@schukai/monster 4.25.4 → 4.26.0

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 
 
+## [4.26.0] - 2025-07-03
+
+### Add Features
+
+- Improve random UUID generation check [#330](https://gitlab.schukai.com/oss/libraries/javascript/monster/issues/330)
+### Bug Fixes
+
+- Add HTML escaping for message headers to prevent XSS
+
+
+
+## [4.25.5] - 2025-07-03
+
+### Bug Fixes
+
+- anlage von wizard-navigation [#329](https://gitlab.schukai.com/oss/libraries/javascript/monster/issues/329)
+### Changes
+
+- update styles
+
+
+
 ## [4.25.4] - 2025-07-03
 
 ### Bug Fixes

package/package.json

@@ -1 +1 @@
-{"author":"schukai GmbH","dependencies":{"@floating-ui/dom":"^1.7.1","@popperjs/core":"^2.11.8"},"description":"Monster is a simple library for creating fast, robust and lightweight websites.","homepage":"https://monsterjs.org/","keywords":["framework","web","dom","css","sass","mobile-first","app","front-end","templates","schukai","core","shopcloud","alvine","monster","buildmap","stack","observer","observable","uuid","node","nodelist","css-in-js","logger","log","theme"],"license":"AGPL 3.0","main":"source/monster.mjs","module":"source/monster.mjs","name":"@schukai/monster","repository":{"type":"git","url":"https://gitlab.schukai.com/oss/libraries/javascript/monster.git"},"type":"module","version":"4.25.4"}
+{"author":"schukai GmbH","dependencies":{"@floating-ui/dom":"^1.7.2","@popperjs/core":"^2.11.8"},"description":"Monster is a simple library for creating fast, robust and lightweight websites.","homepage":"https://monsterjs.org/","keywords":["framework","web","dom","css","sass","mobile-first","app","front-end","templates","schukai","core","shopcloud","alvine","monster","buildmap","stack","observer","observable","uuid","node","nodelist","css-in-js","logger","log","theme"],"license":"AGPL 3.0","main":"source/monster.mjs","module":"source/monster.mjs","name":"@schukai/monster","repository":{"type":"git","url":"https://gitlab.schukai.com/oss/libraries/javascript/monster.git"},"type":"module","version":"4.26.0"}

package/source/components/content/viewer/message.mjs

@@ -193,6 +193,15 @@ class MessageContent extends CustomElement {
 		this.setOption("message.subject", message?.subject || null);
 		this.setOption("message.messageID", message?.messageID || null);
 
+		function escapeHTML(str) {
+			return str
+				.replace(/&/g, "&")
+				.replace(/</g, "&lt;")
+				.replace(/>/g, "&gt;")
+				.replace(/"/g, "&quot;")
+				.replace(/'/g, "&#39;");
+		}
+
 		const headers = [];
 		for (const [key, value] of Object.entries(message?.headers || {})) {
 			if (key && value) {
@@ -200,7 +209,8 @@ class MessageContent extends CustomElement {
 				if (isArray(valueString)) {
 					valueString = "<ul>";
 					for (const item of value) {
-						valueString += `<li>${item}</li>`;
+						const escapedItem = escapeHTML(item);
+						valueString += `<li>${escapedItem}</li>`;
 					}
 					valueString += "</ul>";
 				}
@@ -286,7 +296,6 @@ class MessageContent extends CustomElement {
 		}
 
 		for (const cid in embeddedImages) {
-
 			const imagePart = embeddedImages[cid];
 			if (imagePart.content && imagePart.contentType) {
 				try {
@@ -319,10 +328,11 @@ class MessageContent extends CustomElement {
 					const objectUrl = URL.createObjectURL(blob);
 					this[embeddedImageUrlsSymbol].push(objectUrl); // Speichern zur späteren Widerrufung
 
-     				const imgRegex = /(<img\b(?:(?!src\s*=)[^>])*?)(?:\s+src\s*=\s*(["'])(?:\s*cid:[^'"]*|\s*)\2)?([^>]*>)/gi;
+					const imgRegex =
+						/(<img\b(?:(?!src\s*=)[^>])*?)(?:\s+src\s*=\s*(["'])(?:\s*cid:[^'"]*|\s*)\2)?([^>]*>)/gi;
 					htmlContent = htmlContent.replace(
 						imgRegex,
-						`$1 src="${objectUrl}"$3`
+						`$1 src="${objectUrl}"$3`,
 					);
 				} catch (e) {
 					console.error(

package/source/components/datatable/filter.mjs

@@ -320,7 +320,6 @@ class Filter extends CustomElement {
 				},
 				i18n: true,
 			},
-
 		});
 	}
 
@@ -553,8 +552,7 @@ function getTranslations() {
 				reset: "Сброс",
 				save: "Сохранить",
 				"filter-name": "Имя фильтра",
-				"empty-query-and-no-default":
-					"Запрос пуст и нет запроса по умолчанию.",
+				"empty-query-and-no-default": "Запрос пуст и нет запроса по умолчанию.",
 				"query-not-changed":
 					"Поисковый запрос не изменился, поэтому поиск не требуется.",
 			};
@@ -564,10 +562,8 @@ function getTranslations() {
 				reset: "重置",
 				save: "保存",
 				"filter-name": "过滤器名称",
-				"empty-query-and-no-default":
-					"查询为空，且没有默认查询。",
-				"query-not-changed":
-					"搜索请求没有更改，因此不需要进行搜索。",
+				"empty-query-and-no-default": "查询为空，且没有默认查询。",
+				"query-not-changed": "搜索请求没有更改，因此不需要进行搜索。",
 			};
 		case "hi":
 			return {
@@ -575,8 +571,7 @@ function getTranslations() {
 				reset: "रीसेट करें",
 				save: "सहेजें",
 				"filter-name": "फ़िल्टर नाम",
-				"empty-query-and-no-default":
-					"क्वेरी खाली है और कोई डिफ़ॉल्ट क्वेरी नहीं है।",
+				"empty-query-and-no-default": "क्वेरी खाली है और कोई डिफ़ॉल्ट क्वेरी नहीं है।",
 				"query-not-changed":
 					"खोज अनुरोध में कोई बदलाव नहीं हुआ है, इसलिए खोज आवश्यक नहीं है।",
 			};
@@ -586,8 +581,7 @@ function getTranslations() {
 				reset: "রিসেট",
 				save: "সংরক্ষণ করুন",
 				"filter-name": "ফিল্টারের নাম",
-				"empty-query-and-no-default":
-					"কোয়েরি খালি এবং কোনো ডিফল্ট কোয়েরি নেই।",
+				"empty-query-and-no-default": "কোয়েরি খালি এবং কোনো ডিফল্ট কোয়েরি নেই।",
 				"query-not-changed":
 					"অনুসন্ধানের অনুরোধ পরিবর্তন হয়নি, তাই অনুসন্ধান প্রয়োজন নয়।",
 			};
@@ -599,8 +593,7 @@ function getTranslations() {
 				"filter-name": "フィルター名",
 				"empty-query-and-no-default":
 					"クエリが空で、デフォルトクエリがありません。",
-				"query-not-changed":
-					"検索リクエストに変更がないため、検索は不要です。",
+				"query-not-changed": "検索リクエストに変更がないため、検索は不要です。",
 			};
 		case "pa":
 			return {
@@ -608,8 +601,7 @@ function getTranslations() {
 				reset: "ਰੀਸੈੱਟ ਕਰੋ",
 				save: "ਸੇਵ ਕਰੋ",
 				"filter-name": "ਫਿਲਟਰ ਦਾ ਨਾਂ",
-				"empty-query-and-no-default":
-					"ਕੁਐਰੀ ਖਾਲੀ ਹੈ ਅਤੇ ਕੋਈ ਡਿਫੌਲਟ ਕੁਐਰੀ ਨਹੀਂ ਹੈ।",
+				"empty-query-and-no-default": "ਕੁਐਰੀ ਖਾਲੀ ਹੈ ਅਤੇ ਕੋਈ ਡਿਫੌਲਟ ਕੁਐਰੀ ਨਹੀਂ ਹੈ।",
 				"query-not-changed":
 					"ਖੋਜ ਦੀ ਬੇਨਤੀ ਵਿੱਚ ਕੋਈ ਤਬਦੀਲੀ ਨਹੀਂ ਆਈ ਹੈ, ਇਸ ਲਈ ਖੋਜ ਦੀ ਲੋੜ ਨਹੀਂ ਹੈ।",
 			};
@@ -626,7 +618,6 @@ function getTranslations() {
 					"The search request has not changed, so no search is required.",
 			};
 	}
-
 }
 
 /**
@@ -1165,7 +1156,6 @@ function doSearch({ showEffect } = { showEffect: true }) {
 	return collectSearchQueries
 		.call(this)
 		.then((query) => {
-
 			const buildQuery = buildSearchQuery.call(this, query);
 			if (buildQuery === null) {
 				const msg = this.getOption("labels.empty-query-and-no-default");