@adobe/alloy 2.26.0-beta.0 → 2.26.0-beta.2

package/libEs5/components/ActivityCollector/utils/trimQueryFromUrl.js

@@ -12,6 +12,11 @@ the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTA
 OF ANY KIND, either express or implied. See the License for the specific language
 governing permissions and limitations under the License.
 */
+/**
+ * Trims the query from the URL.
+ * @param {string} url
+ * @returns {string}
+ */
 var _default = url => {
   const questionMarkIndex = url.indexOf("?");
   const hashIndex = url.indexOf("#");

package/libEs5/components/Identity/createComponent.js

@@ -56,7 +56,12 @@ var _default = ({
           // https://jira.corp.adobe.com/browse/EXEG-1234
           setLegacyEcid(newNamespaces[_ecidNamespace.default]);
         }
-        namespaces = newNamespaces;
+        if (newNamespaces && Object.keys(newNamespaces).length > 0) {
+          namespaces = {
+            ...namespaces,
+            ...newNamespaces
+          };
+        }
         // For sendBeacon requests, getEdge() will return {}, so we are using assign here
         // so that sendBeacon requests don't override the edge info from before.
         edge = {

package/libEs5/components/Identity/injectAddQueryStringIdentityToPayload.js

@@ -41,7 +41,8 @@ var _default = ({
   }
   const properties = queryStringValue.split("|").reduce((memo, keyValue) => {
     const [key, value] = keyValue.split("=");
-    memo[key] = value;
+    memo[key] = (0, _decodeUriComponentSafely.default)(value);
+    memo[key] = memo[key].replace(/[^a-zA-Z0-9@_-]/g, ""); // sanitization
     return memo;
   }, {});
   // We are using MCMID and MCORGID to be compatible with Visitor.

package/libEs5/constants/libraryVersion.js

@@ -14,4 +14,4 @@ governing permissions and limitations under the License.
 */
 // The __VERSION__ keyword will be replace at alloy build time with the package.json version.
 // see babel-plugin-version
-var _default = exports.default = "2.26.0-beta.0";
+var _default = exports.default = "2.26.0-beta.2";

package/libEs5/utils/parseUrl.js

@@ -1,7 +1,6 @@
 "use strict";
 
 exports.default = void 0;
-var _parseUri = require("parse-uri");
 var _isString = require("./isString.js");
 /*
 Copyright 2023 Adobe. All rights reserved.
@@ -44,11 +43,39 @@ const parseDomainBasic = host => {
   }
   return result;
 };
+
+/**
+ * @typedef {Object} ParseUriResult
+ * @property {string} host
+ * @property {string} path
+ * @property {string} query
+ * @property {string} anchor
+ *
+ * @param {string} url
+ * @returns {ParseUriResult}
+ */
+const parseUri = url => {
+  try {
+    const parsed = new URL(url);
+    let path = parsed.pathname;
+    if (!url.endsWith("/") && path === "/") {
+      path = "";
+    }
+    return {
+      host: parsed.hostname,
+      path,
+      query: parsed.search.replace(/^\?/, ""),
+      anchor: parsed.hash.replace(/^#/, "")
+    };
+  } catch {
+    return {};
+  }
+};
 const parseUrl = (url, parseDomain = parseDomainBasic) => {
   if (!(0, _isString.default)(url)) {
     url = "";
   }
-  const parsed = (0, _parseUri.default)(url) || {};
+  const parsed = parseUri(url) || {};
   const {
     host = "",
     path = "",

package/libEs6/components/ActivityCollector/utils/trimQueryFromUrl.js

@@ -10,6 +10,11 @@ OF ANY KIND, either express or implied. See the License for the specific languag
 governing permissions and limitations under the License.
 */
 
+/**
+ * Trims the query from the URL.
+ * @param {string} url
+ * @returns {string}
+ */
 export default url => {
   const questionMarkIndex = url.indexOf("?");
   const hashIndex = url.indexOf("#");

package/libEs6/components/Identity/createComponent.js

@@ -53,7 +53,12 @@ export default ({
           // https://jira.corp.adobe.com/browse/EXEG-1234
           setLegacyEcid(newNamespaces[ecidNamespace]);
         }
-        namespaces = newNamespaces;
+        if (newNamespaces && Object.keys(newNamespaces).length > 0) {
+          namespaces = {
+            ...namespaces,
+            ...newNamespaces
+          };
+        }
         // For sendBeacon requests, getEdge() will return {}, so we are using assign here
         // so that sendBeacon requests don't override the edge info from before.
         edge = {

package/libEs6/components/Identity/injectAddQueryStringIdentityToPayload.js

@@ -39,7 +39,8 @@ export default ({
   }
   const properties = queryStringValue.split("|").reduce((memo, keyValue) => {
     const [key, value] = keyValue.split("=");
-    memo[key] = value;
+    memo[key] = decodeUriComponentSafely(value);
+    memo[key] = memo[key].replace(/[^a-zA-Z0-9@_-]/g, ""); // sanitization
     return memo;
   }, {});
   // We are using MCMID and MCORGID to be compatible with Visitor.

package/libEs6/constants/libraryVersion.js

@@ -13,4 +13,4 @@ governing permissions and limitations under the License.
 // The __VERSION__ keyword will be replace at alloy build time with the package.json version.
 // see babel-plugin-version
 
-export default "2.26.0-beta.0";
+export default "2.26.0-beta.2";

package/libEs6/utils/parseUrl.js

@@ -9,7 +9,6 @@ the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTA
 OF ANY KIND, either express or implied. See the License for the specific language
 governing permissions and limitations under the License.
 */
-import parseUri from "parse-uri";
 import isString from "./isString.js";
 const parseDomainBasic = host => {
   const result = {};
@@ -40,6 +39,34 @@ const parseDomainBasic = host => {
   }
   return result;
 };
+
+/**
+ * @typedef {Object} ParseUriResult
+ * @property {string} host
+ * @property {string} path
+ * @property {string} query
+ * @property {string} anchor
+ *
+ * @param {string} url
+ * @returns {ParseUriResult}
+ */
+const parseUri = url => {
+  try {
+    const parsed = new URL(url);
+    let path = parsed.pathname;
+    if (!url.endsWith("/") && path === "/") {
+      path = "";
+    }
+    return {
+      host: parsed.hostname,
+      path,
+      query: parsed.search.replace(/^\?/, ""),
+      anchor: parsed.hash.replace(/^#/, "")
+    };
+  } catch {
+    return {};
+  }
+};
 const parseUrl = (url, parseDomain = parseDomainBasic) => {
   if (!isString(url)) {
     url = "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/alloy",
-  "version": "2.26.0-beta.0",
+  "version": "2.26.0-beta.2",
   "description": "Adobe Experience Platform Web SDK",
   "type": "module",
   "main": "libEs5/index.js",
@@ -81,13 +81,12 @@
     "commander": "^13.1.0",
     "css.escape": "^1.5.1",
     "js-cookie": "3.0.5",
-    "parse-uri": "^1.0.9",
     "rollup": "^4.34.8",
     "rollup-plugin-license": "^3.6.0",
     "uuid": "^11.1.0"
   },
   "devDependencies": {
-    "@adobe/alloy": "^2.25.0",
+    "@adobe/alloy": "^2.26.0-beta.1",
     "@babel/cli": "^7.26.4",
     "@babel/plugin-transform-runtime": "^7.26.9",
     "@eslint/js": "^9.20.0",
@@ -115,7 +114,6 @@
     "prettier": "^3.5.1",
     "read-cache": "^1.0.0",
     "recursive-readdir": "^2.2.3",
-    "request": "^2.88.2",
     "rimraf": "^6.0.1",
     "rollup-plugin-glob-import": "^0.5.0",
     "rollup-plugin-istanbul": "^5.0.0",

package/scripts/alloyBuilder.js

@@ -11,27 +11,25 @@ OF ANY KIND, either express or implied. See the License for the specific languag
 governing permissions and limitations under the License.
 */
 
+import babel from "@babel/core";
+import { checkbox, input, select } from "@inquirer/prompts";
+import { Command, InvalidOptionArgumentError, Option } from "commander";
 import fs from "fs";
 import path from "path";
 import { rollup } from "rollup";
-import { Command, Option, InvalidOptionArgumentError } from "commander";
-import { input, checkbox, select } from "@inquirer/prompts";
-import { fileURLToPath } from "url";
-import babel from "@babel/core";
 import { buildConfig } from "../rollup.config.js";
 import entryPointGeneratorBabelPlugin from "./helpers/entryPointGeneratorBabelPlugin.js";
-
-const dirname = path.dirname(fileURLToPath(import.meta.url));
+import { getProjectRoot, safePathJoin } from "./helpers/path.js";
 
 const packageJsonContent = fs.readFileSync(
-  `${dirname}/../package.json`,
+  safePathJoin(getProjectRoot(), "package.json"),
   "utf8",
 );
 const { version } = JSON.parse(packageJsonContent);
 
-let sourceRootPath = `${dirname}/../src`;
+let sourceRootPath = safePathJoin(getProjectRoot(), "src");
 if (!fs.existsSync(sourceRootPath)) {
-  sourceRootPath = `${dirname}/../libEs6`;
+  sourceRootPath = safePathJoin(getProjectRoot(), "libEs6");
 }
 
 const arrayDifference = (arr1, arr2) => arr1.filter((x) => !arr2.includes(x));
@@ -44,11 +42,14 @@ const getComponents = (() => {
   const components = {};
   [
     {
-      filePath: `${sourceRootPath}/core/componentCreators.js`,
+      filePath: safePathJoin(sourceRootPath, "core/componentCreators.js"),
       key: "optional",
     },
     {
-      filePath: `${sourceRootPath}/core/requiredComponentCreators.js`,
+      filePath: safePathJoin(
+        sourceRootPath,
+        "core/requiredComponentCreators.js",
+      ),
       key: "required",
     },
   ].forEach(({ filePath, key }) => {
@@ -69,12 +70,12 @@ const getComponents = (() => {
   return () => components;
 })();
 
-const getDefaultPath = () => {
-  return process.cwd();
-};
-
 const getOutputFilePath = (argv) => {
-  return `${[argv.outputDir, `alloy${argv.minify ? ".min" : ""}.js`].join(path.sep)}`;
+  const outputPath = safePathJoin(
+    argv.outputDir,
+    `alloy${argv.minify ? ".min" : ""}.js`,
+  );
+  return outputPath;
 };
 
 const getFileSizeInKB = (filePath) => {
@@ -93,7 +94,7 @@ const generateInputEntryFile = ({
   }).code;
 
   const destinationDirectory = path.dirname(inputPath);
-  const outputPath = path.join(destinationDirectory, outputFile);
+  const outputPath = safePathJoin(destinationDirectory, outputFile);
 
   fs.writeFileSync(outputPath, output);
 
@@ -157,10 +158,10 @@ const getMakeBuildCommand = () => {
         "-o, --outputDir <dir>",
         "the output directory for the generated build",
       )
-        .default(getDefaultPath())
+        .default(getProjectRoot())
         .argParser((value) => {
           if (!path.isAbsolute(value)) {
-            value = `${getDefaultPath()}${path.sep}${value}`;
+            value = safePathJoin(getProjectRoot(), value);
           }
 
           try {