THEME=$(sed -n 's/^theme:[[:space:]]*//p' _config.yml | tr -d "\"'")
grep -rnE "toc\(|\.origin|encrypt|tocbot|hexo-blog-decrypt|hbe|password" \
  "themes/$THEME" "node_modules/hexo-theme-$THEME" 2>/dev/null \
  | grep -v -E "/(node_modules|source/lib|vendor)/" | head -80

<div id="toc" class="toc-article">
  <% if (!page.encrypt) { %><%- toc(page.content, {class: 'toc'}) %><% } %>
</div>

<script>
  window.addEventListener('hexo-blog-decrypt', function () {
    var el = document.getElementById('hexo-blog-encrypt');
    if (el) el.classList.add('markdown-body'); // match the theme's contentSelector
    if (window.tocbot) tocbot.refresh();
  });
</script>

<script>
  window.HBE_TOC = {
    container: '#toc',     // the empty container from step 2
    className: 'toc',      // the class the theme passed to toc()
    onRender: function () { /* call the theme's scrollspy init here */ }
  };
</script>
<script src="/js/hbe-toc.js"></script>

hexo clean && hexo generate
# Write Appendix B to a temporary file first, e.g. /tmp/check-toc-leak.js
node /tmp/check-toc-leak.js --source source/_posts --public public

/* hbe-toc.js: theme-agnostic table of contents for hexo-blog-encrypt posts.
 *
 * Builds the TOC in the browser from the decrypted post, so the published
 * HTML never contains the encrypted post's headings. Markup matches Hexo's
 * `toc()` helper (`ol.<cls> > li.<cls>-item.<cls>-level-N > a.<cls>-link >
 * span.<cls>-text`, nested `ol.<cls>-child`), so most theme CSS and scrollspy
 * code works unchanged.
 *
 * Configure before this script loads (all optional):
 *   window.HBE_TOC = {
 *     container: '#toc',          // element that receives the TOC
 *     className: 'toc',           // Hexo toc() `class` option ('nav' for NexT, Keep, Redefine)
 *     maxDepth: 6,                // deepest heading level to include
 *     listNumber: false,          // add <span class="<cls>-number"> like toc({list_number: true})
 *     onRender: function (container, decrypted) {}, // re-run the theme's scrollspy here
 *   };
 */
(function () {
  'use strict';
 
  var opts = window.HBE_TOC || {};
  var cls = opts.className || 'toc';
  var maxDepth = opts.maxDepth || 6;
 
  function slug(text, used) {
    var base = text.trim().toLowerCase().replace(/[\s]+/g, '-').replace(/[^\p{L}\p{N}_-]/gu, '') || 'section';
    var id = base;
    for (var i = 1; used[id] || document.getElementById(id); i++) id = base + '-' + i;
    used[id] = true;
    return id;
  }
 
  function headings(root) {
    var selector = [];
    for (var level = 1; level <= maxDepth; level++) selector.push('h' + level);
    return Array.prototype.filter.call(root.querySelectorAll(selector.join(',')), function (h) {
      return h.textContent.trim() !== '';
    });
  }
 
  function build(root) {
    var used = {};
    var list = document.createElement('ol');
    list.className = cls;
    // stack[i] = { level, item } for the open ancestors of the next heading.
    var stack = [];
    var counters = [];
 
    headings(root).forEach(function (h) {
      var level = Number(h.tagName.charAt(1));
      if (!h.id) h.id = slug(h.textContent, used);
 
      while (stack.length && stack[stack.length - 1].level >= level) stack.pop();
      counters.length = stack.length + 1;
      counters[stack.length] = (counters[stack.length] || 0) + 1;
 
      var parentList = list;
      if (stack.length) {
        var parent = stack[stack.length - 1].item;
        parentList = parent.querySelector(':scope > ol.' + cls + '-child');
        if (!parentList) {
          parentList = document.createElement('ol');
          parentList.className = cls + '-child';
          parent.appendChild(parentList);
        }
      }
 
      var item = document.createElement('li');
      item.className = cls + '-item ' + cls + '-level-' + level;
      var link = document.createElement('a');
      link.className = cls + '-link';
      link.setAttribute('href', '#' + encodeURIComponent(h.id));
      if (opts.listNumber) {
        var number = document.createElement('span');
        number.className = cls + '-number';
        number.textContent = counters.join('.') + '.';
        link.appendChild(number);
        link.appendChild(document.createTextNode(' '));
      }
      var text = document.createElement('span');
      text.className = cls + '-text';
      // textContent, never innerHTML: headings are author content, not markup we trust.
      text.textContent = h.textContent.trim();
      link.appendChild(text);
      item.appendChild(link);
      parentList.appendChild(item);
      stack.push({ level: level, item: item });
    });
    return list;
  }
 
  function render() {
    var decrypted = document.querySelector('#hexo-blog-encrypt.hbe-decrypted-content');
    var container = document.querySelector(opts.container || '#toc');
    if (!decrypted || !container) return;
    var list = build(decrypted);
    container.textContent = '';
    if (list.children.length) container.appendChild(list);
    container.hidden = false;
    container.style.removeProperty('display');
    if (typeof opts.onRender === 'function') opts.onRender(container, decrypted);
  }
 
  // Some forks dispatch a plain Event without `detail`, so never read it.
  window.addEventListener('hexo-blog-decrypt', render);
  // With autoSave, a cached key can decrypt before this script runs.
  render();
})();

#!/usr/bin/env node
/* check-toc-leak.js: fail if an encrypted post's text appears in generated files.
 *
 * Usage (from the Hexo site root, after `hexo clean && hexo generate`):
 *   node check-toc-leak.js [--source source/_posts] [--public public] [--post path.md ...] [--body]
 *
 * Headings are always checked. --body also checks every prose line of at least
 * 40 characters, which catches search indexes, feeds and metadata that copy
 * the post body.
 * Posts with a non-empty front-matter `password` are checked automatically.
 * Tag-encrypted posts have no front-matter password; pass them with --post.
 * Exit code: 0 clean, 1 leak found, 2 usage or I/O error.
 */
'use strict';
 
const fs = require('node:fs');
const path = require('node:path');
 
const MIN_HEADING_LENGTH = 4;
const MIN_BODY_LENGTH = 40;
const SCANNED_EXTENSIONS = new Set(['.html', '.xml', '.json', '.txt', '.js']);
 
function parseArgs(argv) {
  const args = { source: 'source/_posts', public: 'public', posts: [], body: false };
  for (let i = 0; i < argv.length; i++) {
    const flag = argv[i];
    if (flag === '--body') {
      args.body = true;
      continue;
    }
    const value = argv[i + 1];
    if (!['--source', '--public', '--post'].includes(flag) || value === undefined) {
      throw new Error(`unknown or incomplete argument: ${flag}`);
    }
    if (flag === '--post') args.posts.push(value);
    else args[flag.slice(2)] = value;
    i++;
  }
  return args;
}
 
function frontMatter(text) {
  const match = /^---\r?\n([\s\S]*?)\r?\n---/.exec(text);
  return match ? match[1] : '';
}
 
function hasPassword(text) {
  const match = /^password:[ \t]*(.*)$/m.exec(frontMatter(text));
  if (!match) return false;
  const value = match[1].trim().replace(/^(['"])(.*)\1$/, '$2');
  return value !== '';
}
 
function plain(text) {
  return text
    .replace(/!?\[([^\]]*)\]\([^)]*\)/g, '$1')
    .replace(/[`*_~]/g, '')
    .trim();
}
 
function headings(text, includeBody = false) {
  const body = text.replace(/^---\r?\n[\s\S]*?\r?\n---/, '');
  const out = [];
  let fence = null;
  for (const line of body.split(/\r?\n/)) {
    const fenceMatch = /^\s*(```|~~~)/.exec(line);
    if (fenceMatch) {
      fence = fence === fenceMatch[1] ? null : (fence || fenceMatch[1]);
      continue;
    }
    if (fence) continue;
    const match = /^#{1,6}\s+(.+?)\s*#*\s*$/.exec(line);
    if (match) {
      const heading = plain(match[1]);
      if (heading.length >= MIN_HEADING_LENGTH) out.push(heading);
      continue;
    }
    if (!includeBody || /^\s*(<|\||>|[-*+]\s|\d+\.\s|<!--)/.test(line)) continue;
    const prose = plain(line);
    if (prose.length >= MIN_BODY_LENGTH) out.push(prose);
  }
  return out;
}
 
function walk(dir, extensions, files = []) {
  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
    const full = path.join(dir, entry.name);
    if (entry.isDirectory()) walk(full, extensions, files);
    else if (extensions.has(path.extname(entry.name))) files.push(full);
  }
  return files;
}
 
function escapeHtml(text) {
  return text.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
}
 
function main() {
  let args;
  try {
    args = parseArgs(process.argv.slice(2));
  } catch (error) {
    console.error(error.message);
    return 2;
  }
  if (!fs.existsSync(args.public)) {
    console.error(`generated directory not found: ${args.public} (run hexo generate first)`);
    return 2;
  }
 
  const posts = new Set(args.posts);
  if (fs.existsSync(args.source)) {
    for (const file of walk(args.source, new Set(['.md']))) {
      if (hasPassword(fs.readFileSync(file, 'utf8'))) posts.add(file);
    }
  }
  if (posts.size === 0) {
    console.log('No encrypted posts found. Pass tag-encrypted posts with --post.');
    return 0;
  }
 
  const needles = [];
  for (const post of posts) {
    for (const heading of headings(fs.readFileSync(post, 'utf8'), args.body)) {
      needles.push({ post, heading, forms: [heading, escapeHtml(heading), encodeURIComponent(heading)] });
    }
  }
 
  const leaks = [];
  for (const file of walk(args.public, SCANNED_EXTENSIONS)) {
    const text = fs.readFileSync(file, 'utf8');
    for (const needle of needles) {
      if (needle.forms.some((form) => text.includes(form))) leaks.push({ file, ...needle });
    }
  }
 
  for (const leak of leaks) {
    console.log(`LEAK ${leak.file}: "${leak.heading}" from ${leak.post}`);
  }
  console.log(`${posts.size} encrypted post(s), ${needles.length} string(s) checked, ${leaks.length} leak(s).`);
  return leaks.length ? 1 : 0;
}
 
if (require.main === module) process.exitCode = main();
 
module.exports = { hasPassword, headings };