@schukai/monster 4.25.5 → 4.26.0

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 
 
+## [4.26.0] - 2025-07-03
+
+### Add Features
+
+- Improve random UUID generation check [#330](https://gitlab.schukai.com/oss/libraries/javascript/monster/issues/330)
+### Bug Fixes
+
+- Add HTML escaping for message headers to prevent XSS
+
+
+
 ## [4.25.5] - 2025-07-03
 
 ### Bug Fixes

package/package.json

@@ -1 +1 @@
-{"author":"schukai GmbH","dependencies":{"@floating-ui/dom":"^1.7.2","@popperjs/core":"^2.11.8"},"description":"Monster is a simple library for creating fast, robust and lightweight websites.","homepage":"https://monsterjs.org/","keywords":["framework","web","dom","css","sass","mobile-first","app","front-end","templates","schukai","core","shopcloud","alvine","monster","buildmap","stack","observer","observable","uuid","node","nodelist","css-in-js","logger","log","theme"],"license":"AGPL 3.0","main":"source/monster.mjs","module":"source/monster.mjs","name":"@schukai/monster","repository":{"type":"git","url":"https://gitlab.schukai.com/oss/libraries/javascript/monster.git"},"type":"module","version":"4.25.5"}
+{"author":"schukai GmbH","dependencies":{"@floating-ui/dom":"^1.7.2","@popperjs/core":"^2.11.8"},"description":"Monster is a simple library for creating fast, robust and lightweight websites.","homepage":"https://monsterjs.org/","keywords":["framework","web","dom","css","sass","mobile-first","app","front-end","templates","schukai","core","shopcloud","alvine","monster","buildmap","stack","observer","observable","uuid","node","nodelist","css-in-js","logger","log","theme"],"license":"AGPL 3.0","main":"source/monster.mjs","module":"source/monster.mjs","name":"@schukai/monster","repository":{"type":"git","url":"https://gitlab.schukai.com/oss/libraries/javascript/monster.git"},"type":"module","version":"4.26.0"}

package/source/components/content/viewer/message.mjs

@@ -193,6 +193,15 @@ class MessageContent extends CustomElement {
 		this.setOption("message.subject", message?.subject || null);
 		this.setOption("message.messageID", message?.messageID || null);
 
+		function escapeHTML(str) {
+			return str
+				.replace(/&/g, "&")
+				.replace(/</g, "&lt;")
+				.replace(/>/g, "&gt;")
+				.replace(/"/g, "&quot;")
+				.replace(/'/g, "&#39;");
+		}
+
 		const headers = [];
 		for (const [key, value] of Object.entries(message?.headers || {})) {
 			if (key && value) {
@@ -200,7 +209,8 @@ class MessageContent extends CustomElement {
 				if (isArray(valueString)) {
 					valueString = "<ul>";
 					for (const item of value) {
-						valueString += `<li>${item}</li>`;
+						const escapedItem = escapeHTML(item);
+						valueString += `<li>${escapedItem}</li>`;
 					}
 					valueString += "</ul>";
 				}

package/source/types/uuid.mjs

@@ -78,6 +78,6 @@ function createWithRandom() {
 function createWithCrypto() {
 	const crypt = getGlobalObject("crypto");
 	if (!isObject(crypt)) return;
-	if (typeof crypt?.["randomUUID"]) return;
+	if (typeof crypt?.["randomUUID"] !== "function") return;
 	return crypt.randomUUID();
 }