diff --git a/app/game-api/package.json b/app/game-api/package.json index 700d003..68993c1 100644 --- a/app/game-api/package.json +++ b/app/game-api/package.json @@ -26,6 +26,7 @@ "typecheck": "tsc -b" }, "devDependencies": { + "@types/sanitize-html": "2.16.1", "tsdown": "^0.18.4", "vite-tsconfig-paths": "^6.0.3", "vitest": "^4.0.16" @@ -42,6 +43,7 @@ "es-toolkit": "^1.43.0", "fastify": "^5.6.2", "redis": "^5.10.0", + "sanitize-html": "2.17.6", "sharp": "^0.34.4", "zod": "^4.3.5" } diff --git a/app/game-api/src/router/join/index.ts b/app/game-api/src/router/join/index.ts index edb82ba..d7c962a 100644 --- a/app/game-api/src/router/join/index.ts +++ b/app/game-api/src/router/join/index.ts @@ -20,6 +20,7 @@ import { RejectedNpcPossessionCommandError, } from '../../daemon/databaseTransport.js'; import { NpcPossessionError, reserveNpcPossessionCandidates } from '@sammo-ts/game-engine'; +import { resolveNationScoutMessage } from '../nation/shared.js'; const resolveSelectionCommandResult = ( result: Awaited> | null, @@ -302,7 +303,7 @@ export const joinRouter = router({ id: nation.id, name: nation.name, color: nation.color, - scoutMessage: typeof meta.infoText === 'string' ? meta.infoText : null, + scoutMessage: resolveNationScoutMessage(meta) || null, }; }); diff --git a/app/game-api/src/router/nation/endpoints/setNotice.ts b/app/game-api/src/router/nation/endpoints/setNotice.ts index d7bf945..8592d82 100644 --- a/app/game-api/src/router/nation/endpoints/setNotice.ts +++ b/app/game-api/src/router/nation/endpoints/setNotice.ts @@ -3,6 +3,7 @@ import { z } from 'zod'; import { asRecord } from '@sammo-ts/common'; +import { purifyNationHtml } from '../../../security/nationHtml.js'; import { authedProcedure } from '../../../trpc.js'; import { getMyGeneral } from '../../shared/general.js'; import { assertNationAccess, assertNationEditable, updateNationMeta } from '../shared.js'; @@ -10,7 +11,7 @@ import { assertNationAccess, assertNationEditable, updateNationMeta } from '../s export const setNotice = authedProcedure .input( z.object({ - msg: z.string().max(16384), + msg: z.string().min(1).max(16384), }) ) .mutation(async ({ ctx, input }) => { @@ -25,13 +26,14 @@ export const setNotice = authedProcedure } assertNationEditable(me, nation.meta); const nationMeta = asRecord(nation.meta); + const msg = purifyNationHtml(input.msg); await updateNationMeta( ctx, me.nationId, { - notice: input.msg, + notice: msg, }, nationMeta ); - return { ok: true }; + return { ok: true, msg }; }); diff --git a/app/game-api/src/router/nation/endpoints/setScoutMsg.ts b/app/game-api/src/router/nation/endpoints/setScoutMsg.ts index 422bd2c..db89570 100644 --- a/app/game-api/src/router/nation/endpoints/setScoutMsg.ts +++ b/app/game-api/src/router/nation/endpoints/setScoutMsg.ts @@ -3,6 +3,7 @@ import { z } from 'zod'; import { asRecord } from '@sammo-ts/common'; +import { purifyNationHtml } from '../../../security/nationHtml.js'; import { authedProcedure } from '../../../trpc.js'; import { getMyGeneral } from '../../shared/general.js'; import { assertNationAccess, assertNationEditable, updateNationMeta } from '../shared.js'; @@ -10,7 +11,7 @@ import { assertNationAccess, assertNationEditable, updateNationMeta } from '../s export const setScoutMsg = authedProcedure .input( z.object({ - msg: z.string().max(1000), + msg: z.string().min(1).max(1000), }) ) .mutation(async ({ ctx, input }) => { @@ -25,13 +26,14 @@ export const setScoutMsg = authedProcedure } assertNationEditable(me, nation.meta); const nationMeta = asRecord(nation.meta); + const msg = purifyNationHtml(input.msg); await updateNationMeta( ctx, me.nationId, { - infoText: input.msg, + infoText: msg, }, nationMeta ); - return { ok: true }; + return { ok: true, msg }; }); diff --git a/app/game-api/src/router/nation/shared.ts b/app/game-api/src/router/nation/shared.ts index b49ab68..88eb0c4 100644 --- a/app/game-api/src/router/nation/shared.ts +++ b/app/game-api/src/router/nation/shared.ts @@ -27,6 +27,7 @@ import { } from '@sammo-ts/logic'; import type { GameApiContext, InputJsonValue, WorldStateRow } from '../../context.js'; +import { purifyNationHtml } from '../../security/nationHtml.js'; import { resolveSecretPermission } from '../shared/secretPermission.js'; export type PermissionKind = 'normal' | 'ambassador' | 'auditor'; @@ -268,10 +269,10 @@ export const resolveNationBlockScout = (meta: Record): boolean readMetaBool(meta, 'scout', readMetaBool(meta, 'blockScout', false)); export const resolveNationNotice = (meta: Record): string => - typeof meta.notice === 'string' ? meta.notice : ''; + purifyNationHtml(typeof meta.notice === 'string' ? meta.notice : ''); export const resolveNationScoutMessage = (meta: Record): string => - typeof meta.infoText === 'string' ? meta.infoText : ''; + purifyNationHtml(typeof meta.infoText === 'string' ? meta.infoText : ''); export const resolveWarSettingRemain = (meta: Record): number => { const legacy = readMetaNumber(meta, 'available_war_setting_cnt', -1); diff --git a/app/game-api/src/security/nationHtml.ts b/app/game-api/src/security/nationHtml.ts new file mode 100644 index 0000000..9c6e74b --- /dev/null +++ b/app/game-api/src/security/nationHtml.ts @@ -0,0 +1,98 @@ +import sanitizeHtml from 'sanitize-html'; + +const safeIframeSource = /^(?:https?:)?\/\/(?:www\.youtube(?:-nocookie)?\.com\/embed\/|player\.vimeo\.com\/video\/)/; +const unsafeUrlScheme = /^(?:javascript|data|vbscript):/i; +const unsafeSourceMarker = 'data-sammo-unsafe-source'; + +const normalizeUrlScheme = (value: string): string => + Array.from(value) + .filter((character) => { + const codePoint = character.codePointAt(0) ?? 0; + return codePoint > 0x20 && (codePoint < 0x7f || codePoint > 0x9f); + }) + .join(''); + +const options: sanitizeHtml.IOptions = { + allowedTags: [...sanitizeHtml.defaults.allowedTags, 'img', 'iframe'], + allowedAttributes: { + ...sanitizeHtml.defaults.allowedAttributes, + '*': ['class', 'style', 'title', 'lang', 'dir', 'align', 'data-flip'], + a: ['href', 'name', 'title', 'data-flip'], + img: ['src', 'srcset', 'alt', 'title', 'width', 'height', 'data-flip', unsafeSourceMarker], + iframe: ['src', 'width', 'height', 'title', 'frameborder', 'data-flip'], + table: ['width', 'border', 'cellpadding', 'cellspacing', 'summary', 'data-flip'], + td: ['width', 'height', 'colspan', 'rowspan', 'headers', 'data-flip'], + th: ['width', 'height', 'colspan', 'rowspan', 'scope', 'headers', 'data-flip'], + col: ['width', 'span', 'data-flip'], + colgroup: ['width', 'span', 'data-flip'], + }, + allowedSchemes: ['http', 'https', 'ftp', 'mailto', 'tel'], + allowProtocolRelative: true, + allowedStyles: { + '*': { + color: [/^#[0-9a-f]{3,8}$/i, /^rgba?\([\d\s.,%]+\)$/i, /^hsla?\([\d\s.,%]+\)$/i, /^[a-z]+$/i], + 'background-color': [/^#[0-9a-f]{3,8}$/i, /^rgba?\([\d\s.,%]+\)$/i, /^hsla?\([\d\s.,%]+\)$/i, /^[a-z]+$/i], + 'font-family': [/^[\w\s"',.-]+$/], + 'font-size': [ + /^\d+(?:\.\d+)?(?:px|pt|em|rem|%)$/i, + /^(?:xx-small|x-small|small|medium|large|x-large|xx-large)$/i, + ], + 'font-style': [/^(?:normal|italic|oblique)$/i], + 'font-weight': [/^(?:normal|bold|bolder|lighter|[1-9]00)$/i], + 'text-align': [/^(?:left|right|center|justify|start|end)$/i], + 'text-decoration': [/^[\w\s-]+$/i], + 'vertical-align': [ + /^(?:baseline|sub|super|top|text-top|middle|bottom|text-bottom|-?\d+(?:\.\d+)?(?:px|em|rem|%))$/i, + ], + width: [/^(?:auto|\d+(?:\.\d+)?(?:px|em|rem|%))$/i], + height: [/^(?:auto|\d+(?:\.\d+)?(?:px|em|rem|%))$/i], + 'max-width': [/^(?:none|\d+(?:\.\d+)?(?:px|em|rem|%))$/i], + 'max-height': [/^(?:none|\d+(?:\.\d+)?(?:px|em|rem|%))$/i], + 'min-width': [/^\d+(?:\.\d+)?(?:px|em|rem|%)$/i], + 'min-height': [/^\d+(?:\.\d+)?(?:px|em|rem|%)$/i], + margin: [/^(?:auto|-?\d+(?:\.\d+)?(?:px|em|rem|%))(?:\s+(?:auto|-?\d+(?:\.\d+)?(?:px|em|rem|%))){0,3}$/i], + padding: [/^\d+(?:\.\d+)?(?:px|em|rem|%)(?:\s+\d+(?:\.\d+)?(?:px|em|rem|%)){0,3}$/i], + 'line-height': [/^(?:normal|\d+(?:\.\d+)?(?:px|em|rem|%)?)$/i], + float: [/^(?:none|left|right)$/i], + }, + }, + transformTags: { + img: (tagName, attribs) => { + if (typeof attribs.src === 'string' && unsafeUrlScheme.test(normalizeUrlScheme(attribs.src))) { + return { tagName, attribs: { [unsafeSourceMarker]: 'true' } }; + } + if (attribs.alt !== undefined || !attribs.src) { + return { tagName, attribs }; + } + const filename = attribs.src.split('/').filter(Boolean).at(-1); + return { + tagName, + attribs: filename ? { ...attribs, alt: filename } : attribs, + }; + }, + iframe: (tagName, attribs) => { + const source = typeof attribs.src === 'string' ? attribs.src.trim() : undefined; + if (source && !safeIframeSource.test(source)) { + const { src: _unsafeSource, ...safeAttribs } = attribs; + return { tagName, attribs: safeAttribs }; + } + return { + tagName, + attribs: source === undefined ? attribs : { ...attribs, src: source }, + }; + }, + }, + exclusiveFilter: (frame) => frame.tag === 'img' && frame.attribs[unsafeSourceMarker] === 'true', +}; + +/** + * Ref's WebUtil::htmlPurify boundary for nation notice and recruitment HTML. + * Writes are canonicalized and reads are purified again so pre-existing rows + * cannot execute markup. + */ +export const purifyNationHtml = (value: string | null | undefined): string => { + if (!value) { + return ''; + } + return sanitizeHtml(value, options); +}; diff --git a/app/game-api/test/nationHtml.test.ts b/app/game-api/test/nationHtml.test.ts new file mode 100644 index 0000000..a9e4d69 --- /dev/null +++ b/app/game-api/test/nationHtml.test.ts @@ -0,0 +1,76 @@ +import { describe, expect, it } from 'vitest'; + +import { purifyNationHtml } from '../src/security/nationHtml.js'; + +describe('nation HTML purification', () => { + it('removes executable markup and unsafe URL/CSS vectors', () => { + const dirty = [ + '', + '', + '', + 'unsafe link', + '

notice

', + '', + '', + 'svg', + ].join(''); + + const clean = purifyNationHtml(dirty); + + expect(clean).not.toMatch(/script|onerror|onclick|onmouseover|onload|javascript:|background-image|attacker/i); + expect(clean).not.toContain('unsafe link'); + expect(clean).toContain('

notice

'); + expect(clean).toContain(''); + }); + + it('does not throw on malformed escaped filenames and preserves the raw basename as alt text', () => { + expect(purifyNationHtml('')).toBe('%E0%A4%A'); + expect(purifyNationHtml('')).toBe( + 'a%20b.pngy' + ); + }); + + it('matches Ref iframe whitespace and case handling', () => { + expect( + purifyNationHtml( + [ + '', + '', + '', + ].join('') + ) + ).toBe(''); + }); + + it('preserves Ref-compatible formatting, data-flip, images, and safe video embeds', () => { + const source = [ + '
', + '북벌
', + '계획', + '장수', + '', + '', + '
', + ].join(''); + + const clean = purifyNationHtml(source); + + expect(clean).toContain('class="notice"'); + expect(clean).toContain('data-flip="horizontal"'); + expect(clean).toContain('style="text-align:center;color:#00ffff"'); + expect(clean).toContain('북벌
'); + expect(clean).toContain('href="https://example.com/path"'); + expect(clean).not.toContain('target="_blank"'); + expect(clean).toContain('src="/image/icons/default.jpg"'); + expect(clean).toContain('alt="장수"'); + expect(clean).toContain('srcset="/image/icons/default.jpg 1x"'); + expect(clean).toContain('//www.youtube-nocookie.com/embed/abc123'); + expect(clean).toContain('https://player.vimeo.com/video/1234'); + }); + + it('is idempotent for already-purified stored values', () => { + const first = purifyNationHtml('

방침

'); + expect(purifyNationHtml(first)).toBe(first); + }); +}); diff --git a/app/game-api/test/nationHtmlRouter.test.ts b/app/game-api/test/nationHtmlRouter.test.ts new file mode 100644 index 0000000..07ea553 --- /dev/null +++ b/app/game-api/test/nationHtmlRouter.test.ts @@ -0,0 +1,161 @@ +import { describe, expect, it, vi } from 'vitest'; + +import type { GameSessionTokenPayload } from '@sammo-ts/common/auth/gameToken'; +import type { RedisConnector } from '@sammo-ts/infra'; + +import { RedisAccessTokenStore } from '../src/auth/accessTokenStore.js'; +import { InMemoryFlushStore } from '../src/auth/flushStore.js'; +import type { DatabaseClient, GameApiContext, GeneralRow } from '../src/context.js'; +import type { TurnDaemonTransport } from '../src/daemon/transport.js'; +import { appRouter } from '../src/router.js'; +import { resolveNationNotice, resolveNationScoutMessage } from '../src/router/nation/shared.js'; + +const general: GeneralRow = { + id: 1, + userId: 'user-1', + name: '정책담당', + nationId: 1, + cityId: 1, + troopId: 0, + npcState: 0, + affinity: null, + bornYear: 180, + deadYear: 300, + picture: null, + imageServer: 0, + leadership: 50, + strength: 50, + intel: 50, + injury: 0, + experience: 0, + dedication: 0, + officerLevel: 5, + gold: 1_000, + rice: 1_000, + crew: 0, + crewTypeId: 0, + train: 0, + atmos: 0, + weaponCode: 'None', + bookCode: 'None', + horseCode: 'None', + itemCode: 'None', + turnTime: new Date('2026-01-01T00:00:00.000Z'), + recentWarTime: null, + age: 20, + startAge: 20, + personalCode: 'None', + specialCode: 'None', + special2Code: 'None', + lastTurn: {}, + meta: {}, + penalty: {}, + createdAt: new Date('2026-01-01T00:00:00.000Z'), + updatedAt: new Date('2026-01-01T00:00:00.000Z'), +}; + +const auth: GameSessionTokenPayload = { + version: 1, + profile: 'che:default', + issuedAt: '2026-01-01T00:00:00.000Z', + expiresAt: '2026-01-02T00:00:00.000Z', + sessionId: 'session-1', + user: { + id: 'user-1', + username: 'tester', + displayName: 'Tester', + roles: [], + }, + sanctions: {}, +}; + +const buildContext = () => { + const requestCommand = vi.fn(async (command: unknown) => ({ + type: 'setNationMeta', + ok: true, + updatedAt: '2026-01-01T00:00:01.000Z', + command, + })); + const db = { + general: { + findFirst: vi.fn(async () => general), + }, + nation: { + findUnique: vi.fn(async () => ({ meta: {} })), + }, + }; + const redisClient = { + get: async () => null, + set: async () => null, + }; + const context: GameApiContext = { + db: db as unknown as DatabaseClient, + redis: {} as RedisConnector['client'], + turnDaemon: { requestCommand } as unknown as TurnDaemonTransport, + battleSim: {} as GameApiContext['battleSim'], + profile: { id: 'che', scenario: 'default', name: 'che:default' }, + auth, + uploadDir: 'uploads', + uploadPath: '/uploads', + uploadPublicUrl: null, + accessTokenStore: new RedisAccessTokenStore(redisClient, 'che:default'), + flushStore: new InMemoryFlushStore(), + gameTokenSecret: 'test-secret', + }; + return { caller: appRouter.createCaller(context), requestCommand }; +}; + +describe('nation HTML API boundary', () => { + it.each([ + { + procedure: 'setNotice', + metaKey: 'notice', + limit: 16_384, + }, + { + procedure: 'setScoutMsg', + metaKey: 'infoText', + limit: 1_000, + }, + ] as const)('purifies $procedure before daemon persistence', async ({ procedure, metaKey, limit }) => { + const fixture = buildContext(); + const dirty = `

안전

`; + + const msg = '

안전

x'; + await expect(fixture.caller.nation[procedure]({ msg: dirty.slice(0, limit) })).resolves.toEqual({ + ok: true, + msg, + }); + + expect(fixture.requestCommand).toHaveBeenCalledWith({ + type: 'setNationMeta', + nationId: 1, + updates: { + [metaKey]: msg, + }, + expectedUpdatedAt: undefined, + }); + }); + + it.each(['setNotice', 'setScoutMsg'] as const)( + 'rejects an empty $procedure value like Ref required validation', + async (procedure) => { + await expect(buildContext().caller.nation[procedure]({ msg: '' })).rejects.toMatchObject({ + code: 'BAD_REQUEST', + }); + } + ); + + it('purifies legacy stored values on every read resolver', () => { + expect( + resolveNationNotice({ + notice: '방침', + }) + ).toBe('방침'); + expect( + resolveNationScoutMessage({ + infoText: '임관', + }) + ).toBe('임관'); + }); +}); diff --git a/app/game-api/test/nationHtmlTransport.integration.test.ts b/app/game-api/test/nationHtmlTransport.integration.test.ts new file mode 100644 index 0000000..4f24067 --- /dev/null +++ b/app/game-api/test/nationHtmlTransport.integration.test.ts @@ -0,0 +1,202 @@ +import fs from 'node:fs/promises'; +import os from 'node:os'; +import path from 'node:path'; + +import { afterAll, beforeAll, describe, expect, it } from 'vitest'; + +import { type GameSessionTokenPayload } from '@sammo-ts/common/auth/gameToken'; +import { + createGamePostgresConnector, + createRedisConnector, + resolveRedisConfigFromEnv, + type GamePrismaClient, + type RedisConnector, +} from '@sammo-ts/infra'; + +import { RedisAccessTokenStore } from '../src/auth/accessTokenStore.js'; +import { createGameApiServer } from '../src/server.js'; + +const databaseUrl = process.env.INPUT_EVENT_DATABASE_URL; +const integration = describe.skipIf(!databaseUrl || !process.env.REDIS_URL); +const profileId = process.env.POSTGRES_SCHEMA ?? 'conditional_integration'; +const profileName = `che:nation-html-${process.pid}`; +const userId = `nation-html-user-${process.pid}`; +const fixtureId = 900_000 + (process.pid % 50_000); +const secret = 'nation-html-http-secret'; +const redisPrefix = `sammo:nation-html:${process.pid}`; +const envKeys = [ + 'PROFILE', + 'SCENARIO', + 'GAME_PROFILE_NAME', + 'GAME_API_HOST', + 'GAME_API_PORT', + 'GAME_TOKEN_SECRET', + 'GATEWAY_REDIS_PREFIX', + 'GAME_UPLOAD_DIR', + 'DATABASE_URL', +] as const; +const originalEnv = new Map(envKeys.map((key) => [key, process.env[key]])); + +type RunningServer = Awaited>; + +let server: RunningServer | null = null; +let baseUrl = ''; +let uploadDir = ''; +let db: GamePrismaClient; +let disconnectDb: (() => Promise) | null = null; +let redis: RedisConnector | null = null; +let accessToken = ''; + +const restoreEnv = (): void => { + for (const [key, value] of originalEnv) { + if (value === undefined) { + delete process.env[key]; + } else { + process.env[key] = value; + } + } +}; + +integration('nation HTML purification over HTTP transport', () => { + beforeAll(async () => { + uploadDir = await fs.mkdtemp(path.join(os.tmpdir(), 'sammo-nation-html-http-')); + process.env.PROFILE = profileId; + process.env.SCENARIO = 'nation-html'; + process.env.GAME_PROFILE_NAME = profileName; + process.env.GAME_API_HOST = '127.0.0.1'; + process.env.GAME_API_PORT = '0'; + process.env.GAME_TOKEN_SECRET = secret; + process.env.GATEWAY_REDIS_PREFIX = redisPrefix; + process.env.GAME_UPLOAD_DIR = uploadDir; + process.env.DATABASE_URL = databaseUrl; + + const connector = createGamePostgresConnector({ url: databaseUrl! }); + await connector.connect(); + db = connector.prisma; + disconnectDb = () => connector.disconnect(); + + await db.general.deleteMany({ where: { id: fixtureId } }); + await db.nation.deleteMany({ where: { id: fixtureId } }); + await db.worldState.deleteMany({ where: { id: fixtureId } }); + await db.worldState.create({ + data: { + id: fixtureId, + scenarioCode: 'nation-html', + currentYear: 200, + currentMonth: 1, + tickSeconds: 600, + meta: { + lastTurnTime: '2026-07-31T00:00:00.000Z', + }, + }, + }); + await db.nation.create({ + data: { + id: fixtureId, + name: '정화국', + color: '#00ffff', + meta: { + notice: [ + '

안전한 방침

', + '', + '', + '', + ].join(''), + infoText: '임관 권유', + }, + }, + }); + await db.general.create({ + data: { + id: fixtureId, + userId, + name: '정화담당', + nationId: fixtureId, + turnTime: new Date('2026-07-31T00:00:00.000Z'), + }, + }); + + redis = createRedisConnector(resolveRedisConfigFromEnv()); + await redis.connect(); + const store = new RedisAccessTokenStore(redis.client, profileName); + const payload: GameSessionTokenPayload = { + version: 1, + profile: profileName, + issuedAt: new Date(Date.now() - 1_000).toISOString(), + expiresAt: new Date(Date.now() + 10 * 60_000).toISOString(), + sessionId: `nation-html-session-${process.pid}`, + user: { + id: userId, + username: 'nation-html-user', + displayName: 'Nation HTML User', + roles: ['user'], + createdAt: '2026-07-31T00:00:00.000Z', + }, + sanctions: {}, + }; + const created = await store.create(payload); + if (!created) { + throw new Error('failed to seed nation HTML access token'); + } + accessToken = created.accessToken; + + server = await createGameApiServer(); + baseUrl = await server.app.listen({ host: server.config.host, port: server.config.port }); + }, 30_000); + + afterAll(async () => { + await server?.app.close(); + await db?.general.deleteMany({ where: { id: fixtureId } }); + await db?.nation.deleteMany({ where: { id: fixtureId } }); + await db?.worldState.deleteMany({ where: { id: fixtureId } }); + await disconnectDb?.(); + await redis?.disconnect(); + if (uploadDir) { + await fs.rm(uploadDir, { recursive: true, force: true }); + } + restoreEnv(); + }, 30_000); + + it('removes pre-existing executable nation notice markup before serialization', async () => { + const response = await fetch(`${baseUrl}/trpc/general.getFrontStatus`, { + headers: { + authorization: `Bearer ${accessToken}`, + }, + }); + const body = (await response.json()) as { + result?: { + data?: { + nationNotice?: string; + }; + }; + }; + + expect(response.status, JSON.stringify(body)).toBe(200); + expect(body.result?.data?.nationNotice).toBe( + '

안전한 방침

default.jpg' + ); + }); + + it('removes executable stored recruitment markup from join configuration serialization', async () => { + const response = await fetch(`${baseUrl}/trpc/join.getConfig`, { + headers: { + authorization: `Bearer ${accessToken}`, + }, + }); + const body = (await response.json()) as { + result?: { + data?: { + nations?: Array<{ + id: number; + scoutMessage: string | null; + }>; + }; + }; + }; + + expect(response.status, JSON.stringify(body)).toBe(200); + expect(body.result?.data?.nations?.find(({ id }) => id === fixtureId)?.scoutMessage).toBe( + '임관 권유' + ); + }); +}); diff --git a/app/game-frontend/e2e/inGameMenus.spec.ts b/app/game-frontend/e2e/inGameMenus.spec.ts index cf5adbc..2496e0e 100644 --- a/app/game-frontend/e2e/inGameMenus.spec.ts +++ b/app/game-frontend/e2e/inGameMenus.spec.ts @@ -32,6 +32,7 @@ type FixtureState = { dieOnPrestartInputs?: Array>; generalMeQueries?: number; generalLogQueries?: number; + nationNoticeInput?: string; settingMutations: Array>; accessPages: string[]; }; @@ -170,6 +171,15 @@ const install = async (page: Page, state: FixtureState) => { available: false, availableAt: state.dieOnPrestartAvailableAt ?? null, }); + if (operation === 'general.getFrontStatus') + return response({ + onlineUserCount: 1, + onlineNations: '【위】', + onlineGenerals: '검증장수', + nationNotice: state.nationNoticeInput ?? '', + lastExecuted: '2026-01-01T00:00:00.000Z', + latestVote: null, + }); if (operation === 'world.getState') return response({ currentYear: 185, @@ -190,6 +200,36 @@ const install = async (page: Page, state: FixtureState) => { autorun_user: {}, }, }); + if (operation === 'world.getMapLayout') + return response({ mapName: 'che', cityList: [], regionMap: {}, levelMap: {} }); + if (operation === 'world.getMap') + return response({ + year: 185, + month: 1, + startYear: 180, + cityList: [], + nationList: [], + myCity: 1, + myNation: 1, + }); + if (operation === 'turns.getCommandTable') return response({ general: [], nation: [] }); + if (operation === 'turns.reserved.getGeneral' || operation === 'turns.reserved.getNation') + return response({ turns: [], revision: 0 }); + if (operation === 'messages.getRecent') + return response({ + private: [], + national: [], + public: [], + diplomacy: [], + sequence: -1, + hasMore: { private: false, national: false, public: false, diplomacy: false }, + latestRead: { private: 0, national: 0, public: 0, diplomacy: 0 }, + canRespondDiplomacy: false, + }); + if (operation === 'messages.getContacts') return response({ nation: [] }); + if (operation === 'general.getRecentRecords') return response({ global: [], general: [], history: [] }); + if (operation === 'board.getAccess') return response({ permission: 4, canMeeting: true, canSecret: true }); + if (operation === 'tournament.getState') return response({ stage: 0 }); if (operation === 'public.getTraffic') return response({ history: [ @@ -273,6 +313,32 @@ const install = async (page: Page, state: FixtureState) => { }); }; +test('정화된 국가 방침은 실행 가능한 속성 없이 Chromium에 표시된다', async ({ page }) => { + const state: FixtureState = { + permission: 'head', + myset: 0, + nationNoticeInput: [ + '

안전한 방침

', + '', + '위험 링크', + ].join(''), + settingMutations: [], + accessPages: [], + }; + await install(page, state); + + await page.goto(''); + + const notice = page.locator('.nation-notice-body'); + await expect(notice).toContainText('안전한 방침'); + await expect(notice.locator('[data-flip="horizontal"]')).toHaveCSS('color', 'rgb(0, 255, 255)'); + await expect(notice.locator('script, svg, [onerror], [onload], [onclick]')).toHaveCount(0); + await expect(notice.locator('a', { hasText: '위험 링크' })).not.toHaveAttribute('href'); + await expect + .poll(() => page.evaluate(() => (globalThis as typeof globalThis & { __nationXss?: number }).__nationXss)) + .toBeUndefined(); +}); + test('접속량정보 keeps the legacy public 1016px chart geometry', async ({ page }) => { const state: FixtureState = { permission: 'member', myset: 0, settingMutations: [], accessPages: [] }; await install(page, state); diff --git a/app/game-frontend/e2e/nationOffices.spec.ts b/app/game-frontend/e2e/nationOffices.spec.ts index 546f1c9..6a5eb84 100644 --- a/app/game-frontend/e2e/nationOffices.spec.ts +++ b/app/game-frontend/e2e/nationOffices.spec.ts @@ -10,8 +10,19 @@ type FixtureState = { failPersonnelLoad?: boolean; rate: number; appointedGeneralId?: number; + noticeMutationInput?: string; + scoutMutationInput?: string; }; +type TrpcRequestPayload = { + json?: Record; + input?: { json?: Record }; +}; + +const purifiedNoticeResponse = + '

서버 정화 방침

default.jpg'; +const purifiedScoutResponse = '서버 정화 임관문위험 링크'; + const artifactRoot = process.env.OFFICE_PARITY_ARTIFACT_DIR ? resolve(process.env.OFFICE_PARITY_ARTIFACT_DIR) : null; const repositoryRoot = resolve(dirname(fileURLToPath(import.meta.url)), '../../..'); const imageRoots = [ @@ -190,7 +201,17 @@ const installFixture = async (page: Page, state: FixtureState) => { ); await page.route('**/che/api/trpc/**', async (route) => { const operations = operationName(route).split(','); - const results = operations.map((operation) => { + const rawRequestBody: unknown = route.request().postData() ? route.request().postDataJSON() : {}; + const requestBody = + rawRequestBody && typeof rawRequestBody === 'object' ? (rawRequestBody as Record) : {}; + const results = operations.map((operation, operationIndex) => { + const rawPayload = + requestBody[String(operationIndex)] ?? (operations.length === 1 ? requestBody : undefined); + const payload = + rawPayload && typeof rawPayload === 'object' ? (rawPayload as TrpcRequestPayload) : undefined; + const jsonInput = + payload?.json ?? payload?.input?.json ?? (payload as Record | undefined) ?? {}; + if (operation === 'auth.status') return response({ ok: true }); if (operation === 'lobby.info') return response({ myGeneral: { id: 1, name: '조조' } }); if (operation === 'join.getConfig') return response({}); if (operation === 'nation.getPersonnelInfo') { @@ -212,15 +233,15 @@ const installFixture = async (page: Page, state: FixtureState) => { state.rate = 25; return response({ ok: true }); } - if ( - [ - 'nation.setNotice', - 'nation.setScoutMsg', - 'nation.setBill', - 'nation.setSecretLimit', - 'nation.setBlockScout', - ].includes(operation) - ) + if (operation === 'nation.setNotice') { + state.noticeMutationInput = typeof jsonInput.msg === 'string' ? jsonInput.msg : undefined; + return response({ ok: true, msg: purifiedNoticeResponse }); + } + if (operation === 'nation.setScoutMsg') { + state.scoutMutationInput = typeof jsonInput.msg === 'string' ? jsonInput.msg : undefined; + return response({ ok: true, msg: purifiedScoutResponse }); + } + if (['nation.setBill', 'nation.setSecretLimit', 'nation.setBlockScout'].includes(operation)) return response({ ok: true }); if (operation === 'nation.setBlockWar') return response({ availableCnt: 4 }); return errorResponse(operation, `Unhandled fixture operation: ${operation}`); @@ -426,3 +447,45 @@ test('finance enforces edit permissions and preserves the old value across an AP await expect(readOnly.locator('.policy-cell').getByRole('button', { name: '변경' })).toHaveCount(0); await expect(readOnly.getByRole('checkbox', { name: '전쟁 금지' })).toBeDisabled(); }); + +test('finance adopts the server-purified notice and scout message before rendering the saved preview', async ({ + page, +}) => { + const state: FixtureState = { role: 'head', rate: 20 }; + await installFixture(page, state); + await gotoOffice(page, 'nation/finance'); + + const dirtyNotice = + '

원문

'; + await page.getByRole('button', { name: '국가방침 수정' }).click(); + await page.getByRole('textbox', { name: '국가 방침' }).fill(dirtyNotice); + await page.locator('#notice-form').getByRole('button', { name: '저장' }).click(); + + const noticePreview = page.locator('#notice-form .message-preview'); + await expect(noticePreview).toContainText('서버 정화 방침'); + expect(state.noticeMutationInput).toBe(dirtyNotice); + await expect(noticePreview.locator('[data-flip="horizontal"]')).toHaveCSS('color', 'rgb(0, 255, 255)'); + await expect(noticePreview.locator('script, svg, [onerror], [onload], [onclick]')).toHaveCount(0); + await expect + .poll(() => + page.evaluate(() => (globalThis as typeof globalThis & { __nationNoticeXss?: number }).__nationNoticeXss) + ) + .toBeUndefined(); + + const dirtyScout = + '원문'; + await page.getByRole('button', { name: '임관 권유문 수정' }).click(); + await page.getByRole('textbox', { name: '임관 권유' }).fill(dirtyScout); + await page.locator('#scout-message-form').getByRole('button', { name: '저장' }).click(); + + const scoutPreview = page.locator('#scout-message-form .message-preview'); + await expect(scoutPreview).toContainText('서버 정화 임관문'); + expect(state.scoutMutationInput).toBe(dirtyScout); + await expect(scoutPreview.locator('a', { hasText: '위험 링크' })).not.toHaveAttribute('href'); + await expect(scoutPreview.locator('script, svg, [onerror], [onload], [onclick]')).toHaveCount(0); + await expect + .poll(() => + page.evaluate(() => (globalThis as typeof globalThis & { __nationScoutXss?: number }).__nationScoutXss) + ) + .toBeUndefined(); +}); diff --git a/app/game-frontend/src/views/NationAffairsView.vue b/app/game-frontend/src/views/NationAffairsView.vue index 4e3e57e..d14d97c 100644 --- a/app/game-frontend/src/views/NationAffairsView.vue +++ b/app/game-frontend/src/views/NationAffairsView.vue @@ -141,8 +141,10 @@ const saveNationMsg = async () => { if (!editable.value) return; errorMessage.value = null; try { - await trpc.nation.setNotice.mutate({ msg: nationMsg.value }); - originalNationMsg.value = nationMsg.value; + const result = await trpc.nation.setNotice.mutate({ msg: nationMsg.value }); + nationMsg.value = result.msg; + originalNationMsg.value = result.msg; + editor.value?.commands.setContent(result.msg || ''); editingNationMsg.value = false; editor.value?.setEditable(false); } catch (err) { diff --git a/app/game-frontend/src/views/NationStratFinanView.vue b/app/game-frontend/src/views/NationStratFinanView.vue index 48337c5..ce9b24f 100644 --- a/app/game-frontend/src/views/NationStratFinanView.vue +++ b/app/game-frontend/src/views/NationStratFinanView.vue @@ -63,15 +63,21 @@ const resolveDiplomacyEnd = (term: number | null): string => { const formatDiplomacyTerm = (term: number | null): string => (term ? `${term}개월` : '-'); const diplomacyInfo = (nation: NationEntry) => resolveDiplomacyInfo(nation.diplomacy.state); -const mutation = async (action: () => Promise, message: string, rollback?: () => void) => { +const mutation = async ( + action: () => Promise, + message: string, + rollback?: () => void +): Promise => { error.value = null; status.value = null; try { - await action(); + const result = await action(); status.value = message; + return result; } catch (err) { rollback?.(); error.value = resolveErrorMessage(err); + return undefined; } }; @@ -85,9 +91,13 @@ const rollbackNationMsg = () => { editingNationMsg.value = false; }; const saveNationMsg = async () => { - await mutation(() => trpc.nation.setNotice.mutate({ msg: nationMsgDraft.value }), '국가 방침을 변경했습니다.'); - if (!error.value) { - nationMsg.value = nationMsgDraft.value; + const result = await mutation( + () => trpc.nation.setNotice.mutate({ msg: nationMsgDraft.value }), + '국가 방침을 변경했습니다.' + ); + if (result) { + nationMsg.value = result.msg; + nationMsgDraft.value = result.msg; editingNationMsg.value = false; } }; @@ -101,9 +111,13 @@ const rollbackScoutMsg = () => { editingScoutMsg.value = false; }; const saveScoutMsg = async () => { - await mutation(() => trpc.nation.setScoutMsg.mutate({ msg: scoutMsgDraft.value }), '임관 권유문을 변경했습니다.'); - if (!error.value) { - scoutMsg.value = scoutMsgDraft.value; + const result = await mutation( + () => trpc.nation.setScoutMsg.mutate({ msg: scoutMsgDraft.value }), + '임관 권유문을 변경했습니다.' + ); + if (result) { + scoutMsg.value = result.msg; + scoutMsgDraft.value = result.msg; editingScoutMsg.value = false; } }; diff --git a/app/game-frontend/src/views/ScoutMessageView.vue b/app/game-frontend/src/views/ScoutMessageView.vue index 1f7fc5b..202a865 100644 --- a/app/game-frontend/src/views/ScoutMessageView.vue +++ b/app/game-frontend/src/views/ScoutMessageView.vue @@ -117,8 +117,10 @@ const saveScoutMsg = async () => { if (!editable.value) return; errorMessage.value = null; try { - await trpc.nation.setScoutMsg.mutate({ msg: scoutMsg.value }); - originalScoutMsg.value = scoutMsg.value; + const result = await trpc.nation.setScoutMsg.mutate({ msg: scoutMsg.value }); + scoutMsg.value = result.msg; + originalScoutMsg.value = result.msg; + editor.value?.commands.setContent(result.msg || ''); editing.value = false; editor.value?.setEditable(false); } catch (err) { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index bba2e99..2eb8669 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -5,6 +5,7 @@ settings: excludeLinksFromLockfile: false overrides: + postcss: 8.5.19 typescript: 6.0.2 importers: @@ -58,7 +59,7 @@ importers: version: 8.65.0(eslint@10.8.0(jiti@2.6.1)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.2) vitepress: specifier: 1.6.4 - version: 1.6.4(@algolia/client-search@5.56.0)(@types/node@26.1.1)(lightningcss@1.30.2)(postcss@8.5.6)(search-insights@2.17.3)(typescript@6.0.2) + version: 1.6.4(@algolia/client-search@5.56.0)(@types/node@26.1.1)(lightningcss@1.30.2)(postcss@8.5.19)(search-insights@2.17.3)(typescript@6.0.2) vue-eslint-parser: specifier: ^10.4.1 version: 10.4.1(eslint@10.8.0(jiti@2.6.1)(supports-color@7.2.0))(supports-color@7.2.0) @@ -98,6 +99,9 @@ importers: redis: specifier: ^5.10.0 version: 5.10.0 + sanitize-html: + specifier: 2.17.6 + version: 2.17.6 sharp: specifier: ^0.34.4 version: 0.34.5 @@ -105,6 +109,9 @@ importers: specifier: ^4.3.5 version: 4.3.5 devDependencies: + '@types/sanitize-html': + specifier: 2.16.1 + version: 2.16.1 tsdown: specifier: ^0.18.4 version: 0.18.4(@emnapi/core@1.11.2)(@emnapi/runtime@1.11.2)(synckit@0.11.13)(typescript@6.0.2)(vue-tsc@3.2.2(typescript@6.0.2)) @@ -217,10 +224,10 @@ importers: version: 6.0.3(vite@7.3.1(@types/node@26.1.1)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0))(vue@3.5.26(typescript@6.0.2)) autoprefixer: specifier: ^10.4.23 - version: 10.4.23(postcss@8.5.6) + version: 10.4.23(postcss@8.5.19) postcss: - specifier: ^8.5.6 - version: 8.5.6 + specifier: 8.5.19 + version: 8.5.19 tailwindcss: specifier: ^4.1.18 version: 4.1.18 @@ -345,10 +352,10 @@ importers: version: 6.0.3(vite@7.3.0(@types/node@26.1.1)(jiti@2.6.1)(lightningcss@1.30.2)(tsx@4.21.0))(vue@3.5.26(typescript@6.0.2)) autoprefixer: specifier: ^10.4.23 - version: 10.4.23(postcss@8.5.6) + version: 10.4.23(postcss@8.5.19) postcss: - specifier: ^8.5.6 - version: 8.5.6 + specifier: 8.5.19 + version: 8.5.19 tailwindcss: specifier: ^4.1.18 version: 4.1.18 @@ -2315,6 +2322,9 @@ packages: '@types/react@19.2.7': resolution: {integrity: sha512-MWtvHrGZLFttgeEj28VXHxpmwYbor/ATPYbBfSFZEIRK0ecCFLl2Qo55z52Hss+UV9CRN7trSeq1zbgx7YDWWg==} + '@types/sanitize-html@2.16.1': + resolution: {integrity: sha512-n9wjs8bCOTyN/ynwD8s/nTcTreIHB1vf31vhLMGqUPNHaweKC4/fAl4Dj+hUlCTKYgm4P3k83fmiFfzkZ6sgMA==} + '@types/unist@3.0.3': resolution: {integrity: sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==} @@ -2782,7 +2792,7 @@ packages: engines: {node: ^10 || ^12 || >=14} hasBin: true peerDependencies: - postcss: ^8.1.0 + postcss: 8.5.19 avvio@9.1.0: resolution: {integrity: sha512-fYASnYi600CsH/j9EQov7lECAniYiBFiiAtBNuZYLA2leLe9qOvZzqYHFjtIj6gD2VMoMLP14834LFWvr4IfDw==} @@ -3001,6 +3011,10 @@ packages: resolution: {integrity: sha512-HOJkrhaYsweh+W+e74Yn7YStZOilkoPb6fycpwNLKzSPtruFs48nYis0zy5yJz1+ktUhHxoRDJ27RQAWLIJVJw==} engines: {node: '>=16.0.0'} + deepmerge@4.3.1: + resolution: {integrity: sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==} + engines: {node: '>=0.10.0'} + defu@6.1.4: resolution: {integrity: sha512-mEQCMmwJu317oSz8CwdIOdwf3xMif1ttiM8LTufzc3g6kR+9Pe236twL8j3IYT1F7GfRgGcW6MWxzZjLIkuHIg==} @@ -3033,6 +3047,35 @@ packages: devlop@1.1.0: resolution: {integrity: sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==} + dom-serializer@2.0.0: + resolution: {integrity: sha512-wIkAryiqt/nV5EQKqQpo3SToSOV9J0DnbJqwK7Wv/Trc92zIAYZ4FlMu+JPFW1DfGFt81ZTCGgDEabffXeLyJg==} + + dom-serializer@3.1.1: + resolution: {integrity: sha512-4MEa38/QexBob6gFNwu+EGdWvhJ1OKuNwdYY3Y3NyeWDQfnGeDYQUDfIRzWu5B5gsv03so2Uxd28YC6zrsx3Lw==} + engines: {node: '>=20.19.0'} + + domelementtype@2.3.0: + resolution: {integrity: sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw==} + + domelementtype@3.0.0: + resolution: {integrity: sha512-umCQid3jKbDmVjx8jGaW7uUykm4DEUeyV21hPxNMo2nV955DhUThwqyOIDtreepP31hl84X7G5U9ZfsWvIB3Pg==} + engines: {node: '>=20.19.0'} + + domhandler@5.0.3: + resolution: {integrity: sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w==} + engines: {node: '>= 4'} + + domhandler@6.0.1: + resolution: {integrity: sha512-gYzvtM72ZtxQO0T048kd6HWSbbGCNOUwcnfQ01cqIJ4X2IYKFFHZ5mKvrQETcFXxsRObZulDaKmy//R7TPtsBg==} + engines: {node: '>=20.19.0'} + + domutils@3.2.2: + resolution: {integrity: sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw==} + + domutils@4.0.2: + resolution: {integrity: sha512-qI4JLRKnSzqFqr7hAlS5xQDusBCjKSEG4t4+7aNrIQMHBcsC2TGEhuyABJdYkgSewL57PNLYEiibY2iPKhKpaA==} + engines: {node: '>=20.19.0'} + dotenv@16.6.1: resolution: {integrity: sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==} engines: {node: '>=12'} @@ -3092,6 +3135,14 @@ packages: resolution: {integrity: sha512-FDWG5cmEYf2Z00IkYRhbFrwIwvdFKH07uV8dvNy0omp/Qb1xcyCWp2UDtcwJF4QZZvk0sLudP6/hAu42TaqVhQ==} engines: {node: '>=0.12'} + entities@7.0.1: + resolution: {integrity: sha512-TWrgLOFUQTH994YUyl1yT4uyavY5nNB5muff+RtWaqNVCAK408b5ZnnbNAUEWLTCpum9w6arT70i1XdQ4UeOPA==} + engines: {node: '>=0.12'} + + entities@8.0.0: + resolution: {integrity: sha512-zwfzJecQ/Uej6tusMqwAqU/6KL2XaB2VZ2Jg54Je6ahNBGNH6Ek6g3jjNCF0fG9EWQKGZNddNjU5F1ZQn/sBnA==} + engines: {node: '>=20.19.0'} + es-module-lexer@1.7.0: resolution: {integrity: sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==} @@ -3436,6 +3487,13 @@ packages: html-void-elements@3.0.0: resolution: {integrity: sha512-bEqo66MRXsUGxWHV5IP0PUiAWwoEjba4VCzg0LjFJBpchPaTfyfCKTG6bc5F8ucKec3q5y6qOdGyYTSBEvhCrg==} + htmlparser2@10.1.0: + resolution: {integrity: sha512-VTZkM9GWRAtEpveh7MSF6SjjrpNVNNVJfFup7xTY3UpFtm67foy9HDVXneLtFVt4pMz5kZtgNcvCniNFb1hlEQ==} + + htmlparser2@12.0.0: + resolution: {integrity: sha512-Tz7u1i95/g2x2jz81+x0FBVhBhY5aRTvD3tXXdFaljuNdzDLJ8UGNRrTcj2cgQvAg3iW/h77Fz15nLW0L0CrZw==} + engines: {node: '>=20.19.0'} + http-errors@2.0.1: resolution: {integrity: sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==} engines: {node: '>= 0.8'} @@ -3516,6 +3574,10 @@ packages: resolution: {integrity: sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==} engines: {node: '>=0.12.0'} + is-plain-object@5.0.0: + resolution: {integrity: sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q==} + engines: {node: '>=0.10.0'} + is-property@1.0.2: resolution: {integrity: sha512-Ks/IoX00TtClbGQr4TWXemAnktAQvYB7HzcCxDGqEZU6oCmb2INHuOoKxbtR+HFkmYWBKv/dOZtGRiAjDhj92g==} @@ -3563,6 +3625,9 @@ packages: keyv@4.5.4: resolution: {integrity: sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==} + launder@1.7.1: + resolution: {integrity: sha512-mU6WRz5EusL9ZZuiZ5SO4Y6C0P9PAUR9iwdb6bzj4KDihm28DiHFw+/yk9DBH4f+Pv1wuzQ4e2jV3oQ7mkIqvw==} + lazy@1.0.11: resolution: {integrity: sha512-Y+CjUfLmIpoUCCRl0ub4smrYtGGr5AOa2AKOaWelGHOGz33X/Y/KizefGqbkwfz44+cnq/+9habclf8vOmu2LA==} engines: {node: '>=0.2.0'} @@ -3767,8 +3832,8 @@ packages: resolution: {integrity: sha512-Tz09sEL2EEuv5fFowm419c1+a/jSMiBjI9gHxVLrVdbUkkNUUfjsVYs9pVZu5oCon/kmRh9TfLEObFtkVxmY0w==} engines: {node: '>=8.0.0'} - nanoid@3.3.11: - resolution: {integrity: sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==} + nanoid@3.3.16: + resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -3849,6 +3914,9 @@ packages: pako@0.2.9: resolution: {integrity: sha512-NUcwaKxUxWrZLpDG+z/xZaCgQITkA/Dv4V/T6bw7VON6l1Xz/VnrBqrYjZQ12TamKHzITTfOEIYUj48y2KXImA==} + parse-srcset@1.0.2: + resolution: {integrity: sha512-/2qh0lav6CmI15FzA3i/2Bzk2zCgQhGMkvhOhKNcBVQ1ldgpbfiNTVslmooUmWJcADi1f1kIeynbDRVzNlfR6Q==} + path-browserify@1.0.1: resolution: {integrity: sha512-b7uo2UCUOYZcnF/3ID0lulOJi/bafxa1xPe7ZPsammBSpjSWQkjNxlt635YGS2MiR9GjvuXCtz2emr3jbsz98g==} @@ -3992,8 +4060,8 @@ packages: postcss-value-parser@4.2.0: resolution: {integrity: sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==} - postcss@8.5.6: - resolution: {integrity: sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==} + postcss@8.5.19: + resolution: {integrity: sha512-Mz8SaolMd8nB+G13WkORcxQKHZ/NE4xXevtkJHVuG+guo9/wYKlIMTKAqGdEmYOXR2ijPjTYNHssizdaVSUNdQ==} engines: {node: ^10 || ^12 || >=14} postgres-array@2.0.0: @@ -4311,6 +4379,10 @@ packages: safer-buffer@2.1.2: resolution: {integrity: sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==} + sanitize-html@2.17.6: + resolution: {integrity: sha512-M4bo9tfv1yfhQZZKkc6dL07ALrGJtfvNOuhX3hU9AVPR/uPQ+nKOJBqTYc7LfMQblTW04mtSWDJWEyLvygJsLA==} + engines: {node: '>=22.12.0'} + sax@1.4.3: resolution: {integrity: sha512-yqYn1JhPczigF94DMS+shiDMjDowYO6y9+wB/4WgO0Y19jWYk0lQ4tuG5KI7kj4FTp1wxPj5IFfcrz/s1c3jjQ==} @@ -4824,7 +4896,7 @@ packages: hasBin: true peerDependencies: markdown-it-mathjax3: ^4 - postcss: ^8 + postcss: 8.5.19 peerDependenciesMeta: markdown-it-mathjax3: optional: true @@ -6440,6 +6512,10 @@ snapshots: dependencies: csstype: 3.2.3 + '@types/sanitize-html@2.16.1': + dependencies: + htmlparser2: 10.1.0 + '@types/unist@3.0.3': {} '@types/web-bluetooth@0.0.21': {} @@ -6627,7 +6703,7 @@ snapshots: '@vue/shared': 3.5.26 estree-walker: 2.0.2 magic-string: 0.30.21 - postcss: 8.5.6 + postcss: 8.5.19 source-map-js: 1.2.1 '@vue/compiler-ssr@3.5.26': @@ -6915,13 +6991,13 @@ snapshots: atomic-sleep@1.0.0: {} - autoprefixer@10.4.23(postcss@8.5.6): + autoprefixer@10.4.23(postcss@8.5.19): dependencies: browserslist: 4.28.1 caniuse-lite: 1.0.30001764 fraction.js: 5.3.4 picocolors: 1.1.1 - postcss: 8.5.6 + postcss: 8.5.19 postcss-value-parser: 4.2.0 avvio@9.1.0: @@ -7106,6 +7182,8 @@ snapshots: deepmerge-ts@7.1.5: {} + deepmerge@4.3.1: {} + defu@6.1.4: {} defu@6.1.7: {} @@ -7130,6 +7208,42 @@ snapshots: dependencies: dequal: 2.0.3 + dom-serializer@2.0.0: + dependencies: + domelementtype: 2.3.0 + domhandler: 5.0.3 + entities: 4.5.0 + + dom-serializer@3.1.1: + dependencies: + domelementtype: 3.0.0 + domhandler: 6.0.1 + entities: 8.0.0 + + domelementtype@2.3.0: {} + + domelementtype@3.0.0: {} + + domhandler@5.0.3: + dependencies: + domelementtype: 2.3.0 + + domhandler@6.0.1: + dependencies: + domelementtype: 3.0.0 + + domutils@3.2.2: + dependencies: + dom-serializer: 2.0.0 + domelementtype: 2.3.0 + domhandler: 5.0.3 + + domutils@4.0.2: + dependencies: + dom-serializer: 3.1.1 + domelementtype: 3.0.0 + domhandler: 6.0.1 + dotenv@16.6.1: {} dotenv@17.2.3: {} @@ -7164,6 +7278,10 @@ snapshots: entities@7.0.0: {} + entities@7.0.1: {} + + entities@8.0.0: {} + es-module-lexer@1.7.0: {} es-toolkit@1.43.0: {} @@ -7573,6 +7691,20 @@ snapshots: html-void-elements@3.0.0: {} + htmlparser2@10.1.0: + dependencies: + domelementtype: 2.3.0 + domhandler: 5.0.3 + domutils: 3.2.2 + entities: 7.0.1 + + htmlparser2@12.0.0: + dependencies: + domelementtype: 3.0.0 + domhandler: 6.0.1 + domutils: 4.0.2 + entities: 8.0.0 + http-errors@2.0.1: dependencies: depd: 2.0.0 @@ -7641,6 +7773,8 @@ snapshots: is-number@7.0.0: {} + is-plain-object@5.0.0: {} + is-property@1.0.2: {} is-what@5.5.0: {} @@ -7681,6 +7815,10 @@ snapshots: dependencies: json-buffer: 3.0.1 + launder@1.7.1: + dependencies: + dayjs: 1.11.19 + lazy@1.0.11: {} levn@0.4.1: @@ -7865,7 +8003,7 @@ snapshots: dependencies: lru.min: 1.1.3 - nanoid@3.3.11: {} + nanoid@3.3.16: {} natural-compare@1.4.0: {} @@ -7955,6 +8093,8 @@ snapshots: pako@0.2.9: {} + parse-srcset@1.0.2: {} + path-browserify@1.0.1: {} path-exists@4.0.0: {} @@ -8145,9 +8285,9 @@ snapshots: postcss-value-parser@4.2.0: {} - postcss@8.5.6: + postcss@8.5.19: dependencies: - nanoid: 3.3.11 + nanoid: 3.3.16 picocolors: 1.1.1 source-map-js: 1.2.1 @@ -8577,6 +8717,16 @@ snapshots: safer-buffer@2.1.2: {} + sanitize-html@2.17.6: + dependencies: + deepmerge: 4.3.1 + escape-string-regexp: 4.0.0 + htmlparser2: 12.0.0 + is-plain-object: 5.0.0 + launder: 1.7.1 + parse-srcset: 1.0.2 + postcss: 8.5.19 + sax@1.4.3: {} scheduler@0.27.0: {} @@ -8963,7 +9113,7 @@ snapshots: vite@5.4.21(@types/node@26.1.1)(lightningcss@1.30.2): dependencies: esbuild: 0.21.5 - postcss: 8.5.6 + postcss: 8.5.19 rollup: 4.55.1 optionalDependencies: '@types/node': 26.1.1 @@ -8975,7 +9125,7 @@ snapshots: esbuild: 0.27.2 fdir: 6.5.0(picomatch@4.0.3) picomatch: 4.0.3 - postcss: 8.5.6 + postcss: 8.5.19 rollup: 4.54.0 tinyglobby: 0.2.15 optionalDependencies: @@ -8990,7 +9140,7 @@ snapshots: esbuild: 0.27.2 fdir: 6.5.0(picomatch@4.0.5) picomatch: 4.0.5 - postcss: 8.5.6 + postcss: 8.5.19 rollup: 4.55.1 tinyglobby: 0.2.17 optionalDependencies: @@ -9000,7 +9150,7 @@ snapshots: lightningcss: 1.30.2 tsx: 4.21.0 - vitepress@1.6.4(@algolia/client-search@5.56.0)(@types/node@26.1.1)(lightningcss@1.30.2)(postcss@8.5.6)(search-insights@2.17.3)(typescript@6.0.2): + vitepress@1.6.4(@algolia/client-search@5.56.0)(@types/node@26.1.1)(lightningcss@1.30.2)(postcss@8.5.19)(search-insights@2.17.3)(typescript@6.0.2): dependencies: '@docsearch/css': 3.8.2 '@docsearch/js': 3.8.2(@algolia/client-search@5.56.0)(search-insights@2.17.3) @@ -9021,7 +9171,7 @@ snapshots: vite: 5.4.21(@types/node@26.1.1)(lightningcss@1.30.2) vue: 3.5.26(typescript@6.0.2) optionalDependencies: - postcss: 8.5.6 + postcss: 8.5.19 transitivePeerDependencies: - '@algolia/client-search' - '@types/node' diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 82420ef..2a23b14 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -4,6 +4,7 @@ packages: - tools/* overrides: + postcss: 8.5.19 typescript: 6.0.2 allowBuilds: