@salesforcedevs/docs-components 1.14.4 → 1.14.5

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@salesforcedevs/docs-components",
-    "version": "1.14.4",
+    "version": "1.14.5",
     "description": "Docs Lightning web components for DSC",
     "license": "MIT",
     "main": "index.js",
@@ -13,6 +13,7 @@
     "dependencies": {
         "@api-components/amf-helper-mixin": "4.5.29",
         "classnames": "2.5.1",
+        "dompurify": "3.2.4",
         "kagekiri": "1.4.2",
         "lodash.orderby": "4.6.0",
         "lodash.uniqby": "4.7.0",
@@ -24,5 +25,5 @@
         "@types/lodash.orderby": "4.6.9",
         "@types/lodash.uniqby": "4.7.9"
     },
-    "gitHead": "012da86cd801d81111ea8a5822f075677e615d8f"
+    "gitHead": "748ad013c195450fab83df8580f744fe4dd23857"
 }

package/src/modules/doc/xmlContent/xmlContent.ts

@@ -18,6 +18,7 @@ import { LightningElementWithState } from "dxBaseElements/lightningElementWithSt
 import { logCoveoPageView, oldVersionDocInfo } from "docUtils/utils";
 import { Breadcrumb, DocPhaseInfo, Language } from "typings/custom";
 import { track as trackGTM } from "dxUtils/analytics";
+import DOMPurify from "dompurify";
 
 // TODO: Imitating from actual implementation as doc-content use it like this. We should refactor it later.
 const handleContentError = (error: any): void => console.log(error);
@@ -425,9 +426,19 @@ export default class DocXmlContent extends LightningElementWithState<{
             .catch(handleContentError);
     }
 
+    private sanitizeUrlPart(part: string | undefined): string | undefined {
+        if (!part) {
+            return part;
+        }
+        return DOMPurify.sanitize(part);
+    }
+
     getReferenceFromUrl(): PageReference {
         const [page, docId, deliverable, contentDocumentId] =
-            window.location.pathname.substr(1).split("/");
+            window.location.pathname
+                .substr(1)
+                .split("/")
+                .map(this.sanitizeUrlPart);
 
         const { origin: domain, hash, search } = window.location;
 
@@ -436,9 +447,9 @@ export default class DocXmlContent extends LightningElementWithState<{
             deliverable,
             docId,
             domain,
-            hash,
+            hash: this.sanitizeUrlPart(hash),
             page,
-            search
+            search: this.sanitizeUrlPart(search)
         };
     }
 
@@ -701,7 +712,7 @@ export default class DocXmlContent extends LightningElementWithState<{
 
     addMetatags(): void {
         const div = document.createElement("div");
-        div.innerHTML = this.docContent;
+        div.innerHTML = DOMPurify.sanitize(this.docContent);
         const docDescription = div.querySelector(".shortdesc")?.textContent;
         const topicTitle = div.querySelector("h1")?.textContent;