@microsoft/omnichannel-chat-widget 1.8.4-main.f45c44b → 1.8.4-main.f8ae4f8

package/lib/cjs/common/telemetry/TelemetryManager.js

@@ -11,6 +11,7 @@ var _appInsightsLogger = require("./loggers/appInsightsLogger");
 var _ariaTelemetryLogger = require("./loggers/ariaTelemetryLogger");
 var _consoleLogger = require("./loggers/consoleLogger");
 var _defaultAriaConfig = require("./defaultConfigs/defaultAriaConfig");
+var _sanitizeSasInPayload = require("./sanitizeSasInPayload");
 function _defineProperties(target, props) { for (var i = 0; i < props.length; i++) { var descriptor = props[i]; descriptor.enumerable = descriptor.enumerable || false; descriptor.configurable = true; if ("value" in descriptor) descriptor.writable = true; Object.defineProperty(target, _toPropertyKey(descriptor.key), descriptor); } }
 function _createClass(Constructor, protoProps, staticProps) { if (protoProps) _defineProperties(Constructor.prototype, protoProps); if (staticProps) _defineProperties(Constructor, staticProps); Object.defineProperty(Constructor, "prototype", { writable: false }); return Constructor; }
 function _classCallCheck(instance, Constructor) { if (!(instance instanceof Constructor)) { throw new TypeError("Cannot call a class as a function"); } }
@@ -81,11 +82,15 @@ const RegisterLoggers = () => {
     };
   };
   const logTelemetry = telemetryEvent => {
+    // Redact Azure SAS credentials in any URL embedded in the payload (e.g.
+    // customer-supplied blob asset URLs in widget customization props) before
+    // it fans out to console, Aria, AppInsights, or any custom logger.
+    const sanitizedPayload = (0, _sanitizeSasInPayload.sanitizeSasInPayload)(telemetryEvent === null || telemetryEvent === void 0 ? void 0 : telemetryEvent.payload);
     loggers.map(logger => {
       var _payload, _telemetryInput$paylo;
       const logLevel = telemetryEvent.logLevel ?? _TelemetryConstants.LogLevel.INFO;
       const scenarioType = ((_payload = telemetryEvent.payload) === null || _payload === void 0 ? void 0 : _payload.scenarioType) ?? _TelemetryConstants.ScenarioType.UNDEFINED;
-      const telemetryInput = parseInput(telemetryEvent === null || telemetryEvent === void 0 ? void 0 : telemetryEvent.payload, scenarioType);
+      const telemetryInput = parseInput(sanitizedPayload, scenarioType);
       telemetryInput.telemetryInfo = {
         telemetryInfo: _TelemetryHelper.TelemetryHelper.buildTelemetryEvent(logLevel, telemetryInput)
       };

package/lib/cjs/common/telemetry/sanitizeSasInPayload.js

@@ -0,0 +1,82 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.sanitizeSasInPayload = void 0;
+/**
+ * Redacts the values of Azure Shared Access Signature (SAS) query parameters in any
+ * URL embedded in a telemetry payload, so customer-supplied SAS URLs (e.g. blob asset
+ * URLs in widget customization props) cannot leak credentials through Aria/AppInsights.
+ *
+ * Trigger: any URL whose query string contains `sig=`. When detected, every well-known
+ * SAS parameter value in that query is replaced with `[REDACTED]`. Other URLs and other
+ * substrings of the payload pass through unchanged.
+ *
+ * Coverage of SAS parameter names:
+ *  - Service/Blob SAS:        sig, sv, se, st, sp, spr, sr, sip
+ *  - Account SAS:             ss, srt
+ *  - User-delegation key SAS: skoid, sktid, skt, ske, sks, skv, saoid, suoid, sce, sdd
+ *  - Response header overrides: rscc, rscd, rsce, rscl, rsct
+ *
+ * Reference: https://learn.microsoft.com/en-us/rest/api/storageservices/create-service-sas
+ */
+
+const SAS_PARAM_NAMES = new Set(["sig", "sv", "se", "st", "sp", "spr", "sr", "sip", "ss", "srt", "skoid", "sktid", "skt", "ske", "sks", "skv", "saoid", "suoid", "sce", "sdd", "rscc", "rscd", "rsce", "rscl", "rsct"]);
+const REDACTED_VALUE = "[REDACTED]";
+
+// Matches any http(s) URL substring up to whitespace / closing quote / angle-bracket / paren.
+const URL_REGEX = /\bhttps?:\/\/[^\s"'<>)]+/gi;
+const redactQueryIfSas = url => {
+  const queryIdx = url.indexOf("?");
+  if (queryIdx < 0) {
+    return url;
+  }
+  // Separate the fragment (#...) before processing the query — fragments come
+  // after the query string in URL syntax and must not be folded into the last
+  // query parameter's value when we split on `&`.
+  const afterQuestionMark = url.slice(queryIdx + 1);
+  const fragIdx = afterQuestionMark.indexOf("#");
+  const query = fragIdx < 0 ? afterQuestionMark : afterQuestionMark.slice(0, fragIdx);
+  const fragment = fragIdx < 0 ? "" : afterQuestionMark.slice(fragIdx); // includes the leading '#'
+  if (!/(^|&)sig=/i.test(query)) {
+    // No SAS signature present — leave the URL alone so legitimate non-SAS query
+    // strings (e.g. ?utm_source=...) are not mangled.
+    return url;
+  }
+  const base = url.slice(0, queryIdx);
+  const sanitizedQuery = query.split("&").map(pair => {
+    const eqIdx = pair.indexOf("=");
+    if (eqIdx < 0) {
+      return pair;
+    }
+    const name = pair.slice(0, eqIdx).toLowerCase();
+    return SAS_PARAM_NAMES.has(name) ? `${pair.slice(0, eqIdx)}=${REDACTED_VALUE}` : pair;
+  }).join("&");
+  return `${base}?${sanitizedQuery}${fragment}`;
+};
+const sanitizeString = s => s.replace(URL_REGEX, redactQueryIfSas);
+
+/**
+ * Deep-walk a value and redact SAS credentials in any string it contains.
+ * Returns a new object/array (originals are not mutated); non-string leaves are
+ * passed through. Tree-shaped, JSON-like values only — not designed for class
+ * instances, prototype-bound objects, or cyclic graphs.
+ */
+const sanitizeSasInPayload = value => {
+  if (typeof value === "string") {
+    return sanitizeString(value);
+  }
+  if (Array.isArray(value)) {
+    return value.map(sanitizeSasInPayload);
+  }
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = sanitizeSasInPayload(v);
+    }
+    return out;
+  }
+  return value;
+};
+exports.sanitizeSasInPayload = sanitizeSasInPayload;

package/lib/cjs/components/livechatwidget/common/createMarkdown.js

@@ -173,14 +173,16 @@ const createMarkdown = (disableMarkdownMessageFormatting, disableNewLineMarkdown
 
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     md.render = function (text, env) {
+      const safeEnv = env ?? {};
       const processedText = preprocessText(text);
-      return md.renderer.render(md.parse(processedText, env), md.options, env);
+      return md.renderer.render(md.parse(processedText, safeEnv), md.options, safeEnv);
     };
 
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     md.renderInline = function (text, env) {
+      const safeEnv = env ?? {};
       const processedText = preprocessText(text);
-      return md.renderer.render(md.parseInline(processedText, env), md.options, env);
+      return md.renderer.render(md.parseInline(processedText, safeEnv), md.options, safeEnv);
     };
   });
 

package/lib/cjs/components/livechatwidget/common/initWebChatComposer.js

@@ -304,24 +304,28 @@ const initWebChatComposer = (props, state, dispatch, facadeChatSDK, endChat) =>
           const conversationId = (state === null || state === void 0 ? void 0 : (_state$domainStates2 = state.domainStates) === null || _state$domainStates2 === void 0 ? void 0 : (_state$domainStates2$ = _state$domainStates2.chatToken) === null || _state$domainStates2$ === void 0 ? void 0 : _state$domainStates2$.chatId) || "unknown";
           _TelemetryHelper.TelemetryHelper.logActionEvent(_TelemetryConstants.LogLevel.INFO, {
             Event: _TelemetryConstants.TelemetryEvent.HTMLSanitized,
-            Description: "HTML content would be sanitized by stricter allowlist (monitor-only)",
-            ElapsedTimeInMilliseconds: executionTimeMs,
-            CustomProperties: {
-              OrganizationId: orgId,
-              ConversationId: conversationId,
-              RemovedTags: uniqueTags.join(", "),
-              RemovedAttributes: uniqueAttrs.join(", "),
-              Phase: "Monitor"
-            }
+            Description: JSON.stringify({
+              message: "HTML content would be sanitized by stricter allowlist (monitor-only)",
+              removedTags: uniqueTags,
+              removedAttributes: uniqueAttrs,
+              phase: "Monitor",
+              organizationId: orgId,
+              conversationId: conversationId
+            }),
+            ElapsedTimeInMilliseconds: executionTimeMs
           });
 
           // Log to console in development for debugging
           if (process.env.NODE_ENV === "development") {
-            console.warn("[Monitor] Stricter HTML sanitization would remove:", {
+            console.warn("[Monitor] Stricter HTML sanitization telemetry:", {
+              description: JSON.parse(JSON.stringify({
+                message: "HTML content would be sanitized by stricter allowlist (monitor-only)",
+                removedTags: uniqueTags,
+                removedAttributes: uniqueAttrs,
+                phase: "Monitor"
+              })),
               orgId,
               conversationId,
-              removedTags: uniqueTags,
-              removedAttributes: uniqueAttrs,
               executionTimeMs
             });
           }

package/lib/cjs/components/prechatsurveypanestateful/PreChatSurveyPaneStateful.js

@@ -221,7 +221,11 @@ const PreChatSurveyPaneStateful = props => {
     }
   }, []);
   return /*#__PURE__*/_react.default.createElement("div", {
-    onFocusCapture: announceFocusedElement
+    onFocusCapture: announceFocusedElement,
+    style: {
+      width: "100%",
+      height: "100%"
+    }
   }, /*#__PURE__*/_react.default.createElement("div", {
     role: "status",
     "aria-live": "polite",

package/lib/cjs/components/prechatsurveypanestateful/common/defaultStyles/defaultGeneralPreChatSurveyPaneStyleProps.js

@@ -12,7 +12,6 @@ const defaultGeneralPreChatSurveyPaneStyleProps = {
   borderColor: "#F1F1F1",
   overflowY: "auto",
   height: "inherit",
-  width: "inherit",
-  overscrollBehavior: "none"
+  width: "inherit"
 };
 exports.defaultGeneralPreChatSurveyPaneStyleProps = defaultGeneralPreChatSurveyPaneStyleProps;

package/lib/esm/common/telemetry/TelemetryManager.js

@@ -11,6 +11,7 @@ import { appInsightsLogger } from "./loggers/appInsightsLogger";
 import { ariaTelemetryLogger } from "./loggers/ariaTelemetryLogger";
 import { consoleLogger } from "./loggers/consoleLogger";
 import { defaultAriaConfig } from "./defaultConfigs/defaultAriaConfig";
+import { sanitizeSasInPayload } from "./sanitizeSasInPayload";
 export let TelemetryTimers = /*#__PURE__*/_createClass(function TelemetryTimers() {
   _classCallCheck(this, TelemetryTimers);
 });
@@ -72,11 +73,15 @@ export const RegisterLoggers = () => {
     };
   };
   const logTelemetry = telemetryEvent => {
+    // Redact Azure SAS credentials in any URL embedded in the payload (e.g.
+    // customer-supplied blob asset URLs in widget customization props) before
+    // it fans out to console, Aria, AppInsights, or any custom logger.
+    const sanitizedPayload = sanitizeSasInPayload(telemetryEvent === null || telemetryEvent === void 0 ? void 0 : telemetryEvent.payload);
     loggers.map(logger => {
       var _payload, _telemetryInput$paylo;
       const logLevel = telemetryEvent.logLevel ?? LogLevel.INFO;
       const scenarioType = ((_payload = telemetryEvent.payload) === null || _payload === void 0 ? void 0 : _payload.scenarioType) ?? ScenarioType.UNDEFINED;
-      const telemetryInput = parseInput(telemetryEvent === null || telemetryEvent === void 0 ? void 0 : telemetryEvent.payload, scenarioType);
+      const telemetryInput = parseInput(sanitizedPayload, scenarioType);
       telemetryInput.telemetryInfo = {
         telemetryInfo: TelemetryHelper.buildTelemetryEvent(logLevel, telemetryInput)
       };

package/lib/esm/common/telemetry/sanitizeSasInPayload.js

@@ -0,0 +1,75 @@
+/**
+ * Redacts the values of Azure Shared Access Signature (SAS) query parameters in any
+ * URL embedded in a telemetry payload, so customer-supplied SAS URLs (e.g. blob asset
+ * URLs in widget customization props) cannot leak credentials through Aria/AppInsights.
+ *
+ * Trigger: any URL whose query string contains `sig=`. When detected, every well-known
+ * SAS parameter value in that query is replaced with `[REDACTED]`. Other URLs and other
+ * substrings of the payload pass through unchanged.
+ *
+ * Coverage of SAS parameter names:
+ *  - Service/Blob SAS:        sig, sv, se, st, sp, spr, sr, sip
+ *  - Account SAS:             ss, srt
+ *  - User-delegation key SAS: skoid, sktid, skt, ske, sks, skv, saoid, suoid, sce, sdd
+ *  - Response header overrides: rscc, rscd, rsce, rscl, rsct
+ *
+ * Reference: https://learn.microsoft.com/en-us/rest/api/storageservices/create-service-sas
+ */
+
+const SAS_PARAM_NAMES = new Set(["sig", "sv", "se", "st", "sp", "spr", "sr", "sip", "ss", "srt", "skoid", "sktid", "skt", "ske", "sks", "skv", "saoid", "suoid", "sce", "sdd", "rscc", "rscd", "rsce", "rscl", "rsct"]);
+const REDACTED_VALUE = "[REDACTED]";
+
+// Matches any http(s) URL substring up to whitespace / closing quote / angle-bracket / paren.
+const URL_REGEX = /\bhttps?:\/\/[^\s"'<>)]+/gi;
+const redactQueryIfSas = url => {
+  const queryIdx = url.indexOf("?");
+  if (queryIdx < 0) {
+    return url;
+  }
+  // Separate the fragment (#...) before processing the query — fragments come
+  // after the query string in URL syntax and must not be folded into the last
+  // query parameter's value when we split on `&`.
+  const afterQuestionMark = url.slice(queryIdx + 1);
+  const fragIdx = afterQuestionMark.indexOf("#");
+  const query = fragIdx < 0 ? afterQuestionMark : afterQuestionMark.slice(0, fragIdx);
+  const fragment = fragIdx < 0 ? "" : afterQuestionMark.slice(fragIdx); // includes the leading '#'
+  if (!/(^|&)sig=/i.test(query)) {
+    // No SAS signature present — leave the URL alone so legitimate non-SAS query
+    // strings (e.g. ?utm_source=...) are not mangled.
+    return url;
+  }
+  const base = url.slice(0, queryIdx);
+  const sanitizedQuery = query.split("&").map(pair => {
+    const eqIdx = pair.indexOf("=");
+    if (eqIdx < 0) {
+      return pair;
+    }
+    const name = pair.slice(0, eqIdx).toLowerCase();
+    return SAS_PARAM_NAMES.has(name) ? `${pair.slice(0, eqIdx)}=${REDACTED_VALUE}` : pair;
+  }).join("&");
+  return `${base}?${sanitizedQuery}${fragment}`;
+};
+const sanitizeString = s => s.replace(URL_REGEX, redactQueryIfSas);
+
+/**
+ * Deep-walk a value and redact SAS credentials in any string it contains.
+ * Returns a new object/array (originals are not mutated); non-string leaves are
+ * passed through. Tree-shaped, JSON-like values only — not designed for class
+ * instances, prototype-bound objects, or cyclic graphs.
+ */
+export const sanitizeSasInPayload = value => {
+  if (typeof value === "string") {
+    return sanitizeString(value);
+  }
+  if (Array.isArray(value)) {
+    return value.map(sanitizeSasInPayload);
+  }
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = sanitizeSasInPayload(v);
+    }
+    return out;
+  }
+  return value;
+};

package/lib/esm/components/livechatwidget/common/createMarkdown.js

@@ -167,14 +167,16 @@ export const createMarkdown = (disableMarkdownMessageFormatting, disableNewLineM
 
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     md.render = function (text, env) {
+      const safeEnv = env ?? {};
       const processedText = preprocessText(text);
-      return md.renderer.render(md.parse(processedText, env), md.options, env);
+      return md.renderer.render(md.parse(processedText, safeEnv), md.options, safeEnv);
     };
 
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     md.renderInline = function (text, env) {
+      const safeEnv = env ?? {};
       const processedText = preprocessText(text);
-      return md.renderer.render(md.parseInline(processedText, env), md.options, env);
+      return md.renderer.render(md.parseInline(processedText, safeEnv), md.options, safeEnv);
     };
   });
 

package/lib/esm/components/livechatwidget/common/initWebChatComposer.js

@@ -299,24 +299,28 @@ export const initWebChatComposer = (props, state, dispatch, facadeChatSDK, endCh
           const conversationId = (state === null || state === void 0 ? void 0 : (_state$domainStates2 = state.domainStates) === null || _state$domainStates2 === void 0 ? void 0 : (_state$domainStates2$ = _state$domainStates2.chatToken) === null || _state$domainStates2$ === void 0 ? void 0 : _state$domainStates2$.chatId) || "unknown";
           TelemetryHelper.logActionEvent(LogLevel.INFO, {
             Event: TelemetryEvent.HTMLSanitized,
-            Description: "HTML content would be sanitized by stricter allowlist (monitor-only)",
-            ElapsedTimeInMilliseconds: executionTimeMs,
-            CustomProperties: {
-              OrganizationId: orgId,
-              ConversationId: conversationId,
-              RemovedTags: uniqueTags.join(", "),
-              RemovedAttributes: uniqueAttrs.join(", "),
-              Phase: "Monitor"
-            }
+            Description: JSON.stringify({
+              message: "HTML content would be sanitized by stricter allowlist (monitor-only)",
+              removedTags: uniqueTags,
+              removedAttributes: uniqueAttrs,
+              phase: "Monitor",
+              organizationId: orgId,
+              conversationId: conversationId
+            }),
+            ElapsedTimeInMilliseconds: executionTimeMs
           });
 
           // Log to console in development for debugging
           if (process.env.NODE_ENV === "development") {
-            console.warn("[Monitor] Stricter HTML sanitization would remove:", {
+            console.warn("[Monitor] Stricter HTML sanitization telemetry:", {
+              description: JSON.parse(JSON.stringify({
+                message: "HTML content would be sanitized by stricter allowlist (monitor-only)",
+                removedTags: uniqueTags,
+                removedAttributes: uniqueAttrs,
+                phase: "Monitor"
+              })),
               orgId,
               conversationId,
-              removedTags: uniqueTags,
-              removedAttributes: uniqueAttrs,
               executionTimeMs
             });
           }

package/lib/esm/components/prechatsurveypanestateful/PreChatSurveyPaneStateful.js

@@ -212,7 +212,11 @@ export const PreChatSurveyPaneStateful = props => {
     }
   }, []);
   return /*#__PURE__*/React.createElement("div", {
-    onFocusCapture: announceFocusedElement
+    onFocusCapture: announceFocusedElement,
+    style: {
+      width: "100%",
+      height: "100%"
+    }
   }, /*#__PURE__*/React.createElement("div", {
     role: "status",
     "aria-live": "polite",

package/lib/esm/components/prechatsurveypanestateful/common/defaultStyles/defaultGeneralPreChatSurveyPaneStyleProps.js

@@ -6,6 +6,5 @@ export const defaultGeneralPreChatSurveyPaneStyleProps = {
   borderColor: "#F1F1F1",
   overflowY: "auto",
   height: "inherit",
-  width: "inherit",
-  overscrollBehavior: "none"
+  width: "inherit"
 };

package/lib/types/common/telemetry/sanitizeSasInPayload.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Redacts the values of Azure Shared Access Signature (SAS) query parameters in any
+ * URL embedded in a telemetry payload, so customer-supplied SAS URLs (e.g. blob asset
+ * URLs in widget customization props) cannot leak credentials through Aria/AppInsights.
+ *
+ * Trigger: any URL whose query string contains `sig=`. When detected, every well-known
+ * SAS parameter value in that query is replaced with `[REDACTED]`. Other URLs and other
+ * substrings of the payload pass through unchanged.
+ *
+ * Coverage of SAS parameter names:
+ *  - Service/Blob SAS:        sig, sv, se, st, sp, spr, sr, sip
+ *  - Account SAS:             ss, srt
+ *  - User-delegation key SAS: skoid, sktid, skt, ske, sks, skv, saoid, suoid, sce, sdd
+ *  - Response header overrides: rscc, rscd, rsce, rscl, rsct
+ *
+ * Reference: https://learn.microsoft.com/en-us/rest/api/storageservices/create-service-sas
+ */
+/**
+ * Deep-walk a value and redact SAS credentials in any string it contains.
+ * Returns a new object/array (originals are not mutated); non-string leaves are
+ * passed through. Tree-shaped, JSON-like values only — not designed for class
+ * instances, prototype-bound objects, or cyclic graphs.
+ */
+export declare const sanitizeSasInPayload: <T>(value: T) => T;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microsoft/omnichannel-chat-widget",
-  "version": "1.8.4-main.f45c44b",
+  "version": "1.8.4-main.f8ae4f8",
   "description": "Microsoft Omnichannel Chat Widget",
   "main": "lib/cjs/index.js",
   "types": "lib/types/index.d.ts",
@@ -95,8 +95,8 @@
   "dependencies": {
     "@azure/core-tracing": "^1.2.0",
     "@microsoft/applicationinsights-web": "^3.3.6",
-    "@microsoft/omnichannel-chat-components": "1.1.17-main.f21df63",
-    "@microsoft/omnichannel-chat-sdk": "1.11.9-main.a5570e5",
+    "@microsoft/omnichannel-chat-components": "1.1.17-main.05edfd3",
+    "@microsoft/omnichannel-chat-sdk": "1.11.9-main.47a6498",
     "@opentelemetry/api": "^1.9.0",
     "abort-controller": "^3",
     "abort-controller-es5": "^2.0.1",