ext/hyperframes
2
0
Fork 0
mirror of https://github.com/heygen-com/hyperframes.git synced 2026-09-03 04:38:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(sdk,studio): restore DOM edit cutover parity (#1565)

Browse Source 
- Add splitStyleDeclarations with quote/paren-aware CSS parsing
- Fix backslash escape handling inside quoted CSS string values
- Close html-attribute safety gap in SDK cutover (event handlers, dangerous URIs)
- Consolidate HTML attribute safety constants to core/utils/htmlAttrSafety.ts
- Extract NON_HTML_CHILD_TAGS set for foreign-content decline gate
- Add sdkCutoverParity test corpus (shorthand/longhand, mixed batches)
This commit is contained in:
Miguel Ángel
2026-06-19 15:37:10 -04:00
committed by GitHub
parent 4e32c5e0fe
commit 758eda995c
12 changed files with 534 additions and 119 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/core/src/studio-api/helpers/sourceMutation.ts
+1 -90
View File
@@ -1,6 +1,7 @@
import { parseHTML } from "linkedom";
import postcss from "postcss";
import selectorParser from "postcss-selector-parser";
import { isAllowedHtmlAttribute, isSafeAttributeValue } from "../../utils/htmlAttrSafety";
export interface SourceMutationTarget {
id?: string | null;
@@ -133,96 +134,6 @@ export interface PatchOperation {
value: string | null;
}
const ALLOWED_HTML_ATTRS = new Set([
// Identity & structure
"id",
"class",
"style",
"title",
"name",
"for",
"type",
// Internationalization
"lang",
"dir",
"translate",
// Interaction
"hidden",
"tabindex",
"draggable",
"contenteditable",
// Accessibility
"role",
"slot",
// Links & navigation
"href",
"target",
"rel",
// Media
"src",
"srcset",
"sizes",
"alt",
"poster",
"loading",
"decoding",
"crossorigin",
"preload",
"autoplay",
"loop",
"muted",
"controls",
"playsinline",
// Layout
"width",
"height",
"colspan",
"rowspan",
"scope",
// Form
"placeholder",
"value",
"min",
"max",
"step",
"pattern",
"required",
"disabled",
"readonly",
"checked",
"selected",
"multiple",
"accept",
"maxlength",
"minlength",
"rows",
"cols",
"wrap",
]);
const DANGEROUS_URI_SCHEMES = /^(?:javascript|vbscript):/i;
const DANGEROUS_DATA_URI = /^data\s*:\s*text\/html/i;
function isAllowedHtmlAttribute(name: string): boolean {
const lower = name.toLowerCase();
if (lower.startsWith("on")) return false;
if (ALLOWED_HTML_ATTRS.has(lower)) return true;
if (lower.startsWith("data-")) return true;
if (lower.startsWith("aria-")) return true;
return false;
}
const URI_ATTRS = new Set(["src", "href", "action", "formaction", "poster", "srcset"]);
function isSafeAttributeValue(name: string, value: string): boolean {
if (URI_ATTRS.has(name.toLowerCase())) {
const trimmed = value.trim();
if (DANGEROUS_URI_SCHEMES.test(trimmed)) return false;
if (DANGEROUS_DATA_URI.test(trimmed)) return false;
}
return true;
}
// fallow-ignore-next-line complexity
function patchStyleAttrString(style: string, property: string, value: string | null): string {
const props = new Map<string, string>();
packages/core/src/utils/htmlAttrSafety.ts
+96
View File
@@ -0,0 +1,96 @@
/**
* Shared HTML attribute safety constants.
*
* Single source of truth for attribute allowlists and dangerous-URI patterns
* used by sourceMutation (core), sdkCutover (studio), and mutate (sdk).
*/
export const ALLOWED_HTML_ATTRS = new Set([
"id",
"class",
"style",
"title",
"name",
"for",
"type",
"lang",
"dir",
"translate",
"hidden",
"tabindex",
"draggable",
"contenteditable",
"role",
"slot",
"href",
"target",
"rel",
"src",
"srcset",
"sizes",
"alt",
"poster",
"loading",
"decoding",
"crossorigin",
"preload",
"autoplay",
"loop",
"muted",
"controls",
"playsinline",
"width",
"height",
"colspan",
"rowspan",
"scope",
"placeholder",
"value",
"min",
"max",
"step",
"pattern",
"required",
"disabled",
"readonly",
"checked",
"selected",
"multiple",
"accept",
"maxlength",
"minlength",
"rows",
"cols",
"wrap",
]);
export const URI_BEARING_ATTRS = new Set([
"src",
"href",
"action",
"formaction",
"poster",
"srcset",
"xlink:href",
]);
export const DANGEROUS_URI_SCHEMES = /^(?:javascript|vbscript):/i;
export const DANGEROUS_DATA_URI = /^data\s*:\s*text\/html/i;
export function isAllowedHtmlAttribute(name: string): boolean {
const lower = name.toLowerCase();
if (lower.startsWith("on")) return false;
if (ALLOWED_HTML_ATTRS.has(lower)) return true;
if (lower.startsWith("data-")) return true;
if (lower.startsWith("aria-")) return true;
return false;
}
export function isSafeAttributeValue(name: string, value: string): boolean {
if (URI_BEARING_ATTRS.has(name.toLowerCase())) {
const trimmed = value.trim();
if (DANGEROUS_URI_SCHEMES.test(trimmed)) return false;
if (DANGEROUS_DATA_URI.test(trimmed)) return false;
}
return true;
}