(html: string)
| 836 | } |
| 837 | |
| 838 | export function validateCompositionHtml(html: string): ValidationResult { |
| 839 | const errors: string[] = []; |
| 840 | const warnings: string[] = []; |
| 841 | |
| 842 | const parser = new DOMParser(); |
| 843 | const doc = parser.parseFromString(html, "text/html"); |
| 844 | const htmlEl = doc.documentElement; |
| 845 | |
| 846 | if (!htmlEl) { |
| 847 | return { |
| 848 | valid: false, |
| 849 | errors: ["Composition HTML is empty or could not be parsed"], |
| 850 | warnings: [], |
| 851 | }; |
| 852 | } |
| 853 | |
| 854 | const compositionId = htmlEl.getAttribute("data-composition-id"); |
| 855 | if (!compositionId) { |
| 856 | errors.push("Missing data-composition-id attribute on <html> element"); |
| 857 | } |
| 858 | |
| 859 | const durationStr = htmlEl.getAttribute("data-composition-duration"); |
| 860 | if (!durationStr) { |
| 861 | errors.push("Missing data-composition-duration attribute on <html> element"); |
| 862 | } else { |
| 863 | const duration = parseFloat(durationStr); |
| 864 | if (!isFinite(duration) || duration <= 0) { |
| 865 | errors.push("data-composition-duration must be a positive finite number"); |
| 866 | } |
| 867 | } |
| 868 | |
| 869 | const stage = doc.getElementById("stage"); |
| 870 | if (!stage) { |
| 871 | errors.push("Missing #stage element"); |
| 872 | } |
| 873 | |
| 874 | if (/\son\w+\s*=/i.test(html)) { |
| 875 | errors.push("Inline event handlers (onclick, onload, etc.) not allowed"); |
| 876 | } |
| 877 | |
| 878 | if (/javascript\s*:/i.test(html)) { |
| 879 | errors.push("javascript: URLs not allowed"); |
| 880 | } |
| 881 | |
| 882 | const scripts = doc.querySelectorAll("script"); |
| 883 | if (scripts.length > 2) { |
| 884 | warnings.push("Multiple script tags detected - only GSAP CDN and main script expected"); |
| 885 | } |
| 886 | |
| 887 | const gsapScript = extractGsapScript(doc); |
| 888 | if (gsapScript) { |
| 889 | const gsapValidation = validateCompositionGsap(gsapScript); |
| 890 | errors.push(...gsapValidation.errors); |
| 891 | warnings.push(...gsapValidation.warnings); |
| 892 | } |
| 893 | |
| 894 | return { |
| 895 | valid: errors.length === 0, |
no test coverage detected