@salesforcedevs/docs-components 1.34.1-doc-phase-redoc-2 → 1.34.1-doc-phase-redoc-3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforcedevs/docs-components",
-  "version": "1.34.1-doc-phase-redoc-2",
+  "version": "1.34.1-doc-phase-redoc-3",
   "description": "Docs Lightning web components for DSC",
   "license": "MIT",
   "main": "index.js",

package/src/modules/doc/redocReference/redocReference.ts

@@ -768,15 +768,21 @@ export default class RedocReference extends LightningElement {
     // Inserts the doc phase and, on a non-latest version, a dismissible
     // "newer version" banner into a shared doc-phase-wrapper at container start
     private insertStatusItems(container: HTMLElement): void {
-        const items: HTMLElement[] = [];
-
         const docPhaseInfo = this.getDocPhaseInfo();
+        if (!docPhaseInfo && !this.oldVersionInfo) {
+            return;
+        }
+
+        const wrapper = document.createElement("div");
+        wrapper.className = "doc-phase-wrapper";
+        container.insertBefore(wrapper, container.firstChild);
+
         if (docPhaseInfo) {
             const docPhaseElement = createElement("doc-phase", {
                 is: DocPhase
             });
             Object.assign(docPhaseElement, { docPhaseInfo });
-            items.push(docPhaseElement);
+            wrapper.appendChild(docPhaseElement);
         }
 
         if (this.oldVersionInfo) {
@@ -790,17 +796,8 @@ export default class RedocReference extends LightningElement {
                 versionBanner.remove();
                 this.updateSidebarPosition();
             });
-            items.push(versionBanner);
+            wrapper.appendChild(versionBanner);
         }
-
-        if (!items.length) {
-            return;
-        }
-
-        const wrapper = document.createElement("div");
-        wrapper.className = "doc-phase-wrapper";
-        items.forEach((item) => wrapper.appendChild(item));
-        container.insertBefore(wrapper, container.firstChild);
     }
 
     // Appends footer component to container

package/src/modules/docUtils/utils/utils.ts

@@ -1,8 +1,24 @@
 import { CoveoAnalyticsClient } from "coveo.analytics/dist/browser.mjs"; // This fix is required for Node 20 upgrade, so that Coveo analytics is loaded properly by LWR.
 
+// Resolve against the current origin (version links are usually relative) and
+// keep only http/https. Blocks executable schemes like javascript:/data: that
+// would run when the innerHTML-rendered link is clicked
+// encodeURI then keeps the value from breaking out of the href attribute.
+const toSafeHref = (link: string): string => {
+    try {
+        const { protocol } = new URL(link, window.location.origin);
+        if (protocol === "http:" || protocol === "https:") {
+            return encodeURI(link);
+        }
+    } catch {
+        // Fall through to the rejection below.
+    }
+    console.warn(`Blocked unsafe version link: ${link}`);
+    return "#";
+};
+
 export const oldVersionDocInfo = (latestVersionLink: string) => {
-    // encodeURI so the link can't break out of the href attribute (innerHTML sink)
-    const safeLink = encodeURI(latestVersionLink);
+    const safeLink = toSafeHref(latestVersionLink);
     return {
         title: "Newer Version Available",
         body: `This content describes an older version of this product.