@elementor/editor-canvas 4.5.0-1158 → 4.5.0-1159

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/dist/index.js +7 -0
  2. package/dist/index.mjs +7 -0
  3. package/package.json +20 -20
  4. package/src/renderers/__tests__/create-dom-renderer.test.ts +24 -0
  5. package/src/renderers/create-dom-renderer.ts +10 -0
package/dist/index.js CHANGED
@@ -2854,6 +2854,7 @@ function createDomRenderer() {
2854
2854
  const environment = (0, import_twing.createEnvironment)(loader);
2855
2855
  environment.registerEscapingStrategy(escapeHtmlTag, "html_tag");
2856
2856
  environment.registerEscapingStrategy(escapeURL, "full_url");
2857
+ environment.registerEscapingStrategy(escapeJsIdentifier, "js_identifier");
2857
2858
  return {
2858
2859
  register: loader.setTemplate,
2859
2860
  render: environment.render
@@ -2867,6 +2868,12 @@ function escapeHtmlTag(value) {
2867
2868
  const normalizedTag = value?.toLowerCase?.() ?? "";
2868
2869
  return allowedTags.includes(normalizedTag) ? value : "div";
2869
2870
  }
2871
+ var JS_IDENTIFIER_PATTERN = /^[A-Za-z0-9_]+$/;
2872
+ function escapeJsIdentifier(value) {
2873
+ const id = String(value ?? "");
2874
+ const match = id.match(JS_IDENTIFIER_PATTERN);
2875
+ return match?.[0] === id ? id : "";
2876
+ }
2870
2877
  function escapeURL(value) {
2871
2878
  const allowedProtocols = ["http:", "https:", "mailto:", "tel:"];
2872
2879
  try {
package/dist/index.mjs CHANGED
@@ -2810,6 +2810,7 @@ function createDomRenderer() {
2810
2810
  const environment = createEnvironment(loader);
2811
2811
  environment.registerEscapingStrategy(escapeHtmlTag, "html_tag");
2812
2812
  environment.registerEscapingStrategy(escapeURL, "full_url");
2813
+ environment.registerEscapingStrategy(escapeJsIdentifier, "js_identifier");
2813
2814
  return {
2814
2815
  register: loader.setTemplate,
2815
2816
  render: environment.render
@@ -2823,6 +2824,12 @@ function escapeHtmlTag(value) {
2823
2824
  const normalizedTag = value?.toLowerCase?.() ?? "";
2824
2825
  return allowedTags.includes(normalizedTag) ? value : "div";
2825
2826
  }
2827
+ var JS_IDENTIFIER_PATTERN = /^[A-Za-z0-9_]+$/;
2828
+ function escapeJsIdentifier(value) {
2829
+ const id = String(value ?? "");
2830
+ const match = id.match(JS_IDENTIFIER_PATTERN);
2831
+ return match?.[0] === id ? id : "";
2832
+ }
2826
2833
  function escapeURL(value) {
2827
2834
  const allowedProtocols = ["http:", "https:", "mailto:", "tel:"];
2828
2835
  try {
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@elementor/editor-canvas",
3
3
  "description": "Elementor Editor Canvas",
4
- "version": "4.5.0-1158",
4
+ "version": "4.5.0-1159",
5
5
  "private": false,
6
6
  "author": "Elementor Team",
7
7
  "homepage": "https://elementor.com/",
@@ -37,26 +37,26 @@
37
37
  "react-dom": "^18.3.1"
38
38
  },
39
39
  "dependencies": {
40
- "@elementor/editor": "4.5.0-1158",
41
- "@elementor/editor-controls": "4.5.0-1158",
42
- "@elementor/editor-documents": "4.5.0-1158",
43
- "@elementor/editor-elements": "4.5.0-1158",
44
- "@elementor/editor-interactions": "4.5.0-1158",
45
- "@elementor/editor-mcp": "4.5.0-1158",
46
- "@elementor/editor-notifications": "4.5.0-1158",
47
- "@elementor/editor-props": "4.5.0-1158",
48
- "@elementor/editor-responsive": "4.5.0-1158",
49
- "@elementor/editor-styles": "4.5.0-1158",
50
- "@elementor/editor-styles-repository": "4.5.0-1158",
51
- "@elementor/editor-ui": "4.5.0-1158",
52
- "@elementor/editor-v1-adapters": "4.5.0-1158",
53
- "@elementor/events": "4.5.0-1158",
54
- "@elementor/http-client": "4.5.0-1158",
55
- "@elementor/schema": "4.5.0-1158",
56
- "@elementor/twing": "4.5.0-1158",
40
+ "@elementor/editor": "4.5.0-1159",
41
+ "@elementor/editor-controls": "4.5.0-1159",
42
+ "@elementor/editor-documents": "4.5.0-1159",
43
+ "@elementor/editor-elements": "4.5.0-1159",
44
+ "@elementor/editor-interactions": "4.5.0-1159",
45
+ "@elementor/editor-mcp": "4.5.0-1159",
46
+ "@elementor/editor-notifications": "4.5.0-1159",
47
+ "@elementor/editor-props": "4.5.0-1159",
48
+ "@elementor/editor-responsive": "4.5.0-1159",
49
+ "@elementor/editor-styles": "4.5.0-1159",
50
+ "@elementor/editor-styles-repository": "4.5.0-1159",
51
+ "@elementor/editor-ui": "4.5.0-1159",
52
+ "@elementor/editor-v1-adapters": "4.5.0-1159",
53
+ "@elementor/events": "4.5.0-1159",
54
+ "@elementor/http-client": "4.5.0-1159",
55
+ "@elementor/schema": "4.5.0-1159",
56
+ "@elementor/twing": "4.5.0-1159",
57
57
  "@elementor/ui": "1.41.4",
58
- "@elementor/utils": "4.5.0-1158",
59
- "@elementor/wp-media": "4.5.0-1158",
58
+ "@elementor/utils": "4.5.0-1159",
59
+ "@elementor/wp-media": "4.5.0-1159",
60
60
  "@floating-ui/react": "^0.27.5",
61
61
  "@wordpress/i18n": "^5.13.0",
62
62
  "dompurify": "^3.2.6"
package/src/renderers/__tests__/create-dom-renderer.test.ts CHANGED
@@ -77,6 +77,30 @@ describe( 'createDomRenderer', () => {
77
77
  context: { url: 'javascript:alert(123)' },
78
78
  expected: '',
79
79
  },
80
+ {
81
+ title: 'alphanumeric element id in an alpine expression',
82
+ template: `x-data="{% if (id | e( 'js_identifier' )) != '' %}eTabs{{ id | e( 'js_identifier' ) }}{% else %}{}{% endif %}"`,
83
+ context: { id: 'tabscontainer' },
84
+ expected: 'x-data="eTabstabscontainer"',
85
+ },
86
+ {
87
+ title: 'element id with underscore in an alpine expression',
88
+ template: `x-data="{% if (id | e( 'js_identifier' )) != '' %}eForm{{ id | e( 'js_identifier' ) }}{% else %}{}{% endif %}"`,
89
+ context: { id: 'test_atomic_form_instance' },
90
+ expected: 'x-data="eFormtest_atomic_form_instance"',
91
+ },
92
+ {
93
+ title: 'element id that is a javascript expression',
94
+ template: `x-data="{% if (id | e( 'js_identifier' )) != '' %}eTabs{{ id | e( 'js_identifier' ) }}{% else %}{}{% endif %}"`,
95
+ context: { id: '=window.alert(document.domain)' },
96
+ expected: 'x-data="{}"',
97
+ },
98
+ {
99
+ title: 'element id with a hyphen',
100
+ template: `x-data="{% if (id | e( 'js_identifier' )) != '' %}eBackgroundVideo{{ id | e( 'js_identifier' ) }}{% else %}{}{% endif %}"`,
101
+ context: { id: 'foo-alert(1)' },
102
+ expected: 'x-data="{}"',
103
+ },
80
104
  ] )( 'should render template with $title', async ( { template, context, expected } ) => {
81
105
  // Arrange.
82
106
  const domRenderer = createDomRenderer();
package/src/renderers/create-dom-renderer.ts CHANGED
@@ -11,6 +11,7 @@ export function createDomRenderer(): DomRenderer {
11
11
 
12
12
  environment.registerEscapingStrategy( escapeHtmlTag, 'html_tag' );
13
13
  environment.registerEscapingStrategy( escapeURL, 'full_url' );
14
+ environment.registerEscapingStrategy( escapeJsIdentifier, 'js_identifier' );
14
15
 
15
16
  return {
16
17
  register: loader.setTemplate,
@@ -34,6 +35,15 @@ function escapeHtmlTag( value: string ) {
34
35
  return allowedTags.includes( normalizedTag ) ? value : 'div';
35
36
  }
36
37
 
38
+ const JS_IDENTIFIER_PATTERN = /^[A-Za-z0-9_]+$/;
39
+
40
+ function escapeJsIdentifier( value: unknown ): string {
41
+ const id = String( value ?? '' );
42
+ const match = id.match( JS_IDENTIFIER_PATTERN );
43
+
44
+ return match?.[ 0 ] === id ? id : '';
45
+ }
46
+
37
47
  function escapeURL( value: string ) {
38
48
  const allowedProtocols = [ 'http:', 'https:', 'mailto:', 'tel:' ];
39
49