@datagouv/components-next 1.0.2-dev.180 → 1.0.2-dev.182

package/dist/{vue3-xml-viewer.common-B1KPK4L4.js → vue3-xml-viewer.common-B8-AwxIJ.js}

@@ -1,4 +1,4 @@
-import { g as Ke } from "./main-DD4ieUAo.js";
+import { g as Ke } from "./main-8mcMUsT7.js";
 import We from "vue";
 function Fe($, K) {
   for (var V = 0; V < K.length; V++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datagouv/components-next",
-  "version": "1.0.2-dev.180",
+  "version": "1.0.2-dev.182",
   "private": false,
   "type": "module",
   "engines": {

package/src/composables/useResourceCapabilities.ts

@@ -1,14 +1,13 @@
 import { computed, type MaybeRefOrGetter, toValue } from 'vue'
 import { useComponentsConfig } from '../config'
 import { isOrganizationCertified } from '../functions/organizations'
-import { getWfsExportFormats } from '../functions/resourceCapabilities'
+import { getGeneratedFormats, getWfsExportFormats } from '../functions/resourceCapabilities'
 import { detectOgcService, getParsingErrorMessage, getParsingErrorStep, isImagePreviewFormat } from '../functions/resources'
 import type { Dataset, DatasetV2 } from '../types/datasets'
 import type { Resource, WfsMetadata } from '../types/resources'
 import { useHasTabularData } from './useHasTabularData'
 import { useTranslation } from './useTranslation'
 
-const GENERATED_FORMATS = ['parquet', 'pmtiles', 'geojson']
 const URL_FORMATS = ['url', 'doi', 'www:link', 'www:link-1.0-http--link', 'www:link-1.0-http--partners', 'www:link-1.0-http--related', 'www:link-1.0-http--samples']
 
 // Which preview the data tab shows. Single source of truth: the viewer renders it and
@@ -54,24 +53,7 @@ export function useResourceCapabilities(
   const hasPmtilesError = computed(() => getParsingErrorStep(toValue(resource)) === 'pmtiles_export')
   const pmtilesError = computed(() => hasPmtilesError.value ? getParsingErrorMessage(toValue(resource)) : null)
 
-  const generatedFormats = computed(() => {
-    const r = toValue(resource)
-    const formats = GENERATED_FORMATS
-      .filter(format => `analysis:parsing:${format}_url` in r.extras)
-      .map(format => ({
-        url: r.extras[`analysis:parsing:${format}_url`] as string,
-        size: r.extras[`analysis:parsing:${format}_size`] as number | undefined,
-        format,
-      }))
-    if ('analysis:parsing:parsing_table' in r.extras) {
-      formats.push({
-        url: `${config.tabularApiUrl}/api/resources/${r.id}/data/json/`,
-        size: undefined,
-        format: 'json',
-      })
-    }
-    return formats
-  })
+  const generatedFormats = computed(() => getGeneratedFormats(toValue(resource), config.tabularApiUrl))
 
   const wfsFormats = computed(() => {
     return getWfsExportFormats(toValue(resource))

package/src/functions/helpers.ts

@@ -38,6 +38,21 @@ export const summarize = (val: number, fractionDigits = 0) => {
   return `${toFixedIfNotZero(val)}Y`
 }
 
+// Guards any value that ends up in an `href`: only absolute http(s) URLs are allowed.
+// Some of these URLs come from resource extras, which are freely writable by the
+// resource owner, so an unguarded value could carry a `javascript:` or `data:` scheme
+// and execute in the platform origin when a visitor clicks the link.
+export const isSafeHttpUrl = (value: unknown): value is string => {
+  if (typeof value !== 'string') return false
+  try {
+    const { protocol } = new URL(value)
+    return protocol === 'http:' || protocol === 'https:'
+  }
+  catch {
+    return false
+  }
+}
+
 export const escapeCsvValue = (value: string | number | null | undefined): string => {
   if (value === null || value === undefined || value === '') {
     return ''

package/src/functions/resourceCapabilities.ts

@@ -1,4 +1,35 @@
 import type { Resource, WfsMetadata, OgcLayerInfo } from '../types/resources'
+import { isSafeHttpUrl } from './helpers'
+
+const GENERATED_FORMATS = ['parquet', 'pmtiles', 'geojson']
+
+export type GeneratedFormat = {
+  url: string
+  size: number | undefined
+  format: string
+}
+
+export function getGeneratedFormats(resource: Pick<Resource, 'extras' | 'id'>, tabularApiUrl: string | undefined): GeneratedFormat[] {
+  const formats: GeneratedFormat[] = GENERATED_FORMATS.flatMap((format) => {
+    const url = resource.extras[`analysis:parsing:${format}_url`]
+    // The URL is read verbatim from owner-writable extras: drop any entry that is not
+    // a plain http(s) URL so a `javascript:`/`data:` value never reaches an href.
+    if (!isSafeHttpUrl(url)) return []
+    return [{
+      url,
+      size: resource.extras[`analysis:parsing:${format}_size`] as number | undefined,
+      format,
+    }]
+  })
+  if ('analysis:parsing:parsing_table' in resource.extras) {
+    formats.push({
+      url: `${tabularApiUrl}/api/resources/${resource.id}/data/json/`,
+      size: undefined,
+      format: 'json',
+    })
+  }
+  return formats
+}
 
 const WFS_EXPORT_FORMATS = [
   {
@@ -46,6 +77,9 @@ export function getWfsExportFormats(resource: Pick<Resource, 'extras' | 'url'>)
   const outputFormats = wfsMetadata.output_formats.map((format: string) => format.toLowerCase())
   const layer = wfsMetadata.detected_layer
   if (!layer) return []
+  // Every download URL below is built on top of `resource.url`, so its scheme is the one
+  // of `resource.url`: guard it once here rather than on each of the built URLs.
+  if (!isSafeHttpUrl(resource.url)) return []
   const formats = WFS_EXPORT_FORMATS.filter(format => outputFormats.includes(format.mimetype.toLowerCase()))
     .map(format => ({
       url: buildWfsDownloadUrl(resource.url, wfsMetadata, format, layer),