@tiba-spark/client-shared-lib 26.3.0-60 → 26.3.0-80
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"element.util.d.ts","sourceRoot":"","sources":["../../../../projects/client-shared-lib/src/libraries/utils/element.util.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"element.util.d.ts","sourceRoot":"","sources":["../../../../projects/client-shared-lib/src/libraries/utils/element.util.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,OAM1E;AAED,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,iBAAiB,CAUxG;AAED,wBAAsB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAuBvF"}
|
package/package.json
CHANGED
|
@@ -72,6 +72,9 @@ const SAFE_STANDALONE_INNER_HTML_IMPORTS = new Set([
|
|
|
72
72
|
// File-wide allowlisting is intentionally unsupported: one reviewed exception
|
|
73
73
|
// must not silence future XSS vectors added elsewhere in the same file.
|
|
74
74
|
const ALLOWLIST = new Set([
|
|
75
|
+
// SPRK3-14302: What's New renders a trusted (PM-only, password+JWT upload) release-notes
|
|
76
|
+
// document as-is via a sandboxed iframe (no allow-same-origin). Reviewed exception.
|
|
77
|
+
'projects/client-shared-lib/src/libraries/utils/element.util.ts:44',
|
|
75
78
|
'projects/client-shared-lib/src/libraries/directives/ellipsis-multiline.directive.ts:20',
|
|
76
79
|
'projects/client-shared-lib/src/libraries/directives/ellipsis-multiline.directive.ts:56',
|
|
77
80
|
'projects/client-shared-lib/src/libraries/directives/ellipsis-multiline.directive.ts:63',
|
|
@@ -109,6 +112,11 @@ const checks = [
|
|
|
109
112
|
pattern: /\.insertAdjacentHTML\s*\(/,
|
|
110
113
|
extensions: CODE_EXTENSIONS,
|
|
111
114
|
},
|
|
115
|
+
{
|
|
116
|
+
name: 'iframe srcdoc assignment',
|
|
117
|
+
pattern: /\.\s*srcdoc\s*=/,
|
|
118
|
+
extensions: CODE_EXTENSIONS,
|
|
119
|
+
},
|
|
112
120
|
{
|
|
113
121
|
name: 'direct outerHTML assignment',
|
|
114
122
|
pattern: /\.\s*outerHTML\s*=/,
|
|
@@ -119,6 +127,14 @@ const checks = [
|
|
|
119
127
|
pattern: /\binnerHTML\s*=\s*(["'`])([\s\S]*?)\1/i,
|
|
120
128
|
extensions: TEMPLATE_EXTENSIONS,
|
|
121
129
|
isAllowed: (match) => /\bsanitizeHtml\s*\(/.test(match[2]),
|
|
130
|
+
},
|
|
131
|
+
{
|
|
132
|
+
name: 'iframe srcdoc binding in template',
|
|
133
|
+
// Catches both the attribute form (srcdoc="{{ html }}") and the property
|
|
134
|
+
// binding ([srcdoc]="html"); the CODE_EXTENSIONS srcdoc check above never
|
|
135
|
+
// sees these, so an unsanitized srcdoc sink could otherwise enter via a .html.
|
|
136
|
+
pattern: /\[?\s*srcdoc\s*\]?\s*=\s*(["'`])([\s\S]*?)\1/i,
|
|
137
|
+
extensions: TEMPLATE_EXTENSIONS,
|
|
122
138
|
}
|
|
123
139
|
];
|
|
124
140
|
|