flo-bit.dev / blento
your personal website on atproto - mirror blento.app
26
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge pull request #103 from flo-bit/fix-xss

fix 500

authored by

Florian and committed by
GitHub 84984406 e9055a9e

+40 -349
+1 -1
package.json
··· 71 71 "@types/three": "^0.176.0", 72 72 "bits-ui": "^2.15.4", 73 73 "clsx": "^2.1.1", 74 + "dompurify": "^3.3.1", 74 75 "gsap": "^3.14.2", 75 76 "hls.js": "^1.6.15", 76 - "isomorphic-dompurify": "^2.35.0", 77 77 "leaflet": "^1.9.4", 78 78 "link-preview-js": "^4.0.0", 79 79 "mapbox-gl": "^3.18.1",
+3 -342
pnpm-lock.yaml
··· 104 104 clsx: 105 105 specifier: ^2.1.1 106 106 version: 2.1.1 107 + dompurify: 108 + specifier: ^3.3.1 109 + version: 3.3.1 107 110 gsap: 108 111 specifier: ^3.14.2 109 112 version: 3.14.2 110 113 hls.js: 111 114 specifier: ^1.6.15 112 115 version: 1.6.15 113 - isomorphic-dompurify: 114 - specifier: ^2.35.0 115 - version: 2.35.0 116 116 leaflet: 117 117 specifier: ^1.9.4 118 118 version: 1.9.4 ··· 222 222 223 223 packages: 224 224 225 - '@acemir/cssom@0.9.31': 226 - resolution: {integrity: sha512-ZnR3GSaH+/vJ0YlHau21FjfLYjMpYVIzTD8M8vIEQvIGxeOXyXdzCI140rrCY862p/C/BbzWsjc1dgnM9mkoTA==, tarball: https://registry.npmjs.org/@acemir/cssom/-/cssom-0.9.31.tgz} 227 - 228 - '@asamuzakjp/css-color@4.1.1': 229 - resolution: {integrity: sha512-B0Hv6G3gWGMn0xKJ0txEi/jM5iFpT3MfDxmhZFb4W047GvytCf1DHQ1D69W3zHI4yWe2aTZAA0JnbMZ7Xc8DuQ==, tarball: https://registry.npmjs.org/@asamuzakjp/css-color/-/css-color-4.1.1.tgz} 230 - 231 - '@asamuzakjp/dom-selector@6.7.6': 232 - resolution: {integrity: sha512-hBaJER6A9MpdG3WgdlOolHmbOYvSk46y7IQN/1+iqiCuUu6iWdQrs9DGKF8ocqsEqWujWf/V7b7vaDgiUmIvUg==, tarball: https://registry.npmjs.org/@asamuzakjp/dom-selector/-/dom-selector-6.7.6.tgz} 233 - 234 - '@asamuzakjp/nwsapi@2.3.9': 235 - resolution: {integrity: sha512-n8GuYSrI9bF7FFZ/SjhwevlHc8xaVlb/7HmHelnc/PZXBD2ZR49NnN9sMMuDdEGPeeRQ5d0hqlSlEpgCX3Wl0Q==, tarball: https://registry.npmjs.org/@asamuzakjp/nwsapi/-/nwsapi-2.3.9.tgz} 236 - 237 225 '@atcute/atproto@3.1.10': 238 226 resolution: {integrity: sha512-+GKZpOc0PJcdWMQEkTfg/rSNDAAHxmAUGBl60g2az15etqJn5WaUPNGFE2sB7hKpwi5Ue2h/L0OacINcE/JDDQ==} 239 227 ··· 359 347 resolution: {integrity: sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw==} 360 348 engines: {node: '>=12'} 361 349 362 - '@csstools/color-helpers@5.1.0': 363 - resolution: {integrity: sha512-S11EXWJyy0Mz5SYvRmY8nJYTFFd1LCNV+7cXyAgQtOOuzb4EsgfqDufL+9esx72/eLhsRdGZwaldu/h+E4t4BA==, tarball: https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-5.1.0.tgz} 364 - engines: {node: '>=18'} 365 - 366 - '@csstools/css-calc@2.1.4': 367 - resolution: {integrity: sha512-3N8oaj+0juUw/1H3YwmDDJXCgTB1gKU6Hc/bB502u9zR0q2vd786XJH9QfrKIEgFlZmhZiq6epXl4rHqhzsIgQ==, tarball: https://registry.npmjs.org/@csstools/css-calc/-/css-calc-2.1.4.tgz} 368 - engines: {node: '>=18'} 369 - peerDependencies: 370 - '@csstools/css-parser-algorithms': ^3.0.5 371 - '@csstools/css-tokenizer': ^3.0.4 372 - 373 - '@csstools/css-color-parser@3.1.0': 374 - resolution: {integrity: sha512-nbtKwh3a6xNVIp/VRuXV64yTKnb1IjTAEEh3irzS+HkKjAOYLTGNb9pmVNntZ8iVBHcWDA2Dof0QtPgFI1BaTA==, tarball: https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-3.1.0.tgz} 375 - engines: {node: '>=18'} 376 - peerDependencies: 377 - '@csstools/css-parser-algorithms': ^3.0.5 378 - '@csstools/css-tokenizer': ^3.0.4 379 - 380 - '@csstools/css-parser-algorithms@3.0.5': 381 - resolution: {integrity: sha512-DaDeUkXZKjdGhgYaHNJTV9pV7Y9B3b644jCLs9Upc3VeNGg6LWARAT6O+Q+/COo+2gg/bM5rhpMAtf70WqfBdQ==, tarball: https://registry.npmjs.org/@csstools/css-parser-algorithms/-/css-parser-algorithms-3.0.5.tgz} 382 - engines: {node: '>=18'} 383 - peerDependencies: 384 - '@csstools/css-tokenizer': ^3.0.4 385 - 386 - '@csstools/css-syntax-patches-for-csstree@1.0.26': 387 - resolution: {integrity: sha512-6boXK0KkzT5u5xOgF6TKB+CLq9SOpEGmkZw0g5n9/7yg85wab3UzSxB8TxhLJ31L4SGJ6BCFRw/iftTha1CJXA==, tarball: https://registry.npmjs.org/@csstools/css-syntax-patches-for-csstree/-/css-syntax-patches-for-csstree-1.0.26.tgz} 388 - 389 - '@csstools/css-tokenizer@3.0.4': 390 - resolution: {integrity: sha512-Vd/9EVDiu6PPJt9yAh6roZP6El1xHrdvIVGjyBsHR0RYwNHgL7FJPyIIW4fANJNG6FtyZfvlRPpFI4ZM/lubvw==, tarball: https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-3.0.4.tgz} 391 - engines: {node: '>=18'} 392 - 393 350 '@dimforge/rapier3d-compat@0.12.0': 394 351 resolution: {integrity: sha512-uekIGetywIgopfD97oDL5PfeezkFpNhwlzlaEYNOA0N6ghdsOvh/HYjSMek5Q2O1PYvRSDFcqFVJl4r4ZBwOow==} 395 352 ··· 763 720 resolution: {integrity: sha512-mMkoKWMMBXL5iAYrMZqklezZDUU7HpHd+sNsz78e4gElXFyxdOnsIFfPPXpqDcUn6orZHs5MGHvtPi5II5xNAA==} 764 721 peerDependencies: 765 722 '@sveltejs/kit': '>=2.0.0' 766 - 767 - '@exodus/bytes@1.10.0': 768 - resolution: {integrity: sha512-tf8YdcbirXdPnJ+Nd4UN1EXnz+IP2DI45YVEr3vvzcVTOyrApkmIB4zvOQVd3XPr7RXnfBtAx+PXImXOIU0Ajg==, tarball: https://registry.npmjs.org/@exodus/bytes/-/bytes-1.10.0.tgz} 769 - engines: {node: ^20.19.0 || ^22.12.0 || >=24.0.0} 770 - peerDependencies: 771 - '@noble/hashes': ^1.8.0 || ^2.0.0 772 - peerDependenciesMeta: 773 - '@noble/hashes': 774 - optional: true 775 723 776 724 '@floating-ui/core@1.7.3': 777 725 resolution: {integrity: sha512-sGnvb5dmrJaKEZ+LDIpguvdX3bDlEllmv4/ClQ9awcmCZrlx5jQyyMWFM5kBI+EyNOCDDiKk8il0zeuX3Zlg/w==} ··· 1680 1628 engines: {node: '>=0.4.0'} 1681 1629 hasBin: true 1682 1630 1683 - agent-base@7.1.4: 1684 - resolution: {integrity: sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==, tarball: https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz} 1685 - engines: {node: '>= 14'} 1686 - 1687 1631 ajv@6.12.6: 1688 1632 resolution: {integrity: sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==} 1689 1633 ··· 1835 1779 css-to-react-native@3.2.0: 1836 1780 resolution: {integrity: sha512-e8RKaLXMOFii+02mOlqwjbD00KSEKqblnpO9e++1aXS1fPQOpS1YoqdVHBqPjHNoxeF2mimzVqawm2KCbEdtHQ==} 1837 1781 1838 - css-tree@3.1.0: 1839 - resolution: {integrity: sha512-0eW44TGN5SQXU1mWSkKwFstI/22X2bG1nYzZTYMAWjylYURhse752YgbE4Cx46AC+bAvI+/dYTPRk1LqSUnu6w==, tarball: https://registry.npmjs.org/css-tree/-/css-tree-3.1.0.tgz} 1840 - engines: {node: ^10 || ^12.20.0 || ^14.13.0 || >=15.0.0} 1841 - 1842 1782 css-what@6.2.2: 1843 1783 resolution: {integrity: sha512-u/O3vwbptzhMs3L1fQE82ZSLHQQfto5gyZzwteVIEyeaY5Fc7R4dapF/BvRoSYFeqfBk4m0V1Vafq5Pjv25wvA==} 1844 1784 engines: {node: '>= 6'} ··· 1853 1793 resolution: {integrity: sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==} 1854 1794 engines: {node: '>=4'} 1855 1795 hasBin: true 1856 - 1857 - cssstyle@5.3.7: 1858 - resolution: {integrity: sha512-7D2EPVltRrsTkhpQmksIu+LxeWAIEk6wRDMJ1qljlv+CKHJM+cJLlfhWIzNA44eAsHXSNe3+vO6DW1yCYx8SuQ==, tarball: https://registry.npmjs.org/cssstyle/-/cssstyle-5.3.7.tgz} 1859 - engines: {node: '>=20'} 1860 1796 1861 1797 custom-event-polyfill@1.0.7: 1862 1798 resolution: {integrity: sha512-TDDkd5DkaZxZFM8p+1I3yAlvM3rSr1wbrOliG4yJiwinMZN8z/iGL7BTlDkrJcYTmgUSb4ywVCc3ZaUtOtC76w==} 1863 1799 1864 - data-urls@6.0.1: 1865 - resolution: {integrity: sha512-euIQENZg6x8mj3fO6o9+fOW8MimUI4PpD/fZBhJfeioZVy9TUpM4UY7KjQNVZFlqwJ0UdzRDzkycB997HEq1BQ==, tarball: https://registry.npmjs.org/data-urls/-/data-urls-6.0.1.tgz} 1866 - engines: {node: '>=20'} 1867 - 1868 1800 debug@4.4.3: 1869 1801 resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==} 1870 1802 engines: {node: '>=6.0'} ··· 1873 1805 peerDependenciesMeta: 1874 1806 supports-color: 1875 1807 optional: true 1876 - 1877 - decimal.js@10.6.0: 1878 - resolution: {integrity: sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg==, tarball: https://registry.npmjs.org/decimal.js/-/decimal.js-10.6.0.tgz} 1879 1808 1880 1809 deep-is@0.1.4: 1881 1810 resolution: {integrity: sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==} ··· 2118 2047 hls.js@1.6.15: 2119 2048 resolution: {integrity: sha512-E3a5VwgXimGHwpRGV+WxRTKeSp2DW5DI5MWv34ulL3t5UNmyJWCQ1KmLEHbYzcfThfXG8amBL+fCYPneGHC4VA==} 2120 2049 2121 - html-encoding-sniffer@6.0.0: 2122 - resolution: {integrity: sha512-CV9TW3Y3f8/wT0BRFc1/KAVQ3TUHiXmaAb6VW9vtiMFf7SLoMd1PdAc4W3KFOFETBJUb90KatHqlsZMWV+R9Gg==, tarball: https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-6.0.0.tgz} 2123 - engines: {node: ^20.19.0 || ^22.12.0 || >=24.0.0} 2124 - 2125 2050 htmlparser2@10.1.0: 2126 2051 resolution: {integrity: sha512-VTZkM9GWRAtEpveh7MSF6SjjrpNVNNVJfFup7xTY3UpFtm67foy9HDVXneLtFVt4pMz5kZtgNcvCniNFb1hlEQ==} 2127 2052 2128 2053 htmlparser2@8.0.2: 2129 2054 resolution: {integrity: sha512-GYdjWKDkbRLkZ5geuHs5NY1puJ+PXwP7+fHPRz06Eirsb9ugf6d8kkXav6ADhcODhFFPMIXyxkxSuMf3D6NCFA==} 2130 2055 2131 - http-proxy-agent@7.0.2: 2132 - resolution: {integrity: sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==, tarball: https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz} 2133 - engines: {node: '>= 14'} 2134 - 2135 - https-proxy-agent@7.0.6: 2136 - resolution: {integrity: sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==, tarball: https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz} 2137 - engines: {node: '>= 14'} 2138 - 2139 2056 iconv-lite@0.6.3: 2140 2057 resolution: {integrity: sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==} 2141 2058 engines: {node: '>=0.10.0'} ··· 2170 2087 resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==} 2171 2088 engines: {node: '>=0.10.0'} 2172 2089 2173 - is-potential-custom-element-name@1.0.1: 2174 - resolution: {integrity: sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==, tarball: https://registry.npmjs.org/is-potential-custom-element-name/-/is-potential-custom-element-name-1.0.1.tgz} 2175 - 2176 2090 is-reference@3.0.3: 2177 2091 resolution: {integrity: sha512-ixkJoqQvAP88E6wLydLGGqCJsrFUnqoH6HnaczB8XmDH1oaWU+xxdptvikTgaEhtZ53Ky6YXiBuUI2WXLMCwjw==} 2178 2092 ··· 2182 2096 iso-datestring-validator@2.2.2: 2183 2097 resolution: {integrity: sha512-yLEMkBbLZTlVQqOnQ4FiMujR6T4DEcCb1xizmvXS+OxuhwcbtynoosRzdMA69zZCShCNAbi+gJ71FxZBBXx1SA==} 2184 2098 2185 - isomorphic-dompurify@2.35.0: 2186 - resolution: {integrity: sha512-a9+LQqylQCU8f1zmsYmg2tfrbdY2YS/Hc+xntcq/mDI2MY3Q108nq8K23BWDIg6YGC5JsUMC15fj2ZMqCzt/+A==, tarball: https://registry.npmjs.org/isomorphic-dompurify/-/isomorphic-dompurify-2.35.0.tgz} 2187 - engines: {node: '>=20.19.5'} 2188 - 2189 2099 jiti@2.6.1: 2190 2100 resolution: {integrity: sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==} 2191 2101 hasBin: true ··· 2193 2103 js-yaml@4.1.1: 2194 2104 resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==} 2195 2105 hasBin: true 2196 - 2197 - jsdom@27.4.0: 2198 - resolution: {integrity: sha512-mjzqwWRD9Y1J1KUi7W97Gja1bwOOM5Ug0EZ6UDK3xS7j7mndrkwozHtSblfomlzyB4NepioNt+B2sOSzczVgtQ==, tarball: https://registry.npmjs.org/jsdom/-/jsdom-27.4.0.tgz} 2199 - engines: {node: ^20.19.0 || ^22.12.0 || >=24.0.0} 2200 - peerDependencies: 2201 - canvas: ^3.0.0 2202 - peerDependenciesMeta: 2203 - canvas: 2204 - optional: true 2205 2106 2206 2107 json-buffer@3.0.1: 2207 2108 resolution: {integrity: sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==} ··· 2334 2235 2335 2236 lodash.merge@4.6.2: 2336 2237 resolution: {integrity: sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==} 2337 - 2338 - lru-cache@11.2.5: 2339 - resolution: {integrity: sha512-vFrFJkWtJvJnD5hg+hJvVE8Lh/TcMzKnTgCWmtBipwI5yLX/iX+5UB2tfuyODF5E7k9xEzMdYgGqaSb1c0c5Yw==, tarball: https://registry.npmjs.org/lru-cache/-/lru-cache-11.2.5.tgz} 2340 - engines: {node: 20 || >=22} 2341 2238 2342 2239 lz-string@1.5.0: 2343 2240 resolution: {integrity: sha512-h5bgJWpxJNswbU7qCrV0tIKQCaS3blPDrqKWx+QxzuzL1zGUzij9XCWLrSLsJPu5t+eWA/ycetzYAO5IOMcWAQ==} ··· 2367 2264 martinez-polygon-clipping@0.8.1: 2368 2265 resolution: {integrity: sha512-9PLLMzMPI6ihHox4Ns6LpVBLpRc7sbhULybZ/wyaY8sY3ECNe2+hxm1hA2/9bEEpRrdpjoeduBuZLg2aq1cSIQ==} 2369 2266 2370 - mdn-data@2.12.2: 2371 - resolution: {integrity: sha512-IEn+pegP1aManZuckezWCO+XZQDplx1366JoVhTpMpBB1sPey/SbveZQUosKiKiGYjg1wH4pMlNgXbCiYgihQA==, tarball: https://registry.npmjs.org/mdn-data/-/mdn-data-2.12.2.tgz} 2372 - 2373 2267 mdurl@2.0.0: 2374 2268 resolution: {integrity: sha512-Lf+9+2r+Tdp5wXDXC4PcIBjTDtq4UKjCPMQhKIuzpJNW0b96kVqSwW0bT7FhRSfmAiFYgP+SCRvdrDozfh0U5w==} 2375 2269 ··· 2479 2373 2480 2374 parse5@7.3.0: 2481 2375 resolution: {integrity: sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==} 2482 - 2483 - parse5@8.0.0: 2484 - resolution: {integrity: sha512-9m4m5GSgXjL4AjumKzq1Fgfp3Z8rsvjRNbnkVwfu2ImRqE5D0LnY2QfDen18FSY9C573YU5XxSapdHZTZ2WolA==, tarball: https://registry.npmjs.org/parse5/-/parse5-8.0.0.tgz} 2485 2376 2486 2377 path-exists@4.0.0: 2487 2378 resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==} ··· 2782 2673 resolution: {integrity: sha512-abovcqmwl97WKioxpkfuMeZmndB1TuDFY/R+FymrZyiGP+pMYomvgSzVPnbNMWHHESOPosVHGL352oFbdAnJcA==} 2783 2674 engines: {node: '>=16'} 2784 2675 2785 - saxes@6.0.0: 2786 - resolution: {integrity: sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==, tarball: https://registry.npmjs.org/saxes/-/saxes-6.0.0.tgz} 2787 - engines: {node: '>=v12.22.7'} 2788 - 2789 2676 semver@7.7.3: 2790 2677 resolution: {integrity: sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==} 2791 2678 engines: {node: '>=10'} ··· 2888 2775 resolution: {integrity: sha512-+NUe82VoFP1RQViZI/esojx70eazGF4u0O/9ucqZ4rPcOZD+n5EVp17uYsqwdzjUjZyTpGKunHbDziW6AIAVkQ==} 2889 2776 engines: {node: '>=18'} 2890 2777 2891 - symbol-tree@3.2.4: 2892 - resolution: {integrity: sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==, tarball: https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz} 2893 - 2894 2778 tabbable@6.4.0: 2895 2779 resolution: {integrity: sha512-05PUHKSNE8ou2dwIxTngl4EzcnsCDZGJ/iCLtDflR/SHB/ny14rXc+qU5P4mG9JkusiV7EivzY9Mhm55AzAvCg==} 2896 2780 ··· 2960 2844 resolution: {integrity: sha512-QXqwfEl9ddlGBaRFXIvNKK6OhipSiLXuRuLJX5DErz0o0Q0rYxulWLdFryTkV5PkdZct5iMInwYEGe/eR++1AA==} 2961 2845 hasBin: true 2962 2846 2963 - tldts-core@7.0.19: 2964 - resolution: {integrity: sha512-lJX2dEWx0SGH4O6p+7FPwYmJ/bu1JbcGJ8RLaG9b7liIgZ85itUVEPbMtWRVrde/0fnDPEPHW10ZsKW3kVsE9A==, tarball: https://registry.npmjs.org/tldts-core/-/tldts-core-7.0.19.tgz} 2965 - 2966 - tldts@7.0.19: 2967 - resolution: {integrity: sha512-8PWx8tvC4jDB39BQw1m4x8y5MH1BcQ5xHeL2n7UVFulMPH/3Q0uiamahFJ3lXA0zO2SUyRXuVVbWSDmstlt9YA==, tarball: https://registry.npmjs.org/tldts/-/tldts-7.0.19.tgz} 2968 - hasBin: true 2969 - 2970 2847 totalist@3.0.1: 2971 2848 resolution: {integrity: sha512-sf4i37nQ2LBx4m3wB74y+ubopq6W/dIzXg0FDGjsYnZHVa1Da8FH853wlL2gtUhg+xJXjfk3kUZS3BRoQeoQBQ==} 2972 2849 engines: {node: '>=6'} 2973 2850 2974 - tough-cookie@6.0.0: 2975 - resolution: {integrity: sha512-kXuRi1mtaKMrsLUxz3sQYvVl37B0Ns6MzfrtV5DvJceE9bPyspOqk9xxv7XbZWcfLWbFmm997vl83qUWVJA64w==, tarball: https://registry.npmjs.org/tough-cookie/-/tough-cookie-6.0.0.tgz} 2976 - engines: {node: '>=16'} 2977 - 2978 - tr46@6.0.0: 2979 - resolution: {integrity: sha512-bLVMLPtstlZ4iMQHpFHTR7GAGj2jxi8Dg0s2h2MafAE4uSWF98FC/3MomU51iQAMf8/qDUbKWf5GxuvvVcXEhw==, tarball: https://registry.npmjs.org/tr46/-/tr46-6.0.0.tgz} 2980 - engines: {node: '>=20'} 2981 - 2982 2851 troika-three-text@0.52.4: 2983 2852 resolution: {integrity: sha512-V50EwcYGruV5rUZ9F4aNsrytGdKcXKALjEtQXIOBfhVoZU9VAqZNIoGQ3TMiooVqFAbR1w15T+f+8gkzoFzawg==} 2984 2853 peerDependencies: ··· 3118 2987 w3c-keyname@2.2.8: 3119 2988 resolution: {integrity: sha512-dpojBhNsCNN7T82Tm7k26A6G9ML3NkhDsnw9n/eoxSRlVBB4CEtIQ/KTCLI2Fwf3ataSXRhYFkQi3SlnFwPvPQ==} 3120 2989 3121 - w3c-xmlserializer@5.0.0: 3122 - resolution: {integrity: sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA==, tarball: https://registry.npmjs.org/w3c-xmlserializer/-/w3c-xmlserializer-5.0.0.tgz} 3123 - engines: {node: '>=18'} 3124 - 3125 2990 webgl-sdf-generator@1.1.1: 3126 2991 resolution: {integrity: sha512-9Z0JcMTFxeE+b2x1LJTdnaT8rT8aEp7MVxkNwoycNmJWwPdzoXzMh0BjJSh/AEFP+KPYZUli814h8bJZFIZ2jA==} 3127 - 3128 - webidl-conversions@8.0.1: 3129 - resolution: {integrity: sha512-BMhLD/Sw+GbJC21C/UgyaZX41nPt8bUTg+jWyDeg7e7YN4xOM05YPSIXceACnXVtqyEw/LMClUQMtMZ+PGGpqQ==, tarball: https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-8.0.1.tgz} 3130 - engines: {node: '>=20'} 3131 2992 3132 2993 whatwg-encoding@3.1.1: 3133 2994 resolution: {integrity: sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==} ··· 3137 2998 whatwg-mimetype@4.0.0: 3138 2999 resolution: {integrity: sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg==} 3139 3000 engines: {node: '>=18'} 3140 - 3141 - whatwg-mimetype@5.0.0: 3142 - resolution: {integrity: sha512-sXcNcHOC51uPGF0P/D4NVtrkjSU2fNsm9iog4ZvZJsL3rjoDAzXZhkm2MWt1y+PUdggKAYVoMAIYcs78wJ51Cw==, tarball: https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-5.0.0.tgz} 3143 - engines: {node: '>=20'} 3144 - 3145 - whatwg-url@15.1.0: 3146 - resolution: {integrity: sha512-2ytDk0kiEj/yu90JOAp44PVPUkO9+jVhyf+SybKlRHSDlvOOZhdPIrr7xTH64l4WixO2cP+wQIcgujkGBPPz6g==, tarball: https://registry.npmjs.org/whatwg-url/-/whatwg-url-15.1.0.tgz} 3147 - engines: {node: '>=20'} 3148 3001 3149 3002 which@2.0.2: 3150 3003 resolution: {integrity: sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==} ··· 3186 3039 utf-8-validate: 3187 3040 optional: true 3188 3041 3189 - ws@8.19.0: 3190 - resolution: {integrity: sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==, tarball: https://registry.npmjs.org/ws/-/ws-8.19.0.tgz} 3191 - engines: {node: '>=10.0.0'} 3192 - peerDependencies: 3193 - bufferutil: ^4.0.1 3194 - utf-8-validate: '>=5.0.2' 3195 - peerDependenciesMeta: 3196 - bufferutil: 3197 - optional: true 3198 - utf-8-validate: 3199 - optional: true 3200 - 3201 - xml-name-validator@5.0.0: 3202 - resolution: {integrity: sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==, tarball: https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-5.0.0.tgz} 3203 - engines: {node: '>=18'} 3204 - 3205 - xmlchars@2.2.0: 3206 - resolution: {integrity: sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==, tarball: https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz} 3207 - 3208 3042 yaml@1.10.2: 3209 3043 resolution: {integrity: sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg==} 3210 3044 engines: {node: '>= 6'} ··· 3230 3064 3231 3065 snapshots: 3232 3066 3233 - '@acemir/cssom@0.9.31': {} 3234 - 3235 - '@asamuzakjp/css-color@4.1.1': 3236 - dependencies: 3237 - '@csstools/css-calc': 2.1.4(@csstools/css-parser-algorithms@3.0.5(@csstools/css-tokenizer@3.0.4))(@csstools/css-tokenizer@3.0.4) 3238 - '@csstools/css-color-parser': 3.1.0(@csstools/css-parser-algorithms@3.0.5(@csstools/css-tokenizer@3.0.4))(@csstools/css-tokenizer@3.0.4) 3239 - '@csstools/css-parser-algorithms': 3.0.5(@csstools/css-tokenizer@3.0.4) 3240 - '@csstools/css-tokenizer': 3.0.4 3241 - lru-cache: 11.2.5 3242 - 3243 - '@asamuzakjp/dom-selector@6.7.6': 3244 - dependencies: 3245 - '@asamuzakjp/nwsapi': 2.3.9 3246 - bidi-js: 1.0.3 3247 - css-tree: 3.1.0 3248 - is-potential-custom-element-name: 1.0.1 3249 - lru-cache: 11.2.5 3250 - 3251 - '@asamuzakjp/nwsapi@2.3.9': {} 3252 - 3253 3067 '@atcute/atproto@3.1.10': 3254 3068 dependencies: 3255 3069 '@atcute/lexicons': 1.2.6 ··· 3404 3218 '@cspotcode/source-map-support@0.8.1': 3405 3219 dependencies: 3406 3220 '@jridgewell/trace-mapping': 0.3.9 3407 - 3408 - '@csstools/color-helpers@5.1.0': {} 3409 - 3410 - '@csstools/css-calc@2.1.4(@csstools/css-parser-algorithms@3.0.5(@csstools/css-tokenizer@3.0.4))(@csstools/css-tokenizer@3.0.4)': 3411 - dependencies: 3412 - '@csstools/css-parser-algorithms': 3.0.5(@csstools/css-tokenizer@3.0.4) 3413 - '@csstools/css-tokenizer': 3.0.4 3414 - 3415 - '@csstools/css-color-parser@3.1.0(@csstools/css-parser-algorithms@3.0.5(@csstools/css-tokenizer@3.0.4))(@csstools/css-tokenizer@3.0.4)': 3416 - dependencies: 3417 - '@csstools/color-helpers': 5.1.0 3418 - '@csstools/css-calc': 2.1.4(@csstools/css-parser-algorithms@3.0.5(@csstools/css-tokenizer@3.0.4))(@csstools/css-tokenizer@3.0.4) 3419 - '@csstools/css-parser-algorithms': 3.0.5(@csstools/css-tokenizer@3.0.4) 3420 - '@csstools/css-tokenizer': 3.0.4 3421 - 3422 - '@csstools/css-parser-algorithms@3.0.5(@csstools/css-tokenizer@3.0.4)': 3423 - dependencies: 3424 - '@csstools/css-tokenizer': 3.0.4 3425 - 3426 - '@csstools/css-syntax-patches-for-csstree@1.0.26': {} 3427 - 3428 - '@csstools/css-tokenizer@3.0.4': {} 3429 3221 3430 3222 '@dimforge/rapier3d-compat@0.12.0': {} 3431 3223 ··· 3657 3449 satori-html: 0.3.2 3658 3450 std-env: 3.10.0 3659 3451 unwasm: 0.5.3 3660 - 3661 - '@exodus/bytes@1.10.0': {} 3662 3452 3663 3453 '@floating-ui/core@1.7.3': 3664 3454 dependencies: ··· 4525 4315 4526 4316 acorn@8.15.0: {} 4527 4317 4528 - agent-base@7.1.4: {} 4529 - 4530 4318 ajv@6.12.6: 4531 4319 dependencies: 4532 4320 fast-deep-equal: 3.1.3 ··· 4699 4487 css-color-keywords: 1.0.0 4700 4488 postcss-value-parser: 4.2.0 4701 4489 4702 - css-tree@3.1.0: 4703 - dependencies: 4704 - mdn-data: 2.12.2 4705 - source-map-js: 1.2.1 4706 - 4707 4490 css-what@6.2.2: {} 4708 4491 4709 4492 css.escape@1.5.1: {} ··· 4712 4495 4713 4496 cssesc@3.0.0: {} 4714 4497 4715 - cssstyle@5.3.7: 4716 - dependencies: 4717 - '@asamuzakjp/css-color': 4.1.1 4718 - '@csstools/css-syntax-patches-for-csstree': 1.0.26 4719 - css-tree: 3.1.0 4720 - lru-cache: 11.2.5 4721 - 4722 4498 custom-event-polyfill@1.0.7: {} 4723 4499 4724 - data-urls@6.0.1: 4725 - dependencies: 4726 - whatwg-mimetype: 5.0.0 4727 - whatwg-url: 15.1.0 4728 - 4729 4500 debug@4.4.3: 4730 4501 dependencies: 4731 4502 ms: 2.1.3 4732 - 4733 - decimal.js@10.6.0: {} 4734 4503 4735 4504 deep-is@0.1.4: {} 4736 4505 ··· 5011 4780 5012 4781 hls.js@1.6.15: {} 5013 4782 5014 - html-encoding-sniffer@6.0.0: 5015 - dependencies: 5016 - '@exodus/bytes': 1.10.0 5017 - transitivePeerDependencies: 5018 - - '@noble/hashes' 5019 - 5020 4783 htmlparser2@10.1.0: 5021 4784 dependencies: 5022 4785 domelementtype: 2.3.0 ··· 5031 4794 domutils: 3.2.2 5032 4795 entities: 4.5.0 5033 4796 5034 - http-proxy-agent@7.0.2: 5035 - dependencies: 5036 - agent-base: 7.1.4 5037 - debug: 4.4.3 5038 - transitivePeerDependencies: 5039 - - supports-color 5040 - 5041 - https-proxy-agent@7.0.6: 5042 - dependencies: 5043 - agent-base: 7.1.4 5044 - debug: 4.4.3 5045 - transitivePeerDependencies: 5046 - - supports-color 5047 - 5048 4797 iconv-lite@0.6.3: 5049 4798 dependencies: 5050 4799 safer-buffer: 2.1.2 ··· 5069 4818 is-glob@4.0.3: 5070 4819 dependencies: 5071 4820 is-extglob: 2.1.1 5072 - 5073 - is-potential-custom-element-name@1.0.1: {} 5074 4821 5075 4822 is-reference@3.0.3: 5076 4823 dependencies: ··· 5080 4827 5081 4828 iso-datestring-validator@2.2.2: {} 5082 4829 5083 - isomorphic-dompurify@2.35.0: 5084 - dependencies: 5085 - dompurify: 3.3.1 5086 - jsdom: 27.4.0 5087 - transitivePeerDependencies: 5088 - - '@noble/hashes' 5089 - - bufferutil 5090 - - canvas 5091 - - supports-color 5092 - - utf-8-validate 5093 - 5094 4830 jiti@2.6.1: {} 5095 4831 5096 4832 js-yaml@4.1.1: 5097 4833 dependencies: 5098 4834 argparse: 2.0.1 5099 4835 5100 - jsdom@27.4.0: 5101 - dependencies: 5102 - '@acemir/cssom': 0.9.31 5103 - '@asamuzakjp/dom-selector': 6.7.6 5104 - '@exodus/bytes': 1.10.0 5105 - cssstyle: 5.3.7 5106 - data-urls: 6.0.1 5107 - decimal.js: 10.6.0 5108 - html-encoding-sniffer: 6.0.0 5109 - http-proxy-agent: 7.0.2 5110 - https-proxy-agent: 7.0.6 5111 - is-potential-custom-element-name: 1.0.1 5112 - parse5: 8.0.0 5113 - saxes: 6.0.0 5114 - symbol-tree: 3.2.4 5115 - tough-cookie: 6.0.0 5116 - w3c-xmlserializer: 5.0.0 5117 - webidl-conversions: 8.0.1 5118 - whatwg-mimetype: 4.0.0 5119 - whatwg-url: 15.1.0 5120 - ws: 8.19.0 5121 - xml-name-validator: 5.0.0 5122 - transitivePeerDependencies: 5123 - - '@noble/hashes' 5124 - - bufferutil 5125 - - supports-color 5126 - - utf-8-validate 5127 - 5128 4836 json-buffer@3.0.1: {} 5129 4837 5130 4838 json-schema-traverse@0.4.1: {} ··· 5226 4934 5227 4935 lodash.merge@4.6.2: {} 5228 4936 5229 - lru-cache@11.2.5: {} 5230 - 5231 4937 lz-string@1.5.0: {} 5232 4938 5233 4939 maath@0.10.8(@types/three@0.176.0)(three@0.176.0): ··· 5284 4990 robust-predicates: 2.0.4 5285 4991 splaytree: 0.1.4 5286 4992 tinyqueue: 3.0.0 5287 - 5288 - mdn-data@2.12.2: {} 5289 4993 5290 4994 mdurl@2.0.0: {} 5291 4995 ··· 5400 5104 dependencies: 5401 5105 entities: 6.0.1 5402 5106 5403 - parse5@8.0.0: 5404 - dependencies: 5405 - entities: 6.0.1 5406 - 5407 5107 path-exists@4.0.0: {} 5408 5108 5409 5109 path-key@3.1.1: {} ··· 5705 5405 postcss-value-parser: 4.2.0 5706 5406 yoga-wasm-web: 0.3.3 5707 5407 5708 - saxes@6.0.0: 5709 - dependencies: 5710 - xmlchars: 2.2.0 5711 - 5712 5408 semver@7.7.3: {} 5713 5409 5714 5410 set-cookie-parser@2.7.2: {} ··· 5848 5544 magic-string: 0.30.21 5849 5545 zimmerframe: 1.1.4 5850 5546 5851 - symbol-tree@3.2.4: {} 5852 - 5853 5547 tabbable@6.4.0: {} 5854 5548 5855 5549 tailwind-merge@3.0.2: {} ··· 5903 5597 5904 5598 tlds@1.261.0: {} 5905 5599 5906 - tldts-core@7.0.19: {} 5907 - 5908 - tldts@7.0.19: 5909 - dependencies: 5910 - tldts-core: 7.0.19 5911 - 5912 5600 totalist@3.0.1: {} 5913 5601 5914 - tough-cookie@6.0.0: 5915 - dependencies: 5916 - tldts: 7.0.19 5917 - 5918 - tr46@6.0.0: 5919 - dependencies: 5920 - punycode: 2.3.1 5921 - 5922 5602 troika-three-text@0.52.4(three@0.176.0): 5923 5603 dependencies: 5924 5604 bidi-js: 1.0.3 ··· 6026 5706 6027 5707 w3c-keyname@2.2.8: {} 6028 5708 6029 - w3c-xmlserializer@5.0.0: 6030 - dependencies: 6031 - xml-name-validator: 5.0.0 6032 - 6033 5709 webgl-sdf-generator@1.1.1: {} 6034 5710 6035 - webidl-conversions@8.0.1: {} 6036 - 6037 5711 whatwg-encoding@3.1.1: 6038 5712 dependencies: 6039 5713 iconv-lite: 0.6.3 6040 5714 6041 5715 whatwg-mimetype@4.0.0: {} 6042 - 6043 - whatwg-mimetype@5.0.0: {} 6044 - 6045 - whatwg-url@15.1.0: 6046 - dependencies: 6047 - tr46: 6.0.0 6048 - webidl-conversions: 8.0.1 6049 5716 6050 5717 which@2.0.2: 6051 5718 dependencies: ··· 6084 5751 - utf-8-validate 6085 5752 6086 5753 ws@8.18.0: {} 6087 - 6088 - ws@8.19.0: {} 6089 - 6090 - xml-name-validator@5.0.0: {} 6091 - 6092 - xmlchars@2.2.0: {} 6093 5754 6094 5755 yaml@1.10.2: {} 6095 5756
+2 -2
src/lib/cards/TextCard/TextCard.svelte
··· 1 1 <script lang="ts"> 2 2 import { marked } from 'marked'; 3 - import DOMPurify from 'isomorphic-dompurify'; 3 + import { sanitize } from '$lib/sanitize'; 4 4 import type { ContentComponentProps } from '../types'; 5 5 import { textAlignClasses, textSizeClasses, verticalAlignClasses } from '.'; 6 6 import { cn } from '@foxui/core'; ··· 21 21 )} 22 22 > 23 23 <span 24 - >{@html DOMPurify.sanitize(marked.parse(item.cardData.text ?? '', { renderer }) as string, { 24 + >{@html sanitize(marked.parse(item.cardData.text ?? '', { renderer }) as string, { 25 25 ADD_ATTR: ['target'] 26 26 })}</span 27 27 >
+2 -2
src/lib/components/post/Post.svelte
··· 1 1 <script lang="ts"> 2 2 import Embed from './embeds/Embed.svelte'; 3 - import DOMPurify from 'isomorphic-dompurify'; 3 + import { sanitize } from '$lib/sanitize'; 4 4 import { cn, Prose } from '@foxui/core'; 5 5 import type { WithChildren, WithElementRef } from 'bits-ui'; 6 6 import type { HTMLAttributes } from 'svelte/elements'; ··· 177 177 class="accent:prose-a:text-accent-950 accent:text-base-900 accent:prose-p:text-base-900 accent:prose-a:underline" 178 178 > 179 179 {#if data.htmlContent} 180 - {@html DOMPurify.sanitize(data.htmlContent, { ADD_ATTR: ['target'] })} 180 + {@html sanitize(data.htmlContent, { ADD_ATTR: ['target'] })} 181 181 {:else} 182 182 {@render children?.()} 183 183 {/if}
+30
src/lib/sanitize.ts
··· 1 + import { browser } from '$app/environment'; 2 + 3 + // Lightweight regex-based sanitizer for SSR in Cloudflare Workers 4 + // where DOMPurify is not available. Strips common XSS vectors. 5 + function regexSanitize(html: string): string { 6 + return html 7 + .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script\s*>/gi, '') 8 + .replace(/<iframe\b[^<]*(?:(?!<\/iframe>)<[^<]*)*<\/iframe\s*>/gi, '') 9 + .replace(/<object\b[^<]*(?:(?!<\/object>)<[^<]*)*<\/object\s*>/gi, '') 10 + .replace(/<embed\b[^>]*\/?>/gi, '') 11 + .replace(/<style\b[^<]*(?:(?!<\/style>)<[^<]*)*<\/style\s*>/gi, '') 12 + .replace(/\s+on\w+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, '') 13 + .replace(/href\s*=\s*["']?\s*javascript\s*:/gi, 'href="') 14 + .replace(/src\s*=\s*["']?\s*javascript\s*:/gi, 'src="'); 15 + } 16 + 17 + let _purify: ((html: string, config?: { ADD_ATTR?: string[] }) => string) | null = null; 18 + 19 + if (browser) { 20 + import('dompurify').then((mod) => { 21 + _purify = (html, config) => mod.default.sanitize(html, config) as string; 22 + }); 23 + } 24 + 25 + export function sanitize(dirty: string, config?: { ADD_ATTR?: string[] }): string { 26 + if (_purify) { 27 + return _purify(dirty, config); 28 + } 29 + return regexSanitize(dirty); 30 + }
+2 -2
src/lib/website/Profile.svelte
··· 1 1 <script lang="ts"> 2 2 import { marked } from 'marked'; 3 - import DOMPurify from 'isomorphic-dompurify'; 3 + import { sanitize } from '$lib/sanitize'; 4 4 import type { WebsiteData } from '$lib/types'; 5 5 import { getDescription, getImage, getName, getProfilePosition } from '$lib/helper'; 6 6 import { page } from '$app/state'; ··· 65 65 <div 66 66 class="text-base-600 dark:text-base-400 prose dark:prose-invert prose-a:text-accent-500 prose-a:no-underline" 67 67 > 68 - {@html DOMPurify.sanitize( 68 + {@html sanitize( 69 69 marked.parse(getDescription(data), { 70 70 renderer 71 71 }) as string,