@capillarytech/cap-ui-utils 3.0.15-alpha.1 → 3.0.15

package/index.js

@@ -12,4 +12,3 @@ export { default as sanitizeTemplateWithRegexp } from "./utils/contentSanitizati
 export { default as decompressJsonObject } from "./utils/zlibDataDecompress";
 export { default as getEnvVariable } from "./utils/getEnvVariables";
 export { formatDateWithTimezone, getTimezoneTooltip, hasTimezoneFeatureAccess } from "./utils/timezone";
-export { default as MFEEventBus } from "./utils/mfeEventBus";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capillarytech/cap-ui-utils",
-  "version": "3.0.15-alpha.1",
+  "version": "3.0.15",
   "description": "Utility functions shared accross all the modules",
   "main": "index.js",
   "scripts": {

package/utils/contentSanitizationHelper.js

@@ -83,9 +83,16 @@ const sanitizeTemplateWithRegexp = (content) => {
     );
     // regex to replace the &#39 (ascii html for apostrophe) to the apostrophe for ckeditor content
 		const apostropheRegex = new RegExp(''', 'gi');
+    // Preserve double-quote numeric HTML entities by converting them to a raw "
+    // BEFORE hexCodeRegex/regexForUnicode strips all &#…; entities. Mirrors the
+    // existing apostrophe handling above. " is harmless on its own — XSS bypass
+    // tricks like javascript: are still neutralized below because they
+    // depend on entities OTHER than "/".
+		const quoteEntityRegex = new RegExp('"|"', 'gi');
 
     content = content
       .replaceAll(apostropheRegex, '\'')
+      .replaceAll(quoteEntityRegex, '"')
       .replace(hexCodeRegex, "")
       .replace(encodedScriptTagRegex, "")
       .replace(fullTagRegex, "")

package/utils/mfeEventBus.js

@@ -1,47 +0,0 @@
-/**
- * MFEEventBus
- *
- * Lightweight event bus for cross-boundary communication between the MFE
- * host shell and remote apps. Uses window CustomEvent — no build-time
- * coupling between apps.
- *
- * All events are namespaced with the MFE_EVENT_PREFIX to avoid collisions
- * with other window events (e.g. analytics, third-party libraries).
- */
-
-const MFE_EVENT_PREFIX = 'mfe:';
-
-const MFEEventBus = {
-  /**
-   * Emit an event to all listeners (host or any remote).
-   *
-   * @param {string} eventName - Event name without prefix (e.g. 'loyalty:navigate')
-   * @param {object} payload   - Arbitrary serialisable data
-   */
-  emit(eventName, payload = {}) {
-    window.dispatchEvent(
-      new CustomEvent(`${MFE_EVENT_PREFIX}${eventName}`, {
-        detail: payload,
-        bubbles: false,
-        cancelable: false,
-      }),
-    );
-  },
-
-  /**
-   * Subscribe to an event. Returns an unsubscribe function — call it in
-   * useEffect cleanup to prevent memory leaks.
-   *
-   * @param {string}   eventName - Event name without prefix
-   * @param {function} handler   - Called with the event payload object
-   * @returns {function}         - Unsubscribe / cleanup function
-   */
-  on(eventName, handler) {
-    const listener = event => handler(event.detail);
-    window.addEventListener(`${MFE_EVENT_PREFIX}${eventName}`, listener);
-    return () =>
-      window.removeEventListener(`${MFE_EVENT_PREFIX}${eventName}`, listener);
-  },
-};
-
-export default MFEEventBus;