mkdocs-zip-bundle-plugin 0.2.0__tar.gz → 0.3.0__tar.gz

{mkdocs_zip_bundle_plugin-0.2.0/mkdocs_zip_bundle_plugin.egg-info → mkdocs_zip_bundle_plugin-0.3.0}/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.4
 Name: mkdocs-zip-bundle-plugin
-Version: 0.2.0
+Version: 0.3.0
 Summary: Bundle code blocks into downloadable ZIP or raw files — for MkDocs/Material and Zensical.
 Author: Daemonless
-License: MIT
+License-Expression: MIT
 Project-URL: Homepage, https://github.com/daemonless/mkdocs-zip-bundle-plugin
 Project-URL: Repository, https://github.com/daemonless/mkdocs-zip-bundle-plugin
 Project-URL: Bug Tracker, https://github.com/daemonless/mkdocs-zip-bundle-plugin/issues

{mkdocs_zip_bundle_plugin-0.2.0 → mkdocs_zip_bundle_plugin-0.3.0}/mkdocs_zip_bundle/assets/zip-bundle.js

@@ -5,12 +5,19 @@
 // so on MkDocs/Material (server-injected) this is a harmless no-op.
 
 function sanitizeFilename(filename) {
+    if (!filename) return '';
     // Match plugin._sanitize_filename: prevent path traversal, allow subdirs.
-    filename = filename.replace(/\\/g, '/');     // backslashes -> forward
-    filename = filename.replace(/\.\.(?=\/|$)/g, '');  // drop ".." segments
-    filename = filename.replace(/^\/+/, '');     // no leading slashes
-    filename = filename.replace(/\/+/g, '/');    // collapse slashes
-    return filename.trim();
+    filename = filename.replace(/\0/g, '').replace(/\\/g, '/');
+    const parts = [];
+    for (let part of filename.split('/')) {
+        part = part.trim();
+        // Drop empty parts and segments consisting only of dots (., .., ..., etc.)
+        if (!part || /^\.+$/.test(part)) continue;
+        // Strip Windows drive letters (e.g. C:)
+        if (/^[a-zA-Z]:$/.test(part)) continue;
+        parts.push(part);
+    }
+    return parts.join('/');
 }
 
 function titleCase(str) {
@@ -36,8 +43,9 @@ function buildButtonContainer(bundleId, elements) {
     if (customLabel) {
         btn.textContent = customLabel;
     } else if (elements.length === 1 && !forceZip) {
-        const filename = elements[0].getAttribute('data-zip-filename') || 'file';
-        const displayName = filename.split('/').pop();  // basename
+        const rawFilename = elements[0].getAttribute('data-zip-filename');
+        const filename = sanitizeFilename(rawFilename || '') || 'file';
+        const displayName = filename.split('/').pop() || 'file';  // basename
         btn.textContent = `Download ${displayName}`;
     } else {
         const label = titleCase(bundleId.replace(/-/g, ' '));
@@ -88,6 +96,14 @@ if (window.document$ && typeof window.document$.subscribe === 'function') {
 
 // ── Download handling ─────────────────────────────────────────────────
 
+function extractCodeContent(el) {
+    const codeEl = el.querySelector('code') || el;
+    const clone = codeEl.cloneNode(true);
+    // Strip line numbers, Material code annotations, and clipboard buttons
+    clone.querySelectorAll('.linenos, .lineno, .md-annotation, .md-clipboard').forEach(n => n.remove());
+    return clone.textContent;
+}
+
 document.addEventListener('click', function(e) {
     const btn = e.target.closest('.zip-bundle-btn[data-bundle-id]');
     if (btn) {
@@ -96,7 +112,8 @@ document.addEventListener('click', function(e) {
 });
 
 async function downloadZipBundle(bundleId) {
-    const elements = document.querySelectorAll(`[data-zip-bundle="${bundleId}"]`);
+    const escapedId = (window.CSS && CSS.escape) ? CSS.escape(bundleId) : bundleId.replace(/"/g, '\\"');
+    const elements = document.querySelectorAll(`[data-zip-bundle="${escapedId}"]`);
 
     if (elements.length === 0) {
         console.warn(`No elements found for bundle ID: ${bundleId}`);
@@ -108,9 +125,9 @@ async function downloadZipBundle(bundleId) {
     // If it's only one file AND we aren't forcing a ZIP, download it directly
     if (elements.length === 1 && !forceZip) {
         const el = elements[0];
-        const filename = el.getAttribute('data-zip-filename') || 'file';
-        const codeEl = el.querySelector('code') || el;
-        const content = codeEl.innerText;
+        const rawFilename = el.getAttribute('data-zip-filename');
+        const filename = sanitizeFilename(rawFilename || '') || 'file';
+        const content = extractCodeContent(el);
 
         // Ensure UTF-8 encoding
         const blob = new Blob([content], { type: "text/plain;charset=utf-8" });
@@ -128,20 +145,18 @@ async function downloadZipBundle(bundleId) {
 
     const zip = new JSZip();
     elements.forEach(el => {
-        const filename = el.getAttribute('data-zip-filename') || 'unnamed-file';
-        const codeEl = el.querySelector('code') || el;
-        const content = codeEl.innerText;
-
-        // Skip empty files if they have no content
-        if (content.trim().length === 0) {
-            console.warn(`Skipping empty file: ${filename}`);
-            return;
-        }
+        const rawFilename = el.getAttribute('data-zip-filename');
+        const filename = sanitizeFilename(rawFilename || '') || 'unnamed-file';
+        const content = extractCodeContent(el);
 
-        zip.file(filename, content);
+        zip.file(filename, content, { date: new Date(0) });
     });
 
-    const blob = await zip.generateAsync({type: "blob"});
+    const blob = await zip.generateAsync({
+        type: "blob",
+        compression: "DEFLATE",
+        compressionOptions: { level: 6 }
+    });
     const url = URL.createObjectURL(blob);
     triggerDownload(url, `${bundleId}.zip`);
 }

{mkdocs_zip_bundle_plugin-0.2.0 → mkdocs_zip_bundle_plugin-0.3.0}/mkdocs_zip_bundle/plugin.py

@@ -43,15 +43,22 @@ class ZipBundlePlugin(BasePlugin):
         """
         Sanitize filename to prevent path traversal while allowing subdirectories.
         """
-        # Replace backslashes with forward slashes for ZIP compatibility
-        filename = filename.replace('\\', '/')
-        # Remove any ".." segments to prevent traversal
-        filename = re.sub(r'\.\.(?=/|$)', '', filename)
-        # Remove any leading slashes
-        filename = re.sub(r'^/+', '', filename)
-        # Collapse multiple slashes
-        filename = re.sub(r'/+', '/', filename)
-        return filename.strip()
+        if not filename:
+            return ""
+        # Remove null bytes and normalize slashes
+        filename = filename.replace('\0', '').replace('\\', '/')
+        # Split into path components and clean each segment
+        parts = []
+        for part in filename.split('/'):
+            part = part.strip()
+            # Drop empty segments and any segment consisting only of dots (., .., ...)
+            if not part or re.fullmatch(r'\.+', part):
+                continue
+            # Strip Windows drive letters if leading (e.g. 'C:')
+            if len(part) == 2 and part[1] == ':' and part[0].isalpha():
+                continue
+            parts.append(part)
+        return '/'.join(parts)
 
     def _create_button(self, soup, bundle_id, elements):
         """
@@ -70,9 +77,9 @@ class ZipBundlePlugin(BasePlugin):
         if custom_label:
             btn.string = custom_label
         elif len(elements) == 1 and not force_zip:
-            filename = elements[0].get('data-zip-filename', 'file')
+            filename = elements[0].get('data-zip-filename') or 'file'
             # Extract only the base filename for the button label if it's a path
-            display_name = os.path.basename(filename)
+            display_name = os.path.basename(filename) or 'file'
             btn.string = f"Download {display_name}"
         else:
             label = bundle_id.replace('-', ' ').title()

{mkdocs_zip_bundle_plugin-0.2.0 → mkdocs_zip_bundle_plugin-0.3.0/mkdocs_zip_bundle_plugin.egg-info}/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.4
 Name: mkdocs-zip-bundle-plugin
-Version: 0.2.0
+Version: 0.3.0
 Summary: Bundle code blocks into downloadable ZIP or raw files — for MkDocs/Material and Zensical.
 Author: Daemonless
-License: MIT
+License-Expression: MIT
 Project-URL: Homepage, https://github.com/daemonless/mkdocs-zip-bundle-plugin
 Project-URL: Repository, https://github.com/daemonless/mkdocs-zip-bundle-plugin
 Project-URL: Bug Tracker, https://github.com/daemonless/mkdocs-zip-bundle-plugin/issues

{mkdocs_zip_bundle_plugin-0.2.0 → mkdocs_zip_bundle_plugin-0.3.0}/pyproject.toml

@@ -4,11 +4,11 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mkdocs-zip-bundle-plugin"
-version = "0.2.0"
+version = "0.3.0"
 description = "Bundle code blocks into downloadable ZIP or raw files — for MkDocs/Material and Zensical."
 readme = "README.md"
 authors = [{ name = "Daemonless" }]
-license = { text = "MIT" }
+license = "MIT"
 requires-python = ">=3.8"
 keywords = ["mkdocs", "material", "zensical", "zip", "bundle", "placeholders", "interactive"]
 dependencies = [

{mkdocs_zip_bundle_plugin-0.2.0 → mkdocs_zip_bundle_plugin-0.3.0}/tests/test_plugin.py

@@ -34,7 +34,20 @@ def test_sanitize_filename(plugin):
     assert plugin._sanitize_filename('some/../../path.txt') == 'some/path.txt'
     assert plugin._sanitize_filename('win\\path.txt') == 'win/path.txt'
     assert plugin._sanitize_filename('subdir/file.txt') == 'subdir/file.txt'
-    assert plugin._sanitize_filename('//double//slash//') == 'double/slash/'
+    assert plugin._sanitize_filename('//double//slash//') == 'double/slash'
+    # Traversal bypass attempts
+    assert plugin._sanitize_filename('....//test.txt') == 'test.txt'
+    assert plugin._sanitize_filename('....//....//etc/passwd') == 'etc/passwd'
+    assert plugin._sanitize_filename('a/b/../../../c') == 'a/b/c'
+    assert plugin._sanitize_filename('C:\\Windows\\System32\\cmd.exe') == 'Windows/System32/cmd.exe'
+    assert plugin._sanitize_filename('foo/./bar') == 'foo/bar'
+    assert plugin._sanitize_filename('\0secret.txt') == 'secret.txt'
+    # Empty and dot-only inputs
+    assert plugin._sanitize_filename('   ') == ''
+    assert plugin._sanitize_filename('') == ''
+    assert plugin._sanitize_filename('..') == ''
+    assert plugin._sanitize_filename('...') == ''
+    assert plugin._sanitize_filename(None) == ''
 
 
 # --- _create_button ---
@@ -50,6 +63,16 @@ def test_create_button_single(plugin):
     assert 'onclick' not in button.attrs
 
 
+def test_create_button_single_empty_filename(plugin):
+    """Empty or traversal-only filename should fall back safely to 'Download file'."""
+    soup = BeautifulSoup('', 'html.parser')
+    elements = [make_element(soup, {'data-zip-filename': ''})]
+    container = plugin._create_button(soup, 'my-bundle', elements)
+
+    button = container.find('button')
+    assert button.string == 'Download file'
+
+
 def test_create_button_single_subdir(plugin):
     soup = BeautifulSoup('', 'html.parser')
     elements = [make_element(soup, {'data-zip-filename': 'configs/compose.yaml'})]