@decentnetwork/beagle-ui 0.2.34 → 0.2.35

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/dist/beagle-ui.js +13 -2
  2. package/package.json +1 -1
package/dist/beagle-ui.js CHANGED
@@ -1,4 +1,4 @@
1
- export const BEAGLE_UI_VERSION = "0.2.34";
1
+ export const BEAGLE_UI_VERSION = "0.2.35";
2
2
  // src/icons.jsx
3
3
  var ICON_PATHS = {
4
4
  // ---- tab bar (the four must feel like one set) ----
@@ -1713,12 +1713,23 @@ ${lines}`, { assistant: { kind: "adopt", rows: fresh } }));
1713
1713
  }
1714
1714
 
1715
1715
  // src/request-avatar.js
1716
+ var REQUEST_AVATAR_HOST = "ens-gateway.beaglechat.workers.dev";
1716
1717
  var MAX_URL = 2048;
1717
1718
  function requestAvatarUrl(r) {
1718
1719
  const u = r && r.avatarUrl;
1719
1720
  if (typeof u !== "string" || !u || u.length > MAX_URL)
1720
1721
  return null;
1721
- return /^https:\/\/[^\s"'<>]+$/i.test(u) ? u : null;
1722
+ let parsed;
1723
+ try {
1724
+ parsed = new URL(u);
1725
+ } catch {
1726
+ return null;
1727
+ }
1728
+ if (parsed.protocol !== "https:" || parsed.host !== REQUEST_AVATAR_HOST)
1729
+ return null;
1730
+ if (parsed.username || parsed.password)
1731
+ return null;
1732
+ return parsed.href;
1722
1733
  }
1723
1734
  function requestPunkId(r) {
1724
1735
  const p = r && r.punkId;
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@decentnetwork/beagle-ui",
3
- "version": "0.2.34",
3
+ "version": "0.2.35",
4
4
  "description": "The Beagle chat UI, minus the machine it runs on — shared by the desktop install and the browser build.",
5
5
  "license": "MIT",
6
6
  "type": "module",