bd28dbfe2b
Adds an htmlEmbed block node that renders and executes raw HTML/CSS/JS in the wiki origin (e.g. an analytics tracker) — the owner-chosen variant C. Because this is stored-XSS by design, only workspace admins/owners may get such a node persisted; everyone executes it when reading. - Node (editor-ext): htmlEmbed atom/isolating block; source stored base64 in data-source for lossless HTML<->JSON round-trip. renderHTML emits only the encoded marker (never inlines raw markup), so generateHTML/export/search are not themselves injection vectors. Registered in BOTH client extensions and server tiptapExtensions. Markdown round-trip via an <!--html-embed:b64--> comment (turndown) + a marked rule. - Client NodeView: injects source and re-creates <script> elements so they actually run; edit modal; renders in read-only/share too. Slash item is admin-gated (adminOnly filtered by the user's workspace role). - SERVER ENFORCEMENT (the real control — UI gating alone is insufficient): stripHtmlEmbedNodes() removes htmlEmbed from any document persisted by a non-admin, applied at every write path that introduces content from an untrusted author: collab onStoreDocument, REST/MCP/AI updatePageContent, single-file import, zip/multi-file import, page duplication, and transclusion unsync. Page restore introduces no new content. Public share/readonly viewers render fetched (already-stripped) content and do NOT open a collab socket, so the only residual is a transient broadcast window to concurrent authenticated editors (documented). Implements docs/arbitrary-html-embed-plan.md (variant C). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
38 lines
1.2 KiB
TypeScript
38 lines
1.2 KiB
TypeScript
export * from "./lib/trailing-node";
|
|
export * from "./lib/comment/comment";
|
|
export * from "./lib/utils";
|
|
export * from "./lib/math";
|
|
export * from "./lib/details";
|
|
export * from "./lib/table";
|
|
export * from "./lib/image";
|
|
export * from "./lib/video";
|
|
export * from "./lib/callout";
|
|
export * from "./lib/media-utils";
|
|
export * from "./lib/link";
|
|
export * from "./lib/selection";
|
|
export * from "./lib/attachment";
|
|
export * from "./lib/audio";
|
|
export * from "./lib/custom-code-block";
|
|
export * from "./lib/drawio";
|
|
export * from "./lib/excalidraw";
|
|
export * from "./lib/embed";
|
|
export * from "./lib/html-embed/html-embed";
|
|
export * from "./lib/mention";
|
|
export * from "./lib/markdown";
|
|
export * from "./lib/search-and-replace";
|
|
export * from "./lib/embed-provider";
|
|
export * from "./lib/subpages";
|
|
export * from "./lib/transclusion";
|
|
export * from "./lib/highlight";
|
|
export * from "./lib/indent";
|
|
export * from "./lib/heading/heading";
|
|
export * from "./lib/unique-id";
|
|
export * from "./lib/shared-storage";
|
|
export * from "./lib/recreate-transform";
|
|
export * from "./lib/columns";
|
|
export * from "./lib/status";
|
|
export * from "./lib/pdf";
|
|
export * from "./lib/page-break";
|
|
export * from "./lib/resizable-nodeview";
|
|
|