@microsoft/omnichannel-chat-components 1.1.16 → 1.1.17-0

package/lib/cjs/common/Constants.js

@@ -23,7 +23,7 @@ const HiddenTextStyles = {
 exports.HiddenTextStyles = HiddenTextStyles;
 const KeyCodes = (_class = class KeyCodes {}, _defineProperty(_class, "ENTER", "Enter"), _defineProperty(_class, "ESCAPE", "Escape"), _defineProperty(_class, "SPACE", "Space"), _defineProperty(_class, "DeclineCallHotKey", "D"), _defineProperty(_class, "AcceptAudioCallHotKey", "S"), _defineProperty(_class, "AcceptVideoCallHotKey", "A"), _defineProperty(_class, "ToggleMicHotKey", "M"), _defineProperty(_class, "ToggleCameraHotKey", "O"), _defineProperty(_class, "EndCallHotKey", "H"), _class);
 exports.KeyCodes = KeyCodes;
-const Regex = (_class2 = class Regex {}, _defineProperty(_class2, "EmailRegex", "(?:[a-zA-Z0-9!#$%&'*+/=?^_`{|}~-]+(?:\\.[a-zA-Z0-9!#$%&'*+/=?^_`{|}~-]+)*|\"(?:[\\x01-\\x08\\x0b\\x0c\\x0e-\\x1f\\x21\\x23-\\x5b\\x5d-\\x7f]|\\\\[\\x01-\\x09\\x0b\\x0c\\x0e-\\x7f])*\")@(?:(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?\\.)+[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?|\\[(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?|[a-zA-Z0-9-]*[a-zA-Z0-9]:(?:[\\x01-\\x08\\x0b\\x0c\\x0e-\\x1f\\x21-\\x5a\\x53-\\x7f]|\\\\[\\x01-\\x09\\x0b\\x0c\\x0e-\\x7f])+)\\])"), _defineProperty(_class2, "URLRegex", /(https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9]+\.[^\s]{2,}|www\.[a-zA-Z0-9]+\.[^\s]{2,})/gi), _class2);
+const Regex = (_class2 = class Regex {}, _defineProperty(_class2, "EmailRegex", "(?:[a-zA-Z0-9!#$%&'*+/=?^_`{|}~-]+(?:\\.[a-zA-Z0-9!#$%&'*+/=?^_`{|}~-]+)*|\"(?:[\\x01-\\x08\\x0b\\x0c\\x0e-\\x1f\\x21\\x23-\\x5b\\x5d-\\x7f]|\\\\[\\x01-\\x09\\x0b\\x0c\\x0e-\\x7f])*\")@(?:(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?\\.)+[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?|\\[(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?|[a-zA-Z0-9-]*[a-zA-Z0-9]:(?:[\\x01-\\x08\\x0b\\x0c\\x0e-\\x1f\\x21-\\x5a\\x53-\\x7f]|\\\\[\\x01-\\x09\\x0b\\x0c\\x0e-\\x7f])+)\\])"), _defineProperty(_class2, "URLRegex", /(https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9]+\.[^\s]{2,}|www\.[a-zA-Z0-9]+\.[^\s]{2,}|mailto:[^\s]+|tel:[^\s]+|sms:[^\s]+)/gi), _class2);
 exports.Regex = Regex;
 let ElementType;
 exports.ElementType = ElementType;

package/lib/cjs/common/utils.js

@@ -131,20 +131,48 @@ const addNoreferrerNoopenerTag = htmlNode => {
       }
     }
   }
-};
+}; // Escape HTML special characters to prevent XSS in string concatenation
+
 
 exports.addNoreferrerNoopenerTag = addNoreferrerNoopenerTag;
 
+const escapeHTML = str => {
+  return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#x27;");
+}; // Escape only characters dangerous in href attribute context
+
+
+const escapeHrefAttribute = url => {
+  return url.replace(/"/g, "&quot;").replace(/'/g, "&#x27;");
+}; // Validate and sanitize URL to prevent javascript: and data: protocols
+
+
+const isValidURL = url => {
+  const trimmedUrl = url.trim().toLowerCase(); // Block dangerous protocols
+
+  if (trimmedUrl.startsWith("javascript:") || trimmedUrl.startsWith("data:") || trimmedUrl.startsWith("vbscript:") || trimmedUrl.startsWith("file:")) {
+    return false;
+  } // Allow http, https, protocol-relative URLs, and safe contact schemes
+
+
+  return trimmedUrl.startsWith("http://") || trimmedUrl.startsWith("https://") || trimmedUrl.startsWith("www.") || trimmedUrl.startsWith("mailto:") || trimmedUrl.startsWith("tel:") || trimmedUrl.startsWith("sms:");
+};
+
 const replaceURLWithAnchor = (text, openInNewTab) => {
   if (text) {
     const modifiedText = text.replace(_Constants.Regex.URLRegex, function (url) {
-      if (openInNewTab) {
-        // eslint-disable-next-line quotes
-        return '<a href="' + url + '" rel="noreferrer noopener" target="_blank">' + url + '</a>';
-      } // eslint-disable-next-line quotes
+      // Validate URL to prevent dangerous protocols
+      if (!isValidURL(url)) {
+        return escapeHTML(url); // Return escaped text, not a link
+      }
+
+      const escapedUrl = escapeHrefAttribute(url);
+      const displayText = escapeHTML(url);
 
+      if (openInNewTab) {
+        return `<a href="${escapedUrl}" rel="noreferrer noopener" target="_blank">${displayText}</a>`;
+      }
 
-      return '<a href="' + url + '">' + url + '</a>';
+      return `<a href="${escapedUrl}">${displayText}</a>`;
     });
     return modifiedText;
   }

package/lib/esm/common/Constants.js

@@ -13,7 +13,7 @@ export const HiddenTextStyles = {
   whiteSpace: "nowrap"
 };
 export const KeyCodes = (_class = class KeyCodes {}, _defineProperty(_class, "ENTER", "Enter"), _defineProperty(_class, "ESCAPE", "Escape"), _defineProperty(_class, "SPACE", "Space"), _defineProperty(_class, "DeclineCallHotKey", "D"), _defineProperty(_class, "AcceptAudioCallHotKey", "S"), _defineProperty(_class, "AcceptVideoCallHotKey", "A"), _defineProperty(_class, "ToggleMicHotKey", "M"), _defineProperty(_class, "ToggleCameraHotKey", "O"), _defineProperty(_class, "EndCallHotKey", "H"), _class);
-export const Regex = (_class2 = class Regex {}, _defineProperty(_class2, "EmailRegex", "(?:[a-zA-Z0-9!#$%&'*+/=?^_`{|}~-]+(?:\\.[a-zA-Z0-9!#$%&'*+/=?^_`{|}~-]+)*|\"(?:[\\x01-\\x08\\x0b\\x0c\\x0e-\\x1f\\x21\\x23-\\x5b\\x5d-\\x7f]|\\\\[\\x01-\\x09\\x0b\\x0c\\x0e-\\x7f])*\")@(?:(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?\\.)+[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?|\\[(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?|[a-zA-Z0-9-]*[a-zA-Z0-9]:(?:[\\x01-\\x08\\x0b\\x0c\\x0e-\\x1f\\x21-\\x5a\\x53-\\x7f]|\\\\[\\x01-\\x09\\x0b\\x0c\\x0e-\\x7f])+)\\])"), _defineProperty(_class2, "URLRegex", /(https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9]+\.[^\s]{2,}|www\.[a-zA-Z0-9]+\.[^\s]{2,})/gi), _class2);
+export const Regex = (_class2 = class Regex {}, _defineProperty(_class2, "EmailRegex", "(?:[a-zA-Z0-9!#$%&'*+/=?^_`{|}~-]+(?:\\.[a-zA-Z0-9!#$%&'*+/=?^_`{|}~-]+)*|\"(?:[\\x01-\\x08\\x0b\\x0c\\x0e-\\x1f\\x21\\x23-\\x5b\\x5d-\\x7f]|\\\\[\\x01-\\x09\\x0b\\x0c\\x0e-\\x7f])*\")@(?:(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?\\.)+[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?|\\[(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?|[a-zA-Z0-9-]*[a-zA-Z0-9]:(?:[\\x01-\\x08\\x0b\\x0c\\x0e-\\x1f\\x21-\\x5a\\x53-\\x7f]|\\\\[\\x01-\\x09\\x0b\\x0c\\x0e-\\x7f])+)\\])"), _defineProperty(_class2, "URLRegex", /(https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9]+\.[^\s]{2,}|www\.[a-zA-Z0-9]+\.[^\s]{2,}|mailto:[^\s]+|tel:[^\s]+|sms:[^\s]+)/gi), _class2);
 export let ElementType;
 
 (function (ElementType) {

package/lib/esm/common/utils.js

@@ -93,17 +93,45 @@ export const addNoreferrerNoopenerTag = htmlNode => {
       }
     }
   }
+}; // Escape HTML special characters to prevent XSS in string concatenation
+
+const escapeHTML = str => {
+  return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#x27;");
+}; // Escape only characters dangerous in href attribute context
+
+
+const escapeHrefAttribute = url => {
+  return url.replace(/"/g, "&quot;").replace(/'/g, "&#x27;");
+}; // Validate and sanitize URL to prevent javascript: and data: protocols
+
+
+const isValidURL = url => {
+  const trimmedUrl = url.trim().toLowerCase(); // Block dangerous protocols
+
+  if (trimmedUrl.startsWith("javascript:") || trimmedUrl.startsWith("data:") || trimmedUrl.startsWith("vbscript:") || trimmedUrl.startsWith("file:")) {
+    return false;
+  } // Allow http, https, protocol-relative URLs, and safe contact schemes
+
+
+  return trimmedUrl.startsWith("http://") || trimmedUrl.startsWith("https://") || trimmedUrl.startsWith("www.") || trimmedUrl.startsWith("mailto:") || trimmedUrl.startsWith("tel:") || trimmedUrl.startsWith("sms:");
 };
+
 export const replaceURLWithAnchor = (text, openInNewTab) => {
   if (text) {
     const modifiedText = text.replace(Regex.URLRegex, function (url) {
-      if (openInNewTab) {
-        // eslint-disable-next-line quotes
-        return '<a href="' + url + '" rel="noreferrer noopener" target="_blank">' + url + '</a>';
-      } // eslint-disable-next-line quotes
+      // Validate URL to prevent dangerous protocols
+      if (!isValidURL(url)) {
+        return escapeHTML(url); // Return escaped text, not a link
+      }
 
+      const escapedUrl = escapeHrefAttribute(url);
+      const displayText = escapeHTML(url);
+
+      if (openInNewTab) {
+        return `<a href="${escapedUrl}" rel="noreferrer noopener" target="_blank">${displayText}</a>`;
+      }
 
-      return '<a href="' + url + '">' + url + '</a>';
+      return `<a href="${escapedUrl}">${displayText}</a>`;
     });
     return modifiedText;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microsoft/omnichannel-chat-components",
-  "version": "1.1.16",
+  "version": "1.1.17-0",
   "description": "Microsoft Omnichannel Chat Components",
   "main": "lib/cjs/index.js",
   "types": "lib/types/index.d.ts",