@progress/kendo-angular-common 25.3.0-develop.1 → 25.3.0-develop.2

package/fesm2022/progress-kendo-angular-common.mjs

@@ -240,6 +240,58 @@ const processCssValue = (value) => {
     return null;
 };
 
+const allowedUrlSchemes = /^(https?|mailto|tel):/i;
+const allowedImageDataUrl = /^data:image\/(?!svg\+xml\b)[a-z0-9.+-]+[,;]/i;
+const urlScheme = /^[a-z][a-z\d+.-]*:/i;
+const schemeName = /^[a-z][a-z\d+.-]*$/i;
+const removeControlCharacters = (url) => Array.from(url)
+    .filter((character) => {
+    const characterCode = character.codePointAt(0) ?? 0;
+    return characterCode > 31 && characterCode !== 127;
+})
+    .join('');
+const buildExtraSchemesPattern = (extraSchemes) => {
+    const valid = extraSchemes.filter((scheme) => schemeName.test(scheme));
+    if (valid.length === 0) {
+        return null;
+    }
+    return new RegExp('^(' + valid.join('|') + '):', 'i');
+};
+/**
+ * @hidden
+ * Returns `true` when the URL is a relative reference/fragment or uses an allow-listed scheme (http, https, mailto, tel).
+ * Callers may pass `extraSchemes` (without trailing colon) to widen the allow-list for their specific use case.
+ */
+const isSafeUrl = (url, extraSchemes) => {
+    if (url === null || url === undefined) {
+        return true;
+    }
+    const normalizedUrl = removeControlCharacters(String(url).trim());
+    if (!urlScheme.test(normalizedUrl)) {
+        return true;
+    }
+    if (allowedUrlSchemes.test(normalizedUrl)) {
+        return true;
+    }
+    const extra = extraSchemes && extraSchemes.length > 0 ? buildExtraSchemesPattern(extraSchemes) : null;
+    return extra?.test(normalizedUrl) ?? false;
+};
+/**
+ * @hidden
+ * Same as {@link isSafeUrl} but also accepts `data:image/<mime>` URLs (excluding `data:image/svg+xml`)
+ * so that base64-embedded raster images continue to work in image src attributes.
+ */
+const isSafeImageUrl = (url) => {
+    if (url === null || url === undefined) {
+        return true;
+    }
+    const normalizedUrl = removeControlCharacters(String(url).trim());
+    if (!urlScheme.test(normalizedUrl)) {
+        return true;
+    }
+    return allowedUrlSchemes.test(normalizedUrl) || allowedImageDataUrl.test(normalizedUrl);
+};
+
 class DraggableDirective {
     element;
     ngZone;
@@ -2351,5 +2403,5 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "20.3.30", ngImpo
  * Generated bundle index. Do not edit.
  */
 
-export { ScrollbarService as BrowserSupportService, ComponentNameDirective, DraggableDirective, EventsOutsideAngularDirective, KENDO_ADORNMENTS, KENDO_COMMON, KENDO_COMPONENT_NAME, KENDO_DRAGGABLE, KENDO_EVENTS, KENDO_RESIZESENSOR, KENDO_TEMPLATE_CONTEXT, KENDO_TOGGLEBUTTONTABSTOP, KENDO_WATERMARK, KENDO_WEBMCP_HOST, KendoInput, Keys, MultiTabStop, PrefixTemplateDirective, PreventableEvent, ResizeBatchService, ResizeCompatService, ResizeObserverService, ResizeSensorComponent, ScrollbarService, SeparatorComponent, SuffixTemplateDirective, TemplateContextDirective, ToggleButtonTabStopDirective, WatermarkOverlayComponent, anyChanged, applyAttributes, areObjectsEqual, closest, closestBySelector, closestInScope, contains, findElement, findFocusable, findFocusableChild, firefoxMaxHeight, focusableSelector, getLicenseMessage, getter, guid, hasClasses, hasFocusableParent, hasObservers, isChanged, isControlRequired, isDocumentAvailable, isFirefox, isFocusable, isFocusableWithTabKey, isObject, isObjectPresent, isPresent, isSafari, isSet, isString, isVisible, matchesClasses, matchesNodeName, normalizeKeys, parseAttributes, parseCSSClassNames, processCssValue, provideComponentName, removeHTMLAttributes, replaceMessagePlaceholder, rtlScrollLeft, rtlScrollPosition, scrollbarWidth, setHTMLAttributes, setter, shouldShowValidationUI, splitStringToArray };
+export { ScrollbarService as BrowserSupportService, ComponentNameDirective, DraggableDirective, EventsOutsideAngularDirective, KENDO_ADORNMENTS, KENDO_COMMON, KENDO_COMPONENT_NAME, KENDO_DRAGGABLE, KENDO_EVENTS, KENDO_RESIZESENSOR, KENDO_TEMPLATE_CONTEXT, KENDO_TOGGLEBUTTONTABSTOP, KENDO_WATERMARK, KENDO_WEBMCP_HOST, KendoInput, Keys, MultiTabStop, PrefixTemplateDirective, PreventableEvent, ResizeBatchService, ResizeCompatService, ResizeObserverService, ResizeSensorComponent, ScrollbarService, SeparatorComponent, SuffixTemplateDirective, TemplateContextDirective, ToggleButtonTabStopDirective, WatermarkOverlayComponent, anyChanged, applyAttributes, areObjectsEqual, closest, closestBySelector, closestInScope, contains, findElement, findFocusable, findFocusableChild, firefoxMaxHeight, focusableSelector, getLicenseMessage, getter, guid, hasClasses, hasFocusableParent, hasObservers, isChanged, isControlRequired, isDocumentAvailable, isFirefox, isFocusable, isFocusableWithTabKey, isObject, isObjectPresent, isPresent, isSafari, isSafeImageUrl, isSafeUrl, isSet, isString, isVisible, matchesClasses, matchesNodeName, normalizeKeys, parseAttributes, parseCSSClassNames, processCssValue, provideComponentName, removeHTMLAttributes, replaceMessagePlaceholder, rtlScrollLeft, rtlScrollPosition, scrollbarWidth, setHTMLAttributes, setter, shouldShowValidationUI, splitStringToArray };
 

package/index.d.ts

@@ -290,6 +290,19 @@ declare const areObjectsEqual: (firstObject: any, secondObject: any) => boolean;
 
 declare const processCssValue: (value: number | string) => string | null;
 
+/**
+ * @hidden
+ * Returns `true` when the URL is a relative reference/fragment or uses an allow-listed scheme (http, https, mailto, tel).
+ * Callers may pass `extraSchemes` (without trailing colon) to widen the allow-list for their specific use case.
+ */
+declare const isSafeUrl: (url: string | null | undefined, extraSchemes?: readonly string[]) => boolean;
+/**
+ * @hidden
+ * Same as {@link isSafeUrl} but also accepts `data:image/<mime>` URLs (excluding `data:image/svg+xml`)
+ * so that base64-embedded raster images continue to work in image src attributes.
+ */
+declare const isSafeImageUrl: (url: string | null | undefined) => boolean;
+
 /**
  * Enum with key codes.
  */
@@ -819,5 +832,5 @@ declare class ComponentNameDirective {
     static ɵdir: i0.ɵɵDirectiveDeclaration<ComponentNameDirective, "[kendoComponentName]", never, { "name": { "alias": "kendoComponentName"; "required": false; }; }, {}, never, never, true, never>;
 }
 
-export { ScrollbarService as BrowserSupportService, ComponentNameDirective, DraggableDirective, EventsOutsideAngularDirective, KENDO_ADORNMENTS, KENDO_COMMON, KENDO_COMPONENT_NAME, KENDO_DRAGGABLE, KENDO_EVENTS, KENDO_RESIZESENSOR, KENDO_TEMPLATE_CONTEXT, KENDO_TOGGLEBUTTONTABSTOP, KENDO_WATERMARK, KENDO_WEBMCP_HOST, KendoInput, Keys, MultiTabStop, PrefixTemplateDirective, PreventableEvent, ResizeBatchService, ResizeCompatService, ResizeObserverService, ResizeSensorComponent, ScrollbarService, SeparatorComponent, SuffixTemplateDirective, TemplateContextDirective, ToggleButtonTabStopDirective, WatermarkOverlayComponent, anyChanged, applyAttributes, areObjectsEqual, closest, closestBySelector, closestInScope, contains, findElement, findFocusable, findFocusableChild, firefoxMaxHeight, focusableSelector, getLicenseMessage, getter, guid, hasClasses, hasFocusableParent, hasObservers, isChanged, isControlRequired, isDocumentAvailable, isFirefox, isFocusable, isFocusableWithTabKey, isObject, isObjectPresent, isPresent, isSafari, isSet, isString, isVisible, matchesClasses, matchesNodeName, normalizeKeys, parseAttributes, parseCSSClassNames, processCssValue, provideComponentName, removeHTMLAttributes, replaceMessagePlaceholder, rtlScrollLeft, rtlScrollPosition, scrollbarWidth, setHTMLAttributes, setter, shouldShowValidationUI, splitStringToArray };
+export { ScrollbarService as BrowserSupportService, ComponentNameDirective, DraggableDirective, EventsOutsideAngularDirective, KENDO_ADORNMENTS, KENDO_COMMON, KENDO_COMPONENT_NAME, KENDO_DRAGGABLE, KENDO_EVENTS, KENDO_RESIZESENSOR, KENDO_TEMPLATE_CONTEXT, KENDO_TOGGLEBUTTONTABSTOP, KENDO_WATERMARK, KENDO_WEBMCP_HOST, KendoInput, Keys, MultiTabStop, PrefixTemplateDirective, PreventableEvent, ResizeBatchService, ResizeCompatService, ResizeObserverService, ResizeSensorComponent, ScrollbarService, SeparatorComponent, SuffixTemplateDirective, TemplateContextDirective, ToggleButtonTabStopDirective, WatermarkOverlayComponent, anyChanged, applyAttributes, areObjectsEqual, closest, closestBySelector, closestInScope, contains, findElement, findFocusable, findFocusableChild, firefoxMaxHeight, focusableSelector, getLicenseMessage, getter, guid, hasClasses, hasFocusableParent, hasObservers, isChanged, isControlRequired, isDocumentAvailable, isFirefox, isFocusable, isFocusableWithTabKey, isObject, isObjectPresent, isPresent, isSafari, isSafeImageUrl, isSafeUrl, isSet, isString, isVisible, matchesClasses, matchesNodeName, normalizeKeys, parseAttributes, parseCSSClassNames, processCssValue, provideComponentName, removeHTMLAttributes, replaceMessagePlaceholder, rtlScrollLeft, rtlScrollPosition, scrollbarWidth, setHTMLAttributes, setter, shouldShowValidationUI, splitStringToArray };
 export type { SeparatorOrientation };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@progress/kendo-angular-common",
-  "version": "25.3.0-develop.1",
+  "version": "25.3.0-develop.2",
   "description": "Kendo UI for Angular - Utility Package",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "Progress",
@@ -23,7 +23,7 @@
     "@progress/kendo-common": "^1.0.1",
     "@progress/kendo-draggable": "^3.0.2",
     "tslib": "^2.3.1",
-    "@progress/kendo-angular-schematics": "25.3.0-develop.1"
+    "@progress/kendo-angular-schematics": "25.3.0-develop.2"
   },
   "publishConfig": {
     "access": "public"