@rive-app/canvas-single 2.4.2 → 2.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rive-app/canvas-single",
-  "version": "2.4.2",
+  "version": "2.4.3",
   "description": "Rive's high-level canvas based web api all in one js file.",
   "main": "rive.js",
   "homepage": "https://rive.app",

package/rive.js

@@ -131,7 +131,7 @@ if(m.preInit)for("function"==typeof m.preInit&&(m.preInit=[m.preInit]);0<m.preIn
 /* 2 */
 /***/ ((module) => {
 
-module.exports = JSON.parse('{"name":"@rive-app/canvas-single","version":"2.4.2","description":"Rive\'s high-level canvas based web api all in one js file.","main":"rive.js","homepage":"https://rive.app","repository":{"type":"git","url":"https://github.com/rive-app/rive-wasm/tree/master/js"},"keywords":["rive","animation"],"author":"Rive","contributors":["Luigi Rosso <luigi@rive.app> (https://rive.app)","Maxwell Talbot <max@rive.app> (https://rive.app)","Arthur Vivian <arthur@rive.app> (https://rive.app)","Umberto Sonnino <umberto@rive.app> (https://rive.app)","Matthew Sullivan <matt.j.sullivan@gmail.com> (mailto:matt.j.sullivan@gmail.com)"],"license":"MIT","files":["rive.js","rive.js.map","rive.d.ts","rive_advanced.mjs.d.ts"],"typings":"rive.d.ts","dependencies":{},"browser":{"fs":false,"path":false}}');
+module.exports = JSON.parse('{"name":"@rive-app/canvas-single","version":"2.4.3","description":"Rive\'s high-level canvas based web api all in one js file.","main":"rive.js","homepage":"https://rive.app","repository":{"type":"git","url":"https://github.com/rive-app/rive-wasm/tree/master/js"},"keywords":["rive","animation"],"author":"Rive","contributors":["Luigi Rosso <luigi@rive.app> (https://rive.app)","Maxwell Talbot <max@rive.app> (https://rive.app)","Arthur Vivian <arthur@rive.app> (https://rive.app)","Umberto Sonnino <umberto@rive.app> (https://rive.app)","Matthew Sullivan <matt.j.sullivan@gmail.com> (mailto:matt.j.sullivan@gmail.com)"],"license":"MIT","files":["rive.js","rive.js.map","rive.d.ts","rive_advanced.mjs.d.ts"],"typings":"rive.d.ts","dependencies":{},"browser":{"fs":false,"path":false}}');
 
 /***/ }),
 /* 3 */
@@ -139,9 +139,13 @@ module.exports = JSON.parse('{"name":"@rive-app/canvas-single","version":"2.4.2"
 
 __webpack_require__.r(__webpack_exports__);
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   registerTouchInteractions: () => (/* reexport safe */ _registerTouchInteractions__WEBPACK_IMPORTED_MODULE_0__.registerTouchInteractions)
+/* harmony export */   BLANK_URL: () => (/* reexport safe */ _sanitizeUrl__WEBPACK_IMPORTED_MODULE_1__.BLANK_URL),
+/* harmony export */   registerTouchInteractions: () => (/* reexport safe */ _registerTouchInteractions__WEBPACK_IMPORTED_MODULE_0__.registerTouchInteractions),
+/* harmony export */   sanitizeUrl: () => (/* reexport safe */ _sanitizeUrl__WEBPACK_IMPORTED_MODULE_1__.sanitizeUrl)
 /* harmony export */ });
 /* harmony import */ var _registerTouchInteractions__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(4);
+/* harmony import */ var _sanitizeUrl__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(5);
+
 
 
 
@@ -278,6 +282,59 @@ var registerTouchInteractions = function (_a) {
 };
 
 
+/***/ }),
+/* 5 */
+/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
+
+__webpack_require__.r(__webpack_exports__);
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   BLANK_URL: () => (/* binding */ BLANK_URL),
+/* harmony export */   sanitizeUrl: () => (/* binding */ sanitizeUrl)
+/* harmony export */ });
+// Reference: https://github.com/braintree/sanitize-url/tree/main
+var invalidProtocolRegex = /^([^\w]*)(javascript|data|vbscript)/im;
+var htmlEntitiesRegex = /&#(\w+)(^\w|;)?/g;
+var htmlCtrlEntityRegex = /&(newline|tab);/gi;
+var ctrlCharactersRegex = /[\u0000-\u001F\u007F-\u009F\u2000-\u200D\uFEFF]/gim;
+var urlSchemeRegex = /^.+(:|&colon;)/gim;
+var relativeFirstCharacters = [".", "/"];
+var BLANK_URL = "about:blank";
+function isRelativeUrlWithoutProtocol(url) {
+    return relativeFirstCharacters.indexOf(url[0]) > -1;
+}
+// adapted from https://stackoverflow.com/a/29824550/2601552
+function decodeHtmlCharacters(str) {
+    var removedNullByte = str.replace(ctrlCharactersRegex, "");
+    return removedNullByte.replace(htmlEntitiesRegex, function (match, dec) {
+        return String.fromCharCode(dec);
+    });
+}
+function sanitizeUrl(url) {
+    if (!url) {
+        return BLANK_URL;
+    }
+    var sanitizedUrl = decodeHtmlCharacters(url)
+        .replace(htmlCtrlEntityRegex, "")
+        .replace(ctrlCharactersRegex, "")
+        .trim();
+    if (!sanitizedUrl) {
+        return BLANK_URL;
+    }
+    if (isRelativeUrlWithoutProtocol(sanitizedUrl)) {
+        return sanitizedUrl;
+    }
+    var urlSchemeParseResults = sanitizedUrl.match(urlSchemeRegex);
+    if (!urlSchemeParseResults) {
+        return sanitizedUrl;
+    }
+    var urlScheme = urlSchemeParseResults[0];
+    if (invalidProtocolRegex.test(urlScheme)) {
+        return BLANK_URL;
+    }
+    return sanitizedUrl;
+}
+
+
 /***/ })
 /******/ 	]);
 /************************************************************************/
@@ -1521,9 +1578,10 @@ var Rive = /** @class */ (function () {
                             if (this.automaticallyHandleEvents) {
                                 var newAnchorTag = document.createElement("a");
                                 var _b = event_1, url = _b.url, target = _b.target;
-                                url && newAnchorTag.setAttribute("href", url);
+                                var sanitizedUrl = (0,_utils__WEBPACK_IMPORTED_MODULE_2__.sanitizeUrl)(url);
+                                url && newAnchorTag.setAttribute("href", sanitizedUrl);
                                 target && newAnchorTag.setAttribute("target", target);
-                                if (url) {
+                                if (sanitizedUrl && sanitizedUrl !== _utils__WEBPACK_IMPORTED_MODULE_2__.BLANK_URL) {
                                     newAnchorTag.click();
                                 }
                             }