@fuentis/phoenix-ui 0.0.9-alpha.606 → 0.0.9-alpha.607

package/fesm2022/fuentis-phoenix-ui.mjs

@@ -3758,16 +3758,23 @@ class WhiteSpaceValidator {
 }
 
 function noDangerousCharsValidator() {
-    // Blocks only specific dangerous characters: < > " = $ /
-    //[<>"=$/]/ This was before but some catalog name or description contains "/"" so when field is desibled we cannot save form
-    const dangerousCharsPattern = /[<>"=$]/;
+    const dangerousPatterns = [
+        /<\s*script/i, // <script tags
+        /<\s*\/\s*script/i, // </script>
+        /javascript\s*:/i, // javascript: protocol
+        /on\w+\s*=/i, // event handlers like onerror= onclick=
+        /<\s*iframe/i, // iframes
+        /<\s*img[^>]+onerror/i, // <img onerror=
+        /expression\s*\(/i, // CSS expression() attacks
+        /vbscript\s*:/i, // vbscript: protocol
+    ];
     return (control) => {
         const value = control.value;
         if (!value)
             return null;
-        return dangerousCharsPattern.test(String(value))
-            ? { dangerousChars: true }
-            : null;
+        const str = String(value);
+        const isdangerous = dangerousPatterns.some(pattern => pattern.test(str));
+        return isdangerous ? { dangerousChars: true } : null;
     };
 }