@atlaskit/smart-card 43.28.4 → 43.28.6

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @atlaskit/smart-card
 
+## 43.28.6
+
+### Patch Changes
+
+- [`f838a5a7535df`](https://bitbucket.org/atlassian/atlassian-frontend-monorepo/commits/f838a5a7535df) -
+  VULN-1914676 disabling parsing of raw html for ai summary markdown
+
+## 43.28.5
+
+### Patch Changes
+
+- Updated dependencies
+
 ## 43.28.4
 
 ### Patch Changes

package/dist/cjs/utils/analytics/analytics.js

@@ -11,7 +11,7 @@ var ANALYTICS_CHANNEL = exports.ANALYTICS_CHANNEL = 'media';
 var context = exports.context = {
   componentName: 'smart-cards',
   packageName: "@atlaskit/smart-card",
-  packageVersion: "43.28.3"
+  packageVersion: "43.28.5"
 };
 var TrackQuickActionType = exports.TrackQuickActionType = /*#__PURE__*/function (TrackQuickActionType) {
   TrackQuickActionType["StatusUpdate"] = "StatusUpdate";

package/dist/cjs/view/LinkUrl/index.js

@@ -22,7 +22,7 @@ var _excluded = ["href", "children", "checkSafety", "onClick", "testId", "isLink
   _excluded2 = ["isLinkSafe", "showSafetyWarningModal"];
 var PACKAGE_DATA = {
   packageName: "@atlaskit/smart-card",
-  packageVersion: "43.28.3",
+  packageVersion: "43.28.5",
   componentName: 'linkUrl'
 };
 var Anchor = (0, _click.withLinkClickedEvent)('a');

package/dist/cjs/view/common/ai-summary/index.js

@@ -10,11 +10,14 @@ exports.default = void 0;
 require("./index.compiled.css");
 var React = _interopRequireWildcard(require("react"));
 var _runtime = require("@compiled/react/runtime");
+var _defineProperty2 = _interopRequireDefault(require("@babel/runtime/helpers/defineProperty"));
 var _markdownToJsx = _interopRequireDefault(require("markdown-to-jsx"));
 var _platformFeatureFlags = require("@atlaskit/platform-feature-flags");
 var _expValEqualsNoExposure = require("@atlaskit/tmp-editor-statsig/exp-val-equals-no-exposure");
 var _ulist = _interopRequireDefault(require("./ulist"));
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function _interopRequireWildcard(e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != _typeof(e) && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (var _t in e) "default" !== _t && {}.hasOwnProperty.call(e, _t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, _t)) && (i.get || i.set) ? o(f, _t, i) : f[_t] = e[_t]); return f; })(e, t); }
+function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { (0, _defineProperty2.default)(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 var baseStyle = null;
 var textStyleNew = null;
 var textStyleOld = null;
@@ -41,12 +44,14 @@ var AISummary = function AISummary(_ref) {
     ,
     className: (0, _runtime.ax)(["_11c8wadc _slp31hna _1nmz1hna _o5724jg8 _181u1kdv _1rkw1kdv _te171kdv _uizt1kdv", (0, _expValEqualsNoExposure.expValEqualsNoExposure)('platform_sl_3p_auth_rovo_action', 'isEnabled', true) && (0, _platformFeatureFlags.fg)('platform_sl_3p_auth_rovo_action_kill_switch') ? "_syazi7uo" : "_syazazsu", className]),
     children: content,
-    options: {
+    options: _objectSpread({
       forceWrapper: true,
       overrides: {
         ul: _ulist.default
       }
-    },
+    }, (0, _platformFeatureFlags.fg)('navx-vuln-1914676-fix-xss-in-ai-summaries') ? {
+      disableParsingRawHTML: true
+    } : {}),
     style: {
       minHeight: minHeight
     }

package/dist/es2019/utils/analytics/analytics.js

@@ -2,7 +2,7 @@ export const ANALYTICS_CHANNEL = 'media';
 export const context = {
   componentName: 'smart-cards',
   packageName: "@atlaskit/smart-card",
-  packageVersion: "43.28.3"
+  packageVersion: "43.28.5"
 };
 export let TrackQuickActionType = /*#__PURE__*/function (TrackQuickActionType) {
   TrackQuickActionType["StatusUpdate"] = "StatusUpdate";

package/dist/es2019/view/LinkUrl/index.js

@@ -12,7 +12,7 @@ import LinkWarningModal from './LinkWarningModal';
 import { useLinkWarningModal } from './LinkWarningModal/hooks/use-link-warning-modal';
 const PACKAGE_DATA = {
   packageName: "@atlaskit/smart-card",
-  packageVersion: "43.28.3",
+  packageVersion: "43.28.5",
   componentName: 'linkUrl'
 };
 const Anchor = withLinkClickedEvent('a');

package/dist/es2019/view/common/ai-summary/index.js

@@ -34,7 +34,10 @@ const AISummary = ({
       forceWrapper: true,
       overrides: {
         ul: UList
-      }
+      },
+      ...(fg('navx-vuln-1914676-fix-xss-in-ai-summaries') ? {
+        disableParsingRawHTML: true
+      } : {})
     },
     style: {
       minHeight: minHeight

package/dist/esm/utils/analytics/analytics.js

@@ -4,7 +4,7 @@ export var ANALYTICS_CHANNEL = 'media';
 export var context = {
   componentName: 'smart-cards',
   packageName: "@atlaskit/smart-card",
-  packageVersion: "43.28.3"
+  packageVersion: "43.28.5"
 };
 export var TrackQuickActionType = /*#__PURE__*/function (TrackQuickActionType) {
   TrackQuickActionType["StatusUpdate"] = "StatusUpdate";

package/dist/esm/view/LinkUrl/index.js

@@ -15,7 +15,7 @@ import LinkWarningModal from './LinkWarningModal';
 import { useLinkWarningModal } from './LinkWarningModal/hooks/use-link-warning-modal';
 var PACKAGE_DATA = {
   packageName: "@atlaskit/smart-card",
-  packageVersion: "43.28.3",
+  packageVersion: "43.28.5",
   componentName: 'linkUrl'
 };
 var Anchor = withLinkClickedEvent('a');

package/dist/esm/view/common/ai-summary/index.js

@@ -1,7 +1,10 @@
 /* index.tsx generated by @compiled/babel-plugin v0.39.1 */
+import _defineProperty from "@babel/runtime/helpers/defineProperty";
 import "./index.compiled.css";
 import * as React from 'react';
 import { ax, ix } from "@compiled/react/runtime";
+function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 import Markdown from 'markdown-to-jsx';
 import { fg } from '@atlaskit/platform-feature-flags';
 import { expValEqualsNoExposure } from '@atlaskit/tmp-editor-statsig/exp-val-equals-no-exposure';
@@ -32,12 +35,14 @@ var AISummary = function AISummary(_ref) {
     ,
     className: ax(["_11c8wadc _slp31hna _1nmz1hna _o5724jg8 _181u1kdv _1rkw1kdv _te171kdv _uizt1kdv", expValEqualsNoExposure('platform_sl_3p_auth_rovo_action', 'isEnabled', true) && fg('platform_sl_3p_auth_rovo_action_kill_switch') ? "_syazi7uo" : "_syazazsu", className]),
     children: content,
-    options: {
+    options: _objectSpread({
       forceWrapper: true,
       overrides: {
         ul: UList
       }
-    },
+    }, fg('navx-vuln-1914676-fix-xss-in-ai-summaries') ? {
+      disableParsingRawHTML: true
+    } : {}),
     style: {
       minHeight: minHeight
     }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@atlaskit/smart-card",
-	"version": "43.28.4",
+	"version": "43.28.6",
 	"description": "Smart card component",
 	"publishConfig": {
 		"registry": "https://registry.npmjs.org/"
@@ -69,13 +69,13 @@
 		"@atlaskit/react-ufo": "^5.7.0",
 		"@atlaskit/rovo-triggers": "^5.34.0",
 		"@atlaskit/section-message": "^8.12.0",
-		"@atlaskit/select": "^21.8.0",
+		"@atlaskit/select": "^21.9.0",
 		"@atlaskit/spinner": "^19.0.0",
 		"@atlaskit/textarea": "^8.2.0",
 		"@atlaskit/textfield": "^8.2.0",
 		"@atlaskit/theme": "^22.0.0",
 		"@atlaskit/tile": "^1.0.0",
-		"@atlaskit/tmp-editor-statsig": "^49.0.0",
+		"@atlaskit/tmp-editor-statsig": "^50.0.0",
 		"@atlaskit/tokens": "^11.4.0",
 		"@atlaskit/tooltip": "^21.0.0",
 		"@atlaskit/ufo": "^0.4.0",
@@ -233,6 +233,9 @@
 		},
 		"platform_navx_smart_link_icon_label_a11y": {
 			"type": "boolean"
+		},
+		"navx-vuln-1914676-fix-xss-in-ai-summaries": {
+			"type": "boolean"
 		}
 	},
 	"compassUnitTestMetricSourceId": "ari:cloud:compass:a436116f-02ce-4520-8fbb-7301462a1674:metric-source/c5751cc6-3513-4070-9deb-af31e86aed34/f74ef1bc-7240-4aac-9dc8-9dc43b502089"