@flowgram.ai/free-layout-core 0.4.15 → 0.4.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/esm/index.js CHANGED
@@ -3607,11 +3607,35 @@ WorkflowDocumentContribution = __decorateClass([
3607
3607
 
3608
3608
  // src/utils/get-url-params.ts
3609
3609
  function getUrlParams() {
3610
- return location.search.replace(/^\?/, "").split("&").reduce((res, key) => {
3610
+ const paramsMap = /* @__PURE__ */ new Map();
3611
+ location.search.replace(/^\?/, "").split("&").forEach((key) => {
3612
+ if (!key) return;
3611
3613
  const [k, v] = key.split("=");
3612
- res[k] = v;
3613
- return res;
3614
- }, {});
3614
+ if (k) {
3615
+ const decodedKey = decodeURIComponent(k.trim());
3616
+ const decodedValue = v ? decodeURIComponent(v.trim()) : "";
3617
+ const dangerousProps = [
3618
+ "__proto__",
3619
+ "constructor",
3620
+ "prototype",
3621
+ "__defineGetter__",
3622
+ "__defineSetter__",
3623
+ "__lookupGetter__",
3624
+ "__lookupSetter__",
3625
+ "hasOwnProperty",
3626
+ "isPrototypeOf",
3627
+ "propertyIsEnumerable",
3628
+ "toString",
3629
+ "valueOf",
3630
+ "toLocaleString"
3631
+ ];
3632
+ if (dangerousProps.includes(decodedKey.toLowerCase())) {
3633
+ return;
3634
+ }
3635
+ paramsMap.set(decodedKey, decodedValue);
3636
+ }
3637
+ });
3638
+ return Object.fromEntries(paramsMap);
3615
3639
  }
3616
3640
 
3617
3641
  // src/workflow-document-container-module.ts