@openmrs/esm-navigation 10.0.1-pre.5501 → 10.0.1-pre.5505

package/.turbo/turbo-build.log

@@ -1,3 +1,3 @@
-[0] Successfully compiled: 8 files with swc (192.85ms)
+[0] Successfully compiled: 8 files with swc (295.7ms)
 [0] swc --strip-leading-paths src -d dist exited with code 0
 [1] tsc --project tsconfig.build.json exited with code 0

package/dist/navigation/interpolate-string.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interpolate-string.d.ts","sourceRoot":"","sources":["../../src/navigation/interpolate-string.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAMnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,MAAM,CAOrG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,MAAM,CAG7F"}
+{"version":3,"file":"interpolate-string.d.ts","sourceRoot":"","sources":["../../src/navigation/interpolate-string.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAMnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,MAAM,CAWrG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,MAAM,CAG7F"}

package/dist/navigation/interpolate-string.js

@@ -32,11 +32,14 @@
  * @returns The interpolated string with all template parameters replaced.
  */ export function interpolateUrl(template, additionalParams) {
     const openmrsSpaBase = trimTrailingSlash(window.getOpenmrsSpaBase());
-    return interpolateString(template, {
+    const result = interpolateString(template, {
         openmrsBase: window.openmrsBase,
         openmrsSpaBase: openmrsSpaBase,
         ...additionalParams
-    }).replace(/^\/\//, '/'); // remove extra initial slash if present
+    });
+    // remove a additional / at the beginning if added by interpolation
+    // e.g. /${openmrsSpaBase} -> //openmrs/spa
+    return template.startsWith('//') ? result : result.replace(/^\/\//, '/');
 }
 /**
  * Interpolates values of `params` into the `template` string.

package/dist/navigation/navigate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"navigate.d.ts","sourceRoot":"","sources":["../../src/navigation/navigate.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,cAAc,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,CAAC;AAEvD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,QAAQ,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,eAAe,GAAG,IAAI,CAUtE"}
+{"version":3,"file":"navigate.d.ts","sourceRoot":"","sources":["../../src/navigation/navigate.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,cAAc,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,CAAC;AAEvD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,QAAQ,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,eAAe,GAAG,IAAI,CActE"}

package/dist/navigation/navigate.js

@@ -1,4 +1,5 @@
 /** @module @category Navigation */ import { navigateToUrl } from "single-spa";
+import { getCoreTranslation } from "@openmrs/esm-translations";
 import { interpolateUrl } from "./interpolate-string.js";
 function trimTrailingSlash(str) {
     return str.replace(/\/$/, '');
@@ -37,8 +38,12 @@ function trimTrailingSlash(str) {
  */ export function navigate({ to, templateParams }) {
     const openmrsSpaBase = trimTrailingSlash(window.getOpenmrsSpaBase());
     const target = interpolateUrl(to, templateParams).replace(window.location.origin, '');
-    const isSpaPath = target.startsWith(openmrsSpaBase);
-    if (isSpaPath) {
+    const targetURL = new URL(target, window.location.origin);
+    if (targetURL.protocol != 'http:' && targetURL.protocol != 'https:') {
+        console.error(`Received request to navigate to non-http URL: ${targetURL.toString()}`);
+        throw new Error(getCoreTranslation('navigateNonHttp'));
+    }
+    if (target.startsWith(openmrsSpaBase)) {
         navigateToUrl(target);
     } else {
         window.location.assign(target);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openmrs/esm-navigation",
-  "version": "10.0.1-pre.5501",
+  "version": "10.0.1-pre.5505",
   "license": "MPL-2.0",
   "description": "OpenMRS library providing tools for breadcrumbs, navigation, and history.",
   "type": "module",
@@ -53,10 +53,12 @@
     "path-to-regexp": "^8.3.0"
   },
   "peerDependencies": {
-    "@openmrs/esm-state": "^10.0.1-pre.5501"
+    "@openmrs/esm-state": "^10.0.1-pre.5505",
+    "@openmrs/esm-translations": "^10.0.1-pre.5505"
   },
   "devDependencies": {
-    "@openmrs/esm-state": "10.0.1-pre.5501",
+    "@openmrs/esm-state": "10.0.1-pre.5505",
+    "@openmrs/esm-translations": "10.0.1-pre.5505",
     "@swc/cli": "0.8.1",
     "@swc/core": "1.15.21",
     "@vitest/coverage-v8": "^4.1.2",

package/src/navigation/interpolate-string.test.ts

@@ -18,6 +18,10 @@ describe('interpolateUrl', () => {
     const result = interpolateUrl('test ok');
     expect(result).toBe('test ok');
   });
+
+  it('preserves protocol-relative URLs', () => {
+    expect(interpolateUrl('//evil.example/${openmrsSpaBase}')).toBe('//evil.example//openmrs/spa');
+  });
 });
 
 describe('interpolateString', () => {

package/src/navigation/interpolate-string.ts

@@ -36,11 +36,15 @@ function trimTrailingSlash(str: string) {
  */
 export function interpolateUrl(template: string, additionalParams?: { [key: string]: string }): string {
   const openmrsSpaBase = trimTrailingSlash(window.getOpenmrsSpaBase());
-  return interpolateString(template, {
+  const result = interpolateString(template, {
     openmrsBase: window.openmrsBase,
     openmrsSpaBase: openmrsSpaBase,
     ...additionalParams,
-  }).replace(/^\/\//, '/'); // remove extra initial slash if present
+  });
+
+  // remove a additional / at the beginning if added by interpolation
+  // e.g. /${openmrsSpaBase} -> //openmrs/spa
+  return template.startsWith('//') ? result : result.replace(/^\/\//, '/');
 }
 
 /**

package/src/navigation/navigate.test.ts

@@ -66,4 +66,18 @@ describe('navigate', () => {
     expect(navigateToUrl).toHaveBeenCalledWith('/openmrs/spa/qux/page');
     expect(window.location.assign).not.toHaveBeenCalled();
   });
+
+  it('rejects non-http URLs', () => {
+    expect(() => navigate({ to: 'ftp://${openmrsSpaBase}/qux/page' })).toThrow(Error);
+    expect(() => navigate({ to: 'javascript:alert(1)' })).toThrow(Error);
+    expect(navigateToUrl).not.toHaveBeenCalled();
+    expect(window.location.assign).not.toHaveBeenCalled();
+  });
+
+  it('rejects non-http URLs when the SPA base is the root', () => {
+    const getOpenmrsSpaBase = vi.spyOn(window, 'getOpenmrsSpaBase').mockReturnValue('/');
+    expect(() => navigate({ to: 'javascript:alert(1)' })).toThrow(Error);
+    expect(navigateToUrl).not.toHaveBeenCalled();
+    getOpenmrsSpaBase.mockRestore();
+  });
 });

package/src/navigation/navigate.ts

@@ -1,5 +1,6 @@
 /** @module @category Navigation */
 import { navigateToUrl } from 'single-spa';
+import { getCoreTranslation } from '@openmrs/esm-translations';
 import { interpolateUrl } from './interpolate-string';
 import type {} from '@openmrs/esm-globals';
 
@@ -49,9 +50,13 @@ export interface NavigateOptions {
 export function navigate({ to, templateParams }: NavigateOptions): void {
   const openmrsSpaBase = trimTrailingSlash(window.getOpenmrsSpaBase());
   const target = interpolateUrl(to, templateParams).replace(window.location.origin, '');
-  const isSpaPath = target.startsWith(openmrsSpaBase);
+  const targetURL = new URL(target, window.location.origin);
+  if (targetURL.protocol != 'http:' && targetURL.protocol != 'https:') {
+    console.error(`Received request to navigate to non-http URL: ${targetURL.toString()}`);
+    throw new Error(getCoreTranslation('navigateNonHttp'));
+  }
 
-  if (isSpaPath) {
+  if (target.startsWith(openmrsSpaBase)) {
     navigateToUrl(target);
   } else {
     window.location.assign(target);