@formio/js 5.5.0 → 5.5.1-api99.0

package/lib/mjs/utils/utils.js

@@ -404,6 +404,27 @@ export function checkTrigger(component, trigger, row, data, form, instance) {
     // If none of the types matched, don't fire the trigger.
     return false;
 }
+/**
+ * Recursively HTML-escape strings in submission-like objects so logic templates
+ * (e.g. dynamic labels) cannot treat user-entered values as HTML.
+ * @param {*} obj - The value to escape.
+ * @returns {*} - The same structure with strings escaped.
+ */
+export function escapeInterpolationDataStrings(obj) {
+    if (obj === null || obj === undefined) {
+        return obj;
+    }
+    if (typeof obj === 'string') {
+        return _.escape(obj);
+    }
+    if (Array.isArray(obj)) {
+        return obj.map(escapeInterpolationDataStrings);
+    }
+    if (_.isPlainObject(obj)) {
+        return _.mapValues(obj, escapeInterpolationDataStrings);
+    }
+    return obj;
+}
 /**
  * Sets a property on a component via an executed Logic action.
  * @param {import('@formio/core').Component} component - The component to set the property on.
@@ -426,11 +447,16 @@ export function setActionProperty(component, action, result, row, data, instance
             break;
         }
         case 'string': {
+            const safeData = escapeInterpolationDataStrings(data);
+            const safeRow = escapeInterpolationDataStrings(row);
+            const safeResult = typeof result === 'string'
+                ? _.escape(result)
+                : escapeInterpolationDataStrings(result);
             const evalData = {
-                data,
-                row,
+                data: safeData,
+                row: safeRow,
                 component,
-                result,
+                result: safeResult,
             };
             const textValue = action.property.component ? action[action.property.component] : action.text;
             const currentValue = _.get(component, property, '');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@formio/js",
-  "version": "5.5.0",
+  "version": "5.5.1-api99.0",
   "description": "JavaScript powered Forms with JSON Form Builder",
   "main": "lib/cjs/index.js",
   "exports": {
@@ -59,6 +59,7 @@
     "@formio/text-mask-addons": "^3.8.0-formio.4",
     "@formio/vanilla-text-mask": "^5.1.1-formio.1",
     "abortcontroller-polyfill": "^1.7.5",
+    "animation-frame-polyfill": "~1.0.3",
     "autocompleter": "^8.0.4",
     "bootstrap": "^5.3.3",
     "browser-cookies": "^1.2.0",
@@ -68,7 +69,7 @@
     "core-js": "^3.37.1",
     "dialog-polyfill": "^0.5.6",
     "dom-autoscroller": "^2.3.4",
-    "dompurify": "^3.4.0",
+    "dompurify": "^3.4.12",
     "downloadjs": "^1.4.7",
     "dragula": "^3.7.3",
     "eventemitter3": "^5.0.1",
@@ -89,8 +90,8 @@
     "tippy.js": "^6.3.7",
     "uuid": "^9.0.0",
     "vanilla-picker": "^2.12.3",
-    "@formio/bootstrap": "^4.0.3",
-    "@formio/core": "^2.8.0"
+    "@formio/bootstrap": "^4.0.4-api99.0",
+    "@formio/core": "^2.8.1-api99.0"
   },
   "devDependencies": {
     "@types/node": "^22.15.19",