@flowgram.ai/free-layout-core 0.4.14 → 0.4.16

package/dist/index.js

@@ -26,8 +26,8 @@ var __decorateClass = (decorators, target, key, kind) => {
 };
 
 // src/index.ts
-var src_exports = {};
-__export(src_exports, {
+var index_exports = {};
+__export(index_exports, {
   EditorCursorState: () => EditorCursorState,
   InteractiveType: () => InteractiveType,
   LINE_HOVER_DISTANCE: () => LINE_HOVER_DISTANCE,
@@ -84,7 +84,7 @@ __export(src_exports, {
   useService: () => import_core25.useService,
   useWorkflowDocument: () => useWorkflowDocument
 });
-module.exports = __toCommonJS(src_exports);
+module.exports = __toCommonJS(index_exports);
 
 // src/workflow-commands.ts
 var WorkflowCommands = /* @__PURE__ */ ((WorkflowCommands2) => {
@@ -3653,11 +3653,35 @@ WorkflowDocumentContribution = __decorateClass([
 
 // src/utils/get-url-params.ts
 function getUrlParams() {
-  return location.search.replace(/^\?/, "").split("&").reduce((res, key) => {
+  const paramsMap = /* @__PURE__ */ new Map();
+  location.search.replace(/^\?/, "").split("&").forEach((key) => {
+    if (!key) return;
     const [k, v] = key.split("=");
-    res[k] = v;
-    return res;
-  }, {});
+    if (k) {
+      const decodedKey = decodeURIComponent(k.trim());
+      const decodedValue = v ? decodeURIComponent(v.trim()) : "";
+      const dangerousProps = [
+        "__proto__",
+        "constructor",
+        "prototype",
+        "__defineGetter__",
+        "__defineSetter__",
+        "__lookupGetter__",
+        "__lookupSetter__",
+        "hasOwnProperty",
+        "isPrototypeOf",
+        "propertyIsEnumerable",
+        "toString",
+        "valueOf",
+        "toLocaleString"
+      ];
+      if (dangerousProps.includes(decodedKey.toLowerCase())) {
+        return;
+      }
+      paramsMap.set(decodedKey, decodedValue);
+    }
+  });
+  return Object.fromEntries(paramsMap);
 }
 
 // src/workflow-document-container-module.ts