mirror of
https://github.com/hanzoai/gui.git
synced 2026-10-25 02:31:41 +00:00
zeekayandHanzo Dev
69c6e860d7
This repo could never sync. There was NO merge-base with tamagui — 372 commits
here against 15,791 there, unrelated histories — because it began as a
copy-paste rebrand with a flattened layout. Every "sync" since was a hand
re-application that drifted, which is why the tree sat on 7.3.1 while upstream
shipped fixes we then rediscovered by hand.
This commit's PARENT IS TAMAGUI. A future sync is `git merge tama/main` then
`node scripts/rebrand.mjs` — a real merge, because the history is now shared.
174 packages: 166 upstream, our 8 restored (chrome, shell, telemetry, recipes,
get, font-geist-{sans,mono}, @hanzo/booker), bento-get gained. 170/170 build.
Our patches to files UPSTREAM ALSO OWNS are carried, which the package-level
delta missed and which was where the value actually was:
- useMedia's server snapshot (`initState ?? getMedia()`). Upstream still
returns undefined there, so every Tamagui Dialog kills a prerender — the
exact crash hanzo.app spent a day on.
- data-slot on web host nodes, absent upstream entirely.
Both applied ONTO upstream's newer files (it rewrote useMedia +150/-63 and
createComponent +160/-55), marked `PATCH (ours, carried across the transplant)`.
Seven traps are encoded in scripts/rebrand.mjs, each found by a gate:
skip itself and lockfiles; special-case the double-branded names in BOTH scoped
and bare form; map path strings, not just paths; drop a level for the flattened
group; check disk rather than a stale index.
Rust build artifacts are NOT committed. An earlier draft of this commit swept
apps/desktop/src-tauri/target/debug in via `git add -A` — 3,859 files including
a 272MB .a, over GitHub's 100MB cap, so the push could never have landed. They
are gitignored now.
Co-Authored-By: Hanzo Dev <[email protected]>
101 lines
2.5 KiB
TypeScript
101 lines
2.5 KiB
TypeScript
import { Fragment, createElement, type ReactNode } from 'react'
|
|
import parse from 'rehype-parse'
|
|
import { unified } from 'unified'
|
|
|
|
const ALLOWED_TAGS = new Set(['span', 'div', 'br'])
|
|
const SAFE_CLASS_NAME = /^[A-Za-z0-9_-]+$/
|
|
const SAFE_DATA_VALUE = /^[A-Za-z0-9_.:;,+\- ]{0,160}$/
|
|
|
|
export function renderSafeHtml(html: string) {
|
|
const tree = unified().use(parse, { emitParseErrors: true, fragment: true }).parse(html)
|
|
|
|
return renderSafeHastNodes(tree.children as any[])
|
|
}
|
|
|
|
export function renderSafeHastNodes(nodes: any[] = [], keyPrefix = 'safe-html') {
|
|
return nodes.map((node, index) => renderSafeHastNode(node, `${keyPrefix}-${index}`))
|
|
}
|
|
|
|
function renderSafeHastNode(node: any, key: string): ReactNode {
|
|
if (!node) {
|
|
return null
|
|
}
|
|
|
|
if (node.type === 'text') {
|
|
return node.value
|
|
}
|
|
|
|
if (node.type !== 'element') {
|
|
return null
|
|
}
|
|
|
|
const children = renderSafeHastNodes(node.children, key)
|
|
const tagName = String(node.tagName || '').toLowerCase()
|
|
|
|
if (!ALLOWED_TAGS.has(tagName)) {
|
|
return <Fragment key={key}>{children}</Fragment>
|
|
}
|
|
|
|
if (tagName === 'br') {
|
|
return createElement('br', { key })
|
|
}
|
|
|
|
return createElement(tagName, getSafeProps(node.properties, key), children)
|
|
}
|
|
|
|
function getSafeProps(properties: Record<string, unknown> = {}, key: string) {
|
|
const props: Record<string, unknown> = { key }
|
|
const className = getSafeClassName(properties.className)
|
|
|
|
if (className) {
|
|
props.className = className
|
|
}
|
|
|
|
for (const [name, value] of Object.entries(properties)) {
|
|
const dataName = getDataAttributeName(name)
|
|
|
|
if (dataName && isSafeDataValue(value)) {
|
|
props[dataName] = String(value)
|
|
}
|
|
}
|
|
|
|
return props
|
|
}
|
|
|
|
function getSafeClassName(value: unknown) {
|
|
const classes = Array.isArray(value)
|
|
? value
|
|
: typeof value === 'string'
|
|
? value.split(' ')
|
|
: []
|
|
const safeClasses = classes
|
|
.map((className) => String(className).trim())
|
|
.filter((className) => SAFE_CLASS_NAME.test(className))
|
|
|
|
return safeClasses.length ? safeClasses.join(' ') : undefined
|
|
}
|
|
|
|
function getDataAttributeName(name: string) {
|
|
if (name.startsWith('data-')) {
|
|
return name
|
|
}
|
|
|
|
if (!/^data[A-Z]/.test(name)) {
|
|
return null
|
|
}
|
|
|
|
return name.replace(/[A-Z]/g, (char) => `-${char.toLowerCase()}`)
|
|
}
|
|
|
|
function isSafeDataValue(value: unknown) {
|
|
if (
|
|
typeof value !== 'string' &&
|
|
typeof value !== 'number' &&
|
|
typeof value !== 'boolean'
|
|
) {
|
|
return false
|
|
}
|
|
|
|
return SAFE_DATA_VALUE.test(String(value))
|
|
}
|