@salesforce/internal-lightning-out-containers 2.2.6 → 2.2.7-rc.0

package/dist/modules/force/lightningOutBaseContainer/utils/__tests__/env.test.js

@@ -5,8 +5,19 @@
  */
 
 import { assertBareSpecifier } from "../env";
+import { isComponentNameCheckDisabled } from "../gater";
+
+jest.mock("../gater", () => ({
+    isComponentNameCheckDisabled: jest.fn(() => false),
+}));
+
+const mockIsDisabled = isComponentNameCheckDisabled;
 
 describe("assertBareSpecifier", () => {
+    beforeEach(() => {
+        mockIsDisabled.mockReturnValue(false);
+    });
+
     describe("accepts bare identifiers", () => {
         it.each([
             "c/foo",
@@ -51,4 +62,17 @@ describe("assertBareSpecifier", () => {
     it("returns null for null input (missing URL param)", () => {
         expect(assertBareSpecifier(null)).toBeNull();
     });
+
+    describe("kill-switch gate", () => {
+        it("bypasses validation and returns value unchanged when gate is open", () => {
+            mockIsDisabled.mockReturnValue(true);
+            const unsafe = "https://evil.com/payload.js";
+            expect(assertBareSpecifier(unsafe)).toBe(unsafe);
+        });
+
+        it("still returns null for null input when gate is open", () => {
+            mockIsDisabled.mockReturnValue(true);
+            expect(assertBareSpecifier(null)).toBeNull();
+        });
+    });
 });

package/dist/modules/force/lightningOutBaseContainer/utils/env.js

@@ -4,6 +4,8 @@
  * Company Confidential
  */
 
+import { isComponentNameCheckDisabled } from "./gater";
+
 // Bare LWC (namespace/name) or Aura (namespace:name) identifier, with optional /v/<version> suffix.
 // Rejects URL-shaped strings — a specifier reaching `import()` must be resolved as a module,
 // not a URL. LWR's AMD loader treats URL-shaped specifiers as fetchable script sources, which
@@ -13,6 +15,7 @@ const BARE_SPECIFIER = /^[a-zA-Z][a-zA-Z0-9_-]*[/:][a-zA-Z][a-zA-Z0-9_-]*(\/v\/[
 
 export function assertBareSpecifier(value) {
     if (value === null) return null;
+    if (isComponentNameCheckDisabled()) return value;
     if (!BARE_SPECIFIER.test(value)) {
         throw new Error(`Invalid componentName: ${value}`);
     }

package/dist/modules/force/lightningOutBaseContainer/utils/gater.js

@@ -0,0 +1,26 @@
+/*
+ * Copyright 2026 salesforce.com, inc.
+ * All Rights Reserved
+ * Company Confidential
+ */
+
+import disableComponentNameCheckGate from "@salesforce/gate/org.salesforce.lo2.lwr.disableComponentNameCheck";
+
+/**
+ * Kill-switch for componentName bare-specifier validation (W-23730644).
+ * SECURITY: opening re-enables arbitrary-script-load via URL-shaped componentName;
+ * bounded only by CSP. See env.ts BARE_SPECIFIER for the regex + threat model.
+ */
+let warned = false;
+
+export function isComponentNameCheckDisabled() {
+    const disabled = disableComponentNameCheckGate.isOpen({ fallback: false });
+    if (disabled && !warned) {
+        warned = true;
+        console.warn(
+            "[LO2] componentName validation bypassed via kill-switch gate " +
+                "(org.salesforce.lo2.lwr.disableComponentNameCheck). Security fix W-23730644 inactive.",
+        );
+    }
+    return disabled;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@salesforce/internal-lightning-out-containers",
-    "version": "2.2.6",
+    "version": "2.2.7-rc.0",
     "private": false,
     "description": "Lightning Out 2.0 Container Components",
     "license": "SEE LICENSE IN LICENSE.txt",