@datagouv/components-next 1.0.2-dev.201 → 1.0.2-dev.203

package/dist/{vue3-xml-viewer.common-CcF3Xd23.js → vue3-xml-viewer.common-BzKiHzXQ.js}

@@ -1,4 +1,4 @@
-import { g as Ke } from "./main-CVOZp_Nx.js";
+import { g as Ke } from "./main-CICNrWF8.js";
 import We from "vue";
 function Fe(I, K) {
   for (var V = 0; V < K.length; V++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datagouv/components-next",
-  "version": "1.0.2-dev.201",
+  "version": "1.0.2-dev.203",
   "private": false,
   "type": "module",
   "engines": {

package/src/components/ResourceAccordion/Pmtiles.client.vue

@@ -67,7 +67,7 @@ import styleVector from '../../../assets/json/vector.json'
 import PreviewUnavailable from './PreviewUnavailable.vue'
 import { useTranslation } from '../../composables/useTranslation'
 import franceSvg from './france.svg?raw'
-import { getOwnerName, getOwnerPage } from '../../functions/owned'
+import { getMapAttribution } from '../../functions/owned'
 
 const props = defineProps<{ resource: Resource, dataset: Dataset | DatasetV2 }>()
 
@@ -94,11 +94,7 @@ const lastUpdate = computed(() => {
 
 const container = useTemplateRef('containerRef')
 
-const attributions = computed(() => {
-  if (!props.dataset.organization && !props.dataset.owner)
-    return ''
-  return `© <a href="${getOwnerPage(props.dataset)}" target="_blank">${getOwnerName(props.dataset)}</a>`
-})
+const attributions = computed(() => getMapAttribution(props.dataset))
 
 async function displayMap() {
   await import('maplibre-gl/dist/maplibre-gl.css')

package/src/config.ts

@@ -1,6 +1,8 @@
 import { inject, type Component, type InjectionKey } from 'vue'
 import type { UseFetchFunction } from './functions/api.types'
 import type { $Fetch, FetchOptions } from 'ofetch'
+import type { Dataset, DatasetV2 } from './types/datasets'
+import type { CommunityResource, Resource } from './types/resources'
 
 export type PluginConfig = {
   name: string // Name of the application (ex: data.gouv.fr)
@@ -45,6 +47,12 @@ export type PluginConfig = {
   clientOnly?: Component | null
   searchDebounce?: number
   forumUrl?: string
+  /**
+   * Overrides the "Copier le lien" target built by `getResourceExternalUrl`.
+   * Must return an absolute URL: it is copied to the clipboard and used as an
+   * external, `_blank` link target.
+   */
+  getResourceExternalUrl?: (dataset: Dataset | DatasetV2 | Omit<Dataset, 'resources' | 'community_resources'>, resource: Resource | CommunityResource) => string
 }
 
 export const configKey = Symbol() as InjectionKey<PluginConfig>

package/src/functions/owned.ts

@@ -19,3 +19,24 @@ export function getOwnerPage(owned: Owned): string | null {
   }
   return null // Not supposed to exist but it does...
 }
+
+function escapeHtml(value: string): string {
+  return value
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;')
+}
+
+export function getMapAttribution(owned: Owned): string {
+  const name = getOwnerName(owned)
+  const page = getOwnerPage(owned)
+  if (!name && !page)
+    return ''
+  // The owner name is free text any user controls (organization name, or a
+  // profile's first/last name). maplibre-gl injects this attribution string
+  // into the DOM as HTML, and its own attribution sanitizer is bypassable via
+  // mutation XSS, so every interpolated value has to be escaped here.
+  return `© <a href="${escapeHtml(page ?? '')}" target="_blank">${escapeHtml(name)}</a>`
+}

package/src/functions/resources.ts

@@ -176,6 +176,9 @@ export function isCommunityResource(resource: Resource | CommunityResource): boo
 }
 
 export function getResourceExternalUrl(dataset: Dataset | DatasetV2 | Omit<Dataset, 'resources' | 'community_resources'>, resource: Resource | CommunityResource): string {
+  const config = useComponentsConfig()
+  if (config.getResourceExternalUrl) return config.getResourceExternalUrl(dataset, resource)
+
   return `${dataset.page}${isCommunityResource(resource) ? '/community-resources' : ''}?resource_id=${resource.id}`
 }