@nocios/crudify-ui 3.0.56 → 3.0.60

package/dist/index.d.mts

@@ -751,11 +751,13 @@ interface Notification {
     severity: NotificationSeverity;
     autoHideDuration?: number;
     persistent?: boolean;
+    allowHtml?: boolean;
 }
 interface GlobalNotificationContextValue {
     showNotification: (message: string, severity?: NotificationSeverity, options?: {
         autoHideDuration?: number;
         persistent?: boolean;
+        allowHtml?: boolean;
     }) => string;
     hideNotification: (id: string) => void;
     clearAllNotifications: () => void;

package/dist/index.d.ts

@@ -751,11 +751,13 @@ interface Notification {
     severity: NotificationSeverity;
     autoHideDuration?: number;
     persistent?: boolean;
+    allowHtml?: boolean;
 }
 interface GlobalNotificationContextValue {
     showNotification: (message: string, severity?: NotificationSeverity, options?: {
         autoHideDuration?: number;
         persistent?: boolean;
+        allowHtml?: boolean;
     }) => string;
     hideNotification: (id: string) => void;
     clearAllNotifications: () => void;

package/dist/index.js

@@ -1401,8 +1401,24 @@ var isTokenExpired = (token) => {
 var import_react6 = require("react");
 var import_material = require("@mui/material");
 var import_uuid = require("uuid");
+var import_dompurify = __toESM(require("dompurify"));
 var import_jsx_runtime4 = require("react/jsx-runtime");
 var GlobalNotificationContext = (0, import_react6.createContext)(null);
+var sanitizeNotificationContent = (html) => {
+  return import_dompurify.default.sanitize(html, {
+    // Solo permitir tags seguros para notificaciones
+    ALLOWED_TAGS: ["b", "i", "em", "strong", "br", "span"],
+    ALLOWED_ATTR: ["class"],
+    // Remover scripts y eventos
+    FORBID_TAGS: ["script", "iframe", "object", "embed"],
+    FORBID_ATTR: ["onload", "onerror", "onclick", "onmouseover", "onfocus", "onblur"],
+    // Configuración adicional de seguridad
+    WHOLE_DOCUMENT: false,
+    RETURN_DOM: false,
+    RETURN_DOM_FRAGMENT: false,
+    RETURN_TRUSTED_TYPE: false
+  });
+};
 var GlobalNotificationProvider = ({
   children,
   maxNotifications = 5,
@@ -1417,13 +1433,23 @@ var GlobalNotificationProvider = ({
       if (!enabled) {
         return "";
       }
+      if (!message || typeof message !== "string") {
+        console.warn("\u26A0\uFE0F GlobalNotificationProvider: Invalid message provided");
+        return "";
+      }
+      if (message.length > 1e3) {
+        console.warn("\u26A0\uFE0F GlobalNotificationProvider: Message too long, truncating");
+        message = message.substring(0, 1e3) + "...";
+      }
       const id = (0, import_uuid.v4)();
       const newNotification = {
         id,
         message,
         severity,
         autoHideDuration: options?.autoHideDuration ?? defaultAutoHideDuration,
-        persistent: options?.persistent ?? false
+        persistent: options?.persistent ?? false,
+        allowHtml: options?.allowHtml ?? false
+        // Por defecto NO permitir HTML
       };
       setNotifications((prev) => {
         const updatedNotifications = prev.length >= maxNotifications ? prev.slice(-(maxNotifications - 1)) : prev;
@@ -1513,7 +1539,7 @@ var NotificationItem = ({ notification, onClose }) => {
             maxWidth: "400px",
             wordBreak: "break-word"
           },
-          children: /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("span", { dangerouslySetInnerHTML: { __html: notification.message } })
+          children: notification.allowHtml ? /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("span", { dangerouslySetInnerHTML: { __html: sanitizeNotificationContent(notification.message) } }) : /* @__PURE__ */ (0, import_jsx_runtime4.jsx)("span", { children: notification.message })
         }
       )
     }
@@ -2844,6 +2870,7 @@ var CrudifyLoginInternal = ({
   const { t } = useTranslation();
   const { state, setScreen } = useLoginState();
   const { config } = useSessionContext();
+  const { showNotification } = useGlobalNotification();
   const handleScreenChange = (screen2, params) => {
     let finalParams = params;
     if (screen2 === "login") {
@@ -2873,6 +2900,8 @@ var CrudifyLoginInternal = ({
             ...commonProps,
             searchParams: state.searchParams,
             onResetSuccess: () => {
+              const message = t("resetPassword.successMessage");
+              showNotification(message, "success");
               handleScreenChange("login");
             }
           }
@@ -4775,10 +4804,7 @@ var useCrudifyWithNotifications = (options = {}) => {
             moduleKey = actionConfig.moduleKey;
           }
         }
-        if (operation === "validateAndResetPassword") {
-          const message = getSafeTranslation("resetPassword.successMessage", "Contrase\xF1a restablecida exitosamente");
-          showNotification(message, "success", { autoHideDuration });
-        } else if (shouldShowSuccessNotification(operation, moduleKey)) {
+        if (shouldShowSuccessNotification(operation, moduleKey)) {
           const message = getSuccessMessage(operation, moduleKey, actionConfig);
           showNotification(message, "success", { autoHideDuration });
         }

package/dist/index.mjs

@@ -1328,8 +1328,24 @@ var isTokenExpired = (token) => {
 import { useState as useState4, createContext as createContext4, useContext as useContext4, useCallback as useCallback2, useEffect as useEffect5 } from "react";
 import { Snackbar, Alert, Box, Portal } from "@mui/material";
 import { v4 as uuidv4 } from "uuid";
+import DOMPurify from "dompurify";
 import { jsx as jsx4, jsxs } from "react/jsx-runtime";
 var GlobalNotificationContext = createContext4(null);
+var sanitizeNotificationContent = (html) => {
+  return DOMPurify.sanitize(html, {
+    // Solo permitir tags seguros para notificaciones
+    ALLOWED_TAGS: ["b", "i", "em", "strong", "br", "span"],
+    ALLOWED_ATTR: ["class"],
+    // Remover scripts y eventos
+    FORBID_TAGS: ["script", "iframe", "object", "embed"],
+    FORBID_ATTR: ["onload", "onerror", "onclick", "onmouseover", "onfocus", "onblur"],
+    // Configuración adicional de seguridad
+    WHOLE_DOCUMENT: false,
+    RETURN_DOM: false,
+    RETURN_DOM_FRAGMENT: false,
+    RETURN_TRUSTED_TYPE: false
+  });
+};
 var GlobalNotificationProvider = ({
   children,
   maxNotifications = 5,
@@ -1344,13 +1360,23 @@ var GlobalNotificationProvider = ({
       if (!enabled) {
         return "";
       }
+      if (!message || typeof message !== "string") {
+        console.warn("\u26A0\uFE0F GlobalNotificationProvider: Invalid message provided");
+        return "";
+      }
+      if (message.length > 1e3) {
+        console.warn("\u26A0\uFE0F GlobalNotificationProvider: Message too long, truncating");
+        message = message.substring(0, 1e3) + "...";
+      }
       const id = uuidv4();
       const newNotification = {
         id,
         message,
         severity,
         autoHideDuration: options?.autoHideDuration ?? defaultAutoHideDuration,
-        persistent: options?.persistent ?? false
+        persistent: options?.persistent ?? false,
+        allowHtml: options?.allowHtml ?? false
+        // Por defecto NO permitir HTML
       };
       setNotifications((prev) => {
         const updatedNotifications = prev.length >= maxNotifications ? prev.slice(-(maxNotifications - 1)) : prev;
@@ -1440,7 +1466,7 @@ var NotificationItem = ({ notification, onClose }) => {
             maxWidth: "400px",
             wordBreak: "break-word"
           },
-          children: /* @__PURE__ */ jsx4("span", { dangerouslySetInnerHTML: { __html: notification.message } })
+          children: notification.allowHtml ? /* @__PURE__ */ jsx4("span", { dangerouslySetInnerHTML: { __html: sanitizeNotificationContent(notification.message) } }) : /* @__PURE__ */ jsx4("span", { children: notification.message })
         }
       )
     }
@@ -2771,6 +2797,7 @@ var CrudifyLoginInternal = ({
   const { t } = useTranslation();
   const { state, setScreen } = useLoginState();
   const { config } = useSessionContext();
+  const { showNotification } = useGlobalNotification();
   const handleScreenChange = (screen2, params) => {
     let finalParams = params;
     if (screen2 === "login") {
@@ -2800,6 +2827,8 @@ var CrudifyLoginInternal = ({
             ...commonProps,
             searchParams: state.searchParams,
             onResetSuccess: () => {
+              const message = t("resetPassword.successMessage");
+              showNotification(message, "success");
               handleScreenChange("login");
             }
           }
@@ -4761,10 +4790,7 @@ var useCrudifyWithNotifications = (options = {}) => {
             moduleKey = actionConfig.moduleKey;
           }
         }
-        if (operation === "validateAndResetPassword") {
-          const message = getSafeTranslation("resetPassword.successMessage", "Contrase\xF1a restablecida exitosamente");
-          showNotification(message, "success", { autoHideDuration });
-        } else if (shouldShowSuccessNotification(operation, moduleKey)) {
+        if (shouldShowSuccessNotification(operation, moduleKey)) {
           const message = getSuccessMessage(operation, moduleKey, actionConfig);
           showNotification(message, "success", { autoHideDuration });
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocios/crudify-ui",
-  "version": "3.0.56",
+  "version": "3.0.60",
   "description": "Biblioteca de componentes UI para Crudify",
   "author": "Nocios",
   "license": "MIT",
@@ -26,8 +26,10 @@
     "@mui/material": "^7.1.0",
     "@mui/x-data-grid": "^8.5.1",
     "@nocios/crudify-browser": "^2.0.6",
+    "@types/dompurify": "^3.0.5",
     "@types/uuid": "^10.0.0",
     "crypto-js": "^4.2.0",
+    "dompurify": "^3.2.7",
     "i18next-browser-languagedetector": "^8.1.0",
     "i18next-http-backend": "^3.0.2",
     "react": "^19.1.0",