@posthog/browser-common 0.10.2 → 0.10.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/config.js +1 -1
- package/dist/config.mjs +1 -1
- package/dist/surveys/survey-html-sanitizer.d.ts +1 -0
- package/dist/surveys/survey-html-sanitizer.js +260 -0
- package/dist/surveys/survey-html-sanitizer.mjs +212 -0
- package/dist/surveys/surveys-extension-utils.js +2 -1
- package/dist/surveys/surveys-extension-utils.mjs +2 -1
- package/package.json +4 -3
package/dist/config.js
CHANGED
package/dist/config.mjs
CHANGED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
export declare function sanitizeSurveyHtml(html: string): string;
|
|
@@ -0,0 +1,260 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __webpack_require__ = {};
|
|
3
|
+
(()=>{
|
|
4
|
+
__webpack_require__.n = (module)=>{
|
|
5
|
+
var getter = module && module.__esModule ? ()=>module['default'] : ()=>module;
|
|
6
|
+
__webpack_require__.d(getter, {
|
|
7
|
+
a: getter
|
|
8
|
+
});
|
|
9
|
+
return getter;
|
|
10
|
+
};
|
|
11
|
+
})();
|
|
12
|
+
(()=>{
|
|
13
|
+
__webpack_require__.d = (exports1, getters, values)=>{
|
|
14
|
+
var define = (defs, kind)=>{
|
|
15
|
+
for(var key in defs)if (__webpack_require__.o(defs, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
|
|
16
|
+
enumerable: true,
|
|
17
|
+
[kind]: defs[key]
|
|
18
|
+
});
|
|
19
|
+
};
|
|
20
|
+
define(getters, "get");
|
|
21
|
+
define(values, "value");
|
|
22
|
+
};
|
|
23
|
+
})();
|
|
24
|
+
(()=>{
|
|
25
|
+
__webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
|
|
26
|
+
})();
|
|
27
|
+
(()=>{
|
|
28
|
+
__webpack_require__.r = (exports1)=>{
|
|
29
|
+
if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
|
|
30
|
+
value: 'Module'
|
|
31
|
+
});
|
|
32
|
+
Object.defineProperty(exports1, '__esModule', {
|
|
33
|
+
value: true
|
|
34
|
+
});
|
|
35
|
+
};
|
|
36
|
+
})();
|
|
37
|
+
var __webpack_exports__ = {};
|
|
38
|
+
__webpack_require__.r(__webpack_exports__);
|
|
39
|
+
__webpack_require__.d(__webpack_exports__, {
|
|
40
|
+
sanitizeSurveyHtml: ()=>sanitizeSurveyHtml
|
|
41
|
+
});
|
|
42
|
+
const external_dompurify_namespaceObject = require("dompurify");
|
|
43
|
+
var external_dompurify_default = /*#__PURE__*/ __webpack_require__.n(external_dompurify_namespaceObject);
|
|
44
|
+
const allowedTags = [
|
|
45
|
+
'a',
|
|
46
|
+
'abbr',
|
|
47
|
+
'acronym',
|
|
48
|
+
'area',
|
|
49
|
+
'article',
|
|
50
|
+
'aside',
|
|
51
|
+
'b',
|
|
52
|
+
'bdi',
|
|
53
|
+
'bdo',
|
|
54
|
+
'blockquote',
|
|
55
|
+
'br',
|
|
56
|
+
'caption',
|
|
57
|
+
'center',
|
|
58
|
+
'cite',
|
|
59
|
+
'code',
|
|
60
|
+
'col',
|
|
61
|
+
'colgroup',
|
|
62
|
+
'data',
|
|
63
|
+
'dd',
|
|
64
|
+
'del',
|
|
65
|
+
'details',
|
|
66
|
+
'dfn',
|
|
67
|
+
'div',
|
|
68
|
+
'dl',
|
|
69
|
+
'dt',
|
|
70
|
+
'em',
|
|
71
|
+
'figcaption',
|
|
72
|
+
'figure',
|
|
73
|
+
'footer',
|
|
74
|
+
'h1',
|
|
75
|
+
'h2',
|
|
76
|
+
'h3',
|
|
77
|
+
'h4',
|
|
78
|
+
'h5',
|
|
79
|
+
'h6',
|
|
80
|
+
'header',
|
|
81
|
+
'hgroup',
|
|
82
|
+
'hr',
|
|
83
|
+
'i',
|
|
84
|
+
'img',
|
|
85
|
+
'ins',
|
|
86
|
+
'kbd',
|
|
87
|
+
'li',
|
|
88
|
+
'map',
|
|
89
|
+
'mark',
|
|
90
|
+
'nav',
|
|
91
|
+
'ol',
|
|
92
|
+
'p',
|
|
93
|
+
'pre',
|
|
94
|
+
'q',
|
|
95
|
+
'rp',
|
|
96
|
+
'rt',
|
|
97
|
+
'rtc',
|
|
98
|
+
'ruby',
|
|
99
|
+
's',
|
|
100
|
+
'samp',
|
|
101
|
+
'small',
|
|
102
|
+
'span',
|
|
103
|
+
'strike',
|
|
104
|
+
'strong',
|
|
105
|
+
'sub',
|
|
106
|
+
'summary',
|
|
107
|
+
'sup',
|
|
108
|
+
'table',
|
|
109
|
+
'tbody',
|
|
110
|
+
'td',
|
|
111
|
+
'th',
|
|
112
|
+
'thead',
|
|
113
|
+
'time',
|
|
114
|
+
'tr',
|
|
115
|
+
'tt',
|
|
116
|
+
'u',
|
|
117
|
+
'ul',
|
|
118
|
+
'var',
|
|
119
|
+
'wbr'
|
|
120
|
+
];
|
|
121
|
+
const globalAttributes = [
|
|
122
|
+
'style',
|
|
123
|
+
'lang',
|
|
124
|
+
'title',
|
|
125
|
+
'width',
|
|
126
|
+
'height'
|
|
127
|
+
];
|
|
128
|
+
const tableCellAttributes = [
|
|
129
|
+
'abbr',
|
|
130
|
+
'align',
|
|
131
|
+
'axis',
|
|
132
|
+
'bgcolor',
|
|
133
|
+
'char',
|
|
134
|
+
'charoff',
|
|
135
|
+
'colspan',
|
|
136
|
+
'headers',
|
|
137
|
+
'height',
|
|
138
|
+
'nowrap',
|
|
139
|
+
'rowspan',
|
|
140
|
+
'scope',
|
|
141
|
+
'valign',
|
|
142
|
+
'width'
|
|
143
|
+
];
|
|
144
|
+
const allowedAttributes = {
|
|
145
|
+
a: [
|
|
146
|
+
'href',
|
|
147
|
+
'hreflang',
|
|
148
|
+
'target',
|
|
149
|
+
'rel'
|
|
150
|
+
],
|
|
151
|
+
bdo: [
|
|
152
|
+
'dir'
|
|
153
|
+
],
|
|
154
|
+
blockquote: [
|
|
155
|
+
'cite'
|
|
156
|
+
],
|
|
157
|
+
col: [
|
|
158
|
+
'align',
|
|
159
|
+
'char',
|
|
160
|
+
'charoff',
|
|
161
|
+
'span'
|
|
162
|
+
],
|
|
163
|
+
colgroup: [
|
|
164
|
+
'align',
|
|
165
|
+
'char',
|
|
166
|
+
'charoff',
|
|
167
|
+
'span'
|
|
168
|
+
],
|
|
169
|
+
del: [
|
|
170
|
+
'cite',
|
|
171
|
+
'datetime'
|
|
172
|
+
],
|
|
173
|
+
hr: [
|
|
174
|
+
'align',
|
|
175
|
+
'size',
|
|
176
|
+
'width'
|
|
177
|
+
],
|
|
178
|
+
img: [
|
|
179
|
+
'align',
|
|
180
|
+
'alt',
|
|
181
|
+
'height',
|
|
182
|
+
'src',
|
|
183
|
+
'width'
|
|
184
|
+
],
|
|
185
|
+
ins: [
|
|
186
|
+
'cite',
|
|
187
|
+
'datetime'
|
|
188
|
+
],
|
|
189
|
+
ol: [
|
|
190
|
+
'start',
|
|
191
|
+
'type'
|
|
192
|
+
],
|
|
193
|
+
q: [
|
|
194
|
+
'cite'
|
|
195
|
+
],
|
|
196
|
+
table: [
|
|
197
|
+
'align',
|
|
198
|
+
'bgcolor',
|
|
199
|
+
'border',
|
|
200
|
+
'cellpadding',
|
|
201
|
+
'cellspacing',
|
|
202
|
+
'frame',
|
|
203
|
+
'rules',
|
|
204
|
+
'summary',
|
|
205
|
+
'width'
|
|
206
|
+
],
|
|
207
|
+
tbody: [
|
|
208
|
+
'align',
|
|
209
|
+
'char',
|
|
210
|
+
'charoff',
|
|
211
|
+
'valign'
|
|
212
|
+
],
|
|
213
|
+
td: tableCellAttributes,
|
|
214
|
+
tfoot: [
|
|
215
|
+
'align',
|
|
216
|
+
'char',
|
|
217
|
+
'charoff',
|
|
218
|
+
'valign'
|
|
219
|
+
],
|
|
220
|
+
th: tableCellAttributes,
|
|
221
|
+
thead: [
|
|
222
|
+
'align',
|
|
223
|
+
'char',
|
|
224
|
+
'charoff',
|
|
225
|
+
'valign'
|
|
226
|
+
],
|
|
227
|
+
tr: [
|
|
228
|
+
'align',
|
|
229
|
+
'bgcolor',
|
|
230
|
+
'char',
|
|
231
|
+
'charoff',
|
|
232
|
+
'valign'
|
|
233
|
+
]
|
|
234
|
+
};
|
|
235
|
+
let surveySanitizer;
|
|
236
|
+
function sanitizeSurveyHtml(html) {
|
|
237
|
+
const sanitized = (surveySanitizer ??= external_dompurify_default()()).sanitize(html, {
|
|
238
|
+
ALLOWED_TAGS: allowedTags,
|
|
239
|
+
ALLOWED_ATTR: [],
|
|
240
|
+
ALLOW_ARIA_ATTR: false,
|
|
241
|
+
ALLOW_DATA_ATTR: false,
|
|
242
|
+
ALLOWED_NAMESPACES: [
|
|
243
|
+
'http://www.w3.org/1999/xhtml'
|
|
244
|
+
],
|
|
245
|
+
ADD_ATTR: (attributeName, tagName)=>-1 !== globalAttributes.indexOf(attributeName) || Object.prototype.hasOwnProperty.call(allowedAttributes, tagName) && -1 !== (allowedAttributes[tagName] || []).indexOf(attributeName),
|
|
246
|
+
RETURN_DOM_FRAGMENT: true
|
|
247
|
+
});
|
|
248
|
+
const links = sanitized.querySelectorAll('a');
|
|
249
|
+
for(let i = 0; i < links.length; i++)links.item(i).relList.add('noopener');
|
|
250
|
+
const container = document.createElement('div');
|
|
251
|
+
container.appendChild(sanitized);
|
|
252
|
+
return container.innerHTML;
|
|
253
|
+
}
|
|
254
|
+
exports.sanitizeSurveyHtml = __webpack_exports__.sanitizeSurveyHtml;
|
|
255
|
+
for(var __rspack_i in __webpack_exports__)if (-1 === [
|
|
256
|
+
"sanitizeSurveyHtml"
|
|
257
|
+
].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
|
|
258
|
+
Object.defineProperty(exports, '__esModule', {
|
|
259
|
+
value: true
|
|
260
|
+
});
|
|
@@ -0,0 +1,212 @@
|
|
|
1
|
+
import dompurify from "dompurify";
|
|
2
|
+
const allowedTags = [
|
|
3
|
+
'a',
|
|
4
|
+
'abbr',
|
|
5
|
+
'acronym',
|
|
6
|
+
'area',
|
|
7
|
+
'article',
|
|
8
|
+
'aside',
|
|
9
|
+
'b',
|
|
10
|
+
'bdi',
|
|
11
|
+
'bdo',
|
|
12
|
+
'blockquote',
|
|
13
|
+
'br',
|
|
14
|
+
'caption',
|
|
15
|
+
'center',
|
|
16
|
+
'cite',
|
|
17
|
+
'code',
|
|
18
|
+
'col',
|
|
19
|
+
'colgroup',
|
|
20
|
+
'data',
|
|
21
|
+
'dd',
|
|
22
|
+
'del',
|
|
23
|
+
'details',
|
|
24
|
+
'dfn',
|
|
25
|
+
'div',
|
|
26
|
+
'dl',
|
|
27
|
+
'dt',
|
|
28
|
+
'em',
|
|
29
|
+
'figcaption',
|
|
30
|
+
'figure',
|
|
31
|
+
'footer',
|
|
32
|
+
'h1',
|
|
33
|
+
'h2',
|
|
34
|
+
'h3',
|
|
35
|
+
'h4',
|
|
36
|
+
'h5',
|
|
37
|
+
'h6',
|
|
38
|
+
'header',
|
|
39
|
+
'hgroup',
|
|
40
|
+
'hr',
|
|
41
|
+
'i',
|
|
42
|
+
'img',
|
|
43
|
+
'ins',
|
|
44
|
+
'kbd',
|
|
45
|
+
'li',
|
|
46
|
+
'map',
|
|
47
|
+
'mark',
|
|
48
|
+
'nav',
|
|
49
|
+
'ol',
|
|
50
|
+
'p',
|
|
51
|
+
'pre',
|
|
52
|
+
'q',
|
|
53
|
+
'rp',
|
|
54
|
+
'rt',
|
|
55
|
+
'rtc',
|
|
56
|
+
'ruby',
|
|
57
|
+
's',
|
|
58
|
+
'samp',
|
|
59
|
+
'small',
|
|
60
|
+
'span',
|
|
61
|
+
'strike',
|
|
62
|
+
'strong',
|
|
63
|
+
'sub',
|
|
64
|
+
'summary',
|
|
65
|
+
'sup',
|
|
66
|
+
'table',
|
|
67
|
+
'tbody',
|
|
68
|
+
'td',
|
|
69
|
+
'th',
|
|
70
|
+
'thead',
|
|
71
|
+
'time',
|
|
72
|
+
'tr',
|
|
73
|
+
'tt',
|
|
74
|
+
'u',
|
|
75
|
+
'ul',
|
|
76
|
+
'var',
|
|
77
|
+
'wbr'
|
|
78
|
+
];
|
|
79
|
+
const globalAttributes = [
|
|
80
|
+
'style',
|
|
81
|
+
'lang',
|
|
82
|
+
'title',
|
|
83
|
+
'width',
|
|
84
|
+
'height'
|
|
85
|
+
];
|
|
86
|
+
const tableCellAttributes = [
|
|
87
|
+
'abbr',
|
|
88
|
+
'align',
|
|
89
|
+
'axis',
|
|
90
|
+
'bgcolor',
|
|
91
|
+
'char',
|
|
92
|
+
'charoff',
|
|
93
|
+
'colspan',
|
|
94
|
+
'headers',
|
|
95
|
+
'height',
|
|
96
|
+
'nowrap',
|
|
97
|
+
'rowspan',
|
|
98
|
+
'scope',
|
|
99
|
+
'valign',
|
|
100
|
+
'width'
|
|
101
|
+
];
|
|
102
|
+
const allowedAttributes = {
|
|
103
|
+
a: [
|
|
104
|
+
'href',
|
|
105
|
+
'hreflang',
|
|
106
|
+
'target',
|
|
107
|
+
'rel'
|
|
108
|
+
],
|
|
109
|
+
bdo: [
|
|
110
|
+
'dir'
|
|
111
|
+
],
|
|
112
|
+
blockquote: [
|
|
113
|
+
'cite'
|
|
114
|
+
],
|
|
115
|
+
col: [
|
|
116
|
+
'align',
|
|
117
|
+
'char',
|
|
118
|
+
'charoff',
|
|
119
|
+
'span'
|
|
120
|
+
],
|
|
121
|
+
colgroup: [
|
|
122
|
+
'align',
|
|
123
|
+
'char',
|
|
124
|
+
'charoff',
|
|
125
|
+
'span'
|
|
126
|
+
],
|
|
127
|
+
del: [
|
|
128
|
+
'cite',
|
|
129
|
+
'datetime'
|
|
130
|
+
],
|
|
131
|
+
hr: [
|
|
132
|
+
'align',
|
|
133
|
+
'size',
|
|
134
|
+
'width'
|
|
135
|
+
],
|
|
136
|
+
img: [
|
|
137
|
+
'align',
|
|
138
|
+
'alt',
|
|
139
|
+
'height',
|
|
140
|
+
'src',
|
|
141
|
+
'width'
|
|
142
|
+
],
|
|
143
|
+
ins: [
|
|
144
|
+
'cite',
|
|
145
|
+
'datetime'
|
|
146
|
+
],
|
|
147
|
+
ol: [
|
|
148
|
+
'start',
|
|
149
|
+
'type'
|
|
150
|
+
],
|
|
151
|
+
q: [
|
|
152
|
+
'cite'
|
|
153
|
+
],
|
|
154
|
+
table: [
|
|
155
|
+
'align',
|
|
156
|
+
'bgcolor',
|
|
157
|
+
'border',
|
|
158
|
+
'cellpadding',
|
|
159
|
+
'cellspacing',
|
|
160
|
+
'frame',
|
|
161
|
+
'rules',
|
|
162
|
+
'summary',
|
|
163
|
+
'width'
|
|
164
|
+
],
|
|
165
|
+
tbody: [
|
|
166
|
+
'align',
|
|
167
|
+
'char',
|
|
168
|
+
'charoff',
|
|
169
|
+
'valign'
|
|
170
|
+
],
|
|
171
|
+
td: tableCellAttributes,
|
|
172
|
+
tfoot: [
|
|
173
|
+
'align',
|
|
174
|
+
'char',
|
|
175
|
+
'charoff',
|
|
176
|
+
'valign'
|
|
177
|
+
],
|
|
178
|
+
th: tableCellAttributes,
|
|
179
|
+
thead: [
|
|
180
|
+
'align',
|
|
181
|
+
'char',
|
|
182
|
+
'charoff',
|
|
183
|
+
'valign'
|
|
184
|
+
],
|
|
185
|
+
tr: [
|
|
186
|
+
'align',
|
|
187
|
+
'bgcolor',
|
|
188
|
+
'char',
|
|
189
|
+
'charoff',
|
|
190
|
+
'valign'
|
|
191
|
+
]
|
|
192
|
+
};
|
|
193
|
+
let surveySanitizer;
|
|
194
|
+
function sanitizeSurveyHtml(html) {
|
|
195
|
+
const sanitized = (surveySanitizer ??= dompurify()).sanitize(html, {
|
|
196
|
+
ALLOWED_TAGS: allowedTags,
|
|
197
|
+
ALLOWED_ATTR: [],
|
|
198
|
+
ALLOW_ARIA_ATTR: false,
|
|
199
|
+
ALLOW_DATA_ATTR: false,
|
|
200
|
+
ALLOWED_NAMESPACES: [
|
|
201
|
+
'http://www.w3.org/1999/xhtml'
|
|
202
|
+
],
|
|
203
|
+
ADD_ATTR: (attributeName, tagName)=>-1 !== globalAttributes.indexOf(attributeName) || Object.prototype.hasOwnProperty.call(allowedAttributes, tagName) && -1 !== (allowedAttributes[tagName] || []).indexOf(attributeName),
|
|
204
|
+
RETURN_DOM_FRAGMENT: true
|
|
205
|
+
});
|
|
206
|
+
const links = sanitized.querySelectorAll('a');
|
|
207
|
+
for(let i = 0; i < links.length; i++)links.item(i).relList.add('noopener');
|
|
208
|
+
const container = document.createElement('div');
|
|
209
|
+
container.appendChild(sanitized);
|
|
210
|
+
return container.innerHTML;
|
|
211
|
+
}
|
|
212
|
+
export { sanitizeSurveyHtml };
|
|
@@ -61,6 +61,7 @@ __webpack_require__.d(__webpack_exports__, {
|
|
|
61
61
|
shuffle: ()=>surveys_namespaceObject.shuffle,
|
|
62
62
|
useSurveyContext: ()=>useSurveyContext
|
|
63
63
|
});
|
|
64
|
+
const external_survey_html_sanitizer_js_namespaceObject = require("./survey-html-sanitizer.js");
|
|
64
65
|
const external_extension_tokens_js_namespaceObject = require("../extension-tokens.js");
|
|
65
66
|
const url_targeting_utils_js_namespaceObject = require("../utils/url-targeting-utils.js");
|
|
66
67
|
const external_survey_render_context_js_namespaceObject = require("../survey-render-context.js");
|
|
@@ -540,7 +541,7 @@ const SurveyContext = (0, external_preact_namespaceObject.createContext)({
|
|
|
540
541
|
const useSurveyContext = ()=>(0, hooks_namespaceObject.useContext)(SurveyContext);
|
|
541
542
|
const renderChildrenAsTextOrHtml = ({ component, children, renderAsHtml, style })=>renderAsHtml ? (0, external_preact_namespaceObject.cloneElement)(component, {
|
|
542
543
|
dangerouslySetInnerHTML: {
|
|
543
|
-
__html: children
|
|
544
|
+
__html: (0, external_survey_html_sanitizer_js_namespaceObject.sanitizeSurveyHtml)(children)
|
|
544
545
|
},
|
|
545
546
|
style
|
|
546
547
|
}) : (0, external_preact_namespaceObject.cloneElement)(component, {
|
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { sanitizeSurveyHtml } from "./survey-html-sanitizer.mjs";
|
|
1
2
|
import { FeatureFlagsCommonExtension } from "../extension-tokens.mjs";
|
|
2
3
|
import { getTargetingUrl } from "../utils/url-targeting-utils.mjs";
|
|
3
4
|
import { getSurveyReplayUrl } from "../survey-render-context.mjs";
|
|
@@ -477,7 +478,7 @@ const SurveyContext = createContext({
|
|
|
477
478
|
const useSurveyContext = ()=>useContext(SurveyContext);
|
|
478
479
|
const renderChildrenAsTextOrHtml = ({ component, children, renderAsHtml, style })=>renderAsHtml ? cloneElement(component, {
|
|
479
480
|
dangerouslySetInnerHTML: {
|
|
480
|
-
__html: children
|
|
481
|
+
__html: sanitizeSurveyHtml(children)
|
|
481
482
|
},
|
|
482
483
|
style
|
|
483
484
|
}) : cloneElement(component, {
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@posthog/browser-common",
|
|
3
|
-
"version": "0.10.
|
|
3
|
+
"version": "0.10.3",
|
|
4
4
|
"description": "Internal shared browser utilities and extension primitives for PostHog Browser SDKs",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"repository": {
|
|
@@ -239,9 +239,10 @@
|
|
|
239
239
|
}
|
|
240
240
|
},
|
|
241
241
|
"dependencies": {
|
|
242
|
+
"dompurify": "^3.4.13",
|
|
242
243
|
"preact": "^10.29.3",
|
|
243
|
-
"@posthog/core": "^1.
|
|
244
|
-
"@posthog/types": "^1.
|
|
244
|
+
"@posthog/core": "^1.62.0",
|
|
245
|
+
"@posthog/types": "^1.419.0"
|
|
245
246
|
},
|
|
246
247
|
"devDependencies": {
|
|
247
248
|
"@rsbuild/plugin-react": "^2.1.0",
|