/** * @bfra.me/doc-sync/utils/safe-patterns - Safe regex patterns and utilities for MDX/HTML parsing * All patterns are designed to prevent ReDoS attacks */ /** * Create safe heading pattern for specific level * Uses explicit character class instead of greedy `.+` to prevent ReDoS * * @param level - Heading level (1-6) * @returns Safe regex pattern for the heading level * * @example * ```ts * const h2Pattern = createHeadingPattern(2) * const matches = content.match(h2Pattern) * ``` */ declare function createHeadingPattern(level: number): RegExp; /** * Check if content contains a specific JSX component * Uses a safe pattern that avoids catastrophic backtracking * * @param content - The MDX/HTML content to search * @param componentName - Name of the component to find (e.g., 'Card', 'Badge') * @returns True if the component is found * * @example * ```ts * const hasCard = hasComponent(content, 'Card') * const hasCardGrid = hasComponent(content, 'CardGrid') * ``` */ declare function hasComponent(content: string, componentName: string): boolean; /** * Extract code blocks and inline code from markdown content using unified/remark (safe, no regex) * This approach uses AST parsing instead of regex to avoid ReDoS vulnerabilities * * @param content - The markdown content to parse * @returns Array of code block strings (fenced blocks with backticks, inline code with backticks) * * @example * ```ts * const blocks = extractCodeBlocks(content) * for (const block of blocks) { * console.log(block) * } * ``` */ declare function extractCodeBlocks(content: string): readonly string[]; /** * Parse JSX tags from content using a safe, non-backtracking approach. * Uses a state machine instead of regex to prevent ReDoS. * * @param content - The MDX/HTML content to parse * @returns Array of matched JSX tags with their positions */ declare function parseJSXTags(content: string): readonly { tag: string; index: number; isClosing: boolean; isSelfClosing: boolean; }[]; /** * Find empty markdown links in content using safe parsing. * Uses indexOf-based scanning instead of regex to prevent ReDoS. * * @param content - The markdown content to check * @returns Array of positions where empty links were found */ declare function findEmptyMarkdownLinks(content: string): readonly number[]; /** * @bfra.me/doc-sync/utils/sanitization - Sanitization utilities for MDX content * Provides comprehensive XSS prevention for user-generated content */ /** * Sanitize HTML content for MDX context * Escapes all HTML entities and JSX curly braces to prevent XSS * * @param content - The content to sanitize * @returns Sanitized content safe for MDX rendering * * @example * ```ts * const safe = sanitizeForMDX('') * // Returns: '<script>alert("xss")</script>' * ``` */ declare function sanitizeForMDX(content: string): string; /** * Sanitize value for use in HTML/JSX attribute * Uses escape-html library for proper attribute encoding * * @param value - The attribute value to sanitize * @returns Sanitized value safe for attribute context * * @example * ```ts * const safe = sanitizeAttribute('value" onload="alert(1)') * // Returns: 'value" onload="alert(1)' * ``` */ declare function sanitizeAttribute(value: string): string; /** * JSX attribute parsed from a tag */ interface JSXAttribute { readonly name: string; readonly value: string | null; } /** * Parse JSX tag attributes safely without using complex regex * Uses a simple state machine approach to avoid ReDoS vulnerabilities * * @param tag - The complete JSX tag string (e.g., '') * @returns Array of parsed attributes * * @example * ```ts * const attrs = parseJSXAttributes('') * // Returns: [{name: 'title', value: 'Hello'}, {name: 'icon', value: 'star'}] * ``` */ declare function parseJSXAttributes(tag: string): readonly JSXAttribute[]; /** * Sanitize a complete JSX tag including all attributes * Parses the tag and escapes all attribute values to prevent XSS * * @param tag - The complete JSX tag string * @returns Sanitized JSX tag safe for rendering * * @example * ```ts * const safe = sanitizeJSXTag('') * // Returns: '' (with escaped values) * ``` */ declare function sanitizeJSXTag(tag: string): string; export { createHeadingPattern, extractCodeBlocks, findEmptyMarkdownLinks, hasComponent, parseJSXAttributes, parseJSXTags, sanitizeAttribute, sanitizeForMDX, sanitizeJSXTag };