@commercetools-frontend/application-config 21.3.3 → 21.6.0

package/dist/commercetools-frontend-application-config.cjs.dev.js

@@ -27,6 +27,7 @@ var _possibleConstructorReturn = require('@babel/runtime-corejs3/helpers/possibl
 var _getPrototypeOf = require('@babel/runtime-corejs3/helpers/getPrototypeOf');
 var _wrapNativeSuper = require('@babel/runtime-corejs3/helpers/wrapNativeSuper');
 var _mapInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/map');
+var _Set = require('@babel/runtime-corejs3/core-js-stable/set');
 var Ajv = require('ajv');
 var _slicedToArray = require('@babel/runtime-corejs3/helpers/slicedToArray');
 var _trimInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/trim');
@@ -37,6 +38,8 @@ var _includesInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/i
 var uniq = require('lodash/uniq');
 var _startsWithInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/starts-with');
 var formatters = require('./formatters-41584280.cjs.dev.js');
+var createDOMPurify = require('dompurify');
+var jsdom$1 = require('jsdom');
 require('lodash/upperFirst');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { 'default': e }; }
@@ -56,6 +59,7 @@ var omitEmpty__default = /*#__PURE__*/_interopDefault(omitEmpty);
 var path__default = /*#__PURE__*/_interopDefault(path);
 var _Reflect$construct__default = /*#__PURE__*/_interopDefault(_Reflect$construct);
 var _mapInstanceProperty__default = /*#__PURE__*/_interopDefault(_mapInstanceProperty);
+var _Set__default = /*#__PURE__*/_interopDefault(_Set);
 var Ajv__default = /*#__PURE__*/_interopDefault(Ajv);
 var _trimInstanceProperty__default = /*#__PURE__*/_interopDefault(_trimInstanceProperty);
 var _JSON$stringify__default = /*#__PURE__*/_interopDefault(_JSON$stringify);
@@ -63,6 +67,7 @@ var _Object$values__default = /*#__PURE__*/_interopDefault(_Object$values);
 var _includesInstanceProperty__default = /*#__PURE__*/_interopDefault(_includesInstanceProperty);
 var uniq__default = /*#__PURE__*/_interopDefault(uniq);
 var _startsWithInstanceProperty__default = /*#__PURE__*/_interopDefault(_startsWithInstanceProperty);
+var createDOMPurify__default = /*#__PURE__*/_interopDefault(createDOMPurify);
 
 function _createSuper(Derived) { var hasNativeReflectConstruct = _isNativeReflectConstruct(); return function _createSuperInternal() { var Super = _getPrototypeOf(Derived), result; if (hasNativeReflectConstruct) { var NewTarget = _getPrototypeOf(this).constructor; result = _Reflect$construct__default["default"](Super, arguments, NewTarget); } else { result = Super.apply(this, arguments); } return _possibleConstructorReturn(this, result); }; }
 
@@ -182,7 +187,7 @@ var schemaJson = {
 			oneOf: [
 				{
 					type: "string",
-					pattern: "^[^\\-_]([0-9a-z]|[\\-_](?![\\-_])){2,64}[^\\-_]$"
+					pattern: "^[^\\-_#]([0-9a-z]|[\\-_](?![\\-_])){0,62}[^\\-_#]$"
 				},
 				{
 					$ref: "#/definitions/envVariablePlaceholder"
@@ -524,6 +529,21 @@ var validateConfig = function validateConfig(config) {
     throw new Error(printErrors(validate.errors));
   }
 };
+var validateSubmenuLinks = function validateSubmenuLinks(config) {
+  var _context4;
+
+  var uriPathSet = new _Set__default["default"]();
+
+  _forEachInstanceProperty__default["default"](_context4 = config.submenuLinks).call(_context4, function (_ref) {
+    var uriPath = _ref.uriPath;
+
+    if (uriPathSet.has(uriPath)) {
+      throw new Error('Duplicate URI path. Every submenu link must have a unique URI path value');
+    }
+
+    uriPathSet.add(uriPath);
+  });
+};
 
 /**
  * NOTE:
@@ -715,6 +735,19 @@ var getOrThrow = function getOrThrow(fn, errorMessage) {
   }
 };
 
+var jsdom = new jsdom$1.JSDOM(''); // @ts-expect-error: jsdom returns DOMWindow, which doesn't match Window dompurify expects
+
+var DOMPurify = createDOMPurify__default["default"](jsdom.window);
+function sanitizeSvg(data) {
+  return DOMPurify.sanitize(data, {
+    USE_PROFILES: {
+      svg: true
+    },
+    FORBID_ATTR: [// To avoid injection by using `style="filter:url(\"data:image/svg+xml,<svg`
+    'style']
+  });
+}
+
 function ownKeys$1(object, enumerableOnly) { var keys = _Object$keys__default["default"](object); if (_Object$getOwnPropertySymbols__default["default"]) { var symbols = _Object$getOwnPropertySymbols__default["default"](object); enumerableOnly && (symbols = _filterInstanceProperty__default["default"](symbols).call(symbols, function (sym) { return _Object$getOwnPropertyDescriptor__default["default"](object, sym).enumerable; })), keys.push.apply(keys, symbols); } return keys; }
 
 function _objectSpread$1(target) { for (var i = 1; i < arguments.length; i++) { var _context3, _context4; var source = null != arguments[i] ? arguments[i] : {}; i % 2 ? _forEachInstanceProperty__default["default"](_context3 = ownKeys$1(Object(source), !0)).call(_context3, function (key) { _defineProperty(target, key, source[key]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](target, _Object$getOwnPropertyDescriptors__default["default"](source)) : _forEachInstanceProperty__default["default"](_context4 = ownKeys$1(Object(source))).call(_context4, function (key) { _Object$defineProperty__default["default"](target, key, _Object$getOwnPropertyDescriptor__default["default"](source, key)); }); } return target; }
@@ -739,6 +772,7 @@ function transformCustomApplicationConfigToData(appConfig) {
   var _context2;
 
   var permissionKeys = formatters.entryPointUriPathToResourceAccesses(appConfig.entryPointUriPath);
+  validateSubmenuLinks(appConfig);
   return {
     id: appConfig.env.production.applicationId,
     name: appConfig.name,
@@ -752,7 +786,7 @@ function transformCustomApplicationConfigToData(appConfig) {
       name: permissionKeys.manage,
       oAuthScopes: appConfig.oAuthScopes.manage
     }],
-    icon: appConfig.icon,
+    icon: sanitizeSvg(appConfig.icon),
     mainMenuLink: appConfig.mainMenuLink,
     submenuLinks: _mapInstanceProperty__default["default"](_context2 = appConfig.submenuLinks).call(_context2, function (submenuLink) {
       return _objectSpread$1(_objectSpread$1({}, submenuLink), {}, {

package/dist/commercetools-frontend-application-config.cjs.prod.js

@@ -27,6 +27,7 @@ var _possibleConstructorReturn = require('@babel/runtime-corejs3/helpers/possibl
 var _getPrototypeOf = require('@babel/runtime-corejs3/helpers/getPrototypeOf');
 var _wrapNativeSuper = require('@babel/runtime-corejs3/helpers/wrapNativeSuper');
 var _mapInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/map');
+var _Set = require('@babel/runtime-corejs3/core-js-stable/set');
 var Ajv = require('ajv');
 var _slicedToArray = require('@babel/runtime-corejs3/helpers/slicedToArray');
 var _trimInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/trim');
@@ -37,6 +38,8 @@ var _includesInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/i
 var uniq = require('lodash/uniq');
 var _startsWithInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/starts-with');
 var formatters = require('./formatters-40251cfd.cjs.prod.js');
+var createDOMPurify = require('dompurify');
+var jsdom$1 = require('jsdom');
 require('lodash/upperFirst');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { 'default': e }; }
@@ -56,6 +59,7 @@ var omitEmpty__default = /*#__PURE__*/_interopDefault(omitEmpty);
 var path__default = /*#__PURE__*/_interopDefault(path);
 var _Reflect$construct__default = /*#__PURE__*/_interopDefault(_Reflect$construct);
 var _mapInstanceProperty__default = /*#__PURE__*/_interopDefault(_mapInstanceProperty);
+var _Set__default = /*#__PURE__*/_interopDefault(_Set);
 var Ajv__default = /*#__PURE__*/_interopDefault(Ajv);
 var _trimInstanceProperty__default = /*#__PURE__*/_interopDefault(_trimInstanceProperty);
 var _JSON$stringify__default = /*#__PURE__*/_interopDefault(_JSON$stringify);
@@ -63,6 +67,7 @@ var _Object$values__default = /*#__PURE__*/_interopDefault(_Object$values);
 var _includesInstanceProperty__default = /*#__PURE__*/_interopDefault(_includesInstanceProperty);
 var uniq__default = /*#__PURE__*/_interopDefault(uniq);
 var _startsWithInstanceProperty__default = /*#__PURE__*/_interopDefault(_startsWithInstanceProperty);
+var createDOMPurify__default = /*#__PURE__*/_interopDefault(createDOMPurify);
 
 function _createSuper(Derived) { var hasNativeReflectConstruct = _isNativeReflectConstruct(); return function _createSuperInternal() { var Super = _getPrototypeOf(Derived), result; if (hasNativeReflectConstruct) { var NewTarget = _getPrototypeOf(this).constructor; result = _Reflect$construct__default["default"](Super, arguments, NewTarget); } else { result = Super.apply(this, arguments); } return _possibleConstructorReturn(this, result); }; }
 
@@ -182,7 +187,7 @@ var schemaJson = {
 			oneOf: [
 				{
 					type: "string",
-					pattern: "^[^\\-_]([0-9a-z]|[\\-_](?![\\-_])){2,64}[^\\-_]$"
+					pattern: "^[^\\-_#]([0-9a-z]|[\\-_](?![\\-_])){0,62}[^\\-_#]$"
 				},
 				{
 					$ref: "#/definitions/envVariablePlaceholder"
@@ -524,6 +529,21 @@ var validateConfig = function validateConfig(config) {
     throw new Error(printErrors(validate.errors));
   }
 };
+var validateSubmenuLinks = function validateSubmenuLinks(config) {
+  var _context4;
+
+  var uriPathSet = new _Set__default["default"]();
+
+  _forEachInstanceProperty__default["default"](_context4 = config.submenuLinks).call(_context4, function (_ref) {
+    var uriPath = _ref.uriPath;
+
+    if (uriPathSet.has(uriPath)) {
+      throw new Error('Duplicate URI path. Every submenu link must have a unique URI path value');
+    }
+
+    uriPathSet.add(uriPath);
+  });
+};
 
 /**
  * NOTE:
@@ -715,6 +735,19 @@ var getOrThrow = function getOrThrow(fn, errorMessage) {
   }
 };
 
+var jsdom = new jsdom$1.JSDOM(''); // @ts-expect-error: jsdom returns DOMWindow, which doesn't match Window dompurify expects
+
+var DOMPurify = createDOMPurify__default["default"](jsdom.window);
+function sanitizeSvg(data) {
+  return DOMPurify.sanitize(data, {
+    USE_PROFILES: {
+      svg: true
+    },
+    FORBID_ATTR: [// To avoid injection by using `style="filter:url(\"data:image/svg+xml,<svg`
+    'style']
+  });
+}
+
 function ownKeys$1(object, enumerableOnly) { var keys = _Object$keys__default["default"](object); if (_Object$getOwnPropertySymbols__default["default"]) { var symbols = _Object$getOwnPropertySymbols__default["default"](object); enumerableOnly && (symbols = _filterInstanceProperty__default["default"](symbols).call(symbols, function (sym) { return _Object$getOwnPropertyDescriptor__default["default"](object, sym).enumerable; })), keys.push.apply(keys, symbols); } return keys; }
 
 function _objectSpread$1(target) { for (var i = 1; i < arguments.length; i++) { var _context3, _context4; var source = null != arguments[i] ? arguments[i] : {}; i % 2 ? _forEachInstanceProperty__default["default"](_context3 = ownKeys$1(Object(source), !0)).call(_context3, function (key) { _defineProperty(target, key, source[key]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](target, _Object$getOwnPropertyDescriptors__default["default"](source)) : _forEachInstanceProperty__default["default"](_context4 = ownKeys$1(Object(source))).call(_context4, function (key) { _Object$defineProperty__default["default"](target, key, _Object$getOwnPropertyDescriptor__default["default"](source, key)); }); } return target; }
@@ -739,6 +772,7 @@ function transformCustomApplicationConfigToData(appConfig) {
   var _context2;
 
   var permissionKeys = formatters.entryPointUriPathToResourceAccesses(appConfig.entryPointUriPath);
+  validateSubmenuLinks(appConfig);
   return {
     id: appConfig.env.production.applicationId,
     name: appConfig.name,
@@ -752,7 +786,7 @@ function transformCustomApplicationConfigToData(appConfig) {
       name: permissionKeys.manage,
       oAuthScopes: appConfig.oAuthScopes.manage
     }],
-    icon: appConfig.icon,
+    icon: sanitizeSvg(appConfig.icon),
     mainMenuLink: appConfig.mainMenuLink,
     submenuLinks: _mapInstanceProperty__default["default"](_context2 = appConfig.submenuLinks).call(_context2, function (submenuLink) {
       return _objectSpread$1(_objectSpread$1({}, submenuLink), {}, {

package/dist/commercetools-frontend-application-config.esm.js

@@ -23,6 +23,7 @@ import _possibleConstructorReturn from '@babel/runtime-corejs3/helpers/esm/possi
 import _getPrototypeOf from '@babel/runtime-corejs3/helpers/esm/getPrototypeOf';
 import _wrapNativeSuper from '@babel/runtime-corejs3/helpers/esm/wrapNativeSuper';
 import _mapInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/map';
+import _Set from '@babel/runtime-corejs3/core-js-stable/set';
 import Ajv from 'ajv';
 import _slicedToArray from '@babel/runtime-corejs3/helpers/esm/slicedToArray';
 import _trimInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/trim';
@@ -33,6 +34,8 @@ import _includesInstanceProperty from '@babel/runtime-corejs3/core-js-stable/ins
 import uniq from 'lodash/uniq';
 import _startsWithInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/starts-with';
 import { e as entryPointUriPathToResourceAccesses } from './formatters-62af6993.esm.js';
+import createDOMPurify from 'dompurify';
+import { JSDOM } from 'jsdom';
 import 'lodash/upperFirst';
 
 function _createSuper(Derived) { var hasNativeReflectConstruct = _isNativeReflectConstruct(); return function _createSuperInternal() { var Super = _getPrototypeOf(Derived), result; if (hasNativeReflectConstruct) { var NewTarget = _getPrototypeOf(this).constructor; result = _Reflect$construct(Super, arguments, NewTarget); } else { result = Super.apply(this, arguments); } return _possibleConstructorReturn(this, result); }; }
@@ -153,7 +156,7 @@ var schemaJson = {
 			oneOf: [
 				{
 					type: "string",
-					pattern: "^[^\\-_]([0-9a-z]|[\\-_](?![\\-_])){2,64}[^\\-_]$"
+					pattern: "^[^\\-_#]([0-9a-z]|[\\-_](?![\\-_])){0,62}[^\\-_#]$"
 				},
 				{
 					$ref: "#/definitions/envVariablePlaceholder"
@@ -495,6 +498,21 @@ var validateConfig = function validateConfig(config) {
     throw new Error(printErrors(validate.errors));
   }
 };
+var validateSubmenuLinks = function validateSubmenuLinks(config) {
+  var _context4;
+
+  var uriPathSet = new _Set();
+
+  _forEachInstanceProperty(_context4 = config.submenuLinks).call(_context4, function (_ref) {
+    var uriPath = _ref.uriPath;
+
+    if (uriPathSet.has(uriPath)) {
+      throw new Error('Duplicate URI path. Every submenu link must have a unique URI path value');
+    }
+
+    uriPathSet.add(uriPath);
+  });
+};
 
 /**
  * NOTE:
@@ -686,6 +704,19 @@ var getOrThrow = function getOrThrow(fn, errorMessage) {
   }
 };
 
+var jsdom = new JSDOM(''); // @ts-expect-error: jsdom returns DOMWindow, which doesn't match Window dompurify expects
+
+var DOMPurify = createDOMPurify(jsdom.window);
+function sanitizeSvg(data) {
+  return DOMPurify.sanitize(data, {
+    USE_PROFILES: {
+      svg: true
+    },
+    FORBID_ATTR: [// To avoid injection by using `style="filter:url(\"data:image/svg+xml,<svg`
+    'style']
+  });
+}
+
 function ownKeys$1(object, enumerableOnly) { var keys = _Object$keys(object); if (_Object$getOwnPropertySymbols) { var symbols = _Object$getOwnPropertySymbols(object); enumerableOnly && (symbols = _filterInstanceProperty(symbols).call(symbols, function (sym) { return _Object$getOwnPropertyDescriptor(object, sym).enumerable; })), keys.push.apply(keys, symbols); } return keys; }
 
 function _objectSpread$1(target) { for (var i = 1; i < arguments.length; i++) { var _context3, _context4; var source = null != arguments[i] ? arguments[i] : {}; i % 2 ? _forEachInstanceProperty(_context3 = ownKeys$1(Object(source), !0)).call(_context3, function (key) { _defineProperty(target, key, source[key]); }) : _Object$getOwnPropertyDescriptors ? _Object$defineProperties(target, _Object$getOwnPropertyDescriptors(source)) : _forEachInstanceProperty(_context4 = ownKeys$1(Object(source))).call(_context4, function (key) { _Object$defineProperty(target, key, _Object$getOwnPropertyDescriptor(source, key)); }); } return target; }
@@ -710,6 +741,7 @@ function transformCustomApplicationConfigToData(appConfig) {
   var _context2;
 
   var permissionKeys = entryPointUriPathToResourceAccesses(appConfig.entryPointUriPath);
+  validateSubmenuLinks(appConfig);
   return {
     id: appConfig.env.production.applicationId,
     name: appConfig.name,
@@ -723,7 +755,7 @@ function transformCustomApplicationConfigToData(appConfig) {
       name: permissionKeys.manage,
       oAuthScopes: appConfig.oAuthScopes.manage
     }],
-    icon: appConfig.icon,
+    icon: sanitizeSvg(appConfig.icon),
     mainMenuLink: appConfig.mainMenuLink,
     submenuLinks: _mapInstanceProperty(_context2 = appConfig.submenuLinks).call(_context2, function (submenuLink) {
       return _objectSpread$1(_objectSpread$1({}, submenuLink), {}, {

package/dist/declarations/src/sanitize-svg.d.ts

@@ -0,0 +1 @@
+export default function sanitizeSvg(data: string): string;

package/dist/declarations/src/types.d.ts

@@ -34,9 +34,9 @@ export declare type CustomApplicationData = {
     mainMenuLink: CustomApplicationMenuLinkData;
     submenuLinks: CustomApplicationSubmenuLinkData[];
 };
-export declare type ApplicationRuntimeConfig = {
+export declare type ApplicationRuntimeConfig<AdditionalEnvironmentProperties extends {} = {}> = {
     data: CustomApplicationData;
-    env: ApplicationWindow['app'];
+    env: AdditionalEnvironmentProperties & ApplicationWindow['app'];
     headers: JSONSchemaForCustomApplicationConfigurationFiles['headers'];
 };
 export declare type LoadingConfigOptions = {

package/dist/declarations/src/validations.d.ts

@@ -0,0 +1,3 @@
+import type { JSONSchemaForCustomApplicationConfigurationFiles } from './schema';
+export declare const validateConfig: (config: JSONSchemaForCustomApplicationConfigurationFiles) => void;
+export declare const validateSubmenuLinks: (config: JSONSchemaForCustomApplicationConfigurationFiles) => void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commercetools-frontend/application-config",
-  "version": "21.3.3",
+  "version": "21.6.0",
   "description": "Configuration utilities for building Custom Applications",
   "bugs": "https://github.com/commercetools/merchant-center-application-kit/issues",
   "repository": {
@@ -33,16 +33,19 @@
   },
   "dependencies": {
     "@babel/register": "^7.17.7",
-    "@babel/runtime": "^7.17.8",
-    "@babel/runtime-corejs3": "^7.17.8",
-    "@commercetools-frontend/babel-preset-mc-app": "21.3.2",
+    "@babel/runtime": "^7.17.9",
+    "@babel/runtime-corejs3": "^7.17.9",
+    "@commercetools-frontend/babel-preset-mc-app": "21.3.4",
     "ajv": "8.11.0",
     "core-js": "^3.21.1",
     "cosmiconfig": "7.0.1",
+    "dompurify": "^2.3.6",
+    "jsdom": "^19.0.0",
     "lodash": "4.17.21",
     "omit-empty-es": "1.1.3"
   },
   "devDependencies": {
+    "@types/jsdom": "^16.2.14",
     "json-schema-to-typescript": "10.1.5",
     "shelljs": "0.8.5"
   },

package/schema.json

@@ -30,7 +30,7 @@
       "oneOf": [
         {
           "type": "string",
-          "pattern": "^[^\\-_]([0-9a-z]|[\\-_](?![\\-_])){2,64}[^\\-_]$"
+          "pattern": "^[^\\-_#]([0-9a-z]|[\\-_](?![\\-_])){0,62}[^\\-_#]$"
         },
         {
           "$ref": "#/definitions/envVariablePlaceholder"

package/dist/declarations/src/validate-config.d.ts

@@ -1,3 +0,0 @@
-import type { JSONSchemaForCustomApplicationConfigurationFiles } from './schema';
-declare const validateConfig: (config: JSONSchemaForCustomApplicationConfigurationFiles) => void;
-export default validateConfig;