@transferwise/components 46.155.1 → 46.156.0

package/src/Markup/utils/sanitise.test.ts

@@ -0,0 +1,499 @@
+import { isHrefAllowedByMode, sanitiseHref } from './sanitise';
+
+describe('sanitiseHref', () => {
+  describe('allowed protocols', () => {
+    it('allows https URLs', () => {
+      expect(sanitiseHref('https://example.com')).toBeDefined();
+    });
+
+    it('allows mailto URLs', () => {
+      expect(sanitiseHref('mailto:user@example.com')).toBeDefined();
+    });
+
+    it('blocks http URLs', () => {
+      expect(sanitiseHref('http://example.com')).toBeUndefined();
+    });
+
+    it('blocks tel URLs', () => {
+      expect(sanitiseHref('tel:+1234567890')).toBeUndefined();
+    });
+  });
+
+  describe('allowed relative paths', () => {
+    it('allows root-relative paths', () => {
+      expect(sanitiseHref('/settings')).toBeDefined();
+    });
+
+    it('allows hash fragments', () => {
+      expect(sanitiseHref('#section')).toBeDefined();
+    });
+  });
+
+  describe('blocked relative paths', () => {
+    it('blocks dot-relative paths', () => {
+      expect(sanitiseHref('./page')).toBeUndefined();
+    });
+
+    it('blocks parent-relative paths', () => {
+      expect(sanitiseHref('../page')).toBeUndefined();
+    });
+
+    it('blocks dot-relative paths with query parameters', () => {
+      expect(sanitiseHref('./page?time=10:30')).toBeUndefined();
+    });
+
+    it('blocks bare relative paths with colons in segments', () => {
+      expect(sanitiseHref('page?key=value:other')).toBeUndefined();
+    });
+  });
+
+  describe('blocked protocols', () => {
+    it('blocks javascript: protocol', () => {
+      // eslint-disable-next-line no-script-url
+      expect(sanitiseHref('javascript:alert(1)')).toBeUndefined();
+    });
+
+    it('blocks javascript: with mixed case', () => {
+      // eslint-disable-next-line no-script-url
+      expect(sanitiseHref('JavaScript:alert(1)')).toBeUndefined();
+    });
+
+    it('blocks data: protocol', () => {
+      expect(sanitiseHref('data:text/html,<script>alert(1)</script>')).toBeUndefined();
+    });
+
+    it('blocks vbscript: protocol', () => {
+      expect(sanitiseHref('vbscript:MsgBox("xss")')).toBeUndefined();
+    });
+
+    it('blocks unknown protocols', () => {
+      expect(sanitiseHref('ftp://evil.com')).toBeUndefined();
+    });
+  });
+
+  describe('protocol-relative URLs', () => {
+    it('blocks protocol-relative URLs', () => {
+      expect(sanitiseHref('//evil.com/phishing')).toBeUndefined();
+    });
+
+    it('blocks protocol-relative URLs with whitespace', () => {
+      expect(sanitiseHref('  //evil.com  ')).toBeUndefined();
+    });
+  });
+
+  describe('edge cases', () => {
+    it('handles empty string', () => {
+      expect(sanitiseHref('')).toBeUndefined();
+    });
+
+    it('handles whitespace-padded URLs', () => {
+      expect(sanitiseHref('  https://example.com  ')).toBe('https://example.com');
+    });
+
+    it('handles whitespace-padded dangerous URLs', () => {
+      expect(sanitiseHref('  javascript:alert(1)  ')).toBeUndefined();
+    });
+  });
+
+  describe('control characters in scheme — XSS bypass via URL parser throw', () => {
+    it('blocks null byte mid-scheme (java\\x00script:)', () => {
+      expect(sanitiseHref('java\x00script:alert(1)')).toBeUndefined();
+    });
+
+    it('blocks null byte between s and c (javas\\x00cript:)', () => {
+      expect(sanitiseHref('javas\x00cript:alert(1)')).toBeUndefined();
+    });
+
+    it('blocks SOH prefix before javascript:', () => {
+      expect(sanitiseHref('\x01javascript:alert(1)')).toBeUndefined();
+    });
+
+    it('blocks vertical tab prefix before javascript:', () => {
+      expect(sanitiseHref('\x0Bjavascript:alert(1)')).toBeUndefined();
+    });
+
+    it('blocks form feed prefix before javascript:', () => {
+      expect(sanitiseHref('\x0Cjavascript:alert(1)')).toBeUndefined();
+    });
+
+    it('blocks tab mid-scheme (java\\tscript:)', () => {
+      expect(sanitiseHref('java\tscript:alert(1)')).toBeUndefined();
+    });
+
+    it('blocks CRLF mid-scheme (java\\r\\nscript:)', () => {
+      expect(sanitiseHref('java\r\nscript:alert(1)')).toBeUndefined();
+    });
+
+    it('blocks LF mid-scheme (j\\navascript:)', () => {
+      expect(sanitiseHref('j\navascript:alert(1)')).toBeUndefined();
+    });
+  });
+
+  describe('zero-width and invisible character bypass', () => {
+    it('blocks zero-width space prefix before javascript:', () => {
+      expect(sanitiseHref('​javascript:alert(1)')).toBeUndefined();
+    });
+
+    it('blocks zero-width space only (invisible link)', () => {
+      expect(sanitiseHref('​')).toBeUndefined();
+    });
+
+    it('blocks BOM-only string (invisible link)', () => {
+      expect(sanitiseHref('')).toBeUndefined();
+    });
+
+    it('blocks BOM prefix before javascript:', () => {
+      expect(sanitiseHref('javascript:alert(1)')).toBeUndefined();
+    });
+
+    it('blocks zero-width non-joiner prefix before javascript:', () => {
+      expect(sanitiseHref('‌javascript:alert(1)')).toBeUndefined();
+    });
+
+    it('blocks zero-width joiner prefix before javascript:', () => {
+      expect(sanitiseHref('‍javascript:alert(1)')).toBeUndefined();
+    });
+  });
+
+  describe('non-ASCII whitespace prefix bypass', () => {
+    it('blocks NBSP prefix before javascript:', () => {
+      expect(sanitiseHref(' javascript:alert(1)')).toBeUndefined();
+    });
+
+    it('blocks line separator prefix before javascript:', () => {
+      expect(sanitiseHref('\u2028javascript:alert(1)')).toBeUndefined();
+    });
+
+    it('blocks paragraph separator prefix before javascript:', () => {
+      expect(sanitiseHref('\u2029javascript:alert(1)')).toBeUndefined();
+    });
+
+    it('blocks NBSP before protocol-relative URL', () => {
+      expect(sanitiseHref(' //evil.com')).toBeUndefined();
+    });
+
+    it('blocks NBSP-only string', () => {
+      expect(sanitiseHref(' ')).toBeUndefined();
+    });
+  });
+
+  describe('backslash-based open redirect', () => {
+    it('blocks /\\evil.com (browsers normalize \\ to /)', () => {
+      expect(sanitiseHref('/\\evil.com')).toBeUndefined();
+    });
+
+    it('blocks /\\\\evil.com (double backslash)', () => {
+      expect(sanitiseHref('/\\\\evil.com')).toBeUndefined();
+    });
+
+    it('allows /path\\with\\backslash (not at position 1)', () => {
+      expect(sanitiseHref('/path\\with\\backslash')).toBeDefined();
+    });
+  });
+
+  describe('URL-encoded dangerous schemes', () => {
+    it('blocks javascript with URL-encoded colon (%3A)', () => {
+      expect(sanitiseHref('javascript%3Aalert(1)')).toBeUndefined();
+    });
+
+    it('blocks javascript with lowercase URL-encoded colon (%3a)', () => {
+      expect(sanitiseHref('javascript%3aalert(1)')).toBeUndefined();
+    });
+  });
+
+  describe('credential confusion / phishing via userinfo', () => {
+    it('blocks https URLs with misleading userinfo (good.com@evil.com)', () => {
+      expect(sanitiseHref('https://good.com@evil.com')).toBeUndefined();
+    });
+
+    it('blocks https URLs with port-like credentials', () => {
+      expect(sanitiseHref('https://evil.com:443@good.com')).toBeUndefined();
+    });
+
+    it('allows https URLs without userinfo', () => {
+      expect(sanitiseHref('https://example.com/path')).toBeDefined();
+    });
+
+    it('allows mailto with @ (expected in email addresses)', () => {
+      expect(sanitiseHref('mailto:user@example.com')).toBeDefined();
+    });
+  });
+
+  describe('degenerate HTTPS URLs', () => {
+    it('blocks https:evil.com (no slashes — ambiguous host)', () => {
+      expect(sanitiseHref('https:evil.com')).toBeUndefined();
+    });
+
+    it('blocks https:/evil.com (single slash — ambiguous)', () => {
+      expect(sanitiseHref('https:/evil.com')).toBeUndefined();
+    });
+
+    it('blocks https:// (no host)', () => {
+      expect(sanitiseHref('https://')).toBeUndefined();
+    });
+
+    it('blocks https:/// (empty host)', () => {
+      expect(sanitiseHref('https:///')).toBeUndefined();
+    });
+  });
+
+  describe('internal network / SSRF via allowed HTTPS', () => {
+    it('blocks https://127.0.0.1 (localhost)', () => {
+      expect(sanitiseHref('https://127.0.0.1/')).toBeUndefined();
+    });
+
+    it('blocks https://[::1] (IPv6 localhost)', () => {
+      expect(sanitiseHref('https://[::1]/')).toBeUndefined();
+    });
+
+    it('blocks hex-encoded IP (0x7f000001)', () => {
+      expect(sanitiseHref('https://0x7f000001/')).toBeUndefined();
+    });
+
+    it('blocks decimal IP (2130706433)', () => {
+      expect(sanitiseHref('https://2130706433/')).toBeUndefined();
+    });
+
+    it('blocks octal IP (0177.0.0.1)', () => {
+      expect(sanitiseHref('https://0177.0.0.1/')).toBeUndefined();
+    });
+
+    it('blocks AWS metadata endpoint', () => {
+      expect(sanitiseHref('https://169.254.169.254/')).toBeUndefined();
+    });
+
+    it('blocks GCP metadata endpoint', () => {
+      expect(sanitiseHref('https://metadata.google.internal/')).toBeUndefined();
+    });
+
+    it('blocks localhost with trailing dot', () => {
+      expect(sanitiseHref('https://localhost./')).toBeUndefined();
+    });
+
+    it('blocks .internal host with trailing dot', () => {
+      expect(sanitiseHref('https://metadata.google.internal./')).toBeUndefined();
+    });
+
+    it('blocks fully expanded IPv6 loopback', () => {
+      expect(sanitiseHref('https://[0:0:0:0:0:0:0:1]/')).toBeUndefined();
+    });
+  });
+
+  describe('HTML metacharacters in fragment and path (inert in React rendering context)', () => {
+    it('allows angle brackets in hash fragment (React escapes via DOM property)', () => {
+      expect(sanitiseHref('#<img onerror=alert(1)>')).toBeDefined();
+    });
+
+    it('allows angle brackets in path (React escapes via DOM property)', () => {
+      expect(sanitiseHref('/<img onerror=alert(1)>')).toBeDefined();
+    });
+
+    it('allows quotes in hash fragment (React sets href via property, not innerHTML)', () => {
+      expect(sanitiseHref('#" onclick="alert(1)')).toBeDefined();
+    });
+
+    it('allows normal hash fragments', () => {
+      expect(sanitiseHref('#section-1')).toBeDefined();
+    });
+
+    it('allows normal root-relative paths', () => {
+      expect(sanitiseHref('/normal/path?query=value')).toBeDefined();
+    });
+  });
+
+  describe('UNC paths (Windows network shares)', () => {
+    it('blocks UNC path to external server', () => {
+      expect(sanitiseHref('\\\\evil.com\\share')).toBeUndefined();
+    });
+  });
+
+  describe('space before colon in scheme', () => {
+    it('blocks "javascript :alert(1)" (space before colon)', () => {
+      expect(sanitiseHref('javascript :alert(1)')).toBeUndefined();
+    });
+  });
+
+  describe('mailto abuse', () => {
+    it('blocks mailto with XSS in body parameter', () => {
+      expect(sanitiseHref('mailto:evil@evil.com?body=<script>alert(1)</script>')).toBeUndefined();
+    });
+
+    it('blocks mailto with header injection (cc/bcc)', () => {
+      expect(
+        sanitiseHref('mailto:evil@evil.com?cc=victim@good.com&bcc=spy@evil.com'),
+      ).toBeUndefined();
+    });
+
+    it('blocks mailto with no recipient (social engineering)', () => {
+      expect(sanitiseHref('mailto:?subject=urgent&body=click%20here')).toBeUndefined();
+    });
+
+    it('allows simple mailto with just an address', () => {
+      expect(sanitiseHref('mailto:support@example.com')).toBeDefined();
+    });
+  });
+
+  describe('additional blocked protocols (regression)', () => {
+    it('blocks file: protocol', () => {
+      expect(sanitiseHref('file:///etc/passwd')).toBeUndefined();
+    });
+
+    it('blocks ws: protocol', () => {
+      expect(sanitiseHref('ws://evil.com')).toBeUndefined();
+    });
+
+    it('blocks wss: protocol', () => {
+      expect(sanitiseHref('wss://evil.com')).toBeUndefined();
+    });
+
+    it('blocks blob: protocol', () => {
+      expect(sanitiseHref('blob:https://evil.com/uuid')).toBeUndefined();
+    });
+
+    it('blocks data: with SVG XSS', () => {
+      expect(sanitiseHref('data:image/svg+xml,<svg onload=alert(1)>')).toBeUndefined();
+    });
+
+    it('blocks data: with base64-encoded script', () => {
+      expect(
+        sanitiseHref('data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=='),
+      ).toBeUndefined();
+    });
+
+    it('blocks view-source: protocol', () => {
+      expect(sanitiseHref('view-source:https://evil.com')).toBeUndefined();
+    });
+
+    it('blocks custom protocol (foo:bar)', () => {
+      expect(sanitiseHref('foo:bar')).toBeUndefined();
+    });
+
+    it('blocks minimal protocol pattern (a:b)', () => {
+      expect(sanitiseHref('a:b')).toBeUndefined();
+    });
+
+    it('blocks customprotocol:payload', () => {
+      expect(sanitiseHref('customprotocol:payload')).toBeUndefined();
+    });
+  });
+
+  describe('whitespace-only inputs', () => {
+    it('blocks spaces only', () => {
+      expect(sanitiseHref('   ')).toBeUndefined();
+    });
+
+    it('blocks tab/newline/CR only', () => {
+      expect(sanitiseHref('\t\n\r')).toBeUndefined();
+    });
+  });
+});
+
+describe('isHrefAllowedByMode', () => {
+  describe('internal mode', () => {
+    it('allows root-relative paths', () => {
+      expect(isHrefAllowedByMode('/accounts', 'internal')).toBe(true);
+    });
+
+    it('allows deep root-relative paths', () => {
+      expect(isHrefAllowedByMode('/accounts/123/details', 'internal')).toBe(true);
+    });
+
+    it('allows wise.com URLs', () => {
+      expect(isHrefAllowedByMode('https://wise.com/help', 'internal')).toBe(true);
+    });
+
+    it('allows wise.com deep paths', () => {
+      expect(isHrefAllowedByMode('https://wise.com/gb/send-money', 'internal')).toBe(true);
+    });
+
+    it('blocks external domains', () => {
+      expect(isHrefAllowedByMode('https://example.com', 'internal')).toBe(false);
+    });
+
+    it('blocks domains with wise.com as substring', () => {
+      expect(isHrefAllowedByMode('https://wise.company.com', 'internal')).toBe(false);
+    });
+
+    it('blocks hash fragments', () => {
+      expect(isHrefAllowedByMode('#section', 'internal')).toBe(false);
+    });
+
+    it('blocks mailto links', () => {
+      expect(isHrefAllowedByMode('mailto:user@wise.com', 'internal')).toBe(false);
+    });
+
+    describe('URL-parser normalization bypass prevention', () => {
+      it('blocks /\\evil.com (backslash normalised to slash by browsers)', () => {
+        expect(isHrefAllowedByMode('/\\evil.com', 'internal')).toBe(false);
+      });
+
+      it('blocks /\\\\evil.com (double backslash)', () => {
+        expect(isHrefAllowedByMode('/\\\\evil.com', 'internal')).toBe(false);
+      });
+
+      it('allows /%2f/evil.com (percent-encoded slash stays as path segment)', () => {
+        expect(isHrefAllowedByMode('/%2f/evil.com', 'internal')).toBe(true);
+      });
+
+      it('allows normal path with encoded characters', () => {
+        expect(isHrefAllowedByMode('/path/%E2%9C%93/done', 'internal')).toBe(true);
+      });
+
+      it('blocks path that resolves to a different origin via URL parser', () => {
+        expect(isHrefAllowedByMode('/\\@evil.com', 'internal')).toBe(false);
+      });
+
+      it('allows root path (/)', () => {
+        expect(isHrefAllowedByMode('/', 'internal')).toBe(true);
+      });
+
+      it('allows paths with query parameters', () => {
+        expect(isHrefAllowedByMode('/search?q=hello', 'internal')).toBe(true);
+      });
+
+      it('allows paths with hash fragments', () => {
+        expect(isHrefAllowedByMode('/page#section', 'internal')).toBe(true);
+      });
+    });
+  });
+
+  describe('all mode', () => {
+    it('allows root-relative paths', () => {
+      expect(isHrefAllowedByMode('/settings', 'all')).toBe(true);
+    });
+
+    it('allows external domains', () => {
+      expect(isHrefAllowedByMode('https://example.com', 'all')).toBe(true);
+    });
+
+    it('allows wise.com URLs', () => {
+      expect(isHrefAllowedByMode('https://wise.com/help', 'all')).toBe(true);
+    });
+
+    it('allows hash fragments', () => {
+      expect(isHrefAllowedByMode('#section', 'all')).toBe(true);
+    });
+
+    it('allows mailto links', () => {
+      expect(isHrefAllowedByMode('mailto:user@example.com', 'all')).toBe(true);
+    });
+  });
+
+  describe('none mode', () => {
+    it('blocks root-relative paths', () => {
+      expect(isHrefAllowedByMode('/accounts', 'none')).toBe(false);
+    });
+
+    it('blocks wise.com URLs', () => {
+      expect(isHrefAllowedByMode('https://wise.com/help', 'none')).toBe(false);
+    });
+
+    it('blocks external domains', () => {
+      expect(isHrefAllowedByMode('https://example.com', 'none')).toBe(false);
+    });
+
+    it('blocks hash fragments', () => {
+      expect(isHrefAllowedByMode('#section', 'none')).toBe(false);
+    });
+  });
+});

package/src/Markup/utils/sanitise.ts

@@ -0,0 +1,129 @@
+import { ALLOWED_PROTOCOLS } from '../constants';
+
+const INVISIBLE_CHARS = /[\u200b\u200c\u200d\ufeff\u00ad\u2060\u180e]/g;
+// eslint-disable-next-line regexp/no-control-character
+const CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f]/;
+const DANGEROUS_SCHEME = /^(?:javascript|vbscript|data|jscript)\s*:/i;
+// eslint-disable-next-line regexp/no-useless-non-capturing-group
+const ENCODED_COLON_SCHEME = /^(?:javascript|vbscript|data|jscript)(?:%3a)/i;
+const IPV6_BRACKETS = /^\[|\]$/g;
+const NUMERIC_IP = /^[\d.]+$/;
+const HEX_IP = /^0x[0-9a-f]+$/i;
+
+export function sanitiseHref(href: string): string | undefined {
+  const cleaned = href.replace(INVISIBLE_CHARS, '');
+  const trimmed = cleaned.trim();
+
+  if (!trimmed) {
+    return undefined;
+  }
+
+  if (CONTROL_CHARS.test(trimmed)) {
+    return undefined;
+  }
+
+  if (DANGEROUS_SCHEME.test(trimmed)) {
+    return undefined;
+  }
+
+  if (ENCODED_COLON_SCHEME.test(trimmed)) {
+    return undefined;
+  }
+
+  if (trimmed.startsWith('//')) {
+    return undefined;
+  }
+
+  if (trimmed.startsWith('\\')) {
+    return undefined;
+  }
+
+  if (trimmed.startsWith('/')) {
+    return trimmed[1] !== '\\' ? trimmed : undefined;
+  }
+
+  if (trimmed.startsWith('#')) {
+    return trimmed;
+  }
+
+  if (trimmed.startsWith('./') || trimmed.startsWith('../')) {
+    return undefined;
+  }
+
+  try {
+    const url = new URL(trimmed);
+
+    if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {
+      return undefined;
+    }
+
+    if (url.protocol === 'https:') {
+      if (!trimmed.startsWith('https://')) {
+        return undefined;
+      }
+
+      if (!url.hostname) {
+        return undefined;
+      }
+
+      if (url.username || url.password) {
+        return undefined;
+      }
+
+      if (isInternalHost(url.hostname)) {
+        return undefined;
+      }
+    }
+
+    if (url.protocol === 'mailto:') {
+      if (url.search) {
+        return undefined;
+      }
+
+      if (!url.pathname) {
+        return undefined;
+      }
+    }
+
+    return trimmed;
+  } catch {
+    return undefined;
+  }
+}
+
+export type AllowLinksMode = 'internal' | 'all' | 'none';
+
+// Synthetic origin used to resolve relative paths via the WHATWG URL parser.
+// If the resolved origin still equals this sentinel, the path stays on-origin.
+const SSR_SENTINEL_ORIGIN = 'https://internal.invalid';
+
+export function isHrefAllowedByMode(href: string, mode: AllowLinksMode): boolean {
+  switch (mode) {
+    case 'none':
+      return false;
+    case 'all':
+      return true;
+    case 'internal':
+      try {
+        if (!href.startsWith('/')) {
+          const parsed = new URL(href);
+          return parsed.protocol === 'https:' && parsed.hostname === 'wise.com';
+        }
+        const parsed = new URL(href, SSR_SENTINEL_ORIGIN);
+        return parsed.origin === SSR_SENTINEL_ORIGIN;
+      } catch {
+        return false;
+      }
+  }
+}
+
+function isInternalHost(hostname: string): boolean {
+  const stripped = hostname.replace(IPV6_BRACKETS, '');
+  const host = stripped.endsWith('.') ? stripped.slice(0, -1) : stripped;
+  if (NUMERIC_IP.test(host)) return true;
+  if (HEX_IP.test(host)) return true;
+  if (host === '::1' || host === '0:0:0:0:0:0:0:1') return true;
+  if (host === 'localhost') return true;
+  if (host.endsWith('.internal')) return true;
+  return false;
+}

package/src/i18n/hu.json

@@ -23,7 +23,7 @@
   "neptune.Field.characterCount": "Felhasználva {current}/{max} karakter",
   "neptune.FlowNavigation.back": "vissza az előző lépéshez",
   "neptune.Info.ariaLabel": "További információ",
-  "neptune.Label.optional": "(Válaszható)",
+  "neptune.Label.optional": "(Választható)",
   "neptune.Link.opensInNewTab": "(új lapon nyílik meg)",
   "neptune.MoneyInput.Select.placeholder": "Válassz ki egy lehetőséget...",
   "neptune.MoneyInput.Select.searchPlaceholder": "Írj be egy pénznemet vagy országot",

package/src/index.ts

@@ -94,6 +94,7 @@ export type { LegacyListItemProps } from './_deprecated/LegacyListItem';
 export type { LinkProps } from './Link';
 export type { LoaderProps } from './Loader';
 export type { MarkdownProps } from './Markdown';
+export type { MarkupActionHandler, MarkupActions, MarkupNode, MarkupProps } from './Markup';
 export type { ModalProps } from './Modal';
 export type { MoneyProps } from './Money';
 export type {
@@ -253,6 +254,7 @@ export { default as LegacyListItem } from './_deprecated/LegacyListItem';
 export { default as Loader } from './Loader';
 export { default as Logo } from './Logo';
 export { default as Markdown } from './Markdown';
+export { default as Markup } from './Markup';
 export { default as Modal } from './Modal';
 export { default as Money } from './Money';
 export { default as MoneyInput } from './MoneyInput';

package/src/main.css

@@ -30917,6 +30917,41 @@ button.np-link {
   height: var(--wds-logo-height);
 }
 
+.wds-markup-emphasis {
+  font-weight: 600;
+  font-weight: var(--font-weight-semi-bold);
+  font-style: normal;
+}
+
+.wds-markup-emphasis--important {
+  color: #37517e;
+  color: var(--color-content-primary);
+}
+
+.wds-markup-emphasis--positive {
+  color: #008026;
+  color: var(--color-content-positive);
+}
+
+.wds-markup-emphasis--negative {
+  color: #cf2929;
+  color: var(--color-content-negative);
+}
+
+.wds-markup-strong {
+  font-weight: 600;
+  font-weight: var(--font-weight-semi-bold);
+}
+
+.wds-markup-strikethrough {
+  -webkit-text-decoration: line-through;
+  text-decoration: line-through;
+}
+
+.wds-markup-paragraph {
+  margin: 0;
+}
+
 .tw-modal--scrollable {
   max-height: 100%;
   /* mobile viewport bug fix */