@loafmarkets/ui 0.1.409 → 0.1.410

package/dist/index.js

@@ -2669,6 +2669,22 @@ var PropertyTour = React5__namespace.forwardRef(
   }
 );
 PropertyTour.displayName = "PropertyTour";
+
+// src/lib/isSafeUrl.ts
+var CONTROL_CHARS = /[\u0000-\u001F\u007F]/g;
+function isSafeUrl(url) {
+  if (!url) return false;
+  const cleaned = url.replace(CONTROL_CHARS, "").replace(/\\/g, "/").trim();
+  if (cleaned === "") return false;
+  if (cleaned.startsWith("//")) return false;
+  if (cleaned.startsWith("/")) return true;
+  try {
+    const { protocol } = new URL(cleaned);
+    return protocol === "http:" || protocol === "https:";
+  } catch {
+    return false;
+  }
+}
 var ITEMS_PER_PAGE = 5;
 var ITEMS_PER_PAGE_MOBILE = 5;
 var ensureAnimationsInjected = () => {
@@ -2864,7 +2880,7 @@ function NewsArticleModal({ item, onClose }) {
             ] }),
             /* @__PURE__ */ jsxRuntime.jsx("div", { style: { height: "1px", background: "rgba(255,255,255,0.08)", marginBottom: "1.25rem" } }),
             item.summary ? /* @__PURE__ */ jsxRuntime.jsx("p", { style: { fontSize: "0.875rem", color: "rgba(255,255,255,0.8)", lineHeight: 1.75, margin: 0 }, children: item.summary }) : /* @__PURE__ */ jsxRuntime.jsx("p", { style: { fontSize: "0.8rem", color: "rgba(255,255,255,0.35)", fontStyle: "italic", margin: 0 }, children: "Summary not available for this article." }),
-            item.url && /* @__PURE__ */ jsxRuntime.jsx("div", { style: { marginTop: "1.25rem", paddingTop: "1rem", borderTop: "1px solid rgba(255,255,255,0.08)" }, children: /* @__PURE__ */ jsxRuntime.jsxs(
+            item.url && isSafeUrl(item.url) && /* @__PURE__ */ jsxRuntime.jsx("div", { style: { marginTop: "1.25rem", paddingTop: "1rem", borderTop: "1px solid rgba(255,255,255,0.08)" }, children: /* @__PURE__ */ jsxRuntime.jsxs(
               "a",
               {
                 href: item.url,
@@ -6640,6 +6656,16 @@ var PropertySubheader = React5__namespace.forwardRef(
   }
 );
 PropertySubheader.displayName = "PropertySubheader";
+
+// src/lib/isTrustedTransakOrigin.ts
+function isTrustedTransakOrigin(eventOrigin, widgetUrl) {
+  if (!widgetUrl) return false;
+  try {
+    return eventOrigin === new URL(widgetUrl).origin;
+  } catch {
+    return false;
+  }
+}
 var DEFAULT_LOGO_SRC = Loaf_logo_Banner_default;
 var DEFAULT_LOGO_ALT = "Loaf";
 var OTP_INPUT_LENGTH = 6;
@@ -6780,7 +6806,7 @@ var LoginPopup = ({
   React5.useEffect(() => {
     if (!transakWidgetUrl) return;
     const handleTransakMessage = (event) => {
-      if (!event.origin.includes("transak.com") && !event.origin.includes("global.transak.com")) {
+      if (!isTrustedTransakOrigin(event.origin, transakWidgetUrl)) {
         return;
       }
       try {
@@ -12297,7 +12323,7 @@ function PropertyDocuments({ documentsData, highlightDocument, onClearHighlight
   const [previewTitle, setPreviewTitle] = React5.useState(null);
   const backendDocuments = Array.isArray(documentsData?.documents) ? documentsData.documents : [];
   const liveDocs = backendDocuments.filter(
-    (d) => Boolean(d.documentUrl) && LIVE_TITLE_PATTERNS.some((rx) => rx.test(d.title))
+    (d) => Boolean(d.documentUrl) && isSafeUrl(d.documentUrl) && LIVE_TITLE_PATTERNS.some((rx) => rx.test(d.title))
   );
   const comingSoonDocs = COMING_SOON_TITLES.filter(
     (title) => !liveDocs.some((d) => d.title.toLowerCase().includes(title.toLowerCase()) || title.toLowerCase().includes(d.title.toLowerCase()))