Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 0d1558a

Browse files
wooormwooorm
committed
esbuild: remove allowDangerousRemoteMdx option
1 parent e12f307 commit 0d1558a

File tree

10 files changed

+8
-299
lines changed

10 files changed

+8
-299
lines changed

‎docs/docs/getting-started.mdx‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -237,7 +237,6 @@ long.
237237

238238
We support [esbuild](https://esbuild.github.io).
239239
Install and configure the esbuild plugin [`@mdx-js/esbuild`][mdx-esbuild].
240-
This plugin has an additional option `allowDangerousRemoteMdx`.
241240
[Configure your JSX runtime][jsx] depending on which one you use (React, Preact,
242241
Vue, etc.).
243242

‎package-lock.json‎

Lines changed: 0 additions & 20 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/esbuild/lib/index.js‎

Lines changed: 6 additions & 114 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/**
2-
* @typedef {import('@mdx-js/mdx').ProcessorOptions} ProcessorOptions
2+
* @typedef {import('@mdx-js/mdx').CompileOptions} CompileOptions
33
* @typedef {import('esbuild').Message} Message
44
* @typedef {import('esbuild').OnLoadArgs} OnLoadArgs
55
* @typedef {import('esbuild').OnLoadResult} OnLoadResult
@@ -10,15 +10,6 @@
1010
*/
1111

1212
/**
13-
* @typedef EsbuildOptions
14-
* Extra options.
15-
* @property {boolean | null | undefined} [allowDangerousRemoteMdx=false]
16-
* Whether to allow importing from `http:` and `https:` URLs (`boolean`,
17-
* default: `false`).
18-
*
19-
* When passing `allowDangerousRemoteMdx`, MD(X) *and* JS files can be
20-
* imported from `http:` and `https:` urls.
21-
*
2213
* @typedef {Omit<OnLoadArgs, 'pluginData'> & LoadDataFields} LoadData
2314
* Data passed to `onload`.
2415
*
@@ -27,22 +18,10 @@
2718
* @property {PluginData | null | undefined} [pluginData]
2819
* Plugin data.
2920
*
30-
* @typedef {EsbuildOptions & ProcessorOptions} Options
21+
* @typedef {CompileOptions} Options
3122
* Configuration.
3223
*
33-
* Options are the same as `compile` from `@mdx-js/mdx` with the addition
34-
* of `allowDangerousRemoteMdx`.
35-
*
36-
* ###### Notes
37-
*
38-
* > ⚠️ **Security**: `allowDangerousRemoteMdx` (intentionally) enabled remote
39-
* > code execution.
40-
* > Make sure you trust your code!
41-
* > See [§ Security][security] for more
42-
* > info.
43-
*
44-
* > 💡 **Experiment**: `allowDangerousRemoteMdx` is an experimental feature
45-
* > that might not work well and might change in minor releases.
24+
* Options are the same as `compile` from `@mdx-js/mdx`.
4625
*
4726
* @typedef PluginData
4827
* Extra data passed.
@@ -62,20 +41,14 @@
6241
import assert from 'node:assert'
6342
import fs from 'node:fs/promises'
6443
import path from 'node:path'
65-
import process from 'node:process'
6644
import {createFormatAwareProcessors} from '@mdx-js/mdx/internal-create-format-aware-processors'
6745
import {extnamesToRegex} from '@mdx-js/mdx/internal-extnames-to-regex'
68-
import {fetch} from 'undici'
6946
import {VFile} from 'vfile'
7047
import {VFileMessage} from 'vfile-message'
7148

7249
const eol = /\r\n|\r|\n|\u2028|\u2029/g
7350

74-
/** @type {Map<string, string>} */
75-
const cache = new Map()
7651
const name = '@mdx-js/esbuild'
77-
const p = process
78-
const remoteNamespace = name + '-remote'
7952

8053
/**
8154
* Create an esbuild plugin to compile MDX to JS.
@@ -92,8 +65,7 @@ const remoteNamespace = name + '-remote'
9265
* Plugin.
9366
*/
9467
export function esbuild(options) {
95-
const {allowDangerousRemoteMdx, ...rest} = options || {}
96-
const {extnames, process} = createFormatAwareProcessors(rest)
68+
const {extnames, process} = createFormatAwareProcessors(options || {})
9769

9870
return {name, setup}
9971

@@ -104,85 +76,7 @@ export function esbuild(options) {
10476
* Nothing.
10577
*/
10678
function setup(build) {
107-
const filter = extnamesToRegex(extnames)
108-
const filterHttp = new RegExp('^https?:\\/{2}.+' + filter.source)
109-
const http = /^https?:\/{2}/
110-
const filterHttpOrRelative = /^(https?:\/{2}|.{1,2}\/).*/
111-
112-
if (allowDangerousRemoteMdx) {
113-
// Intercept import paths starting with "http:" and "https:" so
114-
// esbuild doesn't attempt to map them to a file system location.
115-
// Tag them with the "http-url" namespace to associate them with
116-
// this plugin.
117-
build.onResolve(
118-
{filter: filterHttp, namespace: 'file'},
119-
resolveRemoteInLocal
120-
)
121-
122-
build.onResolve(
123-
{filter: filterHttpOrRelative, namespace: remoteNamespace},
124-
resolveInRemote
125-
)
126-
}
127-
128-
build.onLoad({filter: /.*/, namespace: remoteNamespace}, onloadremote)
129-
build.onLoad({filter}, onload)
130-
131-
/** @param {OnResolveArgs} args */
132-
function resolveRemoteInLocal(args) {
133-
return {namespace: remoteNamespace, path: args.path}
134-
}
135-
136-
// Intercept all import paths inside downloaded files and resolve them against
137-
// the original URL. All of these
138-
// files will be in the "http-url" namespace. Make sure to keep
139-
// the newly resolved URL in the "http-url" namespace so imports
140-
// inside it will also be resolved as URLs recursively.
141-
/** @param {OnResolveArgs} args */
142-
function resolveInRemote(args) {
143-
return {
144-
namespace: remoteNamespace,
145-
path: String(new URL(args.path, args.importer))
146-
}
147-
}
148-
149-
/**
150-
* @param {OnLoadArgs} data
151-
* Data.
152-
* @returns {Promise<OnLoadResult>}
153-
* Result.
154-
*/
155-
async function onloadremote(data) {
156-
const href = data.path
157-
console.log('%s: downloading `%s`', remoteNamespace, href)
158-
159-
/** @type {string} */
160-
let contents
161-
162-
const cachedContents = cache.get(href)
163-
if (cachedContents) {
164-
contents = cachedContents
165-
} else {
166-
const response = await fetch(href)
167-
contents = await response.text()
168-
cache.set(href, contents)
169-
}
170-
171-
if (filter.test(href)) {
172-
// Clean search and hash from URL.
173-
const url = new URL(href)
174-
url.hash = ''
175-
url.search = ''
176-
return onload({
177-
namespace: 'file',
178-
path: url.href,
179-
pluginData: {contents},
180-
suffix: ''
181-
})
182-
}
183-
184-
return {contents, loader: 'js', resolveDir: p.cwd()}
185-
}
79+
build.onLoad({filter: extnamesToRegex(extnames)}, onload)
18680

18781
/**
18882
* @param {LoadData} data
@@ -240,9 +134,7 @@ export function esbuild(options) {
240134
return {
241135
contents: value || '',
242136
errors,
243-
resolveDir: http.test(file.path)
244-
? p.cwd()
245-
: path.resolve(file.cwd, file.dirname),
137+
resolveDir: path.resolve(file.cwd, file.dirname),
246138
warnings
247139
}
248140
}

‎packages/esbuild/package.json‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,6 @@
3939
"dependencies": {
4040
"@mdx-js/mdx": "^2.0.0",
4141
"@types/unist": "^3.0.0",
42-
"undici": "^5.0.0",
4342
"vfile": "^6.0.0",
4443
"vfile-message": "^4.0.0"
4544
},

‎packages/esbuild/readme.md‎

Lines changed: 1 addition & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -97,64 +97,7 @@ ESBuild plugin ([`Plugin`][esbuild-plugin] from `esbuild`).
9797

9898
Configuration (TypeScript type).
9999

100-
Options are the same as [`CompileOptions` from `@mdx-js/mdx`][compile-options]
101-
with the addition of `allowDangerousRemoteMdx`:
102-
103-
###### Fields
104-
105-
* `allowDangerousRemoteMdx` (`boolean`, default: `false`)
106-
— whether to allow importing from `http:` and `https:` URLs;
107-
when passing `allowDangerousRemoteMdx`, MD(X) *and* JS files can be imported
108-
from `http:` and `https:` urls;
109-
110-
###### Notes
111-
112-
> ⚠️ **Security**: `allowDangerousRemoteMdx` (intentionally) enabled remote
113-
> code execution.
114-
> Make sure you trust your code!
115-
> See [§ Security][security] for more
116-
> info.
117-
118-
> 💡 **Experiment**: `allowDangerousRemoteMdx` is an experimental feature that
119-
> might not work well and might change in minor releases.
120-
121-
## Examples
122-
123-
### Use `allowDangerousRemoteMdx`
124-
125-
Take this `index.mdx` file:
126-
127-
```mdx
128-
import Readme from 'https://raw.githubusercontent.com/mdx-js/mdx/main/readme.md'
129-
130-
Here’s the readme:
131-
132-
<Readme />
133-
```
134-
135-
…and a module `build.js`:
136-
137-
```tsx
138-
import mdx from '@mdx-js/esbuild'
139-
import esbuild from 'esbuild'
140-
141-
await esbuild.build({
142-
entryPoints: ['index.mdx'],
143-
format: 'esm',
144-
outfile: 'output.js',
145-
plugins: [mdx({allowDangerousRemoteMdx: true, /* Other options… */})]
146-
})
147-
```
148-
149-
…then running that (`node build.js`) and evaluating `output.js` (depends on how
150-
you evaluate React or another framework) would give:
151-
152-
```tsx
153-
<p>Here’s the readme:</p>
154-
<h1>MDX: Markdown for the component era 🚀</h1>
155-
{/* … */}
156-
<p><a href="https://github.com/mdx-js/mdx/blob/main/license">MIT</a> © …</p>
157-
```
100+
Options are the same as [`CompileOptions` from `@mdx-js/mdx`][compile-options].
158101

159102
## Types
160103

‎packages/esbuild/test/files/components.js‎

Lines changed: 0 additions & 23 deletions
This file was deleted.

‎packages/esbuild/test/files/md-file.md‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎packages/esbuild/test/files/mdx-file-importing-markdown.mdx‎

Lines changed: 0 additions & 8 deletions
This file was deleted.

0 commit comments

Comments
 (0)