@salesforcedevs/docs-components 1.32.0 → 1.33.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@salesforcedevs/docs-components",
-    "version": "1.32.0",
+    "version": "1.33.0",
     "description": "Docs Lightning web components for DSC",
     "license": "MIT",
     "main": "index.js",
@@ -25,5 +25,5 @@
         "@types/lodash.orderby": "4.6.9",
         "@types/lodash.uniqby": "4.7.9"
     },
-    "gitHead": "c45be158e09722da65cded05e0877f02b9d8a37a"
+    "gitHead": "e85fc1bb496e99a4ba453db278a465079bcf6385"
 }

package/src/modules/docUtils/searchClient/searchClient.ts

@@ -2,6 +2,9 @@
 // The ONLY place a /api/search URL is built, and the ONLY place the HTTP
 // contract lives. No LWC / arch / dx imports — browser DOM APIs only.
 
+/** Where a result's `snippet` came from (mirrors the backend contract). */
+export type SnippetSource = "headline" | "description" | "none";
+
 export interface SearchResult {
     url: string;
     title: string;
@@ -14,6 +17,12 @@ export interface SearchResult {
     lexScore: number;
     semScore: number;
     matchType: string;
+    // Contextual highlighted passage (P4.5). Always XSS-safe HTML from the
+    // backend, but only display-correct as HTML when snippetSource is
+    // "headline" (see highlightedSnippetHtml). Optional so pre-P4.5 backends
+    // and existing fixtures still satisfy the type.
+    snippet?: string | null;
+    snippetSource?: SnippetSource;
 }
 
 export interface FacetBucket {
@@ -158,3 +167,54 @@ export function decodeHtmlEntities(value: unknown): string {
     const doc = new DOMParser().parseFromString(value, "text/html");
     return doc.documentElement.textContent ?? "";
 }
+
+/**
+ * Defense-in-depth sanitizer for a backend `snippet` (P4.5). The backend
+ * already emits XSS-safe HTML whose ONLY tags are the `<b>`/`</b>` it wrapped
+ * around matched terms (escape-then-mark via PUA sentinels), so this is a
+ * belt-and-braces second gate on the client: strip every tag except `<b>` and
+ * `</b>`. A malformed backend, a proxy that rewrites bodies, or a future
+ * contract drift can't inject anything else. Text between the bold tags is
+ * left byte-for-byte (it is already entity-escaped by the backend, so literal
+ * `<`/`>`/`&` in prose arrive as `&lt;`/`&gt;`/`&amp;` and stay inert).
+ */
+export function sanitizeSnippetHtml(value: unknown): string {
+    // Strip every tag except a BARE <b> or </b> (case-insensitive). The backend
+    // only ever emits attribute-less bold tags, so requiring the `>` right after
+    // `b` also drops an attribute-bearing `<b onmouseover=…>` — the tightest
+    // possible allowlist. Text between tags is left as-is (already escaped).
+    //
+    // The trailing `(?:>|$)` also consumes an UNTERMINATED tag that runs to the
+    // end of the string (e.g. `…<img src=x onerror=alert(1)` with no closing
+    // `>`). A plain `…>` alternative would leave that fragment as literal text;
+    // today's sole sink (innerHTML at end-of-fragment) happens to drop such a
+    // tag, but this helper is exported and must honor its own contract without
+    // leaning on the parser's incidental EOF behavior.
+    return String(value ?? "").replace(/<(?!\/?b>)[^>]*(?:>|$)/gi, "");
+}
+
+/**
+ * The HTML to render for a result's highlighted snippet, or `null` when the
+ * caller should fall back to the plain-text description path.
+ *
+ * Only `snippetSource === "headline"` yields HTML: that branch is
+ * `markHtml(headline)` over `chunk_text`, which the backend already DECODED
+ * (entities resolved, markup stripped) and then escaped, so it renders
+ * display-correct as HTML. The `"description"` branch, by contrast, is
+ * `escapeHtml(rawDescription)` where the raw description is still
+ * entity-ENCODED frontmatter (verified on the live corpus: descriptions carry
+ * `&#x22;` etc.) — rendering that as HTML would double-escape and show literal
+ * entities, a regression vs. the existing `decodeHtmlEntities(description)`
+ * text path. So for anything but a headline we return `null` and let the
+ * caller keep today's text rendering.
+ */
+export function highlightedSnippetHtml(result: SearchResult): string | null {
+    if (result.snippetSource !== "headline") {
+        return null;
+    }
+    const snippet = result.snippet;
+    if (typeof snippet !== "string" || snippet === "") {
+        return null;
+    }
+    return sanitizeSnippetHtml(snippet);
+}