@faststore/api 2.2.0-alpha.6 → 2.2.16

package/dist/api.cjs.development.js

@@ -6,6 +6,7 @@ var schema = require('@graphql-tools/schema');
 var fetch = _interopDefault(require('isomorphic-unfetch'));
 var DataLoader = _interopDefault(require('dataloader'));
 var pLimit = _interopDefault(require('p-limit'));
+var sanitizeHtmlLib = _interopDefault(require('sanitize-html'));
 var deepEquals = _interopDefault(require('fast-deep-equal'));
 var crypto = _interopDefault(require('crypto'));
 var graphql = require('graphql');
@@ -22,7 +23,7 @@ var api = require('@opentelemetry/api');
 var apiLogs = require('@opentelemetry/api-logs');
 
 var name = "@faststore/api";
-var version = "2.2.0-alpha.1";
+var version = "2.2.0";
 var license = "MIT";
 var main = "dist/index.js";
 var typings = "dist/index.d.ts";
@@ -54,15 +55,17 @@ var dependencies = {
 	dataloader: "^2.1.0",
 	"fast-deep-equal": "^3.1.3",
 	"isomorphic-unfetch": "^3.1.0",
-	"p-limit": "^3.1.0"
+	"p-limit": "^3.1.0",
+	"sanitize-html": "^2.11.0"
 };
 var devDependencies = {
 	"@envelop/core": "^2.6.0",
-	"@faststore/eslint-config": "^2.2.0-alpha.1",
-	"@faststore/shared": "^2.2.0-alpha.1",
+	"@faststore/eslint-config": "^2.2.0",
+	"@faststore/shared": "^2.2.0",
 	"@graphql-codegen/cli": "2.2.0",
 	"@graphql-codegen/typescript": "2.2.2",
 	"@types/express": "^4.17.16",
+	"@types/sanitize-html": "^2.9.1",
 	concurrently: "^6.2.1",
 	eslint: "7.32.0",
 	express: "^4.17.3",
@@ -515,9 +518,32 @@ const getSimulationLoader = (_, clients) => {
   });
 };
 
+/**
+ * For now, we're using sanitize-html's default set
+ * of allowed tags and attributes, which don't even include img elements
+ *
+ * It is known many client depends on pontentially vulnerable tags, such as script tags
+ * We chose to be restrictive at first, and document those restrictions later.
+ *
+ * When expanding the set of allowed tags and attributes, please consider performance, privacy and security.
+ *
+ * This possibily breaks compatibility with Portal and Store Framework,
+ * which both allows an enormous amount of tags and attributes
+ *
+ * This was a thoughtful decision that can be reviewed in the future given
+ * research was made to back up those changes.
+ */
+const sanitizeHtml = (dirty, options) => sanitizeHtmlLib(dirty, options);
+
+function sanitizeProduct(product) {
+  return {
+    ...product,
+    description: product.description ? sanitizeHtml(product.description) : product.description
+  };
+}
 const enhanceSku = (item, product) => ({
   ...item,
-  isVariantOf: product
+  isVariantOf: sanitizeProduct(product)
 });
 
 class FastStoreError extends Error {