@cosmicdrift/kumiko-renderer-web 0.158.2 → 0.159.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-renderer-web",
-  "version": "0.158.2",
+  "version": "0.159.1",
   "description": "Web-platform bindings for @cosmicdrift/kumiko-renderer. HTML default-primitives, browser history-based navigation, EventSource-backed live events, and a one-call createKumikoApp that mounts the whole stack via react-dom.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -16,9 +16,9 @@
     "./styles.css": "./src/styles.css"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.158.2",
-    "@cosmicdrift/kumiko-headless": "0.158.2",
-    "@cosmicdrift/kumiko-renderer": "0.158.2",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.159.1",
+    "@cosmicdrift/kumiko-headless": "0.159.1",
+    "@cosmicdrift/kumiko-renderer": "0.159.1",
     "@radix-ui/react-dialog": "^1.1.15",
     "@radix-ui/react-dropdown-menu": "^2.1.16",
     "@radix-ui/react-label": "^2.1.8",

package/src/__tests__/kumiko-screen.test.tsx

@@ -499,6 +499,31 @@ describe("KumikoScreen", () => {
     expect(bannerText).not.toBe("errors.access.denied");
   });
 
+  test("entityList: query-Error zeigt übersetzten Text statt rohem i18nKey (issue #1193)", async () => {
+    const dispatcher = makeDispatcher({
+      query: (async () => ({
+        isSuccess: false,
+        error: {
+          code: "access_denied",
+          httpStatus: 403,
+          i18nKey: "errors.access.denied",
+          message: "",
+        },
+      })) as unknown as Dispatcher["query"],
+    });
+
+    render(
+      <DispatcherProvider dispatcher={dispatcher}>
+        <KumikoScreen schema={schema} qn="tasks:screen:task-list" />
+      </DispatcherProvider>,
+    );
+
+    await waitFor(() => expect(screen.queryByTestId("kumiko-screen-error")).toBeTruthy());
+    const bannerText = screen.getByTestId("kumiko-screen-error").textContent;
+    expect(bannerText).toBe(kumikoDefaultTranslations["en"]?.["errors.access.denied"] ?? "");
+    expect(bannerText).not.toBe("errors.access.denied");
+  });
+
   // RowActions-Mapping (Tier 2.7a Resolution-Layer): pinst dass
   // EntityListBody die Schema-Form (handler-QN, label-i18nKey, payload-
   // builder, visible-Function, confirmLabel) zu DataTableRowAction

package/src/__tests__/xss-safety.test.tsx

@@ -0,0 +1,58 @@
+//
+// Pins the XSS-escaping behavior for tenant-/pattern-authored content
+// (kumiko-framework#1321). renderer-web has no dangerouslySetInnerHTML
+// and no field-renderer path that wires tenant data into href/src — this
+// test guards JSX auto-escaping against future regressions (e.g. if
+// someone adds rich-text/markdown support via dangerouslySetInnerHTML),
+// and pins the Link primitive's scheme guard (kumiko-framework#1365)
+// against javascript:/data: hrefs as defense-in-depth.
+
+import { describe, expect, test } from "bun:test";
+import { defaultPrimitives } from "../primitives";
+import { StatCard } from "../widgets/stat";
+import { render, screen } from "./test-utils";
+
+const PAYLOAD = '<script>window.__xss = true;</script><img src=x onerror="window.__xss = true">';
+const UNSAFE_HREFS = [
+  "javascript:window.__xss = true",
+  "data:text/html,<script>window.__xss=true</script>",
+];
+
+describe("XSS-safety (tenant-authored content)", () => {
+  test("Text-Primitive rendert Payload als Text, nicht als HTML", () => {
+    render(<defaultPrimitives.Text testId="txt">{PAYLOAD}</defaultPrimitives.Text>);
+    const node = screen.getByTestId("txt");
+    expect(node.textContent).toBe(PAYLOAD);
+    expect(node.querySelector("script")).toBeNull();
+    expect(node.querySelector("img")).toBeNull();
+  });
+
+  test("StatCard-Widget rendert label/value/sub als Text, nicht als HTML", () => {
+    render(<StatCard testId="stat" label={PAYLOAD} value={PAYLOAD} sub={PAYLOAD} />);
+    const node = screen.getByTestId("stat");
+    expect(node.querySelector("script")).toBeNull();
+    expect(node.querySelector("img")).toBeNull();
+    expect(node.textContent).toContain(PAYLOAD);
+  });
+
+  test.each(UNSAFE_HREFS)("Link-Primitive neutralisiert unsicheren href-Scheme: %s", (href) => {
+    render(
+      <defaultPrimitives.Link testId="link" href={href}>
+        text
+      </defaultPrimitives.Link>,
+    );
+    const node = screen.getByTestId("link");
+    expect(node.getAttribute("href")).toBe("#");
+  });
+
+  test("Link-Primitive lässt sichere hrefs (https/mailto/relativ) unverändert", () => {
+    for (const href of ["https://example.com", "mailto:a@example.com", "/relative/path"]) {
+      render(
+        <defaultPrimitives.Link testId={`link-${href}`} href={href}>
+          text
+        </defaultPrimitives.Link>,
+      );
+      expect(screen.getByTestId(`link-${href}`).getAttribute("href")).toBe(href);
+    }
+  });
+});

package/src/app/__tests__/first-open-screen-qn.test.ts

@@ -63,4 +63,15 @@ describe("firstOpenScreenQn", () => {
     ];
     expect(firstOpenScreenQn(features)).toBeUndefined();
   });
+
+  test("resolves a bare screen id in nav to the qualified screen name", () => {
+    const features: readonly FeatureSchema[] = [
+      feature({
+        featureName: "shop",
+        screens: [customScreen({ id: "catalog" })],
+        navs: [{ id: "catalog", label: "shop:nav.catalog", screen: "catalog" }],
+      }),
+    ];
+    expect(firstOpenScreenQn(features)).toBe("shop:screen:catalog");
+  });
 });

package/src/primitives/index.tsx

@@ -1661,6 +1661,15 @@ function DefaultText({ variant = "body", children, testId }: TextProps): ReactNo
 
 // ---- Link (anchor mit Button-/Muted-Optik) ----
 
+// http(s)/mailto or scheme-less (relative/anchor) allowed; javascript:, data:,
+// vbscript:, etc. rejected. Mirrors renderer-mail-html's renderSafeMarkdown
+// href guard — no sanitizer dependency needed for a four-line regex check.
+function isSafeHref(href: string): boolean {
+  const trimmed = href.trim().toLowerCase();
+  if (!/^[a-z][a-z0-9+.-]*:/.test(trimmed)) return true;
+  return /^(?:https?|mailto):/.test(trimmed);
+}
+
 // `button` nutzt die Primary-Buttonfläche auf einem semantischen <a> —
 // der Standard für „weiter zu"-Navigationen nach Success-States (ehem.
 // authButtonClass), `muted` der dezente Sekundär-Link (ehem.
@@ -1681,7 +1690,7 @@ function DefaultLink({
         : "text-primary underline-offset-4 hover:underline";
   return (
     <a
-      href={href}
+      href={isSafeHref(href) ? href : "#"}
       target={target}
       rel={target === "_blank" ? "noreferrer" : undefined}
       data-testid={testId}