@faststore/api 2.2.0-alpha.6 → 2.2.16

package/dist/api.esm.js

@@ -2,6 +2,7 @@ import { makeExecutableSchema } from '@graphql-tools/schema';
 import fetch from 'isomorphic-unfetch';
 import DataLoader from 'dataloader';
 import pLimit from 'p-limit';
+import sanitizeHtmlLib from 'sanitize-html';
 import deepEquals from 'fast-deep-equal';
 import crypto from 'crypto';
 import { GraphQLScalarType, print, Kind as Kind$1 } from 'graphql';
@@ -18,7 +19,7 @@ import { trace, context, SpanKind } from '@opentelemetry/api';
 import { SeverityNumber } from '@opentelemetry/api-logs';
 
 var name = "@faststore/api";
-var version = "2.2.0-alpha.1";
+var version = "2.2.0";
 var license = "MIT";
 var main = "dist/index.js";
 var typings = "dist/index.d.ts";
@@ -50,15 +51,17 @@ var dependencies = {
 	dataloader: "^2.1.0",
 	"fast-deep-equal": "^3.1.3",
 	"isomorphic-unfetch": "^3.1.0",
-	"p-limit": "^3.1.0"
+	"p-limit": "^3.1.0",
+	"sanitize-html": "^2.11.0"
 };
 var devDependencies = {
 	"@envelop/core": "^2.6.0",
-	"@faststore/eslint-config": "^2.2.0-alpha.1",
-	"@faststore/shared": "^2.2.0-alpha.1",
+	"@faststore/eslint-config": "^2.2.0",
+	"@faststore/shared": "^2.2.0",
 	"@graphql-codegen/cli": "2.2.0",
 	"@graphql-codegen/typescript": "2.2.2",
 	"@types/express": "^4.17.16",
+	"@types/sanitize-html": "^2.9.1",
 	concurrently: "^6.2.1",
 	eslint: "7.32.0",
 	express: "^4.17.3",
@@ -511,9 +514,32 @@ const getSimulationLoader = (_, clients) => {
   });
 };
 
+/**
+ * For now, we're using sanitize-html's default set
+ * of allowed tags and attributes, which don't even include img elements
+ *
+ * It is known many client depends on pontentially vulnerable tags, such as script tags
+ * We chose to be restrictive at first, and document those restrictions later.
+ *
+ * When expanding the set of allowed tags and attributes, please consider performance, privacy and security.
+ *
+ * This possibily breaks compatibility with Portal and Store Framework,
+ * which both allows an enormous amount of tags and attributes
+ *
+ * This was a thoughtful decision that can be reviewed in the future given
+ * research was made to back up those changes.
+ */
+const sanitizeHtml = (dirty, options) => sanitizeHtmlLib(dirty, options);
+
+function sanitizeProduct(product) {
+  return {
+    ...product,
+    description: product.description ? sanitizeHtml(product.description) : product.description
+  };
+}
 const enhanceSku = (item, product) => ({
   ...item,
-  isVariantOf: product
+  isVariantOf: sanitizeProduct(product)
 });
 
 class FastStoreError extends Error {