rendered as a diagram.                                                        |
   | **Syntax-Highlighted Code Blocks**                    | ` ```python ...` gets syntax highlighting.                                                         |
-  | **Admonitions**                                       | `!!! note ...` is styled as a note box.                                                                |
+  | **Admonitions**                                       | `!!! note ...` is styled as a note box.                                                            |
   | **Dynamic Table of Contents**                         | `[TOC]` inserts a Table of Contents.                                                               |
   | **Image Attributes**                                  | `![::shadow::](sky.png)` shows a shadow behind the image.                                          |
   | **Captions**                                          | `![sky](sky.png)_A beautiful sky_` shows a caption, centered below the image.                      |
@@ -83,11 +83,23 @@ Options:
         admonitions,anchors,task-lists,math,custom-spans,highlights,
         syntax-highlighting,table-of-contents,vega-lite,inline-math,
         block-math,schemdraw,mermaid,dynamic-tables,dynamic-queries
-  --security=default|strict
+  --security=basic|default|strict
       Specify the security level.
-      Strict mode disables inline HTML, internet access and JS,
-      but local files can still be referenced.
-      This improves security, but will break some extras.
+      Basic:
+        - Inline HTML:   No restrictions.
+        - JS:            Restricted to extras.
+        - Remote files:  Restricted to images and fonts via https.
+        - Local files:   No restrictions.
+      Default:
+        - Inline HTML:   Disabled.
+        - JS:            Restricted to extras.
+        - Remote files:  Restricted to images and fonts via https.
+        - Local files:   Restricted to files inside the base directory.
+      Strict:
+        - Inline HTML:   Disabled.
+        - JS:            Disabled (may break some extras).
+        - Remote files:  Disabled (internet access completely disabled).
+        - Local files:   Restricted to files inside the base directory.
 ```
 
 For example: `markdown-convert README.md --mode=live --css=style.css --out=output.pdf` will convert `README.md` to `output.pdf` using `style.css` and update the PDF live as you edit the Markdown file.

{markdown_convert-2.0.8 → markdown_convert-2.0.10}/markdown_convert/modules/constants.py

@@ -42,7 +42,7 @@ OPTIONS = (
 
 OPTIONS_MODES = ("once", "live", "debug")
 
-OPTIONS_SECURITY = ("default", "strict")
+OPTIONS_SECURITY = ("basic", "default", "strict")
 
 EXTRAS = {
     "admonitions": {

{markdown_convert-2.0.8 → markdown_convert-2.0.10}/markdown_convert/modules/convert.py

@@ -6,8 +6,10 @@ Author: @julynx
 import os
 import secrets
 import time
+import urllib.request
 from datetime import datetime
 from pathlib import Path
+from urllib.parse import urlparse
 
 from markdown_it import MarkdownIt
 from playwright.sync_api import sync_playwright
@@ -50,7 +52,21 @@ def convert(
         dump_html (bool=False): Dump the intermediate HTML to a file.
         extras (list=None): List of extras to use.
         security_level (str=None): Security level to use.
-          "strict" disables JS, inline HTML and internet access.
+            Basic:
+                - Inline HTML:   No restrictions.
+                - JS:            Restricted to extras.
+                - Remote files:  Restricted to images and fonts via https.
+                - Local files:   No restrictions.
+            Default:
+                - Inline HTML:   Disabled.
+                - JS:            Restricted to extras.
+                - Remote files:  Restricted to images and fonts via https.
+                - Local files:   Restricted to files inside the base directory.
+            Strict:
+                - Inline HTML:   Disabled.
+                - JS:            Disabled (may break some extras).
+                - Remote files:  Disabled (internet access completely disabled).
+                - Local files:   Restricted to files inside the base directory.
     """
     markdown_text = (
         Path(markdown_path).read_text(encoding="utf-8")
@@ -97,7 +113,21 @@ def live_convert(
         extend_default_css (bool=True): Extend the default CSS file.
         extras (list=None): List of extras to use.
         security_level (str=None): Security level to use.
-          "strict" disables JS, inline HTML and internet access.
+            Basic:
+                - Inline HTML:   No restrictions.
+                - JS:            Restricted to extras.
+                - Remote files:  Restricted to images and fonts via https.
+                - Local files:   No restrictions.
+            Default:
+                - Inline HTML:   Disabled.
+                - JS:            Restricted to extras.
+                - Remote files:  Restricted to images and fonts via https.
+                - Local files:   Restricted to files inside the base directory.
+            Strict:
+                - Inline HTML:   Disabled.
+                - JS:            Disabled (may break some extras).
+                - Remote files:  Disabled (internet access completely disabled).
+                - Local files:   Restricted to files inside the base directory.
     """
     if css_path is None:
         css_path = get_css_path()
@@ -140,7 +170,21 @@ def convert_text(
         dump_html (bool=False): Dump the intermediate HTML to a file.
         extras (list=None): List of extras to use.
         security_level (str=None): Security level to use.
-          "strict" disables JS, inline HTML and internet access.
+            Basic:
+                - Inline HTML:   No restrictions.
+                - JS:            Restricted to extras.
+                - Remote files:  Restricted to images and fonts via https.
+                - Local files:   No restrictions.
+            Default:
+                - Inline HTML:   Disabled.
+                - JS:            Restricted to extras.
+                - Remote files:  Restricted to images and fonts via https.
+                - Local files:   Restricted to files inside the base directory.
+            Strict:
+                - Inline HTML:   Disabled.
+                - JS:            Disabled (may break some extras).
+                - Remote files:  Disabled (internet access completely disabled).
+                - Local files:   Restricted to files inside the base directory.
 
     Returns:
         PDF file as bytes if output_path is None, else None.
@@ -165,7 +209,7 @@ def convert_text(
             "js-default",
             {
                 "breaks": True,
-                "html": security_level != "strict",
+                "html": security_level == "basic",
             },
         )
         for extra in extras["markdown_it_extras"]:
@@ -225,7 +269,21 @@ class LiveConverter:
             extend_default_css (bool): Extend the default CSS file.
             extras (list=None): List of extras to use.
             security_level (str=None): Security level to use.
-              "strict" disables JS, inline HTML and internet access.
+                Basic:
+                    - Inline HTML:   No restrictions.
+                    - JS:            Restricted to extras.
+                    - Remote files:  Restricted to images and fonts via https.
+                    - Local files:   No restrictions.
+                Default:
+                    - Inline HTML:   Disabled.
+                    - JS:            Restricted to extras.
+                    - Remote files:  Restricted to images and fonts via https.
+                    - Local files:   Restricted to files inside the base directory.
+                Strict:
+                    - Inline HTML:   Disabled.
+                    - JS:            Disabled (may break some extras).
+                    - Remote files:  Disabled (internet access completely disabled).
+                    - Local files:   Restricted to files inside the base directory.
         """
         self.md_path = Path(markdown_path).absolute()
         self.css_path = Path(css_path).absolute() if css_path else None
@@ -323,7 +381,21 @@ def _generate_pdf_with_playwright(
         dump_html (bool, optional): Whether to dump the HTML content to a file.
         nonce (str, optional): Nonce for Content Security Policy.
         security_level (str=None): Security level to use.
-          "strict" disables JS, inline HTML and internet access.
+            Basic:
+                - Inline HTML:   No restrictions.
+                - JS:            Restricted to extras.
+                - Remote files:  Restricted to images and fonts via https.
+                - Local files:   No restrictions.
+            Default:
+                - Inline HTML:   Disabled.
+                - JS:            Restricted to extras.
+                - Remote files:  Restricted to images and fonts via https.
+                - Local files:   Restricted to files inside the base directory.
+            Strict:
+                - Inline HTML:   Disabled.
+                - JS:            Disabled (may break some extras).
+                - Remote files:  Disabled (internet access completely disabled).
+                - Local files:   Restricted to files inside the base directory.
     """
     if nonce is None:
         raise ValueError("A nonce must be provided for CSP generation.")
@@ -355,6 +427,11 @@ def _generate_pdf_with_playwright(
 
         try:
             if base_dir:
+                if security_level != "basic":
+                    resolved_base = base_dir.resolve()
+                    page.route(
+                        "**/*", lambda route: _route_handler(route, resolved_base)
+                    )
                 page.goto(base_dir.as_uri())
 
             page.set_content(full_html, wait_until="networkidle", timeout=30000)
@@ -369,3 +446,24 @@ def _generate_pdf_with_playwright(
 
         finally:
             browser.close()
+
+
+def _route_handler(route, resolved_base):
+    """
+    Route handler to prevent access to files outside the base directory.
+
+    Args:
+        route (Route): Route to handle.
+        resolved_base (Path): Base directory for resolving relative paths in HTML.
+    """
+    parsed = urlparse(route.request.url)
+
+    if parsed.scheme == "file":
+        try:
+            file_path = Path(urllib.request.url2pathname(parsed.path)).resolve()
+            if not file_path.is_relative_to(resolved_base):
+                return route.abort("accessdenied")
+        except Exception:
+            return route.abort("accessdenied")
+
+    route.continue_()

{markdown_convert-2.0.8 → markdown_convert-2.0.10}/markdown_convert/modules/extras.py

@@ -105,6 +105,9 @@ class SyntaxHighlightExtra(ExtraFeature):
         code = match.group("code")
 
         try:
+            # Unescape is used here because markdown-it escapes "stray" > characters
+            # when html is enabled (security_level=basic) and code blocks can contain
+            # these characters.
             highlighted = highlight(
                 html.unescape(code),
                 get_lexer_by_name(lang),
@@ -158,6 +161,9 @@ class InlineMathExtra(ExtraFeature):
             str: Tag representing the LaTeX math expression.
         """
         content = match.group("content")
+
+        # Unescape is used here because markdown-it escapes "stray" > characters when
+        # html is enabled (security_level=basic) and math contains these characters.
         converted = mathml.convert(html.unescape(content))
         return converted
 
@@ -182,6 +188,9 @@ class BlockMathExtra(ExtraFeature):
             str: Tag representing the LaTeX math expression.
         """
         content = match.group("content")
+
+        # Unescape is used here because markdown-it escapes "stray" > characters when
+        # html is enabled (security_level=basic) and math contains these characters.
         converted = mathml.convert(html.unescape(content), display="block")
         return converted
 
@@ -237,7 +246,7 @@ class TocExtra(ExtraFeature):
 
             list_item = soup.new_tag("li")
             link = soup.new_tag("a", href=f"#{header['id']}")
-            link.string = header.get_text(strip=True)
+            link.string = header.get_text(strip=True, separator=" ")
             list_item.append(link)
 
             active_list[level].append(list_item)
@@ -272,6 +281,9 @@ class MermaidExtra(ExtraFeature):
             str: SVG tag representing the mermaid diagram.
         """
         content = match.group("content")
+
+        # Unescape is used here because markdown-it escapes "stray" > characters when
+        # html is enabled (security_level=basic) and mermaid relies on these characters.
         content = html.unescape(content)
         return f'<div class="mermaid">{content}</div>'
 
@@ -318,6 +330,10 @@ class VegaExtra(ExtraFeature):
                 data_spec["values"] = table.to_dict(orient="records")
 
         content = match.group("content")
+
+        # Unescape is used here because markdown-it escapes "stray" > characters
+        # when html is enabled (security_level=basic) and vega-lite specs can contain
+        # these characters.
         content = html.unescape(content)
         spec = None
 
@@ -376,6 +392,10 @@ class SchemDrawExtra(ExtraFeature):
             str: SVG tag representing the schemdraw diagram.
         """
         content = match.group("content")
+
+        # Unescape is used here because markdown-it escapes "stray" > characters
+        # when html is enabled (security_level=basic) and schemdraw specs can contain
+        # these characters.
         content = html.unescape(content)
         try:
             diagram = from_yaml_string(content)
@@ -462,6 +482,10 @@ class DynamicQueryExtra(ExtraFeature):
         Returns:
             str: The query result as text or an HTML table.
         """
+
+        # Unescape is used here because markdown-it escapes "stray" > characters
+        # when html is enabled (security_level=basic) and sql queries can contain
+        # these characters.
         expression = html.unescape(match.group("expression"))
         try:
             conn = _get_duckdb_connection(memory)
@@ -510,9 +534,10 @@ def _render_html_table(columns, rows):
     Returns:
         str: An HTML <table> string.
     """
-    header_cells = "".join(f"<th>{col}</th>" for col in columns)
+    header_cells = "".join(f"<th>{html.escape(str(col))}</th>" for col in columns)
     body_rows = "".join(
-        "<tr>" + "".join(f"<td>{val}</td>" for val in row) + "</tr>" for row in rows
+        "<tr>" + "".join(f"<td>{html.escape(str(val))}</td>" for val in row) + "</tr>"
+        for row in rows
     )
     return (
         f"<table><thead><tr>{header_cells}</tr></thead>"

{markdown_convert-2.0.8 → markdown_convert-2.0.10}/markdown_convert/modules/resources.py

@@ -149,8 +149,20 @@ def get_usage():
         f"      Supported extras:\n{extras_str}\n"
         f"  {option_five}\n"
         "      Specify the security level.\n"
-        "      Strict mode disables inline HTML, internet access and JS,\n"
-        "      but local files can still be referenced.\n"
-        "      This improves security, but will break some extras.\n"
+        "      Basic:\n"
+        "        - Inline HTML:   No restrictions.\n"
+        "        - JS:            Restricted to extras.\n"
+        "        - Remote files:  Restricted to images and fonts via https.\n"
+        "        - Local files:   No restrictions.\n"
+        "      Default:\n"
+        "        - Inline HTML:   Disabled.\n"
+        "        - JS:            Restricted to extras.\n"
+        "        - Remote files:  Restricted to images and fonts via https.\n"
+        "        - Local files:   Restricted to files inside the base directory.\n"
+        "      Strict:\n"
+        "        - Inline HTML:   Disabled.\n"
+        "        - JS:            Disabled (may break some extras).\n"
+        "        - Remote files:  Disabled (internet access completely disabled).\n"
+        "        - Local files:   Restricted to files inside the base directory.\n"
     )
     return usage

{markdown_convert-2.0.8 → markdown_convert-2.0.10}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "markdown_convert"
-version = "2.0.8"
+version = "2.0.10"
 description = "Convert Markdown files to PDF from your command line."
 authors = [{ name = "Julio Cabria", email = "juliocabria@tutanota.com" }]
 license = { text = "GPL-2.0-only" }