@transferwise/components 0.0.0-experimental-fa3aa98 → 0.0.0-experimental-f4a328f

package/src/Markup/utils/sanitise.test.ts

@@ -0,0 +1,497 @@
+import { isAllowedHref, isHrefAllowedByMode } from './sanitise';
+
+describe('isAllowedHref', () => {
+  describe('allowed protocols', () => {
+    it('allows https URLs', () => {
+      expect(isAllowedHref('https://example.com')).toBe(true);
+    });
+
+    it('allows mailto URLs', () => {
+      expect(isAllowedHref('mailto:user@example.com')).toBe(true);
+    });
+
+    it('blocks http URLs', () => {
+      expect(isAllowedHref('http://example.com')).toBe(false);
+    });
+
+    it('blocks tel URLs', () => {
+      expect(isAllowedHref('tel:+1234567890')).toBe(false);
+    });
+  });
+
+  describe('allowed relative paths', () => {
+    it('allows root-relative paths', () => {
+      expect(isAllowedHref('/settings')).toBe(true);
+    });
+
+    it('allows hash fragments', () => {
+      expect(isAllowedHref('#section')).toBe(true);
+    });
+  });
+
+  describe('blocked relative paths', () => {
+    it('blocks dot-relative paths', () => {
+      expect(isAllowedHref('./page')).toBe(false);
+    });
+
+    it('blocks parent-relative paths', () => {
+      expect(isAllowedHref('../page')).toBe(false);
+    });
+
+    it('blocks dot-relative paths with query parameters', () => {
+      expect(isAllowedHref('./page?time=10:30')).toBe(false);
+    });
+
+    it('blocks bare relative paths with colons in segments', () => {
+      expect(isAllowedHref('page?key=value:other')).toBe(false);
+    });
+  });
+
+  describe('blocked protocols', () => {
+    it('blocks javascript: protocol', () => {
+      // eslint-disable-next-line no-script-url
+      expect(isAllowedHref('javascript:alert(1)')).toBe(false);
+    });
+
+    it('blocks javascript: with mixed case', () => {
+      // eslint-disable-next-line no-script-url
+      expect(isAllowedHref('JavaScript:alert(1)')).toBe(false);
+    });
+
+    it('blocks data: protocol', () => {
+      expect(isAllowedHref('data:text/html,<script>alert(1)</script>')).toBe(false);
+    });
+
+    it('blocks vbscript: protocol', () => {
+      expect(isAllowedHref('vbscript:MsgBox("xss")')).toBe(false);
+    });
+
+    it('blocks unknown protocols', () => {
+      expect(isAllowedHref('ftp://evil.com')).toBe(false);
+    });
+  });
+
+  describe('protocol-relative URLs', () => {
+    it('blocks protocol-relative URLs', () => {
+      expect(isAllowedHref('//evil.com/phishing')).toBe(false);
+    });
+
+    it('blocks protocol-relative URLs with whitespace', () => {
+      expect(isAllowedHref('  //evil.com  ')).toBe(false);
+    });
+  });
+
+  describe('edge cases', () => {
+    it('handles empty string', () => {
+      expect(isAllowedHref('')).toBe(false);
+    });
+
+    it('handles whitespace-padded URLs', () => {
+      expect(isAllowedHref('  https://example.com  ')).toBe(true);
+    });
+
+    it('handles whitespace-padded dangerous URLs', () => {
+      expect(isAllowedHref('  javascript:alert(1)  ')).toBe(false);
+    });
+  });
+
+  describe('control characters in scheme — XSS bypass via URL parser throw', () => {
+    it('blocks null byte mid-scheme (java\\x00script:)', () => {
+      expect(isAllowedHref('java\x00script:alert(1)')).toBe(false);
+    });
+
+    it('blocks null byte between s and c (javas\\x00cript:)', () => {
+      expect(isAllowedHref('javas\x00cript:alert(1)')).toBe(false);
+    });
+
+    it('blocks SOH prefix before javascript:', () => {
+      expect(isAllowedHref('\x01javascript:alert(1)')).toBe(false);
+    });
+
+    it('blocks vertical tab prefix before javascript:', () => {
+      expect(isAllowedHref('\x0Bjavascript:alert(1)')).toBe(false);
+    });
+
+    it('blocks form feed prefix before javascript:', () => {
+      expect(isAllowedHref('\x0Cjavascript:alert(1)')).toBe(false);
+    });
+
+    it('blocks tab mid-scheme (java\\tscript:)', () => {
+      expect(isAllowedHref('java\tscript:alert(1)')).toBe(false);
+    });
+
+    it('blocks CRLF mid-scheme (java\\r\\nscript:)', () => {
+      expect(isAllowedHref('java\r\nscript:alert(1)')).toBe(false);
+    });
+
+    it('blocks LF mid-scheme (j\\navascript:)', () => {
+      expect(isAllowedHref('j\navascript:alert(1)')).toBe(false);
+    });
+  });
+
+  describe('zero-width and invisible character bypass', () => {
+    it('blocks zero-width space prefix before javascript:', () => {
+      expect(isAllowedHref('​javascript:alert(1)')).toBe(false);
+    });
+
+    it('blocks zero-width space only (invisible link)', () => {
+      expect(isAllowedHref('​')).toBe(false);
+    });
+
+    it('blocks BOM-only string (invisible link)', () => {
+      expect(isAllowedHref('')).toBe(false);
+    });
+
+    it('blocks BOM prefix before javascript:', () => {
+      expect(isAllowedHref('javascript:alert(1)')).toBe(false);
+    });
+
+    it('blocks zero-width non-joiner prefix before javascript:', () => {
+      expect(isAllowedHref('‌javascript:alert(1)')).toBe(false);
+    });
+
+    it('blocks zero-width joiner prefix before javascript:', () => {
+      expect(isAllowedHref('‍javascript:alert(1)')).toBe(false);
+    });
+  });
+
+  describe('non-ASCII whitespace prefix bypass', () => {
+    it('blocks NBSP prefix before javascript:', () => {
+      expect(isAllowedHref(' javascript:alert(1)')).toBe(false);
+    });
+
+    it('blocks line separator prefix before javascript:', () => {
+      expect(isAllowedHref('\u2028javascript:alert(1)')).toBe(false);
+    });
+
+    it('blocks paragraph separator prefix before javascript:', () => {
+      expect(isAllowedHref('\u2029javascript:alert(1)')).toBe(false);
+    });
+
+    it('blocks NBSP before protocol-relative URL', () => {
+      expect(isAllowedHref(' //evil.com')).toBe(false);
+    });
+
+    it('blocks NBSP-only string', () => {
+      expect(isAllowedHref(' ')).toBe(false);
+    });
+  });
+
+  describe('backslash-based open redirect', () => {
+    it('blocks /\\evil.com (browsers normalize \\ to /)', () => {
+      expect(isAllowedHref('/\\evil.com')).toBe(false);
+    });
+
+    it('blocks /\\\\evil.com (double backslash)', () => {
+      expect(isAllowedHref('/\\\\evil.com')).toBe(false);
+    });
+
+    it('allows /path\\with\\backslash (not at position 1)', () => {
+      expect(isAllowedHref('/path\\with\\backslash')).toBe(true);
+    });
+  });
+
+  describe('URL-encoded dangerous schemes', () => {
+    it('blocks javascript with URL-encoded colon (%3A)', () => {
+      expect(isAllowedHref('javascript%3Aalert(1)')).toBe(false);
+    });
+
+    it('blocks javascript with lowercase URL-encoded colon (%3a)', () => {
+      expect(isAllowedHref('javascript%3aalert(1)')).toBe(false);
+    });
+  });
+
+  describe('credential confusion / phishing via userinfo', () => {
+    it('blocks https URLs with misleading userinfo (good.com@evil.com)', () => {
+      expect(isAllowedHref('https://good.com@evil.com')).toBe(false);
+    });
+
+    it('blocks https URLs with port-like credentials', () => {
+      expect(isAllowedHref('https://evil.com:443@good.com')).toBe(false);
+    });
+
+    it('allows https URLs without userinfo', () => {
+      expect(isAllowedHref('https://example.com/path')).toBe(true);
+    });
+
+    it('allows mailto with @ (expected in email addresses)', () => {
+      expect(isAllowedHref('mailto:user@example.com')).toBe(true);
+    });
+  });
+
+  describe('degenerate HTTPS URLs', () => {
+    it('blocks https:evil.com (no slashes — ambiguous host)', () => {
+      expect(isAllowedHref('https:evil.com')).toBe(false);
+    });
+
+    it('blocks https:/evil.com (single slash — ambiguous)', () => {
+      expect(isAllowedHref('https:/evil.com')).toBe(false);
+    });
+
+    it('blocks https:// (no host)', () => {
+      expect(isAllowedHref('https://')).toBe(false);
+    });
+
+    it('blocks https:/// (empty host)', () => {
+      expect(isAllowedHref('https:///')).toBe(false);
+    });
+  });
+
+  describe('internal network / SSRF via allowed HTTPS', () => {
+    it('blocks https://127.0.0.1 (localhost)', () => {
+      expect(isAllowedHref('https://127.0.0.1/')).toBe(false);
+    });
+
+    it('blocks https://[::1] (IPv6 localhost)', () => {
+      expect(isAllowedHref('https://[::1]/')).toBe(false);
+    });
+
+    it('blocks hex-encoded IP (0x7f000001)', () => {
+      expect(isAllowedHref('https://0x7f000001/')).toBe(false);
+    });
+
+    it('blocks decimal IP (2130706433)', () => {
+      expect(isAllowedHref('https://2130706433/')).toBe(false);
+    });
+
+    it('blocks octal IP (0177.0.0.1)', () => {
+      expect(isAllowedHref('https://0177.0.0.1/')).toBe(false);
+    });
+
+    it('blocks AWS metadata endpoint', () => {
+      expect(isAllowedHref('https://169.254.169.254/')).toBe(false);
+    });
+
+    it('blocks GCP metadata endpoint', () => {
+      expect(isAllowedHref('https://metadata.google.internal/')).toBe(false);
+    });
+
+    it('blocks localhost with trailing dot', () => {
+      expect(isAllowedHref('https://localhost./')).toBe(false);
+    });
+
+    it('blocks .internal host with trailing dot', () => {
+      expect(isAllowedHref('https://metadata.google.internal./')).toBe(false);
+    });
+
+    it('blocks fully expanded IPv6 loopback', () => {
+      expect(isAllowedHref('https://[0:0:0:0:0:0:0:1]/')).toBe(false);
+    });
+  });
+
+  describe('XSS payloads in fragment and path', () => {
+    it('blocks XSS payload in hash fragment', () => {
+      expect(isAllowedHref('#<img onerror=alert(1)>')).toBe(false);
+    });
+
+    it('blocks XSS payload in path', () => {
+      expect(isAllowedHref('/<img onerror=alert(1)>')).toBe(false);
+    });
+
+    it('blocks attribute injection in hash fragment', () => {
+      expect(isAllowedHref('#" onclick="alert(1)')).toBe(false);
+    });
+
+    it('allows normal hash fragments', () => {
+      expect(isAllowedHref('#section-1')).toBe(true);
+    });
+
+    it('allows normal root-relative paths', () => {
+      expect(isAllowedHref('/normal/path?query=value')).toBe(true);
+    });
+  });
+
+  describe('UNC paths (Windows network shares)', () => {
+    it('blocks UNC path to external server', () => {
+      expect(isAllowedHref('\\\\evil.com\\share')).toBe(false);
+    });
+  });
+
+  describe('space before colon in scheme', () => {
+    it('blocks "javascript :alert(1)" (space before colon)', () => {
+      expect(isAllowedHref('javascript :alert(1)')).toBe(false);
+    });
+  });
+
+  describe('mailto abuse', () => {
+    it('blocks mailto with XSS in body parameter', () => {
+      expect(isAllowedHref('mailto:evil@evil.com?body=<script>alert(1)</script>')).toBe(false);
+    });
+
+    it('blocks mailto with header injection (cc/bcc)', () => {
+      expect(isAllowedHref('mailto:evil@evil.com?cc=victim@good.com&bcc=spy@evil.com')).toBe(false);
+    });
+
+    it('blocks mailto with no recipient (social engineering)', () => {
+      expect(isAllowedHref('mailto:?subject=urgent&body=click%20here')).toBe(false);
+    });
+
+    it('allows simple mailto with just an address', () => {
+      expect(isAllowedHref('mailto:support@example.com')).toBe(true);
+    });
+  });
+
+  describe('additional blocked protocols (regression)', () => {
+    it('blocks file: protocol', () => {
+      expect(isAllowedHref('file:///etc/passwd')).toBe(false);
+    });
+
+    it('blocks ws: protocol', () => {
+      expect(isAllowedHref('ws://evil.com')).toBe(false);
+    });
+
+    it('blocks wss: protocol', () => {
+      expect(isAllowedHref('wss://evil.com')).toBe(false);
+    });
+
+    it('blocks blob: protocol', () => {
+      expect(isAllowedHref('blob:https://evil.com/uuid')).toBe(false);
+    });
+
+    it('blocks data: with SVG XSS', () => {
+      expect(isAllowedHref('data:image/svg+xml,<svg onload=alert(1)>')).toBe(false);
+    });
+
+    it('blocks data: with base64-encoded script', () => {
+      expect(isAllowedHref('data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==')).toBe(
+        false,
+      );
+    });
+
+    it('blocks view-source: protocol', () => {
+      expect(isAllowedHref('view-source:https://evil.com')).toBe(false);
+    });
+
+    it('blocks custom protocol (foo:bar)', () => {
+      expect(isAllowedHref('foo:bar')).toBe(false);
+    });
+
+    it('blocks minimal protocol pattern (a:b)', () => {
+      expect(isAllowedHref('a:b')).toBe(false);
+    });
+
+    it('blocks customprotocol:payload', () => {
+      expect(isAllowedHref('customprotocol:payload')).toBe(false);
+    });
+  });
+
+  describe('whitespace-only inputs', () => {
+    it('blocks spaces only', () => {
+      expect(isAllowedHref('   ')).toBe(false);
+    });
+
+    it('blocks tab/newline/CR only', () => {
+      expect(isAllowedHref('\t\n\r')).toBe(false);
+    });
+  });
+});
+
+describe('isHrefAllowedByMode', () => {
+  describe('internal mode', () => {
+    it('allows root-relative paths', () => {
+      expect(isHrefAllowedByMode('/accounts', 'internal')).toBe(true);
+    });
+
+    it('allows deep root-relative paths', () => {
+      expect(isHrefAllowedByMode('/accounts/123/details', 'internal')).toBe(true);
+    });
+
+    it('allows wise.com URLs', () => {
+      expect(isHrefAllowedByMode('https://wise.com/help', 'internal')).toBe(true);
+    });
+
+    it('allows wise.com deep paths', () => {
+      expect(isHrefAllowedByMode('https://wise.com/gb/send-money', 'internal')).toBe(true);
+    });
+
+    it('blocks external domains', () => {
+      expect(isHrefAllowedByMode('https://example.com', 'internal')).toBe(false);
+    });
+
+    it('blocks domains with wise.com as substring', () => {
+      expect(isHrefAllowedByMode('https://wise.company.com', 'internal')).toBe(false);
+    });
+
+    it('blocks hash fragments', () => {
+      expect(isHrefAllowedByMode('#section', 'internal')).toBe(false);
+    });
+
+    it('blocks mailto links', () => {
+      expect(isHrefAllowedByMode('mailto:user@wise.com', 'internal')).toBe(false);
+    });
+
+    describe('URL-parser normalization bypass prevention', () => {
+      it('blocks /\\evil.com (backslash normalised to slash by browsers)', () => {
+        expect(isHrefAllowedByMode('/\\evil.com', 'internal')).toBe(false);
+      });
+
+      it('blocks /\\\\evil.com (double backslash)', () => {
+        expect(isHrefAllowedByMode('/\\\\evil.com', 'internal')).toBe(false);
+      });
+
+      it('allows /%2f/evil.com (percent-encoded slash stays as path segment)', () => {
+        expect(isHrefAllowedByMode('/%2f/evil.com', 'internal')).toBe(true);
+      });
+
+      it('allows normal path with encoded characters', () => {
+        expect(isHrefAllowedByMode('/path/%E2%9C%93/done', 'internal')).toBe(true);
+      });
+
+      it('blocks path that resolves to a different origin via URL parser', () => {
+        expect(isHrefAllowedByMode('/\\@evil.com', 'internal')).toBe(false);
+      });
+
+      it('allows root path (/)', () => {
+        expect(isHrefAllowedByMode('/', 'internal')).toBe(true);
+      });
+
+      it('allows paths with query parameters', () => {
+        expect(isHrefAllowedByMode('/search?q=hello', 'internal')).toBe(true);
+      });
+
+      it('allows paths with hash fragments', () => {
+        expect(isHrefAllowedByMode('/page#section', 'internal')).toBe(true);
+      });
+    });
+  });
+
+  describe('all mode', () => {
+    it('allows root-relative paths', () => {
+      expect(isHrefAllowedByMode('/settings', 'all')).toBe(true);
+    });
+
+    it('allows external domains', () => {
+      expect(isHrefAllowedByMode('https://example.com', 'all')).toBe(true);
+    });
+
+    it('allows wise.com URLs', () => {
+      expect(isHrefAllowedByMode('https://wise.com/help', 'all')).toBe(true);
+    });
+
+    it('allows hash fragments', () => {
+      expect(isHrefAllowedByMode('#section', 'all')).toBe(true);
+    });
+
+    it('allows mailto links', () => {
+      expect(isHrefAllowedByMode('mailto:user@example.com', 'all')).toBe(true);
+    });
+  });
+
+  describe('none mode', () => {
+    it('blocks root-relative paths', () => {
+      expect(isHrefAllowedByMode('/accounts', 'none')).toBe(false);
+    });
+
+    it('blocks wise.com URLs', () => {
+      expect(isHrefAllowedByMode('https://wise.com/help', 'none')).toBe(false);
+    });
+
+    it('blocks external domains', () => {
+      expect(isHrefAllowedByMode('https://example.com', 'none')).toBe(false);
+    });
+
+    it('blocks hash fragments', () => {
+      expect(isHrefAllowedByMode('#section', 'none')).toBe(false);
+    });
+  });
+});

package/src/Markup/utils/sanitise.ts

@@ -0,0 +1,133 @@
+import { ALLOWED_PROTOCOLS } from '../constants';
+
+const INVISIBLE_CHARS = /[\u200b\u200c\u200d\ufeff\u00ad\u2060\u180e]/g;
+// eslint-disable-next-line regexp/no-control-character
+const CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f]/;
+const DANGEROUS_HTML_CHARS = /[<>"']/;
+const DANGEROUS_SCHEME = /^(?:javascript|vbscript|data|jscript)\s*:/i;
+// eslint-disable-next-line regexp/no-useless-non-capturing-group
+const ENCODED_COLON_SCHEME = /^(?:javascript|vbscript|data|jscript)(?:%3a)/i;
+const IPV6_BRACKETS = /^\[|\]$/g;
+const NUMERIC_IP = /^[\d.]+$/;
+const HEX_IP = /^0x[0-9a-f]+$/i;
+
+export function isAllowedHref(href: string): boolean {
+  const cleaned = href.replace(INVISIBLE_CHARS, '');
+  const trimmed = cleaned.trim();
+
+  if (!trimmed) {
+    return false;
+  }
+
+  if (CONTROL_CHARS.test(trimmed)) {
+    return false;
+  }
+
+  if (DANGEROUS_HTML_CHARS.test(trimmed)) {
+    return false;
+  }
+
+  if (DANGEROUS_SCHEME.test(trimmed)) {
+    return false;
+  }
+
+  if (ENCODED_COLON_SCHEME.test(trimmed)) {
+    return false;
+  }
+
+  if (trimmed.startsWith('//')) {
+    return false;
+  }
+
+  if (trimmed.startsWith('\\')) {
+    return false;
+  }
+
+  if (trimmed.startsWith('/')) {
+    return trimmed[1] !== '\\';
+  }
+
+  if (trimmed.startsWith('#')) {
+    return true;
+  }
+
+  if (trimmed.startsWith('./') || trimmed.startsWith('../')) {
+    return false;
+  }
+
+  try {
+    const url = new URL(trimmed);
+
+    if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {
+      return false;
+    }
+
+    if (url.protocol === 'https:') {
+      if (!trimmed.startsWith('https://')) {
+        return false;
+      }
+
+      if (!url.hostname) {
+        return false;
+      }
+
+      if (url.username || url.password) {
+        return false;
+      }
+
+      if (isInternalHost(url.hostname)) {
+        return false;
+      }
+    }
+
+    if (url.protocol === 'mailto:') {
+      if (url.search) {
+        return false;
+      }
+
+      if (!url.pathname) {
+        return false;
+      }
+    }
+
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export type AllowLinksMode = 'internal' | 'all' | 'none';
+
+// Synthetic origin used to resolve relative paths via the WHATWG URL parser.
+// If the resolved origin still equals this sentinel, the path stays on-origin.
+const SSR_SENTINEL_ORIGIN = 'https://internal.invalid';
+
+export function isHrefAllowedByMode(href: string, mode: AllowLinksMode): boolean {
+  switch (mode) {
+    case 'none':
+      return false;
+    case 'all':
+      return true;
+    case 'internal':
+      if (href.startsWith('https://wise.com/')) return true;
+      if (href.startsWith('/')) {
+        try {
+          return new URL(href, SSR_SENTINEL_ORIGIN).origin === SSR_SENTINEL_ORIGIN;
+        } catch {
+          return false;
+        }
+      }
+      return false;
+  }
+}
+
+function isInternalHost(hostname: string): boolean {
+  const stripped = hostname.replace(IPV6_BRACKETS, '');
+  const host = stripped.endsWith('.') ? stripped.slice(0, -1) : stripped;
+  if (NUMERIC_IP.test(host)) return true;
+  if (HEX_IP.test(host)) return true;
+  if (host === '::1' || host === '0:0:0:0:0:0:0:1') return true;
+  if (host === 'localhost') return true;
+  if (host.endsWith('.internal')) return true;
+  return false;
+}

package/src/common/DateUtils/index.ts

@@ -6,5 +6,3 @@ export { isDateValid } from './isDateValid/isDateValid';
 export { isMonthAndYearFormat } from './isMonthAndYearFormat/isMonthAndYearFormat';
 export { MDY, YMD } from './getFormatForLocale/getFormatForLocale';
 export { returnDateView } from './getDateView/getDateView';
-export { isDateDisabled } from './isDateDisabled/isDateDisabled';
-export { hasDisabledDatesInMonth } from './hasDisabledDatesInMonth/hasDisabledDatesInMonth';

package/src/i18n/en.json

@@ -12,10 +12,6 @@
   "neptune.DateLookup.goTo20YearView": "Go to 20 year view",
   "neptune.DateLookup.month": "month",
   "neptune.DateLookup.next": "next",
-  "neptune.DateLookup.notAvailable": "not available",
-  "neptune.DateLookup.outOfRangeAfter": "Please select a date on or after {min}.",
-  "neptune.DateLookup.outOfRangeBefore": "Please select a date on or before {max}.",
-  "neptune.DateLookup.outOfRangeBetween": "Please select a date between {min} and {max}.",
   "neptune.DateLookup.previous": "previous",
   "neptune.DateLookup.selected": "selected",
   "neptune.DateLookup.twentyYears": "20 years",

package/src/index.ts

@@ -25,8 +25,6 @@ export type {
   ButtonProps as LegacyButtonProps,
   AnchorElementProps,
 } from './Button';
-export type { CalendarProps } from './Calendar';
-export type { DisabledRules, WeekDayType, DisabledDateRange } from './Calendar';
 export type { CardProps } from './_deprecated/Card';
 export type {
   CarouselProps,
@@ -57,6 +55,7 @@ export type {
 export type { BottomSheetProps } from './common/BottomSheet';
 export type { DateInputProps } from './DateInput';
 export type { DateLookupProps } from './DateLookup';
+export type { CalendarProps } from './Calendar';
 export type { DecisionProps } from './Decision';
 export type {
   DefinitionListProps,
@@ -92,6 +91,7 @@ export type { LabelProps, LabelOptionalProps, LabelDescriptionProps } from './La
 export type { LegacyListItemProps } from './_deprecated/LegacyListItem';
 export type { LoaderProps } from './Loader';
 export type { MarkdownProps } from './Markdown';
+export type { MarkupActionHandler, MarkupActions, MarkupNode, MarkupProps } from './Markup';
 export type { ModalProps } from './Modal';
 export type { MoneyProps } from './Money';
 export type {
@@ -202,7 +202,6 @@ export { default as Badge, BadgeAssets } from './_deprecated/Badge';
 export { default as Body } from './Body';
 export { default as Button } from './Button';
 export { default as IconButton } from './IconButton';
-export { default as Calendar } from './Calendar';
 export { default as Carousel } from './Carousel';
 export { default as Card } from './_deprecated/Card';
 export { default as Checkbox } from './Checkbox';
@@ -218,6 +217,7 @@ export { default as BaseCard } from './common/BaseCard';
 export { default as CriticalCommsBanner } from './_deprecated/CriticalBanner';
 export { default as DateInput } from './DateInput';
 export { default as DateLookup } from './DateLookup';
+export { default as Calendar } from './Calendar';
 export { default as Decision } from './Decision';
 export { default as DefinitionList } from './DefinitionList';
 export { default as Dimmer } from './Dimmer';
@@ -250,6 +250,7 @@ export { default as LegacyListItem } from './_deprecated/LegacyListItem';
 export { default as Loader } from './Loader';
 export { default as Logo } from './Logo';
 export { default as Markdown } from './Markdown';
+export { default as Markup } from './Markup';
 export { default as Modal } from './Modal';
 export { default as Money } from './Money';
 export { default as MoneyInput } from './MoneyInput';