@memberjunction/react-runtime 6.2.0-edge.6 → 6.2.0-edge.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memberjunction/react-runtime",
-  "version": "6.2.0-edge.6",
+  "version": "6.2.0-edge.8",
   "description": "Platform-agnostic React component runtime for MemberJunction. Provides core compilation, registry, and execution capabilities for React components in any JavaScript environment.",
   "type": "module",
   "main": "dist/index.js",
@@ -20,12 +20,12 @@
   "homepage": "https://github.com/MemberJunction/MJ#readme",
   "dependencies": {
     "@babel/standalone": "^7.29.1",
-    "@memberjunction/ai-vectors-memory": "6.2.0-edge.6",
-    "@memberjunction/core": "6.2.0-edge.6",
-    "@memberjunction/core-entities": "6.2.0-edge.6",
-    "@memberjunction/global": "6.2.0-edge.6",
-    "@memberjunction/graphql-dataprovider": "6.2.0-edge.6",
-    "@memberjunction/interactive-component-types": "6.2.0-edge.6",
+    "@memberjunction/ai-vectors-memory": "6.2.0-edge.8",
+    "@memberjunction/core": "6.2.0-edge.8",
+    "@memberjunction/core-entities": "6.2.0-edge.8",
+    "@memberjunction/global": "6.2.0-edge.8",
+    "@memberjunction/graphql-dataprovider": "6.2.0-edge.8",
+    "@memberjunction/interactive-component-types": "6.2.0-edge.8",
     "rxjs": "^7.8.2"
   },
   "devDependencies": {

package/src/__tests__/subresource-url-selector-security.test.ts

@@ -0,0 +1,121 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('@memberjunction/core-entities', () => ({
+    MJComponentLibraryEntity: class {},
+}));
+
+import {
+    FindDomSubresourceByUrl,
+    IsAllowedSubresourceUrl,
+} from '../utilities/library-loader';
+import { ComponentCompiler } from '../compiler/component-compiler';
+
+interface FakeElement {
+    tagName: string;
+    rel?: string;
+    href?: string;
+    src?: string;
+    async?: boolean;
+    getAttribute(attr: string): string | null;
+}
+
+function makeFakeElement(tagName: string, attrs: { src?: string; href?: string } = {}): FakeElement {
+    return {
+        tagName,
+        src: attrs.src,
+        href: attrs.href,
+        getAttribute(attr: string): string | null {
+            if (attr === 'src') return this.src ?? null;
+            if (attr === 'href') return this.href ?? null;
+            return null;
+        },
+    };
+}
+
+describe('React runtime subresource URL screening & selector-injection prevention (PR #6034)', () => {
+    const scripts: FakeElement[] = [];
+    const links: FakeElement[] = [];
+    const appendedToHead: FakeElement[] = [];
+    const querySelectorSpy = vi.fn(() => {
+        throw new Error('querySelector should never be used for untrusted URL lookups');
+    });
+
+    beforeEach(() => {
+        scripts.length = 0;
+        links.length = 0;
+        appendedToHead.length = 0;
+        querySelectorSpy.mockClear();
+
+        vi.stubGlobal('window', { location: { origin: 'https://explorer.example.com' } });
+        vi.stubGlobal('document', {
+            querySelector: querySelectorSpy,
+            getElementsByTagName: vi.fn((tag: string) => {
+                if (tag === 'script') return scripts;
+                if (tag === 'link') return links;
+                return [];
+            }),
+            createElement: vi.fn((tag: string) => makeFakeElement(tag)),
+            head: {
+                appendChild: vi.fn((el: FakeElement) => {
+                    appendedToHead.push(el);
+                }),
+            },
+        });
+    });
+
+    afterEach(() => {
+        vi.unstubAllGlobals();
+    });
+
+    it('IsAllowedSubresourceUrl allows http(s) and same-origin paths while blocking dangerous schemes', () => {
+        expect(IsAllowedSubresourceUrl('https://cdn.jsdelivr.net/npm/react@18/umd/react.production.min.js')).toBe(true);
+        expect(IsAllowedSubresourceUrl('http://localhost:4200/vendor/lib.js')).toBe(true);
+        expect(IsAllowedSubresourceUrl('/assets/theme.css')).toBe(true);
+
+        expect(IsAllowedSubresourceUrl('javascript:alert(1)')).toBe(false);
+        expect(IsAllowedSubresourceUrl('data:text/javascript,alert(1)')).toBe(false);
+        expect(IsAllowedSubresourceUrl('blob:https://explorer.example.com/id')).toBe(false);
+        expect(IsAllowedSubresourceUrl('//evil.example.com/lib.js')).toBe(false);
+        expect(IsAllowedSubresourceUrl('')).toBe(false);
+        expect(IsAllowedSubresourceUrl(null)).toBe(false);
+    });
+
+    it('FindDomSubresourceByUrl safely matches URLs containing quotes and CSS selector metacharacters without calling querySelector', () => {
+        const trickyUrl = 'https://cdn.example.com/style.css?v=1"] , body[data-x="1';
+        const existing = makeFakeElement('link', { href: trickyUrl });
+        links.push(existing);
+
+        const found = FindDomSubresourceByUrl('link', 'href', trickyUrl);
+        expect(found).toBe(existing);
+        expect(FindDomSubresourceByUrl('link', 'href', 'https://cdn.example.com/other.css')).toBeNull();
+        expect(querySelectorSpy).not.toHaveBeenCalled();
+    });
+
+    it('ComponentCompiler.loadStyles and loadScript block non-http(s) URLs and avoid querySelector on quoted URLs', async () => {
+        const compiler = new ComponentCompiler();
+        const loadStyles = Reflect.get(compiler, 'loadStyles') as (urls: string[]) => Promise<void>;
+        const loadScript = Reflect.get(compiler, 'loadScript') as (url: string, globalName: string) => Promise<void>;
+
+        const quotedCssUrl = 'https://cdn.example.com/app.css?tok="]';
+        await loadStyles.call(compiler, [
+            'javascript:alert(1)',
+            'data:text/css,body{display:none}',
+            '//evil.example.com/inject.css',
+            quotedCssUrl,
+        ]);
+
+        // Only the valid https stylesheet was appended; querySelector was never invoked
+        expect(appendedToHead).toHaveLength(1);
+        expect(appendedToHead[0].href).toBe(quotedCssUrl);
+        expect(querySelectorSpy).not.toHaveBeenCalled();
+
+        // Dangerous script schemes reject immediately without creating a <script> tag
+        await expect(loadScript.call(compiler, 'javascript:alert(1)', 'EvilGlobal')).rejects.toThrow(
+            /Refused to load script from non-http\(s\) URL/,
+        );
+        await expect(loadScript.call(compiler, '//evil.example.com/x.js', 'EvilGlobal')).rejects.toThrow(
+            /Refused to load script from non-http\(s\) URL/,
+        );
+        expect(appendedToHead).toHaveLength(1);
+    });
+});

package/src/compiler/component-compiler.ts

@@ -15,7 +15,11 @@ import {
 } from '../types';
 import { ComponentStyles, ComponentObject } from '@memberjunction/interactive-component-types';
 import { LibraryRegistry } from '../utilities/library-registry';
-import { LibraryLoader } from '../utilities/library-loader';
+import {
+  FindDomSubresourceByUrl,
+  IsAllowedSubresourceUrl,
+  LibraryLoader,
+} from '../utilities/library-loader';
 import { UnwrapLibraryComponent, UnwrapLibraryComponents, UnwrapAllLibraryComponents } from '../utilities/component-unwrapper';
 import { MJComponentLibraryEntity } from '@memberjunction/core-entities';
 
@@ -643,8 +647,14 @@ export class ComponentCompiler {
   private async loadStyles(urls: string[]): Promise<void> {
     const loadPromises = urls.map(url => {
       return new Promise<void>((resolve) => {
-        // Check if stylesheet already exists
-        const existingLink = document.querySelector(`link[href="${url}"]`);
+        if (!IsAllowedSubresourceUrl(url)) {
+          resolve();
+          return;
+        }
+
+        // Check if stylesheet already exists via direct href attribute comparison instead of
+        // interpolating the URL into a CSS selector.
+        const existingLink = FindDomSubresourceByUrl('link', 'href', url);
         if (existingLink) {
           resolve();
           return;
@@ -673,8 +683,15 @@ export class ComponentCompiler {
    */
   private loadScript(url: string, globalName: string): Promise<void> {
     return new Promise((resolve, reject) => {
-      // Check if script already exists
-      const existingScript = document.querySelector(`script[src="${url}"]`);
+      if (!IsAllowedSubresourceUrl(url)) {
+        reject(new Error(`Refused to load script from non-http(s) URL: ${url}`));
+        return;
+      }
+
+      // Check if script already exists. Compare src attributes directly instead of interpolating
+      // the URL into a CSS selector, where quotes/brackets in a URL would break (or redirect) the
+      // selector match.
+      const existingScript = FindDomSubresourceByUrl('script', 'src', url);
       if (existingScript) {
         // Wait for it to finish loading with exponential backoff
         let attempts = 0;

package/src/utilities/library-loader.ts

@@ -19,6 +19,54 @@ import { LibraryRegistry } from './library-registry';
 // Unique component ID for resource tracking
 const LIBRARY_LOADER_COMPONENT_ID = 'mj-react-runtime-library-loader-singleton';
 
+/**
+ * Validates that a script or stylesheet subresource URL resolves to `http:` or `https:` and is not
+ * a scheme-relative (`//...`) reference. Prevents dangerous schemes (`javascript:`, `data:`,
+ * `blob:`, `vbscript:`) from reaching `<script src>` or `<link href>` DOM sinks.
+ */
+export function IsAllowedSubresourceUrl(url: string | null | undefined): boolean {
+  if (typeof url !== 'string') {
+    return false;
+  }
+  const trimmed = url.trim();
+  if (!trimmed || trimmed.startsWith('//')) {
+    return false;
+  }
+  try {
+    const baseOrigin =
+      typeof window !== 'undefined' && window.location?.origin
+        ? window.location.origin
+        : 'https://localhost';
+    const parsed = new URL(trimmed, baseOrigin);
+    return parsed.protocol === 'http:' || parsed.protocol === 'https:';
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Finds an existing `<script>` or `<link>` element by exact attribute comparison rather than
+ * interpolating an untrusted URL into `document.querySelector('tag[attr="..."]')`, where quotes or
+ * brackets in a URL can break or redirect CSS selector matching.
+ */
+export function FindDomSubresourceByUrl(
+  tagName: 'script' | 'link',
+  attrName: 'src' | 'href',
+  url: string,
+): HTMLScriptElement | HTMLLinkElement | null {
+  if (typeof document === 'undefined' || typeof document.getElementsByTagName !== 'function') {
+    return null;
+  }
+  const collection = document.getElementsByTagName(tagName);
+  for (let i = 0; i < collection.length; i++) {
+    const el = collection[i];
+    if (typeof el.getAttribute === 'function' && el.getAttribute(attrName) === url) {
+      return el;
+    }
+  }
+  return null;
+}
+
 /**
  * Represents a loaded script or CSS resource
  */
@@ -83,8 +131,11 @@ export class LibraryLoader {
     const coreLibraries = GetCoreRuntimeLibraries(debug);
     for (const lib of coreLibraries) {
       // Skip if already preloaded or loaded
-      if (document.querySelector(`link[href="${lib.cdnUrl}"]`) ||
-          document.querySelector(`script[src="${lib.cdnUrl}"]`)) {
+      if (
+        !IsAllowedSubresourceUrl(lib.cdnUrl) ||
+        FindDomSubresourceByUrl('link', 'href', lib.cdnUrl) ||
+        FindDomSubresourceByUrl('script', 'src', lib.cdnUrl)
+      ) {
         continue;
       }
       const link = document.createElement('link');
@@ -381,7 +432,13 @@ export class LibraryLoader {
       return existing.promise;
     }
 
+    let createdScript: HTMLScriptElement | null = null;
     const promise = new Promise((resolve, reject) => {
+      if (!IsAllowedSubresourceUrl(url)) {
+        reject(new Error(`Refused to load script from non-http(s) URL: ${url}`));
+        return;
+      }
+
       // Check if global already exists
       const existingGlobal = (window as any)[globalName];
       if (existingGlobal) {
@@ -389,8 +446,8 @@ export class LibraryLoader {
         return;
       }
 
-      // Check if script tag exists
-      const existingScript = document.querySelector(`script[src="${url}"]`);
+      // Check if script tag exists via direct attribute comparison (no CSS selector interpolation)
+      const existingScript = FindDomSubresourceByUrl('script', 'src', url);
       if (existingScript) {
         this.waitForScriptLoad(existingScript as HTMLScriptElement, globalName, resolve, reject);
         return;
@@ -400,6 +457,7 @@ export class LibraryLoader {
       // "no-cors" mode, which avoids CORS failures when CDN headers are missing
       // or browser tracking prevention interferes with the response.
       const script = document.createElement('script');
+      createdScript = script;
       script.src = url;
       script.async = true;
 
@@ -470,10 +528,13 @@ export class LibraryLoader {
       resourceManager.registerDOMElement(LIBRARY_LOADER_COMPONENT_ID, script);
     });
 
-    this.loadedResources.set(url, {
-      element: document.querySelector(`script[src="${url}"]`)!,
-      promise
-    });
+    const trackedElement = createdScript ?? FindDomSubresourceByUrl('script', 'src', url);
+    if (trackedElement) {
+      this.loadedResources.set(url, {
+        element: trackedElement,
+        promise
+      });
+    }
 
     return promise;
   }
@@ -576,11 +637,11 @@ export class LibraryLoader {
    * Load CSS from URL
    */
   private static loadCSS(url: string): void {
-    if (this.loadedResources.has(url)) {
+    if (!IsAllowedSubresourceUrl(url) || this.loadedResources.has(url)) {
       return;
     }
 
-    const existingLink = document.querySelector(`link[href="${url}"]`);
+    const existingLink = FindDomSubresourceByUrl('link', 'href', url);
     if (existingLink) {
       return;
     }

package/src/utilities/runtime-utilities.ts

@@ -169,7 +169,8 @@ export class RuntimeUtilities {
           // Use the AI client from GraphQLDataProvider to generate embeddings
           const result = await graphQLProvider.AI.EmbedText({
             textToEmbed: params.textToEmbed,
-            modelSize: params.modelSize
+            modelSize: params.modelSize,
+            inputType: params.inputType
           });
           
           if (result.error) {