@flowgram.ai/free-layout-core 0.4.15 → 0.4.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.js CHANGED
@@ -3653,11 +3653,35 @@ WorkflowDocumentContribution = __decorateClass([
3653
3653
 
3654
3654
  // src/utils/get-url-params.ts
3655
3655
  function getUrlParams() {
3656
- return location.search.replace(/^\?/, "").split("&").reduce((res, key) => {
3656
+ const paramsMap = /* @__PURE__ */ new Map();
3657
+ location.search.replace(/^\?/, "").split("&").forEach((key) => {
3658
+ if (!key) return;
3657
3659
  const [k, v] = key.split("=");
3658
- res[k] = v;
3659
- return res;
3660
- }, {});
3660
+ if (k) {
3661
+ const decodedKey = decodeURIComponent(k.trim());
3662
+ const decodedValue = v ? decodeURIComponent(v.trim()) : "";
3663
+ const dangerousProps = [
3664
+ "__proto__",
3665
+ "constructor",
3666
+ "prototype",
3667
+ "__defineGetter__",
3668
+ "__defineSetter__",
3669
+ "__lookupGetter__",
3670
+ "__lookupSetter__",
3671
+ "hasOwnProperty",
3672
+ "isPrototypeOf",
3673
+ "propertyIsEnumerable",
3674
+ "toString",
3675
+ "valueOf",
3676
+ "toLocaleString"
3677
+ ];
3678
+ if (dangerousProps.includes(decodedKey.toLowerCase())) {
3679
+ return;
3680
+ }
3681
+ paramsMap.set(decodedKey, decodedValue);
3682
+ }
3683
+ });
3684
+ return Object.fromEntries(paramsMap);
3661
3685
  }
3662
3686
 
3663
3687
  // src/workflow-document-container-module.ts