@autobusal/common 1.4.2 → 1.4.4

package/BlogItem/BlogItem.tsx

@@ -1,5 +1,6 @@
 import { TFunction } from 'i18next';
 import { FiCalendar } from 'react-icons/fi';
+import { sanitizeHtml } from '@autobusal/utilities';
 import Image from './Image';
 import { LinkTitle, Details, DisplayDate, TextPreview, TextView, ButtonLink } from './styles';
 import { ArticleData } from '@autobusal/providers/types/articles';
@@ -33,7 +34,7 @@ const BlogItem = ({ article, type, t }: Props): JSX.Element => (
       </TextPreview>
     ) }
 
-    { type === 'view' && <TextView dangerouslySetInnerHTML={{ __html: article.content }} /> }
+    { type === 'view' && <TextView dangerouslySetInnerHTML={{ __html: sanitizeHtml(article.content) }} /> }
   </div>
 );
 

package/CHANGELOG.md

@@ -3,6 +3,28 @@
 All notable changes to `@autobusal/common` are documented here. This project follows
 [Keep a Changelog](https://keepachangelog.com/) and [Semantic Versioning](https://semver.org/).
 
+## [1.4.4] - 2026-07-24
+
+### Fixed
+
+- `BlogItem.tsx` and `Policy.tsx`: article/policy content is now run through `@autobusal/utilities`'s `sanitizeHtml` before being rendered via `dangerouslySetInnerHTML`, closing an XSS gap where an already-compromised admin account could persist JS in blog articles or policy pages.
+
+## [1.4.3] - 2026-07-19
+
+### Changed
+
+- **`Meta` (`Meta.tsx`) is now brand-configurable, eliminating the per-brand SEO fork.**
+  Merged magus's rich SEO `Meta` (robots, canonical, Open Graph and Twitter card tags, plus
+  optional `image`/`url`/`type`/`noIndex` props) into the shared component, and replaced the
+  hard-coded "BusMagus" strings with a `VITE_APP_NAME` build-time env: the `<title>` suffix,
+  `og:title`/`twitter:title` and `og:site_name` derive from that brand name, and when it is
+  unset the title renders bare (no suffix) with `og:site_name` omitted — so a brand that has
+  not configured a name is unaffected. This lets every whitelabel consume the published
+  `Meta` and pass its own brand via env, instead of magus vite-aliasing `@autobusal/common`
+  to a local `src/modules/Common` copy just to override this one file. `children` is now
+  optional; the prop set is a superset of the previous one, so all existing `<Meta title=…>`
+  call sites are unaffected.
+
 ## [1.4.2] - 2026-07-19
 
 ### Added

package/Meta.tsx

@@ -4,20 +4,53 @@ interface Props {
   title: string
   keywords?: string
   description?: string
-  children: any
+  image?: string
+  url?: string
+  type?: string
+  noIndex?: boolean
+  children?: any
 }
 
-const Meta = ({ title, keywords, description, children }: Props): JSX.Element => (
+// Brand display name for SEO, set per whitelabel via VITE_APP_NAME (build-time
+// Vite env). It drives the <title> suffix, the og/twitter titles and
+// og:site_name. When unset, titles render bare (no suffix) and og:site_name is
+// omitted, so a brand that has not configured a name is unaffected. This is
+// what lets every brand consume the published @autobusal/common Meta instead of
+// aliasing a per-brand fork.
+const brand = import.meta.env.VITE_APP_NAME as string | undefined;
+
+const withBrand = (value: string): string => (brand ? `${ value } - ${ brand }` : value);
+
+const Meta = ({ title, keywords, description, image, url, type = 'website', noIndex = false, children }: Props): JSX.Element => (
   <>
     <Helmet>
-      <title>{ title }</title>
+      <title>{ withBrand(title) }</title>
+
+      {/* Robots */}
+      <meta name="robots" content={ noIndex ? 'noindex, nofollow' : 'index, follow' } />
 
+      {/* Standard Meta Tags */}
       { keywords && <meta name="keywords" content={ keywords } /> }
       { description && <meta name="description" content={ description } /> }
+      { url && <link rel="canonical" href={ url } /> }
+
+      {/* Open Graph / Facebook */}
+      <meta property="og:type" content={ type } />
+      <meta property="og:title" content={ withBrand(title) } />
+      { description && <meta property="og:description" content={ description } /> }
+      { image && <meta property="og:image" content={ image } /> }
+      { url && <meta property="og:url" content={ url } /> }
+      { brand && <meta property="og:site_name" content={ brand } /> }
+
+      {/* Twitter */}
+      <meta name="twitter:card" content="summary_large_image" />
+      <meta name="twitter:title" content={ withBrand(title) } />
+      { description && <meta name="twitter:description" content={ description } /> }
+      { image && <meta name="twitter:image" content={ image } /> }
     </Helmet>
 
     { children }
   </>
 );
 
-export default Meta;
+export default Meta;

package/Policy/Policy.tsx

@@ -1,4 +1,5 @@
 import { TFunction } from 'i18next';
+import { sanitizeHtml } from '@autobusal/utilities';
 import Modal from '../Modal/Modal';
 import { useGetPolicy } from './services';
 
@@ -17,7 +18,7 @@ const Policy = ({ id, t, onClose }: Props): JSX.Element => {
       width={ 750 }
       title={ t('policy.title') }
       content={
-        <div dangerouslySetInnerHTML={{ __html: data?.policies ?? '' }} />
+        <div dangerouslySetInnerHTML={{ __html: sanitizeHtml(data?.policies) }} />
       }
       onClose={ onClose }
     />

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autobusal/common",
-  "version": "1.4.2",
+  "version": "1.4.4",
   "author": "Ferjolt Ozuni",
   "type": "module",
   "main": "index.ts"