Merge remote-tracking branch 'origin' into fix_url_for

.c8rc.json

@@ -0,0 +1,3 @@
+{
+  "all": "true"
+}

.github/dependabot.yml

@@ -3,4 +3,9 @@ updates:
 - package-ecosystem: npm
   directory: "/"
   schedule:
-    interval: daily
+    interval: monthly
+  ignore:
+    - dependency-name: "@types/node"
+    - dependency-name: "*"
+      update-types: ["version-update:semver-patch"]
+  open-pull-requests-limit: 3

.github/workflows/tester.yml

@@ -8,7 +8,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
-        node-version: ['12.x', '14.x']
+        node-version: ['14.x', '16.x', '18.x']
       fail-fast: false
     steps:
       - uses: actions/checkout@v2

SECURITY.md

@@ -0,0 +1,5 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+To report a security issue, please use the GitHub Security Advisory ["Report a Vulnerability"](https://github.com/hexojs/hexo-util/security/advisories/new) tab.

lib/escape_html.ts

@@ -1,6 +1,6 @@
-import unescapeHTML from './unescape_html';
-
-const htmlEntityMap = {
+const escapeTestNoEncode = /[<>"'`/=]|&(?!(#\d{1,7}|#[Xx][a-fA-F0-9]{1,6}|\w+);)/;
+const escapeReplaceNoEncode = new RegExp(escapeTestNoEncode.source, 'g');
+const escapeReplacements = {
   '&': '&amp;',
   '<': '&lt;',
   '>': '&gt;',
@@ -10,14 +10,16 @@ const htmlEntityMap = {
   '/': '&#x2F;',
   '=': '&#x3D;'
 };
+const getEscapeReplacement = (ch: string) => escapeReplacements[ch];
 
 function escapeHTML(str: string) {
   if (typeof str !== 'string') throw new TypeError('str must be a string!');
 
-  str = unescapeHTML(str);
-
-  // http://stackoverflow.com/a/12034334
-  return str.replace(/[&<>"'`/=]/g, a => htmlEntityMap[a]);
+  // https://github.com/markedjs/marked/blob/master/src/helpers.js
+  if (escapeTestNoEncode.test(str)) {
+    return str.replace(escapeReplaceNoEncode, getEscapeReplacement);
+  }
+  return str;
 }
 
 export = escapeHTML;

lib/html_tag.ts

@@ -1,7 +1,7 @@
 import encodeURL from './encode_url';
 import escapeHTML from './escape_html';
 const regexUrl = /(cite|download|href|src|url)$/i;
-const regexMeta = /^(og:|twitter:)(audio|image|url|video)(:secure_url)?$/i;
+const regexMeta = /^(og:|twitter:)(audio|image|url|video|player)(:secure_url)?$/i;
 
 function encSrcset(str: string) {
   str.split(' ')

lib/is_external_link.ts

@@ -10,7 +10,7 @@ const cache = new Cache<boolean>();
  * @returns {Boolean} True if the link doesn't have protocol or link has same host with config.url
  */
 
-function isExternalLink(input: string, sitehost: string, exclude: string[]): boolean {
+function isExternalLink(input: string, sitehost: string, exclude?: string | string[]): boolean {
   return cache.apply(`${input}-${sitehost}-${exclude}`, () => {
     // Return false early for internal link
     if (!/^(\/\/|http(s)?:)/.test(input)) return false;

package.json

@@ -1,6 +1,6 @@
 {
   "name": "hexo-util",
-  "version": "3.0.1",
+  "version": "3.1.0",
   "description": "Utilities for Hexo.",
   "main": "dist/index",
   "types": "./dist/index.d.ts",
@@ -12,7 +12,7 @@
     "eslint": "eslint lib test",
     "pretest": "npm run clean && npm run build",
     "test": "mocha --require ts-node/register",
-    "test-cov": "nyc --reporter=lcovonly npm run test",
+    "test-cov": "c8 --reporter=lcovonly npm run test",
     "build:highlight": "node scripts/build_highlight_alias.js",
     "postinstall": "npm run build:highlight"
   },
@@ -37,16 +37,14 @@
     "@types/cross-spawn": "^6.0.2",
     "@types/node": "^18.11.8",
     "@types/prismjs": "^1.26.0",
-    "@typescript-eslint/eslint-plugin": "^5.41.0",
-    "@typescript-eslint/parser": "^5.41.0",
+    "c8": "^8.0.1",
     "chai": "^4.3.6",
     "chai-as-promised": "^7.1.1",
     "eslint": "^8.23.0",
     "eslint-config-hexo": "^5.0.0",
     "html-entities": "^2.3.3",
     "html-tag-validator": "^1.6.0",
     "mocha": "^10.0.0",
-    "nyc": "^15.1.0",
     "rewire": "^6.0.0",
     "ts-node": "^10.9.1",
     "typescript": "^5.0.3"
@@ -56,7 +54,7 @@
     "cross-spawn": "^7.0.3",
     "deepmerge": "^4.2.2",
     "highlight.js": "^11.6.0",
-    "htmlparser2": "^8.0.1",
+    "htmlparser2": "^9.0.0",
     "prismjs": "^1.29.0",
     "strip-indent": "^3.0.0"
   },

test/color.spec.js

@@ -51,5 +51,53 @@ describe('color', () => {
     `${steelblue}`.should.eql('#4682b4');
     `${mid1}`.should.eql('rgba(70, 130, 180, 0.53)');
     `${mid2}`.should.eql('rgba(70, 130, 180, 0.77)');
+
+    // s=0
+    const grey = new Color('hsl(207, 0%, 49%)');
+    // h=0
+    const red1 = new Color('hsl(0, 100%, 50%)');
+    // h=360
+    const red2 = new Color('hsl(360, 100%, 50%)');
+
+    `${grey}`.should.eql('#7d7d7d');
+    `${red1}`.should.eql('#f00');
+    `${red2}`.should.eql('#f00');
+  });
+
+  it('invalid color', () => {
+    let color;
+    try {
+      color = new Color(200);
+    } catch (e) {
+      e.message.should.eql('color is required!');
+    }
+    try {
+      color = new Color('rgb(300, 130, 180)');
+    } catch (e) {
+      e.message.should.eql('{r: 300, g: 130, b: 180, a: 1} is invalid.');
+    }
+    try {
+      color = new Color('cmyk(0%,0%,0%,0%)');
+    } catch (e) {
+      e.message.should.eql('cmyk(0%,0%,0%,0%) is not a supported color format.');
+    }
+    (typeof color).should.eql('undefined');
   });
+
+  it('mix()', () => {
+    const red = new Color('red');
+    const pink = new Color('pink');
+    const mid1 = red.mix(pink, 0);
+    const mid2 = red.mix(pink, 1);
+
+    `${mid1}`.should.eql('#f00');
+    `${mid2}`.should.eql('#ffc0cb');
+
+    try {
+      red.mix(pink, 2);
+    } catch (e) {
+      e.message.should.eql('Valid numbers is only between 0 and 1.');
+    }
+  });
+
 });

test/decode_url.spec.js

@@ -84,4 +84,9 @@ describe('decodeURL', () => {
     const content = '#f%C3%B3o-b%C3%A1r';
     decodeURL(content).should.eql('#fóo-bár');
   });
+
+  it('data url', () => {
+    const content = 'data:image/png;base64';
+    decodeURL(content).should.eql('data:image/png;base64');
+  });
 });

test/escape_html.spec.js

@@ -16,4 +16,8 @@ describe('escapeHTML', () => {
   it('avoid double escape', () => {
     escapeHTML('&lt;foo>bar</foo&gt;').should.eql('&lt;foo&gt;bar&lt;&#x2F;foo&gt;');
   });
+
+  it('avoid double escape https://github.com/hexojs/hexo/issues/4946', () => {
+    escapeHTML('&emsp;&nbsp;&ensp;').should.eql('&emsp;&nbsp;&ensp;');
+  });
 });

test/is_external_link.spec.js

@@ -56,4 +56,11 @@ describe('isExternalLink', () => {
     isExternalLink('https://bar.com/', ctx.config.url, ctx.config.external_link.exclude).should.eql(false);
     isExternalLink('https://baz.com/', ctx.config.url, ctx.config.external_link.exclude).should.eql(true);
   });
+
+  it('invalid sitehost', () => {
+    ctx.config.url = '';
+    isExternalLink('https://localhost:4000', ctx.config.url).should.eql(false);
+    ctx.config.url = 'https://example.com';
+  });
+
 });

test/pattern.spec.js

@@ -59,10 +59,23 @@ describe('Pattern', () => {
     pattern.match('foo').should.eql({});
   });
 
+  it('Pattern', () => {
+    const pattern = new Pattern('posts/:id');
+    new Pattern(pattern).should.eql(pattern);
+  });
+
   it('rule is required', () => {
     (() => {
       // eslint-disable-next-line no-new
       new Pattern();
     }).should.throw('rule must be a function, a string or a regular expression.');
   });
+
+  it('test function', () => {
+    const pattern = new Pattern('posts/:id');
+
+    pattern.test('/posts/89').should.eql(true);
+    pattern.test('/post/89').should.eql(false);
+  });
+
 });

test/permalink.spec.js

@@ -19,6 +19,18 @@ describe('Permalink', () => {
     permalink.regex.should.eql(/^(.+?)_(.+?)_(.+?)_(.+?)$/);
     permalink.params.should.eql(['year', 'i_month', 'i_day', 'title']);
 
+    permalink = new Permalink(':year/:month/:day/:title', {
+      segments: {
+        year: '(\\d{4})',
+        month: '(\\d{2})',
+        day: '(\\d{2})'
+      }
+    });
+
+    permalink.rule.should.eql(':year/:month/:day/:title');
+    permalink.regex.should.eql(/^(\d{4})\/(\d{2})\/(\d{2})\/(.+?)$/);
+    permalink.params.should.eql(['year', 'month', 'day', 'title']);
+
     permalink = new Permalink(':year/:month/:day/:title', {
       segments: {
         year: /(\d{4})/,
@@ -53,6 +65,7 @@ describe('Permalink', () => {
       day: '31',
       title: 'test'
     });
+    (typeof permalink.parse('test')).should.eql('undefined');
   });
 
   it('stringify()', () => {

test/spawn.spec.js

@@ -115,4 +115,11 @@ describe('spawn', () => {
   });
 
   it('stdio = inherit', () => spawn('echo', ['something'], { stdio: 'inherit' }));
+
+  it('exit with code', () => {
+    if (isWindows) {
+      return spawn('cmd.exe', ['/c', 'exit', '1'], { stdio: 'inherit' }).should.rejectedWith('Spawn failed');
+    }
+    return spawn('sh', ['/c', 'exit', '1'], { stdio: 'inherit' }).should.rejectedWith('Spawn failed');
+  });
 });

test/strip_indent.spec.js

@@ -0,0 +1,11 @@
+'use strict';
+
+const stripIndent = require('../dist/strip_indent');
+
+describe('stripIndent', () => {
+  it('default', () => {
+    const text = '\tunicorn\n\t\tcake';
+
+    stripIndent(text).should.eql('unicorn\n\tcake');
+  });
+});