@bpmn-io/form-js-editor 1.8.1 → 1.8.3

package/dist/index.es.js

@@ -1060,7 +1060,7 @@ function EditorHtml(props) {
         class: "fjs-form-field-placeholder",
         children: [jsx(Icon, {
           viewBox: "0 0 54 54"
-        }), "Html is empty"]
+        }), "Html view is empty"]
       })
     });
   }
@@ -1071,7 +1071,7 @@ function EditorHtml(props) {
         class: "fjs-form-field-placeholder",
         children: [jsx(Icon, {
           viewBox: "0 0 54 54"
-        }), "Html is populated by an expression"]
+        }), "Html view is populated by an expression"]
       })
     });
   }
@@ -1082,7 +1082,7 @@ function EditorHtml(props) {
         class: "fjs-form-field-placeholder",
         children: [jsx(Icon, {
           viewBox: "0 0 54 54"
-        }), "Html is templated"]
+        }), "Html view is templated"]
       })
     });
   }
@@ -1163,13 +1163,14 @@ function EditorExpressionField(props) {
     field
   } = props;
   const {
-    expression = ''
+    expression = '',
+    key
   } = field;
   const Icon = iconsByType('expression');
   const expressionLanguage = useService$1('expressionLanguage');
   let placeholderContent = 'Expression is empty';
   if (expression.trim() && expressionLanguage.isExpression(expression)) {
-    placeholderContent = 'Expression';
+    placeholderContent = `Expression for '${key}'`;
   }
   return jsx("div", {
     class: editorFormFieldClasses(type),
@@ -8981,6 +8982,14 @@ function textToLabel(text) {
 function isValidDotPath(path) {
   return /^\w+(\.\w+)*$/.test(path);
 }
+
+/**
+  * @param {string} path
+  */
+function isProhibitedPath(path) {
+  const prohibitedSegments = ['__proto__', 'prototype', 'constructor'];
+  return path.split('.').some(segment => prohibitedSegments.includes(segment));
+}
 const LABELED_NON_INPUTS = ['button', 'group', 'dynamiclist', 'iframe', 'table'];
 const INPUTS = ['checkbox', 'checklist', 'datetime', 'number', 'radio', 'select', 'taglist', 'textfield', 'textarea'];
 const OPTIONS_INPUTS = ['checklist', 'radio', 'select', 'taglist'];
@@ -9920,6 +9929,9 @@ function Key$2(props) {
     if (hasIntegerPathSegment(value)) {
       return 'Must not contain numerical path segments.';
     }
+    if (isProhibitedPath(value)) {
+      return 'Must not be a prohibited path.';
+    }
     const replacements = {
       [field.id]: value.split('.')
     };
@@ -10012,11 +10024,15 @@ function Path(props) {
     }
 
     // Check for integer segments in the path
-    const hasIntegerPathSegment = value.split('.').some(segment => /^\d+$/.test(segment));
-    if (hasIntegerPathSegment) {
+    if (hasIntegerPathSegment(value)) {
       return 'Must not contain numerical path segments.';
     }
 
+    // Check for special prohibited paths
+    if (isProhibitedPath(value)) {
+      return 'Must not be a prohibited path.';
+    }
+
     // Check for path collisions
     const options = {
       replacements: {