@chat21/chat21-web-widget 5.1.32-rc8 → 5.1.33-rc8

package/src/app/modals/confirm-close/confirm-close.component.ts

@@ -1,4 +1,4 @@
-import { Component, ElementRef, EventEmitter, Input, OnInit, Output, SimpleChange, SimpleChanges, ViewChild, OnDestroy } from '@angular/core';
+import { Component, ElementRef, EventEmitter, HostListener, Input, OnInit, Output, SimpleChange, SimpleChanges, ViewChild, OnDestroy } from '@angular/core';
 import { LoggerService } from 'src/chat21-core/providers/abstract/logger.service';
 import { LoggerInstance } from 'src/chat21-core/providers/logger/loggerInstance';
 
@@ -25,6 +25,13 @@ export class ConfirmCloseComponent implements OnInit{
     // this.dialog.showModal();
   }
 
+  @HostListener('keydown.escape', ['$event'])
+  onEscape(event: KeyboardEvent){
+    event.preventDefault();
+    event.stopPropagation();
+    this.onBack();
+  }
+
   ngOnChanges(changes: SimpleChanges){
     if(changes && 
       changes['conversationId'] && 

package/src/app/pipe/html-entites-encode.pipe.spec.ts

@@ -1,8 +1,41 @@
 import { HtmlEntitiesEncodePipe } from './html-entities-encode.pipe';
 
 describe('HtmlEntitiesEncodePipe', () => {
-  it('create an instance', () => {
-    const pipe = new HtmlEntitiesEncodePipe();
+  let pipe: HtmlEntitiesEncodePipe;
+
+  beforeEach(() => {
+    pipe = new HtmlEntitiesEncodePipe();
+  });
+
+  it('should create', () => {
     expect(pipe).toBeTruthy();
   });
+
+  it('should encode angle brackets so raw HTML tags are not preserved (XSS mitigation)', () => {
+    const malicious = '<script>alert(1)</script><img src=x onerror=alert(1)>';
+    const out = pipe.transform(malicious);
+    expect(out).not.toContain('<script');
+    expect(out).not.toContain('<img');
+    expect(out).toContain('&lt;');
+    expect(out).toContain('&gt;');
+  });
+
+  it('should encode double quotes for attribute injection contexts', () => {
+    expect(pipe.transform('say "hello"')).toContain('&quot;');
+  });
+
+  it('should replace newlines with <br> via replaceEndOfLine', () => {
+    const out = pipe.transform('line1\nline2');
+    expect(out).toContain('<br>');
+    expect(out).toContain('line1');
+    expect(out).toContain('line2');
+  });
+
+  it('should trim leading and trailing whitespace', () => {
+    expect(pipe.transform('  abc  ')).toBe('abc');
+  });
+
+  it('should coerce non-string input to string before encoding', () => {
+    expect(pipe.transform(123 as any)).toBe('123');
+  });
 });

package/src/app/pipe/marked.pipe.spec.ts

@@ -1,8 +1,44 @@
 import { MarkedPipe } from './marked.pipe';
 
 describe('MarkedPipe', () => {
-  it('create an instance', () => {
-    const pipe = new MarkedPipe();
+  let pipe: MarkedPipe;
+
+  beforeEach(() => {
+    pipe = new MarkedPipe();
+  });
+
+  it('should create', () => {
     expect(pipe).toBeTruthy();
   });
+
+  it('should render markdown bold as HTML strong', () => {
+    const html = pipe.transform('Hello **world**') as string;
+    expect(html).toMatch(/<strong>world<\/strong>|<b>world<\/b>/);
+  });
+
+  it('should not leave raw script tags in output (HTML tokens escaped)', () => {
+    const html = pipe.transform('<script>alert(1)</script>') as string;
+    expect(html.toLowerCase()).not.toContain('<script>');
+    expect(html).toContain('&lt;');
+  });
+
+  it('should not emit javascript: links as clickable href', () => {
+    const html = pipe.transform('[clickme](javascript:alert(1))') as string;
+    expect(html).not.toMatch(/href=["']javascript:/i);
+  });
+
+  it('should add rel noopener on http links', () => {
+    const html = pipe.transform('[x](https://example.com)') as string;
+    expect(html).toContain('rel="noopener noreferrer"');
+    expect(html).toContain('target="_blank"');
+  });
+
+  it('should treat escaped newlines as real newlines (GFM breaks)', () => {
+    const html = pipe.transform('a\\nb') as string;
+    expect(html).toMatch(/<br\s*\/?>/i);
+  });
+
+  it('should coerce null to empty string', () => {
+    expect(pipe.transform(null)).toBe('');
+  });
 });

package/src/app/providers/app-config.service.ts

@@ -40,8 +40,10 @@ export class AppConfigService {
     }
     // END GET BASE URL and create absolute url of remoteConfigUrl //
     const that = this;
-    return this.http.get(urlConfigFile).toPromise().then(data => {
-      that.appConfig = data;
+    return this.http.get(urlConfigFile).toPromise().then((data: any) => {
+      if (data) {
+        that.appConfig = data;
+      }
       }).catch(err => {
         console.error('error loadAppConfig', err);
       });

package/src/app/providers/brand.service.spec.ts

@@ -1,12 +1,33 @@
+import { HttpTestingController, provideHttpClientTesting } from '@angular/common/http/testing';
+import { provideHttpClient, withInterceptorsFromDi } from '@angular/common/http';
 import { TestBed } from '@angular/core/testing';
+import { TranslateModule } from '@ngx-translate/core';
 
 import { BrandService } from './brand.service';
+import { AppConfigService } from './app-config.service';
+import { Globals } from '../utils/globals';
 
 describe('BrandService', () => {
-  beforeEach(() => TestBed.configureTestingModule({}));
+  let httpMock: HttpTestingController;
+
+  beforeEach(() => {
+    TestBed.configureTestingModule({
+      imports: [TranslateModule.forRoot()],
+      providers: [
+        BrandService,
+        Globals,
+        AppConfigService,
+        provideHttpClient(withInterceptorsFromDi()),
+        provideHttpClientTesting(),
+      ],
+    });
+    httpMock = TestBed.inject(HttpTestingController);
+  });
+
+  afterEach(() => httpMock.verify());
 
   it('should be created', () => {
-    const service: BrandService = TestBed.get(BrandService);
+    const service = TestBed.inject(BrandService);
     expect(service).toBeTruthy();
   });
 });

package/src/app/providers/brand.service.ts

@@ -60,7 +60,7 @@ export class BrandService {
     },
     WIDGET: {
       LOGO_CHAT: "https://smartflows-eu-public.s3.eu-central-1.amazonaws.com/imagicle-resources/SmartflowsLogo-NoText.svg",
-      POWERED_BY: "<a tabindex='-1' target='_blank href='https://www.imagicle.com/en/products/conversational-ai/'><img src='https://smartflows-eu-public.s3.eu-central-1.amazonaws.com/imagicle-resources/SmartflowsLogo-NoText.svg'/><span> Powered by Conversational AI</span></a>",
+      POWERED_BY: "<a target='_blank' rel='noopener noreferrer' href='https://www.imagicle.com/en/products/conversational-ai/'><img src='https://smartflows-eu-public.s3.eu-central-1.amazonaws.com/imagicle-resources/SmartflowsLogo-NoText.svg' alt=''/><span> Powered by Conversational AI</span></a>",
     },
     CDS: {
       META_TITLE:"Design Studio",