@gitlab/ui 42.11.0 → 42.12.0

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+# [42.12.0](https://gitlab.com/gitlab-org/gitlab-ui/compare/v42.11.0...v42.12.0) (2022-06-30)
+
+
+### Features
+
+* **SafeHtml:** allow non-http links in urls ([ef995ed](https://gitlab.com/gitlab-org/gitlab-ui/commit/ef995edbaeecccd8d4c6a457d1c0cf9a9a350245))
+
 # [42.11.0](https://gitlab.com/gitlab-org/gitlab-ui/compare/v42.10.1...v42.11.0) (2022-06-29)
 
 

package/dist/directives/safe_html/safe_html.js

@@ -8,6 +8,7 @@ import { forbiddenDataAttrs } from './constants';
 
 const DEFAULT_CONFIG = {
   RETURN_DOM_FRAGMENT: true,
+  ALLOW_UNKNOWN_PROTOCOLS: true,
   FORBID_ATTR: [...forbiddenDataAttrs]
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gitlab/ui",
-  "version": "42.11.0",
+  "version": "42.12.0",
   "description": "GitLab UI Components",
   "license": "MIT",
   "main": "dist/index.js",

package/src/directives/safe_html/safe_html.js

@@ -6,7 +6,11 @@ import { forbiddenDataAttrs } from './constants';
 // See https://gitlab.com/gitlab-org/gitlab-ui/-/merge_requests/1782
 // and https://gitlab.com/gitlab-org/gitlab-ui/-/merge_requests/2127
 // for more details.
-const DEFAULT_CONFIG = { RETURN_DOM_FRAGMENT: true, FORBID_ATTR: [...forbiddenDataAttrs] };
+const DEFAULT_CONFIG = {
+  RETURN_DOM_FRAGMENT: true,
+  ALLOW_UNKNOWN_PROTOCOLS: true,
+  FORBID_ATTR: [...forbiddenDataAttrs],
+};
 
 const transform = (el, binding) => {
   if (binding.oldValue !== binding.value) {

package/src/directives/safe_html/safe_html.spec.js

@@ -2,6 +2,17 @@ import { shallowMount } from '@vue/test-utils';
 import { forbiddenDataAttrs } from './constants';
 import { SafeHtmlDirective as safeHtml } from './safe_html';
 
+/* eslint-disable no-script-url */
+const invalidProtocolUrls = [
+  'javascript:alert(1)',
+  'jAvascript:alert(1)',
+  'data:text/html,<script>alert(1);</script>',
+  ' javascript:',
+  'javascript :',
+];
+/* eslint-enable no-script-url */
+const validProtocolUrls = ['slack://open', 'x-devonthink-item://90909', 'x-devonthink-item:90909'];
+
 describe('safe html directive', () => {
   let wrapper;
 
@@ -46,6 +57,22 @@ describe('safe html directive', () => {
       expect(wrapper.html()).toEqual('<div>hello world</div>');
     });
 
+    describe('with non-http links', () => {
+      it.each(validProtocolUrls)('should allow %s', (url) => {
+        createComponent({
+          html: `<a href="${url}">internal link</a>`,
+        });
+        expect(wrapper.html()).toContain(`<a href="${url}">internal link</a>`);
+      });
+
+      it.each(invalidProtocolUrls)('should not allow %s', (url) => {
+        createComponent({
+          html: `<a href="${url}">internal link</a>`,
+        });
+        expect(wrapper.html()).toContain(`<a>internal link</a>`);
+      });
+    });
+
     describe('handles data attributes correctly', () => {
       const acceptedDataAttrs = ['data-safe', 'data-random'];