@progress/kendo-angular-spreadsheet 25.3.0-develop.1 → 25.3.0-develop.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -3,7 +3,7 @@
3
3
  * Licensed under commercial license. See LICENSE.md in the project root for more information
4
4
  *-------------------------------------------------------------------------------------------*/
5
5
  import * as i0 from '@angular/core';
6
- import { Injectable, EventEmitter, Output, Inject, Optional, Input, Component, HostBinding, Directive, ElementRef, ViewChildren, ViewChild, HostListener, InjectionToken, forwardRef, ContentChild, ViewContainerRef, NgModule } from '@angular/core';
6
+ import { Injectable, EventEmitter, Output, Inject, Optional, Input, Component, HostBinding, Directive, ElementRef, ViewChildren, ViewChild, HostListener, InjectionToken, isDevMode, forwardRef, ContentChild, ViewContainerRef, NgModule } from '@angular/core';
7
7
  import { Subject, Subscription } from 'rxjs';
8
8
  import { take, map } from 'rxjs/operators';
9
9
  import { validatePackage } from '@progress/kendo-licensing';
@@ -17,7 +17,7 @@ import { LocalizationService, L10N_PREFIX, RTL, ComponentMessages } from '@progr
17
17
  import * as i1$1 from '@progress/kendo-angular-popup';
18
18
  import { PopupService } from '@progress/kendo-angular-popup';
19
19
  import { MenuComponent, MenuItemComponent, ContextMenuComponent } from '@progress/kendo-angular-menu';
20
- import { PreventableEvent, EventsOutsideAngularDirective, replaceMessagePlaceholder, isDocumentAvailable, isPresent, normalizeKeys, Keys, hasObservers, guid, getLicenseMessage, shouldShowValidationUI, WatermarkOverlayComponent, KENDO_WEBMCP_HOST, provideComponentName, ResizeBatchService } from '@progress/kendo-angular-common';
20
+ import { PreventableEvent, isSafeUrl, EventsOutsideAngularDirective, replaceMessagePlaceholder, isDocumentAvailable, isPresent, normalizeKeys, Keys, hasObservers, guid, getLicenseMessage, shouldShowValidationUI, WatermarkOverlayComponent, KENDO_WEBMCP_HOST, provideComponentName, ResizeBatchService } from '@progress/kendo-angular-common';
21
21
  import * as i1$2 from '@progress/kendo-angular-dialog';
22
22
  import { DialogContentBase, DialogActionsComponent, DialogContainerService, DialogService, WindowService, WindowContainerService } from '@progress/kendo-angular-dialog';
23
23
  import { IconWrapperComponent, IconsService } from '@progress/kendo-angular-icons';
@@ -48,8 +48,8 @@ const packageMetadata = {
48
48
  productName: 'Kendo UI for Angular',
49
49
  productCode: 'KENDOUIANGULAR',
50
50
  productCodes: ['KENDOUIANGULAR'],
51
- publishDate: 1790689423,
52
- version: '25.3.0-develop.1',
51
+ publishDate: 1790761578,
52
+ version: '25.3.0-develop.2',
53
53
  licensingDocsUrl: 'https://www.telerik.com/kendo-angular-ui/my-license/?utm_medium=product&utm_source=kendoangular&utm_campaign=kendo-ui-angular-purchase-license-keys-warning',
54
54
  };
55
55
 
@@ -230,6 +230,17 @@ class SpreadsheetContextMenuEvent extends PreventableEvent {
230
230
  }
231
231
  }
232
232
 
233
+ /**
234
+ * @hidden
235
+ * Sanitizes hyperlinks imported from `.xlsx` workbooks before the
236
+ * spreadsheet engine renders them as anchor tags.
237
+ */
238
+ const sanitizeHyperlinks = (hyperlinks) => {
239
+ if (!hyperlinks || !Array.isArray(hyperlinks)) {
240
+ return hyperlinks;
241
+ }
242
+ return hyperlinks.filter(entry => isSafeUrl(entry?.target));
243
+ };
233
244
  /**
234
245
  * @hidden
235
246
  */
@@ -242,7 +253,7 @@ const mapToSheetDescriptor = (sheetsArray) => {
242
253
  drawings: sheet._drawings,
243
254
  frozenColumns: sheet.frozenColumns,
244
255
  frozenRows: sheet.frozenRows,
245
- hyperlinks: sheet._hyperlinks,
256
+ hyperlinks: sanitizeHyperlinks(sheet._hyperlinks),
246
257
  mergedCells: sheet.mergedCells,
247
258
  name: sheet.name(),
248
259
  rows: sheet._rows,
@@ -2082,6 +2093,12 @@ class SpreadsheetInsertLinkDirective extends SpreadsheetCommandButton {
2082
2093
  let link = null;
2083
2094
  if (event.text === this.localization.get('dialogInsert')) {
2084
2095
  link = dialogContent.urlLink || null;
2096
+ if (link !== null && !isSafeUrl(link)) {
2097
+ if (isDevMode()) {
2098
+ console.warn('kendo-spreadsheet: the entered hyperlink uses an unsupported URL scheme and was rejected. Allowed schemes: http, https, mailto, tel.');
2099
+ }
2100
+ link = null;
2101
+ }
2085
2102
  }
2086
2103
  this.spreadsheetService.spreadsheet.executeCommand({
2087
2104
  command: 'HyperlinkCommand',
@@ -6667,6 +6684,12 @@ class SpreadsheetComponent {
6667
6684
  let link = null;
6668
6685
  if (event.text === this.localization.get('dialogInsert')) {
6669
6686
  link = dialogContent.urlLink || null;
6687
+ if (link !== null && !isSafeUrl(link)) {
6688
+ if (isDevMode()) {
6689
+ console.warn('kendo-spreadsheet: the entered hyperlink uses an unsupported URL scheme and was rejected. Allowed schemes: http, https, mailto, tel.');
6690
+ }
6691
+ link = null;
6692
+ }
6670
6693
  }
6671
6694
  this.spreadsheetService.spreadsheet.executeCommand({
6672
6695
  command: 'HyperlinkCommand',
@@ -7,7 +7,7 @@ export const packageMetadata = {
7
7
  "productCodes": [
8
8
  "KENDOUIANGULAR"
9
9
  ],
10
- "publishDate": 1790689423,
11
- "version": "25.3.0-develop.1",
10
+ "publishDate": 1790761578,
11
+ "version": "25.3.0-develop.2",
12
12
  "licensingDocsUrl": "https://www.telerik.com/kendo-angular-ui/my-license/?utm_medium=product&utm_source=kendoangular&utm_campaign=kendo-ui-angular-purchase-license-keys-warning"
13
13
  };
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@progress/kendo-angular-spreadsheet",
3
- "version": "25.3.0-develop.1",
3
+ "version": "25.3.0-develop.2",
4
4
  "description": "A Spreadsheet Component for Angular",
5
5
  "license": "SEE LICENSE IN LICENSE.md",
6
6
  "author": "Progress",
@@ -47,7 +47,7 @@
47
47
  "package": {
48
48
  "productName": "Kendo UI for Angular",
49
49
  "productCode": "KENDOUIANGULAR",
50
- "publishDate": 1790689423,
50
+ "publishDate": 1790761578,
51
51
  "licensingDocsUrl": "https://www.telerik.com/kendo-angular-ui/my-license/?utm_medium=product&utm_source=kendoangular&utm_campaign=kendo-ui-angular-purchase-license-keys-warning"
52
52
  }
53
53
  },
@@ -57,26 +57,26 @@
57
57
  "@angular/core": "20 - 22",
58
58
  "@angular/platform-browser": "20 - 22",
59
59
  "@progress/kendo-licensing": "^1.11.0",
60
- "@progress/kendo-angular-buttons": "25.3.0-develop.1",
61
- "@progress/kendo-angular-common": "25.3.0-develop.1",
62
- "@progress/kendo-angular-dialog": "25.3.0-develop.1",
63
- "@progress/kendo-angular-dropdowns": "25.3.0-develop.1",
64
- "@progress/kendo-angular-icons": "25.3.0-develop.1",
65
- "@progress/kendo-angular-inputs": "25.3.0-develop.1",
66
- "@progress/kendo-angular-treeview": "25.3.0-develop.1",
67
- "@progress/kendo-angular-dateinputs": "25.3.0-develop.1",
68
- "@progress/kendo-angular-intl": "25.3.0-develop.1",
69
- "@progress/kendo-angular-l10n": "25.3.0-develop.1",
70
- "@progress/kendo-angular-label": "25.3.0-develop.1",
71
- "@progress/kendo-angular-layout": "25.3.0-develop.1",
72
- "@progress/kendo-angular-menu": "25.3.0-develop.1",
73
- "@progress/kendo-angular-popup": "25.3.0-develop.1",
74
- "@progress/kendo-angular-toolbar": "25.3.0-develop.1",
60
+ "@progress/kendo-angular-buttons": "25.3.0-develop.2",
61
+ "@progress/kendo-angular-common": "25.3.0-develop.2",
62
+ "@progress/kendo-angular-dialog": "25.3.0-develop.2",
63
+ "@progress/kendo-angular-dropdowns": "25.3.0-develop.2",
64
+ "@progress/kendo-angular-icons": "25.3.0-develop.2",
65
+ "@progress/kendo-angular-inputs": "25.3.0-develop.2",
66
+ "@progress/kendo-angular-treeview": "25.3.0-develop.2",
67
+ "@progress/kendo-angular-dateinputs": "25.3.0-develop.2",
68
+ "@progress/kendo-angular-intl": "25.3.0-develop.2",
69
+ "@progress/kendo-angular-l10n": "25.3.0-develop.2",
70
+ "@progress/kendo-angular-label": "25.3.0-develop.2",
71
+ "@progress/kendo-angular-layout": "25.3.0-develop.2",
72
+ "@progress/kendo-angular-menu": "25.3.0-develop.2",
73
+ "@progress/kendo-angular-popup": "25.3.0-develop.2",
74
+ "@progress/kendo-angular-toolbar": "25.3.0-develop.2",
75
75
  "rxjs": "^6.5.3 || ^7.0.0"
76
76
  },
77
77
  "dependencies": {
78
78
  "tslib": "^2.3.1",
79
- "@progress/kendo-angular-schematics": "25.3.0-develop.1",
79
+ "@progress/kendo-angular-schematics": "25.3.0-develop.2",
80
80
  "@progress/jszip-esm": "^1.0.3",
81
81
  "@progress/kendo-common": "^1.0.1",
82
82
  "@progress/kendo-date-math": "^1.5.10",
@@ -11,8 +11,8 @@ function default_1(options) {
11
11
  // Peer dependency of icons
12
12
  '@progress/kendo-svg-icons': '^4.0.0',
13
13
  // peer deps of the dropdowns
14
- '@progress/kendo-angular-navigation': '25.3.0-develop.1',
15
- '@progress/kendo-angular-treeview': '25.3.0-develop.1'
14
+ '@progress/kendo-angular-navigation': '25.3.0-develop.2',
15
+ '@progress/kendo-angular-treeview': '25.3.0-develop.2'
16
16
  } });
17
17
  return (0, schematics_1.externalSchematic)('@progress/kendo-angular-schematics', 'ng-add', finalOptions);
18
18
  }