mirror of
https://github.com/heygen-com/hyperframes.git
synced 2026-11-15 13:58:20 +00:00
Miguel Angel Simon Sierra
b2ef6192ed
Two rounds of regex/tokenizer patches to sanitizeSvg found new bypasses in the same shape each time (unquoted href, style= url(), aliased xlink prefix; then presentation-attribute url(), unquoted '=' handling, SMIL animate/set href rewrite, self-closing-slash tag corruption, data:image/ navigation via <a>). Denylisting attribute names against a hand-rolled tokenizer was the wrong approach regardless of how careful the regex. Rewrote sanitizeSvg (packages/core/src/figma/sanitizeSvg.ts) as a real DOM walk (linkedom, already a dependency of core and cli) with an allowlist: known-safe elements and attributes only, everything else dropped by construction rather than pattern-matched as dangerous. href/xlink:href (any namespace prefix) kept only for a same-document fragment, or data:image/ off non-<a> elements. Any attribute value or <style> text containing url() kept only when every url() argument is a fragment; @import/expression(/javascript: dropped from style content. Serializing from a real DOM means output is always well-formed, so the self-closing-slash corruption class of bug is gone by construction. media-use's own copy (packages/cli/src/media-use/lib/svg-sanitize.mjs) can't import linkedom directly: its CI test lane runs bare `node --test` with no install step, so even an external dependency fails to resolve, not just a workspace import. It's now a generated file instead of a hand-copy: scripts/generate-media-use-svg-sanitize.mjs bundles the core source (esbuild, minified, zero remaining imports) and scripts/check-media-use-svg-sanitize-generated.test.mjs fails the build on drift. Verified the generated file runs with plain node in an empty directory with no node_modules on the path. Every payload from both independent-review reports is now a table-driven test in sanitizeSvg.test.ts (46 cases) and the same corpus in check-svg-sanitize-parity.test.mjs (39 cases) asserts core and the generated media-use copy agree and each independently rejects every non-local url(), javascript:, data: href on <a>, and on* handler. Mutation-proved against the real pre-fix blob, not a synthetic case. Sampled 56 real theSVG icons across all 7 collections to check the allowlist doesn't over-strip legitimate content: found and fixed three missing attributes (fx/fy, enable-background, a blanket data-* allowance) and one real behavioral bug - <style> elements were being dropped outright, silently unstyling any Illustrator-exported logo that colors paths via CSS classes. Fixed by keeping <style> on the allowlist and content-checking its text the same way as an inline style= attribute, with a regression test using that exact shape. Full suite after the fix: sanitizeSvg.test.ts 46/46, parity+drift tests 39/39, media-use suite 298/298, tsc/oxlint/oxfmt clean.
95 lines
6.7 KiB
JSON
95 lines
6.7 KiB
JSON
{
|
|
"name": "hyperframes-monorepo",
|
|
"private": true,
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://github.com/heygen-com/hyperframes"
|
|
},
|
|
"workspaces": [
|
|
"packages/*"
|
|
],
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "bun run studio",
|
|
"build": "bun run --filter '@hyperframes/{parsers,lint,studio-server}' build && bun run --filter @hyperframes/core build && bun run --filter '@hyperframes/{engine,producer,player,studio,shader-transitions,aws-lambda,gcp-cloud-run,sdk}' build && bun run --filter @hyperframes/cli build && bun run --filter @hyperframes/sdk-playground build",
|
|
"build:producer": "bun run --filter @hyperframes/producer build",
|
|
"studio": "bun run --filter @hyperframes/studio dev",
|
|
"build:hyperframes-runtime": "bun run --filter @hyperframes/core build:hyperframes-runtime",
|
|
"build:hyperframes-runtime:modular": "bun run --filter @hyperframes/core build:hyperframes-runtime:modular",
|
|
"verify:packed-manifests": "node scripts/verify-packed-manifests.mjs",
|
|
"validate:release-channel": "node scripts/validate-release-channel.mjs",
|
|
"set-version": "tsx scripts/set-version.ts",
|
|
"release:prepare": "tsx scripts/release-prepare.ts",
|
|
"changelog:draft": "tsx scripts/draft-changelog.ts",
|
|
"changelog:weekly": "tsx scripts/changelog-weekly.ts",
|
|
"sync-schemas": "tsx scripts/sync-schemas.ts",
|
|
"sync-schemas:check": "tsx scripts/sync-schemas.ts --check",
|
|
"sync:package-subpaths": "node scripts/package-subpaths.mjs --write",
|
|
"check:package-subpaths": "node scripts/package-subpaths.mjs",
|
|
"lint": "bun run check:docs-snippet-motion && bun run check:tracked-artifacts && bun run check:workspace-contracts && bun run check:gcp-cloud-run-dockerfile && bun run check:package-cycles && bun run check:package-subpaths && bun run check:cli-process-ownership && oxlint . && tsx scripts/lint-skills.ts && node scripts/check-skill-mirror.mjs",
|
|
"check:gcp-cloud-run-dockerfile": "bun run --cwd packages/gcp-cloud-run test:dockerfile-workspaces",
|
|
"lint:skills": "tsx scripts/lint-skills.ts",
|
|
"check:skill-mirror": "node scripts/check-skill-mirror.mjs",
|
|
"lint:fix": "oxlint --fix .",
|
|
"check:tracked-artifacts": "node scripts/check-tracked-artifacts.mjs",
|
|
"check:docs-snippet-motion": "node scripts/check-docs-snippet-motion.mjs",
|
|
"check:docs-catalog": "node scripts/check-docs-catalog.mjs",
|
|
"check:catalog-drift": "node scripts/check-registry-set-delta.mjs origin/main && tsx scripts/catalog-drift.ts",
|
|
"verify:catalog-payloads": "tsx scripts/verify-catalog-payloads.ts",
|
|
"check:workspace-contracts": "node scripts/check-workspace-contracts.mjs",
|
|
"check:package-cycles": "node scripts/check-package-cycles.mjs",
|
|
"check:cli-process-ownership": "node scripts/check-cli-process-ownership.mjs",
|
|
"format": "oxfmt .",
|
|
"test": "bun run test:unit",
|
|
"test:unit": "bun run --filter '*' test",
|
|
"producer:test:classification": "bun run --cwd packages/producer test:classification",
|
|
"producer:test:unit": "bun run --cwd packages/producer test:unit",
|
|
"producer:test:unit:bun": "bun run --cwd packages/producer test:unit:bun",
|
|
"producer:test:unit:vitest": "bun run --cwd packages/producer test:unit:vitest",
|
|
"producer:test:integration": "bun run --cwd packages/producer test:integration",
|
|
"test:regression": "bun run --cwd packages/producer test:regression",
|
|
"player:perf": "bun run --filter @hyperframes/player perf",
|
|
"format:check": "oxfmt --check .",
|
|
"knip": "knip",
|
|
"test:scripts": "node --import tsx --test scripts/animejs-v4-guidance.test.mjs scripts/check-tracked-artifacts.test.mjs scripts/check-registry-set-delta.test.mjs scripts/check-no-main-deletions.test.mjs scripts/check-pr-captures.test.mjs scripts/check-docs-snippet-motion.test.mjs scripts/registry-target-paths.test.mjs scripts/check-workspace-contracts.test.mjs scripts/check-media-use-copy-parity.test.mjs scripts/check-svg-sanitize-parity.test.mjs scripts/check-media-use-svg-sanitize-generated.test.mjs scripts/check-package-cycles.test.mjs scripts/check-cli-process-ownership.test.mjs scripts/check-large-files.test.mjs scripts/package-subpaths.test.mjs scripts/validate-release-channel.test.mjs scripts/publish-workflow.test.mjs scripts/install-workspace-dependencies.test.mjs scripts/draft-changelog.test.ts scripts/set-version.test.ts scripts/release-prepare.test.ts scripts/cli-options.test.ts scripts/changelog-weekly.test.ts scripts/claude-plugin-compression.test.ts scripts/catalog-payload-assets.test.ts scripts/host-registry-assets.test.ts scripts/catalog-preview-temp.test.ts scripts/catalog-hosted-files.test.ts scripts/player-cdn-pin.test.ts scripts/studio-runtime-smoke.test.mjs scripts/verify-packed-manifests.test.mjs scripts/lint-skills.test.mjs scripts/creator-editing-recipes.test.mjs packages/gcp-cloud-run/check-dockerfile-workspaces.test.mjs packages/core/scripts/writeGeneratedFile.test.ts scripts/catalog-drift.test.ts scripts/catalog-fetch-mirror.test.ts scripts/catalog-script-inlining.test.ts scripts/catalog-detail.test.ts scripts/generate-catalog-pages.test.ts scripts/verify-catalog-payloads.test.ts scripts/registry-skill-files.test.ts scripts/creator-editing-capabilities.test.mjs scripts/generate-catalog-previews.test.ts scripts/registry-primitive-payloads.test.ts registry/components/pan-stations/pan-stations.test.mjs && vitest run scripts/catalog/ scripts/contrastRatchet.test.ts scripts/generate-catalog-payloads.test.ts",
|
|
"typecheck:scripts": "tsc --noEmit -p scripts/tsconfig.json",
|
|
"test:skills": "node --test 'skills/**/*.test.mjs' 'packages/cli/src/media-use/**/*.test.mjs'",
|
|
"generate:previews": "tsx scripts/generate-template-previews.ts",
|
|
"generate:catalog-previews": "tsx scripts/generate-catalog-previews.ts",
|
|
"package:codex-plugin": "node scripts/package-codex-plugin.mjs",
|
|
"upload:docs-images": "bash scripts/upload-docs-images.sh",
|
|
"host:registry-assets": "bun run scripts/host-registry-assets.ts",
|
|
"prepare": "test -d .git && lefthook install || true",
|
|
"lint:registry-items": "node scripts/lint-registry-items.mjs"
|
|
},
|
|
"devDependencies": {
|
|
"@commitlint/cli": "^20.5.0",
|
|
"@commitlint/config-conventional": "^20.5.0",
|
|
"@hyperframes/player": "workspace:*",
|
|
"@types/node": "^25.0.10",
|
|
"concurrently": "^8.2.0",
|
|
"fallow": "^2.75.0",
|
|
"happy-dom": "^20.9.0",
|
|
"knip": "^6.0.3",
|
|
"lefthook": "^2.1.4",
|
|
"oxfmt": "^0.41.0",
|
|
"oxlint": "^1.56.0",
|
|
"tsx": "^4.21.0",
|
|
"typescript": "^5.0.0",
|
|
"vitest": "^4.1.11",
|
|
"yaml": "^2.9.0"
|
|
},
|
|
"resolutions": {
|
|
"@types/react": "^19.0.0",
|
|
"@types/react-dom": "^19.0.0",
|
|
"react": "^19.0.0",
|
|
"react-dom": "^19.0.0"
|
|
},
|
|
"overrides": {
|
|
"@types/react": "^19.0.0",
|
|
"@types/react-dom": "^19.0.0",
|
|
"react": "^19.0.0",
|
|
"react-dom": "^19.0.0"
|
|
}
|
|
}
|