@commercetools-frontend/application-config 21.5.0 → 21.8.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2020 commercetools GmbH
+Copyright (c) commercetools GmbH
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/client.d.ts

@@ -0,0 +1,19 @@
+type CSSModuleClasses = { readonly [key: string]: string };
+
+declare module '*.mod.css' {
+  const classes: CSSModuleClasses;
+  export default classes;
+}
+declare module '*.module.css' {
+  const classes: CSSModuleClasses;
+  export default classes;
+}
+
+declare module '*.png' {
+  const src: string;
+  export default src;
+}
+declare module '*.svg' {
+  const src: string;
+  export default src;
+}

package/dist/commercetools-frontend-application-config.cjs.dev.js

@@ -38,6 +38,8 @@ var _includesInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/i
 var uniq = require('lodash/uniq');
 var _startsWithInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/starts-with');
 var formatters = require('./formatters-41584280.cjs.dev.js');
+var createDOMPurify = require('dompurify');
+var jsdom$1 = require('jsdom');
 require('lodash/upperFirst');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { 'default': e }; }
@@ -65,6 +67,7 @@ var _Object$values__default = /*#__PURE__*/_interopDefault(_Object$values);
 var _includesInstanceProperty__default = /*#__PURE__*/_interopDefault(_includesInstanceProperty);
 var uniq__default = /*#__PURE__*/_interopDefault(uniq);
 var _startsWithInstanceProperty__default = /*#__PURE__*/_interopDefault(_startsWithInstanceProperty);
+var createDOMPurify__default = /*#__PURE__*/_interopDefault(createDOMPurify);
 
 function _createSuper(Derived) { var hasNativeReflectConstruct = _isNativeReflectConstruct(); return function _createSuperInternal() { var Super = _getPrototypeOf(Derived), result; if (hasNativeReflectConstruct) { var NewTarget = _getPrototypeOf(this).constructor; result = _Reflect$construct__default["default"](Super, arguments, NewTarget); } else { result = Super.apply(this, arguments); } return _possibleConstructorReturn(this, result); }; }
 
@@ -184,7 +187,7 @@ var schemaJson = {
 			oneOf: [
 				{
 					type: "string",
-					pattern: "^[^\\-_]([0-9a-z]|[\\-_](?![\\-_])){2,64}[^\\-_]$"
+					pattern: "^[^\\-_#]([0-9a-z]|[\\-_](?![\\-_])){0,62}[^\\-_#]$"
 				},
 				{
 					$ref: "#/definitions/envVariablePlaceholder"
@@ -732,6 +735,19 @@ var getOrThrow = function getOrThrow(fn, errorMessage) {
   }
 };
 
+var jsdom = new jsdom$1.JSDOM(''); // @ts-expect-error: jsdom returns DOMWindow, which doesn't match Window dompurify expects
+
+var DOMPurify = createDOMPurify__default["default"](jsdom.window);
+function sanitizeSvg(data) {
+  return DOMPurify.sanitize(data, {
+    USE_PROFILES: {
+      svg: true
+    },
+    FORBID_ATTR: [// To avoid injection by using `style="filter:url(\"data:image/svg+xml,<svg`
+    'style']
+  });
+}
+
 function ownKeys$1(object, enumerableOnly) { var keys = _Object$keys__default["default"](object); if (_Object$getOwnPropertySymbols__default["default"]) { var symbols = _Object$getOwnPropertySymbols__default["default"](object); enumerableOnly && (symbols = _filterInstanceProperty__default["default"](symbols).call(symbols, function (sym) { return _Object$getOwnPropertyDescriptor__default["default"](object, sym).enumerable; })), keys.push.apply(keys, symbols); } return keys; }
 
 function _objectSpread$1(target) { for (var i = 1; i < arguments.length; i++) { var _context3, _context4; var source = null != arguments[i] ? arguments[i] : {}; i % 2 ? _forEachInstanceProperty__default["default"](_context3 = ownKeys$1(Object(source), !0)).call(_context3, function (key) { _defineProperty(target, key, source[key]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](target, _Object$getOwnPropertyDescriptors__default["default"](source)) : _forEachInstanceProperty__default["default"](_context4 = ownKeys$1(Object(source))).call(_context4, function (key) { _Object$defineProperty__default["default"](target, key, _Object$getOwnPropertyDescriptor__default["default"](source, key)); }); } return target; }
@@ -770,7 +786,7 @@ function transformCustomApplicationConfigToData(appConfig) {
       name: permissionKeys.manage,
       oAuthScopes: appConfig.oAuthScopes.manage
     }],
-    icon: appConfig.icon,
+    icon: sanitizeSvg(appConfig.icon),
     mainMenuLink: appConfig.mainMenuLink,
     submenuLinks: _mapInstanceProperty__default["default"](_context2 = appConfig.submenuLinks).call(_context2, function (submenuLink) {
       return _objectSpread$1(_objectSpread$1({}, submenuLink), {}, {

package/dist/commercetools-frontend-application-config.cjs.prod.js

@@ -38,6 +38,8 @@ var _includesInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/i
 var uniq = require('lodash/uniq');
 var _startsWithInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/starts-with');
 var formatters = require('./formatters-40251cfd.cjs.prod.js');
+var createDOMPurify = require('dompurify');
+var jsdom$1 = require('jsdom');
 require('lodash/upperFirst');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { 'default': e }; }
@@ -65,6 +67,7 @@ var _Object$values__default = /*#__PURE__*/_interopDefault(_Object$values);
 var _includesInstanceProperty__default = /*#__PURE__*/_interopDefault(_includesInstanceProperty);
 var uniq__default = /*#__PURE__*/_interopDefault(uniq);
 var _startsWithInstanceProperty__default = /*#__PURE__*/_interopDefault(_startsWithInstanceProperty);
+var createDOMPurify__default = /*#__PURE__*/_interopDefault(createDOMPurify);
 
 function _createSuper(Derived) { var hasNativeReflectConstruct = _isNativeReflectConstruct(); return function _createSuperInternal() { var Super = _getPrototypeOf(Derived), result; if (hasNativeReflectConstruct) { var NewTarget = _getPrototypeOf(this).constructor; result = _Reflect$construct__default["default"](Super, arguments, NewTarget); } else { result = Super.apply(this, arguments); } return _possibleConstructorReturn(this, result); }; }
 
@@ -184,7 +187,7 @@ var schemaJson = {
 			oneOf: [
 				{
 					type: "string",
-					pattern: "^[^\\-_]([0-9a-z]|[\\-_](?![\\-_])){2,64}[^\\-_]$"
+					pattern: "^[^\\-_#]([0-9a-z]|[\\-_](?![\\-_])){0,62}[^\\-_#]$"
 				},
 				{
 					$ref: "#/definitions/envVariablePlaceholder"
@@ -732,6 +735,19 @@ var getOrThrow = function getOrThrow(fn, errorMessage) {
   }
 };
 
+var jsdom = new jsdom$1.JSDOM(''); // @ts-expect-error: jsdom returns DOMWindow, which doesn't match Window dompurify expects
+
+var DOMPurify = createDOMPurify__default["default"](jsdom.window);
+function sanitizeSvg(data) {
+  return DOMPurify.sanitize(data, {
+    USE_PROFILES: {
+      svg: true
+    },
+    FORBID_ATTR: [// To avoid injection by using `style="filter:url(\"data:image/svg+xml,<svg`
+    'style']
+  });
+}
+
 function ownKeys$1(object, enumerableOnly) { var keys = _Object$keys__default["default"](object); if (_Object$getOwnPropertySymbols__default["default"]) { var symbols = _Object$getOwnPropertySymbols__default["default"](object); enumerableOnly && (symbols = _filterInstanceProperty__default["default"](symbols).call(symbols, function (sym) { return _Object$getOwnPropertyDescriptor__default["default"](object, sym).enumerable; })), keys.push.apply(keys, symbols); } return keys; }
 
 function _objectSpread$1(target) { for (var i = 1; i < arguments.length; i++) { var _context3, _context4; var source = null != arguments[i] ? arguments[i] : {}; i % 2 ? _forEachInstanceProperty__default["default"](_context3 = ownKeys$1(Object(source), !0)).call(_context3, function (key) { _defineProperty(target, key, source[key]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](target, _Object$getOwnPropertyDescriptors__default["default"](source)) : _forEachInstanceProperty__default["default"](_context4 = ownKeys$1(Object(source))).call(_context4, function (key) { _Object$defineProperty__default["default"](target, key, _Object$getOwnPropertyDescriptor__default["default"](source, key)); }); } return target; }
@@ -770,7 +786,7 @@ function transformCustomApplicationConfigToData(appConfig) {
       name: permissionKeys.manage,
       oAuthScopes: appConfig.oAuthScopes.manage
     }],
-    icon: appConfig.icon,
+    icon: sanitizeSvg(appConfig.icon),
     mainMenuLink: appConfig.mainMenuLink,
     submenuLinks: _mapInstanceProperty__default["default"](_context2 = appConfig.submenuLinks).call(_context2, function (submenuLink) {
       return _objectSpread$1(_objectSpread$1({}, submenuLink), {}, {

package/dist/commercetools-frontend-application-config.esm.js

@@ -34,6 +34,8 @@ import _includesInstanceProperty from '@babel/runtime-corejs3/core-js-stable/ins
 import uniq from 'lodash/uniq';
 import _startsWithInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/starts-with';
 import { e as entryPointUriPathToResourceAccesses } from './formatters-62af6993.esm.js';
+import createDOMPurify from 'dompurify';
+import { JSDOM } from 'jsdom';
 import 'lodash/upperFirst';
 
 function _createSuper(Derived) { var hasNativeReflectConstruct = _isNativeReflectConstruct(); return function _createSuperInternal() { var Super = _getPrototypeOf(Derived), result; if (hasNativeReflectConstruct) { var NewTarget = _getPrototypeOf(this).constructor; result = _Reflect$construct(Super, arguments, NewTarget); } else { result = Super.apply(this, arguments); } return _possibleConstructorReturn(this, result); }; }
@@ -154,7 +156,7 @@ var schemaJson = {
 			oneOf: [
 				{
 					type: "string",
-					pattern: "^[^\\-_]([0-9a-z]|[\\-_](?![\\-_])){2,64}[^\\-_]$"
+					pattern: "^[^\\-_#]([0-9a-z]|[\\-_](?![\\-_])){0,62}[^\\-_#]$"
 				},
 				{
 					$ref: "#/definitions/envVariablePlaceholder"
@@ -702,6 +704,19 @@ var getOrThrow = function getOrThrow(fn, errorMessage) {
   }
 };
 
+var jsdom = new JSDOM(''); // @ts-expect-error: jsdom returns DOMWindow, which doesn't match Window dompurify expects
+
+var DOMPurify = createDOMPurify(jsdom.window);
+function sanitizeSvg(data) {
+  return DOMPurify.sanitize(data, {
+    USE_PROFILES: {
+      svg: true
+    },
+    FORBID_ATTR: [// To avoid injection by using `style="filter:url(\"data:image/svg+xml,<svg`
+    'style']
+  });
+}
+
 function ownKeys$1(object, enumerableOnly) { var keys = _Object$keys(object); if (_Object$getOwnPropertySymbols) { var symbols = _Object$getOwnPropertySymbols(object); enumerableOnly && (symbols = _filterInstanceProperty(symbols).call(symbols, function (sym) { return _Object$getOwnPropertyDescriptor(object, sym).enumerable; })), keys.push.apply(keys, symbols); } return keys; }
 
 function _objectSpread$1(target) { for (var i = 1; i < arguments.length; i++) { var _context3, _context4; var source = null != arguments[i] ? arguments[i] : {}; i % 2 ? _forEachInstanceProperty(_context3 = ownKeys$1(Object(source), !0)).call(_context3, function (key) { _defineProperty(target, key, source[key]); }) : _Object$getOwnPropertyDescriptors ? _Object$defineProperties(target, _Object$getOwnPropertyDescriptors(source)) : _forEachInstanceProperty(_context4 = ownKeys$1(Object(source))).call(_context4, function (key) { _Object$defineProperty(target, key, _Object$getOwnPropertyDescriptor(source, key)); }); } return target; }
@@ -740,7 +755,7 @@ function transformCustomApplicationConfigToData(appConfig) {
       name: permissionKeys.manage,
       oAuthScopes: appConfig.oAuthScopes.manage
     }],
-    icon: appConfig.icon,
+    icon: sanitizeSvg(appConfig.icon),
     mainMenuLink: appConfig.mainMenuLink,
     submenuLinks: _mapInstanceProperty(_context2 = appConfig.submenuLinks).call(_context2, function (submenuLink) {
       return _objectSpread$1(_objectSpread$1({}, submenuLink), {}, {

package/dist/declarations/src/sanitize-svg.d.ts

@@ -0,0 +1 @@
+export default function sanitizeSvg(data: string): string;

package/dist/declarations/src/utils.d.ts

@@ -1,3 +1,5 @@
+/// <reference types="node" />
+/// <reference types="webpack-env" />
 import { CLOUD_IDENTIFIERS } from './constants';
 declare const mapCloudIdentifierToApiUrl: (key: typeof CLOUD_IDENTIFIERS[keyof typeof CLOUD_IDENTIFIERS]) => string;
 declare const getUniqueValues: (initialValues?: string[], additionalValues?: string[]) => string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commercetools-frontend/application-config",
-  "version": "21.5.0",
+  "version": "21.8.0",
   "description": "Configuration utilities for building Custom Applications",
   "bugs": "https://github.com/commercetools/merchant-center-application-kit/issues",
   "repository": {
@@ -21,9 +21,11 @@
   },
   "files": [
     "dist",
-    "ssr",
     "scripts",
+    "ssr",
+    "client.d.ts",
     "schema.json",
+    "tsconfig-mc-app.json",
     "package.json",
     "LICENSE",
     "README.md"
@@ -35,14 +37,17 @@
     "@babel/register": "^7.17.7",
     "@babel/runtime": "^7.17.9",
     "@babel/runtime-corejs3": "^7.17.9",
-    "@commercetools-frontend/babel-preset-mc-app": "21.3.4",
+    "@commercetools-frontend/babel-preset-mc-app": "21.8.0",
     "ajv": "8.11.0",
     "core-js": "^3.21.1",
     "cosmiconfig": "7.0.1",
+    "dompurify": "^2.3.6",
+    "jsdom": "^19.0.0",
     "lodash": "4.17.21",
     "omit-empty-es": "1.1.3"
   },
   "devDependencies": {
+    "@types/jsdom": "^16.2.14",
     "json-schema-to-typescript": "10.1.5",
     "shelljs": "0.8.5"
   },

package/schema.json

@@ -30,7 +30,7 @@
       "oneOf": [
         {
           "type": "string",
-          "pattern": "^[^\\-_]([0-9a-z]|[\\-_](?![\\-_])){2,64}[^\\-_]$"
+          "pattern": "^[^\\-_#]([0-9a-z]|[\\-_](?![\\-_])){0,62}[^\\-_#]$"
         },
         {
           "$ref": "#/definitions/envVariablePlaceholder"

package/tsconfig-mc-app.json

@@ -0,0 +1,31 @@
+{
+  "$schema": "https://json.schemastore.org/tsconfig",
+  "display": "Custom Application",
+
+  "compilerOptions": {
+    "allowJs": false,
+    "allowSyntheticDefaultImports": true,
+    "esModuleInterop": true,
+    "importHelpers": true,
+    "isolatedModules": true,
+    "jsx": "react-jsx",
+    "jsxImportSource": "@emotion/react",
+    "lib": ["ESNext", "DOM"],
+    "module": "ESNext",
+    "moduleResolution": "Node",
+    "noFallthroughCasesInSwitch": true,
+    "noImplicitAny": true,
+    "noImplicitReturns": true,
+    "noImplicitThis": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "preserveSymlinks": true,
+    "removeComments": true,
+    "resolveJsonModule": true,
+    "sourceMap": true,
+    "strict": true,
+    "strictNullChecks": true,
+    "stripInternal": true,
+    "target": "ES2022"
+  }
+}