mirror of
https://github.com/multica-ai/multica.git
synced 2026-07-11 10:17:12 +02:00
6c5879215d
* fix: sanitize markdown rendering in comments and shared renderers Add rehype-sanitize to both ReadonlyContent and Markdown components so that raw HTML parsed by rehype-raw is sanitized against a strict allowlist before reaching the DOM. On the backend, add a bluemonday sanitization pass when creating and updating comments to strip dangerous tags as defense-in-depth. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add mention:// protocol to sanitize allowlist and validate file card URLs - Add mention:// to rehype-sanitize protocols.href in both ReadonlyContent and Markdown so @mention links survive sanitization - Validate data-href on file cards to only allow http(s) URLs, blocking javascript: and data: schemes in both frontend click handler and backend bluemonday policy - Narrow class attribute allowlist to specific elements (code, div, span, pre) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
60 lines
1.6 KiB
JSON
60 lines
1.6 KiB
JSON
{
|
|
"name": "@multica/ui",
|
|
"version": "0.0.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"typecheck": "tsc --noEmit",
|
|
"lint": "eslint ."
|
|
},
|
|
"exports": {
|
|
"./components/ui/*": "./components/ui/*.tsx",
|
|
"./components/common/*": "./components/common/*.tsx",
|
|
"./markdown": "./markdown/index.ts",
|
|
"./markdown/*": "./markdown/*.tsx",
|
|
"./markdown/linkify": "./markdown/linkify.ts",
|
|
"./markdown/mentions": "./markdown/mentions.ts",
|
|
"./hooks/*": "./hooks/*.ts",
|
|
"./lib/utils": "./lib/utils.ts",
|
|
"./styles/tokens.css": "./styles/tokens.css",
|
|
"./styles/base.css": "./styles/base.css"
|
|
},
|
|
"dependencies": {
|
|
"@base-ui/react": "^1.3.0",
|
|
"@emoji-mart/data": "^1.2.1",
|
|
"class-variance-authority": "catalog:",
|
|
"clsx": "catalog:",
|
|
"cmdk": "^1.1.1",
|
|
"date-fns": "^4.1.0",
|
|
"embla-carousel-react": "^8.6.0",
|
|
"emoji-mart": "^5.6.0",
|
|
"input-otp": "^1.4.2",
|
|
"linkify-it": "^5.0.0",
|
|
"lucide-react": "catalog:",
|
|
"next-themes": "^0.4.6",
|
|
"react-day-picker": "^9.14.0",
|
|
"react-markdown": "^10.1.0",
|
|
"react-resizable-panels": "^4.7.5",
|
|
"recharts": "3.8.0",
|
|
"rehype-raw": "^7.0.0",
|
|
"remark-gfm": "^4.0.1",
|
|
"shiki": "^3.21.0",
|
|
"sonner": "^2.0.7",
|
|
"tailwind-merge": "catalog:",
|
|
"tw-animate-css": "^1.4.0",
|
|
"vaul": "^1.1.2"
|
|
},
|
|
"peerDependencies": {
|
|
"react": "catalog:",
|
|
"react-dom": "catalog:"
|
|
},
|
|
"devDependencies": {
|
|
"@multica/tsconfig": "workspace:*",
|
|
"@types/linkify-it": "^5.0.0",
|
|
"@types/react": "catalog:",
|
|
"@types/react-dom": "catalog:",
|
|
"rehype-sanitize": "^6.0.0",
|
|
"typescript": "catalog:"
|
|
}
|
|
}
|