fix: purify nation-authored HTML at server boundaries

This commit is contained in:
2026-07-31 06:41:09 +00:00
parent 71ec02d091
commit 243f58be9a
16 changed files with 898 additions and 55 deletions
+2
View File
@@ -26,6 +26,7 @@
"typecheck": "tsc -b"
},
"devDependencies": {
"@types/sanitize-html": "2.16.1",
"tsdown": "^0.18.4",
"vite-tsconfig-paths": "^6.0.3",
"vitest": "^4.0.16"
@@ -42,6 +43,7 @@
"es-toolkit": "^1.43.0",
"fastify": "^5.6.2",
"redis": "^5.10.0",
"sanitize-html": "2.17.6",
"sharp": "^0.34.4",
"zod": "^4.3.5"
}
+2 -1
View File
@@ -20,6 +20,7 @@ import {
RejectedNpcPossessionCommandError,
} from '../../daemon/databaseTransport.js';
import { NpcPossessionError, reserveNpcPossessionCandidates } from '@sammo-ts/game-engine';
import { resolveNationScoutMessage } from '../nation/shared.js';
const resolveSelectionCommandResult = (
result: Awaited<ReturnType<GameApiContext['turnDaemon']['requestCommand']>> | null,
@@ -302,7 +303,7 @@ export const joinRouter = router({
id: nation.id,
name: nation.name,
color: nation.color,
scoutMessage: typeof meta.infoText === 'string' ? meta.infoText : null,
scoutMessage: resolveNationScoutMessage(meta) || null,
};
});
@@ -3,6 +3,7 @@ import { z } from 'zod';
import { asRecord } from '@sammo-ts/common';
import { purifyNationHtml } from '../../../security/nationHtml.js';
import { authedProcedure } from '../../../trpc.js';
import { getMyGeneral } from '../../shared/general.js';
import { assertNationAccess, assertNationEditable, updateNationMeta } from '../shared.js';
@@ -10,7 +11,7 @@ import { assertNationAccess, assertNationEditable, updateNationMeta } from '../s
export const setNotice = authedProcedure
.input(
z.object({
msg: z.string().max(16384),
msg: z.string().min(1).max(16384),
})
)
.mutation(async ({ ctx, input }) => {
@@ -25,13 +26,14 @@ export const setNotice = authedProcedure
}
assertNationEditable(me, nation.meta);
const nationMeta = asRecord(nation.meta);
const msg = purifyNationHtml(input.msg);
await updateNationMeta(
ctx,
me.nationId,
{
notice: input.msg,
notice: msg,
},
nationMeta
);
return { ok: true };
return { ok: true, msg };
});
@@ -3,6 +3,7 @@ import { z } from 'zod';
import { asRecord } from '@sammo-ts/common';
import { purifyNationHtml } from '../../../security/nationHtml.js';
import { authedProcedure } from '../../../trpc.js';
import { getMyGeneral } from '../../shared/general.js';
import { assertNationAccess, assertNationEditable, updateNationMeta } from '../shared.js';
@@ -10,7 +11,7 @@ import { assertNationAccess, assertNationEditable, updateNationMeta } from '../s
export const setScoutMsg = authedProcedure
.input(
z.object({
msg: z.string().max(1000),
msg: z.string().min(1).max(1000),
})
)
.mutation(async ({ ctx, input }) => {
@@ -25,13 +26,14 @@ export const setScoutMsg = authedProcedure
}
assertNationEditable(me, nation.meta);
const nationMeta = asRecord(nation.meta);
const msg = purifyNationHtml(input.msg);
await updateNationMeta(
ctx,
me.nationId,
{
infoText: input.msg,
infoText: msg,
},
nationMeta
);
return { ok: true };
return { ok: true, msg };
});
+3 -2
View File
@@ -27,6 +27,7 @@ import {
} from '@sammo-ts/logic';
import type { GameApiContext, InputJsonValue, WorldStateRow } from '../../context.js';
import { purifyNationHtml } from '../../security/nationHtml.js';
import { resolveSecretPermission } from '../shared/secretPermission.js';
export type PermissionKind = 'normal' | 'ambassador' | 'auditor';
@@ -268,10 +269,10 @@ export const resolveNationBlockScout = (meta: Record<string, unknown>): boolean
readMetaBool(meta, 'scout', readMetaBool(meta, 'blockScout', false));
export const resolveNationNotice = (meta: Record<string, unknown>): string =>
typeof meta.notice === 'string' ? meta.notice : '';
purifyNationHtml(typeof meta.notice === 'string' ? meta.notice : '');
export const resolveNationScoutMessage = (meta: Record<string, unknown>): string =>
typeof meta.infoText === 'string' ? meta.infoText : '';
purifyNationHtml(typeof meta.infoText === 'string' ? meta.infoText : '');
export const resolveWarSettingRemain = (meta: Record<string, unknown>): number => {
const legacy = readMetaNumber(meta, 'available_war_setting_cnt', -1);
+98
View File
@@ -0,0 +1,98 @@
import sanitizeHtml from 'sanitize-html';
const safeIframeSource = /^(?:https?:)?\/\/(?:www\.youtube(?:-nocookie)?\.com\/embed\/|player\.vimeo\.com\/video\/)/;
const unsafeUrlScheme = /^(?:javascript|data|vbscript):/i;
const unsafeSourceMarker = 'data-sammo-unsafe-source';
const normalizeUrlScheme = (value: string): string =>
Array.from(value)
.filter((character) => {
const codePoint = character.codePointAt(0) ?? 0;
return codePoint > 0x20 && (codePoint < 0x7f || codePoint > 0x9f);
})
.join('');
const options: sanitizeHtml.IOptions = {
allowedTags: [...sanitizeHtml.defaults.allowedTags, 'img', 'iframe'],
allowedAttributes: {
...sanitizeHtml.defaults.allowedAttributes,
'*': ['class', 'style', 'title', 'lang', 'dir', 'align', 'data-flip'],
a: ['href', 'name', 'title', 'data-flip'],
img: ['src', 'srcset', 'alt', 'title', 'width', 'height', 'data-flip', unsafeSourceMarker],
iframe: ['src', 'width', 'height', 'title', 'frameborder', 'data-flip'],
table: ['width', 'border', 'cellpadding', 'cellspacing', 'summary', 'data-flip'],
td: ['width', 'height', 'colspan', 'rowspan', 'headers', 'data-flip'],
th: ['width', 'height', 'colspan', 'rowspan', 'scope', 'headers', 'data-flip'],
col: ['width', 'span', 'data-flip'],
colgroup: ['width', 'span', 'data-flip'],
},
allowedSchemes: ['http', 'https', 'ftp', 'mailto', 'tel'],
allowProtocolRelative: true,
allowedStyles: {
'*': {
color: [/^#[0-9a-f]{3,8}$/i, /^rgba?\([\d\s.,%]+\)$/i, /^hsla?\([\d\s.,%]+\)$/i, /^[a-z]+$/i],
'background-color': [/^#[0-9a-f]{3,8}$/i, /^rgba?\([\d\s.,%]+\)$/i, /^hsla?\([\d\s.,%]+\)$/i, /^[a-z]+$/i],
'font-family': [/^[\w\s"',.-]+$/],
'font-size': [
/^\d+(?:\.\d+)?(?:px|pt|em|rem|%)$/i,
/^(?:xx-small|x-small|small|medium|large|x-large|xx-large)$/i,
],
'font-style': [/^(?:normal|italic|oblique)$/i],
'font-weight': [/^(?:normal|bold|bolder|lighter|[1-9]00)$/i],
'text-align': [/^(?:left|right|center|justify|start|end)$/i],
'text-decoration': [/^[\w\s-]+$/i],
'vertical-align': [
/^(?:baseline|sub|super|top|text-top|middle|bottom|text-bottom|-?\d+(?:\.\d+)?(?:px|em|rem|%))$/i,
],
width: [/^(?:auto|\d+(?:\.\d+)?(?:px|em|rem|%))$/i],
height: [/^(?:auto|\d+(?:\.\d+)?(?:px|em|rem|%))$/i],
'max-width': [/^(?:none|\d+(?:\.\d+)?(?:px|em|rem|%))$/i],
'max-height': [/^(?:none|\d+(?:\.\d+)?(?:px|em|rem|%))$/i],
'min-width': [/^\d+(?:\.\d+)?(?:px|em|rem|%)$/i],
'min-height': [/^\d+(?:\.\d+)?(?:px|em|rem|%)$/i],
margin: [/^(?:auto|-?\d+(?:\.\d+)?(?:px|em|rem|%))(?:\s+(?:auto|-?\d+(?:\.\d+)?(?:px|em|rem|%))){0,3}$/i],
padding: [/^\d+(?:\.\d+)?(?:px|em|rem|%)(?:\s+\d+(?:\.\d+)?(?:px|em|rem|%)){0,3}$/i],
'line-height': [/^(?:normal|\d+(?:\.\d+)?(?:px|em|rem|%)?)$/i],
float: [/^(?:none|left|right)$/i],
},
},
transformTags: {
img: (tagName, attribs) => {
if (typeof attribs.src === 'string' && unsafeUrlScheme.test(normalizeUrlScheme(attribs.src))) {
return { tagName, attribs: { [unsafeSourceMarker]: 'true' } };
}
if (attribs.alt !== undefined || !attribs.src) {
return { tagName, attribs };
}
const filename = attribs.src.split('/').filter(Boolean).at(-1);
return {
tagName,
attribs: filename ? { ...attribs, alt: filename } : attribs,
};
},
iframe: (tagName, attribs) => {
const source = typeof attribs.src === 'string' ? attribs.src.trim() : undefined;
if (source && !safeIframeSource.test(source)) {
const { src: _unsafeSource, ...safeAttribs } = attribs;
return { tagName, attribs: safeAttribs };
}
return {
tagName,
attribs: source === undefined ? attribs : { ...attribs, src: source },
};
},
},
exclusiveFilter: (frame) => frame.tag === 'img' && frame.attribs[unsafeSourceMarker] === 'true',
};
/**
* Ref's WebUtil::htmlPurify boundary for nation notice and recruitment HTML.
* Writes are canonicalized and reads are purified again so pre-existing rows
* cannot execute markup.
*/
export const purifyNationHtml = (value: string | null | undefined): string => {
if (!value) {
return '';
}
return sanitizeHtml(value, options);
};
+76
View File
@@ -0,0 +1,76 @@
import { describe, expect, it } from 'vitest';
import { purifyNationHtml } from '../src/security/nationHtml.js';
describe('nation HTML purification', () => {
it('removes executable markup and unsafe URL/CSS vectors', () => {
const dirty = [
'<script>globalThis.__nationXss = true</script>',
'<img src="javascript:alert(1)" onerror="globalThis.__nationXss = true">',
'<img src="jav&#x09;ascript:alert(1)" srcset="data:image/svg+xml,attack 2x">',
'<a href="javascript:alert(2)" onclick="alert(3)">unsafe link</a>',
'<p style="background-image:url(javascript:alert(4));color:#fff" onmouseover="alert(5)">notice</p>',
'<iframe src="https://attacker.example/embed/1" onload="alert(6)"></iframe>',
'<iframe src="//www.youtube.com.evil.example/embed/1" srcdoc="<script>alert(7)</script>"></iframe>',
'<svg><a xlink:href="javascript:alert(8)">svg</a></svg>',
].join('');
const clean = purifyNationHtml(dirty);
expect(clean).not.toMatch(/script|onerror|onclick|onmouseover|onload|javascript:|background-image|attacker/i);
expect(clean).not.toContain('<img');
expect(clean).toContain('<a>unsafe link</a>');
expect(clean).toContain('<p style="color:#fff">notice</p>');
expect(clean).toContain('<iframe></iframe>');
});
it('does not throw on malformed escaped filenames and preserves the raw basename as alt text', () => {
expect(purifyNationHtml('<img src="/image/%E0%A4%A">')).toBe('<img src="/image/%E0%A4%A" alt="%E0%A4%A" />');
expect(purifyNationHtml('<img src="/image/a%20b.png"><img src="/image/a.png?x/y"><img src="x" alt="">')).toBe(
'<img src="/image/a%20b.png" alt="a%20b.png" /><img src="/image/a.png?x/y" alt="y" /><img src="x" alt="" />'
);
});
it('matches Ref iframe whitespace and case handling', () => {
expect(
purifyNationHtml(
[
'<iframe src=" https://www.youtube.com/embed/x "></iframe>',
'<iframe src="https://WWW.YouTube.COM/embed/x"></iframe>',
'<iframe src="https://www.youtube.com/Embed/x"></iframe>',
].join('')
)
).toBe('<iframe src="https://www.youtube.com/embed/x"></iframe><iframe></iframe><iframe></iframe>');
});
it('preserves Ref-compatible formatting, data-flip, images, and safe video embeds', () => {
const source = [
'<div class="notice" data-flip="horizontal" style="text-align:center;color:#00ffff">',
'<strong>북벌</strong><br>',
'<a href="https://example.com/path" target="_blank">계획</a>',
'<img src="/image/icons/default.jpg" srcset="javascript:alert(1) 2x, /image/icons/default.jpg 1x" alt="장수" width="64" height="64">',
'<iframe src="//www.youtube-nocookie.com/embed/abc123" width="560" height="315" allowfullscreen></iframe>',
'<iframe src="https://player.vimeo.com/video/1234" title="video"></iframe>',
'</div>',
].join('');
const clean = purifyNationHtml(source);
expect(clean).toContain('class="notice"');
expect(clean).toContain('data-flip="horizontal"');
expect(clean).toContain('style="text-align:center;color:#00ffff"');
expect(clean).toContain('<strong>북벌</strong><br />');
expect(clean).toContain('href="https://example.com/path"');
expect(clean).not.toContain('target="_blank"');
expect(clean).toContain('src="/image/icons/default.jpg"');
expect(clean).toContain('alt="장수"');
expect(clean).toContain('srcset="/image/icons/default.jpg 1x"');
expect(clean).toContain('//www.youtube-nocookie.com/embed/abc123');
expect(clean).toContain('https://player.vimeo.com/video/1234');
});
it('is idempotent for already-purified stored values', () => {
const first = purifyNationHtml('<p style="color:red"><b>방침</b></p>');
expect(purifyNationHtml(first)).toBe(first);
});
});
+161
View File
@@ -0,0 +1,161 @@
import { describe, expect, it, vi } from 'vitest';
import type { GameSessionTokenPayload } from '@sammo-ts/common/auth/gameToken';
import type { RedisConnector } from '@sammo-ts/infra';
import { RedisAccessTokenStore } from '../src/auth/accessTokenStore.js';
import { InMemoryFlushStore } from '../src/auth/flushStore.js';
import type { DatabaseClient, GameApiContext, GeneralRow } from '../src/context.js';
import type { TurnDaemonTransport } from '../src/daemon/transport.js';
import { appRouter } from '../src/router.js';
import { resolveNationNotice, resolveNationScoutMessage } from '../src/router/nation/shared.js';
const general: GeneralRow = {
id: 1,
userId: 'user-1',
name: '정책담당',
nationId: 1,
cityId: 1,
troopId: 0,
npcState: 0,
affinity: null,
bornYear: 180,
deadYear: 300,
picture: null,
imageServer: 0,
leadership: 50,
strength: 50,
intel: 50,
injury: 0,
experience: 0,
dedication: 0,
officerLevel: 5,
gold: 1_000,
rice: 1_000,
crew: 0,
crewTypeId: 0,
train: 0,
atmos: 0,
weaponCode: 'None',
bookCode: 'None',
horseCode: 'None',
itemCode: 'None',
turnTime: new Date('2026-01-01T00:00:00.000Z'),
recentWarTime: null,
age: 20,
startAge: 20,
personalCode: 'None',
specialCode: 'None',
special2Code: 'None',
lastTurn: {},
meta: {},
penalty: {},
createdAt: new Date('2026-01-01T00:00:00.000Z'),
updatedAt: new Date('2026-01-01T00:00:00.000Z'),
};
const auth: GameSessionTokenPayload = {
version: 1,
profile: 'che:default',
issuedAt: '2026-01-01T00:00:00.000Z',
expiresAt: '2026-01-02T00:00:00.000Z',
sessionId: 'session-1',
user: {
id: 'user-1',
username: 'tester',
displayName: 'Tester',
roles: [],
},
sanctions: {},
};
const buildContext = () => {
const requestCommand = vi.fn(async (command: unknown) => ({
type: 'setNationMeta',
ok: true,
updatedAt: '2026-01-01T00:00:01.000Z',
command,
}));
const db = {
general: {
findFirst: vi.fn(async () => general),
},
nation: {
findUnique: vi.fn(async () => ({ meta: {} })),
},
};
const redisClient = {
get: async () => null,
set: async () => null,
};
const context: GameApiContext = {
db: db as unknown as DatabaseClient,
redis: {} as RedisConnector['client'],
turnDaemon: { requestCommand } as unknown as TurnDaemonTransport,
battleSim: {} as GameApiContext['battleSim'],
profile: { id: 'che', scenario: 'default', name: 'che:default' },
auth,
uploadDir: 'uploads',
uploadPath: '/uploads',
uploadPublicUrl: null,
accessTokenStore: new RedisAccessTokenStore(redisClient, 'che:default'),
flushStore: new InMemoryFlushStore(),
gameTokenSecret: 'test-secret',
};
return { caller: appRouter.createCaller(context), requestCommand };
};
describe('nation HTML API boundary', () => {
it.each([
{
procedure: 'setNotice',
metaKey: 'notice',
limit: 16_384,
},
{
procedure: 'setScoutMsg',
metaKey: 'infoText',
limit: 1_000,
},
] as const)('purifies $procedure before daemon persistence', async ({ procedure, metaKey, limit }) => {
const fixture = buildContext();
const dirty = `<p data-flip="x">안전</p><img src=x onerror="alert(1)"><script>alert(2)</script>`;
const msg = '<p data-flip="x">안전</p><img src="x" alt="x" />';
await expect(fixture.caller.nation[procedure]({ msg: dirty.slice(0, limit) })).resolves.toEqual({
ok: true,
msg,
});
expect(fixture.requestCommand).toHaveBeenCalledWith({
type: 'setNationMeta',
nationId: 1,
updates: {
[metaKey]: msg,
},
expectedUpdatedAt: undefined,
});
});
it.each(['setNotice', 'setScoutMsg'] as const)(
'rejects an empty $procedure value like Ref required validation',
async (procedure) => {
await expect(buildContext().caller.nation[procedure]({ msg: '' })).rejects.toMatchObject({
code: 'BAD_REQUEST',
});
}
);
it('purifies legacy stored values on every read resolver', () => {
expect(
resolveNationNotice({
notice: '<strong>방침</strong><svg onload="alert(1)"></svg>',
})
).toBe('<strong>방침</strong>');
expect(
resolveNationScoutMessage({
infoText: '<a href="javascript:alert(1)">임관</a>',
})
).toBe('<a>임관</a>');
});
});
@@ -0,0 +1,202 @@
import fs from 'node:fs/promises';
import os from 'node:os';
import path from 'node:path';
import { afterAll, beforeAll, describe, expect, it } from 'vitest';
import { type GameSessionTokenPayload } from '@sammo-ts/common/auth/gameToken';
import {
createGamePostgresConnector,
createRedisConnector,
resolveRedisConfigFromEnv,
type GamePrismaClient,
type RedisConnector,
} from '@sammo-ts/infra';
import { RedisAccessTokenStore } from '../src/auth/accessTokenStore.js';
import { createGameApiServer } from '../src/server.js';
const databaseUrl = process.env.INPUT_EVENT_DATABASE_URL;
const integration = describe.skipIf(!databaseUrl || !process.env.REDIS_URL);
const profileId = process.env.POSTGRES_SCHEMA ?? 'conditional_integration';
const profileName = `che:nation-html-${process.pid}`;
const userId = `nation-html-user-${process.pid}`;
const fixtureId = 900_000 + (process.pid % 50_000);
const secret = 'nation-html-http-secret';
const redisPrefix = `sammo:nation-html:${process.pid}`;
const envKeys = [
'PROFILE',
'SCENARIO',
'GAME_PROFILE_NAME',
'GAME_API_HOST',
'GAME_API_PORT',
'GAME_TOKEN_SECRET',
'GATEWAY_REDIS_PREFIX',
'GAME_UPLOAD_DIR',
'DATABASE_URL',
] as const;
const originalEnv = new Map(envKeys.map((key) => [key, process.env[key]]));
type RunningServer = Awaited<ReturnType<typeof createGameApiServer>>;
let server: RunningServer | null = null;
let baseUrl = '';
let uploadDir = '';
let db: GamePrismaClient;
let disconnectDb: (() => Promise<void>) | null = null;
let redis: RedisConnector | null = null;
let accessToken = '';
const restoreEnv = (): void => {
for (const [key, value] of originalEnv) {
if (value === undefined) {
delete process.env[key];
} else {
process.env[key] = value;
}
}
};
integration('nation HTML purification over HTTP transport', () => {
beforeAll(async () => {
uploadDir = await fs.mkdtemp(path.join(os.tmpdir(), 'sammo-nation-html-http-'));
process.env.PROFILE = profileId;
process.env.SCENARIO = 'nation-html';
process.env.GAME_PROFILE_NAME = profileName;
process.env.GAME_API_HOST = '127.0.0.1';
process.env.GAME_API_PORT = '0';
process.env.GAME_TOKEN_SECRET = secret;
process.env.GATEWAY_REDIS_PREFIX = redisPrefix;
process.env.GAME_UPLOAD_DIR = uploadDir;
process.env.DATABASE_URL = databaseUrl;
const connector = createGamePostgresConnector({ url: databaseUrl! });
await connector.connect();
db = connector.prisma;
disconnectDb = () => connector.disconnect();
await db.general.deleteMany({ where: { id: fixtureId } });
await db.nation.deleteMany({ where: { id: fixtureId } });
await db.worldState.deleteMany({ where: { id: fixtureId } });
await db.worldState.create({
data: {
id: fixtureId,
scenarioCode: 'nation-html',
currentYear: 200,
currentMonth: 1,
tickSeconds: 600,
meta: {
lastTurnTime: '2026-07-31T00:00:00.000Z',
},
},
});
await db.nation.create({
data: {
id: fixtureId,
name: '정화국',
color: '#00ffff',
meta: {
notice: [
'<p data-flip="horizontal" style="color:#00ffff">안전한 방침</p>',
'<img src="/image/icons/default.jpg" onerror="globalThis.__nationXss=1">',
'<script>globalThis.__nationXss=2</script>',
'<iframe src="https://attacker.example/embed/1"></iframe>',
].join(''),
infoText: '<strong>임관 권유</strong><svg onload="globalThis.__nationScoutXss=1"></svg>',
},
},
});
await db.general.create({
data: {
id: fixtureId,
userId,
name: '정화담당',
nationId: fixtureId,
turnTime: new Date('2026-07-31T00:00:00.000Z'),
},
});
redis = createRedisConnector(resolveRedisConfigFromEnv());
await redis.connect();
const store = new RedisAccessTokenStore(redis.client, profileName);
const payload: GameSessionTokenPayload = {
version: 1,
profile: profileName,
issuedAt: new Date(Date.now() - 1_000).toISOString(),
expiresAt: new Date(Date.now() + 10 * 60_000).toISOString(),
sessionId: `nation-html-session-${process.pid}`,
user: {
id: userId,
username: 'nation-html-user',
displayName: 'Nation HTML User',
roles: ['user'],
createdAt: '2026-07-31T00:00:00.000Z',
},
sanctions: {},
};
const created = await store.create(payload);
if (!created) {
throw new Error('failed to seed nation HTML access token');
}
accessToken = created.accessToken;
server = await createGameApiServer();
baseUrl = await server.app.listen({ host: server.config.host, port: server.config.port });
}, 30_000);
afterAll(async () => {
await server?.app.close();
await db?.general.deleteMany({ where: { id: fixtureId } });
await db?.nation.deleteMany({ where: { id: fixtureId } });
await db?.worldState.deleteMany({ where: { id: fixtureId } });
await disconnectDb?.();
await redis?.disconnect();
if (uploadDir) {
await fs.rm(uploadDir, { recursive: true, force: true });
}
restoreEnv();
}, 30_000);
it('removes pre-existing executable nation notice markup before serialization', async () => {
const response = await fetch(`${baseUrl}/trpc/general.getFrontStatus`, {
headers: {
authorization: `Bearer ${accessToken}`,
},
});
const body = (await response.json()) as {
result?: {
data?: {
nationNotice?: string;
};
};
};
expect(response.status, JSON.stringify(body)).toBe(200);
expect(body.result?.data?.nationNotice).toBe(
'<p data-flip="horizontal" style="color:#00ffff">안전한 방침</p><img src="/image/icons/default.jpg" alt="default.jpg" /><iframe></iframe>'
);
});
it('removes executable stored recruitment markup from join configuration serialization', async () => {
const response = await fetch(`${baseUrl}/trpc/join.getConfig`, {
headers: {
authorization: `Bearer ${accessToken}`,
},
});
const body = (await response.json()) as {
result?: {
data?: {
nations?: Array<{
id: number;
scoutMessage: string | null;
}>;
};
};
};
expect(response.status, JSON.stringify(body)).toBe(200);
expect(body.result?.data?.nations?.find(({ id }) => id === fixtureId)?.scoutMessage).toBe(
'<strong>임관 권유</strong>'
);
});
});
+66
View File
@@ -32,6 +32,7 @@ type FixtureState = {
dieOnPrestartInputs?: Array<Record<string, unknown>>;
generalMeQueries?: number;
generalLogQueries?: number;
nationNoticeInput?: string;
settingMutations: Array<Record<string, unknown>>;
accessPages: string[];
};
@@ -170,6 +171,15 @@ const install = async (page: Page, state: FixtureState) => {
available: false,
availableAt: state.dieOnPrestartAvailableAt ?? null,
});
if (operation === 'general.getFrontStatus')
return response({
onlineUserCount: 1,
onlineNations: '【위】',
onlineGenerals: '검증장수',
nationNotice: state.nationNoticeInput ?? '',
lastExecuted: '2026-01-01T00:00:00.000Z',
latestVote: null,
});
if (operation === 'world.getState')
return response({
currentYear: 185,
@@ -190,6 +200,36 @@ const install = async (page: Page, state: FixtureState) => {
autorun_user: {},
},
});
if (operation === 'world.getMapLayout')
return response({ mapName: 'che', cityList: [], regionMap: {}, levelMap: {} });
if (operation === 'world.getMap')
return response({
year: 185,
month: 1,
startYear: 180,
cityList: [],
nationList: [],
myCity: 1,
myNation: 1,
});
if (operation === 'turns.getCommandTable') return response({ general: [], nation: [] });
if (operation === 'turns.reserved.getGeneral' || operation === 'turns.reserved.getNation')
return response({ turns: [], revision: 0 });
if (operation === 'messages.getRecent')
return response({
private: [],
national: [],
public: [],
diplomacy: [],
sequence: -1,
hasMore: { private: false, national: false, public: false, diplomacy: false },
latestRead: { private: 0, national: 0, public: 0, diplomacy: 0 },
canRespondDiplomacy: false,
});
if (operation === 'messages.getContacts') return response({ nation: [] });
if (operation === 'general.getRecentRecords') return response({ global: [], general: [], history: [] });
if (operation === 'board.getAccess') return response({ permission: 4, canMeeting: true, canSecret: true });
if (operation === 'tournament.getState') return response({ stage: 0 });
if (operation === 'public.getTraffic')
return response({
history: [
@@ -273,6 +313,32 @@ const install = async (page: Page, state: FixtureState) => {
});
};
test('정화된 국가 방침은 실행 가능한 속성 없이 Chromium에 표시된다', async ({ page }) => {
const state: FixtureState = {
permission: 'head',
myset: 0,
nationNoticeInput: [
'<p data-flip="horizontal" style="color:#00ffff">안전한 방침</p>',
'<img src="/image/icons/default.jpg" />',
'<a>위험 링크</a>',
].join(''),
settingMutations: [],
accessPages: [],
};
await install(page, state);
await page.goto('');
const notice = page.locator('.nation-notice-body');
await expect(notice).toContainText('안전한 방침');
await expect(notice.locator('[data-flip="horizontal"]')).toHaveCSS('color', 'rgb(0, 255, 255)');
await expect(notice.locator('script, svg, [onerror], [onload], [onclick]')).toHaveCount(0);
await expect(notice.locator('a', { hasText: '위험 링크' })).not.toHaveAttribute('href');
await expect
.poll(() => page.evaluate(() => (globalThis as typeof globalThis & { __nationXss?: number }).__nationXss))
.toBeUndefined();
});
test('접속량정보 keeps the legacy public 1016px chart geometry', async ({ page }) => {
const state: FixtureState = { permission: 'member', myset: 0, settingMutations: [], accessPages: [] };
await install(page, state);
+73 -10
View File
@@ -10,8 +10,19 @@ type FixtureState = {
failPersonnelLoad?: boolean;
rate: number;
appointedGeneralId?: number;
noticeMutationInput?: string;
scoutMutationInput?: string;
};
type TrpcRequestPayload = {
json?: Record<string, unknown>;
input?: { json?: Record<string, unknown> };
};
const purifiedNoticeResponse =
'<p data-flip="horizontal" style="color:#00ffff">서버 정화 방침</p><img src="/image/icons/default.jpg" alt="default.jpg" />';
const purifiedScoutResponse = '<strong>서버 정화 임관문</strong><a>위험 링크</a>';
const artifactRoot = process.env.OFFICE_PARITY_ARTIFACT_DIR ? resolve(process.env.OFFICE_PARITY_ARTIFACT_DIR) : null;
const repositoryRoot = resolve(dirname(fileURLToPath(import.meta.url)), '../../..');
const imageRoots = [
@@ -190,7 +201,17 @@ const installFixture = async (page: Page, state: FixtureState) => {
);
await page.route('**/che/api/trpc/**', async (route) => {
const operations = operationName(route).split(',');
const results = operations.map((operation) => {
const rawRequestBody: unknown = route.request().postData() ? route.request().postDataJSON() : {};
const requestBody =
rawRequestBody && typeof rawRequestBody === 'object' ? (rawRequestBody as Record<string, unknown>) : {};
const results = operations.map((operation, operationIndex) => {
const rawPayload =
requestBody[String(operationIndex)] ?? (operations.length === 1 ? requestBody : undefined);
const payload =
rawPayload && typeof rawPayload === 'object' ? (rawPayload as TrpcRequestPayload) : undefined;
const jsonInput =
payload?.json ?? payload?.input?.json ?? (payload as Record<string, unknown> | undefined) ?? {};
if (operation === 'auth.status') return response({ ok: true });
if (operation === 'lobby.info') return response({ myGeneral: { id: 1, name: '조조' } });
if (operation === 'join.getConfig') return response({});
if (operation === 'nation.getPersonnelInfo') {
@@ -212,15 +233,15 @@ const installFixture = async (page: Page, state: FixtureState) => {
state.rate = 25;
return response({ ok: true });
}
if (
[
'nation.setNotice',
'nation.setScoutMsg',
'nation.setBill',
'nation.setSecretLimit',
'nation.setBlockScout',
].includes(operation)
)
if (operation === 'nation.setNotice') {
state.noticeMutationInput = typeof jsonInput.msg === 'string' ? jsonInput.msg : undefined;
return response({ ok: true, msg: purifiedNoticeResponse });
}
if (operation === 'nation.setScoutMsg') {
state.scoutMutationInput = typeof jsonInput.msg === 'string' ? jsonInput.msg : undefined;
return response({ ok: true, msg: purifiedScoutResponse });
}
if (['nation.setBill', 'nation.setSecretLimit', 'nation.setBlockScout'].includes(operation))
return response({ ok: true });
if (operation === 'nation.setBlockWar') return response({ availableCnt: 4 });
return errorResponse(operation, `Unhandled fixture operation: ${operation}`);
@@ -426,3 +447,45 @@ test('finance enforces edit permissions and preserves the old value across an AP
await expect(readOnly.locator('.policy-cell').getByRole('button', { name: '변경' })).toHaveCount(0);
await expect(readOnly.getByRole('checkbox', { name: '전쟁 금지' })).toBeDisabled();
});
test('finance adopts the server-purified notice and scout message before rendering the saved preview', async ({
page,
}) => {
const state: FixtureState = { role: 'head', rate: 20 };
await installFixture(page, state);
await gotoOffice(page, 'nation/finance');
const dirtyNotice =
'<script>globalThis.__nationNoticeXss=1</script><img src=x onerror="globalThis.__nationNoticeXss=2"><p data-flip="horizontal" style="color:#00ffff">원문</p>';
await page.getByRole('button', { name: '국가방침 수정' }).click();
await page.getByRole('textbox', { name: '국가 방침' }).fill(dirtyNotice);
await page.locator('#notice-form').getByRole('button', { name: '저장' }).click();
const noticePreview = page.locator('#notice-form .message-preview');
await expect(noticePreview).toContainText('서버 정화 방침');
expect(state.noticeMutationInput).toBe(dirtyNotice);
await expect(noticePreview.locator('[data-flip="horizontal"]')).toHaveCSS('color', 'rgb(0, 255, 255)');
await expect(noticePreview.locator('script, svg, [onerror], [onload], [onclick]')).toHaveCount(0);
await expect
.poll(() =>
page.evaluate(() => (globalThis as typeof globalThis & { __nationNoticeXss?: number }).__nationNoticeXss)
)
.toBeUndefined();
const dirtyScout =
'<svg onload="globalThis.__nationScoutXss=1"></svg><a href="javascript:alert(1)" onclick="globalThis.__nationScoutXss=2">원문</a>';
await page.getByRole('button', { name: '임관 권유문 수정' }).click();
await page.getByRole('textbox', { name: '임관 권유' }).fill(dirtyScout);
await page.locator('#scout-message-form').getByRole('button', { name: '저장' }).click();
const scoutPreview = page.locator('#scout-message-form .message-preview');
await expect(scoutPreview).toContainText('서버 정화 임관문');
expect(state.scoutMutationInput).toBe(dirtyScout);
await expect(scoutPreview.locator('a', { hasText: '위험 링크' })).not.toHaveAttribute('href');
await expect(scoutPreview.locator('script, svg, [onerror], [onload], [onclick]')).toHaveCount(0);
await expect
.poll(() =>
page.evaluate(() => (globalThis as typeof globalThis & { __nationScoutXss?: number }).__nationScoutXss)
)
.toBeUndefined();
});
@@ -141,8 +141,10 @@ const saveNationMsg = async () => {
if (!editable.value) return;
errorMessage.value = null;
try {
await trpc.nation.setNotice.mutate({ msg: nationMsg.value });
originalNationMsg.value = nationMsg.value;
const result = await trpc.nation.setNotice.mutate({ msg: nationMsg.value });
nationMsg.value = result.msg;
originalNationMsg.value = result.msg;
editor.value?.commands.setContent(result.msg || '');
editingNationMsg.value = false;
editor.value?.setEditable(false);
} catch (err) {
@@ -63,15 +63,21 @@ const resolveDiplomacyEnd = (term: number | null): string => {
const formatDiplomacyTerm = (term: number | null): string => (term ? `${term}개월` : '-');
const diplomacyInfo = (nation: NationEntry) => resolveDiplomacyInfo(nation.diplomacy.state);
const mutation = async (action: () => Promise<unknown>, message: string, rollback?: () => void) => {
const mutation = async <T,>(
action: () => Promise<T>,
message: string,
rollback?: () => void
): Promise<T | undefined> => {
error.value = null;
status.value = null;
try {
await action();
const result = await action();
status.value = message;
return result;
} catch (err) {
rollback?.();
error.value = resolveErrorMessage(err);
return undefined;
}
};
@@ -85,9 +91,13 @@ const rollbackNationMsg = () => {
editingNationMsg.value = false;
};
const saveNationMsg = async () => {
await mutation(() => trpc.nation.setNotice.mutate({ msg: nationMsgDraft.value }), '국가 방침을 변경했습니다.');
if (!error.value) {
nationMsg.value = nationMsgDraft.value;
const result = await mutation(
() => trpc.nation.setNotice.mutate({ msg: nationMsgDraft.value }),
'국가 방침을 변경했습니다.'
);
if (result) {
nationMsg.value = result.msg;
nationMsgDraft.value = result.msg;
editingNationMsg.value = false;
}
};
@@ -101,9 +111,13 @@ const rollbackScoutMsg = () => {
editingScoutMsg.value = false;
};
const saveScoutMsg = async () => {
await mutation(() => trpc.nation.setScoutMsg.mutate({ msg: scoutMsgDraft.value }), '임관 권유문을 변경했습니다.');
if (!error.value) {
scoutMsg.value = scoutMsgDraft.value;
const result = await mutation(
() => trpc.nation.setScoutMsg.mutate({ msg: scoutMsgDraft.value }),
'임관 권유문을 변경했습니다.'
);
if (result) {
scoutMsg.value = result.msg;
scoutMsgDraft.value = result.msg;
editingScoutMsg.value = false;
}
};
@@ -117,8 +117,10 @@ const saveScoutMsg = async () => {
if (!editable.value) return;
errorMessage.value = null;
try {
await trpc.nation.setScoutMsg.mutate({ msg: scoutMsg.value });
originalScoutMsg.value = scoutMsg.value;
const result = await trpc.nation.setScoutMsg.mutate({ msg: scoutMsg.value });
scoutMsg.value = result.msg;
originalScoutMsg.value = result.msg;
editor.value?.commands.setContent(result.msg || '');
editing.value = false;
editor.value?.setEditable(false);
} catch (err) {
+174 -24
View File
@@ -5,6 +5,7 @@ settings:
excludeLinksFromLockfile: false
overrides:
postcss: 8.5.19
typescript: 6.0.2
importers:
@@ -58,7 +59,7 @@ importers:
version: 8.65.0(eslint@10.8.0(jiti@2.6.1)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.2)
vitepress:
specifier: 1.6.4
version: 1.6.4(@algolia/client-search@5.56.0)(@types/node@26.1.1)(lightningcss@1.30.2)(postcss@8.5.6)(search-insights@2.17.3)(typescript@6.0.2)
version: 1.6.4(@algolia/client-search@5.56.0)(@types/node@26.1.1)(lightningcss@1.30.2)(postcss@8.5.19)(search-insights@2.17.3)(typescript@6.0.2)
vue-eslint-parser:
specifier: ^10.4.1
version: 10.4.1(eslint@10.8.0(jiti@2.6.1)(supports-color@7.2.0))(supports-color@7.2.0)
@@ -98,6 +99,9 @@ importers:
redis:
specifier: ^5.10.0
version: 5.10.0
sanitize-html:
specifier: 2.17.6
version: 2.17.6
sharp:
specifier: ^0.34.4
version: 0.34.5
@@ -105,6 +109,9 @@ importers:
specifier: ^4.3.5
version: 4.3.5
devDependencies:
'@types/sanitize-html':
specifier: 2.16.1
version: 2.16.1
tsdown:
specifier: ^0.18.4
version: 0.18.4(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(synckit@0.11.13)(typescript@6.0.2)(vue-tsc@3.2.2(typescript@6.0.2))
@@ -217,10 +224,10 @@ importers:
version: 6.0.3(vite@7.3.1(@types/node@26.1.1)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0))(vue@3.5.26(typescript@6.0.2))
autoprefixer:
specifier: ^10.4.23
version: 10.4.23(postcss@8.5.6)
version: 10.4.23(postcss@8.5.19)
postcss:
specifier: ^8.5.6
version: 8.5.6
specifier: 8.5.19
version: 8.5.19
tailwindcss:
specifier: ^4.1.18
version: 4.1.18
@@ -345,10 +352,10 @@ importers:
version: 6.0.3(vite@7.3.0(@types/node@26.1.1)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0))(vue@3.5.26(typescript@6.0.2))
autoprefixer:
specifier: ^10.4.23
version: 10.4.23(postcss@8.5.6)
version: 10.4.23(postcss@8.5.19)
postcss:
specifier: ^8.5.6
version: 8.5.6
specifier: 8.5.19
version: 8.5.19
tailwindcss:
specifier: ^4.1.18
version: 4.1.18
@@ -2315,6 +2322,9 @@ packages:
'@types/react@19.2.7':
resolution: {integrity: sha512-MWtvHrGZLFttgeEj28VXHxpmwYbor/ATPYbBfSFZEIRK0ecCFLl2Qo55z52Hss+UV9CRN7trSeq1zbgx7YDWWg==}
'@types/sanitize-html@2.16.1':
resolution: {integrity: sha512-n9wjs8bCOTyN/ynwD8s/nTcTreIHB1vf31vhLMGqUPNHaweKC4/fAl4Dj+hUlCTKYgm4P3k83fmiFfzkZ6sgMA==}
'@types/unist@3.0.3':
resolution: {integrity: sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==}
@@ -2782,7 +2792,7 @@ packages:
engines: {node: ^10 || ^12 || >=14}
hasBin: true
peerDependencies:
postcss: ^8.1.0
postcss: 8.5.19
avvio@9.1.0:
resolution: {integrity: sha512-fYASnYi600CsH/j9EQov7lECAniYiBFiiAtBNuZYLA2leLe9qOvZzqYHFjtIj6gD2VMoMLP14834LFWvr4IfDw==}
@@ -3001,6 +3011,10 @@ packages:
resolution: {integrity: sha512-HOJkrhaYsweh+W+e74Yn7YStZOilkoPb6fycpwNLKzSPtruFs48nYis0zy5yJz1+ktUhHxoRDJ27RQAWLIJVJw==}
engines: {node: '>=16.0.0'}
deepmerge@4.3.1:
resolution: {integrity: sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==}
engines: {node: '>=0.10.0'}
defu@6.1.4:
resolution: {integrity: sha512-mEQCMmwJu317oSz8CwdIOdwf3xMif1ttiM8LTufzc3g6kR+9Pe236twL8j3IYT1F7GfRgGcW6MWxzZjLIkuHIg==}
@@ -3033,6 +3047,35 @@ packages:
devlop@1.1.0:
resolution: {integrity: sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==}
dom-serializer@2.0.0:
resolution: {integrity: sha512-wIkAryiqt/nV5EQKqQpo3SToSOV9J0DnbJqwK7Wv/Trc92zIAYZ4FlMu+JPFW1DfGFt81ZTCGgDEabffXeLyJg==}
dom-serializer@3.1.1:
resolution: {integrity: sha512-4MEa38/QexBob6gFNwu+EGdWvhJ1OKuNwdYY3Y3NyeWDQfnGeDYQUDfIRzWu5B5gsv03so2Uxd28YC6zrsx3Lw==}
engines: {node: '>=20.19.0'}
domelementtype@2.3.0:
resolution: {integrity: sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw==}
domelementtype@3.0.0:
resolution: {integrity: sha512-umCQid3jKbDmVjx8jGaW7uUykm4DEUeyV21hPxNMo2nV955DhUThwqyOIDtreepP31hl84X7G5U9ZfsWvIB3Pg==}
engines: {node: '>=20.19.0'}
domhandler@5.0.3:
resolution: {integrity: sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w==}
engines: {node: '>= 4'}
domhandler@6.0.1:
resolution: {integrity: sha512-gYzvtM72ZtxQO0T048kd6HWSbbGCNOUwcnfQ01cqIJ4X2IYKFFHZ5mKvrQETcFXxsRObZulDaKmy//R7TPtsBg==}
engines: {node: '>=20.19.0'}
domutils@3.2.2:
resolution: {integrity: sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw==}
domutils@4.0.2:
resolution: {integrity: sha512-qI4JLRKnSzqFqr7hAlS5xQDusBCjKSEG4t4+7aNrIQMHBcsC2TGEhuyABJdYkgSewL57PNLYEiibY2iPKhKpaA==}
engines: {node: '>=20.19.0'}
dotenv@16.6.1:
resolution: {integrity: sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==}
engines: {node: '>=12'}
@@ -3092,6 +3135,14 @@ packages:
resolution: {integrity: sha512-FDWG5cmEYf2Z00IkYRhbFrwIwvdFKH07uV8dvNy0omp/Qb1xcyCWp2UDtcwJF4QZZvk0sLudP6/hAu42TaqVhQ==}
engines: {node: '>=0.12'}
entities@7.0.1:
resolution: {integrity: sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA==}
engines: {node: '>=0.12'}
entities@8.0.0:
resolution: {integrity: sha512-zwfzJecQ/Uej6tusMqwAqU/6KL2XaB2VZ2Jg54Je6ahNBGNH6Ek6g3jjNCF0fG9EWQKGZNddNjU5F1ZQn/sBnA==}
engines: {node: '>=20.19.0'}
es-module-lexer@1.7.0:
resolution: {integrity: sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==}
@@ -3436,6 +3487,13 @@ packages:
html-void-elements@3.0.0:
resolution: {integrity: sha512-bEqo66MRXsUGxWHV5IP0PUiAWwoEjba4VCzg0LjFJBpchPaTfyfCKTG6bc5F8ucKec3q5y6qOdGyYTSBEvhCrg==}
htmlparser2@10.1.0:
resolution: {integrity: sha512-VTZkM9GWRAtEpveh7MSF6SjjrpNVNNVJfFup7xTY3UpFtm67foy9HDVXneLtFVt4pMz5kZtgNcvCniNFb1hlEQ==}
htmlparser2@12.0.0:
resolution: {integrity: sha512-Tz7u1i95/g2x2jz81+x0FBVhBhY5aRTvD3tXXdFaljuNdzDLJ8UGNRrTcj2cgQvAg3iW/h77Fz15nLW0L0CrZw==}
engines: {node: '>=20.19.0'}
http-errors@2.0.1:
resolution: {integrity: sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==}
engines: {node: '>= 0.8'}
@@ -3516,6 +3574,10 @@ packages:
resolution: {integrity: sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==}
engines: {node: '>=0.12.0'}
is-plain-object@5.0.0:
resolution: {integrity: sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q==}
engines: {node: '>=0.10.0'}
is-property@1.0.2:
resolution: {integrity: sha512-Ks/IoX00TtClbGQr4TWXemAnktAQvYB7HzcCxDGqEZU6oCmb2INHuOoKxbtR+HFkmYWBKv/dOZtGRiAjDhj92g==}
@@ -3563,6 +3625,9 @@ packages:
keyv@4.5.4:
resolution: {integrity: sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==}
launder@1.7.1:
resolution: {integrity: sha512-mU6WRz5EusL9ZZuiZ5SO4Y6C0P9PAUR9iwdb6bzj4KDihm28DiHFw+/yk9DBH4f+Pv1wuzQ4e2jV3oQ7mkIqvw==}
lazy@1.0.11:
resolution: {integrity: sha512-Y+CjUfLmIpoUCCRl0ub4smrYtGGr5AOa2AKOaWelGHOGz33X/Y/KizefGqbkwfz44+cnq/+9habclf8vOmu2LA==}
engines: {node: '>=0.2.0'}
@@ -3767,8 +3832,8 @@ packages:
resolution: {integrity: sha512-Tz09sEL2EEuv5fFowm419c1+a/jSMiBjI9gHxVLrVdbUkkNUUfjsVYs9pVZu5oCon/kmRh9TfLEObFtkVxmY0w==}
engines: {node: '>=8.0.0'}
nanoid@3.3.11:
resolution: {integrity: sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==}
nanoid@3.3.16:
resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==}
engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
hasBin: true
@@ -3849,6 +3914,9 @@ packages:
pako@0.2.9:
resolution: {integrity: sha512-NUcwaKxUxWrZLpDG+z/xZaCgQITkA/Dv4V/T6bw7VON6l1Xz/VnrBqrYjZQ12TamKHzITTfOEIYUj48y2KXImA==}
parse-srcset@1.0.2:
resolution: {integrity: sha512-/2qh0lav6CmI15FzA3i/2Bzk2zCgQhGMkvhOhKNcBVQ1ldgpbfiNTVslmooUmWJcADi1f1kIeynbDRVzNlfR6Q==}
path-browserify@1.0.1:
resolution: {integrity: sha512-b7uo2UCUOYZcnF/3ID0lulOJi/bafxa1xPe7ZPsammBSpjSWQkjNxlt635YGS2MiR9GjvuXCtz2emr3jbsz98g==}
@@ -3992,8 +4060,8 @@ packages:
postcss-value-parser@4.2.0:
resolution: {integrity: sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==}
postcss@8.5.6:
resolution: {integrity: sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==}
postcss@8.5.19:
resolution: {integrity: sha512-Mz8SaolMd8nB+G13WkORcxQKHZ/NE4xXevtkJHVuG+guo9/wYKlIMTKAqGdEmYOXR2ijPjTYNHssizdaVSUNdQ==}
engines: {node: ^10 || ^12 || >=14}
postgres-array@2.0.0:
@@ -4311,6 +4379,10 @@ packages:
safer-buffer@2.1.2:
resolution: {integrity: sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==}
sanitize-html@2.17.6:
resolution: {integrity: sha512-M4bo9tfv1yfhQZZKkc6dL07ALrGJtfvNOuhX3hU9AVPR/uPQ+nKOJBqTYc7LfMQblTW04mtSWDJWEyLvygJsLA==}
engines: {node: '>=22.12.0'}
sax@1.4.3:
resolution: {integrity: sha512-yqYn1JhPczigF94DMS+shiDMjDowYO6y9+wB/4WgO0Y19jWYk0lQ4tuG5KI7kj4FTp1wxPj5IFfcrz/s1c3jjQ==}
@@ -4824,7 +4896,7 @@ packages:
hasBin: true
peerDependencies:
markdown-it-mathjax3: ^4
postcss: ^8
postcss: 8.5.19
peerDependenciesMeta:
markdown-it-mathjax3:
optional: true
@@ -6440,6 +6512,10 @@ snapshots:
dependencies:
csstype: 3.2.3
'@types/sanitize-html@2.16.1':
dependencies:
htmlparser2: 10.1.0
'@types/unist@3.0.3': {}
'@types/web-bluetooth@0.0.21': {}
@@ -6627,7 +6703,7 @@ snapshots:
'@vue/shared': 3.5.26
estree-walker: 2.0.2
magic-string: 0.30.21
postcss: 8.5.6
postcss: 8.5.19
source-map-js: 1.2.1
'@vue/compiler-ssr@3.5.26':
@@ -6915,13 +6991,13 @@ snapshots:
atomic-sleep@1.0.0: {}
autoprefixer@10.4.23(postcss@8.5.6):
autoprefixer@10.4.23(postcss@8.5.19):
dependencies:
browserslist: 4.28.1
caniuse-lite: 1.0.30001764
fraction.js: 5.3.4
picocolors: 1.1.1
postcss: 8.5.6
postcss: 8.5.19
postcss-value-parser: 4.2.0
avvio@9.1.0:
@@ -7106,6 +7182,8 @@ snapshots:
deepmerge-ts@7.1.5: {}
deepmerge@4.3.1: {}
defu@6.1.4: {}
defu@6.1.7: {}
@@ -7130,6 +7208,42 @@ snapshots:
dependencies:
dequal: 2.0.3
dom-serializer@2.0.0:
dependencies:
domelementtype: 2.3.0
domhandler: 5.0.3
entities: 4.5.0
dom-serializer@3.1.1:
dependencies:
domelementtype: 3.0.0
domhandler: 6.0.1
entities: 8.0.0
domelementtype@2.3.0: {}
domelementtype@3.0.0: {}
domhandler@5.0.3:
dependencies:
domelementtype: 2.3.0
domhandler@6.0.1:
dependencies:
domelementtype: 3.0.0
domutils@3.2.2:
dependencies:
dom-serializer: 2.0.0
domelementtype: 2.3.0
domhandler: 5.0.3
domutils@4.0.2:
dependencies:
dom-serializer: 3.1.1
domelementtype: 3.0.0
domhandler: 6.0.1
dotenv@16.6.1: {}
dotenv@17.2.3: {}
@@ -7164,6 +7278,10 @@ snapshots:
entities@7.0.0: {}
entities@7.0.1: {}
entities@8.0.0: {}
es-module-lexer@1.7.0: {}
es-toolkit@1.43.0: {}
@@ -7573,6 +7691,20 @@ snapshots:
html-void-elements@3.0.0: {}
htmlparser2@10.1.0:
dependencies:
domelementtype: 2.3.0
domhandler: 5.0.3
domutils: 3.2.2
entities: 7.0.1
htmlparser2@12.0.0:
dependencies:
domelementtype: 3.0.0
domhandler: 6.0.1
domutils: 4.0.2
entities: 8.0.0
http-errors@2.0.1:
dependencies:
depd: 2.0.0
@@ -7641,6 +7773,8 @@ snapshots:
is-number@7.0.0: {}
is-plain-object@5.0.0: {}
is-property@1.0.2: {}
is-what@5.5.0: {}
@@ -7681,6 +7815,10 @@ snapshots:
dependencies:
json-buffer: 3.0.1
launder@1.7.1:
dependencies:
dayjs: 1.11.19
lazy@1.0.11: {}
levn@0.4.1:
@@ -7865,7 +8003,7 @@ snapshots:
dependencies:
lru.min: 1.1.3
nanoid@3.3.11: {}
nanoid@3.3.16: {}
natural-compare@1.4.0: {}
@@ -7955,6 +8093,8 @@ snapshots:
pako@0.2.9: {}
parse-srcset@1.0.2: {}
path-browserify@1.0.1: {}
path-exists@4.0.0: {}
@@ -8145,9 +8285,9 @@ snapshots:
postcss-value-parser@4.2.0: {}
postcss@8.5.6:
postcss@8.5.19:
dependencies:
nanoid: 3.3.11
nanoid: 3.3.16
picocolors: 1.1.1
source-map-js: 1.2.1
@@ -8577,6 +8717,16 @@ snapshots:
safer-buffer@2.1.2: {}
sanitize-html@2.17.6:
dependencies:
deepmerge: 4.3.1
escape-string-regexp: 4.0.0
htmlparser2: 12.0.0
is-plain-object: 5.0.0
launder: 1.7.1
parse-srcset: 1.0.2
postcss: 8.5.19
sax@1.4.3: {}
scheduler@0.27.0: {}
@@ -8963,7 +9113,7 @@ snapshots:
vite@5.4.21(@types/node@26.1.1)(lightningcss@1.30.2):
dependencies:
esbuild: 0.21.5
postcss: 8.5.6
postcss: 8.5.19
rollup: 4.55.1
optionalDependencies:
'@types/node': 26.1.1
@@ -8975,7 +9125,7 @@ snapshots:
esbuild: 0.27.2
fdir: 6.5.0(picomatch@4.0.3)
picomatch: 4.0.3
postcss: 8.5.6
postcss: 8.5.19
rollup: 4.54.0
tinyglobby: 0.2.15
optionalDependencies:
@@ -8990,7 +9140,7 @@ snapshots:
esbuild: 0.27.2
fdir: 6.5.0(picomatch@4.0.5)
picomatch: 4.0.5
postcss: 8.5.6
postcss: 8.5.19
rollup: 4.55.1
tinyglobby: 0.2.17
optionalDependencies:
@@ -9000,7 +9150,7 @@ snapshots:
lightningcss: 1.30.2
tsx: 4.21.0
vitepress@1.6.4(@algolia/client-search@5.56.0)(@types/node@26.1.1)(lightningcss@1.30.2)(postcss@8.5.6)(search-insights@2.17.3)(typescript@6.0.2):
vitepress@1.6.4(@algolia/client-search@5.56.0)(@types/node@26.1.1)(lightningcss@1.30.2)(postcss@8.5.19)(search-insights@2.17.3)(typescript@6.0.2):
dependencies:
'@docsearch/css': 3.8.2
'@docsearch/js': 3.8.2(@algolia/client-search@5.56.0)(search-insights@2.17.3)
@@ -9021,7 +9171,7 @@ snapshots:
vite: 5.4.21(@types/node@26.1.1)(lightningcss@1.30.2)
vue: 3.5.26(typescript@6.0.2)
optionalDependencies:
postcss: 8.5.6
postcss: 8.5.19
transitivePeerDependencies:
- '@algolia/client-search'
- '@types/node'
+1
View File
@@ -4,6 +4,7 @@ packages:
- tools/*
overrides:
postcss: 8.5.19
typescript: 6.0.2
allowBuilds: