@autobusal/routes-order 1.4.1 → 1.4.2

package/CHANGELOG.md

@@ -0,0 +1,37 @@
+# Changelog
+
+All notable changes to this package are documented here. This project follows
+[Keep a Changelog](https://keepachangelog.com/) and [Semantic Versioning](https://semver.org/).
+
+## [1.4.2] - 2026-07-19
+
+### Added
+
+- `Found/Route/Route.tsx`: added a neutral inline SVG data-URI `LOGO_FALLBACK`.
+  The operator logo `<img>` now falls back to it when `logo_url` is empty
+  (`data.operator.logo_url || LOGO_FALLBACK`) and via an `onError` handler
+  (which nulls `onerror` first to avoid a loop), so a missing or broken operator
+  logo no longer renders the browser's broken-image icon in route results.
+
+### Fixed
+
+- `Found/Orders/Orders.tsx`: the not-found branch now triggers on
+  `data === undefined || data.length === 0` instead of only `data?.length == 0`.
+  An `undefined` result means the search errored (e.g. same origin and
+  destination), and it now shows the not-found message instead of an empty
+  shell.
+- `Found/Booking/Booking.tsx`: the Booking.com logo `<img>` now has an
+  `alt="Booking.com"` attribute, giving the image an accessible name.
+- `Found/Route/Route.tsx`: the operator logo `<img>` now has an `alt` attribute
+  set to the operator company name.
+
+### Security
+
+- `Found/Booking/Booking.tsx`: the `LinkBooking` external link
+  (`target="_blank"`) now includes `rel="noopener noreferrer"`, closing the
+  reverse-tabnabbing / `window.opener` leak.
+- `Found/Route/Route.tsx`: the operator `LinkCompany` and route `LinkRoute`
+  external links (`target="_blank"`) now include `rel="noopener noreferrer"` for
+  the same tabnabbing protection.
+
+Authored by Ferjolt Ozuni. Consolidated from the magus and alvavel whitelabel patch sets into canonical @autobusal source (eliminates per-repo patch-package divergence).

package/Found/Booking/Booking.tsx

@@ -39,10 +39,10 @@ const Booking = ({ data, step1, t }: Props): (JSX.Element | null) => {
     <Container>
       <About>
         { t('routes_order.step2.booking.title', { location: destination.city.name }) }
-        <img src="https://s-ec.bstatic.com/static/img/b26logo/booking_logo_retina/22615963add19ac6b6d715a97c8d477e8b95b7ea.png" />
+        <img src="https://s-ec.bstatic.com/static/img/b26logo/booking_logo_retina/22615963add19ac6b6d715a97c8d477e8b95b7ea.png" alt="Booking.com" />
       </About>
 
-      <LinkBooking to={ location } target="_blank">{ t('routes_order.step2.booking.search') }</LinkBooking>
+      <LinkBooking to={ location } target="_blank" rel="noopener noreferrer">{ t('routes_order.step2.booking.search') }</LinkBooking>
     </Container>
   );
 };

package/Found/Orders/Orders.tsx

@@ -23,7 +23,9 @@ const Orders = ({ loading, data, type, preferredStop, t, onSave }: Props): JSX.E
     );
   }
 
-  if (data?.length == 0) {
+  // undefined means the search errored (e.g. same origin and destination) -
+  // show the not-found message instead of an empty shell
+  if (data === undefined || data.length === 0) {
     return (
       <ContainerNotFound className="box">{ t('routes_order.step2.not_found') }</ContainerNotFound>
     );

package/Found/Route/Route.tsx

@@ -6,6 +6,10 @@ import { Button, RouteFeature, Policy } from '@autobusal/common';
 import { Container, SpecialOffer, FavoriteStop, Trip, Company, Location, Time, Price, LinkCompany, Details, Detail, ButtonPolicy, TitleDetail, LinkRoute, Features, TitleFeatures, FeaturesItems } from './styles';
 import { FoundData } from '@autobusal/providers/types/routes';
 
+// neutral placeholder so a missing/broken operator logo doesn't render the
+// browser's broken-image icon in the route results
+const LOGO_FALLBACK = "data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='120' height='60' viewBox='0 0 120 60'%3E%3Crect width='120' height='60' rx='6' fill='%23e5e7eb'/%3E%3Cpath d='M42 22h36v14a2 2 0 0 1-2 2h-2a3 3 0 0 1-6 0H52a3 3 0 0 1-6 0h-2a2 2 0 0 1-2-2z' fill='%239ca3af'/%3E%3C/svg%3E";
+
 interface Props {
   data: FoundData
   type: 'favorite' | 'normal'
@@ -30,7 +34,7 @@ const Route = ({ data, type, t, onSave }: Props): JSX.Element => {
 
       <Trip>
         <Company>
-          <LinkCompany to={ data.operator.link } target="_blank" title={ data.operator.company }><img src={ data.operator.logo_url } /></LinkCompany>
+          <LinkCompany to={ data.operator.link } target="_blank" rel="noopener noreferrer" title={ data.operator.company }><img src={ data.operator.logo_url || LOGO_FALLBACK } onError={ (e) => { e.currentTarget.onerror = null; e.currentTarget.src = LOGO_FALLBACK; } } alt={ data.operator.company } /></LinkCompany>
         </Company>
 
         <Location>
@@ -69,7 +73,7 @@ const Route = ({ data, type, t, onSave }: Props): JSX.Element => {
       <Details>
         <Detail>
           <TitleDetail>{ t('routes_order.step2.route.name') }</TitleDetail>
-          <LinkRoute to={ data.link } target="_blank">{ data.code }</LinkRoute>
+          <LinkRoute to={ data.link } target="_blank" rel="noopener noreferrer">{ data.code }</LinkRoute>
         </Detail>
 
         { customs && (

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@autobusal/routes-order",
-  "version": "1.4.1",
+  "version": "1.4.2",
+  "author": "Ferjolt Ozuni",
   "type": "module",
   "main": "index.ts"
 }