@ada-support/embed2 1.7.17 → 1.7.18

package/dist/npm-entry/common/helpers/url/index.d.ts

@@ -30,4 +30,5 @@ export declare function getChatURL({ handle, version, cluster, domain, qp, }: {
     domain?: string;
     qp?: QueryParams;
 }): string;
+export declare function escapeUrlParam(param: string): string;
 export {};

package/dist/npm-entry/index.js

@@ -13260,7 +13260,7 @@ const client = new error_tracker_BrowserClient({
     return event;
   },
   environment: "production",
-  release: "1.7.17-b090bf3",
+  release: "1.7.18-7c6b6b5",
   sampleRate: 0.25,
   autoSessionTracking: false,
   // Integrations don't seem to work with Sentry: https://github.com/getsentry/sentry-javascript/issues/2541
@@ -13832,7 +13832,7 @@ function getEmbedURL(_ref) {
   } else {
     host = `http://${handle}.localhost:9001`;
   }
-  return `${host}/embed/${frameName}/${"b090bf3"}/index.html`;
+  return `${host}/embed/${frameName}/${"7c6b6b5"}/index.html`;
 }
 function constructQueryString(query) {
   return Object.keys(query).map(key => {
@@ -13903,6 +13903,23 @@ function getChatURL(_ref3) {
   }
   return prodUrl;
 }
+function escapeUrlParam(param) {
+  /**
+   * Escapes a URL parameter to prevent XSS attacks.
+   *
+   * The following characters are escaped:
+   *  &  is replaced with &, but only if it is not already part of an existing HTML entity (&, <, >, ", ')
+   *  <  is replaced with &lt;
+   *  >  is replaced with &gt;
+   *  "  is replaced with &quot;
+   *  '  is replaced with &apos;
+   *  /  is replaced with &#47;
+   *  ?  is replaced with &#63;
+   *  =  is replaced with &#61;
+   *  .  is replaced with &#46;
+   */
+  return param.replace(/&(?!amp)(?!lt;)(?!gt;)(?!quot)(?!apos;)/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;").replace(/\//g, "&#47;").replace(/\?/g, "&#63;").replace(/=/g, "&#61;").replace(/\./g, "&#46;");
+}
 ;// CONCATENATED MODULE: ./src/client/store/actions/index.ts
 
 
@@ -14993,9 +15010,9 @@ async function log(message, extra, options) {
       service: "embed",
       env: "production",
       embedVersion: 2,
-      version: "1.7.17",
+      version: "1.7.18",
       isNpm: true,
-      commitHash: "b090bf3"
+      commitHash: "7c6b6b5"
     }))
   });
 }
@@ -15008,6 +15025,7 @@ function alternative_bot_rollout_objectSpread(e) { for (var r = 1; r < arguments
 
 
 
+
 const PRIMARY_BOT_ASSIGNMENT_LABEL = "primary";
 const ALTERNATIVE_BOT_ASSIGNMENT_LABEL = "alternative";
 const BOT_ASSIGNMENT_STORAGE_KEY = "botAssignment";
@@ -15168,7 +15186,11 @@ async function fetchClientUsingAlternativeBotRollout(primaryBotClientObject, alt
     language
   } = adaSettings;
   if (adaBotHandleOverride) {
-    const overrideBotClientObject = await fetchClient(adaBotHandleOverride, cluster, domain, language || get_browser_language());
+    const sanitizedAdaBotHandleOverride = escapeUrlParam(adaBotHandleOverride);
+    if (sanitizedAdaBotHandleOverride !== adaBotHandleOverride) {
+      return primaryBotClientObject;
+    }
+    const overrideBotClientObject = await fetchClient(sanitizedAdaBotHandleOverride, cluster, domain, language || get_browser_language());
     if (!overrideBotClientObject) {
       return null;
     }
@@ -16033,7 +16055,7 @@ class ChatFrame extends d {
     const hostPageUrlParams = new URL(window.location.href).searchParams;
     const smsToken = hostPageUrlParams.get("adaSMSToken");
     const queryParams = {
-      embedVersion: "b090bf3".slice(0, 7),
+      embedVersion: "7c6b6b5".slice(0, 7),
       greeting,
       language,
       skipGreeting,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ada-support/embed2",
-  "version": "1.7.17",
+  "version": "1.7.18",
   "description": "",
   "main": "dist/npm-entry",
   "typings": "dist/npm-entry/index-npm.d.ts",