@commercetools-frontend/application-config 21.5.0 → 21.6.0

package/dist/commercetools-frontend-application-config.cjs.dev.js

@@ -38,6 +38,8 @@ var _includesInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/i
 var uniq = require('lodash/uniq');
 var _startsWithInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/starts-with');
 var formatters = require('./formatters-41584280.cjs.dev.js');
+var createDOMPurify = require('dompurify');
+var jsdom$1 = require('jsdom');
 require('lodash/upperFirst');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { 'default': e }; }
@@ -65,6 +67,7 @@ var _Object$values__default = /*#__PURE__*/_interopDefault(_Object$values);
 var _includesInstanceProperty__default = /*#__PURE__*/_interopDefault(_includesInstanceProperty);
 var uniq__default = /*#__PURE__*/_interopDefault(uniq);
 var _startsWithInstanceProperty__default = /*#__PURE__*/_interopDefault(_startsWithInstanceProperty);
+var createDOMPurify__default = /*#__PURE__*/_interopDefault(createDOMPurify);
 
 function _createSuper(Derived) { var hasNativeReflectConstruct = _isNativeReflectConstruct(); return function _createSuperInternal() { var Super = _getPrototypeOf(Derived), result; if (hasNativeReflectConstruct) { var NewTarget = _getPrototypeOf(this).constructor; result = _Reflect$construct__default["default"](Super, arguments, NewTarget); } else { result = Super.apply(this, arguments); } return _possibleConstructorReturn(this, result); }; }
 
@@ -184,7 +187,7 @@ var schemaJson = {
 			oneOf: [
 				{
 					type: "string",
-					pattern: "^[^\\-_]([0-9a-z]|[\\-_](?![\\-_])){2,64}[^\\-_]$"
+					pattern: "^[^\\-_#]([0-9a-z]|[\\-_](?![\\-_])){0,62}[^\\-_#]$"
 				},
 				{
 					$ref: "#/definitions/envVariablePlaceholder"
@@ -732,6 +735,19 @@ var getOrThrow = function getOrThrow(fn, errorMessage) {
   }
 };
 
+var jsdom = new jsdom$1.JSDOM(''); // @ts-expect-error: jsdom returns DOMWindow, which doesn't match Window dompurify expects
+
+var DOMPurify = createDOMPurify__default["default"](jsdom.window);
+function sanitizeSvg(data) {
+  return DOMPurify.sanitize(data, {
+    USE_PROFILES: {
+      svg: true
+    },
+    FORBID_ATTR: [// To avoid injection by using `style="filter:url(\"data:image/svg+xml,<svg`
+    'style']
+  });
+}
+
 function ownKeys$1(object, enumerableOnly) { var keys = _Object$keys__default["default"](object); if (_Object$getOwnPropertySymbols__default["default"]) { var symbols = _Object$getOwnPropertySymbols__default["default"](object); enumerableOnly && (symbols = _filterInstanceProperty__default["default"](symbols).call(symbols, function (sym) { return _Object$getOwnPropertyDescriptor__default["default"](object, sym).enumerable; })), keys.push.apply(keys, symbols); } return keys; }
 
 function _objectSpread$1(target) { for (var i = 1; i < arguments.length; i++) { var _context3, _context4; var source = null != arguments[i] ? arguments[i] : {}; i % 2 ? _forEachInstanceProperty__default["default"](_context3 = ownKeys$1(Object(source), !0)).call(_context3, function (key) { _defineProperty(target, key, source[key]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](target, _Object$getOwnPropertyDescriptors__default["default"](source)) : _forEachInstanceProperty__default["default"](_context4 = ownKeys$1(Object(source))).call(_context4, function (key) { _Object$defineProperty__default["default"](target, key, _Object$getOwnPropertyDescriptor__default["default"](source, key)); }); } return target; }
@@ -770,7 +786,7 @@ function transformCustomApplicationConfigToData(appConfig) {
       name: permissionKeys.manage,
       oAuthScopes: appConfig.oAuthScopes.manage
     }],
-    icon: appConfig.icon,
+    icon: sanitizeSvg(appConfig.icon),
     mainMenuLink: appConfig.mainMenuLink,
     submenuLinks: _mapInstanceProperty__default["default"](_context2 = appConfig.submenuLinks).call(_context2, function (submenuLink) {
       return _objectSpread$1(_objectSpread$1({}, submenuLink), {}, {

package/dist/commercetools-frontend-application-config.cjs.prod.js

@@ -38,6 +38,8 @@ var _includesInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/i
 var uniq = require('lodash/uniq');
 var _startsWithInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/starts-with');
 var formatters = require('./formatters-40251cfd.cjs.prod.js');
+var createDOMPurify = require('dompurify');
+var jsdom$1 = require('jsdom');
 require('lodash/upperFirst');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { 'default': e }; }
@@ -65,6 +67,7 @@ var _Object$values__default = /*#__PURE__*/_interopDefault(_Object$values);
 var _includesInstanceProperty__default = /*#__PURE__*/_interopDefault(_includesInstanceProperty);
 var uniq__default = /*#__PURE__*/_interopDefault(uniq);
 var _startsWithInstanceProperty__default = /*#__PURE__*/_interopDefault(_startsWithInstanceProperty);
+var createDOMPurify__default = /*#__PURE__*/_interopDefault(createDOMPurify);
 
 function _createSuper(Derived) { var hasNativeReflectConstruct = _isNativeReflectConstruct(); return function _createSuperInternal() { var Super = _getPrototypeOf(Derived), result; if (hasNativeReflectConstruct) { var NewTarget = _getPrototypeOf(this).constructor; result = _Reflect$construct__default["default"](Super, arguments, NewTarget); } else { result = Super.apply(this, arguments); } return _possibleConstructorReturn(this, result); }; }
 
@@ -184,7 +187,7 @@ var schemaJson = {
 			oneOf: [
 				{
 					type: "string",
-					pattern: "^[^\\-_]([0-9a-z]|[\\-_](?![\\-_])){2,64}[^\\-_]$"
+					pattern: "^[^\\-_#]([0-9a-z]|[\\-_](?![\\-_])){0,62}[^\\-_#]$"
 				},
 				{
 					$ref: "#/definitions/envVariablePlaceholder"
@@ -732,6 +735,19 @@ var getOrThrow = function getOrThrow(fn, errorMessage) {
   }
 };
 
+var jsdom = new jsdom$1.JSDOM(''); // @ts-expect-error: jsdom returns DOMWindow, which doesn't match Window dompurify expects
+
+var DOMPurify = createDOMPurify__default["default"](jsdom.window);
+function sanitizeSvg(data) {
+  return DOMPurify.sanitize(data, {
+    USE_PROFILES: {
+      svg: true
+    },
+    FORBID_ATTR: [// To avoid injection by using `style="filter:url(\"data:image/svg+xml,<svg`
+    'style']
+  });
+}
+
 function ownKeys$1(object, enumerableOnly) { var keys = _Object$keys__default["default"](object); if (_Object$getOwnPropertySymbols__default["default"]) { var symbols = _Object$getOwnPropertySymbols__default["default"](object); enumerableOnly && (symbols = _filterInstanceProperty__default["default"](symbols).call(symbols, function (sym) { return _Object$getOwnPropertyDescriptor__default["default"](object, sym).enumerable; })), keys.push.apply(keys, symbols); } return keys; }
 
 function _objectSpread$1(target) { for (var i = 1; i < arguments.length; i++) { var _context3, _context4; var source = null != arguments[i] ? arguments[i] : {}; i % 2 ? _forEachInstanceProperty__default["default"](_context3 = ownKeys$1(Object(source), !0)).call(_context3, function (key) { _defineProperty(target, key, source[key]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](target, _Object$getOwnPropertyDescriptors__default["default"](source)) : _forEachInstanceProperty__default["default"](_context4 = ownKeys$1(Object(source))).call(_context4, function (key) { _Object$defineProperty__default["default"](target, key, _Object$getOwnPropertyDescriptor__default["default"](source, key)); }); } return target; }
@@ -770,7 +786,7 @@ function transformCustomApplicationConfigToData(appConfig) {
       name: permissionKeys.manage,
       oAuthScopes: appConfig.oAuthScopes.manage
     }],
-    icon: appConfig.icon,
+    icon: sanitizeSvg(appConfig.icon),
     mainMenuLink: appConfig.mainMenuLink,
     submenuLinks: _mapInstanceProperty__default["default"](_context2 = appConfig.submenuLinks).call(_context2, function (submenuLink) {
       return _objectSpread$1(_objectSpread$1({}, submenuLink), {}, {

package/dist/commercetools-frontend-application-config.esm.js

@@ -34,6 +34,8 @@ import _includesInstanceProperty from '@babel/runtime-corejs3/core-js-stable/ins
 import uniq from 'lodash/uniq';
 import _startsWithInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/starts-with';
 import { e as entryPointUriPathToResourceAccesses } from './formatters-62af6993.esm.js';
+import createDOMPurify from 'dompurify';
+import { JSDOM } from 'jsdom';
 import 'lodash/upperFirst';
 
 function _createSuper(Derived) { var hasNativeReflectConstruct = _isNativeReflectConstruct(); return function _createSuperInternal() { var Super = _getPrototypeOf(Derived), result; if (hasNativeReflectConstruct) { var NewTarget = _getPrototypeOf(this).constructor; result = _Reflect$construct(Super, arguments, NewTarget); } else { result = Super.apply(this, arguments); } return _possibleConstructorReturn(this, result); }; }
@@ -154,7 +156,7 @@ var schemaJson = {
 			oneOf: [
 				{
 					type: "string",
-					pattern: "^[^\\-_]([0-9a-z]|[\\-_](?![\\-_])){2,64}[^\\-_]$"
+					pattern: "^[^\\-_#]([0-9a-z]|[\\-_](?![\\-_])){0,62}[^\\-_#]$"
 				},
 				{
 					$ref: "#/definitions/envVariablePlaceholder"
@@ -702,6 +704,19 @@ var getOrThrow = function getOrThrow(fn, errorMessage) {
   }
 };
 
+var jsdom = new JSDOM(''); // @ts-expect-error: jsdom returns DOMWindow, which doesn't match Window dompurify expects
+
+var DOMPurify = createDOMPurify(jsdom.window);
+function sanitizeSvg(data) {
+  return DOMPurify.sanitize(data, {
+    USE_PROFILES: {
+      svg: true
+    },
+    FORBID_ATTR: [// To avoid injection by using `style="filter:url(\"data:image/svg+xml,<svg`
+    'style']
+  });
+}
+
 function ownKeys$1(object, enumerableOnly) { var keys = _Object$keys(object); if (_Object$getOwnPropertySymbols) { var symbols = _Object$getOwnPropertySymbols(object); enumerableOnly && (symbols = _filterInstanceProperty(symbols).call(symbols, function (sym) { return _Object$getOwnPropertyDescriptor(object, sym).enumerable; })), keys.push.apply(keys, symbols); } return keys; }
 
 function _objectSpread$1(target) { for (var i = 1; i < arguments.length; i++) { var _context3, _context4; var source = null != arguments[i] ? arguments[i] : {}; i % 2 ? _forEachInstanceProperty(_context3 = ownKeys$1(Object(source), !0)).call(_context3, function (key) { _defineProperty(target, key, source[key]); }) : _Object$getOwnPropertyDescriptors ? _Object$defineProperties(target, _Object$getOwnPropertyDescriptors(source)) : _forEachInstanceProperty(_context4 = ownKeys$1(Object(source))).call(_context4, function (key) { _Object$defineProperty(target, key, _Object$getOwnPropertyDescriptor(source, key)); }); } return target; }
@@ -740,7 +755,7 @@ function transformCustomApplicationConfigToData(appConfig) {
       name: permissionKeys.manage,
       oAuthScopes: appConfig.oAuthScopes.manage
     }],
-    icon: appConfig.icon,
+    icon: sanitizeSvg(appConfig.icon),
     mainMenuLink: appConfig.mainMenuLink,
     submenuLinks: _mapInstanceProperty(_context2 = appConfig.submenuLinks).call(_context2, function (submenuLink) {
       return _objectSpread$1(_objectSpread$1({}, submenuLink), {}, {

package/dist/declarations/src/sanitize-svg.d.ts

@@ -0,0 +1 @@
+export default function sanitizeSvg(data: string): string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commercetools-frontend/application-config",
-  "version": "21.5.0",
+  "version": "21.6.0",
   "description": "Configuration utilities for building Custom Applications",
   "bugs": "https://github.com/commercetools/merchant-center-application-kit/issues",
   "repository": {
@@ -39,10 +39,13 @@
     "ajv": "8.11.0",
     "core-js": "^3.21.1",
     "cosmiconfig": "7.0.1",
+    "dompurify": "^2.3.6",
+    "jsdom": "^19.0.0",
     "lodash": "4.17.21",
     "omit-empty-es": "1.1.3"
   },
   "devDependencies": {
+    "@types/jsdom": "^16.2.14",
     "json-schema-to-typescript": "10.1.5",
     "shelljs": "0.8.5"
   },

package/schema.json

@@ -30,7 +30,7 @@
       "oneOf": [
         {
           "type": "string",
-          "pattern": "^[^\\-_]([0-9a-z]|[\\-_](?![\\-_])){2,64}[^\\-_]$"
+          "pattern": "^[^\\-_#]([0-9a-z]|[\\-_](?![\\-_])){0,62}[^\\-_#]$"
         },
         {
           "$ref": "#/definitions/envVariablePlaceholder"