@file-viewer/renderer-text - npm Package Compare versions

Comparing version 2.2.8 to 2.2.9

dist/markdown.js

 import { marked } from 'marked';
+import createDOMPurify from 'dompurify';
 import { createFileViewerZoomChangeEmitter as createZoomChangeEmitter, readFileViewerText as readText, registerFileViewerZoomProvider, resolveFileViewerFitScale, unregisterFileViewerZoomProvider, } from '@file-viewer/core';
+const createSafeTextFragment = (documentRef, value) => {
+    const fragment = documentRef.createDocumentFragment();
+    fragment.append(documentRef.createTextNode(value));
+    return fragment;
+};
+const sanitizeMarkdownHtml = (documentRef, html) => {
+    const windowRef = documentRef.defaultView;
+    if (!windowRef) {
+        return createSafeTextFragment(documentRef, html);
+    }
+    const purifier = createDOMPurify(windowRef);
+    if (!purifier.isSupported) {
+        return createSafeTextFragment(documentRef, html);
+    }
+    return purifier.sanitize(html, {
+        RETURN_DOM_FRAGMENT: true,
+        USE_PROFILES: { html: true },
+        ADD_ATTR: ['target'],
+        FORBID_TAGS: ['style', 'iframe', 'object', 'embed', 'form'],
+        FORBID_ATTR: ['style', 'srcdoc'],
+    });
+};
+const hardenMarkdownLinks = (root) => {
+    root.querySelectorAll('a[target]').forEach(anchor => {
+        if ((anchor.getAttribute('target') || '').trim().toLowerCase() === '_blank') {
+            anchor.rel = 'noopener noreferrer';
+        }
+    });
+};
 const markdownStyle = `
@@ -178,3 +208,5 @@ .markdown-viewer{min-height:100%;padding:28px 16px 48px;background:var(--file-viewer-render-surface-background,#eef1f4);overflow:auto;box-sizing:border-box}
     article.className = 'markdown-body';
-    article.innerHTML = await marked(stripMarkdownFrontmatter(text));
+    const renderedHtml = await marked(stripMarkdownFrontmatter(text));
+    article.append(sanitizeMarkdownHtml(article.ownerDocument, renderedHtml));
+    hardenMarkdownLinks(article);
     applyMarkdownZoom(root, zoom);
@@ -181,0 +213,0 @@ root.append(article);

package.json

 {
   "name": "@file-viewer/renderer-text",
-  "version": "2.2.8",
+  "version": "2.2.9",
   "private": false,
@@ -60,7 +60,8 @@ "type": "module",
   "dependencies": {
-    "@file-viewer/core": "2.2.8",
+    "@file-viewer/core": "2.2.9",
     "diff2html": "^3.4.56",
+    "dompurify": "^3.4.13",
     "highlight.js": "^11.11.1",
     "marked": "^18.0.5",
-    "mermaid": "^11.15.0",
+    "mermaid": "^11.16.1",
     "pako": "^2.1.0"
@@ -67,0 +68,0 @@ },

No alert changes

Improved metrics

Total package byte prevSize

113987

1.09%

Lines of code

1968

1.65%

Worsened metrics

Dependency count

7

16.67%

Dependency changes

• + Added

  dompurify@^3.4.13

• + Added

  @file-viewer/core@2.2.9
  (transitive)

• - Removed

  @file-viewer/core@2.2.8
  (transitive)

• Updated

  @file-viewer/core@2.2.9

• Updated

  mermaid@^11.16.1