mirror of
https://github.com/pewdiepie-archdaemon/odysseus.git
synced 2026-10-15 11:22:21 +02:00
Alexandre TeixeiraandLéo
f1a47f3812
* refactor(notes): decompose Notes into feature-owned modules * fix(notes): avoid HTML interpolation in reminder picker * docs(notes): drop checkpoint archives, session logs and publication drafts The N0-N6 tarballs and raw pytest/node logs are not read by any script or test, and the logs carry absolute home-directory paths. Once squashed into dev they would stay in history for good. notes-pr.md and notes-issue.md were the drafts used to open #6712 and #6713, not documentation. notes-validation.md keeps the counts, the checkpoint hashes and implementation.sha256 as the record; local interpreter paths and the local Docker image name are replaced with portable placeholders. * fix(notes): keep the state store raw and stop masonry re-observing after close - state: writes built from views (filter, spread, splice) stored nested read-only views in the store, so structuredClone on a stored note threw DataCloneError. Store writes now unwrap nested views. - layout: a save that resolves after closePanel re-renders the leaving pane and re-created the masonry ResizeObserver that teardown had disposed. Skip creating it once Notes is closed. - index.js: drop 30 imported or declared names that were never used and group the imports at the top. Import order is unchanged. - Revert unrelated punctuation edits in .gitattributes and keep the header comment and docstring first in compare/vote.js and test_notes_dom_xss_helpers.py. Both fixes have a node test that fails on the previous head. * test(notes): make script rejection assertion case-insensitive Address CodeQL js/bad-tag-filter alert #1150 in test-only assertion and refresh Notes evidence manifest checksum. --------- Co-authored-by: Léo <leograndcontact@gmail.com>
40 lines
1.4 KiB
JavaScript
40 lines
1.4 KiB
JavaScript
/** Escaping, safe image sources and link rendering. */
|
|
export function createText({
|
|
uiModule
|
|
}) {
|
|
function _esc(s) { return uiModule.esc ? uiModule.esc(s || '') : (s || '').replace(/</g, '<').replace(/>/g, '>'); }
|
|
|
|
function _attrEsc(s) {
|
|
return String(s || '')
|
|
.replace(/"/g, '"')
|
|
.replace(/'/g, ''')
|
|
.replace(/</g, '<')
|
|
.replace(/>/g, '>')
|
|
.replace(/`/g, '`');
|
|
}
|
|
|
|
function _safeImgSrc(s) {
|
|
const v = (s || '').trim();
|
|
if (!v) return '';
|
|
if (v.startsWith('/') || v.startsWith('./') || v.startsWith('../')) return v;
|
|
if (/^https?:\/\//i.test(v) || /^data:image\/(?:png|jpe?g|gif|webp);base64,/i.test(v)) return v;
|
|
return '';
|
|
}
|
|
|
|
function _linkify(s) {
|
|
const escaped = _esc(s);
|
|
const urlRe = /\b((?:https?:\/\/|www\.)[^\s<>"']+[^\s<>"'.,;:!?\]])/g;
|
|
return escaped.replace(urlRe, (m) => {
|
|
let url = m;
|
|
// Trim a trailing ')' that doesn't have a matching '(' inside the URL
|
|
if (url.endsWith(')') && (url.match(/\(/g) || []).length < (url.match(/\)/g) || []).length) {
|
|
url = url.slice(0, -1);
|
|
}
|
|
const href = url.startsWith('www.') ? `https://${url}` : url;
|
|
return `<a href="${_attrEsc(href)}" class="note-link" target="_blank" rel="noopener noreferrer" onclick="event.stopPropagation()">${url}</a>` + (url !== m ? m.slice(url.length) : '');
|
|
});
|
|
}
|
|
|
|
return { _esc, _attrEsc, _safeImgSrc, _linkify };
|
|
}
|