zenn-dev · cm-igarashi-ryosuke · Feb 6, 2024 · Feb 5, 2024 · Feb 5, 2024 · Feb 5, 2024
diff --git a/lerna.json b/lerna.json
@@ -2,6 +2,6 @@
   "packages": [
     "packages/*"
   ],
-  "version": "0.1.152",
+  "version": "0.1.153-alpha.0",
   "npmClient": "pnpm"
 }
diff --git a/packages/zenn-cli/package.json b/packages/zenn-cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "zenn-cli",
-  "version": "0.1.152",
+  "version": "0.1.153-alpha.0",
   "description": "Preview Zenn content locally.",
   "repository": {
     "type": "git",

diff --git a/packages/zenn-content-css/package.json b/packages/zenn-content-css/package.json
@@ -1,6 +1,6 @@
 {
   "name": "zenn-content-css",
-  "version": "0.1.152",
+  "version": "0.1.153-alpha.0",
   "license": "MIT",
   "description": "Zenn flavor content style.",
   "repository": {

diff --git a/packages/zenn-embed-elements/package.json b/packages/zenn-embed-elements/package.json
@@ -1,6 +1,6 @@
 {
   "name": "zenn-embed-elements",
-  "version": "0.1.152",
+  "version": "0.1.153-alpha.0",
   "license": "MIT",
   "description": "Web components for embedded contents.",
   "repository": {

diff --git a/packages/zenn-markdown-html/__tests__/matchers/isCodesandboxUrl.test.ts b/packages/zenn-markdown-html/__tests__/matchers/isCodesandboxUrl.test.ts
@@ -0,0 +1,20 @@
+import { describe, test, expect } from 'vitest';
+import { isCodesandboxUrl } from '../../src/utils/url-matcher';
+
+describe('isCodesandboxUrlのテスト', () => {
+  describe('Trueを返す場合', () => {
+    test('Codesandboxの埋め込みURL', () => {
+      const url =
+        'https://codesandbox.io/embed/new?view=Editor+%2B+Preview';
+
+      expect(isCodesandboxUrl(url)).toBe(true);
+    });
+  });
+
+  describe('Falseを返す場合', () => {
+    test('XSSを含んでいる', () => {
+      const url = `https://codesandbox.io/embed/new?view=Editor+%2B+Preview"></iframe><img src onerror=alert(document.domain)>/`;
+      expect(isCodesandboxUrl(url)).toBe(false);
+    });
+  });
+});
diff --git a/packages/zenn-markdown-html/package.json b/packages/zenn-markdown-html/package.json
@@ -1,6 +1,6 @@
 {
   "name": "zenn-markdown-html",
-  "version": "0.1.152",
+  "version": "0.1.153-alpha.0",
   "license": "MIT",
   "description": "Convert markdown to zenn flavor html.",
   "main": "lib/index.js",

diff --git a/packages/zenn-markdown-html/src/utils/url-matcher.ts b/packages/zenn-markdown-html/src/utils/url-matcher.ts
@@ -32,7 +32,7 @@ export function isStackblitzUrl(url: string): boolean {
 }
 
 export function isCodesandboxUrl(url: string): boolean {
-  return /^https:\/\/codesandbox\.io\/embed\/[a-zA-Z0-9\-_/.@?&=%,]+$/.test(
+  return /^https:\/\/codesandbox\.io\/embed\/[a-zA-Z0-9\-_/.@?&=%,+]+$/.test(
     url
   );
 }

diff --git a/packages/zenn-model/package.json b/packages/zenn-model/package.json
@@ -1,6 +1,6 @@
 {
   "name": "zenn-model",
-  "version": "0.1.152",
+  "version": "0.1.153-alpha.0",
   "license": "MIT",
   "description": "Model utils for Zenn contents",
   "main": "lib/index.js",
-Original file line number
+Diff line change
@@ Expand Up / @@ -32,7 +32,7 @@ export function isStackblitzUrl(url: string): boolean { @@
     }
     export function isCodesandboxUrl(url: string): boolean {
-      return /^https:\/\/codesandbox\.io\/embed\/[a-zA-Z0-9\-_/.@?&=%,]+$/.test(
+      return /^https:\/\/codesandbox\.io\/embed\/[a-zA-Z0-9\-_/.@?&=%,+]+$/.test(
         url
       );
     }
@@ Expand Down @@