├── .gitignore
├── .npmignore
├── .nvmrc
├── .prettierrc.yml
├── .travis.yml
├── LICENSE
├── README.md
├── _dev
    └── steem-content-renderer.code-workspace
├── browser-test
    ├── browser-test.js
    └── index.html
├── package-lock.json
├── package.json
├── sample
    ├── demo-lib.js
    ├── demo-local.js
    └── live-demo.html
├── src
    ├── Log.ts
    ├── RendererError.ts
    ├── index.ts
    ├── renderers
    │   └── default
    │   │   ├── DefaultRenderer.spec.test.ts
    │   │   ├── DefaultRenderer.ts
    │   │   ├── DefaultRendererLocalization.ts
    │   │   ├── StaticConfig.ts
    │   │   ├── _test
    │   │       └── example1.mock.test.ts
    │   │   ├── embedder
    │   │       ├── AssetEmbedder.ts
    │   │       ├── AssetEmbedderOptions.ts
    │   │       ├── HtmlDOMParser.spec.test.ts
    │   │       ├── HtmlDOMParser.ts
    │   │       ├── utils
    │   │       │   ├── AccountNameValidator.ts
    │   │       │   ├── BadActorList.ts
    │   │       │   └── Links.ts
    │   │       └── videoembedders
    │   │       │   ├── AbstractVideoEmbedder.ts
    │   │       │   ├── TwitchEmbedder.ts
    │   │       │   ├── VideoEmbedders.ts
    │   │       │   ├── VimeoEmbedder.ts
    │   │       │   └── YoutubeEmbedder.ts
    │   │   └── sanitization
    │   │       ├── PreliminarySanitizer.ts
    │   │       └── TagTransformingSanitizer.ts
    └── security
    │   ├── LinkSanitizer.spec.test.ts
    │   ├── LinkSanitizer.ts
    │   ├── Phishing.ts
    │   ├── SecurityChecker.spec.test.ts
    │   └── SecurityChecker.ts
├── tsconfig.json
├── tsconfig.lint.json
├── tslint.json
└── webpack.config.js


/.gitignore:
--------------------------------------------------------------------------------
 1 | /dist
 2 | /.DS_Store
 3 | 
 4 | # Logs
 5 | logs
 6 | *.log
 7 | npm-debug.log*
 8 | yarn-debug.log*
 9 | yarn-error.log*
10 | 
11 | # Runtime data
12 | pids
13 | *.pid
14 | *.seed
15 | *.pid.lock
16 | 
17 | # Directory for instrumented libs generated by jscoverage/JSCover
18 | lib-cov
19 | 
20 | # Coverage directory used by tools like istanbul
21 | coverage
22 | 
23 | # nyc test coverage
24 | .nyc_output
25 | 
26 | # Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files)
27 | .grunt
28 | 
29 | # Bower dependency directory (https://bower.io/)
30 | bower_components
31 | 
32 | # node-waf configuration
33 | .lock-wscript
34 | 
35 | # Compiled binary addons (https://nodejs.org/api/addons.html)
36 | build/Release
37 | 
38 | # Dependency directories
39 | node_modules/
40 | jspm_packages/
41 | 
42 | # TypeScript v1 declaration files
43 | typings/
44 | 
45 | # Optional npm cache directory
46 | .npm
47 | 
48 | # Optional eslint cache
49 | .eslintcache
50 | 
51 | # Optional REPL history
52 | .node_repl_history
53 | 
54 | # Output of 'npm pack'
55 | *.tgz
56 | 
57 | # Yarn Integrity file
58 | .yarn-integrity
59 | 
60 | # dotenv environment variables file
61 | .env
62 | 
63 | # next.js build output
64 | .next
65 | 


--------------------------------------------------------------------------------
/.npmignore:
--------------------------------------------------------------------------------
 1 | /_dev
 2 | /.travis.yml
 3 | /.prettierrc.yml
 4 | /TODO
 5 | /README.md
 6 | /LICENSE
 7 | /src
 8 | /.DS_Store
 9 | /sample
10 | /tslint.json
11 | /tsconfig.lint.json
12 | *.test.ts
13 | /dist/browser/statistics.html


--------------------------------------------------------------------------------
/.nvmrc:
--------------------------------------------------------------------------------
1 | v10


--------------------------------------------------------------------------------
/.prettierrc.yml:
--------------------------------------------------------------------------------
1 | trailingComma: all
2 | tabWidth: 4
3 | semi: true
4 | printWidth: 120
5 | singleQuote: false
6 | 


--------------------------------------------------------------------------------
/.travis.yml:
--------------------------------------------------------------------------------
 1 | dist: xenial
 2 | language: node_js
 3 | 
 4 | branches:
 5 |   except:
 6 |     - /^v[0-9]/
 7 | 
 8 | before_install:
 9 |   - npm i -g npm
10 | 
11 | install:
12 |   - npm ci
13 | 
14 | script:
15 |   - NODE_ENV=production npm run build
16 |   - npm run test
17 |   - node sample/demo-local.js
18 |   # Test installation:
19 |   - (mkdir ~/libtest && cp ./sample/demo-lib.js ~/libtest/demo-lib.js && cd ~/libtest && npm install $TRAVIS_BUILD_DIR && node demo-lib.js)
20 | 
21 | deploy:
22 |   - provider: script
23 |     script: npm run semantic-release
24 |     skip_cleanup: true
25 |     on:
26 |       tags: false
27 |       all_branches: true
28 | 
29 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | MIT License
 2 | 
 3 | Copyright (c) 2019 Wise Team
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy
 6 | of this software and associated documentation files (the "Software"), to deal
 7 | in the Software without restriction, including without limitation the rights
 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # steem-content-renderer
 2 | 
 3 | [![npm](https://img.shields.io/npm/v/steem-content-renderer.svg?style=flat-square)](https://www.npmjs.com/package/steem-content-renderer) [![License](https://img.shields.io/github/license/wise-team/steem-content-renderer.svg?style=flat-square)](https://github.com/wise-team/steem-content-renderer/blob/master/LICENSE) [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat-square)](http://makeapullrequest.com) [![Chat](https://img.shields.io/badge/chat%20on%20discord-6b11ff.svg?style=flat-square)](https://discordapp.com/invite/CwxQDbG)
 4 | 
 5 | 👉 **[Online demo](https://wise-team.github.io/steem-content-renderer/sample/live-demo.html)**
 6 | 
 7 | Portable library that renders steem posts and comments to string. It supports markdown and html and mimics the behaviour of condenser frontend.
 8 | 
 9 | Features:
10 | 
11 | -   supports markdown and html
12 | 
13 | -   sanitizes html and protects from XSS
14 | 
15 | **Credit**: this library is based on the code from condenser. It's aim is to allow other projects display steem content the right way without porting the same code over and over.
16 | 
17 | ## Server side usage
18 | 
19 | Installation:
20 | 
21 | ```bash
22 | $ npm install --save steem-content-renderer
23 | ```
24 | 
25 | **Typescript:**
26 | 
27 | ```typescript
28 | import { DefaultRenderer } from "steem-content-renderer";
29 | 
30 | const renderer = new DefaultRenderer({
31 |     baseUrl: "https://steemit.com/",
32 |     breaks: true,
33 |     skipSanitization: false,
34 |     allowInsecureScriptTags: false,
35 |     addNofollowToLinks: true,
36 |     doNotShowImages: false,
37 |     ipfsPrefix: "",
38 |     assetsWidth: 640,
39 |     assetsHeight: 480,
40 |     imageProxyFn: (url: string) => url,
41 |     usertagUrlFn: (account: string) => "/@" + account,
42 |     hashtagUrlFn: (hashtag: string) => "/trending/" + hashtag,
43 |     isLinkSafeFn: (url: string) => true,
44 | });
45 | 
46 | const safeHtmlStr = renderer.render(postContent);
47 | ```
48 | 
49 | ## Browser usage:
50 | 
51 | See [demo](https://wise-team.github.io/steem-content-renderer/sample/live-demo.html) and [its source](https://github.com/wise-team/steem-content-renderer/blob/master/sample/live-demo.html).
52 | 
53 | ```html
54 |         <script src="https://unpkg.com/steem-content-renderer"></script>
55 |         <script>
56 |             const renderer = new SteemContentRenderer.DefaultRenderer({
57 |                 baseUrl: "https://steemit.com/",
58 |                 breaks: true,
59 |                 skipSanitization: false,
60 |                 allowInsecureScriptTags: false,
61 |                 addNofollowToLinks: true,
62 |                 doNotShowImages: false,
63 |                 ipfsPrefix: "",
64 |                 assetsWidth: 640,
65 |                 assetsHeight: 480,
66 |                 imageProxyFn: (url) => url,
67 |                 usertagUrlFn: (account) => "/@" + account,
68 |                 hashtagUrlFn: (hashtag) => "/trending/" + hashtag,
69 |                 isLinkSafeFn: (url) => true,
70 |             });
71 | 
72 |             $(document).ready(() => {
73 |                 const renderMarkdownBtnElem = $("#render-button");
74 |                 const inputElem = $("#input");
75 |                 const outputElem = $("#output");
76 |                 const outputMarkupElem = $("#output-markup");
77 | 
78 |                 renderMarkdownBtnElem.on("click", () => {
79 |                     const input = inputElem.val();
80 |                     const output = renderer.render(input);
81 | 
82 |                     console.log("Rendered", output);
83 |                     outputElem.html(output);
84 |                     outputMarkupElem.text(output);
85 |                 });
86 |             });
87 |         </script>
88 |     </body>
89 | </html>
90 | ```
91 | 


--------------------------------------------------------------------------------
/_dev/steem-content-renderer.code-workspace:
--------------------------------------------------------------------------------
1 | {
2 | 	"folders": [{
3 | 		"path": ".."
4 | 	}],
5 | 	"settings": {
6 | 		"editor.rulers": [110, 120]
7 | 	}
8 | }


--------------------------------------------------------------------------------
/browser-test/browser-test.js:
--------------------------------------------------------------------------------
 1 | import {ClientFunction, Selector} from 'testcafe';
 2 | 
 3 | fixture`Getting Started`
 4 | 	.page`./index.html`;
 5 | 
 6 | const defaultOptions = {
 7 |     baseUrl: "https://steemit.com/",
 8 |     breaks: true,
 9 |     skipSanitization: false,
10 |     allowInsecureScriptTags: false,
11 |     addNofollowToLinks: true,
12 |     doNotShowImages: false,
13 |     ipfsPrefix: "",
14 |     assetsWidth: 640,
15 |     assetsHeight: 480,
16 |     imageProxyFn: (url) => url,
17 |     usertagUrlFn: (account) => `https://steemit.com/@${account}`,
18 |     hashtagUrlFn: (hashtag) => `/trending/${hashtag}`,
19 |     isLinkSafeFn: (url) => true, // !!url.match(/^(\/(?!\/)|https:\/\/steemit.com)/),
20 | };
21 | 
22 | const renderInBrowser = ClientFunction((options, markup) => {
23 |     const renderer = new SteemContentRenderer.DefaultRenderer(options);
24 |     return renderer.render(markup);
25 | });
26 | 
27 | test('Renders properly simple markup', async t => {
28 |     const markup = "# H1"
29 | 
30 |     await t.click(Selector('#awaiter'))
31 |     .expect(renderInBrowser({ ...defaultOptions }, markup)).eql('<h1>H1</h1>\n');
32 | });
33 | 
34 | test('Does not crash on mixed-img markup', async t => {
35 |     const markup = `<img src="![Sacrifice The Truth Logo.jpg](https://cdn.steemitimages.com/DQmUjNstssuPJpjPDDWfRnw1x2tY6AWWKcajDMGpPLA5iJf/Sacrifice%20The%20Truth%20Logo.jpg)"/>`;
36 |     const expected = `<p><img src="brokenimg.jpg" /></p>\n`;
37 | 
38 |     await t.click(Selector('#awaiter'))
39 |     .expect(renderInBrowser({ ...defaultOptions }, markup)).eql(expected);
40 | });


--------------------------------------------------------------------------------
/browser-test/index.html:
--------------------------------------------------------------------------------
 1 | <!DOCTYPE html>
 2 | <html lang="en">
 3 |   <head>
 4 |     <meta charset="utf-8">
 5 |     <title>Browser test of clean-stack</title>
 6 |     <script>
 7 | module = {
 8 |     exports: undefined,
 9 | };
10 |     </script>
11 |     <script src="../dist/browser/steem-content-renderer.min.js"></script>
12 |     <script>
13 |         console.log(SteemContentRenderer.DefaultRenderer);
14 |     </script>
15 |   </head>
16 |   <button id="awaiter">Awaiter</button>
17 |   <body>
18 |   </body>
19 | </html>


--------------------------------------------------------------------------------
/package.json:
--------------------------------------------------------------------------------
  1 | {
  2 |   "name": "steem-content-renderer",
  3 |   "version": "0.0.0-development",
  4 |   "description": "Content renderer for Steem posts and comments. Markdown + HTML",
  5 |   "main": "dist/index.js",
  6 |   "types": "dist/index.d.ts",
  7 |   "unpkg": "dist/browser/steem-content-renderer.min.js",
  8 |   "engines": {
  9 |     "node": ">=8"
 10 |   },
 11 |   "publishConfig": {
 12 |     "access": "public"
 13 |   },
 14 |   "scripts": {
 15 |     "build:cleanbefore": "rm -rf dist",
 16 |     "build:lint": "tslint -c tslint.json -p tsconfig.lint.json",
 17 |     "build:node": "tsc",
 18 |     "build:browser": "rm -rf dist/browser/ && NODE_ENV=production webpack -p --config webpack.config.js",
 19 |     "build": "npm run build:cleanbefore && npm run build:node && npm run build:lint && npm run build:browser",
 20 |     "prepare": "NODE_ENV=production npm run build",
 21 |     "test": "find src -name '*.spec.test.ts' | TS_NODE_FILES=true TS_NODE_CACHE=false TS_NODE_COMPILER_OPTIONS='{\"module\":\"commonjs\"}' xargs mocha -r ts-node/register --require source-map-support/register",
 22 |     "verify": "find src -name '*.integration.test.ts' | TS_NODE_FILES=true TS_NODE_CACHE=false TS_NODE_COMPILER_OPTIONS='{\"module\":\"commonjs\"}' xargs mocha -r ts-node/register --require source-map-support/register",
 23 |     "verify:browser":" testcafe --app-init-timeout 4000 --selector-timeout 2000 --assertion-timeout 2000 chrome browser-test/browser-test.js",
 24 |     "lint-fix": "tslint --fix -c tslint.json -p tsconfig.lint.json",
 25 |     "semantic-release": "semantic-release"
 26 |   },
 27 |   "dependencies": {
 28 |     "ow": "^0.13.2",
 29 |     "remarkable": "^1.7.1",
 30 |     "sanitize-html": "^1.20.1",
 31 |     "typescript-chained-error": "^1.3.2",
 32 |     "universe-log": "^2.1.0",
 33 |     "xmldom": "^0.1.27"
 34 |   },
 35 |   "devDependencies": {
 36 |     "@commitlint/cli": "^8.1.0",
 37 |     "@commitlint/config-conventional": "^8.1.0",
 38 |     "@types/bluebird": "^3.5.27",
 39 |     "@types/chai": "^4.2.0",
 40 |     "@types/chai-as-promised": "^7.1.2",
 41 |     "@types/jsdom": "^12.2.4",
 42 |     "@types/lodash": "^4.14.136",
 43 |     "@types/mocha": "^5.2.7",
 44 |     "@types/node": "^12.7.1",
 45 |     "@types/remarkable": "1.7.3",
 46 |     "@types/sanitize-html": "^1.20.1",
 47 |     "@types/sinon": "^7.0.13",
 48 |     "@types/uuid": "^3.4.5",
 49 |     "@types/xmldom": "^0.1.29",
 50 |     "chai": "^4.2.0",
 51 |     "chai-as-promised": "^7.1.1",
 52 |     "husky": "^3.0.3",
 53 |     "jsdom": "^15.1.1",
 54 |     "lodash": "^4.17.15",
 55 |     "mocha": "^6.2.0",
 56 |     "semantic-release": "^16.0.0-beta.22",
 57 |     "sinon": "^7.4.1",
 58 |     "testcafe": "^1.4.3",
 59 |     "ts-node": "^8.3.0",
 60 |     "tslint": "^5.18.0",
 61 |     "typescript": "^3.5.3",
 62 |     "uuid": "^3.3.2",
 63 |     "webpack": "^4.39.1",
 64 |     "webpack-cli": "^3.3.6",
 65 |     "webpack-visualizer-plugin": "^0.1.11",
 66 |     "wise-tslint-configuration": "^0.2.0"
 67 |   },
 68 |   "commitlint": {
 69 |     "extends": [
 70 |       "@commitlint/config-conventional"
 71 |     ],
 72 |     "rules": {
 73 |       "header-max-length": [
 74 |         0
 75 |       ],
 76 |       "scope-case": [
 77 |         0
 78 |       ]
 79 |     }
 80 |   },
 81 |   "husky": {
 82 |     "hooks": {
 83 |       "commit-msg": "commitlint -E HUSKY_GIT_PARAMS"
 84 |     }
 85 |   },
 86 |   "repository": {
 87 |     "type": "git",
 88 |     "url": "https://github.com/wise-team/steem-content-renderer"
 89 |   },
 90 |   "keywords": [
 91 |     "steem",
 92 |     "markdown",
 93 |     "renderer",
 94 |     "blockchain"
 95 |   ],
 96 |   "author": "The Wise Team (https://wise-team.io/)",
 97 |   "contributors": [
 98 |     "Jędrzej Lewandowski <jedrzejblew@gmail.com> (https://jedrzej.lewandowski.doctor/)"
 99 |   ],
100 |   "license": "MIT",
101 |   "bugs": {
102 |     "url": "https://github.com/wise-team/steem-content-renderer/issues"
103 |   },
104 |   "homepage": "https://engrave.website/"
105 | }
106 | 


--------------------------------------------------------------------------------
/sample/demo-lib.js:
--------------------------------------------------------------------------------
 1 | const SteemContentRenderer = require("steem-content-renderer");
 2 | 
 3 | const renderer = new SteemContentRenderer.DefaultRenderer({
 4 |     baseUrl: "https://steemit.com/",
 5 |     breaks: true,
 6 |     skipSanitization: false,
 7 |     allowInsecureScriptTags: false,
 8 |     addNofollowToLinks: true,
 9 |     doNotShowImages: false,
10 |     ipfsPrefix: "",
11 |     assetsWidth: 640,
12 |     assetsHeight: 480,
13 |     imageProxyFn: (url) => url,
14 |     usertagUrlFn: (account) => "/@" + account,
15 |     hashtagUrlFn: (hashtag) => "/trending/" + hashtag,
16 |     isLinkSafeFn: (url) => true,
17 | });
18 | 
19 | const input = `
20 | # Sample post
21 | 
22 | and some content
23 | 
24 | Lets mention @ned #stark.
25 | `;
26 | 
27 | const output = renderer.render(input);
28 | 
29 | console.log();
30 | console.log("+-----------------------------+");
31 | console.log("| Steem-content-renderer demo |");
32 | console.log("+-----------------------------+");
33 | console.log();
34 | console.log(output);
35 | console.log();
36 | console.log();


--------------------------------------------------------------------------------
/sample/demo-local.js:
--------------------------------------------------------------------------------
 1 | const SteemContentRenderer = require("../dist/index");
 2 | 
 3 | const renderer = new SteemContentRenderer.DefaultRenderer({
 4 |     baseUrl: "https://steemit.com/",
 5 |     breaks: true,
 6 |     skipSanitization: false,
 7 |     allowInsecureScriptTags: false,
 8 |     addNofollowToLinks: true,
 9 |     doNotShowImages: false,
10 |     ipfsPrefix: "",
11 |     assetsWidth: 640,
12 |     assetsHeight: 480,
13 |     imageProxyFn: (url) => url,
14 |     usertagUrlFn: (account) => "/@" + account,
15 |     hashtagUrlFn: (hashtag) => "/trending/" + hashtag,
16 |     isLinkSafeFn: (url) => true,
17 | });
18 | 
19 | const input = `
20 | # Sample post
21 | 
22 | and some content
23 | 
24 | Lets mention @ned #stark.
25 | `;
26 | 
27 | const output = renderer.render(input);
28 | 
29 | console.log();
30 | console.log("+-----------------------------+");
31 | console.log("| Steem-content-renderer demo |");
32 | console.log("+-----------------------------+");
33 | console.log();
34 | console.log(output);
35 | console.log();
36 | console.log();


--------------------------------------------------------------------------------
/sample/live-demo.html:
--------------------------------------------------------------------------------
  1 | <!doctype html>
  2 | <html>
  3 |     <head>
  4 |         <meta charset="UTF-8">
  5 |         <meta name="viewport" content="width=device-width, height=device-height, user-scalable=no, initial-scale=1.0"/>
  6 |         <title>Steem-content-renderer live demo</title>
  7 |         <style>
  8 |             /* source: https://github.com/setetres/evenbettermotherfuckingwebsite */
  9 |             body {margin: 5% auto; padding: 0 3rem; background: #f2f2f2; color: #444444; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif; font-size: 16px; line-height: 1.8; text-shadow: 0 1px 0 #ffffff; max-width: 800px;}
 10 |             code {background: white;}
 11 |             a {border-bottom: 1px solid #444444; color: #444444; text-decoration: none;}
 12 |             a:hover {border-bottom: 0;}
 13 |             /**/
 14 |             h1 { font-size: 2.2em; }
 15 |             h2, h3, h4, h5 { margin-bottom: 0; }
 16 |             #output {
 17 |                 border: 1px solid #777;
 18 |                 padding: 0.5rem;
 19 |             }
 20 |             #output-markup {
 21 |                 width: 100%;
 22 |                 padding: 0.5rem;
 23 |                 background: #eee;
 24 |                 border: 1px solid #777;
 25 |                 overflow-x: scroll;
 26 |             }
 27 |             #render-button-container {
 28 |                 text-align: center;
 29 |             }
 30 |             #render-button {
 31 |                 padding: 0.5rem;
 32 |                 font-size: 1.2em;
 33 |                 border-radius: 0.5rem 0.5rem;
 34 |             }
 35 |             .load-post-form {
 36 |                 text-align: right;
 37 |             }
 38 |             header small {
 39 |                 color: #999;
 40 |                 font-size: 50%;
 41 |             }
 42 |             img {
 43 |                 max-width: 100%;
 44 |             }
 45 |         </style>
 46 |     </head>
 47 |     <body>
 48 |         <header>
 49 |             <h1>Steem-content-renderer <small>example</small></h1>
 50 |             <aside>
 51 |                 Steem-content-renderer is aimed at unifying post rendering across all Steem interfaces.
 52 |                 The rendering code was extracted from 
 53 |                 <a href="https://github.com/steemit/condenser">condenser by Steemit</a>, refactored, tested
 54 |                 and bundled into a standalone library. This approach allows independedt development and 
 55 |                 continous improvement of post rendering in Steem blockchain. As for now it is fully compatible
 56 |                 with the Steemit way of rendering posts. See 
 57 |                 the <a href="https://github.com/wise-team/steem-content-renderer">repository</a>, integrate into your project,
 58 |                 star, make pull requests and create issues. Let's make the project alive!
 59 |                 <hr />
 60 |                 This example uses some markdown and transforms it to html. The library is loaded from the
 61 |                 unpkg CDN: <em><a href="https://unpkg.com/steem-content-renderer">https://unpkg.com/steem-content-renderer</a></em>.
 62 |             </aside>
 63 |         </header>
 64 | 
 65 |         <h2>Render markdown:</h2>
 66 |         <div class="load-post-form">
 67 |             Link to post (busy or steemit): <input type="text" id="post-link-input">
 68 |             <button id="load-post-button">Load steem post</button></div>
 69 |         <textarea rows="12" style="width: 100%;" id="input">
 70 | # Sample post
 71 | and some content.
 72 | 
 73 | Let's mention @ned
 74 | or include a tag #steem. 
 75 | 
 76 | https://youtu.be/B7C83L6iWJQ
 77 | 
 78 |         </textarea>
 79 |         <p id="render-button-container"><button id="render-button">Render markdown</button></p>
 80 | 
 81 |         <h2>Output:</h2>
 82 |         <p id="output">
 83 |             ...press the button...
 84 |         </p>
 85 |         <br />
 86 | 
 87 |         <h2>Generated HTML markup</h2>
 88 |         <pre id="output-markup">
 89 |             ...press the button...
 90 |         </pre>
 91 |         
 92 |         <script src="https://cdn.steemjs.com/lib/latest/steem.min.js"></script>
 93 |         <script src="https://unpkg.com/jquery"></script>
 94 |         <script src="https://unpkg.com/steem-content-renderer@latest"></script>
 95 |         <!--<script src="../dist/browser/steem-content-renderer.min.js"></script>-->
 96 |         <script>
 97 |             const renderer = new SteemContentRenderer.DefaultRenderer({
 98 |                 baseUrl: "https://steemit.com/",
 99 |                 breaks: true,
100 |                 skipSanitization: false,
101 |                 allowInsecureScriptTags: false,
102 |                 addNofollowToLinks: true,
103 |                 doNotShowImages: false,
104 |                 ipfsPrefix: "",
105 |                 assetsWidth: 640,
106 |                 assetsHeight: 480,
107 |                 imageProxyFn: (url) => url,
108 |                 usertagUrlFn: (account) => "https://steemit.com/@" + account,
109 |                 hashtagUrlFn: (hashtag) => "https://steemit.com/trending/" + hashtag,
110 |                 isLinkSafeFn: (url) => true,
111 |             });
112 | 
113 |             $(document).ready(() => {
114 |                 const renderMarkdownBtnElem = $("#render-button");
115 |                 const inputElem = $("#input");
116 |                 const outputElem = $("#output");
117 |                 const outputMarkupElem = $("#output-markup");
118 |                 const loadPostButton = $("#load-post-button");
119 |                 const postLinkInput = $("#post-link-input");
120 | 
121 |                 function setOutput(output) {
122 |                     outputElem.html(output);
123 |                     outputMarkupElem.text(output);
124 |                 }
125 | 
126 |                 function render() {
127 |                     const input = inputElem.val();
128 |                     const output = renderer.render(input);
129 |                     
130 |                     console.log("Rendered", output);
131 |                     setOutput(output);
132 |                 }
133 | 
134 |                 function getAuthorAndPermlinkFromLink(link) {
135 |                     let author = "";
136 |                     let permlink = "";
137 |                     if (link.length > 0) {
138 |                         /* tslint:disable max-line-length */
139 |                         const regex = /^\/?(?:https?:\/\/(?:steemit\.com|busy\.org))?(?:\/?[^\/\n]*\/)?@?([^\/\n]+)\/([^\/\n]+)$/giu;
140 |                         /* tslint:disable max-line-length */
141 |                         const match = regex.exec(link);
142 |                         if (match && match.length > 1) {
143 |                             author = match[1];
144 |                             permlink = match[2];
145 |                         }
146 |                     }
147 |                     return { author, permlink };
148 |                 }
149 | 
150 |                 renderMarkdownBtnElem.on("click", () => render());
151 | 
152 |                 loadPostButton.on("click", () => {
153 |                     const postLink = postLinkInput.val();
154 |                     const { author, permlink } = getAuthorAndPermlinkFromLink(postLink);
155 |                     if (!author || author.length === 0 || !permlink || permlink.length === 0) {
156 |                         inputElem.text("Author or permlink is missing...");
157 |                         return;
158 |                     }
159 | 
160 |                     inputElem.text("Loading post @" + author + "/" + permlink + " ...");
161 |                     (async () => {
162 |                         try {
163 |                             const post = await steem.api.getContentAsync(author, permlink);
164 |                             const postMarkdown = post.body;
165 |                             console.log("Content loaded", postMarkdown);
166 |                             inputElem.text(postMarkdown);
167 |                             render();
168 |                         }
169 |                         catch (error) {
170 |                             inputElem.text("Error while loading post @" + author + "/" + permlink + ": " + error);
171 |                         }
172 |                     })();
173 | 
174 |                 });
175 |             });
176 |         </script>
177 |     </body>
178 | </html>


--------------------------------------------------------------------------------
/src/Log.ts:
--------------------------------------------------------------------------------
 1 | import { AbstractUniverseLog } from "universe-log";
 2 | 
 3 | export class Log extends AbstractUniverseLog {
 4 |     public static log(): Log {
 5 |         return Log.INSTANCE;
 6 |     }
 7 |     private static INSTANCE: Log = new Log();
 8 | 
 9 |     private constructor() {
10 |         super({
11 |             levelEnvs: ["STEEM_CONTENT_RENDERER_LOG_LEVEL", "ENGRAVE_LOG_LEVEL"],
12 |             metadata: {
13 |                 library: "steem-content-renderer",
14 |             },
15 |         });
16 |     }
17 | 
18 |     public initialize() {
19 |         super.init();
20 |     }
21 | 
22 |     public init() {
23 |         throw new Error("Instead of #init() please call #initialize() which indirectly overrides init");
24 |     }
25 | }
26 | 


--------------------------------------------------------------------------------
/src/RendererError.ts:
--------------------------------------------------------------------------------
1 | import ChainedError from "typescript-chained-error";
2 | 
3 | export class RendererError extends ChainedError {
4 |     public constructor(message?: string, cause?: Error) {
5 |         super(message, cause);
6 |     }
7 | }
8 | 


--------------------------------------------------------------------------------
/src/index.ts:
--------------------------------------------------------------------------------
1 | import { DefaultRenderer } from "./renderers/default/DefaultRenderer";
2 | export { DefaultRenderer } from "./renderers/default/DefaultRenderer";
3 | 
4 | export const SteemContentRenderer = {
5 |     DefaultRenderer,
6 | };
7 | 
8 | export default SteemContentRenderer;
9 | 


--------------------------------------------------------------------------------
/src/renderers/default/DefaultRenderer.spec.test.ts:
--------------------------------------------------------------------------------
  1 | // tslint:disable max-line-length quotemark
  2 | 
  3 | import { expect } from "chai";
  4 | import { JSDOM } from "jsdom";
  5 | import "mocha";
  6 | 
  7 | import { Log } from "../../Log";
  8 | 
  9 | import { DefaultRenderer } from "./DefaultRenderer";
 10 | 
 11 | describe("DefaultRender", () => {
 12 |     const defaultOptions: DefaultRenderer.Options = {
 13 |         baseUrl: "https://steemit.com/",
 14 |         breaks: true,
 15 |         skipSanitization: false,
 16 |         allowInsecureScriptTags: false,
 17 |         addNofollowToLinks: true,
 18 |         doNotShowImages: false,
 19 |         ipfsPrefix: "",
 20 |         assetsWidth: 640,
 21 |         assetsHeight: 480,
 22 |         imageProxyFn: (url: string) => url,
 23 |         usertagUrlFn: (account: string) => `https://steemit.com/@${account}`,
 24 |         hashtagUrlFn: (hashtag: string) => `/trending/${hashtag}`,
 25 |         isLinkSafeFn: (url: string) => true, // !!url.match(/^(\/(?!\/)|https:\/\/steemit.com)/),
 26 |     };
 27 | 
 28 |     const tests = [
 29 |         { name: "Renders H1 headers correctly", raw: `# Header H1`, expected: "<h1>Header H1</h1>" },
 30 |         { name: "Renders H4 headers correctly", raw: `#### Header H4`, expected: "<h4>Header H4</h4>" },
 31 |         {
 32 |             name: "Renders headers and paragraphs correctly",
 33 |             raw: "# Header H1\n\nSome paragraph\n\n## Header H2\n\nAnother paragraph",
 34 |             expected: "<h1>Header H1</h1>\n<p>Some paragraph</p>\n<h2>Header H2</h2>\n<p>Another paragraph</p>",
 35 |         },
 36 |         {
 37 |             name: "Renders steem mentions correctly",
 38 |             raw: "Content @noisy another content",
 39 |             expected: '<p>Content <a href="https://steemit.com/@noisy">@noisy</a> another content</p>',
 40 |         },
 41 |         {
 42 |             name: "Renders steem hashtags correctly",
 43 |             raw: "Content #pl-nuda another content",
 44 |             expected: '<p>Content <a href="/trending/pl-nuda">#pl-nuda</a> another content</p>',
 45 |         },
 46 |         {
 47 |             name: "Embeds correctly vimeo video via paste",
 48 |             raw:
 49 |                 '<iframe src="https://player.vimeo.com/video/174544848?byline=0" width="640" height="360" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe>',
 50 |             expected:
 51 |                 '<div class="videoWrapper"><iframe frameborder="0" allowfullscreen="allowfullscreen" webkitallowfullscreen="webkitallowfullscreen" mozallowfullscreen="mozallowfullscreen" src="https://player.vimeo.com/video/174544848" width="640" height="480"></iframe></div>',
 52 |         },
 53 |         {
 54 |             name: "Embeds correctly youtube video via paste",
 55 |             raw:
 56 |                 '<iframe width="560" height="315" src="https://www.youtube.com/embed/0nFkmd-A7jA" frameborder="0" allowfullscreen></iframe>',
 57 |             expected:
 58 |                 '<div class="videoWrapper"><iframe width="640" height="480" src="https://www.youtube.com/embed/0nFkmd-A7jA" allowfullscreen="allowfullscreen" webkitallowfullscreen="webkitallowfullscreen" mozallowfullscreen="mozallowfullscreen" frameborder="0"></iframe></div>',
 59 |         },
 60 |         {
 61 |             name: "Embeds correctly youtube video via youtube.com link",
 62 |             raw: "https://www.youtube.com/embed/0nFkmd-A7jA",
 63 |             expected:
 64 |                 '<p><div class="videoWrapper"><iframe width="640" height="480" src="https://www.youtube.com/embed/0nFkmd-A7jA" allowfullscreen="allowfullscreen" webkitallowfullscreen="webkitallowfullscreen" mozallowfullscreen="mozallowfullscreen" frameborder="0"></iframe></div></p>',
 65 |         },
 66 |         {
 67 |             name: "Embeds correctly youtube video via youtu.be link",
 68 |             raw: "https://www.youtu.be/0nFkmd-A7jA",
 69 |             expected:
 70 |                 '<p><div class="videoWrapper"><iframe width="640" height="480" src="https://www.youtube.com/embed/0nFkmd-A7jA" allowfullscreen="allowfullscreen" webkitallowfullscreen="webkitallowfullscreen" mozallowfullscreen="mozallowfullscreen" frameborder="0"></iframe></div></p>',
 71 |         },
 72 |         {
 73 |             name: "Allows links embedded via <a> tags",
 74 |             raw:
 75 |                 "<a href='https://steemit.com/utopian-io/@blockchainstudio/drugswars-revenue-and-transaction-analysis'>Drugwars - revenue and transaction analysis</a>",
 76 |             expected:
 77 |                 '<p><a href="https://steemit.com/utopian-io/@blockchainstudio/drugswars-revenue-and-transaction-analysis">Drugwars - revenue and transaction analysis</a></p>',
 78 |         },
 79 | 
 80 |         {
 81 |             name: "Allows links embedded via <a> tags inside of markdown headers",
 82 |             raw:
 83 |                 "## <a href='https://steemit.com/utopian-io/@blockchainstudio/drugswars-revenue-and-transaction-analysis'>Drugwars - revenue and transaction analysis</a>",
 84 |             expected:
 85 |                 '<h2><a href="https://steemit.com/utopian-io/@blockchainstudio/drugswars-revenue-and-transaction-analysis">Drugwars - revenue and transaction analysis</a></h2>',
 86 |         },
 87 |     ];
 88 | 
 89 |     tests.forEach(test =>
 90 |         it(test.name, () => {
 91 |             const renderer = new DefaultRenderer(defaultOptions);
 92 |             const rendered = renderer.render(test.raw).trim();
 93 | 
 94 |             const renderedNode = JSDOM.fragment(rendered);
 95 |             const comparisonNode = JSDOM.fragment(test.expected);
 96 | 
 97 |             Log.log().debug("rendered", rendered);
 98 |             Log.log().debug("expected", test.expected);
 99 | 
100 |             expect(renderedNode.isEqualNode(comparisonNode)).to.be.equal(true);
101 |         }),
102 |     );
103 | 
104 |     it("Allows insecure script tags when allowInsecureScriptTags = true", () => {
105 |         const renderer = new DefaultRenderer({ ...defaultOptions, allowInsecureScriptTags: true });
106 |         const insecureContent = '<script src="">';
107 |         renderer.render(insecureContent);
108 |     });
109 | 
110 |     it("Does not allow insecure script tags when allowInsecureScriptTags = false", () => {
111 |         const renderer = new DefaultRenderer({
112 |             ...defaultOptions,
113 |             skipSanitization: true,
114 |             allowInsecureScriptTags: false,
115 |         });
116 |         const insecureContent = '<script src="">';
117 |         expect(() => renderer.render(insecureContent)).to.throw(/insecure content/);
118 |     });
119 | 
120 |     it("Rejects mixed image tag", () => {
121 |         const renderer = new DefaultRenderer({ ...defaultOptions });
122 |         const markup = `<img src="![img.jpg](https://img.jpg)"/>`;
123 |         const rendered = renderer.render(markup);
124 | 
125 |         const expected = `<p><img src="brokenimg.jpg" /></p>\n`;
126 |         expect(rendered).to.be.equal(expected);
127 |     });
128 | });
129 | 


--------------------------------------------------------------------------------
/src/renderers/default/DefaultRenderer.ts:
--------------------------------------------------------------------------------
  1 | import ow from "ow";
  2 | import * as Remarkable from "remarkable";
  3 | 
  4 | import { SecurityChecker } from "../../security/SecurityChecker";
  5 | 
  6 | import { DefaultRendererLocalization } from "./DefaultRendererLocalization";
  7 | import { AssetEmbedder } from "./embedder/AssetEmbedder";
  8 | import { PreliminarySanitizer } from "./sanitization/PreliminarySanitizer";
  9 | import { TagTransformingSanitizer } from "./sanitization/TagTransformingSanitizer";
 10 | 
 11 | export class DefaultRenderer {
 12 |     private options: DefaultRenderer.Options;
 13 |     private tagTransformingSanitizer: TagTransformingSanitizer;
 14 |     private embedder: AssetEmbedder;
 15 | 
 16 |     public constructor(
 17 |         options: DefaultRenderer.Options,
 18 |         localization: DefaultRendererLocalization = DefaultRendererLocalization.DEFAULT,
 19 |     ) {
 20 |         DefaultRenderer.Options.validate(options);
 21 |         this.options = options;
 22 | 
 23 |         DefaultRendererLocalization.validate(localization);
 24 | 
 25 |         this.tagTransformingSanitizer = new TagTransformingSanitizer(
 26 |             {
 27 |                 iframeWidth: this.options.assetsWidth,
 28 |                 iframeHeight: this.options.assetsHeight,
 29 |                 addNofollowToLinks: this.options.addNofollowToLinks,
 30 |                 noImage: this.options.doNotShowImages,
 31 |                 isLinkSafeFn: this.options.isLinkSafeFn,
 32 |             },
 33 |             localization,
 34 |         );
 35 | 
 36 |         this.embedder = new AssetEmbedder(
 37 |             {
 38 |                 ipfsPrefix: this.options.ipfsPrefix,
 39 |                 width: this.options.assetsWidth,
 40 |                 height: this.options.assetsHeight,
 41 |                 hideImages: this.options.doNotShowImages,
 42 |                 imageProxyFn: this.options.imageProxyFn,
 43 |                 hashtagUrlFn: this.options.hashtagUrlFn,
 44 |                 usertagUrlFn: this.options.usertagUrlFn,
 45 |                 baseUrl: this.options.baseUrl,
 46 |             },
 47 |             localization,
 48 |         );
 49 |     }
 50 | 
 51 |     public render(input: string): string {
 52 |         ow(input, "input", ow.string.nonEmpty);
 53 |         return this.doRender(input);
 54 |     }
 55 | 
 56 |     private doRender(text: string): string {
 57 |         text = PreliminarySanitizer.preliminarySanitize(text);
 58 | 
 59 |         const isHtml = this.isHtml(text);
 60 |         text = isHtml ? text : this.renderMarkdown(text);
 61 | 
 62 |         text = this.wrapRenderedTextWithHtmlIfNeeded(text);
 63 |         text = this.embedder.markAssets(text);
 64 |         text = this.sanitize(text);
 65 |         SecurityChecker.checkSecurity(text, { allowScriptTag: this.options.allowInsecureScriptTags });
 66 |         text = this.embedder.insertAssets(text);
 67 | 
 68 |         return text;
 69 |     }
 70 | 
 71 |     private renderMarkdown(text: string): string {
 72 |         const renderer = new Remarkable({
 73 |             html: true, // remarkable renders first then sanitize runs...
 74 |             breaks: this.options.breaks,
 75 |             linkify: false, // linkify is done locally
 76 |             typographer: false, // https://github.com/jonschlinkert/remarkable/issues/142#issuecomment-221546793
 77 |             quotes: "“”‘’",
 78 |         });
 79 |         return renderer.render(text);
 80 |     }
 81 | 
 82 |     private wrapRenderedTextWithHtmlIfNeeded(renderedText: string): string {
 83 |         // If content isn't wrapped with an html element at this point, add it.
 84 |         if (renderedText.indexOf("<html>") !== 0) {
 85 |             renderedText = "<html>" + renderedText + "</html>";
 86 |         }
 87 |         return renderedText;
 88 |     }
 89 | 
 90 |     private isHtml(text: string): boolean {
 91 |         let html = false;
 92 |         // See also ReplyEditor isHtmlTest
 93 |         const m = text.match(/^<html>([\S\s]*)<\/html>$/);
 94 |         if (m && m.length === 2) {
 95 |             html = true;
 96 |             text = m[1];
 97 |         } else {
 98 |             // See also ReplyEditor isHtmlTest
 99 |             html = /^<p>[\S\s]*<\/p>/.test(text);
100 |         }
101 |         return html;
102 |     }
103 | 
104 |     private sanitize(text: string): string {
105 |         if (this.options.skipSanitization) {
106 |             return text;
107 |         }
108 | 
109 |         return this.tagTransformingSanitizer.sanitize(text);
110 |     }
111 | }
112 | 
113 | export namespace DefaultRenderer {
114 |     export interface Options {
115 |         baseUrl: string;
116 |         breaks: boolean;
117 |         skipSanitization: boolean;
118 |         allowInsecureScriptTags: boolean;
119 |         addNofollowToLinks: boolean;
120 |         doNotShowImages: boolean;
121 |         ipfsPrefix: string;
122 |         assetsWidth: number;
123 |         assetsHeight: number;
124 |         imageProxyFn: (url: string) => string;
125 |         hashtagUrlFn: (hashtag: string) => string;
126 |         usertagUrlFn: (account: string) => string;
127 |         isLinkSafeFn: (url: string) => boolean;
128 |     }
129 | 
130 |     export namespace Options {
131 |         export function validate(o: Options) {
132 |             ow(o.baseUrl, "Options.baseUrl", ow.string.nonEmpty);
133 |             ow(o.breaks, "Options.breaks", ow.boolean);
134 |             ow(o.skipSanitization, "Options.skipSanitization", ow.boolean);
135 |             ow(o.addNofollowToLinks, "Options.addNofollowToLinks", ow.boolean);
136 |             ow(o.doNotShowImages, "Options.doNotShowImages", ow.boolean);
137 |             ow(o.ipfsPrefix, "Options.ipfsPrefix", ow.string);
138 |             ow(o.assetsWidth, "Options.assetsWidth", ow.number.integer.positive);
139 |             ow(o.assetsHeight, "Options.assetsHeight", ow.number.integer.positive);
140 |             ow(o.imageProxyFn, "Options.imageProxyFn", ow.function);
141 |             ow(o.hashtagUrlFn, "Options.hashtagUrlFn", ow.function);
142 |             ow(o.usertagUrlFn, "Options.usertagUrlFn", ow.function);
143 |             ow(o.isLinkSafeFn, "TagTransformingSanitizer.Options.isLinkSafeFn", ow.function);
144 |         }
145 |     }
146 | }
147 | 


--------------------------------------------------------------------------------
/src/renderers/default/DefaultRendererLocalization.ts:
--------------------------------------------------------------------------------
 1 | import ow from "ow";
 2 | 
 3 | export interface DefaultRendererLocalization {
 4 |     phishingWarning: string; // "Link expanded to plain text; beware of a potential phishing attempt"
 5 |     externalLink: string; // "This link will take you away from example.com"
 6 |     noImage: string; // "Images not allowed"
 7 |     accountNameWrongLength: string; // "Account name should be between 3 and 16 characters long."
 8 |     accountNameBadActor: string; // "This account is on a bad actor list"
 9 |     accountNameWrongSegment: string; // "This account name contains a bad segment"
10 | }
11 | 
12 | export namespace DefaultRendererLocalization {
13 |     export function validate(o: DefaultRendererLocalization) {
14 |         ow(o, "DefaultRendererLocalization", ow.object);
15 |         ow(o.phishingWarning, "DefaultRendererLocalization.phishingWarningMessage", ow.string.nonEmpty);
16 |         ow(o.externalLink, "DefaultRendererLocalization.externalLink", ow.string.nonEmpty);
17 |         ow(o.noImage, "DefaultRendererLocalization.noImage", ow.string.nonEmpty);
18 |         ow(o.accountNameWrongLength, "DefaultRendererLocalization.accountNameWrongLength", ow.string.nonEmpty);
19 |         ow(o.accountNameBadActor, "DefaultRendererLocalization.accountNameBadActor", ow.string.nonEmpty);
20 |         ow(o.accountNameWrongSegment, "DefaultRendererLocalization.accountNameWrongSegment", ow.string.nonEmpty);
21 |     }
22 | 
23 |     export const DEFAULT: DefaultRendererLocalization = {
24 |         phishingWarning: "Link expanded to plain text; beware of a potential phishing attempt",
25 |         externalLink: "This link will take you away from example.com",
26 |         noImage: "Images not allowed",
27 |         accountNameWrongLength: "Account name should be between 3 and 16 characters long",
28 |         accountNameBadActor: "This account is on a bad actor list",
29 |         accountNameWrongSegment: "This account name contains a bad segment",
30 |     };
31 | }
32 | 


--------------------------------------------------------------------------------
/src/renderers/default/StaticConfig.ts:
--------------------------------------------------------------------------------
 1 | /**
 2 |  * This file is based on
 3 |  *  - https://github.com/steemit/condenser/blob/master/src/app/utils/SanitizeConfig.js
 4 |  */
 5 | // tslint:disable max-line-length
 6 | export class StaticConfig {
 7 |     public static sanitization = {
 8 |         iframeWhitelist: [
 9 |             {
10 |                 re: /^(https?:)?\/\/player.vimeo.com\/video\/.*/i,
11 |                 fn: (src: string) => {
12 |                     // <iframe src="https://player.vimeo.com/video/179213493" width="640" height="360" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe>
13 |                     if (!src) {
14 |                         return null;
15 |                     }
16 |                     const m = src.match(/https:\/\/player\.vimeo\.com\/video\/([0-9]+)/);
17 |                     if (!m || m.length !== 2) {
18 |                         return null;
19 |                     }
20 |                     return "https://player.vimeo.com/video/" + m[1];
21 |                 },
22 |             },
23 |             {
24 |                 re: /^(https?:)?\/\/www.youtube.com\/embed\/.*/i,
25 |                 fn: (src: string) => {
26 |                     return src.replace(/\?.+$/, ""); // strip query string (yt: autoplay=1,controls=0,showinfo=0, etc)
27 |                 },
28 |             },
29 |             {
30 |                 re: /^https:\/\/w.soundcloud.com\/player\/.*/i,
31 |                 fn: (src: string) => {
32 |                     if (!src) {
33 |                         return null;
34 |                     }
35 |                     // <iframe width="100%" height="450" scrolling="no" frameborder="no" src="https://w.soundcloud.com/player/?url=https%3A//api.soundcloud.com/tracks/257659076&amp;auto_play=false&amp;hide_related=false&amp;show_comments=true&amp;show_user=true&amp;show_reposts=false&amp;visual=true"></iframe>
36 |                     const m = src.match(/url=(.+?)&/);
37 |                     if (!m || m.length !== 2) {
38 |                         return null;
39 |                     }
40 |                     return (
41 |                         "https://w.soundcloud.com/player/?url=" +
42 |                         m[1] +
43 |                         "&auto_play=false&hide_related=false&show_comments=true" +
44 |                         "&show_user=true&show_reposts=false&visual=true"
45 |                     );
46 |                 },
47 |             },
48 |             {
49 |                 re: /^(https?:)?\/\/player.twitch.tv\/.*/i,
50 |                 fn: (src: string) => {
51 |                     // <iframe src="https://player.twitch.tv/?channel=ninja" frameborder="0" allowfullscreen="true" scrolling="no" height="378" width="620">
52 |                     return src;
53 |                 },
54 |             },
55 |         ],
56 |         noImageText: "(Image not shown due to low ratings)",
57 |         allowedTags: `
58 |     div, iframe, del,
59 |     a, p, b, i, q, br, ul, li, ol, img, h1, h2, h3, h4, h5, h6, hr,
60 |     blockquote, pre, code, em, strong, center, table, thead, tbody, tr, th, td,
61 |     strike, sup, sub
62 | `
63 |             .trim()
64 |             .split(/,\s*/),
65 |     };
66 | }
67 | 


--------------------------------------------------------------------------------
/src/renderers/default/_test/example1.mock.test.ts:
--------------------------------------------------------------------------------
 1 | // tslint:disable
 2 | 
 3 | /**
 4 |  * https://steemit.com/steemit/@steemitblog/wallet-app-soft-roll-out-is-live
 5 |  */
 6 | 
 7 | export const raw = `
 8 | ![Major post copy.png](https://cdn.steemitimages.com/DQmTcGq5DXga8RbFeFjuzUXkLPBBi4MUk1WRUqgdnb4Dr6G/Major%20post%20copy.png)
 9 | 
10 | In our [engineering update released earlier today](https://steemit.com/steemit/@steemitblog/engineering-update-all-team-meeting-condenser-split) we announced that we would soft roll-out the new Wallet app. Well, we are now happy to announce the soft roll-out of the new Wallet application! To see what we mean, head on over to [steemitwallet.com](https://steemitwallet.com). For the time being, a full version of Condenser will be running on steemit.com, but once the Wallet app has been sufficiently tested, the new Social app will be rolled out to steemit.com. At that time, users who attempt to access their Steem wallet will be redirected to [steemitwallet.com](https://steemitwallet.com), so it was very important to maintain a consistent user experience. At that point, the Condenser Split will be complete.
11 | 
12 | <h1>Check It Out</h1>
13 | 
14 | The reason we are following this soft rollout strategy is so that users can begin familiarizing themselves with this new application, so be sure to head on over to [steemitwallet.com](https://steemitwallet.com) to see what the experience is like. One change you will see on steemit.com is that when you try to sign in with your Active or Owner Key, you will now receive the following warning:
15 | 
16 | 
17 | ![login-with-posting-key](https://cdn.steemitimages.com/DQmRyYMhuAyRHjocXHPqTPByr7Gx8LubotqF2rwY6rgk996/logging-in-with-posting-key.png)
18 | 
19 | The goal is to make the User Experience between the two applications as seamless as possible, so if you notice anything disruptive in this experience, please leave us feedback in the comments section below. 
20 | 
21 | <h1>The Mission</h1>
22 | 
23 | Our Mission at Steemit is to help build great online communities with financial inclusion. To that end, we envision a vibrant communities web application that features cryptocurrency incentives, the development of which is economically sustainable and scalable. Splitting Condenser into separate Social and Wallet applications will constitute a major step toward accomplishing our mission by enabling us to improve each application faster, consume fewer resources, and generate more revenue, while maximizing user security by enhancing the client-side signing experience.  
24 | 
25 | _The Steemit Team_
26 | `;
27 | export const rendered = `
28 | <p><img src="https://steemitimages.com/640x0/https://cdn.steemitimages.com/DQmTcGq5DXga8RbFeFjuzUXkLPBBi4MUk1WRUqgdnb4Dr6G/Major%20post%20copy.png" alt="Major post copy.png"></p>
29 | <p>In our <a href="https://steemit.com/steemit/@steemitblog/engineering-update-all-team-meeting-condenser-split">engineering update released earlier today</a> we announced that we would soft roll-out the new Wallet app. Well, we are now happy to announce the soft roll-out of the new Wallet application! To see what we mean, head on over to <a href="https://steemitwallet.com" rel="nofollow noopener" title="This link will take you away from steemit.com">steemitwallet.com</a>. For the time being, a full version of Condenser will be running on steemit.com, but once the Wallet app has been sufficiently tested, the new Social app will be rolled out to steemit.com. At that time, users who attempt to access their Steem wallet will be redirected to <a href="https://steemitwallet.com" rel="nofollow noopener" title="This link will take you away from steemit.com">steemitwallet.com</a>, so it was very important to maintain a consistent user experience. At that point, the Condenser Split will be complete.</p>
30 | <p></p><h1>Check It Out</h1><p></p>
31 | <p>The reason we are following this soft rollout strategy is so that users can begin familiarizing themselves with this new application, so be sure to head on over to <a href="https://steemitwallet.com" rel="nofollow noopener" title="This link will take you away from steemit.com">steemitwallet.com</a> to see what the experience is like. One change you will see on steemit.com is that when you try to sign in with your Active or Owner Key, you will now receive the following warning:</p>
32 | <p><img src="https://steemitimages.com/640x0/https://cdn.steemitimages.com/DQmRyYMhuAyRHjocXHPqTPByr7Gx8LubotqF2rwY6rgk996/logging-in-with-posting-key.png" alt="login-with-posting-key"></p>
33 | <p>The goal is to make the User Experience between the two applications as seamless as possible, so if you notice anything disruptive in this experience, please leave us feedback in the comments section below.</p>
34 | <p></p><h1>The Mission</h1><p></p>
35 | <p>Our Mission at Steemit is to help build great online communities with financial inclusion. To that end, we envision a vibrant communities web application that features cryptocurrency incentives, the development of which is economically sustainable and scalable. Splitting Condenser into separate Social and Wallet applications will constitute a major step toward accomplishing our mission by enabling us to improve each application faster, consume fewer resources, and generate more revenue, while maximizing user security by enhancing the client-side signing experience.</p>
36 | <p><em>The Steemit Team</em></p>
37 | `;
38 | 


--------------------------------------------------------------------------------
/src/renderers/default/embedder/AssetEmbedder.ts:
--------------------------------------------------------------------------------
 1 | import { DefaultRendererLocalization } from "../DefaultRendererLocalization";
 2 | 
 3 | import { AssetEmbedderOptions } from "./AssetEmbedderOptions";
 4 | import { HtmlDOMParser } from "./HtmlDOMParser";
 5 | import { VideoEmbedders } from "./videoembedders/VideoEmbedders";
 6 | 
 7 | export class AssetEmbedder {
 8 |     private options: AssetEmbedderOptions;
 9 |     private localization: DefaultRendererLocalization;
10 | 
11 |     public constructor(options: AssetEmbedderOptions, localization: DefaultRendererLocalization) {
12 |         AssetEmbedderOptions.validate(options);
13 |         this.options = options;
14 |         this.localization = localization;
15 |     }
16 | 
17 |     public markAssets(input: string): string {
18 |         const parser = new HtmlDOMParser(this.options, this.localization);
19 |         return parser.parse(input).getParsedDocumentAsString();
20 |     }
21 | 
22 |     public insertAssets(input: string): string {
23 |         const size = {
24 |             width: this.options.width,
25 |             height: this.options.height,
26 |         };
27 |         return VideoEmbedders.insertMarkedEmbedsToRenderedOutput(input, size);
28 |     }
29 | }
30 | 


--------------------------------------------------------------------------------
/src/renderers/default/embedder/AssetEmbedderOptions.ts:
--------------------------------------------------------------------------------
 1 | import ow from "ow";
 2 | 
 3 | export interface AssetEmbedderOptions {
 4 |     ipfsPrefix: string;
 5 |     width: number;
 6 |     height: number;
 7 |     hideImages: boolean;
 8 |     baseUrl: string;
 9 |     imageProxyFn: (url: string) => string;
10 |     hashtagUrlFn: (hashtag: string) => string;
11 |     usertagUrlFn: (account: string) => string;
12 | }
13 | 
14 | export namespace AssetEmbedderOptions {
15 |     export function validate(o: AssetEmbedderOptions) {
16 |         ow(o.ipfsPrefix, "AssetEmbedderOptions.ipfsPrefix", ow.string);
17 |         ow(o.width, "AssetEmbedderOptions.width", ow.number.integer.positive);
18 |         ow(o.height, "AssetEmbedderOptions.height", ow.number.integer.positive);
19 |         ow(o.hideImages, "AssetEmbedderOptions.hideImages", ow.boolean);
20 |         ow(o.baseUrl, "AssetEmbedderOptions.baseUrl", ow.string.nonEmpty);
21 |         ow(o.imageProxyFn, "AssetEmbedderOptions.imageProxyFn", ow.function);
22 |         ow(o.hashtagUrlFn, "AssetEmbedderOptions.hashtagUrlFn", ow.function);
23 |         ow(o.usertagUrlFn, "AssetEmbedderOptions.usertagUrlFn", ow.function);
24 |     }
25 | }
26 | 


--------------------------------------------------------------------------------
/src/renderers/default/embedder/HtmlDOMParser.spec.test.ts:
--------------------------------------------------------------------------------
  1 | /**
  2 |  * Based on: https://github.com/steemit/condenser/raw/master/src/shared/HtmlReady.test.js
  3 |  */
  4 | 
  5 | // tslint:disable max-line-length
  6 | import { expect } from "chai";
  7 | import "mocha";
  8 | 
  9 | /* global describe, it, before, beforeEach, after, afterEach */
 10 | import { AssetEmbedderOptions } from "./AssetEmbedderOptions";
 11 | import { HtmlDOMParser } from "./HtmlDOMParser";
 12 | 
 13 | describe("HtmlDOMParser", () => {
 14 |     const htmlParserOptions: AssetEmbedderOptions = {
 15 |         ipfsPrefix: "",
 16 |         imageProxyFn: (url: string) => url,
 17 |         usertagUrlFn: (account: string) => `/@${account}`,
 18 |         hashtagUrlFn: (hashtag: string) => `/trending/${hashtag}`,
 19 |         baseUrl: "https://steemit.com/",
 20 |         width: 640,
 21 |         height: 480,
 22 |         hideImages: false,
 23 |     };
 24 | 
 25 |     /*it("should return an empty string if input cannot be parsed", () => {
 26 |         const teststring = "teststring lol"; // this string causes the xmldom parser to fail & error out
 27 |         const parser = new HtmlDOMParser(htmlParserOptions);
 28 |         expect(parser.parse(teststring).getParsedDocumentAsString()).to.equal("");
 29 |     });*/
 30 | 
 31 |     it("should allow links where the text portion and href contains steemit.com", () => {
 32 |         const dirty =
 33 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><a href="https://steemit.com/signup" xmlns="http://www.w3.org/1999/xhtml">https://steemit.com/signup</a></xml>';
 34 |         const parser = new HtmlDOMParser(htmlParserOptions);
 35 |         const res = parser.parse(dirty).getParsedDocumentAsString();
 36 |         expect(res).to.equal(dirty);
 37 |     });
 38 | 
 39 |     it("should allow in-page links ", () => {
 40 |         const dirty =
 41 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><a href="#some-link" xmlns="http://www.w3.org/1999/xhtml">a link location</a></xml>';
 42 |         const parser = new HtmlDOMParser(htmlParserOptions);
 43 |         const res = parser.parse(dirty).getParsedDocumentAsString();
 44 |         expect(res).to.equal(dirty);
 45 | 
 46 |         const externalDomainDirty =
 47 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><a href="https://anotherwebsite.com/apples#some-link" xmlns="http://www.w3.org/1999/xhtml">Another website\'s apple section</a></xml>';
 48 |         const externalDomainResult = parser.parse(externalDomainDirty).getParsedDocumentAsString();
 49 |         expect(externalDomainResult).to.equal(externalDomainDirty);
 50 |     });
 51 | 
 52 |     it("should not allow links where the text portion contains steemit.com but the link does not", () => {
 53 |         // There isn't an easy way to mock counterpart, even with proxyquire, so we just test for the missing translation message -- ugly but ok
 54 | 
 55 |         const dirty =
 56 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><a href="https://steamit.com/signup" xmlns="http://www.w3.org/1999/xhtml">https://steemit.com/signup</a></xml>';
 57 |         const cleansed =
 58 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><div title="Link expanded to plain text; beware of a potential phishing attempt" class="phishy">https://steemit.com/signup / https://steamit.com/signup</div></xml>';
 59 |         const res = new HtmlDOMParser(htmlParserOptions).parse(dirty).getParsedDocumentAsString();
 60 |         expect(res).to.equal(cleansed);
 61 | 
 62 |         const cased =
 63 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><a href="https://steamit.com/signup" xmlns="http://www.w3.org/1999/xhtml">https://Steemit.com/signup</a></xml>';
 64 |         const cleansedcased =
 65 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><div title="Link expanded to plain text; beware of a potential phishing attempt" class="phishy">https://Steemit.com/signup / https://steamit.com/signup</div></xml>';
 66 |         const rescased = new HtmlDOMParser(htmlParserOptions).parse(cased).getParsedDocumentAsString();
 67 |         expect(rescased).to.equal(cleansedcased);
 68 | 
 69 |         const withuser =
 70 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><a href="https://steamit.com/signup" xmlns="http://www.w3.org/1999/xhtml">https://official@steemit.com/signup</a></xml>';
 71 |         const cleansedwithuser =
 72 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><div title="Link expanded to plain text; beware of a potential phishing attempt" class="phishy">https://official@steemit.com/signup / https://steamit.com/signup</div></xml>';
 73 |         const reswithuser = new HtmlDOMParser(htmlParserOptions).parse(withuser).getParsedDocumentAsString();
 74 |         expect(reswithuser).to.equal(cleansedwithuser);
 75 | 
 76 |         const noendingslash =
 77 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><a href="https://steamit.com" xmlns="http://www.w3.org/1999/xhtml">https://steemit.com</a></xml>';
 78 |         const cleansednoendingslash =
 79 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><div title="Link expanded to plain text; beware of a potential phishing attempt" class="phishy">https://steemit.com / https://steamit.com</div></xml>';
 80 |         const resnoendingslash = new HtmlDOMParser(htmlParserOptions).parse(noendingslash).getParsedDocumentAsString();
 81 |         expect(resnoendingslash).to.equal(cleansednoendingslash);
 82 | 
 83 |         // make sure extra-domain in-page links are also caught by our phishy link scan.
 84 |         const domainInpage =
 85 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><a href="https://steamit.com#really-evil-inpage-component" xmlns="http://www.w3.org/1999/xhtml">https://steemit.com</a></xml>';
 86 |         const cleanDomainInpage =
 87 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><div title="Link expanded to plain text; beware of a potential phishing attempt" class="phishy">https://steemit.com / https://steamit.com#really-evil-inpage-component</div></xml>';
 88 |         const resDomainInpage = new HtmlDOMParser(htmlParserOptions).parse(domainInpage).getParsedDocumentAsString();
 89 |         expect(resDomainInpage).to.equal(cleanDomainInpage);
 90 | 
 91 |         // anchor links including steemit.com should be allowed
 92 |         const inpage =
 93 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><a href="#https://steamit.com/unlikelyinpagelink" xmlns="http://www.w3.org/1999/xhtml">Go down lower for https://steemit.com info!</a></xml>';
 94 |         const cleanInpage =
 95 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><a href="#https://steamit.com/unlikelyinpagelink" xmlns="http://www.w3.org/1999/xhtml">Go down lower for https://steemit.com info!</a></xml>';
 96 |         const resinpage = new HtmlDOMParser(htmlParserOptions).parse(inpage).getParsedDocumentAsString();
 97 |         expect(resinpage).to.equal(cleanInpage);
 98 | 
 99 |         const noprotocol =
100 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><a href="https://steamit.com/" xmlns="http://www.w3.org/1999/xhtml">for a good time, visit steemit.com today</a></xml>';
101 |         const cleansednoprotocol =
102 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><div title="Link expanded to plain text; beware of a potential phishing attempt" class="phishy">for a good time, visit steemit.com today / https://steamit.com/</div></xml>';
103 |         const resnoprotocol = new HtmlDOMParser(htmlParserOptions).parse(noprotocol).getParsedDocumentAsString();
104 |         expect(resnoprotocol).to.equal(cleansednoprotocol);
105 |     });
106 | 
107 |     it("should allow more than one link per post", () => {
108 |         const somanylinks = '<xml xmlns="http://www.w3.org/1999/xhtml">https://foo.com and https://blah.com</xml>';
109 |         const htmlified =
110 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><span><a href="https://foo.com">https://foo.com</a> and <a href="https://blah.com">https://blah.com</a></span></xml>';
111 |         const res = new HtmlDOMParser(htmlParserOptions).parse(somanylinks).getParsedDocumentAsString();
112 |         expect(res).to.equal(htmlified);
113 |     });
114 | 
115 |     it("should link usernames", () => {
116 |         const textwithmentions = '<xml xmlns="http://www.w3.org/1999/xhtml">@username (@a1b2, whatever</xml>';
117 |         const htmlified =
118 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><span><a href="/@username">@username</a> (<a href="/@a1b2">@a1b2</a>, whatever</span></xml>';
119 |         const res = new HtmlDOMParser(htmlParserOptions).parse(textwithmentions).getParsedDocumentAsString();
120 |         expect(res).to.equal(htmlified);
121 |     });
122 | 
123 |     it("should detect only valid mentions", () => {
124 |         const textwithmentions = "@abc @xx (@aaa1) @_x @eee, @fff! https://x.com/@zzz/test";
125 |         const res = new HtmlDOMParser(htmlParserOptions)
126 |             .setMutateEnabled(false)
127 |             .parse(textwithmentions)
128 |             .getState();
129 |         const usertags = Array.from(res.usertags).join(",");
130 |         expect(usertags).to.equal("abc,aaa1,eee,fff");
131 |     });
132 | 
133 |     it("should not link usernames at the front of linked text", () => {
134 |         const nameinsidelinkfirst =
135 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><a href="https://steemit.com/signup">@hihi</a></xml>';
136 |         const htmlified =
137 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><a href="https://steemit.com/signup">@hihi</a></xml>';
138 |         const res = new HtmlDOMParser(htmlParserOptions).parse(nameinsidelinkfirst).getParsedDocumentAsString();
139 |         expect(res).to.equal(htmlified);
140 |     });
141 | 
142 |     it("should not link usernames in the middle of linked text", () => {
143 |         const nameinsidelinkmiddle =
144 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><a href="https://steemit.com/signup">hi @hihi</a></xml>';
145 |         const htmlified =
146 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><a href="https://steemit.com/signup">hi @hihi</a></xml>';
147 |         const res = new HtmlDOMParser(htmlParserOptions).parse(nameinsidelinkmiddle).getParsedDocumentAsString();
148 |         expect(res).to.equal(htmlified);
149 |     });
150 | 
151 |     it("should make relative links absolute with https by default", () => {
152 |         const noRelativeHttpHttpsOrSteem =
153 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><a href="land.com"> zippy </a> </xml>';
154 |         const cleansedRelativeHttpHttpsOrSteem =
155 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><a href="https://land.com"> zippy </a> </xml>';
156 |         const resNoRelativeHttpHttpsOrSteem = new HtmlDOMParser(htmlParserOptions)
157 |             .parse(noRelativeHttpHttpsOrSteem)
158 |             .getParsedDocumentAsString();
159 |         expect(resNoRelativeHttpHttpsOrSteem).to.equal(cleansedRelativeHttpHttpsOrSteem);
160 |     });
161 | 
162 |     it("should allow the steem uri scheme for vessel links", () => {
163 |         const noRelativeHttpHttpsOrSteem =
164 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><a href="steem://veins.com"> arteries </a> </xml>';
165 |         const cleansedRelativeHttpHttpsOrSteem =
166 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><a href="steem://veins.com"> arteries </a> </xml>';
167 |         const resNoRelativeHttpHttpsOrSteem = new HtmlDOMParser(htmlParserOptions)
168 |             .parse(noRelativeHttpHttpsOrSteem)
169 |             .getParsedDocumentAsString();
170 |         expect(resNoRelativeHttpHttpsOrSteem).to.equal(cleansedRelativeHttpHttpsOrSteem);
171 |     });
172 | 
173 |     it("should not mistake usernames in valid comment urls as mentions", () => {
174 |         const url =
175 |             "https://steemit.com/spam/@test-safari/34gfex-december-spam#@test-safari/re-test-safari-34gfex-december-spam-20180110t234627522z";
176 |         const prefix = '<xml xmlns="http://www.w3.org/1999/xhtml">';
177 |         const suffix = "</xml>";
178 |         const input = prefix + url + suffix;
179 |         const expected = prefix + '<span><a href="' + url + '">' + url + "</a></span>" + suffix;
180 |         const result = new HtmlDOMParser(htmlParserOptions).parse(input).getParsedDocumentAsString();
181 |         expect(result).to.equal(expected);
182 |     });
183 | 
184 |     it("should not modify text when mention contains invalid username", () => {
185 |         const body = "valid mention match but invalid username..@usernamewaytoolong";
186 |         const prefix = '<xml xmlns="http://www.w3.org/1999/xhtml">';
187 |         const suffix = "</xml>";
188 |         const input = prefix + body + suffix;
189 |         const result = new HtmlDOMParser(htmlParserOptions).parse(input).getParsedDocumentAsString();
190 |         expect(result).to.equal(input);
191 |     });
192 | 
193 |     it("should detect urls that are phishy", () => {
194 |         const dirty =
195 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><a href="https://steewit.com/signup" xmlns="http://www.w3.org/1999/xhtml">https://steemit.com/signup</a></xml>';
196 |         const cleansed =
197 |             '<xml xmlns="http://www.w3.org/1999/xhtml"><div title="Link expanded to plain text; beware of a potential phishing attempt" class="phishy">https://steemit.com/signup / https://steewit.com/signup</div></xml>';
198 |         const res = new HtmlDOMParser(htmlParserOptions).parse(dirty).getParsedDocumentAsString();
199 |         expect(res).to.equal(cleansed);
200 |     });
201 | 
202 |     it("should not omit text on same line as youtube link", () => {
203 |         const testString = "<html><p>before text https://www.youtube.com/watch?v=NrS9vvNgx7I after text</p></html>";
204 |         const htmlified =
205 |             '<html xmlns="http://www.w3.org/1999/xhtml"><p>before text ~~~ embed:NrS9vvNgx7I youtube ~~~ after text</p></html>';
206 |         const res = new HtmlDOMParser(htmlParserOptions).parse(testString).getParsedDocumentAsString();
207 |         expect(res).to.equal(htmlified);
208 |     });
209 | 
210 |     it("should not omit text on same line as vimeo link", () => {
211 |         const testString = "<html><p>before text https://vimeo.com/193628816/ after text</p></html>";
212 |         const htmlified =
213 |             '<html xmlns="http://www.w3.org/1999/xhtml"><p>before text ~~~ embed:193628816 vimeo ~~~ after text</p></html>';
214 |         const res = new HtmlDOMParser(htmlParserOptions).parse(testString).getParsedDocumentAsString();
215 |         expect(res).to.equal(htmlified);
216 |     });
217 | });
218 | 


--------------------------------------------------------------------------------
/src/renderers/default/embedder/HtmlDOMParser.ts:
--------------------------------------------------------------------------------
  1 | /**
  2 |  * Based on: https://github.com/steemit/condenser/raw/master/src/shared/HtmlReady.js
  3 |  */
  4 | // tslint:disable max-classes-per-file
  5 | import ChainedError from "typescript-chained-error";
  6 | import * as xmldom from "xmldom";
  7 | 
  8 | import { Log } from "../../../Log";
  9 | import { LinkSanitizer } from "../../../security/LinkSanitizer";
 10 | import { DefaultRendererLocalization } from "../DefaultRendererLocalization";
 11 | 
 12 | import { AssetEmbedderOptions } from "./AssetEmbedderOptions";
 13 | import { AccountNameValidator } from "./utils/AccountNameValidator";
 14 | import linksRe, { any as linksAny } from "./utils/Links";
 15 | import { VideoEmbedders } from "./videoembedders/VideoEmbedders";
 16 | import { YoutubeEmbedder } from "./videoembedders/YoutubeEmbedder";
 17 | 
 18 | export class HtmlDOMParser {
 19 |     private options: AssetEmbedderOptions;
 20 |     private localization: DefaultRendererLocalization;
 21 |     private linkSanitizer: LinkSanitizer;
 22 | 
 23 |     private domParser = new xmldom.DOMParser({
 24 |         errorHandler: {
 25 |             warning: () => {
 26 |                 /* */
 27 |             },
 28 |             error: () => {
 29 |                 /* */
 30 |             },
 31 |         },
 32 |     });
 33 |     private xmlSerializer = new xmldom.XMLSerializer();
 34 |     private state: HtmlDOMParser.State;
 35 |     private mutate = true;
 36 |     private parsedDocument: Document | undefined = undefined;
 37 | 
 38 |     public constructor(
 39 |         options: AssetEmbedderOptions,
 40 |         localization: DefaultRendererLocalization = DefaultRendererLocalization.DEFAULT,
 41 |     ) {
 42 |         AssetEmbedderOptions.validate(options);
 43 |         this.options = options;
 44 |         this.localization = localization;
 45 |         this.linkSanitizer = new LinkSanitizer({
 46 |             baseUrl: this.options.baseUrl,
 47 |         });
 48 | 
 49 |         this.state = {
 50 |             hashtags: new Set(),
 51 |             usertags: new Set(),
 52 |             htmltags: new Set(),
 53 |             images: new Set(),
 54 |             links: new Set(),
 55 |         };
 56 |     }
 57 | 
 58 |     public setMutateEnabled(mutate: boolean): HtmlDOMParser {
 59 |         this.mutate = mutate;
 60 |         return this;
 61 |     }
 62 | 
 63 |     public parse(html: string): HtmlDOMParser {
 64 |         try {
 65 |             const doc: Document = this.domParser.parseFromString(html, "text/html");
 66 |             this.traverseDOMNode(doc);
 67 |             if (this.mutate) this.postprocessDOM(doc);
 68 |             this.parsedDocument = doc;
 69 |         } catch (error) {
 70 |             throw new HtmlDOMParser.HtmlDOMParserError("Parsing error", error);
 71 |         }
 72 | 
 73 |         return this;
 74 |     }
 75 | 
 76 |     public getState(): HtmlDOMParser.State {
 77 |         if (!this.parsedDocument) throw new HtmlDOMParser.HtmlDOMParserError("Html has not been parsed yet");
 78 |         return this.state;
 79 |     }
 80 | 
 81 |     public getParsedDocument(): Document {
 82 |         if (!this.parsedDocument) throw new HtmlDOMParser.HtmlDOMParserError("Html has not been parsed yet");
 83 |         return this.parsedDocument;
 84 |     }
 85 | 
 86 |     public getParsedDocumentAsString(): string {
 87 |         return this.xmlSerializer.serializeToString(this.getParsedDocument());
 88 |     }
 89 | 
 90 |     private traverseDOMNode(node: Document | ChildNode, depth = 0) {
 91 |         if (!node || !node.childNodes) {
 92 |             return;
 93 |         }
 94 | 
 95 |         Array.from(node.childNodes).forEach(child => {
 96 |             const tag = (child as any).tagName ? (child as any).tagName.toLowerCase() : null;
 97 |             if (tag) {
 98 |                 this.state.htmltags.add(tag);
 99 |             }
100 | 
101 |             if (tag === "img") {
102 |                 this.processImgTag(child as HTMLObjectElement);
103 |             } else if (tag === "iframe") {
104 |                 this.processIframeTag(child as HTMLObjectElement);
105 |             } else if (tag === "a") {
106 |                 this.processLinkTag(child as HTMLObjectElement);
107 |             } else if (child.nodeName === "#text") {
108 |                 this.processTextNode(child as HTMLObjectElement);
109 |             }
110 | 
111 |             this.traverseDOMNode(child, depth + 1);
112 |         });
113 |     }
114 | 
115 |     private processLinkTag(child: HTMLObjectElement) {
116 |         const url = child.getAttribute("href");
117 |         if (url) {
118 |             this.state.links.add(url);
119 |             if (this.mutate) {
120 |                 // Unlink potential phishing attempts
121 |                 const urlTitle = child.textContent + "";
122 |                 const sanitizedLink = this.linkSanitizer.sanitizeLink(url, urlTitle);
123 |                 if (sanitizedLink === false) {
124 |                     const phishyDiv = (child as any).ownerDocument.createElement("div");
125 |                     phishyDiv.textContent = `${child.textContent} / ${url}`;
126 |                     phishyDiv.setAttribute("title", this.localization.phishingWarning);
127 |                     phishyDiv.setAttribute("class", "phishy");
128 |                     (child as any).parentNode.replaceChild(phishyDiv, child);
129 |                 } else {
130 |                     child.setAttribute("href", sanitizedLink);
131 |                 }
132 |             }
133 |         }
134 |     }
135 | 
136 |     // wrap iframes in div.videoWrapper to control size/aspect ratio
137 |     private processIframeTag(child: HTMLObjectElement) {
138 |         const url = child.getAttribute("src");
139 |         if (url) this.reportIframeLink(url);
140 | 
141 |         if (!this.mutate) {
142 |             return;
143 |         }
144 | 
145 |         const tag = (child as any).parentNode.tagName
146 |             ? (child as any).parentNode.tagName.toLowerCase()
147 |             : (child as any).parentNode.tagName;
148 |         if (tag === "div" && (child as any).parentNode.getAttribute("class") === "videoWrapper") {
149 |             return;
150 |         }
151 |         const html = this.xmlSerializer.serializeToString(child);
152 |         (child as any).parentNode.replaceChild(
153 |             this.domParser.parseFromString(`<div class="videoWrapper">${html}</div>`),
154 |             child,
155 |         );
156 |     }
157 | 
158 |     private reportIframeLink(url: string) {
159 |         const yt = YoutubeEmbedder.getYoutubeMetadataFromLink(url);
160 |         if (yt) {
161 |             this.state.links.add(yt.url);
162 |             this.state.images.add("https://img.youtube.com/vi/" + yt.id + "/0.jpg");
163 |         }
164 |     }
165 | 
166 |     private processImgTag(child: HTMLObjectElement) {
167 |         const url = child.getAttribute("src");
168 |         if (url) {
169 |             this.state.images.add(url);
170 |             if (this.mutate) {
171 |                 let url2 = this.normalizeUrl(url);
172 |                 if (/^\/\//.test(url2)) {
173 |                     // Change relative protocol imgs to https
174 |                     url2 = "https:" + url2;
175 |                 }
176 |                 if (url2 !== url) {
177 |                     child.setAttribute("src", url2);
178 |                 }
179 |             }
180 |         }
181 |     }
182 | 
183 |     private processTextNode(child: HTMLObjectElement) {
184 |         try {
185 |             const tag = (child.parentNode as any).tagName
186 |                 ? (child.parentNode as any).tagName.toLowerCase()
187 |                 : (child.parentNode as any).tagName;
188 |             if (tag === "code") {
189 |                 return;
190 |             }
191 |             if (tag === "a") {
192 |                 return;
193 |             }
194 | 
195 |             if (!child.data) {
196 |                 return;
197 |             }
198 | 
199 |             const embedResp = VideoEmbedders.processTextNodeAndInsertEmbeds(child);
200 |             embedResp.images.forEach(img => this.state.images.add(img));
201 |             embedResp.links.forEach(link => this.state.links.add(link));
202 | 
203 |             const data = this.xmlSerializer.serializeToString(child);
204 |             const content = this.linkify(data);
205 |             if (this.mutate && content !== data) {
206 |                 const newChild = this.domParser.parseFromString(`<span>${content}</span>`);
207 |                 (child.parentNode as any).replaceChild(newChild, child);
208 |                 return newChild;
209 |             }
210 |         } catch (error) {
211 |             Log.log().error(error);
212 |         }
213 |     }
214 | 
215 |     private linkify(content: string) {
216 |         // plaintext links
217 |         content = content.replace(linksAny("gi"), ln => {
218 |             if (linksRe.image.test(ln)) {
219 |                 this.state.images.add(ln);
220 |                 return `<img src="${this.normalizeUrl(ln)}" />`;
221 |             }
222 | 
223 |             // do not linkify .exe or .zip urls
224 |             if (/\.(zip|exe)$/i.test(ln)) {
225 |                 return ln;
226 |             }
227 | 
228 |             // do not linkify phishy links
229 |             const sanitizedLink = this.linkSanitizer.sanitizeLink(ln, ln);
230 |             if (sanitizedLink === false) {
231 |                 return `<div title='${this.localization.phishingWarning}' class='phishy'>${ln}</div>`;
232 |             }
233 | 
234 |             this.state.links.add(sanitizedLink);
235 |             const out = `<a href="${this.normalizeUrl(ln)}">${sanitizedLink}</a>`;
236 |             return out;
237 |         });
238 | 
239 |         // hashtag
240 |         content = content.replace(/(^|\s)(#[-a-z\d]+)/gi, tag => {
241 |             if (/#[\d]+$/.test(tag)) {
242 |                 return tag;
243 |             } // Don't allow numbers to be tags
244 |             const space = /^\s/.test(tag) ? tag[0] : "";
245 |             const tag2 = tag.trim().substring(1);
246 |             const tagLower = tag2.toLowerCase();
247 |             this.state.hashtags.add(tagLower);
248 |             if (!this.mutate) {
249 |                 return tag;
250 |             }
251 |             const tagUrl = this.options.hashtagUrlFn(tagLower);
252 |             return space + `<a href="${tagUrl}">${tag.trim()}</a>`;
253 |         });
254 | 
255 |         // usertag (mention)
256 |         // Cribbed from https://github.com/twitter/twitter-text/blob/v1.14.7/js/twitter-text.js#L90
257 |         content = content.replace(
258 |             /(^|[^a-zA-Z0-9_!#$%&*@＠\/]|(^|[^a-zA-Z0-9_+~.-\/#]))[@＠]([a-z][-\.a-z\d]+[a-z\d])/gi,
259 |             (match, preceeding1, preceeding2, user) => {
260 |                 const userLower = user.toLowerCase();
261 |                 const valid = AccountNameValidator.validateAccountName(userLower, this.localization) == null;
262 | 
263 |                 if (valid && this.state.usertags) {
264 |                     this.state.usertags.add(userLower);
265 |                 }
266 | 
267 |                 // include the preceeding matches if they exist
268 |                 const preceedings = (preceeding1 || "") + (preceeding2 || "");
269 | 
270 |                 if (!this.mutate) {
271 |                     return `${preceedings}${user}`;
272 |                 }
273 | 
274 |                 const userTagUrl = this.options.usertagUrlFn(userLower);
275 |                 return valid ? `${preceedings}<a href="${userTagUrl}">@${user}</a>` : `${preceedings}@${user}`;
276 |             },
277 |         );
278 |         return content;
279 |     }
280 | 
281 |     private postprocessDOM(doc: Document) {
282 |         this.hideImagesIfNeeded(doc);
283 |         this.proxifyImagesIfNeeded(doc);
284 |     }
285 | 
286 |     private hideImagesIfNeeded(doc: Document) {
287 |         if (this.mutate && this.options.hideImages) {
288 |             for (const image of Array.from(doc.getElementsByTagName("img"))) {
289 |                 const pre = doc.createElement("pre");
290 |                 pre.setAttribute("class", "image-url-only");
291 |                 pre.appendChild(doc.createTextNode(image.getAttribute("src") || ""));
292 |                 if (image.parentNode) {
293 |                     image.parentNode.replaceChild(pre, image);
294 |                 }
295 |             }
296 |         }
297 |     }
298 | 
299 |     private proxifyImagesIfNeeded(doc: Document) {
300 |         if (this.mutate && !this.options.hideImages) {
301 |             this.proxifyImages(doc);
302 |         }
303 |     }
304 | 
305 |     // For all img elements with non-local URLs, prepend the proxy URL (e.g. `https://img0.steemit.com/0x0/`)
306 |     private proxifyImages(doc: Document) {
307 |         if (!doc) {
308 |             return;
309 |         }
310 |         Array.from(doc.getElementsByTagName("img")).forEach(node => {
311 |             const url: string = node.getAttribute("src") || "";
312 |             if (!linksRe.local.test(url)) {
313 |                 node.setAttribute("src", this.options.imageProxyFn(url));
314 |             }
315 |         });
316 |     }
317 | 
318 |     private normalizeUrl(url: any) {
319 |         if (this.options.ipfsPrefix) {
320 |             // Convert //ipfs/xxx  or /ipfs/xxx  into  https://steemit.com/ipfs/xxxxx
321 |             if (/^\/?\/ipfs\//.test(url)) {
322 |                 const slash = url.charAt(1) === "/" ? 1 : 0;
323 |                 url = url.substring(slash + "/ipfs/".length); // start with only 1 /
324 |                 return this.options.ipfsPrefix + "/" + url;
325 |             }
326 |         }
327 |         return url;
328 |     }
329 | }
330 | 
331 | export namespace HtmlDOMParser {
332 |     export interface State {
333 |         hashtags: Set<string>;
334 |         usertags: Set<string>;
335 |         htmltags: Set<string>;
336 |         images: Set<string>;
337 |         links: Set<string>;
338 |     }
339 | 
340 |     export class HtmlDOMParserError extends ChainedError {
341 |         public constructor(message?: string, cause?: Error) {
342 |             super(message, cause);
343 |         }
344 |     }
345 | }
346 | 
347 | /*
348 | 
349 | */
350 | 
351 | /****************
352 |  * Legacy docs of HtmlReady:
353 |  */
354 | /**
355 |  * Functions performed by HTMLReady
356 |  *
357 |  * State reporting
358 |  *  - hashtags: collect all #tags in content
359 |  *  - usertags: collect all @mentions in content
360 |  *  - htmltags: collect all html <tags> used (for validation)
361 |  *  - images: collect all image URLs in content
362 |  *  - links: collect all href URLs in content
363 |  *
364 |  * Mutations
365 |  *  - link()
366 |  *    - ensure all <a> href's begin with a protocol. prepend https:// otherwise.
367 |  *  - iframe()
368 |  *    - wrap all <iframe>s in <div class="videoWrapper"> for responsive sizing
369 |  *  - img()
370 |  *    - convert any <img> src IPFS prefixes to standard URL
371 |  *    - change relative protocol to https://
372 |  *  - linkifyNode()
373 |  *    - scans text content to be turned into rich content
374 |  *    - embedYouTubeNode()
375 |  *      - identify plain youtube URLs and prep them for "rich embed"
376 |  *    - linkify()
377 |  *      - scan text for:
378 |  *        - #tags, convert to <a> links
379 |  *        - @mentions, convert to <a> links
380 |  *        - naked URLs
381 |  *          - if img URL, normalize URL and convert to <img> tag
382 |  *          - otherwise, normalize URL and convert to <a> link
383 |  *  - proxifyImages()
384 |  *    - prepend proxy URL to any non-local <img> src's
385 |  *
386 |  * We could implement 2 levels of HTML mutation for maximum reuse:
387 |  *  1. Normalization of HTML - non-proprietary, pre-rendering cleanup/normalization
388 |  *    - (state reporting done at this level)
389 |  *    - normalize URL protocols
390 |  *    - convert naked URLs to images/links
391 |  *    - convert embeddable URLs to <iframe>s
392 |  *    - basic sanitization?
393 |  *  2. Steemit.com Rendering - add in proprietary Steemit.com functions/links
394 |  *    - convert <iframe>s to custom objects
395 |  *    - linkify #tags and @mentions
396 |  *    - proxify images
397 |  *
398 |  * TODO:
399 |  *  - change ipfsPrefix(url) to normalizeUrl(url)
400 |  *    - rewrite IPFS prefixes to valid URLs
401 |  *    - schema normalization
402 |  *    - gracefully handle protocols like ftp, mailto
403 |  */
404 | 
405 | /** Split the HTML on top-level elements. This allows react to compare separately, preventing excessive re-rendering.
406 |  * Used in MarkdownViewer.jsx
407 |  */
408 | // export function sectionHtml (html) {
409 | //   const doc = this.domParser.parseFromString(html, 'text/html')
410 | //   const sections = Array(...doc.childNodes).map(child => this.xmlSerializer.serializeToString(child))
411 | //   return sections
412 | // }
413 | 
414 | /* Embed videos, link mentions and hashtags, etc...
415 |     If hideImages and mutate is set to true all images will be replaced
416 |     by <pre> elements containing just the image url.
417 | */
418 | 


--------------------------------------------------------------------------------
/src/renderers/default/embedder/utils/AccountNameValidator.ts:
--------------------------------------------------------------------------------
 1 | /**
 2 |  * Based on: https://raw.githubusercontent.com/steemit/condenser/master/src/app/utils/ChainValidation.js
 3 |  */
 4 | import { DefaultRendererLocalization } from "../../DefaultRendererLocalization";
 5 | 
 6 | import BadActorList from "./BadActorList";
 7 | 
 8 | export class AccountNameValidator {
 9 |     // tslint:disable cyclomatic-complexity
10 |     public static validateAccountName(value: string, localization: DefaultRendererLocalization) {
11 |         let i;
12 |         let label;
13 |         let len;
14 |         let length;
15 |         let ref;
16 | 
17 |         if (!value) {
18 |             return localization.accountNameWrongLength;
19 |         }
20 |         length = value.length;
21 |         if (length < 3) {
22 |             return localization.accountNameWrongLength;
23 |         }
24 |         if (length > 16) {
25 |             return localization.accountNameWrongLength;
26 |         }
27 |         if (BadActorList.includes(value)) {
28 |             return localization.accountNameBadActor;
29 |         }
30 |         ref = value.split(".");
31 |         for (i = 0, len = ref.length; i < len; i++) {
32 |             label = ref[i];
33 |             if (!/^[a-z]/.test(label)) {
34 |                 return localization.accountNameWrongSegment;
35 |                 // each_account_segment_should_start_with_a_letter
36 |             }
37 |             if (!/^[a-z0-9-]*$/.test(label)) {
38 |                 return localization.accountNameWrongSegment;
39 |                 // each_account_segment_should_have_only_letters_digits_or_dashes
40 |             }
41 |             if (/--/.test(label)) {
42 |                 return localization.accountNameWrongSegment;
43 |                 // each_account_segment_should_have_only_one_dash_in_a_row
44 |             }
45 |             if (!/[a-z0-9]$/.test(label)) {
46 |                 return localization.accountNameWrongSegment;
47 |                 // each_account_segment_should_end_with_a_letter_or_digit
48 |             }
49 |             if (!(label.length >= 3)) {
50 |                 return localization.accountNameWrongSegment;
51 |                 // each_account_segment_should_be_longer
52 |             }
53 |         }
54 |         return null;
55 |     }
56 | }
57 | 


--------------------------------------------------------------------------------
/src/renderers/default/embedder/utils/BadActorList.ts:
--------------------------------------------------------------------------------
  1 | /**
  2 |  * Based on: https://raw.githubusercontent.com/steemit/condenser/master/src/app/utils/BadActorList.js
  3 |  */
  4 | 
  5 | const list = `
  6 | aalpha
  7 | aappreciator
  8 | abits
  9 | acx
 10 | aex.com
 11 | alha
 12 | alhpa
 13 | allcoin.com
 14 | alpah
 15 | alph
 16 | alphha
 17 | alppha
 18 | alueup
 19 | apha
 20 | aplha
 21 | apppreciator
 22 | apprceiator
 23 | apprciator
 24 | apprecaitor
 25 | apprecator
 26 | apprecciator
 27 | appreciaator
 28 | appreciaor
 29 | appreciaotr
 30 | appreciater
 31 | appreciatoor
 32 | appreciatorr
 33 | appreciatr
 34 | appreciatro
 35 | appreciattor
 36 | appreciiator
 37 | apprecitaor
 38 | apprecitor
 39 | appreeciator
 40 | appreiator
 41 | appreicator
 42 | apprreciator
 43 | apreciator
 44 | aprpeciator
 45 | ausbitban
 46 | ausbltbank
 47 | avlueup
 48 | battrex
 49 | bbithumb.hot
 50 | bbittrex
 51 | bblocktrades
 52 | bboomerang
 53 | bbooster
 54 | bbuildawhale
 55 | bcex
 56 | bellyrub
 57 | berniesandlers
 58 | bernieslanders
 59 | berniestandards
 60 | bernlesanders
 61 | bettrex
 62 | bihtrex
 63 | bihtumb.hot
 64 | bihumb.hot
 65 | biithumb.hot
 66 | biitrex
 67 | biittrex
 68 | bildawhale
 69 | binan
 70 | binanc
 71 | binance
 72 | binance.com
 73 | binanced
 74 | binancee
 75 | binances
 76 | binanse
 77 | binnance
 78 | bit-z
 79 | bitex
 80 | bitfinex
 81 | bitfinex.com
 82 | bitfinix
 83 | bitflip
 84 | bithhumb.hot
 85 | bithmb.hot
 86 | bithmub.hot
 87 | bithub.hot
 88 | bithubm.hot
 89 | bithum.bhot
 90 | bithumb
 91 | bithumb-deposit
 92 | bithumb-exchange
 93 | bithumb-pro
 94 | bithumb.com
 95 | bithumb.hoot
 96 | bithumb.hott
 97 | bithumb.hto
 98 | bithumb.oht
 99 | bithumbb.hot
100 | bithummb.hot
101 | bithuumb.hot
102 | bitifinex
103 | bitkrx
104 | bitnaru
105 | bitre
106 | bitreex
107 | bitrex
108 | bitrexx
109 | bitrix
110 | bitrrex
111 | bitrtex
112 | bitrx
113 | bitsane
114 | bitsane.com
115 | bitstamp
116 | bitstamp.net
117 | bitt
118 | bitteex
119 | bitter
120 | bitterex
121 | bitterx
122 | bittex
123 | bitthai
124 | bittr
125 | bittrax
126 | bittre
127 | bittrec
128 | bittrecs
129 | bittrecx
130 | bittred
131 | bittreex
132 | bittrek
133 | bittres
134 | bittresx
135 | bittret
136 | bittrev
137 | bittrex-deposit
138 | bittrex-pro
139 | bittrex.com
140 | bittrexc
141 | bittrexchange
142 | bittrexe
143 | bittrexs
144 | bittrext
145 | bittrexx
146 | bittrexxx
147 | bittrez
148 | bittrix
149 | bittrrex
150 | bittrrx
151 | bittrx
152 | bittrxe
153 | bitttec
154 | bitttex
155 | bitttrex
156 | bittylicious
157 | bittylicious.com
158 | bituhmb.hot
159 | biuldawhale
160 | blcktrades
161 | blcoktrades
162 | bleutrade
163 | bleutrade.com
164 | bllocktrades
165 | bloccktrades
166 | block-trades
167 | block-trades-com
168 | blockktrades
169 | blockrade
170 | blockrades
171 | blockrtades
172 | blocktades
173 | blocktardes
174 | blocktraades
175 | blocktrad
176 | blocktraddes
177 | blocktrade
178 | blocktraded
179 | blocktradee
180 | blocktradees
181 | blocktrader
182 | blocktraders
183 | blocktrades-com
184 | blocktrades-info
185 | blocktrades-us
186 | blocktrades.com
187 | blocktrades.info
188 | blocktrades.us
189 | blocktradess
190 | blocktradesss
191 | blocktradez
192 | blocktrading
193 | blocktrads
194 | blocktradse
195 | blocktraeds
196 | blocktraes
197 | blocktrdaes
198 | blocktrdes
199 | blocktredes
200 | blocktrrades
201 | blockttrades
202 | bloctkrades
203 | bloctrades
204 | blokctrades
205 | bloktrades
206 | bloocktrades
207 | bocktrades
208 | bolcktrades
209 | bomerang
210 | bomoerang
211 | booemrang
212 | booerang
213 | boomeang
214 | boomearng
215 | boomeerang
216 | boomeraang
217 | boomerag
218 | boomeragn
219 | boomerangg
220 | boomeranng
221 | boomernag
222 | boomerrang
223 | boommerang
224 | boomreang
225 | booomerang
226 | boooster
227 | booser
228 | boosetr
229 | boostar
230 | booste
231 | boosterr
232 | boostr
233 | boostre
234 | boostter
235 | bootser
236 | bosoter
237 | boster
238 | btc-alpha
239 | btc-alpha.com
240 | btc38
241 | btcalpha
242 | btcmarkets
243 | btcmarkets.net
244 | bthumb.hot
245 | btihumb.hot
246 | btitrex
247 | btrex
248 | bttrex
249 | bttrx
250 | buidawhale
251 | buidlawhale
252 | buiildawhale
253 | builadwhale
254 | buildaawhale
255 | buildahale
256 | buildahwale
257 | buildawahle
258 | buildawale
259 | buildawhaale
260 | buildawhael
261 | buildawhalee
262 | buildawhalle
263 | buildawhhale
264 | buildawhile
265 | buildawhlae
266 | buildawwhale
267 | builddawhale
268 | buildwahale
269 | buildwhale
270 | builldawhale
271 | buldawhale
272 | bulidawhale
273 | buobi-pro
274 | buuildawhale
275 | c-cex
276 | c-cex.com
277 | canadiancoconut
278 | ccex
279 | cexio
280 | changellly
281 | changelly.com
282 | changely
283 | cinpayments.net
284 | cionpayments.net
285 | coin-room
286 | coinapyments.net
287 | coinayments.net
288 | coinbas
289 | coinbase
290 | coinbase.com
291 | coinbased
292 | coinegg
293 | coinegg.com
294 | coinpaments.net
295 | coinpamyents.net
296 | coinpayemnts.net
297 | coinpayents.net
298 | coinpaymens.net
299 | coinpaymenst.net
300 | coinpayment
301 | coinpayment.snet
302 | coinpayments
303 | coinpayments.ent
304 | coinpayments.nte
305 | coinpaymetns.net
306 | coinpaymnets.net
307 | coinpaymnts.net
308 | coinpia
309 | coinpyaments.net
310 | coinroom.com
311 | coinsmarkets
312 | coinsmarkets.com
313 | coinspot
314 | coinzest
315 | coipayments.net
316 | coipnayments.net
317 | community-coin
318 | conipayments.net
319 | conpayments.net
320 | coolcoin.com
321 | curi
322 | curied
323 | curies
324 | curing
325 | d-tube
326 | dcrypto8
327 | ddeepcrypto8
328 | decrypto8
329 | deep8
330 | deepccrypto8
331 | deepcripto8
332 | deepcrpto8
333 | deepcrrypto8
334 | deepcrypo8
335 | deepcryppto8
336 | deepcrypt08
337 | deepcrypt8
338 | deepcrypto-8
339 | deepcrypto0
340 | deepcrypto7
341 | deepcrypto88
342 | deepcrypto9
343 | deepcryptoo8
344 | deepcryptos
345 | deepcryptos8
346 | deepcryptto8
347 | deepcryto8
348 | deepcrytpo8
349 | deepcryypto8
350 | deepcypto8
351 | deeppcrypto8
352 | deeprypto8
353 | depcrypto8
354 | donkeypon
355 | edepcrypto8
356 | eepcrypto8
357 | etherdelta
358 | etherdelta.com
359 | exrates
360 | exx.com
361 | feepcrypto8
362 | freeewallet
363 | freewalet.org
364 | freewaller
365 | frewallet
366 | fyrstiken
367 | gatecoin.com
368 | gatehub
369 | gatehub.net
370 | gdax.com
371 | gemini.com
372 | ggopax-deposit
373 | goapx-deposit
374 | goax-deposit
375 | good-kama
376 | goopax-deposit
377 | gopa-deposit
378 | gopa-xdeposit
379 | gopaax-deposit
380 | gopax-ddeposit
381 | gopax-deopsit
382 | gopax-deosit
383 | gopax-depoist
384 | gopax-depoit
385 | gopax-depoosit
386 | gopax-deposiit
387 | gopax-depositt
388 | gopax-depossit
389 | gopax-depost
390 | gopax-deposti
391 | gopax-depposit
392 | gopax-depsit
393 | gopax-depsoit
394 | gopax-dpeosit
395 | gopax-dposit
396 | gopax-edposit
397 | gopax-eposit
398 | gopax-hot
399 | gopaxd-eposit
400 | gopaxx-deposit
401 | goppax-deposit
402 | gopx-deposit
403 | gopxa-deposit
404 | gpax-deposit
405 | gpoax-deposit
406 | gtg.witnesses
407 | herising
408 | hhuobi-pro
409 | hitbtc-deposit
410 | hitbtc-pro
411 | hitbtc.com
412 | hitbtcexchange
413 | hterising
414 | huobbi-pro
415 | huobi-ppro
416 | huobi-pr0
417 | huobi-proo
418 | huobi-prro
419 | huobi.pro
420 | huobii-pro
421 | huobl-pro
422 | huoobi-pro
423 | huuobi-pro
424 | ibthumb.hot
425 | ibttrex
426 | idex.market
427 | imnnowbooster
428 | inance
429 | innowbooster
430 | ithumb.hot
431 | ittrex
432 | ittrexx
433 | kcx
434 | kevinwon
435 | kocostock
436 | koinex
437 | kraken
438 | kraken.com
439 | kucoi
440 | kucoin
441 | kucoinn
442 | kucoins
443 | lapha
444 | lbocktrades
445 | linkcoin
446 | litebit
447 | little-pepper
448 | livecoin.com
449 | livecoinnet
450 | livingroomofsato
451 | localtrade
452 | localtrade.pro
453 | locktrades
454 | lpha
455 | martsteem
456 | mercatox.com
457 | miinnowbooster
458 | minnnowbooster
459 | minnobooster
460 | minnobwooster
461 | minnooboster
462 | minnoowbooster
463 | minnowboooster
464 | minnowbooser
465 | minnowboosetr
466 | minnowboosster
467 | minnowboost
468 | minnowbooste
469 | minnowboosted
470 | minnowboosteer
471 | minnowboosterr
472 | minnowboosters
473 | minnowboostr
474 | minnowboostre
475 | minnowboostter
476 | minnowbootser
477 | minnowbosoter
478 | minnowboster
479 | minnowbuster
480 | minnowhelp
481 | minnowoboster
482 | minnowooster
483 | minnowpooster
484 | minnows
485 | minnowsuport
486 | minnowsupports
487 | minnowwbooster
488 | minnwbooster
489 | minnwobooster
490 | minobooster
491 | minonwbooster
492 | minowbooster
493 | minowboster
494 | minowhelper
495 | minowsupport
496 | mminnowbooster
497 | mmyupbit
498 | mninowbooster
499 | msartsteem
500 | my-upbit
501 | myupbbit
502 | myupbiit
503 | myupbitt
504 | myupblt
505 | myuppbit
506 | myuupbit
507 | myyupbit
508 | neraex
509 | neraex.com
510 | nextgencrypted
511 | nextgencryptos
512 | obomerang
513 | oboster
514 | ocky1
515 | oenledger-dex
516 | oepnledger-dex
517 | ogpax-deposit
518 | oinpayments.net
519 | okex.com
520 | olonie
521 | oloniex
522 | oomerang
523 | oopenledger-dex
524 | ooster
525 | opeenledger-dex
526 | opeledger-dex
527 | opelnedger-dex
528 | openedger-dex
529 | openeldger-dex
530 | openldeger-dex
531 | openldger-dex
532 | openleddger-dex
533 | openledegr-dex
534 | openleder-dex
535 | openledge-dex
536 | openledge-rdex
537 | openledgeer-dex
538 | openledger-ddex
539 | openledger-de
540 | openledger-deex
541 | openledger-dx
542 | openledger-dxe
543 | openledger-edx
544 | openledger-ex
545 | openledger-pro
546 | openledgerd-ex
547 | openledgerdex
548 | openledgerr-dex
549 | openledgr-dex
550 | openledgre-dex
551 | openleedger-dex
552 | openlegder-dex
553 | openleger-dex
554 | openlledger-dex
555 | opennledger-dex
556 | opnledger-dex
557 | oppenledger-dex
558 | opstpromoter
559 | orcky1
560 | ostpromoter
561 | p-funk
562 | paloniex
563 | papreciator
564 | paypals
565 | penledger-dex
566 | pextokens
567 | pfuck
568 | piloniex
569 | plolniex
570 | ploniex
571 | plooniex
572 | poenledger-dex
573 | pokoniex
574 | polaniex
575 | poleniex
576 | poliniex
577 | polionex
578 | pollniex
579 | polloniex
580 | polloniexx
581 | pollonix
582 | polniex
583 | polnoiex
584 | polobiex
585 | poloex
586 | poloiex
587 | poloinex
588 | pololniex
589 | polomiex
590 | polon
591 | poloneex
592 | poloneiex
593 | poloneix
594 | polonex
595 | poloni
596 | poloniax
597 | polonie
598 | poloniec
599 | poloniecs
600 | polonied
601 | poloniee
602 | polonieex
603 | poloniek
604 | polonieks
605 | polonies
606 | poloniet
607 | poloniets
608 | poloniew
609 | poloniex.com
610 | poloniexcold
611 | poloniexcom
612 | poloniexe
613 | poloniexs
614 | poloniext
615 | poloniexwalle
616 | poloniexwallet
617 | poloniexx
618 | poloniexxx
619 | poloniey
620 | poloniez
621 | poloniiex
622 | poloniix
623 | poloniks
624 | poloniox
625 | polonium
626 | polonix
627 | polonixe
628 | polonixx
629 | polonniex
630 | polonoiex
631 | polonox
632 | polonx
633 | polonyex
634 | polooniex
635 | poluniex
636 | pomobot
637 | pononiex
638 | poolniex
639 | pooloniex
640 | pooniex
641 | poooniex
642 | poostpromoter
643 | poponiex
644 | pormobot
645 | posptromoter
646 | posstpromoter
647 | postpormoter
648 | postppromoter
649 | postprmooter
650 | postprmoter
651 | postprommoter
652 | postpromoer
653 | postpromooter
654 | postpromote
655 | postpromoteer
656 | postpromoterr
657 | postpromotor
658 | postpromotre
659 | postpromotter
660 | postpromter
661 | postpromtoer
662 | postproomoter
663 | postproomter
664 | postprooter
665 | postprromoter
666 | postromoter
667 | posttpromoter
668 | potpromoter
669 | potspromoter
670 | ppostpromoter
671 | ppreciator
672 | ppromobot
673 | prmobot
674 | prmoobot
675 | promboot
676 | prombot
677 | prommobot
678 | promobbot
679 | promobo
680 | promoboot
681 | promobott
682 | promobt
683 | promobto
684 | promoobot
685 | promoobt
686 | promoot
687 | proobot
688 | proombot
689 | proomobot
690 | prromobot
691 | pse
692 | psotpromoter
693 | pstpromoter
694 | ptakundamianshow
695 | ptunk
696 | puloniex
697 | qryptos
698 | qryptos.com
699 | randomwhale
700 | randowale
701 | randowhal
702 | randwhale
703 | rcky1
704 | rcoky1
705 | rdex
706 | rduex
707 | rendowhale
708 | roccky1
709 | rock1y
710 | rockky1
711 | rockyy1
712 | rocy1
713 | rocyk1
714 | rokcy1
715 | romobot
716 | roocky1
717 | rpomobot
718 | rrocky1
719 | rrudex
720 | ruddex
721 | rudeex
722 | rudexx
723 | rudx
724 | rudxe
725 | ruedx
726 | ruudex
727 | samrtsteem
728 | sartsteem
729 | scoin
730 | seem
731 | seemit
732 | seemit2
733 | seepcrypto8
734 | setem
735 | setemit
736 | setemit2
737 | shapeshif
738 | shapeshift
739 | smaartsteem
740 | smarrtsteem
741 | smarstteem
742 | smartseem
743 | smartsetem
744 | smartstee
745 | smartsteeem
746 | smartsteemm
747 | smartsteme
748 | smartstteem
749 | smartteem
750 | smatrsteem
751 | smmartsteem
752 | smratsteem
753 | smrtsteem
754 | ssmartsteem
755 | ssteemit2
756 | steampunks
757 | steeemit2
758 | steeimt
759 | steeimt2
760 | steeit
761 | steeit2
762 | steemi2
763 | steemi2t
764 | steemitpay
765 | steemitt2
766 | steemmit2
767 | steempay
768 | steempays
769 | steemt2
770 | steemti2
771 | steemupbit
772 | stemeit
773 | stemeit2
774 | stemit1
775 | stemit2
776 | stemit3
777 | stemit4
778 | stteem
779 | stteemit2
780 | sweetsj
781 | sweetssj
782 | sweetsss
783 | sweetsssjs
784 | sweetssssj
785 | swetsssj
786 | tdax
787 | tdax.com
788 | teamsteam
789 | techno-comanche
790 | technocommander
791 | teemit2
792 | tehrising
793 | terising
794 | thealien
795 | thebiton
796 | theerising
797 | theirsing
798 | theising
799 | theriing
800 | theriising
801 | theriisng
802 | therisig
803 | therisign
804 | therisiing
805 | therisingg
806 | therisinng
807 | therisng
808 | therisnig
809 | therissing
810 | therocktrading
811 | therrising
812 | thersiing
813 | thersing
814 | thherising
815 | threising
816 | thrising
817 | tidex.com
818 | topbtc
819 | tseem
820 | tseemit
821 | tseemit2
822 | ttherising
823 | ttrex
824 | ubildawhale
825 | udex
826 | uhobi-pro
827 | uildawhale
828 | umewhale
829 | umpewhale
830 | underug
831 | uobi-pro
832 | upbbit
833 | upbi
834 | upbit
835 | upbit.com
836 | upbits
837 | upbitt
838 | upblt
839 | upemwhale
840 | upewhale
841 | upm
842 | upmee
843 | upmeewhale
844 | upmehale
845 | upmehwale
846 | upmewahle
847 | upmewhaale
848 | upmewhae
849 | upmewhael
850 | upmewhalee
851 | upmewhalle
852 | upmewhhale
853 | upmewhlae
854 | upmewhle
855 | upmewwhale
856 | upmme
857 | upmmewhale
858 | upmwehale
859 | upmwhale
860 | uppme
861 | uppmee
862 | uppmewhale
863 | uupmewhale
864 | vaalueup
865 | valeup
866 | valeuup
867 | vallueup
868 | valueeup
869 | valuep
870 | valuepu
871 | valueu
872 | valueupp
873 | valuuep
874 | valuueup
875 | valuup
876 | vaueup
877 | vauleup
878 | viabtc
879 | vittrex
880 | vlaueup
881 | vlueup
882 | vvalueup
883 | wallet.bitshares
884 | whaleshare
885 | www.aex.com
886 | www.binance.com
887 | www.bit-z.com
888 | www.bitfinex.com
889 | www.bithumb.com
890 | www.bitstamp.net
891 | www.bittrex.com
892 | www.coinbase.com
893 | www.coinegg.com
894 | www.coolcoin.com
895 | www.exx.com
896 | www.gatecoin.com
897 | www.gatehub.net
898 | www.gdax.com
899 | www.huobi.pro
900 | www.kraken.com
901 | www.livecoin.net
902 | www.okex.com
903 | www.poloniex.com
904 | www.qryptos.com
905 | www.xbtce.com
906 | xbtce.com
907 | ymupbit
908 | yobit
909 | yobit.net
910 | youbit
911 | yunbi
912 | zenieix
913 | `
914 |     .trim()
915 |     .split("\n");
916 | 
917 | export default list;
918 | 


--------------------------------------------------------------------------------
/src/renderers/default/embedder/utils/Links.ts:
--------------------------------------------------------------------------------
 1 | /**
 2 |  * Based on: https://raw.githubusercontent.com/steemit/condenser/master/src/app/utils/Links.js
 3 |  */
 4 | // tslint:disable variable-name prefer-for-of
 5 | 
 6 | const urlChar = '[^\\s"<>\\]\\[\\(\\)]';
 7 | const urlCharEnd = urlChar.replace(/\]$/, ".,']"); // insert bad chars to end on
 8 | const imagePath = "(?:(?:\\.(?:tiff?|jpe?g|gif|png|svg|ico)|ipfs/[a-z\\d]{40,}))";
 9 | const domainPath = "(?:[-a-zA-Z0-9\\._]*[-a-zA-Z0-9])";
10 | const urlChars = "(?:" + urlChar + "*" + urlCharEnd + ")?";
11 | 
12 | const urlSet = ({ domain = domainPath, path = "" } = {}) => {
13 |     // urlChars is everything but html or markdown stop chars
14 |     return `https?:\/\/${domain}(?::\\d{2,5})?(?:[/\\?#]${urlChars}${path ? path : ""})${path ? "" : "?"}`;
15 | };
16 | 
17 | /**
18 |  * Unless your using a 'g' (glob) flag you can store and re-use your regular expression.  Use the cache below.
19 |  *  If your using a glob (for example: replace all), the regex object becomes stateful and continues where it
20 |  *   left off when called with the
21 |  *   same string so naturally the regexp object can't be cached for long.
22 |  */
23 | export const any = (flags = "i") => new RegExp(urlSet(), flags);
24 | export const local = (flags = "i") => new RegExp(urlSet({ domain: "(?:localhost|(?:.*\\.)?steemit.com)" }), flags);
25 | export const remote = (flags = "i") =>
26 |     new RegExp(urlSet({ domain: `(?!localhost|(?:.*\\.)?steemit.com)${domainPath}` }), flags);
27 | export const youTube = (flags = "i") => new RegExp(urlSet({ domain: "(?:(?:.*.)?(youtube\\.com|youtu\\.be))" }), flags);
28 | export const image = (flags = "i") => new RegExp(urlSet({ path: imagePath }), flags);
29 | export const imageFile = (flags = "i") => new RegExp(imagePath, flags);
30 | // export const nonImage = (flags = 'i') => new RegExp(urlSet({path: '!' + imageFile}), flags)
31 | // export const markDownImageRegExp = (flags = 'i') => new RegExp('\!\[[\w\s]*\]\(([^\)]+)\)', flags);
32 | 
33 | export default {
34 |     any: any(),
35 |     local: local(),
36 |     remote: remote(),
37 |     image: image(),
38 |     imageFile: imageFile(),
39 |     youTube: youTube(),
40 |     youTubeId: /(?:(?:youtube.com\/watch\?v=)|(?:youtu.be\/)|(?:youtube.com\/embed\/))([A-Za-z0-9\_\-]+)/i,
41 |     vimeo: /https?:\/\/(?:vimeo.com\/|player.vimeo.com\/video\/)([0-9]+)\/*/,
42 |     vimeoId: /(?:vimeo.com\/|player.vimeo.com\/video\/)([0-9]+)/,
43 |     // simpleLink: new RegExp(`<a href="(.*)">(.*)<\/a>`, 'ig'),
44 |     ipfsPrefix: /(https?:\/\/.*)?\/ipfs/i,
45 |     twitch: /https?:\/\/(?:www.)?twitch.tv\/(?:(videos)\/)?([a-zA-Z0-9][\w]{3,24})/i,
46 | };
47 | 
48 | /**
49 |  * Returns a new object extended from outputParams with [key] == inputParams[key] if the value is in allowedValues
50 |  * @param outputParams
51 |  * @param inputParamsco
52 |  * @param key
53 |  * @param allowedValues
54 |  * @returns {*}
55 |  */
56 | export const addToParams = (outputParams: any, inputParams: any, key: any, allowedValues: any) => {
57 |     const respParams = Object.assign({}, outputParams);
58 |     if (inputParams[key] && allowedValues.indexOf(inputParams[key]) > -1) {
59 |         respParams[key] = inputParams[key];
60 |     }
61 |     return respParams;
62 | };
63 | 
64 | export const makeParams = (params: string[], prefix: string | false) => {
65 |     let paramsList: string[] = [];
66 |     if (params.constructor === Array) {
67 |         paramsList = params;
68 |     } else {
69 |         Object.entries(params).forEach(([key, value]) => {
70 |             paramsList.push(`${key}=${value}`);
71 |         });
72 |     }
73 |     if (paramsList.length > 0) {
74 |         return (prefix !== false ? (typeof prefix === "string" ? prefix : "?") : "") + paramsList.join("&");
75 |     }
76 |     return "";
77 | };
78 | 


--------------------------------------------------------------------------------
/src/renderers/default/embedder/videoembedders/AbstractVideoEmbedder.ts:
--------------------------------------------------------------------------------
 1 | // tslint:disable member-ordering
 2 | 
 3 | export abstract class AbstractVideoEmbedder {
 4 |     public abstract markEmbedIfFound(textNode: HTMLObjectElement): { image?: string; link?: string } | undefined;
 5 |     public abstract processEmbedIfRelevant(
 6 |         embedType: string,
 7 |         id: string,
 8 |         size: { width: number; height: number },
 9 |         htmlElementKey: string,
10 |     ): string | undefined;
11 | 
12 |     public static getEmbedMarker(id: string, type: string) {
13 |         return `~~~ embed:${id} ${type} ~~~`;
14 |     }
15 | 
16 |     public static insertAllEmbeds(
17 |         embedders: AbstractVideoEmbedder[],
18 |         input: string,
19 |         size: { width: number; height: number },
20 |     ): string {
21 |         // In addition to inserting the youtube component, this allows
22 |         // react to compare separately preventing excessive re-rendering.
23 |         let idx = 0;
24 |         const sections = [];
25 | 
26 |         // HtmlReady inserts ~~~ embed:${id} type ~~~
27 |         for (let section of input.split("~~~ embed:")) {
28 |             const match = section.match(/^([A-Za-z0-9\?\=\_\-]+) ([^ ]*) ~~~/);
29 |             if (match && match.length >= 3) {
30 |                 const id = match[1];
31 |                 const type = match[2];
32 |                 for (const embedder of embedders) {
33 |                     const resp = embedder.processEmbedIfRelevant(type, id, size, idx++ + "");
34 |                     if (resp) {
35 |                         sections.push(resp);
36 |                         break;
37 |                     }
38 |                 }
39 |                 section = section.substring(`${id} ${type} ~~~`.length);
40 |                 // section = section.substring(`${id} ${type} ~~~`.length);
41 |                 if (section === "") {
42 |                     continue;
43 |                 }
44 |             }
45 |             sections.push(section);
46 |         }
47 |         return sections.join("");
48 |     }
49 | }
50 | 


--------------------------------------------------------------------------------
/src/renderers/default/embedder/videoembedders/TwitchEmbedder.ts:
--------------------------------------------------------------------------------
 1 | import { Log } from "../../../../Log";
 2 | import linksRe from "../utils/Links";
 3 | 
 4 | import { AbstractVideoEmbedder } from "./AbstractVideoEmbedder";
 5 | 
 6 | export class TwitchEmbedder extends AbstractVideoEmbedder {
 7 |     private static TYPE = "twitch";
 8 | 
 9 |     public markEmbedIfFound(child: HTMLObjectElement) {
10 |         try {
11 |             const data = child.data;
12 |             const twitch = this.twitchId(data);
13 |             if (!twitch) {
14 |                 return undefined;
15 |             }
16 | 
17 |             const embedMarker = AbstractVideoEmbedder.getEmbedMarker(twitch.id, TwitchEmbedder.TYPE);
18 |             child.data = data.replace(twitch.url, embedMarker);
19 | 
20 |             return { link: twitch.canonical };
21 |         } catch (error) {
22 |             Log.log().error(error);
23 |         }
24 |         return undefined;
25 |     }
26 | 
27 |     public processEmbedIfRelevant(
28 |         embedType: string,
29 |         id: string,
30 |         size: { width: number; height: number },
31 |         htmlElementKey: string,
32 |     ): string | undefined {
33 |         if (embedType !== TwitchEmbedder.TYPE) return undefined;
34 |         const url = `https://player.twitch.tv/${id}`;
35 |         return `<div className="videoWrapper">
36 |                 <iframe
37 |                     key=${htmlElementKey}
38 |                     src=${url}
39 |                     width=${size.width}
40 |                     height=${size.height}
41 |                     rameBorder="0"
42 |                     allowFullScreen
43 |                 />
44 |             </div>`;
45 |     }
46 | 
47 |     private twitchId(data: any) {
48 |         if (!data) {
49 |             return null;
50 |         }
51 |         const m = data.match(linksRe.twitch);
52 |         if (!m || m.length < 3) {
53 |             return null;
54 |         }
55 | 
56 |         return {
57 |             id: m[1] === `videos` ? `?video=${m[2]}` : `?channel=${m[2]}`,
58 |             url: m[0],
59 |             canonical:
60 |                 m[1] === `videos`
61 |                     ? `https://player.twitch.tv/?video=${m[2]}`
62 |                     : `https://player.twitch.tv/?channel=${m[2]}`,
63 |         };
64 |     }
65 | }
66 | 


--------------------------------------------------------------------------------
/src/renderers/default/embedder/videoembedders/VideoEmbedders.ts:
--------------------------------------------------------------------------------
 1 | import { AbstractVideoEmbedder } from "./AbstractVideoEmbedder";
 2 | import { TwitchEmbedder } from "./TwitchEmbedder";
 3 | import { VimeoEmbedder } from "./VimeoEmbedder";
 4 | import { YoutubeEmbedder } from "./YoutubeEmbedder";
 5 | 
 6 | export class VideoEmbedders {
 7 |     public static LIST: AbstractVideoEmbedder[] = [
 8 |         //
 9 |         new YoutubeEmbedder(),
10 |         new VimeoEmbedder(),
11 |         new TwitchEmbedder(),
12 |     ];
13 | 
14 |     public static processTextNodeAndInsertEmbeds(node: HTMLObjectElement): { links: string[]; images: string[] } {
15 |         const out: { links: string[]; images: string[] } = { links: [], images: [] };
16 | 
17 |         for (const embedder of VideoEmbedders.LIST) {
18 |             const markResult = embedder.markEmbedIfFound(node);
19 |             if (markResult) {
20 |                 if (markResult.image) out.images.push(markResult.image);
21 |                 if (markResult.link) out.links.push(markResult.link);
22 |             }
23 |         }
24 |         return out;
25 |     }
26 | 
27 |     public static insertMarkedEmbedsToRenderedOutput(input: string, size: { width: number; height: number }): string {
28 |         return AbstractVideoEmbedder.insertAllEmbeds(VideoEmbedders.LIST, input, size);
29 |     }
30 | }
31 | 


--------------------------------------------------------------------------------
/src/renderers/default/embedder/videoembedders/VimeoEmbedder.ts:
--------------------------------------------------------------------------------
 1 | import { Log } from "../../../../Log";
 2 | import linksRe from "../utils/Links";
 3 | 
 4 | import { AbstractVideoEmbedder } from "./AbstractVideoEmbedder";
 5 | 
 6 | export class VimeoEmbedder extends AbstractVideoEmbedder {
 7 |     private static TYPE = "vimeo";
 8 | 
 9 |     public markEmbedIfFound(child: HTMLObjectElement) {
10 |         try {
11 |             const data = child.data;
12 |             const vimeo = this.vimeoId(data);
13 |             if (!vimeo) {
14 |                 return undefined;
15 |             }
16 |             const embedMarker = AbstractVideoEmbedder.getEmbedMarker(vimeo.id, VimeoEmbedder.TYPE);
17 | 
18 |             child.data = data.replace(vimeo.url, embedMarker);
19 | 
20 |             return { link: vimeo.canonical };
21 |         } catch (error) {
22 |             Log.log().error(error);
23 |         }
24 |         return undefined;
25 |     }
26 | 
27 |     public processEmbedIfRelevant(
28 |         embedType: string,
29 |         id: string,
30 |         size: { width: number; height: number },
31 |         htmlElementKey: string,
32 |     ): string | undefined {
33 |         if (embedType !== VimeoEmbedder.TYPE) return undefined;
34 |         const url = `https://player.vimeo.com/video/${id}`;
35 |         return `<div className="videoWrapper">
36 |             <iframe
37 |                 key=${htmlElementKey}
38 |                 src=${url}
39 |                 width=${size.width}
40 |                 height=${size.height}
41 |                 frameBorder="0"
42 |                 webkitallowfullscreen
43 |                 mozallowfullscreen
44 |                 allowFullScreen
45 |             />
46 |         </div>`;
47 |     }
48 | 
49 |     private vimeoId(data: string) {
50 |         if (!data) {
51 |             return null;
52 |         }
53 |         const m = data.match(linksRe.vimeo);
54 |         if (!m || m.length < 2) {
55 |             return null;
56 |         }
57 | 
58 |         return {
59 |             id: m[1],
60 |             url: m[0],
61 |             canonical: `https://player.vimeo.com/video/${m[1]}`,
62 |             // thumbnail: requires a callback - http://stackoverflow.com/questions/1361149/get-img-thumbnails-from-vimeo
63 |         };
64 |     }
65 | }
66 | 


--------------------------------------------------------------------------------
/src/renderers/default/embedder/videoembedders/YoutubeEmbedder.ts:
--------------------------------------------------------------------------------
 1 | import { Log } from "../../../../Log";
 2 | import linksRe from "../utils/Links";
 3 | 
 4 | import { AbstractVideoEmbedder } from "./AbstractVideoEmbedder";
 5 | 
 6 | export class YoutubeEmbedder extends AbstractVideoEmbedder {
 7 |     /** @return {id, url} or <b>null</b> */
 8 |     public static getYoutubeMetadataFromLink(data: string): { id: string; url: string; thumbnail: string } | null {
 9 |         if (!data) {
10 |             return null;
11 |         }
12 | 
13 |         const m1 = data.match(linksRe.youTube);
14 |         const url = m1 ? m1[0] : null;
15 |         if (!url) {
16 |             return null;
17 |         }
18 | 
19 |         const m2 = url.match(linksRe.youTubeId);
20 |         const id = m2 && m2.length >= 2 ? m2[1] : null;
21 |         if (!id) {
22 |             return null;
23 |         }
24 | 
25 |         return {
26 |             id,
27 |             url,
28 |             thumbnail: "https://img.youtube.com/vi/" + id + "/0.jpg",
29 |         };
30 |     }
31 | 
32 |     private static TYPE = "youtube";
33 | 
34 |     public markEmbedIfFound(child: HTMLObjectElement) {
35 |         try {
36 |             const data = child.data;
37 |             const yt = YoutubeEmbedder.getYoutubeMetadataFromLink(data);
38 |             if (!yt) {
39 |                 return undefined;
40 |             }
41 | 
42 |             const embedMarker = AbstractVideoEmbedder.getEmbedMarker(yt.id, YoutubeEmbedder.TYPE);
43 |             child.data = data.replace(yt.url, embedMarker);
44 | 
45 |             return { image: yt.thumbnail, link: yt.url };
46 |         } catch (error) {
47 |             Log.log().error(error);
48 |         }
49 |         return undefined;
50 |     }
51 | 
52 |     public processEmbedIfRelevant(
53 |         embedType: string,
54 |         id: string,
55 |         size: { width: number; height: number },
56 |         htmlElementKey: string,
57 |     ): string | undefined {
58 |         if (embedType !== YoutubeEmbedder.TYPE) return undefined;
59 | 
60 |         const ytUrl = `https://www.youtube.com/embed/${id}`;
61 |         return `<div class="videoWrapper"><iframe
62 |                     width="${size.width}"
63 |                     height="${size.height}"
64 |                     src="${ytUrl}"
65 |                     allowfullscreen="allowfullscreen"
66 |                     webkitallowfullscreen="webkitallowfullscreen"
67 |                     mozallowfullscreen="mozallowfullscreen"
68 |                     frameborder="0"
69 |                 ></iframe></div>`;
70 |     }
71 | }
72 | 


--------------------------------------------------------------------------------
/src/renderers/default/sanitization/PreliminarySanitizer.ts:
--------------------------------------------------------------------------------
 1 | export class PreliminarySanitizer {
 2 |     public static preliminarySanitize(text: string): string {
 3 |         return PreliminarySanitizer.stripHtmlComments(text);
 4 |     }
 5 | 
 6 |     private static stripHtmlComments(text: string) {
 7 |         return text.replace(/<!--([\s\S]+?)(-->|$)/g, "(html comment removed: $1)");
 8 |     }
 9 | }
10 | 


--------------------------------------------------------------------------------
/src/renderers/default/sanitization/TagTransformingSanitizer.ts:
--------------------------------------------------------------------------------
  1 | /**
  2 |  * This file is based on https://github.com/steemit/condenser/blob/master/src/app/utils/SanitizeConfig.js
  3 |  */
  4 | import ow from "ow";
  5 | import * as sanitize from "sanitize-html";
  6 | 
  7 | import { Log } from "../../../Log";
  8 | import { DefaultRendererLocalization } from "../DefaultRendererLocalization";
  9 | import { StaticConfig } from "../StaticConfig";
 10 | 
 11 | export class TagTransformingSanitizer {
 12 |     private options: TagTransformingSanitizer.Options;
 13 |     private localization: DefaultRendererLocalization;
 14 |     private sanitizationErrors: string[] = [];
 15 | 
 16 |     public constructor(options: TagTransformingSanitizer.Options, localization: DefaultRendererLocalization) {
 17 |         TagTransformingSanitizer.Options.validate(options);
 18 |         this.localization = localization;
 19 | 
 20 |         this.options = options;
 21 |     }
 22 | 
 23 |     public sanitize(text: string): string {
 24 |         return sanitize(text, this.generateSanitizeConfig());
 25 |     }
 26 | 
 27 |     public getErrors(): string[] {
 28 |         return this.sanitizationErrors;
 29 |     }
 30 | 
 31 |     private generateSanitizeConfig(): sanitize.IOptions {
 32 |         return {
 33 |             allowedTags: StaticConfig.sanitization.allowedTags,
 34 | 
 35 |             // SEE https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
 36 |             allowedAttributes: {
 37 |                 // "src" MUST pass a whitelist (below)
 38 |                 iframe: [
 39 |                     "src",
 40 |                     "width",
 41 |                     "height",
 42 |                     "frameborder",
 43 |                     "allowfullscreen",
 44 |                     "webkitallowfullscreen",
 45 |                     "mozallowfullscreen",
 46 |                 ],
 47 | 
 48 |                 // class attribute is strictly whitelisted (below)
 49 |                 // and title is only set in the case of a phishing warning
 50 |                 div: ["class", "title"],
 51 | 
 52 |                 // style is subject to attack, filtering more below
 53 |                 td: ["style"],
 54 |                 img: ["src", "alt"],
 55 | 
 56 |                 // title is only set in the case of an external link warning
 57 |                 a: ["href", "rel", "title"],
 58 |             },
 59 |             allowedSchemes: ["http", "https", "steem"],
 60 |             transformTags: {
 61 |                 iframe: (tagName: string, attribs: sanitize.Attributes) => {
 62 |                     const srcAtty = attribs.src;
 63 |                     for (const item of StaticConfig.sanitization.iframeWhitelist) {
 64 |                         if (item.re.test(srcAtty)) {
 65 |                             const src = typeof item.fn === "function" ? item.fn(srcAtty) : srcAtty;
 66 |                             if (!src) {
 67 |                                 break;
 68 |                             }
 69 |                             const iframeToBeReturned: sanitize.Tag = {
 70 |                                 tagName: "iframe",
 71 |                                 attribs: {
 72 |                                     frameborder: "0",
 73 |                                     allowfullscreen: "allowfullscreen",
 74 | 
 75 |                                     // deprecated but required for vimeo : https://vimeo.com/forums/help/topic:278181
 76 |                                     webkitallowfullscreen: "webkitallowfullscreen",
 77 | 
 78 |                                     mozallowfullscreen: "mozallowfullscreen", // deprecated but required for vimeo
 79 |                                     src,
 80 |                                     width: this.options.iframeWidth + "",
 81 |                                     height: this.options.iframeHeight + "",
 82 |                                 },
 83 |                             };
 84 |                             return iframeToBeReturned;
 85 |                         }
 86 |                     }
 87 |                     Log.log().warn('Blocked, did not match iframe "src" white list urls:', tagName, attribs);
 88 |                     this.sanitizationErrors.push("Invalid iframe URL: " + srcAtty);
 89 | 
 90 |                     const retTag: sanitize.Tag = { tagName: "div", text: `(Unsupported ${srcAtty})`, attribs: {} };
 91 |                     return retTag;
 92 |                 },
 93 |                 img: (tagName, attribs) => {
 94 |                     if (this.options.noImage) {
 95 |                         const retTagOnImagesNotAllowed: sanitize.Tag = {
 96 |                             tagName: "div",
 97 |                             text: this.localization.noImage,
 98 |                             attribs: {},
 99 |                         };
100 |                         return retTagOnImagesNotAllowed;
101 |                     }
102 |                     // See https://github.com/punkave/sanitize-html/issues/117
103 |                     const { src, alt } = attribs;
104 |                     if (!/^(https?:)?\/\//i.test(src)) {
105 |                         Log.log().warn("Blocked, image tag src does not appear to be a url", tagName, attribs);
106 |                         this.sanitizationErrors.push("An image in this post did not save properly.");
107 |                         const retTagOnNoUrl: sanitize.Tag = {
108 |                             tagName: "img",
109 |                             attribs: { src: "brokenimg.jpg" },
110 |                         };
111 |                         return retTagOnNoUrl;
112 |                     }
113 | 
114 |                     const atts: sanitize.Attributes = {};
115 |                     atts.src = src.replace(/^http:\/\//i, "//"); // replace http:// with // to force https when needed
116 |                     if (alt && alt !== "") {
117 |                         atts.alt = alt;
118 |                     }
119 |                     const retTag: sanitize.Tag = { tagName, attribs: atts };
120 |                     return retTag;
121 |                 },
122 |                 div: (tagName, attribs) => {
123 |                     const attys: sanitize.Attributes = {};
124 |                     const classWhitelist = [
125 |                         "pull-right",
126 |                         "pull-left",
127 |                         "text-justify",
128 |                         "text-rtl",
129 |                         "text-center",
130 |                         "text-right",
131 |                         "videoWrapper",
132 |                         "phishy",
133 |                     ];
134 |                     const validClass = classWhitelist.find(e => attribs.class === e);
135 |                     if (validClass) {
136 |                         attys.class = validClass;
137 |                     }
138 |                     if (validClass === "phishy" && attribs.title === this.localization.phishingWarning) {
139 |                         attys.title = attribs.title;
140 |                     }
141 |                     const retTag: sanitize.Tag = {
142 |                         tagName,
143 |                         attribs: attys,
144 |                     };
145 |                     return retTag;
146 |                 },
147 |                 td: (tagName, attribs) => {
148 |                     const attys: sanitize.Attributes = {};
149 |                     if (attribs.style === "text-align:right") {
150 |                         attys.style = "text-align:right";
151 |                     }
152 |                     const retTag: sanitize.Tag = {
153 |                         tagName,
154 |                         attribs: attys,
155 |                     };
156 |                     return retTag;
157 |                 },
158 |                 a: (tagName, attribs) => {
159 |                     let { href } = attribs;
160 |                     if (!href) {
161 |                         href = "#";
162 |                     }
163 |                     href = href.trim();
164 |                     const attys: sanitize.Attributes = { href };
165 |                     // If it's not a (relative or absolute) steemit URL...
166 |                     if (!this.options.isLinkSafeFn(href)) {
167 |                         // attys.target = '_blank' // pending iframe impl https://mathiasbynens.github.io/rel-noopener/
168 |                         attys.rel = this.options.addNofollowToLinks ? "nofollow noopener" : "noopener";
169 |                         attys.title = this.localization.phishingWarning;
170 |                     }
171 |                     const retTag: sanitize.Tag = {
172 |                         tagName,
173 |                         attribs: attys,
174 |                     };
175 |                     return retTag;
176 |                 },
177 |             },
178 |         };
179 |     }
180 | }
181 | 
182 | export namespace TagTransformingSanitizer {
183 |     export interface Options {
184 |         iframeWidth: number;
185 |         iframeHeight: number;
186 |         addNofollowToLinks: boolean;
187 |         noImage: boolean;
188 |         isLinkSafeFn: (url: string) => boolean;
189 |     }
190 | 
191 |     export namespace Options {
192 |         export function validate(o: Options) {
193 |             ow(o.iframeWidth, "TagTransformingSanitizer.Options.iframeWidth", ow.number.integer.positive);
194 |             ow(o.iframeHeight, "TagTransformingSanitizer.Options.iframeHeight", ow.number.integer.positive);
195 |             ow(o.addNofollowToLinks, "TagTransformingSanitizer.Options.addNofollowToLinks", ow.boolean);
196 |             ow(o.noImage, "TagTransformingSanitizer.Options.noImage", ow.boolean);
197 |             ow(o.isLinkSafeFn, "TagTransformingSanitizer.Options.isLinkSafeFn", ow.function);
198 |         }
199 |     }
200 | }
201 | 


--------------------------------------------------------------------------------
/src/security/LinkSanitizer.spec.test.ts:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/wise-team/steem-content-renderer/53c59042dcf7e76df7078a839fb8d0b7346b1e37/src/security/LinkSanitizer.spec.test.ts


--------------------------------------------------------------------------------
/src/security/LinkSanitizer.ts:
--------------------------------------------------------------------------------
 1 | import ow from "ow";
 2 | 
 3 | import { Log } from "../Log";
 4 | 
 5 | import { Phishing } from "./Phishing";
 6 | 
 7 | export class LinkSanitizer {
 8 |     private options: LinkSanitizer.Options;
 9 |     private baseUrl: URL;
10 |     private topLevelsBaseDomain: string;
11 | 
12 |     public constructor(options: LinkSanitizer.Options) {
13 |         LinkSanitizer.Options.validate(options);
14 |         this.options = options;
15 |         this.baseUrl = new URL(this.options.baseUrl);
16 |         this.topLevelsBaseDomain = this.getTopLevelBaseDomainFromBaseUrl(this.baseUrl);
17 |     }
18 | 
19 |     public sanitizeLink(url: string, urlTitle: string): string | false {
20 |         url = this.prependUnknownProtocolLink(url);
21 | 
22 |         Log.log().debug("LinkSanitizer#sanitizeLink", { url, urlTitle });
23 | 
24 |         if (Phishing.looksPhishy(url)) {
25 |             Log.log().debug("LinkSanitizer#sanitizeLink", "phishing link detected", "phishing list", url, {
26 |                 url,
27 |                 urlTitle,
28 |             });
29 |             return false;
30 |         }
31 | 
32 |         if (this.isPseudoLocalUrl(url, urlTitle)) {
33 |             Log.log().debug("LinkSanitizer#sanitizeLink", "phishing link detected", "pseudo local url", url, {
34 |                 url,
35 |                 urlTitle,
36 |             });
37 |             return false;
38 |         }
39 |         return url;
40 |     }
41 | 
42 |     private getTopLevelBaseDomainFromBaseUrl(url: URL) {
43 |         const regex = /([^\s\/$.?#]+\.[^\s\/$.?#]+)$/g;
44 |         const m = regex.exec(url.hostname);
45 |         if (m && m[0]) return m[0];
46 |         else {
47 |             throw new Error(
48 |                 `LinkSanitizer: could not determine top level base domain from baseUrl hostname: ${url.hostname}`,
49 |             );
50 |         }
51 |     }
52 | 
53 |     private prependUnknownProtocolLink(url: string): string {
54 |         // If this link is not relative, http, https, or steem -- add https.
55 |         if (!/^((#)|(\/(?!\/))|(((steem|https?):)?\/\/))/.test(url)) {
56 |             url = "https://" + url;
57 |         }
58 |         return url;
59 |     }
60 | 
61 |     private isPseudoLocalUrl(url: string, urlTitle: string): boolean {
62 |         if (url.indexOf("#") === 0) return false;
63 |         url = url.toLowerCase();
64 |         urlTitle = urlTitle.toLowerCase();
65 | 
66 |         try {
67 |             const urlTitleContainsBaseDomain = urlTitle.indexOf(this.topLevelsBaseDomain) !== -1;
68 |             const urlContainsBaseDomain = url.indexOf(this.topLevelsBaseDomain) !== -1;
69 |             if (urlTitleContainsBaseDomain && !urlContainsBaseDomain) {
70 |                 return true;
71 |             }
72 |         } catch (error) {
73 |             if (error instanceof TypeError) {
74 |                 return false; // if url is invalid it is ok
75 |             } else throw error;
76 |         }
77 |         return false;
78 |     }
79 | }
80 | 
81 | export namespace LinkSanitizer {
82 |     export interface Options {
83 |         baseUrl: string;
84 |     }
85 | 
86 |     export namespace Options {
87 |         export function validate(o: Options) {
88 |             ow(o, "LinkSanitizer.Options", ow.object);
89 |             ow(o.baseUrl, "LinkSanitizer.Options.baseUrl", ow.string.nonEmpty);
90 |         }
91 |     }
92 | }
93 | 


--------------------------------------------------------------------------------
/src/security/Phishing.ts:
--------------------------------------------------------------------------------
  1 | /**
  2 |  * Based on: https://raw.githubusercontent.com/steemit/condenser/master/src/app/utils/Phishing.js
  3 |  */
  4 | 
  5 | const domains = [
  6 |     "steewit.com",
  7 |     "śteemit.com",
  8 |     "ŝteemit.com",
  9 |     "şteemit.com",
 10 |     "šteemit.com",
 11 |     "sţeemit.com",
 12 |     "sťeemit.com",
 13 |     "șteemit.com",
 14 |     "sleemit.com",
 15 |     "aba.ae",
 16 |     "autobidbot.cf",
 17 |     "autobidbot.ga",
 18 |     "autobidbot.gq",
 19 |     "autobotsteem.cf",
 20 |     "autobotsteem.ga",
 21 |     "autobotsteem.gq",
 22 |     "autobotsteem.ml",
 23 |     "autosteem.info",
 24 |     "autosteembot.cf",
 25 |     "autosteembot.ga",
 26 |     "autosteembot.gq",
 27 |     "autosteembot.ml",
 28 |     "autosteemit.wapka.mobi",
 29 |     "boostbot.ga",
 30 |     "boostbot.gq",
 31 |     "boostwhaleup.cf",
 32 |     "cutt.us",
 33 |     "dereferer.me",
 34 |     "eb2a.com",
 35 |     "lordlinkers.tk",
 36 |     "nullrefer.com",
 37 |     "steeemit.ml",
 38 |     "steeemitt.aba.ae",
 39 |     "steemart.ga",
 40 |     "steemautobot.bid",
 41 |     "steemautobot.cf",
 42 |     "steemautobot.trade",
 43 |     "steemers.aba.ae",
 44 |     "steemiit.cf",
 45 |     "steemiit.ga",
 46 |     "steemij.tk",
 47 |     "steemik.ga",
 48 |     "steemik.tk",
 49 |     "steemil.com",
 50 |     "steemil.ml",
 51 |     "steemir.tk",
 52 |     "steemitou.co.nf",
 53 |     "steemitservices.ga",
 54 |     "steemitservices.gq",
 55 |     "steemiz.tk",
 56 |     "steemnow.cf",
 57 |     "steemnow.ga",
 58 |     "steemnow.gq",
 59 |     "steemnow.ml",
 60 |     "steempostupper.win",
 61 |     "steemrewards.ml",
 62 |     "steemrobot.ga",
 63 |     "steemrobot.ml",
 64 |     "steemupgot.cf",
 65 |     "steemupgot.ga",
 66 |     "steemupgot.gq",
 67 |     "steemupper.cf",
 68 |     "steemupper.ga",
 69 |     "steemupper.gq",
 70 |     "steemupper.ml",
 71 |     "steenit.cf",
 72 |     "stemit.com",
 73 |     "stssmater.aba.ae",
 74 |     "uppervotes.ga",
 75 |     "uppervotes.gq",
 76 |     "upperwhaleplus.cf",
 77 |     "upperwhaleplus.ga",
 78 |     "upperwhaleplus.gq",
 79 |     "upvoteme.cf",
 80 |     "upvoteme.ga",
 81 |     "upvoteme.gq",
 82 |     "upvoteme.ml",
 83 |     "url.rw",
 84 |     "us.aba.ae",
 85 |     "whaleboostup.ga",
 86 |     "whaleboostup.ml",
 87 | ];
 88 | 
 89 | export namespace Phishing {
 90 |     /**
 91 |      * Does this URL look like a phishing attempt?
 92 |      *
 93 |      * @param {string} questionableUrl
 94 |      * @returns {boolean}
 95 |      */
 96 |     export const looksPhishy = (questionableUrl: string) => {
 97 |         for (const domain of domains) {
 98 |             if (questionableUrl.toLocaleLowerCase().indexOf(domain) > -1) return true;
 99 |         }
100 | 
101 |         return false;
102 |     };
103 | }
104 | 


--------------------------------------------------------------------------------
/src/security/SecurityChecker.spec.test.ts:
--------------------------------------------------------------------------------
 1 | import { expect } from "chai";
 2 | import "mocha";
 3 | 
 4 | import { SecurityChecker } from "./SecurityChecker";
 5 | 
 6 | describe("SecurityChecker", () => {
 7 |     describe("checkSecurity", () => {
 8 |         describe("props.allowScriptTag = false", () => {
 9 |             const opts = { allowScriptTag: false };
10 | 
11 |             it("Throws when contains script tag", () => {
12 |                 expect(() => SecurityChecker.checkSecurity("<script src=", opts)).to.throw(
13 |                     /insecure content/,
14 |                 );
15 |             });
16 | 
17 |             it("Does not throw when no script tag", () => {
18 |                 SecurityChecker.checkSecurity("<p></p>", opts);
19 |             });
20 |         });
21 | 
22 |         describe("props.allowScriptTag = true", () => {
23 |             const opts = { allowScriptTag: true };
24 | 
25 |             it("Does not throw when script tag", () => {
26 |                 SecurityChecker.checkSecurity("<script src=", opts);
27 |             });
28 | 
29 |             it("Does not throw when no script tag", () => {
30 |                 SecurityChecker.checkSecurity("<p></p>", opts);
31 |             });
32 |         });
33 |     });
34 | });
35 | 


--------------------------------------------------------------------------------
/src/security/SecurityChecker.ts:
--------------------------------------------------------------------------------
 1 | import ChainedError from "typescript-chained-error";
 2 | 
 3 | export class SecurityChecker {
 4 |     public static checkSecurity(text: string, props: { allowScriptTag: boolean }) {
 5 |         if (!props.allowScriptTag && this.containsScriptTag(text)) {
 6 |             throw new SecurityChecker.SecurityError(
 7 |                 "Renderer rejected the input because of insecure content: text contains script tag",
 8 |             );
 9 |         }
10 |     }
11 | 
12 |     private static containsScriptTag(text: string): boolean {
13 |         return /<\s*script/gi.test(text);
14 |     }
15 | }
16 | 
17 | export namespace SecurityChecker {
18 |     /* tslint:disable max-classes-per-file */
19 |     export class SecurityError extends ChainedError {
20 |         public constructor(message?: string, cause?: Error) {
21 |             super(message, cause);
22 |         }
23 |     }
24 | }
25 | 


--------------------------------------------------------------------------------
/tsconfig.json:
--------------------------------------------------------------------------------
 1 | {
 2 |     "compilerOptions": {
 3 |         "module": "commonjs",
 4 |         "target": "es6",
 5 |         "strict": true,
 6 |         "declaration": true,
 7 |         "moduleResolution": "node",
 8 |         "allowSyntheticDefaultImports": false,
 9 |         "noImplicitAny": true,
10 |         "allowJs": false,
11 |         "sourceMap": true,
12 |         "outDir": "dist",
13 |         "baseUrl": "src/",
14 |         "paths": {
15 |             "*": [
16 |                 "node_modules/*",
17 |                 "src/types/*"
18 |             ]
19 |         }
20 |     },
21 |     "include": [
22 |         "src/**/*"
23 |     ],
24 |     "exclude": [
25 |         "src/**/*.test.ts",
26 |         "**/_test/**/*"
27 |     ]
28 | }


--------------------------------------------------------------------------------
/tsconfig.lint.json:
--------------------------------------------------------------------------------
1 | {
2 |     "extends": "./tsconfig.json",
3 |     "exclude": []
4 | }


--------------------------------------------------------------------------------
/tslint.json:
--------------------------------------------------------------------------------
1 | {
2 |     "extends": "wise-tslint-configuration"
3 | }


--------------------------------------------------------------------------------
/webpack.config.js:
--------------------------------------------------------------------------------
 1 | 'use strict';
 2 | 
 3 | const Visualizer = require('webpack-visualizer-plugin');
 4 | 
 5 | const path = require('path');
 6 | const webpack = require('webpack');
 7 | 
 8 | const DEFAULTS = {
 9 |     isDevelopment: process.env.NODE_ENV !== 'production',
10 |     baseDir: path.join(__dirname, '..'),
11 | };
12 | 
13 | module.exports = {
14 |     mode: (DEFAULTS.isDevelopment ? "development" : "production"),
15 |     entry: "./dist/index",
16 |     output: {
17 |         path: path.resolve(__dirname, "dist", "browser"),
18 |         filename: "steem-content-renderer.min.js",
19 |         library: "SteemContentRenderer",
20 |         libraryTarget: "umd"
21 |     },
22 |     devtool: (DEFAULTS.isDevelopment ? 'cheap-eval-source-map' : ''),
23 |     target: "web",
24 |     module: {
25 |         rules: []
26 |     },
27 |     optimization: {
28 |         minimize: (DEFAULTS.isDevelopment ? false : true)
29 |     },
30 |     performance: {
31 |         hints: false
32 |     },
33 |     resolve: {
34 |         extensions: [".js", ".json"]
35 |     },
36 |     node: {
37 |         fs: "empty" // fix can't resolve "fs" in ow
38 |     },
39 |     plugins: [
40 |         new Visualizer({
41 |             filename: './statistics.html'
42 |         }),
43 |         new webpack.DefinePlugin({
44 |             'process.env': (process.env.NODE_ENV === 'production') ? {
45 |               NODE_ENV: '"production"'
46 |             } : {
47 |               NODE_ENV: '"development"'
48 |             },
49 |             "_WEBPACK_BUILD": JSON.stringify(true),
50 |           }),
51 |     ]
52 | }


--------------------------------------------------------------------------------