@journeyrewards/hive-vercel 1.2.0 → 1.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +15 -4
- package/dist/index.mjs +15 -4
- package/package.json +1 -1
package/dist/index.js
CHANGED
|
@@ -397,6 +397,14 @@ function MessageBubble({ role, content, timestamp }) {
|
|
|
397
397
|
) : null
|
|
398
398
|
);
|
|
399
399
|
}
|
|
400
|
+
function isSafeUrl(url) {
|
|
401
|
+
try {
|
|
402
|
+
const parsed = new URL(url);
|
|
403
|
+
return parsed.protocol === "https:" || parsed.protocol === "http:";
|
|
404
|
+
} catch {
|
|
405
|
+
return false;
|
|
406
|
+
}
|
|
407
|
+
}
|
|
400
408
|
function ChartEmbed({ embedUrl, imageUrl, title, chartId, width, height, className }) {
|
|
401
409
|
const containerStyle = {
|
|
402
410
|
margin: "8px 0 16px",
|
|
@@ -405,7 +413,7 @@ function ChartEmbed({ embedUrl, imageUrl, title, chartId, width, height, classNa
|
|
|
405
413
|
border: "1px solid #e2e2ea",
|
|
406
414
|
maxWidth: width || "640px"
|
|
407
415
|
};
|
|
408
|
-
if (embedUrl) {
|
|
416
|
+
if (embedUrl && isSafeUrl(embedUrl)) {
|
|
409
417
|
return (0, import_react2.createElement)(
|
|
410
418
|
"div",
|
|
411
419
|
{ className: `jh-chart-embed ${className || ""}`.trim(), style: containerStyle },
|
|
@@ -413,11 +421,13 @@ function ChartEmbed({ embedUrl, imageUrl, title, chartId, width, height, classNa
|
|
|
413
421
|
src: embedUrl,
|
|
414
422
|
title: title || "Chart",
|
|
415
423
|
style: { width: "100%", height: height || "400px", border: "none" },
|
|
416
|
-
loading: "lazy"
|
|
424
|
+
loading: "lazy",
|
|
425
|
+
sandbox: "allow-scripts allow-same-origin",
|
|
426
|
+
referrerPolicy: "no-referrer"
|
|
417
427
|
})
|
|
418
428
|
);
|
|
419
429
|
}
|
|
420
|
-
if (imageUrl) {
|
|
430
|
+
if (imageUrl && isSafeUrl(imageUrl)) {
|
|
421
431
|
return (0, import_react2.createElement)(
|
|
422
432
|
"div",
|
|
423
433
|
{ className: `jh-chart-embed ${className || ""}`.trim(), style: containerStyle },
|
|
@@ -425,7 +435,8 @@ function ChartEmbed({ embedUrl, imageUrl, title, chartId, width, height, classNa
|
|
|
425
435
|
src: imageUrl,
|
|
426
436
|
alt: title || "Chart",
|
|
427
437
|
style: { width: "100%", height: "auto", display: "block" },
|
|
428
|
-
loading: "lazy"
|
|
438
|
+
loading: "lazy",
|
|
439
|
+
referrerPolicy: "no-referrer"
|
|
429
440
|
})
|
|
430
441
|
);
|
|
431
442
|
}
|
package/dist/index.mjs
CHANGED
|
@@ -371,6 +371,14 @@ function MessageBubble({ role, content, timestamp }) {
|
|
|
371
371
|
) : null
|
|
372
372
|
);
|
|
373
373
|
}
|
|
374
|
+
function isSafeUrl(url) {
|
|
375
|
+
try {
|
|
376
|
+
const parsed = new URL(url);
|
|
377
|
+
return parsed.protocol === "https:" || parsed.protocol === "http:";
|
|
378
|
+
} catch {
|
|
379
|
+
return false;
|
|
380
|
+
}
|
|
381
|
+
}
|
|
374
382
|
function ChartEmbed({ embedUrl, imageUrl, title, chartId, width, height, className }) {
|
|
375
383
|
const containerStyle = {
|
|
376
384
|
margin: "8px 0 16px",
|
|
@@ -379,7 +387,7 @@ function ChartEmbed({ embedUrl, imageUrl, title, chartId, width, height, classNa
|
|
|
379
387
|
border: "1px solid #e2e2ea",
|
|
380
388
|
maxWidth: width || "640px"
|
|
381
389
|
};
|
|
382
|
-
if (embedUrl) {
|
|
390
|
+
if (embedUrl && isSafeUrl(embedUrl)) {
|
|
383
391
|
return createElement2(
|
|
384
392
|
"div",
|
|
385
393
|
{ className: `jh-chart-embed ${className || ""}`.trim(), style: containerStyle },
|
|
@@ -387,11 +395,13 @@ function ChartEmbed({ embedUrl, imageUrl, title, chartId, width, height, classNa
|
|
|
387
395
|
src: embedUrl,
|
|
388
396
|
title: title || "Chart",
|
|
389
397
|
style: { width: "100%", height: height || "400px", border: "none" },
|
|
390
|
-
loading: "lazy"
|
|
398
|
+
loading: "lazy",
|
|
399
|
+
sandbox: "allow-scripts allow-same-origin",
|
|
400
|
+
referrerPolicy: "no-referrer"
|
|
391
401
|
})
|
|
392
402
|
);
|
|
393
403
|
}
|
|
394
|
-
if (imageUrl) {
|
|
404
|
+
if (imageUrl && isSafeUrl(imageUrl)) {
|
|
395
405
|
return createElement2(
|
|
396
406
|
"div",
|
|
397
407
|
{ className: `jh-chart-embed ${className || ""}`.trim(), style: containerStyle },
|
|
@@ -399,7 +409,8 @@ function ChartEmbed({ embedUrl, imageUrl, title, chartId, width, height, classNa
|
|
|
399
409
|
src: imageUrl,
|
|
400
410
|
alt: title || "Chart",
|
|
401
411
|
style: { width: "100%", height: "auto", display: "block" },
|
|
402
|
-
loading: "lazy"
|
|
412
|
+
loading: "lazy",
|
|
413
|
+
referrerPolicy: "no-referrer"
|
|
403
414
|
})
|
|
404
415
|
);
|
|
405
416
|
}
|