@revenuecat/purchases-ui-js 4.12.0 → 4.12.1

package/dist/components/purchase-button/custom-web-checkout-url.d.ts

@@ -12,6 +12,7 @@ type CustomWebCheckoutContext = {
  * Mirrors the native SDKs: source, then app user ID, env and package when
  * configured. The source is the host's own, so it survives a same-tab hop.
  * Same-named params are replaced; an unparseable URL is returned unchanged.
+ * Script-capable URLs resolve to undefined, so the button purchases instead.
  */
-export declare const buildCustomWebCheckoutURL: (url: string, config: CustomURLConfig, { packageId, appUserId, isSandbox, rcSource }: CustomWebCheckoutContext) => string;
+export declare const buildCustomWebCheckoutURL: (url: string, config: CustomURLConfig, { packageId, appUserId, isSandbox, rcSource }: CustomWebCheckoutContext) => string | undefined;
 export {};

package/dist/components/purchase-button/custom-web-checkout-url.js

@@ -1,7 +1,9 @@
+const SCRIPT_PROTOCOLS = new Set(["javascript:", "data:", "vbscript:"]);
 /**
  * Mirrors the native SDKs: source, then app user ID, env and package when
  * configured. The source is the host's own, so it survives a same-tab hop.
  * Same-named params are replaced; an unparseable URL is returned unchanged.
+ * Script-capable URLs resolve to undefined, so the button purchases instead.
  */
 export const buildCustomWebCheckoutURL = (url, config, { packageId, appUserId, isSandbox, rcSource }) => {
     let parsed;
@@ -11,6 +13,9 @@ export const buildCustomWebCheckoutURL = (url, config, { packageId, appUserId, i
     catch {
         return url;
     }
+    if (SCRIPT_PROTOCOLS.has(parsed.protocol)) {
+        return undefined;
+    }
     const { searchParams } = parsed;
     if (rcSource !== undefined) {
         searchParams.set("rc_source", rcSource);

package/package.json

@@ -2,7 +2,7 @@
   "name": "@revenuecat/purchases-ui-js",
   "description": "Web components for Paywalls. Powered by RevenueCat",
   "private": false,
-  "version": "4.12.0",
+  "version": "4.12.1",
   "author": {
     "name": "RevenueCat, Inc."
   },