tbenandClaude Opus 5.5
ddf431e866
- Add bun test suite: SQL generator and value unit tests, plus MariaDB integration tests gated on BUN_MARIADB_TEST_DB - schema: add --dry-run and require confirmation (or --yes) before dropping tables/columns; block unapproved destructive statements - Always AND targetId with the query, regardless of searchOperator - Initialize lazily on first call; init throws instead of exiting - Generate IN (?, ?, ...) lists for IN / NOT IN - Share value binding between insert and update (booleans, embeddings, function values, "" -> NULL for non-text columns) - Keep Buffers and convert BigInt/Date without a JSON round-trip - DbSQL: report success for empty SELECT results - Run update() in a transaction with row locking - Key the client cache on the full connection config - Consolidate identifier quoting, drop dead code, merge column lookup - Read CLI version from package.json, pin @types/bun, chmod CLI on compile - Rebuild dist Co-Authored-By: Claude Opus 5.5 <[email protected]>
74 lines
1.8 KiB
JavaScript
74 lines
1.8 KiB
JavaScript
export const defaultSanitizeHtmlOptions = {
|
|
allowedTags: [
|
|
"b",
|
|
"i",
|
|
"em",
|
|
"strong",
|
|
"a",
|
|
"p",
|
|
"span",
|
|
"ul",
|
|
"ol",
|
|
"li",
|
|
"h1",
|
|
"h2",
|
|
"h3",
|
|
"h4",
|
|
"h5",
|
|
"h6",
|
|
"img",
|
|
"div",
|
|
"pre",
|
|
"code",
|
|
"br",
|
|
"hr",
|
|
"blockquote",
|
|
"table",
|
|
"tr",
|
|
"td",
|
|
"th",
|
|
"thead",
|
|
"tbody",
|
|
"tfoot",
|
|
"caption",
|
|
"colgroup",
|
|
"col",
|
|
],
|
|
// `style` / `id` are intentionally not allowed by default (CSS overlays,
|
|
// DOM clobbering). Add them via `html_sanitize.allowed_attributes`.
|
|
allowedAttributes: {
|
|
a: ["href", "title", "class", "target", "rel"],
|
|
img: ["src", "alt", "width", "height", "class"],
|
|
"*": ["class", "title"],
|
|
},
|
|
};
|
|
function uniqueStrings(values) {
|
|
return Array.from(new Set(values));
|
|
}
|
|
/**
|
|
* Build sanitize-html options, appending any tags/attributes from config.
|
|
*/
|
|
export default function getSanitizeHtmlOptions(config) {
|
|
const cfg = config || global.CONFIG;
|
|
const extra = cfg?.html_sanitize;
|
|
const baseTags = defaultSanitizeHtmlOptions.allowedTags || [];
|
|
const baseAttrs = {
|
|
...(defaultSanitizeHtmlOptions.allowedAttributes || {}),
|
|
};
|
|
const allowedTags = uniqueStrings([
|
|
...(Array.isArray(baseTags) ? baseTags : []),
|
|
...(extra?.allowed_tags || []),
|
|
]);
|
|
const allowedAttributes = { ...baseAttrs };
|
|
for (const [tag, attrs] of Object.entries(extra?.allowed_attributes || {})) {
|
|
allowedAttributes[tag] = uniqueStrings([
|
|
...(allowedAttributes[tag] || []),
|
|
...attrs,
|
|
]);
|
|
}
|
|
return {
|
|
allowedTags,
|
|
allowedAttributes,
|
|
};
|
|
}
|