@chat21/chat21-web-widget 5.1.33 → 5.1.34-rc1

package/src/app/modals/confirm-close/confirm-close.component.ts

@@ -1,4 +1,4 @@
-import { Component, ElementRef, EventEmitter, Input, OnInit, Output, SimpleChange, SimpleChanges, ViewChild, OnDestroy } from '@angular/core';
+import { Component, ElementRef, EventEmitter, HostListener, Input, OnInit, Output, SimpleChange, SimpleChanges, ViewChild, OnDestroy } from '@angular/core';
 import { LoggerService } from 'src/chat21-core/providers/abstract/logger.service';
 import { LoggerInstance } from 'src/chat21-core/providers/logger/loggerInstance';
 
@@ -25,6 +25,13 @@ export class ConfirmCloseComponent implements OnInit{
     // this.dialog.showModal();
   }
 
+  @HostListener('keydown.escape', ['$event'])
+  onEscape(event: KeyboardEvent){
+    event.preventDefault();
+    event.stopPropagation();
+    this.onBack();
+  }
+
   ngOnChanges(changes: SimpleChanges){
     if(changes && 
       changes['conversationId'] && 

package/src/app/pipe/html-entites-encode.pipe.spec.ts

@@ -1,8 +1,41 @@
 import { HtmlEntitiesEncodePipe } from './html-entities-encode.pipe';
 
 describe('HtmlEntitiesEncodePipe', () => {
-  it('create an instance', () => {
-    const pipe = new HtmlEntitiesEncodePipe();
+  let pipe: HtmlEntitiesEncodePipe;
+
+  beforeEach(() => {
+    pipe = new HtmlEntitiesEncodePipe();
+  });
+
+  it('should create', () => {
     expect(pipe).toBeTruthy();
   });
+
+  it('should encode angle brackets so raw HTML tags are not preserved (XSS mitigation)', () => {
+    const malicious = '<script>alert(1)</script><img src=x onerror=alert(1)>';
+    const out = pipe.transform(malicious);
+    expect(out).not.toContain('<script');
+    expect(out).not.toContain('<img');
+    expect(out).toContain('&lt;');
+    expect(out).toContain('&gt;');
+  });
+
+  it('should encode double quotes for attribute injection contexts', () => {
+    expect(pipe.transform('say "hello"')).toContain('&quot;');
+  });
+
+  it('should replace newlines with <br> via replaceEndOfLine', () => {
+    const out = pipe.transform('line1\nline2');
+    expect(out).toContain('<br>');
+    expect(out).toContain('line1');
+    expect(out).toContain('line2');
+  });
+
+  it('should trim leading and trailing whitespace', () => {
+    expect(pipe.transform('  abc  ')).toBe('abc');
+  });
+
+  it('should coerce non-string input to string before encoding', () => {
+    expect(pipe.transform(123 as any)).toBe('123');
+  });
 });

package/src/app/pipe/marked.pipe.spec.ts

@@ -1,8 +1,44 @@
 import { MarkedPipe } from './marked.pipe';
 
 describe('MarkedPipe', () => {
-  it('create an instance', () => {
-    const pipe = new MarkedPipe();
+  let pipe: MarkedPipe;
+
+  beforeEach(() => {
+    pipe = new MarkedPipe();
+  });
+
+  it('should create', () => {
     expect(pipe).toBeTruthy();
   });
+
+  it('should render markdown bold as HTML strong', () => {
+    const html = pipe.transform('Hello **world**') as string;
+    expect(html).toMatch(/<strong>world<\/strong>|<b>world<\/b>/);
+  });
+
+  it('should not leave raw script tags in output (HTML tokens escaped)', () => {
+    const html = pipe.transform('<script>alert(1)</script>') as string;
+    expect(html.toLowerCase()).not.toContain('<script>');
+    expect(html).toContain('&lt;');
+  });
+
+  it('should not emit javascript: links as clickable href', () => {
+    const html = pipe.transform('[clickme](javascript:alert(1))') as string;
+    expect(html).not.toMatch(/href=["']javascript:/i);
+  });
+
+  it('should add rel noopener on http links', () => {
+    const html = pipe.transform('[x](https://example.com)') as string;
+    expect(html).toContain('rel="noopener noreferrer"');
+    expect(html).toContain('target="_blank"');
+  });
+
+  it('should treat escaped newlines as real newlines (GFM breaks)', () => {
+    const html = pipe.transform('a\\nb') as string;
+    expect(html).toMatch(/<br\s*\/?>/i);
+  });
+
+  it('should coerce null to empty string', () => {
+    expect(pipe.transform(null)).toBe('');
+  });
 });

package/src/app/pipe/marked.pipe.ts

@@ -5,61 +5,71 @@ import { marked, Tokens } from 'marked';
   name: 'marked'
 })
 export class MarkedPipe implements PipeTransform {
+  private static renderer: any = null;
 
-  transform(value: any): string {
+  private static getRenderer(): any {
+    if (!MarkedPipe.renderer) {
+      const renderer = new marked.Renderer();
 
-    const input =
-      typeof value === 'string'
-        ? value
-        : (value === null || value === undefined) ? '' : String(value);
+      /* --------------------------------------------------
+         🔐 1. NON renderizzare HTML raw
+      -------------------------------------------------- */
+      renderer.html = function(token: Tokens.HTML | Tokens.Tag): string {
+        const html = 'text' in token ? token.text : '';
 
-    const inputWithNewlines = input.replace(/\\n/g, '\n');
+        return html
+          .replace(/&/g, '&')
+          .replace(/</g, '&lt;')
+          .replace(/>/g, '&gt;');
+      };
+
+      /* --------------------------------------------------
+         🔐 2. Link sicuri
+      -------------------------------------------------- */
+      const originalLinkRenderer = renderer.link.bind(renderer);
+
+      const dangerousProtocols = [
+        /^javascript:/i,
+        /^data:/i,
+        /^vbscript:/i
+      ];
 
-    const renderer = new marked.Renderer();
+      renderer.link = function({ href, title, tokens }: any) {
 
-    /* --------------------------------------------------
-       🔐 1. NON renderizzare HTML raw
-    -------------------------------------------------- */
-    renderer.html = function(token: Tokens.HTML | Tokens.Tag): string {
-      const html = 'text' in token ? token.text : '';
+        const normalized = (href || '').trim();
 
-      return html
-        .replace(/&/g, '&amp;')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;');
-    };
+        const isDangerous = dangerousProtocols.some(pattern =>
+          pattern.test(normalized)
+        );
 
-    /* --------------------------------------------------
-       🔐 2. Link sicuri
-    -------------------------------------------------- */
-    const originalLinkRenderer = renderer.link.bind(renderer);
+        if (isDangerous) {
+          return tokens ? tokens.map((t: any) => t.raw).join('') : href || '';
+        }
 
-    const dangerousProtocols = [
-      /^javascript:/i,
-      /^data:/i,
-      /^vbscript:/i
-    ];
+        const html = originalLinkRenderer({ href, title, tokens });
 
-    renderer.link = function({ href, title, tokens }) {
+        // aggiunge sicurezza ai link
+        return html.replace(
+          '<a ',
+          '<a target="_blank" rel="noopener noreferrer" '
+        );
+      };
 
-      const normalized = (href || '').trim();
+      MarkedPipe.renderer = renderer;
+    }
+    return MarkedPipe.renderer;
+  }
 
-      const isDangerous = dangerousProtocols.some(pattern =>
-        pattern.test(normalized)
-      );
+  transform(value: any): string {
 
-      if (isDangerous) {
-        return tokens ? tokens.map(t => t.raw).join('') : href || '';
-      }
+    const input =
+      typeof value === 'string'
+        ? value
+        : (value === null || value === undefined) ? '' : String(value);
 
-      const html = originalLinkRenderer({ href, title, tokens });
+    const inputWithNewlines = input.replace(/\\n/g, '\n');
 
-      // aggiunge sicurezza ai link
-      return html.replace(
-        '<a ',
-        '<a target="_blank" rel="noopener noreferrer" '
-      );
-    };
+    const renderer = MarkedPipe.getRenderer();
 
     marked.setOptions({
       renderer,

package/src/app/providers/app-config.service.ts

@@ -40,8 +40,10 @@ export class AppConfigService {
     }
     // END GET BASE URL and create absolute url of remoteConfigUrl //
     const that = this;
-    return this.http.get(urlConfigFile).toPromise().then(data => {
-      that.appConfig = data;
+    return this.http.get(urlConfigFile).toPromise().then((data: any) => {
+      if (data) {
+        that.appConfig = data;
+      }
       }).catch(err => {
         console.error('error loadAppConfig', err);
       });

package/src/app/providers/brand.service.spec.ts

@@ -1,12 +1,33 @@
+import { HttpTestingController, provideHttpClientTesting } from '@angular/common/http/testing';
+import { provideHttpClient, withInterceptorsFromDi } from '@angular/common/http';
 import { TestBed } from '@angular/core/testing';
+import { TranslateModule } from '@ngx-translate/core';
 
 import { BrandService } from './brand.service';
+import { AppConfigService } from './app-config.service';
+import { Globals } from '../utils/globals';
 
 describe('BrandService', () => {
-  beforeEach(() => TestBed.configureTestingModule({}));
+  let httpMock: HttpTestingController;
+
+  beforeEach(() => {
+    TestBed.configureTestingModule({
+      imports: [TranslateModule.forRoot()],
+      providers: [
+        BrandService,
+        Globals,
+        AppConfigService,
+        provideHttpClient(withInterceptorsFromDi()),
+        provideHttpClientTesting(),
+      ],
+    });
+    httpMock = TestBed.inject(HttpTestingController);
+  });
+
+  afterEach(() => httpMock.verify());
 
   it('should be created', () => {
-    const service: BrandService = TestBed.get(BrandService);
+    const service = TestBed.inject(BrandService);
     expect(service).toBeTruthy();
   });
 });

package/src/app/providers/brand.service.ts

@@ -60,7 +60,7 @@ export class BrandService {
     },
     WIDGET: {
       LOGO_CHAT: "https://smartflows-eu-public.s3.eu-central-1.amazonaws.com/imagicle-resources/SmartflowsLogo-NoText.svg",
-      POWERED_BY: "<a tabindex='-1' target='_blank href='https://www.imagicle.com/en/products/conversational-ai/'><img src='https://smartflows-eu-public.s3.eu-central-1.amazonaws.com/imagicle-resources/SmartflowsLogo-NoText.svg'/><span> Powered by Conversational AI</span></a>",
+      POWERED_BY: "<a target='_blank' rel='noopener noreferrer' href='https://www.imagicle.com/en/products/conversational-ai/'><img src='https://smartflows-eu-public.s3.eu-central-1.amazonaws.com/imagicle-resources/SmartflowsLogo-NoText.svg' alt=''/><span> Powered by Conversational AI</span></a>",
     },
     CDS: {
       META_TITLE:"Design Studio",