@uniformdev/canvas-next 18.34.0 → 18.35.1-alpha.12

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/dist/index.esm.js +7 -2
  2. package/dist/index.js +7 -2
  3. package/dist/index.mjs +7 -2
  4. package/package.json +7 -7
package/dist/index.esm.js CHANGED
@@ -18,6 +18,7 @@ var createPreviewHandlerGet = ({ secret, resolveFullPath = resolveFullPathDefaul
18
18
  const path = getQueryParam(req, "path");
19
19
  const locale = getQueryParam(req, "locale");
20
20
  const pathToRedirectTo = resolveFullPath({ id, slug, path, locale });
21
+ validateLocalRedirectUrl(pathToRedirectTo);
21
22
  if (!pathToRedirectTo) {
22
23
  return res.status(400).json({ message: "Could not resolve the full path of the preview page" });
23
24
  }
@@ -63,9 +64,13 @@ var createPreviewHandlerGet = ({ secret, resolveFullPath = resolveFullPathDefaul
63
64
  res.redirect(urlToRedirectTo);
64
65
  };
65
66
  var resolveFullPathDefault = ({ slug, path }) => {
66
- const pathToRedirectTo = path || slug;
67
- return pathToRedirectTo != null ? pathToRedirectTo : "";
67
+ return path || slug;
68
68
  };
69
+ function validateLocalRedirectUrl(pathToRedirectTo) {
70
+ if (pathToRedirectTo == null ? void 0 : pathToRedirectTo.match(/^[a-z]+:\/\//g)) {
71
+ throw new Error("Tried to redirect to absolute URL with protocol. Disallowing open redirect.");
72
+ }
73
+ }
69
74
 
70
75
  // src/preview/previewHandlerPost.ts
71
76
  import { generateHash } from "@uniformdev/canvas";
package/dist/index.js CHANGED
@@ -53,6 +53,7 @@ var createPreviewHandlerGet = ({ secret, resolveFullPath = resolveFullPathDefaul
53
53
  const path = getQueryParam(req, "path");
54
54
  const locale = getQueryParam(req, "locale");
55
55
  const pathToRedirectTo = resolveFullPath({ id, slug, path, locale });
56
+ validateLocalRedirectUrl(pathToRedirectTo);
56
57
  if (!pathToRedirectTo) {
57
58
  return res.status(400).json({ message: "Could not resolve the full path of the preview page" });
58
59
  }
@@ -98,9 +99,13 @@ var createPreviewHandlerGet = ({ secret, resolveFullPath = resolveFullPathDefaul
98
99
  res.redirect(urlToRedirectTo);
99
100
  };
100
101
  var resolveFullPathDefault = ({ slug, path }) => {
101
- const pathToRedirectTo = path || slug;
102
- return pathToRedirectTo != null ? pathToRedirectTo : "";
102
+ return path || slug;
103
103
  };
104
+ function validateLocalRedirectUrl(pathToRedirectTo) {
105
+ if (pathToRedirectTo == null ? void 0 : pathToRedirectTo.match(/^[a-z]+:\/\//g)) {
106
+ throw new Error("Tried to redirect to absolute URL with protocol. Disallowing open redirect.");
107
+ }
108
+ }
104
109
 
105
110
  // src/preview/previewHandlerPost.ts
106
111
  var import_canvas2 = require("@uniformdev/canvas");
package/dist/index.mjs CHANGED
@@ -18,6 +18,7 @@ var createPreviewHandlerGet = ({ secret, resolveFullPath = resolveFullPathDefaul
18
18
  const path = getQueryParam(req, "path");
19
19
  const locale = getQueryParam(req, "locale");
20
20
  const pathToRedirectTo = resolveFullPath({ id, slug, path, locale });
21
+ validateLocalRedirectUrl(pathToRedirectTo);
21
22
  if (!pathToRedirectTo) {
22
23
  return res.status(400).json({ message: "Could not resolve the full path of the preview page" });
23
24
  }
@@ -63,9 +64,13 @@ var createPreviewHandlerGet = ({ secret, resolveFullPath = resolveFullPathDefaul
63
64
  res.redirect(urlToRedirectTo);
64
65
  };
65
66
  var resolveFullPathDefault = ({ slug, path }) => {
66
- const pathToRedirectTo = path || slug;
67
- return pathToRedirectTo != null ? pathToRedirectTo : "";
67
+ return path || slug;
68
68
  };
69
+ function validateLocalRedirectUrl(pathToRedirectTo) {
70
+ if (pathToRedirectTo == null ? void 0 : pathToRedirectTo.match(/^[a-z]+:\/\//g)) {
71
+ throw new Error("Tried to redirect to absolute URL with protocol. Disallowing open redirect.");
72
+ }
73
+ }
69
74
 
70
75
  // src/preview/previewHandlerPost.ts
71
76
  import { generateHash } from "@uniformdev/canvas";
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@uniformdev/canvas-next",
3
- "version": "18.34.0",
3
+ "version": "18.35.1-alpha.12+d5e86f567",
4
4
  "description": "Next.js SDK for Uniform Canvas",
5
5
  "license": "SEE LICENSE IN LICENSE.txt",
6
6
  "main": "./dist/index.js",
@@ -53,9 +53,9 @@
53
53
  "document": "api-extractor run --local"
54
54
  },
55
55
  "dependencies": {
56
- "@uniformdev/canvas": "18.34.0",
57
- "@uniformdev/canvas-react": "18.34.0",
58
- "@uniformdev/project-map": "18.34.0"
56
+ "@uniformdev/canvas": "18.35.1-alpha.12+d5e86f567",
57
+ "@uniformdev/canvas-react": "18.35.1-alpha.12+d5e86f567",
58
+ "@uniformdev/project-map": "18.35.1-alpha.12+d5e86f567"
59
59
  },
60
60
  "peerDependencies": {
61
61
  "next": ">= 12.0.0",
@@ -63,8 +63,8 @@
63
63
  "react-dom": ">=16"
64
64
  },
65
65
  "devDependencies": {
66
- "@types/react": "18.0.31",
67
- "next": "13.2.4",
66
+ "@types/react": "18.0.33",
67
+ "next": "13.3.0",
68
68
  "react": "18.2.0",
69
69
  "react-dom": "18.2.0"
70
70
  },
@@ -74,5 +74,5 @@
74
74
  "publishConfig": {
75
75
  "access": "public"
76
76
  },
77
- "gitHead": "563ab31aa4308102c988bea321028e73efe836d0"
77
+ "gitHead": "d5e86f5673575aecfcf517e684922871315f279b"
78
78
  }