@coveo/atomic-react 3.11.43 → 3.11.44

package/dist/cjs/atomic-react.cjs

@@ -605,7 +605,7 @@ const renderBreadcrumbContainer = ({ props })=>(children)=>{
     </div>`;
     };
 
-/*! @license DOMPurify 3.4.14 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.14/LICENSE */
+/*! @license DOMPurify 3.4.15 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.15/LICENSE */
 
 function _arrayLikeToArray(r, a) {
   (null == a || a > r.length) && (a = r.length);
@@ -1077,7 +1077,7 @@ const _resolveObjectOption = function _resolveObjectOption(cfg, key, makeFallbac
 function createDOMPurify() {
   let window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal();
   const DOMPurify = root => createDOMPurify(root);
-  DOMPurify.version = '3.4.14';
+  DOMPurify.version = '3.4.15';
   DOMPurify.removed = [];
   if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document || !window.Element) {
     // Not running in a browser, provide a factory function
@@ -1101,6 +1101,12 @@ function createDOMPurify() {
   const ElementPrototype = Element.prototype;
   const cloneNode = lookupGetter(ElementPrototype, 'cloneNode');
   const remove = lookupGetter(ElementPrototype, 'remove');
+  // Clobber-safe Attr-node removal. On an HTMLFormElement a descendant named
+  // "removeAttributeNode" shadows the prototype method via
+  // [LegacyOverrideBuiltIns], so element.removeAttributeNode(attr) throws.
+  // Calling the cached Element.prototype method with the element as the
+  // receiver removes the exact live Attr node regardless of the shadowing.
+  const removeAttributeNode = lookupGetter(ElementPrototype, 'removeAttributeNode');
   const getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');
   const getChildNodes = lookupGetter(ElementPrototype, 'childNodes');
   const getParentNode = lookupGetter(ElementPrototype, 'parentNode');
@@ -1765,7 +1771,7 @@ function createDOMPurify() {
    */
   const _stripAttributeNode = function _stripAttributeNode(element, attribute, name) {
     try {
-      element.removeAttributeNode(attribute);
+      removeAttributeNode(element, attribute);
     } catch (_) {
       try {
         element.removeAttribute(name);
@@ -1853,13 +1859,18 @@ function createDOMPurify() {
     });
     try {
       if (attr) {
-        element.removeAttributeNode(attr);
+        removeAttributeNode(element, attr);
       } else {
         element.removeAttribute(name);
       }
     } catch (_) {
       /* Clobbered or already-detached node - best-effort fall back to a
-         name-based removal so the "is" handling below still runs. */
+         name-based removal so the "is" handling below still runs. Note this
+         fallback ASCII-lowercases its lookup key in an HTML document and so
+         cannot reach a case-preserved attribute name; the cached
+         removeAttributeNode() above is what removes those, and a clobbered
+         form is already removed wholesale by _isClobbered() before reaching
+         here. */
       try {
         element.removeAttribute(name);
       } catch (_) {}
@@ -2195,7 +2206,17 @@ function createDOMPurify() {
     // makes the direct read diverge from the cached read; a clean form
     // (same-realm OR foreign-realm) has both reads pointing at the same
     // canonical NamedNodeMap.
-    element.attributes !== getAttributes(element) || typeof element.removeAttribute !== 'function' || typeof element.setAttribute !== 'function' || typeof element.namespaceURI !== 'string' || typeof element.insertBefore !== 'function' || typeof element.hasChildNodes !== 'function' ||
+    element.attributes !== getAttributes(element) || typeof element.removeAttribute !== 'function' ||
+    // A form descendant named "removeAttributeNode" or "getAttributeNode"
+    // shadows these Attr-node methods via [LegacyOverrideBuiltIns].
+    // _removeAttribute() / _stripAttributeNode() reach for
+    // element.removeAttributeNode(attr) first; when it is shadowed the call
+    // throws and the name-based fallback element.removeAttribute(name)
+    // ASCII-lowercases its lookup key in an HTML document, silently missing
+    // a case-preserved event-handler attribute (e.g. an ONANIMATIONSTART
+    // that reached the sanitizer through an XML/XHTML parse). Flag the form
+    // so it is removed wholesale, exactly as for the other shadowed methods.
+    typeof element.removeAttributeNode !== 'function' || typeof element.getAttributeNode !== 'function' || typeof element.setAttribute !== 'function' || typeof element.namespaceURI !== 'string' || typeof element.insertBefore !== 'function' || typeof element.hasChildNodes !== 'function' ||
     // NodeType clobbering probe. Cached Node.prototype.nodeType getter
     // returns the integer 1 for any Element regardless of realm; direct
     // read on a clobbered form (e.g. <input name="nodeType">) returns
@@ -2686,15 +2707,25 @@ function createDOMPurify() {
   /**
    * Write a modified attribute value back onto the element. On
    * success, re-probe for clobbering introduced by the new value and
-   * remove the element when found; otherwise pop the removal entry
-   * recorded by the earlier _removeAttribute (long-standing pairing
-   * with the SANITIZE_NAMED_PROPS path - do not "fix" casually). On
+   * remove the element when found; otherwise, when this writeback is the
+   * recreate half of the SANITIZE_NAMED_PROPS remove-and-recreate, pop the
+   * removal entry that path recorded so it does not show as removed. On
    * failure, remove the attribute instead.
    *
+   * Returns true only on a clean write (the value was set and the new value
+   * introduced no clobbering). The caller uses that, together with its own
+   * knowledge of whether this attribute pushed a DOMPurify.removed record, to
+   * decide whether to pop that record. The pop must happen ONLY for the
+   * named-prop remove-and-recreate; popping on any other value change (trim,
+   * template scrubbing, Trusted Types) would consume an unrelated _forceRemove
+   * subtree-cleanup record and let that detached subtree keep a live event
+   * handler through the IN_PLACE neutralization pass (SO-001).
+   *
    * @param currentNode the element carrying the attribute
    * @param name the attribute name as present on the element
    * @param namespaceURI the attribute's namespace, if any
    * @param value the new attribute value
+   * @return true if the value was written without introducing clobbering
    */
   const _setAttributeValue = function _setAttributeValue(currentNode, name, namespaceURI, value) {
     try {
@@ -2706,11 +2737,12 @@ function createDOMPurify() {
       }
       if (_isClobbered(currentNode)) {
         _forceRemove(currentNode);
-      } else {
-        arrayPop(DOMPurify.removed);
+        return false;
       }
+      return true;
     } catch (_) {
       _removeAttribute(name, currentNode);
+      return false;
     }
   };
   /**
@@ -2723,6 +2755,7 @@ function createDOMPurify() {
    *
    * @param currentNode to sanitize
    */
+  // eslint-disable-next-line complexity
   const _sanitizeAttributes = function _sanitizeAttributes(currentNode) {
     /* Execute a hook if present */
     _executeHooks(hooks.beforeSanitizeAttributes, currentNode, null);
@@ -2752,6 +2785,15 @@ function createDOMPurify() {
       const lcName = transformCaseFunc(name);
       const initValue = attrValue;
       let value = name === 'value' ? initValue : stringTrim(initValue);
+      /* Tracks whether this specific attribute pushed a DOMPurify.removed
+         record that a later _setAttributeValue() writeback is expected to pop
+         back off (the SANITIZE_NAMED_PROPS remove-and-recreate below is the
+         only path that does). A value that merely changed via trim, template
+         scrubbing, or Trusted Types pushes no such record, so its writeback
+         must NOT pop — otherwise it consumes an unrelated _forceRemove subtree
+         record and that detached subtree escapes the IN_PLACE handler-
+         neutralization pass (SO-001). */
+      let recreatedNamedProp = false;
       /* Execute a hook if present */
       hookEvent.attrName = lcName;
       hookEvent.attrValue = value;
@@ -2767,6 +2809,9 @@ function createDOMPurify() {
         _removeAttribute(name, currentNode, attr);
         // Prefix the value and later re-create the attribute with the sanitized value
         value = SANITIZE_NAMED_PROPS_PREFIX + value;
+        // This attribute owns the record just pushed; its recreate writeback
+        // is the one allowed to pop it back off.
+        recreatedNamedProp = true;
       }
       // Else: already prefixed, leave the attribute alone — the prefix is
       // itself the clobbering protection, and re-applying it is incorrect.
@@ -2807,7 +2852,14 @@ function createDOMPurify() {
       value = _applyTrustedTypesToAttribute(lcTag, lcName, namespaceURI, value);
       /* Handle invalid data-* attribute set by try-catching it */
       if (value !== initValue) {
-        _setAttributeValue(currentNode, name, namespaceURI, value);
+        const cleanWrite = _setAttributeValue(currentNode, name, namespaceURI, value);
+        /* Only the named-prop remove-and-recreate owns a DOMPurify.removed
+           record to pop; a plain trim/template/Trusted-Types writeback owns
+           none, so popping here would drop an unrelated subtree's cleanup
+           record (SO-001). */
+        if (cleanWrite && recreatedNamedProp) {
+          arrayPop(DOMPurify.removed);
+        }
       }
     }
     /* Execute a hook if present */
@@ -3083,8 +3135,15 @@ function createDOMPurify() {
          them before the main iterator runs, since the iterator does not
          descend into shadow trees. The walk routes every read through a
          cached prototype getter so clobbering descendants on a form root
-         cannot hide a shadow host from this pass. */
-      _sanitizeAttachedShadowRoots(importedNode);
+         cannot hide a shadow host from this pass.
+                Traverse from `body`, not `importedNode`: when importedNode is a
+         DocumentFragment, the appendChild() above moves its children into
+         `body` and leaves the fragment empty, so walking importedNode would
+         scan nothing and miss every attached shadow host now under `body`
+         (SO-003). In the BODY/HTML branches `body === importedNode`, so this
+         is equivalent there; in the element branch `body` contains the
+         appended element and its descendants. `body` covers all three. */
+      _sanitizeAttachedShadowRoots(body);
     } else {
       /* Exit directly if we have nothing to do */
       if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT &&
@@ -7252,7 +7311,7 @@ class Interpolator {
           interpolationkey: match[1].trim()
         }), value.trim());
       }
-      str = str.replace(match[0], value);
+      str = str.replace(match[0], regexSafe(makeString(value)));
       this.regexp.lastIndex = 0;
     }
     return str;
@@ -8302,7 +8361,7 @@ function getWindow$1() {
 }
 function getAtomicEnvironment(headlessVersion) {
     return {
-        version: "3.61.3",
+        version: "3.61.4",
         headlessVersion
     };
 }
@@ -8529,7 +8588,7 @@ function isSafeUrlSegmentBase(v) {
 	if (UNSAFE_KEYS$1.indexOf(v) > -1) return false;
 	if (v.indexOf("..") > -1) return false;
 	if (v.indexOf("\\") > -1) return false;
-	if (/[?#%\s]/.test(v)) return false;
+	if (/[?#%:\s]/.test(v)) return false;
 	if (/[\x00-\x1F\x7F]/.test(v)) return false;
 	return true;
 }
@@ -8539,7 +8598,9 @@ function isSafeLangUrlSegment(v) {
 	return true;
 }
 function isSafeNsUrlSegment(v) {
-	return isSafeUrlSegmentBase(v);
+	if (!isSafeUrlSegmentBase(v)) return false;
+	if (v.indexOf("//") > -1) return false;
+	return true;
 }
 const SAFETY_CHECK_BY_KEY = {
 	lng: isSafeLangUrlSegment,
@@ -12617,7 +12678,7 @@ var attachStyles = (hostRef) => {
   const cmpMeta = hostRef.$cmpMeta$;
   const elm = hostRef.$hostElement$;
   const flags = cmpMeta.$flags$;
-  createTime("attachStyles", cmpMeta.$tagName$);
+  const endAttachStyles = createTime("attachStyles", cmpMeta.$tagName$);
   const scopeId2 = addStyle(
     elm.shadowRoot ? elm.shadowRoot : elm.getRootNode(),
     cmpMeta,
@@ -12630,6 +12691,7 @@ var attachStyles = (hostRef) => {
       elm.classList.add(scopeId2 + "-s");
     }
   }
+  endAttachStyles();
 };
 var getScopeId = (cmp, mode) => "sc-" + (mode && cmp.$flags$ & 32 /* hasMode */ ? cmp.$tagName$ + "-" + mode : cmp.$tagName$);
 var setAccessor = (elm, memberName, oldValue, newValue, isSvg, flags) => {
@@ -13311,7 +13373,7 @@ var scheduleUpdate = (hostRef, isInitialLoad) => {
 };
 var dispatchHooks = (hostRef, isInitialLoad) => {
   const elm = hostRef.$hostElement$;
-  createTime("scheduleUpdate", hostRef.$cmpMeta$.$tagName$);
+  const endSchedule = createTime("scheduleUpdate", hostRef.$cmpMeta$.$tagName$);
   const instance = elm;
   if (!instance) {
     throw new Error(
@@ -13331,6 +13393,7 @@ var dispatchHooks = (hostRef, isInitialLoad) => {
   {
     maybePromise = enqueue(maybePromise, () => safeCall(instance, "componentWillRender"));
   }
+  endSchedule();
   return enqueue(maybePromise, () => updateComponent(hostRef, instance, isInitialLoad));
 };
 var enqueue = (maybePromise, fn) => isPromisey(maybePromise) ? maybePromise.then(fn).catch((err2) => {
@@ -13340,15 +13403,17 @@ var enqueue = (maybePromise, fn) => isPromisey(maybePromise) ? maybePromise.then
 var isPromisey = (maybePromise) => maybePromise instanceof Promise || maybePromise && maybePromise.then && typeof maybePromise.then === "function";
 var updateComponent = async (hostRef, instance, isInitialLoad) => {
   const elm = hostRef.$hostElement$;
-  createTime("update", hostRef.$cmpMeta$.$tagName$);
+  const endUpdate = createTime("update", hostRef.$cmpMeta$.$tagName$);
   elm["s-rc"];
   if (isInitialLoad) {
     attachStyles(hostRef);
   }
-  createTime("render", hostRef.$cmpMeta$.$tagName$);
+  const endRender = createTime("render", hostRef.$cmpMeta$.$tagName$);
   {
     callRender(hostRef, instance, elm, isInitialLoad);
   }
+  endRender();
+  endUpdate();
   {
     postUpdateComponent(hostRef);
   }
@@ -13382,8 +13447,9 @@ var callRender = (hostRef, instance, elm, isInitialLoad) => {
   return null;
 };
 var postUpdateComponent = (hostRef) => {
-  hostRef.$cmpMeta$.$tagName$;
+  const tagName = hostRef.$cmpMeta$.$tagName$;
   const elm = hostRef.$hostElement$;
+  const endPostUpdate = createTime("postUpdate", tagName);
   const instance = elm;
   hostRef.$ancestorComponent$;
   {
@@ -13394,10 +13460,12 @@ var postUpdateComponent = (hostRef) => {
     {
       safeCall(instance, "componentDidLoad");
     }
+    endPostUpdate();
   } else {
     {
       safeCall(instance, "componentDidUpdate");
     }
+    endPostUpdate();
   }
 };
 var safeCall = (instance, method, arg) => {
@@ -13544,8 +13612,9 @@ var initializeComponent = async (elm, hostRef, cmpMeta, hmrVersionId) => {
       }
       const scopeId2 = getScopeId(cmpMeta, hostRef.$modeName$);
       if (!styles$h.has(scopeId2)) {
-        createTime("registerStyles", cmpMeta.$tagName$);
+        const endRegisterStyles = createTime("registerStyles", cmpMeta.$tagName$);
         registerStyle(scopeId2, style, !!(cmpMeta.$flags$ & 1 /* shadowDomEncapsulation */));
+        endRegisterStyles();
       }
     }
   }
@@ -13563,7 +13632,7 @@ var connectedCallback = (elm) => {
   if ((plt.$flags$ & 1 /* isTmpDisconnected */) === 0) {
     const hostRef = getHostRef(elm);
     const cmpMeta = hostRef.$cmpMeta$;
-    createTime("connectedCallback", cmpMeta.$tagName$);
+    const endConnected = createTime("connectedCallback", cmpMeta.$tagName$);
     if (!(hostRef.$flags$ & 1 /* hasConnected */)) {
       hostRef.$flags$ |= 1 /* hasConnected */;
       {
@@ -13592,6 +13661,7 @@ var connectedCallback = (elm) => {
         hostRef.$onReadyPromise$.then(() => fireConnectedCallback(hostRef.$lazyInstance$));
       }
     }
+    endConnected();
   }
 };
 var setContentReference = (elm) => {
@@ -32587,6 +32657,7 @@ function requireBgStandard_common () {
 	  pastChat: "rgb(255, 93, 45)",
 	  cryptoTransactionEnvelopeChangeLog: "rgb(8, 73, 104)",
 	  feedback: "rgb(27, 150, 255)",
+	  voicemailDrop: "rgb(3, 45, 96)",
 	  actionListComponent: "rgb(16, 124, 173)",
 	  opportunitySplits: "rgb(255, 93, 45)",
 	  locationPermit: "rgb(6, 165, 154)",
@@ -32737,7 +32808,9 @@ function requireBgStandard_common () {
 	  sendLog: "rgb(147, 147, 147)",
 	  dxPipeline: "rgb(255, 93, 45)",
 	  account: "rgb(88, 103, 232)",
+	  suggestedForYou: "rgb(144, 80, 233)",
 	  programStatus: "rgb(144, 80, 233)",
+	  outboundCall: "rgb(3, 45, 96)",
 	  studyCandidate: "rgb(47, 44, 183)",
 	  couponCodes: "rgb(57, 101, 71)",
 	  adverseEvent: "rgb(182, 5, 84)",
@@ -32830,6 +32903,7 @@ function requireBgStandard_common () {
 	  contract: "rgb(57, 101, 71)",
 	  policy: "rgb(6, 165, 154)",
 	  sobject: "rgb(147, 147, 147)",
+	  inQueueExperience: "rgb(3, 45, 96)",
 	  adEventEffect: "rgb(182, 5, 84)",
 	  whatsapp: "rgb(59, 167, 85)",
 	  salesCadenceTarget: "rgb(16, 124, 173)",
@@ -32862,6 +32936,7 @@ function requireBgStandard_common () {
 	  taxRate: "rgb(57, 101, 71)",
 	  report: "rgb(6, 165, 154)",
 	  customerWorkspace: "rgb(57, 101, 71)",
+	  rfpRecord: "rgb(59, 167, 85)",
 	  groups: "rgb(27, 150, 255)",
 	  diseaseOutbreak: "rgb(255, 83, 138)",
 	  dataModel: "rgb(255, 83, 138)",
@@ -32875,6 +32950,7 @@ function requireBgStandard_common () {
 	  priceBooks: "rgb(57, 101, 71)",
 	  entityMilestone: "rgb(255, 93, 45)",
 	  contractLineOutcome: "rgb(57, 101, 71)",
+	  aiModelGenerative: "rgb(27, 150, 255)",
 	  wealthManagement: "rgb(6, 165, 154)",
 	  customers: "rgb(6, 165, 154)",
 	  disclosureAndCompliance: "rgb(6, 165, 154)",
@@ -32953,6 +33029,7 @@ function requireBgStandard_common () {
 	  avatar: "rgb(27, 150, 255)",
 	  recordDelete: "rgb(255, 83, 138)",
 	  solution: "rgb(59, 167, 85)",
+	  initiateExternalTransfer: "rgb(3, 45, 96)",
 	  editForm: "rgb(147, 147, 147)",
 	  nftStudio: "rgb(88, 103, 232)",
 	  manualDiscounts: "rgb(16, 124, 173)",
@@ -37416,6 +37493,7 @@ let AtomicSortDropdown$1 = class AtomicSortDropdown extends lit.LitElement {
                 })))}`);
     }
     render() {
+        if (!this.options.length) return lit.html`<slot></slot>`;
         const { hasError, hasResults, firstSearchExecuted, isLoading } = this.searchStatusState;
         return lit.html`
       ${sortGuard({