wehub-resource-sync
d25d482dc2
Publish CLI Package / publish-npm (push) Waiting to run
Publish Python SDK / publish-pypi (push) Waiting to run
Publish TypeScript SDK / publish-npm (push) Waiting to run
CI / Migrate Dev DB (push) Has been skipped
CI / Detect Version (push) Has been cancelled
CI / Migrate DB (push) Has been cancelled
CI / Build Dev ECR (./docker/app.Dockerfile, ECR_APP) (push) Has been cancelled
CI / Build Dev ECR (./docker/db.Dockerfile, ECR_MIGRATIONS) (push) Has been cancelled
CI / Build Dev ECR (./docker/pii.Dockerfile, ECR_PII) (push) Has been cancelled
CI / Build Dev ECR (./docker/realtime.Dockerfile, ECR_REALTIME) (push) Has been cancelled
CI / Deploy Trigger.dev (Dev) (push) Has been cancelled
CI / Build AMD64 (./docker/app.Dockerfile, ECR_APP, ghcr.io/simstudioai/simstudio) (push) Has been cancelled
CI / Build AMD64 (./docker/db.Dockerfile, ECR_MIGRATIONS, ghcr.io/simstudioai/migrations) (push) Has been cancelled
CI / Build AMD64 (./docker/pii.Dockerfile, ECR_PII, ghcr.io/simstudioai/pii) (push) Has been cancelled
CI / Build AMD64 (./docker/realtime.Dockerfile, ECR_REALTIME, ghcr.io/simstudioai/realtime) (push) Has been cancelled
CI / Build ARM64 (GHCR Only) (./docker/app.Dockerfile, ghcr.io/simstudioai/simstudio) (push) Has been cancelled
CI / Build ARM64 (GHCR Only) (./docker/db.Dockerfile, ghcr.io/simstudioai/migrations) (push) Has been cancelled
CI / Build ARM64 (GHCR Only) (./docker/pii.Dockerfile, ghcr.io/simstudioai/pii) (push) Has been cancelled
CI / Build ARM64 (GHCR Only) (./docker/realtime.Dockerfile, ghcr.io/simstudioai/realtime) (push) Has been cancelled
CI / Create GHCR Manifests (ghcr.io/simstudioai/migrations) (push) Has been cancelled
CI / Create GHCR Manifests (ghcr.io/simstudioai/pii) (push) Has been cancelled
CI / Create GHCR Manifests (ghcr.io/simstudioai/realtime) (push) Has been cancelled
CI / Create GHCR Manifests (ghcr.io/simstudioai/simstudio) (push) Has been cancelled
CI / Check Docs Changes (push) Has been cancelled
CI / Process Docs (push) Has been cancelled
CI / Create GitHub Release (push) Has been cancelled
CI / Test and Build (push) Has been cancelled
38 lines
1.3 KiB
TypeScript
38 lines
1.3 KiB
TypeScript
/**
|
|
* URL safety utilities for external hyperlinks/media in untrusted document content
|
|
* (PPTX, DOCX, and other previews rendered into the app origin).
|
|
*/
|
|
|
|
const ALLOWED_PROTOCOLS = new Set(['http:', 'https:', 'mailto:'])
|
|
|
|
/**
|
|
* Returns true only for absolute URLs with an allowed protocol.
|
|
*/
|
|
export function isAllowedExternalUrl(url: string): boolean {
|
|
try {
|
|
const parsed = new URL(url)
|
|
return ALLOWED_PROTOCOLS.has(parsed.protocol.toLowerCase())
|
|
} catch {
|
|
return false
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Neutralizes anchors rendered from untrusted document content (e.g. docx-preview,
|
|
* which copies an external-relationship `Target` straight into `href` with no scheme
|
|
* check). Same-document fragment links (`#bookmark`) are left intact; anything else
|
|
* that isn't http/https/mailto has its `href` stripped so the anchor can't navigate.
|
|
* Surviving external links get `rel="noopener noreferrer"` to block tabnabbing.
|
|
*/
|
|
export function sanitizeRenderedHyperlinks(root: ParentNode): void {
|
|
for (const anchor of root.querySelectorAll('a[href]')) {
|
|
const href = anchor.getAttribute('href') ?? ''
|
|
if (href.startsWith('#')) continue
|
|
if (isAllowedExternalUrl(href)) {
|
|
anchor.setAttribute('rel', 'noopener noreferrer')
|
|
continue
|
|
}
|
|
anchor.removeAttribute('href')
|
|
}
|
|
}
|