mehdown - npm Package Compare versions

Comparing version 2.0.2 to 2.0.3

lib/plugins/emoji.js

 const emojione = require('emojione');
 
+const mehdown = require('../index');
+
+const emojioneRegExp = /(<img class="emojione".*?>)/g;
+
 module.exports = function(md, opts) {
     opts = opts || {};
 
-    var defaultRender = md.renderer.rules.text || function(tokens, idx, options, env, self) {
-        return self.renderToken(tokens, idx, options);
-    };
+    md.core.ruler.push('emoji', function(state) {
+        state.tokens.filter(t => t.type === 'inline').forEach(token => {
+            for (var i = token.children.length - 1; i >= 0; i--) {
+                var childToken = token.children[i];
+                var previousToken = token.children[i - 1];
 
-    md.renderer.rules.text = function(tokens, idx, options) {
-        var token = tokens[idx];
-        var previousToken = tokens[idx - 1];
+                // Ensure parent token isn't a link with the same href as the text
+                if (previousToken && previousToken.tag === 'a') {
+                    var hrefIndex = previousToken.attrIndex('href');
 
-        // Ensure previous token isn't a link with the same href as the text
-        if (previousToken) {
-            var hrefIndex = previousToken.attrIndex('href');
+                    if (hrefIndex !== -1 && previousToken.attrs[hrefIndex][1] === childToken.content) {
+                        continue;
+                    }
+                }
 
-            if (hrefIndex !== -1 && previousToken.attrs[hrefIndex][1] === token.content) {
-                return defaultRender(tokens, idx, options);
-            }
-        }
+                if (childToken.type === 'text') {
+                    emojione.ascii = true;
+                    emojione.imagePathPNG = opts.imagePathPNG || 'https://cdn.jsdelivr.net/emojione/assets/png/';
+                    emojione.unicodeAlt = false;
 
-        emojione.ascii = true;
-        emojione.imagePathPNG = opts.imagePathPNG || 'https://cdn.jsdelivr.net/emojione/assets/png/';
-        emojione.unicodeAlt = false;
+                    var emojiHtml = emojione.toImage(childToken.content);
 
-        return emojione.toImage(token.content).replace(/class="emojione" alt="/g, 'class="emojione" title="');
-    };
+                    if (childToken.content === emojiHtml) {
+                        continue;
+                    }
+
+                    var _tokens = emojiHtml.split(emojioneRegExp);
+
+                    _tokens = _tokens.map(t => {
+                        if (t.match(emojioneRegExp)) {
+                            var _token = new state.Token('image', 'img', 0);
+                            _token.children = [];
+
+                            _token.attrs = [
+                                ['alt', mehdown.html.getAttributeValue(t, 'alt')],
+                                ['class', 'emojione'],
+                                ['src', mehdown.html.getAttributeValue(t, 'src')],
+                                ['title', mehdown.html.getAttributeValue(t, 'alt')]
+                            ];
+
+                            return _token;
+                        }
+
+                        _token = new state.Token('text', '', 0);
+                        _token.content = t;
+                        return _token;
+                    });
+
+                    token.children = md.utils.arrayReplaceAt(token.children, i, _tokens);
+                }
+            }
+        });
+    });
 };

package.json

@@ -20,3 +20,3 @@ {
     },
-    "version": "2.0.2"
+    "version": "2.0.3"
 }

test/fixtures/fixtures.js

@@ -18,3 +18,3 @@ const assert = require('assert');
         mehdown.render(fs.readFileSync(`${__dirname}/mehdown.md`).toString(), options, function(err, html) {
-            assert.equal(html, fs.readFileSync(`${__dirname}/mehdown.html`).toString());
+            assert.equal(html.trim(), fs.readFileSync(`${__dirname}/mehdown.html`).toString().trim());
             done();
@@ -21,0 +21,0 @@ });

test/index.js

@@ -298,1 +298,10 @@ const assert = require('assert');
 });
+
+describe('security', function() {
+    it('<script>alert("hello world")</script>', function(done) {
+        mehdown.render('<script>alert("hello world");</script>', function(err, html) {
+            assert.equal(html, '<p>&lt;script&gt;alert(“hello world”);&lt;/script&gt;</p>');
+            done();
+        });
+    });
+});

test/plugins/emoji.js

@@ -8,3 +8,3 @@ const assert = require('assert');
         mehdown.render('Hello world! 😄 :smile:', function(err, html) {
-            assert.equal(html, '<p>Hello world! <img class="emojione" title=":smile:" src="https://cdn.jsdelivr.net/emojione/assets/png/1f604.png?v=2.1.4"/> <img class="emojione" title=":smile:" src="https://cdn.jsdelivr.net/emojione/assets/png/1f604.png?v=2.1.4"/></p>');
+            assert.equal(html, '<p>Hello world! <img alt="" class="emojione" src="https://cdn.jsdelivr.net/emojione/assets/png/1f604.png?v=2.1.4" title=":smile:" /> <img alt="" class="emojione" src="https://cdn.jsdelivr.net/emojione/assets/png/1f604.png?v=2.1.4" title=":smile:" /></p>');
             done();
@@ -16,3 +16,3 @@ });
         mehdown.render('Hello world! 😄 :smile:', { emoji: { imagePathPNG: 'https://example.com/' } }, function(err, html) {
-            assert.equal(html, '<p>Hello world! <img class="emojione" title=":smile:" src="https://example.com/1f604.png?v=2.1.4"/> <img class="emojione" title=":smile:" src="https://example.com/1f604.png?v=2.1.4"/></p>');
+            assert.equal(html, '<p>Hello world! <img alt="" class="emojione" src="https://example.com/1f604.png?v=2.1.4" title=":smile:" /> <img alt="" class="emojione" src="https://example.com/1f604.png?v=2.1.4" title=":smile:" /></p>');
             done();
@@ -24,3 +24,3 @@ });
         mehdown.render(':alien: is 👽 and 저 is not :alien: or :alien: also :randomy: is not emoji', function(err, html) {
-            assert.equal(html, '<p><img class="emojione" title=":alien:" src="https://cdn.jsdelivr.net/emojione/assets/png/1f47d.png?v=2.1.4"/> is <img class="emojione" title=":alien:" src="https://cdn.jsdelivr.net/emojione/assets/png/1f47d.png?v=2.1.4"/> and 저 is not <img class="emojione" title=":alien:" src="https://cdn.jsdelivr.net/emojione/assets/png/1f47d.png?v=2.1.4"/> or <img class="emojione" title=":alien:" src="https://cdn.jsdelivr.net/emojione/assets/png/1f47d.png?v=2.1.4"/> also :randomy: is not emoji</p>');
+            assert.equal(html, '<p><img alt="" class="emojione" src="https://cdn.jsdelivr.net/emojione/assets/png/1f47d.png?v=2.1.4" title=":alien:" /> is <img alt="" class="emojione" src="https://cdn.jsdelivr.net/emojione/assets/png/1f47d.png?v=2.1.4" title=":alien:" /> and 저 is not <img alt="" class="emojione" src="https://cdn.jsdelivr.net/emojione/assets/png/1f47d.png?v=2.1.4" title=":alien:" /> or <img alt="" class="emojione" src="https://cdn.jsdelivr.net/emojione/assets/png/1f47d.png?v=2.1.4" title=":alien:" /> also :randomy: is not emoji</p>');
             done();
@@ -32,3 +32,3 @@ });
         mehdown.render(':)', function(err, html) {
-            assert.equal(html, '<p><img class="emojione" title=":)" src="https://cdn.jsdelivr.net/emojione/assets/png/1f642.png?v=2.1.4"/></p>');
+            assert.equal(html, '<p><img alt="" class="emojione" src="https://cdn.jsdelivr.net/emojione/assets/png/1f642.png?v=2.1.4" title=":)" /></p>');
             done();
@@ -35,0 +35,0 @@ });

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

82788

increased by2.28%

Lines of code

1184

increased by3.05%

No dependency changes