@shopgate/pwa-common 7.31.9-beta.1 → 7.31.9-beta.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@shopgate/pwa-common",
3
- "version": "7.31.9-beta.1",
3
+ "version": "7.31.9-beta.2",
4
4
  "description": "Common library for the Shopgate Connect PWA.",
5
5
  "license": "Apache-2.0",
6
6
  "author": "Shopgate <support@shopgate.com>",
@@ -17,7 +17,7 @@
17
17
  "dependencies": {
18
18
  "@redux-devtools/extension": "^3.3.0",
19
19
  "@sentry/browser": "6.0.1",
20
- "@shopgate/pwa-benchmark": "7.31.9-beta.1",
20
+ "@shopgate/pwa-benchmark": "7.31.9-beta.2",
21
21
  "@virtuous/conductor": "~2.5.0",
22
22
  "@virtuous/react-conductor": "~2.5.0",
23
23
  "@virtuous/redux-persister": "1.1.0-beta.7",
@@ -40,7 +40,7 @@
40
40
  "swiper": "12.1.0"
41
41
  },
42
42
  "devDependencies": {
43
- "@shopgate/pwa-core": "7.31.9-beta.1",
43
+ "@shopgate/pwa-core": "7.31.9-beta.2",
44
44
  "@types/lodash": "^4.17.24",
45
45
  "@types/react-portal": "^3.0.9",
46
46
  "lodash": "^4.17.23",
@@ -109,6 +109,10 @@ export default function routerSubscriptions(subscribe) {
109
109
  }
110
110
  case HISTORY_RESET_TO:
111
111
  {
112
+ const sanitizedResetToPathname = sanitizeLink(String(resetToPathname || ''));
113
+ if (!sanitizedResetToPathname) {
114
+ return;
115
+ }
112
116
  await router.pop({
113
117
  steps: historyLength - 1,
114
118
  state: routeState,
@@ -116,7 +120,7 @@ export default function routerSubscriptions(subscribe) {
116
120
  emitAfter: false
117
121
  });
118
122
  await router.replace({
119
- pathname: resetToPathname,
123
+ pathname: sanitizedResetToPathname,
120
124
  state: routeState
121
125
  });
122
126
  return;
@@ -125,6 +129,13 @@ export default function routerSubscriptions(subscribe) {
125
129
  break;
126
130
  }
127
131
 
132
+ // Remove HTML markup from the location (e.g. within query parameters of links from CMS content)
133
+ // to prevent that it's rendered within pages or sent within requests. Links with a script
134
+ // protocol are rejected.
135
+ if (location) {
136
+ location = sanitizeLink(String(location));
137
+ }
138
+
128
139
  // Remove trailing slashes from internal links, since they might break the routing mechanism.
129
140
  // External links are treated as valid, since we don't know about the requirements at the
130
141
  // 3rd party server (e.g. google maps links might require trailing slashes).