feat : update

2026-09-04 23:30:42 +07:00
parent 890b88d4f1
commit b4f9fb0abb
12 changed files with 689 additions and 196 deletions
@@ -0,0 +1,108 @@
+import { highlightTextSegments, type TextHighlight } from "@/lib/guides/highlights";
+
+const ALLOWED_TAGS = new Set([
+  "a",
+  "blockquote",
+  "br",
+  "code",
+  "em",
+  "li",
+  "ol",
+  "p",
+  "pre",
+  "s",
+  "span",
+  "strong",
+  "u",
+  "ul",
+]);
+
+const BLOCKED_CONTENT = /<(script|style|iframe|object|embed|svg|math|template)\b[^>]*>[\s\S]*?<\/\1\s*>/gi;
+const HTML_COMMENT = /<!--[\s\S]*?-->/g;
+const TAG = /<\/?([a-zA-Z][a-zA-Z0-9-]*)([^>]*)>/g;
+const ATTRIBUTE = /([a-zA-Z_:][a-zA-Z0-9_:.-]*)\s*=\s*("[^"]*"|'[^']*'|[^\s"'=<>`]+)/g;
+const HEX_COLOR = /^#[0-9a-fA-F]{6}$/;
+
+export function sanitizeRichTextUrl(value: string): string {
+  const url = value.trim();
+  if (!url) return "";
+
+  try {
+    const parsed = new URL(url, "https://example.invalid");
+    return ["http:", "https:", "mailto:"].includes(parsed.protocol) ? url : "";
+  } catch {
+    return "";
+  }
+}
+
+function escapeAttribute(value: string): string {
+  return value
+    .replaceAll("&", "&amp;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;");
+}
+
+function escapeHtml(value: string): string {
+  return escapeAttribute(value).replaceAll("'", "&#39;");
+}
+
+function attributeValue(rawAttributes: string, name: string): string {
+  for (const match of rawAttributes.matchAll(ATTRIBUTE)) {
+    if (match[1].toLowerCase() === name) {
+      return match[2].replace(/^['"]|['"]$/g, "");
+    }
+  }
+  return "";
+}
+
+export function sanitizeRichTextHtml(value: string): string {
+  return value
+    .replace(BLOCKED_CONTENT, "")
+    .replace(HTML_COMMENT, "")
+    .replace(TAG, (tag, rawName: string, rawAttributes: string) => {
+      const name = rawName.toLowerCase();
+      if (!ALLOWED_TAGS.has(name)) return "";
+      if (tag.startsWith("</")) return name === "br" ? "" : `</${name}>`;
+      if (name === "br") return "<br>";
+
+      if (name === "a") {
+        const href = sanitizeRichTextUrl(attributeValue(rawAttributes, "href"));
+        return href
+          ? `<a href="${escapeAttribute(href)}" target="_blank" rel="noopener noreferrer">`
+          : "<a>";
+      }
+
+      if (name === "span") {
+        const style = attributeValue(rawAttributes, "style");
+        const color = style.match(/(?:^|;)\s*color\s*:\s*(#[0-9a-fA-F]{6})\s*(?:;|$)/)?.[1];
+        return color && HEX_COLOR.test(color)
+          ? `<span style="color: ${color.toUpperCase()}">`
+          : "<span>";
+      }
+
+      return `<${name}>`;
+    });
+}
+
+export function isRichTextHtml(value: string): boolean {
+  return /<(?:p|br|strong|em|u|s|a|span|ul|ol|li|blockquote|pre|code)\b/i.test(value);
+}
+
+export function normalizeExtraRichText(
+  body: string,
+  highlights: readonly TextHighlight[] = [],
+): string {
+  if (isRichTextHtml(body)) return sanitizeRichTextHtml(body);
+
+  const content = highlightTextSegments(body, highlights)
+    .map((segment) => {
+      const text = escapeHtml(segment.text).replaceAll("\n", "<br>");
+      return segment.color && HEX_COLOR.test(segment.color)
+        ? `<span style="color: ${segment.color.toUpperCase()}">${text}</span>`
+        : text;
+    })
+    .join("");
+
+  return content ? `<p>${content}</p>` : "";
+}