@coveo/atomic-react 3.11.43 → 3.11.44

package/dist/cjs/commerce/atomic-react.cjs

@@ -464,7 +464,7 @@ const renderBreadcrumbContainer = ({ props })=>(children)=>{
     </div>`;
     };
 
-/*! @license DOMPurify 3.4.14 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.14/LICENSE */
+/*! @license DOMPurify 3.4.15 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.15/LICENSE */
 
 function _arrayLikeToArray(r, a) {
   (null == a || a > r.length) && (a = r.length);
@@ -936,7 +936,7 @@ const _resolveObjectOption = function _resolveObjectOption(cfg, key, makeFallbac
 function createDOMPurify() {
   let window = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : getGlobal();
   const DOMPurify = root => createDOMPurify(root);
-  DOMPurify.version = '3.4.14';
+  DOMPurify.version = '3.4.15';
   DOMPurify.removed = [];
   if (!window || !window.document || window.document.nodeType !== NODE_TYPE.document || !window.Element) {
     // Not running in a browser, provide a factory function
@@ -960,6 +960,12 @@ function createDOMPurify() {
   const ElementPrototype = Element.prototype;
   const cloneNode = lookupGetter(ElementPrototype, 'cloneNode');
   const remove = lookupGetter(ElementPrototype, 'remove');
+  // Clobber-safe Attr-node removal. On an HTMLFormElement a descendant named
+  // "removeAttributeNode" shadows the prototype method via
+  // [LegacyOverrideBuiltIns], so element.removeAttributeNode(attr) throws.
+  // Calling the cached Element.prototype method with the element as the
+  // receiver removes the exact live Attr node regardless of the shadowing.
+  const removeAttributeNode = lookupGetter(ElementPrototype, 'removeAttributeNode');
   const getNextSibling = lookupGetter(ElementPrototype, 'nextSibling');
   const getChildNodes = lookupGetter(ElementPrototype, 'childNodes');
   const getParentNode = lookupGetter(ElementPrototype, 'parentNode');
@@ -1624,7 +1630,7 @@ function createDOMPurify() {
    */
   const _stripAttributeNode = function _stripAttributeNode(element, attribute, name) {
     try {
-      element.removeAttributeNode(attribute);
+      removeAttributeNode(element, attribute);
     } catch (_) {
       try {
         element.removeAttribute(name);
@@ -1712,13 +1718,18 @@ function createDOMPurify() {
     });
     try {
       if (attr) {
-        element.removeAttributeNode(attr);
+        removeAttributeNode(element, attr);
       } else {
         element.removeAttribute(name);
       }
     } catch (_) {
       /* Clobbered or already-detached node - best-effort fall back to a
-         name-based removal so the "is" handling below still runs. */
+         name-based removal so the "is" handling below still runs. Note this
+         fallback ASCII-lowercases its lookup key in an HTML document and so
+         cannot reach a case-preserved attribute name; the cached
+         removeAttributeNode() above is what removes those, and a clobbered
+         form is already removed wholesale by _isClobbered() before reaching
+         here. */
       try {
         element.removeAttribute(name);
       } catch (_) {}
@@ -2054,7 +2065,17 @@ function createDOMPurify() {
     // makes the direct read diverge from the cached read; a clean form
     // (same-realm OR foreign-realm) has both reads pointing at the same
     // canonical NamedNodeMap.
-    element.attributes !== getAttributes(element) || typeof element.removeAttribute !== 'function' || typeof element.setAttribute !== 'function' || typeof element.namespaceURI !== 'string' || typeof element.insertBefore !== 'function' || typeof element.hasChildNodes !== 'function' ||
+    element.attributes !== getAttributes(element) || typeof element.removeAttribute !== 'function' ||
+    // A form descendant named "removeAttributeNode" or "getAttributeNode"
+    // shadows these Attr-node methods via [LegacyOverrideBuiltIns].
+    // _removeAttribute() / _stripAttributeNode() reach for
+    // element.removeAttributeNode(attr) first; when it is shadowed the call
+    // throws and the name-based fallback element.removeAttribute(name)
+    // ASCII-lowercases its lookup key in an HTML document, silently missing
+    // a case-preserved event-handler attribute (e.g. an ONANIMATIONSTART
+    // that reached the sanitizer through an XML/XHTML parse). Flag the form
+    // so it is removed wholesale, exactly as for the other shadowed methods.
+    typeof element.removeAttributeNode !== 'function' || typeof element.getAttributeNode !== 'function' || typeof element.setAttribute !== 'function' || typeof element.namespaceURI !== 'string' || typeof element.insertBefore !== 'function' || typeof element.hasChildNodes !== 'function' ||
     // NodeType clobbering probe. Cached Node.prototype.nodeType getter
     // returns the integer 1 for any Element regardless of realm; direct
     // read on a clobbered form (e.g. <input name="nodeType">) returns
@@ -2545,15 +2566,25 @@ function createDOMPurify() {
   /**
    * Write a modified attribute value back onto the element. On
    * success, re-probe for clobbering introduced by the new value and
-   * remove the element when found; otherwise pop the removal entry
-   * recorded by the earlier _removeAttribute (long-standing pairing
-   * with the SANITIZE_NAMED_PROPS path - do not "fix" casually). On
+   * remove the element when found; otherwise, when this writeback is the
+   * recreate half of the SANITIZE_NAMED_PROPS remove-and-recreate, pop the
+   * removal entry that path recorded so it does not show as removed. On
    * failure, remove the attribute instead.
    *
+   * Returns true only on a clean write (the value was set and the new value
+   * introduced no clobbering). The caller uses that, together with its own
+   * knowledge of whether this attribute pushed a DOMPurify.removed record, to
+   * decide whether to pop that record. The pop must happen ONLY for the
+   * named-prop remove-and-recreate; popping on any other value change (trim,
+   * template scrubbing, Trusted Types) would consume an unrelated _forceRemove
+   * subtree-cleanup record and let that detached subtree keep a live event
+   * handler through the IN_PLACE neutralization pass (SO-001).
+   *
    * @param currentNode the element carrying the attribute
    * @param name the attribute name as present on the element
    * @param namespaceURI the attribute's namespace, if any
    * @param value the new attribute value
+   * @return true if the value was written without introducing clobbering
    */
   const _setAttributeValue = function _setAttributeValue(currentNode, name, namespaceURI, value) {
     try {
@@ -2565,11 +2596,12 @@ function createDOMPurify() {
       }
       if (_isClobbered(currentNode)) {
         _forceRemove(currentNode);
-      } else {
-        arrayPop(DOMPurify.removed);
+        return false;
       }
+      return true;
     } catch (_) {
       _removeAttribute(name, currentNode);
+      return false;
     }
   };
   /**
@@ -2582,6 +2614,7 @@ function createDOMPurify() {
    *
    * @param currentNode to sanitize
    */
+  // eslint-disable-next-line complexity
   const _sanitizeAttributes = function _sanitizeAttributes(currentNode) {
     /* Execute a hook if present */
     _executeHooks(hooks.beforeSanitizeAttributes, currentNode, null);
@@ -2611,6 +2644,15 @@ function createDOMPurify() {
       const lcName = transformCaseFunc(name);
       const initValue = attrValue;
       let value = name === 'value' ? initValue : stringTrim(initValue);
+      /* Tracks whether this specific attribute pushed a DOMPurify.removed
+         record that a later _setAttributeValue() writeback is expected to pop
+         back off (the SANITIZE_NAMED_PROPS remove-and-recreate below is the
+         only path that does). A value that merely changed via trim, template
+         scrubbing, or Trusted Types pushes no such record, so its writeback
+         must NOT pop — otherwise it consumes an unrelated _forceRemove subtree
+         record and that detached subtree escapes the IN_PLACE handler-
+         neutralization pass (SO-001). */
+      let recreatedNamedProp = false;
       /* Execute a hook if present */
       hookEvent.attrName = lcName;
       hookEvent.attrValue = value;
@@ -2626,6 +2668,9 @@ function createDOMPurify() {
         _removeAttribute(name, currentNode, attr);
         // Prefix the value and later re-create the attribute with the sanitized value
         value = SANITIZE_NAMED_PROPS_PREFIX + value;
+        // This attribute owns the record just pushed; its recreate writeback
+        // is the one allowed to pop it back off.
+        recreatedNamedProp = true;
       }
       // Else: already prefixed, leave the attribute alone — the prefix is
       // itself the clobbering protection, and re-applying it is incorrect.
@@ -2666,7 +2711,14 @@ function createDOMPurify() {
       value = _applyTrustedTypesToAttribute(lcTag, lcName, namespaceURI, value);
       /* Handle invalid data-* attribute set by try-catching it */
       if (value !== initValue) {
-        _setAttributeValue(currentNode, name, namespaceURI, value);
+        const cleanWrite = _setAttributeValue(currentNode, name, namespaceURI, value);
+        /* Only the named-prop remove-and-recreate owns a DOMPurify.removed
+           record to pop; a plain trim/template/Trusted-Types writeback owns
+           none, so popping here would drop an unrelated subtree's cleanup
+           record (SO-001). */
+        if (cleanWrite && recreatedNamedProp) {
+          arrayPop(DOMPurify.removed);
+        }
       }
     }
     /* Execute a hook if present */
@@ -2942,8 +2994,15 @@ function createDOMPurify() {
          them before the main iterator runs, since the iterator does not
          descend into shadow trees. The walk routes every read through a
          cached prototype getter so clobbering descendants on a form root
-         cannot hide a shadow host from this pass. */
-      _sanitizeAttachedShadowRoots(importedNode);
+         cannot hide a shadow host from this pass.
+                Traverse from `body`, not `importedNode`: when importedNode is a
+         DocumentFragment, the appendChild() above moves its children into
+         `body` and leaves the fragment empty, so walking importedNode would
+         scan nothing and miss every attached shadow host now under `body`
+         (SO-003). In the BODY/HTML branches `body === importedNode`, so this
+         is equivalent there; in the element branch `body` contains the
+         appended element and its descendants. `body` covers all three. */
+      _sanitizeAttachedShadowRoots(body);
     } else {
       /* Exit directly if we have nothing to do */
       if (!RETURN_DOM && !SAFE_FOR_TEMPLATES && !WHOLE_DOCUMENT &&
@@ -8663,7 +8722,7 @@ class Interpolator {
           interpolationkey: match[1].trim()
         }), value.trim());
       }
-      str = str.replace(match[0], value);
+      str = str.replace(match[0], regexSafe(makeString(value)));
       this.regexp.lastIndex = 0;
     }
     return str;
@@ -9722,7 +9781,7 @@ function getWindow() {
 }
 function getAtomicEnvironment(headlessVersion) {
     return {
-        version: "3.61.3",
+        version: "3.61.4",
         headlessVersion
     };
 }
@@ -9920,7 +9979,7 @@ function isSafeUrlSegmentBase(v) {
 	if (UNSAFE_KEYS$1.indexOf(v) > -1) return false;
 	if (v.indexOf("..") > -1) return false;
 	if (v.indexOf("\\") > -1) return false;
-	if (/[?#%\s]/.test(v)) return false;
+	if (/[?#%:\s]/.test(v)) return false;
 	if (/[\x00-\x1F\x7F]/.test(v)) return false;
 	return true;
 }
@@ -9930,7 +9989,9 @@ function isSafeLangUrlSegment(v) {
 	return true;
 }
 function isSafeNsUrlSegment(v) {
-	return isSafeUrlSegmentBase(v);
+	if (!isSafeUrlSegmentBase(v)) return false;
+	if (v.indexOf("//") > -1) return false;
+	return true;
 }
 const SAFETY_CHECK_BY_KEY = {
 	lng: isSafeLangUrlSegment,
@@ -17619,7 +17680,7 @@ var attachStyles = (hostRef) => {
   const cmpMeta = hostRef.$cmpMeta$;
   const elm = hostRef.$hostElement$;
   const flags = cmpMeta.$flags$;
-  createTime("attachStyles", cmpMeta.$tagName$);
+  const endAttachStyles = createTime("attachStyles", cmpMeta.$tagName$);
   const scopeId2 = addStyle(
     elm.shadowRoot ? elm.shadowRoot : elm.getRootNode(),
     cmpMeta,
@@ -17632,6 +17693,7 @@ var attachStyles = (hostRef) => {
       elm.classList.add(scopeId2 + "-s");
     }
   }
+  endAttachStyles();
 };
 var getScopeId = (cmp, mode) => "sc-" + (mode && cmp.$flags$ & 32 /* hasMode */ ? cmp.$tagName$ + "-" + mode : cmp.$tagName$);
 var setAccessor = (elm, memberName, oldValue, newValue, isSvg, flags) => {
@@ -18313,7 +18375,7 @@ var scheduleUpdate = (hostRef, isInitialLoad) => {
 };
 var dispatchHooks = (hostRef, isInitialLoad) => {
   const elm = hostRef.$hostElement$;
-  createTime("scheduleUpdate", hostRef.$cmpMeta$.$tagName$);
+  const endSchedule = createTime("scheduleUpdate", hostRef.$cmpMeta$.$tagName$);
   const instance = elm;
   if (!instance) {
     throw new Error(
@@ -18333,6 +18395,7 @@ var dispatchHooks = (hostRef, isInitialLoad) => {
   {
     maybePromise = enqueue(maybePromise, () => safeCall(instance, "componentWillRender"));
   }
+  endSchedule();
   return enqueue(maybePromise, () => updateComponent(hostRef, instance, isInitialLoad));
 };
 var enqueue = (maybePromise, fn) => isPromisey(maybePromise) ? maybePromise.then(fn).catch((err2) => {
@@ -18342,15 +18405,17 @@ var enqueue = (maybePromise, fn) => isPromisey(maybePromise) ? maybePromise.then
 var isPromisey = (maybePromise) => maybePromise instanceof Promise || maybePromise && maybePromise.then && typeof maybePromise.then === "function";
 var updateComponent = async (hostRef, instance, isInitialLoad) => {
   const elm = hostRef.$hostElement$;
-  createTime("update", hostRef.$cmpMeta$.$tagName$);
+  const endUpdate = createTime("update", hostRef.$cmpMeta$.$tagName$);
   elm["s-rc"];
   if (isInitialLoad) {
     attachStyles(hostRef);
   }
-  createTime("render", hostRef.$cmpMeta$.$tagName$);
+  const endRender = createTime("render", hostRef.$cmpMeta$.$tagName$);
   {
     callRender(hostRef, instance, elm, isInitialLoad);
   }
+  endRender();
+  endUpdate();
   {
     postUpdateComponent(hostRef);
   }
@@ -18384,8 +18449,9 @@ var callRender = (hostRef, instance, elm, isInitialLoad) => {
   return null;
 };
 var postUpdateComponent = (hostRef) => {
-  hostRef.$cmpMeta$.$tagName$;
+  const tagName = hostRef.$cmpMeta$.$tagName$;
   const elm = hostRef.$hostElement$;
+  const endPostUpdate = createTime("postUpdate", tagName);
   const instance = elm;
   hostRef.$ancestorComponent$;
   {
@@ -18396,10 +18462,12 @@ var postUpdateComponent = (hostRef) => {
     {
       safeCall(instance, "componentDidLoad");
     }
+    endPostUpdate();
   } else {
     {
       safeCall(instance, "componentDidUpdate");
     }
+    endPostUpdate();
   }
 };
 var safeCall = (instance, method, arg) => {
@@ -18546,8 +18614,9 @@ var initializeComponent = async (elm, hostRef, cmpMeta, hmrVersionId) => {
       }
       const scopeId2 = getScopeId(cmpMeta, hostRef.$modeName$);
       if (!styles$1.has(scopeId2)) {
-        createTime("registerStyles", cmpMeta.$tagName$);
+        const endRegisterStyles = createTime("registerStyles", cmpMeta.$tagName$);
         registerStyle(scopeId2, style, !!(cmpMeta.$flags$ & 1 /* shadowDomEncapsulation */));
+        endRegisterStyles();
       }
     }
   }
@@ -18565,7 +18634,7 @@ var connectedCallback = (elm) => {
   if ((plt.$flags$ & 1 /* isTmpDisconnected */) === 0) {
     const hostRef = getHostRef(elm);
     const cmpMeta = hostRef.$cmpMeta$;
-    createTime("connectedCallback", cmpMeta.$tagName$);
+    const endConnected = createTime("connectedCallback", cmpMeta.$tagName$);
     if (!(hostRef.$flags$ & 1 /* hasConnected */)) {
       hostRef.$flags$ |= 1 /* hasConnected */;
       {
@@ -18594,6 +18663,7 @@ var connectedCallback = (elm) => {
         hostRef.$onReadyPromise$.then(() => fireConnectedCallback(hostRef.$lazyInstance$));
       }
     }
+    endConnected();
   }
 };
 var setContentReference = (elm) => {