@microsoft/omnichannel-chat-widget 1.2.3-main.2ce131d → 1.2.3-main.d27a359

package/lib/cjs/common/telemetry/TelemetryConstants.js

@@ -164,6 +164,7 @@ exports.TelemetryEvent = TelemetryEvent;
   TelemetryEvent["SetBotAuthProviderHideCard"] = "SetBotAuthProviderHideCard";
   TelemetryEvent["SetBotAuthProviderDisplayCard"] = "SetBotAuthProviderDisplayCard";
   TelemetryEvent["SetBotAuthProviderNotFound"] = "SetBotAuthProviderNotFound";
+  TelemetryEvent["BotAuthActivityUndefinedSignInId"] = "BotAuthActivityUndefinedSignInId";
   TelemetryEvent["ThirdPartyCookiesBlocked"] = "ThirdPartyCookiesBlocked";
   TelemetryEvent["ProcessingHTMLTextMiddlewareFailed"] = "ProcessingHTMLTextMiddlewareFailed";
   TelemetryEvent["ProcessingSanitizationMiddlewareFailed"] = "ProcessingSanitizationMiddlewareFailed";

package/lib/cjs/components/livechatwidget/common/ActivitySubscriber/BotAuthActivitySubscriber.js

@@ -83,7 +83,10 @@ class BotAuthActivitySubscriber {
     const signInUrl = attachment.content.buttons[0].value;
     const signInId = extractSignInId(signInUrl);
     if (!signInId) {
-      return;
+      _TelemetryHelper.TelemetryHelper.logLoadingEvent(_TelemetryConstants.LogLevel.INFO, {
+        Event: _TelemetryConstants.TelemetryEvent.BotAuthActivityUndefinedSignInId
+      });
+      return activity;
     }
     if (this.signInCardSeen.has(signInId)) {
       // Prevents duplicate auth

package/lib/cjs/components/webchatcontainerstateful/webchatcontroller/middlewares/renderingmiddlewares/activityMiddleware.js

@@ -51,12 +51,15 @@ const handleSystemMessage = (next, args, card, systemMessageStyleProps) => {
     return () => false;
   }
 
-  // eslint-disable-next-line react/display-name, @typescript-eslint/no-explicit-any
+  // eslint-disable-next-line react/display-name
   return () => /*#__PURE__*/_react.default.createElement("div", {
     key: card.activity.id,
     style: systemMessageStyles,
-    "aria-hidden": "true"
-  }, card.activity.text);
+    "aria-hidden": "true",
+    dangerouslySetInnerHTML: {
+      __html: (0, _utils.escapeHtml)(card.activity.text)
+    }
+  });
 };
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any

package/lib/cjs/components/webchatcontainerstateful/webchatcontroller/middlewares/renderingmiddlewares/activityMiddleware.spec.js

@@ -0,0 +1,190 @@
+"use strict";
+
+var _Constants = require("../../../../../common/Constants");
+var _DirectLineActivityType = require("../../enums/DirectLineActivityType");
+var _DirectLineSenderRole = require("../../enums/DirectLineSenderRole");
+var _MessageType = require("../../enums/MessageType");
+var _TelemetryHelper = require("../../../../../common/telemetry/TelemetryHelper");
+var _activityMiddleware = require("./activityMiddleware");
+describe("activityMiddleware test", () => {
+  it("createActivityMiddleware() with Channel role sender should returns nothing", () => {
+    spyOn(_TelemetryHelper.TelemetryHelper, "logActionEvent").and.callFake(() => false);
+    const next = args => () => args; // eslint-disable-line @typescript-eslint/no-explicit-any
+    const args = {
+      activity: {
+        channelData: {
+          type: _MessageType.MessageTypes.Thread
+        },
+        from: {
+          role: _DirectLineSenderRole.DirectLineSenderRole.Channel
+        }
+      }
+    };
+    const results = (0, _activityMiddleware.createActivityMiddleware)()()(next)(args);
+    expect(results()).toEqual(false);
+    expect(_TelemetryHelper.TelemetryHelper.logActionEvent).toHaveBeenCalledTimes(1);
+  });
+  it("createActivityMiddleware() with Hidden tag should return nothing", () => {
+    spyOn(_TelemetryHelper.TelemetryHelper, "logActionEvent").and.callFake(() => false);
+    const next = args => () => args; // eslint-disable-line @typescript-eslint/no-explicit-any
+    const args = {
+      activity: {
+        channelData: {
+          tags: [_Constants.Constants.hiddenTag]
+        },
+        from: {
+          role: _DirectLineSenderRole.DirectLineSenderRole.User
+        }
+      }
+    };
+    const results = (0, _activityMiddleware.createActivityMiddleware)()()(next)(args);
+    expect(results()).toEqual(false);
+    expect(_TelemetryHelper.TelemetryHelper.logActionEvent).toHaveBeenCalledTimes(0);
+  });
+  it("createActivityMiddleware() with System tag should return system message", () => {
+    var _results$props, _results$props$danger;
+    spyOn(_TelemetryHelper.TelemetryHelper, "logActionEvent").and.callFake(() => false);
+    const next = args => () => args; // eslint-disable-line @typescript-eslint/no-explicit-any
+    const systemMessage = "system message";
+    const args = {
+      activity: {
+        text: systemMessage,
+        channelData: {
+          tags: [_Constants.Constants.systemMessageTag]
+        },
+        from: {
+          role: _DirectLineSenderRole.DirectLineSenderRole.User
+        }
+      }
+    };
+    const results = (0, _activityMiddleware.createActivityMiddleware)()()(next)(args);
+    expect(_TelemetryHelper.TelemetryHelper.logActionEvent).toHaveBeenCalledTimes(0);
+    expect((_results$props = results().props) === null || _results$props === void 0 ? void 0 : (_results$props$danger = _results$props.dangerouslySetInnerHTML) === null || _results$props$danger === void 0 ? void 0 : _results$props$danger.__html).toEqual(systemMessage);
+  });
+  it("createActivityMiddleware() should escape html texts to prevent XSS attacks", () => {
+    var _results$props2, _results$props2$dange;
+    spyOn(_TelemetryHelper.TelemetryHelper, "logActionEvent").and.callFake(() => false);
+    const next = args => () => args; // eslint-disable-line @typescript-eslint/no-explicit-any
+    const systemMessage = "<img src='' onerror=\"alert('XSS attack')\"/>";
+    const args = {
+      activity: {
+        text: systemMessage,
+        channelData: {
+          tags: [_Constants.Constants.systemMessageTag]
+        },
+        from: {
+          role: _DirectLineSenderRole.DirectLineSenderRole.User
+        }
+      }
+    };
+    const results = (0, _activityMiddleware.createActivityMiddleware)()()(next)(args);
+    expect(_TelemetryHelper.TelemetryHelper.logActionEvent).toHaveBeenCalledTimes(0);
+    expect((_results$props2 = results().props) === null || _results$props2 === void 0 ? void 0 : (_results$props2$dange = _results$props2.dangerouslySetInnerHTML) === null || _results$props2$dange === void 0 ? void 0 : _results$props2$dange.__html).toEqual("&lt;img src=&#39;&#39; onerror=&quot;alert(&#39;XSS attack&#39;)&quot;&#x2F;&gt;");
+  });
+  it("createActivityMiddleware() with QueuePosition tag should log QueuePosition message", () => {
+    spyOn(_TelemetryHelper.TelemetryHelper, "logActionEvent").and.callFake(() => false);
+    const next = args => () => args; // eslint-disable-line @typescript-eslint/no-explicit-any
+    const systemMessage = "system message";
+    const args = {
+      activity: {
+        text: systemMessage,
+        channelData: {
+          tags: [_Constants.Constants.systemMessageTag, _Constants.Constants.queuePositionMessageTag]
+        },
+        from: {
+          role: _DirectLineSenderRole.DirectLineSenderRole.User
+        }
+      }
+    };
+    (0, _activityMiddleware.createActivityMiddleware)()()(next)(args);
+    expect(_TelemetryHelper.TelemetryHelper.logActionEvent).toHaveBeenCalledTimes(1);
+  });
+  it("createActivityMiddleware() with same clientmessageid with next activity should return nothing", () => {
+    spyOn(_TelemetryHelper.TelemetryHelper, "logActionEvent").and.callFake(() => false);
+    const next = args => () => args; // eslint-disable-line @typescript-eslint/no-explicit-any
+    const systemMessage = "system message";
+    const args = {
+      activity: {
+        text: systemMessage,
+        channelData: {
+          tags: [_Constants.Constants.systemMessageTag],
+          clientmessageid: "1234"
+        },
+        from: {
+          role: _DirectLineSenderRole.DirectLineSenderRole.User
+        }
+      },
+      nextVisibleActivity: {
+        channelData: {
+          clientmessageid: "1234"
+        }
+      }
+    };
+    const results = (0, _activityMiddleware.createActivityMiddleware)()()(next)(args);
+    expect(results()).toEqual(false);
+  });
+  it("createActivityMiddleware() with same messageid with next activity should return nothing", () => {
+    spyOn(_TelemetryHelper.TelemetryHelper, "logActionEvent").and.callFake(() => false);
+    const next = args => () => args; // eslint-disable-line @typescript-eslint/no-explicit-any
+    const systemMessage = "system message";
+    const args = {
+      activity: {
+        text: systemMessage,
+        channelData: {
+          tags: [_Constants.Constants.systemMessageTag]
+        },
+        from: {
+          role: _DirectLineSenderRole.DirectLineSenderRole.User
+        },
+        messageid: "1234"
+      },
+      nextVisibleActivity: {
+        messageid: "1234"
+      }
+    };
+    const results = (0, _activityMiddleware.createActivityMiddleware)()()(next)(args);
+    expect(results()).toEqual(false);
+  });
+  it("createActivityMiddleware() should render normal user messages", () => {
+    var _results$props3, _results$props3$child, _results$props3$child2;
+    spyOn(_TelemetryHelper.TelemetryHelper, "logActionEvent").and.callFake(() => false);
+    const next = args => () => args; // eslint-disable-line @typescript-eslint/no-explicit-any
+    const userMessage = "Hello World";
+    const args = {
+      activity: {
+        text: userMessage,
+        channelId: "webchat",
+        channelData: {
+          isHtmlEncoded: false
+        },
+        from: {
+          role: _DirectLineSenderRole.DirectLineSenderRole.User
+        },
+        type: _DirectLineActivityType.DirectLineActivityType.Message
+      }
+    };
+    const results = (0, _activityMiddleware.createActivityMiddleware)()()(next)(args);
+    expect((_results$props3 = results().props) === null || _results$props3 === void 0 ? void 0 : (_results$props3$child = _results$props3.children) === null || _results$props3$child === void 0 ? void 0 : (_results$props3$child2 = _results$props3$child.activity) === null || _results$props3$child2 === void 0 ? void 0 : _results$props3$child2.text).toEqual(userMessage);
+  });
+  it("createActivityMiddleware() should not render typing messages", () => {
+    var _results$activity;
+    spyOn(_TelemetryHelper.TelemetryHelper, "logActionEvent").and.callFake(() => false);
+    const next = args => () => args; // eslint-disable-line @typescript-eslint/no-explicit-any
+    const userMessage = "Hello World";
+    const args = {
+      activity: {
+        text: userMessage,
+        channelId: "webchat",
+        channelData: {
+          isHtmlEncoded: false
+        },
+        from: {
+          role: _DirectLineSenderRole.DirectLineSenderRole.User
+        },
+        type: _DirectLineActivityType.DirectLineActivityType.Typing
+      }
+    };
+    const results = (0, _activityMiddleware.createActivityMiddleware)()()(next)(args);
+    expect((_results$activity = results().activity) === null || _results$activity === void 0 ? void 0 : _results$activity.text).toEqual(userMessage);
+  });
+});

package/lib/esm/common/telemetry/TelemetryConstants.js

@@ -158,6 +158,7 @@ export let TelemetryEvent;
   TelemetryEvent["SetBotAuthProviderHideCard"] = "SetBotAuthProviderHideCard";
   TelemetryEvent["SetBotAuthProviderDisplayCard"] = "SetBotAuthProviderDisplayCard";
   TelemetryEvent["SetBotAuthProviderNotFound"] = "SetBotAuthProviderNotFound";
+  TelemetryEvent["BotAuthActivityUndefinedSignInId"] = "BotAuthActivityUndefinedSignInId";
   TelemetryEvent["ThirdPartyCookiesBlocked"] = "ThirdPartyCookiesBlocked";
   TelemetryEvent["ProcessingHTMLTextMiddlewareFailed"] = "ProcessingHTMLTextMiddlewareFailed";
   TelemetryEvent["ProcessingSanitizationMiddlewareFailed"] = "ProcessingSanitizationMiddlewareFailed";

package/lib/esm/components/livechatwidget/common/ActivitySubscriber/BotAuthActivitySubscriber.js

@@ -79,7 +79,10 @@ export class BotAuthActivitySubscriber {
     const signInUrl = attachment.content.buttons[0].value;
     const signInId = extractSignInId(signInUrl);
     if (!signInId) {
-      return;
+      TelemetryHelper.logLoadingEvent(LogLevel.INFO, {
+        Event: TelemetryEvent.BotAuthActivityUndefinedSignInId
+      });
+      return activity;
     }
     if (this.signInCardSeen.has(signInId)) {
       // Prevents duplicate auth

package/lib/esm/components/webchatcontainerstateful/webchatcontroller/middlewares/renderingmiddlewares/activityMiddleware.js

@@ -44,12 +44,15 @@ const handleSystemMessage = (next, args, card, systemMessageStyleProps) => {
     return () => false;
   }
 
-  // eslint-disable-next-line react/display-name, @typescript-eslint/no-explicit-any
+  // eslint-disable-next-line react/display-name
   return () => /*#__PURE__*/React.createElement("div", {
     key: card.activity.id,
     style: systemMessageStyles,
-    "aria-hidden": "true"
-  }, card.activity.text);
+    "aria-hidden": "true",
+    dangerouslySetInnerHTML: {
+      __html: escapeHtml(card.activity.text)
+    }
+  });
 };
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any

package/lib/esm/components/webchatcontainerstateful/webchatcontroller/middlewares/renderingmiddlewares/activityMiddleware.spec.js

@@ -0,0 +1,188 @@
+import { Constants } from "../../../../../common/Constants";
+import { DirectLineActivityType } from "../../enums/DirectLineActivityType";
+import { DirectLineSenderRole } from "../../enums/DirectLineSenderRole";
+import { MessageTypes } from "../../enums/MessageType";
+import { TelemetryHelper } from "../../../../../common/telemetry/TelemetryHelper";
+import { createActivityMiddleware } from "./activityMiddleware";
+describe("activityMiddleware test", () => {
+  it("createActivityMiddleware() with Channel role sender should returns nothing", () => {
+    spyOn(TelemetryHelper, "logActionEvent").and.callFake(() => false);
+    const next = args => () => args; // eslint-disable-line @typescript-eslint/no-explicit-any
+    const args = {
+      activity: {
+        channelData: {
+          type: MessageTypes.Thread
+        },
+        from: {
+          role: DirectLineSenderRole.Channel
+        }
+      }
+    };
+    const results = createActivityMiddleware()()(next)(args);
+    expect(results()).toEqual(false);
+    expect(TelemetryHelper.logActionEvent).toHaveBeenCalledTimes(1);
+  });
+  it("createActivityMiddleware() with Hidden tag should return nothing", () => {
+    spyOn(TelemetryHelper, "logActionEvent").and.callFake(() => false);
+    const next = args => () => args; // eslint-disable-line @typescript-eslint/no-explicit-any
+    const args = {
+      activity: {
+        channelData: {
+          tags: [Constants.hiddenTag]
+        },
+        from: {
+          role: DirectLineSenderRole.User
+        }
+      }
+    };
+    const results = createActivityMiddleware()()(next)(args);
+    expect(results()).toEqual(false);
+    expect(TelemetryHelper.logActionEvent).toHaveBeenCalledTimes(0);
+  });
+  it("createActivityMiddleware() with System tag should return system message", () => {
+    var _results$props, _results$props$danger;
+    spyOn(TelemetryHelper, "logActionEvent").and.callFake(() => false);
+    const next = args => () => args; // eslint-disable-line @typescript-eslint/no-explicit-any
+    const systemMessage = "system message";
+    const args = {
+      activity: {
+        text: systemMessage,
+        channelData: {
+          tags: [Constants.systemMessageTag]
+        },
+        from: {
+          role: DirectLineSenderRole.User
+        }
+      }
+    };
+    const results = createActivityMiddleware()()(next)(args);
+    expect(TelemetryHelper.logActionEvent).toHaveBeenCalledTimes(0);
+    expect((_results$props = results().props) === null || _results$props === void 0 ? void 0 : (_results$props$danger = _results$props.dangerouslySetInnerHTML) === null || _results$props$danger === void 0 ? void 0 : _results$props$danger.__html).toEqual(systemMessage);
+  });
+  it("createActivityMiddleware() should escape html texts to prevent XSS attacks", () => {
+    var _results$props2, _results$props2$dange;
+    spyOn(TelemetryHelper, "logActionEvent").and.callFake(() => false);
+    const next = args => () => args; // eslint-disable-line @typescript-eslint/no-explicit-any
+    const systemMessage = "<img src='' onerror=\"alert('XSS attack')\"/>";
+    const args = {
+      activity: {
+        text: systemMessage,
+        channelData: {
+          tags: [Constants.systemMessageTag]
+        },
+        from: {
+          role: DirectLineSenderRole.User
+        }
+      }
+    };
+    const results = createActivityMiddleware()()(next)(args);
+    expect(TelemetryHelper.logActionEvent).toHaveBeenCalledTimes(0);
+    expect((_results$props2 = results().props) === null || _results$props2 === void 0 ? void 0 : (_results$props2$dange = _results$props2.dangerouslySetInnerHTML) === null || _results$props2$dange === void 0 ? void 0 : _results$props2$dange.__html).toEqual("&lt;img src=&#39;&#39; onerror=&quot;alert(&#39;XSS attack&#39;)&quot;&#x2F;&gt;");
+  });
+  it("createActivityMiddleware() with QueuePosition tag should log QueuePosition message", () => {
+    spyOn(TelemetryHelper, "logActionEvent").and.callFake(() => false);
+    const next = args => () => args; // eslint-disable-line @typescript-eslint/no-explicit-any
+    const systemMessage = "system message";
+    const args = {
+      activity: {
+        text: systemMessage,
+        channelData: {
+          tags: [Constants.systemMessageTag, Constants.queuePositionMessageTag]
+        },
+        from: {
+          role: DirectLineSenderRole.User
+        }
+      }
+    };
+    createActivityMiddleware()()(next)(args);
+    expect(TelemetryHelper.logActionEvent).toHaveBeenCalledTimes(1);
+  });
+  it("createActivityMiddleware() with same clientmessageid with next activity should return nothing", () => {
+    spyOn(TelemetryHelper, "logActionEvent").and.callFake(() => false);
+    const next = args => () => args; // eslint-disable-line @typescript-eslint/no-explicit-any
+    const systemMessage = "system message";
+    const args = {
+      activity: {
+        text: systemMessage,
+        channelData: {
+          tags: [Constants.systemMessageTag],
+          clientmessageid: "1234"
+        },
+        from: {
+          role: DirectLineSenderRole.User
+        }
+      },
+      nextVisibleActivity: {
+        channelData: {
+          clientmessageid: "1234"
+        }
+      }
+    };
+    const results = createActivityMiddleware()()(next)(args);
+    expect(results()).toEqual(false);
+  });
+  it("createActivityMiddleware() with same messageid with next activity should return nothing", () => {
+    spyOn(TelemetryHelper, "logActionEvent").and.callFake(() => false);
+    const next = args => () => args; // eslint-disable-line @typescript-eslint/no-explicit-any
+    const systemMessage = "system message";
+    const args = {
+      activity: {
+        text: systemMessage,
+        channelData: {
+          tags: [Constants.systemMessageTag]
+        },
+        from: {
+          role: DirectLineSenderRole.User
+        },
+        messageid: "1234"
+      },
+      nextVisibleActivity: {
+        messageid: "1234"
+      }
+    };
+    const results = createActivityMiddleware()()(next)(args);
+    expect(results()).toEqual(false);
+  });
+  it("createActivityMiddleware() should render normal user messages", () => {
+    var _results$props3, _results$props3$child, _results$props3$child2;
+    spyOn(TelemetryHelper, "logActionEvent").and.callFake(() => false);
+    const next = args => () => args; // eslint-disable-line @typescript-eslint/no-explicit-any
+    const userMessage = "Hello World";
+    const args = {
+      activity: {
+        text: userMessage,
+        channelId: "webchat",
+        channelData: {
+          isHtmlEncoded: false
+        },
+        from: {
+          role: DirectLineSenderRole.User
+        },
+        type: DirectLineActivityType.Message
+      }
+    };
+    const results = createActivityMiddleware()()(next)(args);
+    expect((_results$props3 = results().props) === null || _results$props3 === void 0 ? void 0 : (_results$props3$child = _results$props3.children) === null || _results$props3$child === void 0 ? void 0 : (_results$props3$child2 = _results$props3$child.activity) === null || _results$props3$child2 === void 0 ? void 0 : _results$props3$child2.text).toEqual(userMessage);
+  });
+  it("createActivityMiddleware() should not render typing messages", () => {
+    var _results$activity;
+    spyOn(TelemetryHelper, "logActionEvent").and.callFake(() => false);
+    const next = args => () => args; // eslint-disable-line @typescript-eslint/no-explicit-any
+    const userMessage = "Hello World";
+    const args = {
+      activity: {
+        text: userMessage,
+        channelId: "webchat",
+        channelData: {
+          isHtmlEncoded: false
+        },
+        from: {
+          role: DirectLineSenderRole.User
+        },
+        type: DirectLineActivityType.Typing
+      }
+    };
+    const results = createActivityMiddleware()()(next)(args);
+    expect((_results$activity = results().activity) === null || _results$activity === void 0 ? void 0 : _results$activity.text).toEqual(userMessage);
+  });
+});

package/lib/types/common/telemetry/TelemetryConstants.d.ts

@@ -151,6 +151,7 @@ export declare enum TelemetryEvent {
     SetBotAuthProviderHideCard = "SetBotAuthProviderHideCard",
     SetBotAuthProviderDisplayCard = "SetBotAuthProviderDisplayCard",
     SetBotAuthProviderNotFound = "SetBotAuthProviderNotFound",
+    BotAuthActivityUndefinedSignInId = "BotAuthActivityUndefinedSignInId",
     ThirdPartyCookiesBlocked = "ThirdPartyCookiesBlocked",
     ProcessingHTMLTextMiddlewareFailed = "ProcessingHTMLTextMiddlewareFailed",
     ProcessingSanitizationMiddlewareFailed = "ProcessingSanitizationMiddlewareFailed",

package/lib/types/components/webchatcontainerstateful/webchatcontroller/middlewares/renderingmiddlewares/activityMiddleware.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microsoft/omnichannel-chat-widget",
-  "version": "1.2.3-main.2ce131d",
+  "version": "1.2.3-main.d27a359",
   "description": "Microsoft Omnichannel Chat Widget",
   "main": "lib/cjs/index.js",
   "types": "lib/types/index.d.ts",