markdown.ts · Source

markdown.tsapps/api/src/modules/forms/markdown.tsraw ← forms3,734 B← Back to the app
1/**
2 * TASK-0107 §4 — the form-intro markdown sanitizer.
3 *
4 * Spec: allow `p / strong / em / ul / ol / a[href^=http] / br` — NO
5 * scripts, NO iframes, NO attribute injection. No shared sanitizer exists
6 * in the repo (checked `packages/editor` + `packages/ui` first — the
7 * editor's `clipboard.ts` is block conversion, not an HTML sanitizer; the
8 * decision is recorded in the Phase-10 task file per AGENTS rule 29).
9 *
10 * Strategy: (1) HTML-escape the ENTIRE input first (every `<` becomes
11 * `&lt;` — no raw tag can ever reach the output), (2) parse the escaped
12 * text into a strict block grammar (paragraph / ul / ol), (3) apply a
13 * whitelist of inline transforms (strong, em, http(s)-only links). The
14 * only HTML the function can emit is the literal strings it inserts.
15 */
16 
17const MAX_INPUT = 10_000; // defense in depth (config schema caps at 2000)
18 
19function escapeHtml(s: string): string {
20  return s
21    .replace(/&/g, "&amp;")
22    .replace(/</g, "&lt;")
23    .replace(/>/g, "&gt;")
24    .replace(/"/g, "&quot;")
25    .replace(/'/g, "&#39;");
26}
27 
28/** http(s) URLs only — the single allowed attribute value in the output. */
29function safeUrl(raw: string): string | null {
30  const trimmed = raw.trim();
31  if (!/^(https?:\/\/)/i.test(trimmed)) return null;
32  // Control chars / whitespace are already impossible (escaped input,
33  // and `\s` is excluded by the link-capture regex) — this is belt & braces.
34  if (/[\u0000-\u001f]/.test(trimmed)) return null;
35  return trimmed;
36}
37 
38/** Inline transforms over ALREADY-ESCAPED text. Order: bold → em → links. */
39function inline(s: string): string {
40  let out = s;
41  // **bold** / __bold__
42  out = out.replace(/\*\*([^*]+)\*\*/g, "<strong>$1</strong>");
43  out = out.replace(/__([^_]+)__/g, "<strong>$1</strong>");
44  // *em* / _em_ (single, not part of ** — the bold pass already consumed those)
45  out = out.replace(/(^|[^*])\*([^*\n]+)\*/g, "$1<em>$2</em>");
46  out = out.replace(/(^|[^_])_([^_\n]+)_/g, "$1<em>$2</em>");
47  // [label](url) — http(s) only; anything else is left as literal text.
48  out = out.replace(/\[([^\]]+)\]\(([^()\s]+)\)/g, (_m, label: string, url: string) => {
49    const safe = safeUrl(url);
50    if (!safe) return `${label}(${url})`;
51    return `<a href="${safe}" rel="noopener noreferrer" target="_blank">${label}</a>`;
52  });
53  return out;
54}
55 
56/**
57 * Render a form-intro markdown string to the ALLOWED HTML subset.
58 * Never throws (bad input degrades to escaped plain text).
59 */
60export function renderIntroMarkdown(md: string): string {
61  if (typeof md !== "string" || md.length === 0) return "";
62  const source = escapeHtml(md.slice(0, MAX_INPUT));
63  const lines = source.split(/\r?\n/);
64  const blocks: string[] = [];
65  let i = 0;
66 
67  while (i < lines.length) {
68    const line = lines[i];
69    if (line.trim() === "") {
70      i += 1;
71      continue;
72    }
73    const ul = /^\s*[-*]\s+/.test(line);
74    const ol = /^\s*\d+[.)]\s+/.test(line);
75    if (ul || ol) {
76      const items: string[] = [];
77      const re = ul ? /^\s*[-*]\s+(.*)$/ : /^\s*\d+[.)]\s+(.*)$/;
78      while (i < lines.length) {
79        const m = lines[i].match(re);
80        if (!m) break;
81        items.push(`<li>${inline(m[1])}</li>`);
82        i += 1;
83      }
84      const tag = ul ? "ul" : "ol";
85      blocks.push(`<${tag}>${items.join("")}</${tag}>`);
86      continue;
87    }
88    // Paragraph: consume consecutive plain lines (soft breaks → <br>).
89    const para: string[] = [];
90    while (i < lines.length) {
91      const l = lines[i];
92      if (l.trim() === "" || /^\s*[-*]\s+/.test(l) || /^\s*\d+[.)]\s+/.test(l)) break;
93      para.push(inline(l));
94      i += 1;
95    }
96    if (para.length > 0) blocks.push(`<p>${para.join("<br>")}</p>`);
97  }
98 
99  return blocks.join("");
100}
101