@wise/dynamic-flow-client 5.22.0 → 5.22.2

package/build/main.js

@@ -1313,6 +1313,15 @@ var makeDismissHandler = (onDismiss, mapperProps) => () => {
   });
 };
 
+// src/utils/safe-parse-link.ts
+var safeParseLink = (url) => {
+  const parsed = URL.parse(url);
+  if ((parsed == null ? void 0 : parsed.protocol) === "javascript:") {
+    throw new Error("Javascript URLs are not allowed");
+  }
+  return url;
+};
+
 // src/domain/mappers/utils/behavior-utils.ts
 var getDomainLayerBehavior = ({ action, behavior: specBehavior }, stepActions, registerSubmissionBehavior) => {
   if (specBehavior) {
@@ -1336,13 +1345,32 @@ var normaliseBehavior = (behavior, stepActions) => {
         onError: behavior.onError ? normaliseBehavior(behavior.onError, stepActions) : void 0
       });
     }
+    if (behavior.type === "delay") {
+      return {
+        type: "none",
+        track: false
+      };
+    }
+    if (behavior.type === "dispatch-event") {
+      return {
+        type: "none",
+        track: false
+      };
+    }
+    if (behavior.type === "link") {
+      return __spreadProps(__spreadValues({}, behavior), {
+        type: "link",
+        url: safeParseLink(behavior.url),
+        track: true
+      });
+    }
     return __spreadProps(__spreadValues({}, behavior), { track: true });
   }
   if ("action" in behavior && behavior.action) {
     return actionToBehavior(behavior.action, stepActions);
   }
   if ("link" in behavior && behavior.link) {
-    return { type: "link", url: behavior.link.url, track: true };
+    return { type: "link", url: safeParseLink(behavior.link.url), track: true };
   }
   return { type: "none", track: false };
 };
@@ -1718,9 +1746,15 @@ var mergeSections = (existing, incoming) => {
   const knownIds = new Set(existing.map((section) => section.id));
   const newSections = incoming.filter((section) => !knownIds.has(section.id));
   const merged = existing.map((section) => {
+    var _a, _b;
     const match = incoming.find((s) => s.id === section.id);
     if (!match) return section;
-    return __spreadProps(__spreadValues({}, match), { items: [...section.items, ...match.items] });
+    return {
+      id: match.id,
+      title: (_a = match.title) != null ? _a : section.title,
+      callToAction: (_b = match.callToAction) != null ? _b : section.callToAction,
+      items: [...section.items, ...match.items]
+    };
   });
   return [...merged, ...newSections];
 };
@@ -6924,7 +6958,7 @@ var getExternalConfiguration = (uid, external, onLoad, mapperProps) => {
   if (onLoad.type === "link") {
     return createExternalConfirmation(
       `${uid}-external-confirmation`,
-      onLoad == null ? void 0 : onLoad.url,
+      safeParseLink(onLoad.url),
       mapperProps.onLink,
       mapperProps.onComponentUpdate
     );
@@ -6932,7 +6966,7 @@ var getExternalConfiguration = (uid, external, onLoad, mapperProps) => {
   if ((external == null ? void 0 : external.url) && onLoad.type === "none") {
     return createExternalConfirmation(
       `${uid}-external-confirmation`,
-      external == null ? void 0 : external.url,
+      safeParseLink(external.url),
       mapperProps.onLink,
       mapperProps.onComponentUpdate
     );

package/build/main.mjs

@@ -1282,6 +1282,15 @@ var makeDismissHandler = (onDismiss, mapperProps) => () => {
   });
 };
 
+// src/utils/safe-parse-link.ts
+var safeParseLink = (url) => {
+  const parsed = URL.parse(url);
+  if ((parsed == null ? void 0 : parsed.protocol) === "javascript:") {
+    throw new Error("Javascript URLs are not allowed");
+  }
+  return url;
+};
+
 // src/domain/mappers/utils/behavior-utils.ts
 var getDomainLayerBehavior = ({ action, behavior: specBehavior }, stepActions, registerSubmissionBehavior) => {
   if (specBehavior) {
@@ -1305,13 +1314,32 @@ var normaliseBehavior = (behavior, stepActions) => {
         onError: behavior.onError ? normaliseBehavior(behavior.onError, stepActions) : void 0
       });
     }
+    if (behavior.type === "delay") {
+      return {
+        type: "none",
+        track: false
+      };
+    }
+    if (behavior.type === "dispatch-event") {
+      return {
+        type: "none",
+        track: false
+      };
+    }
+    if (behavior.type === "link") {
+      return __spreadProps(__spreadValues({}, behavior), {
+        type: "link",
+        url: safeParseLink(behavior.url),
+        track: true
+      });
+    }
     return __spreadProps(__spreadValues({}, behavior), { track: true });
   }
   if ("action" in behavior && behavior.action) {
     return actionToBehavior(behavior.action, stepActions);
   }
   if ("link" in behavior && behavior.link) {
-    return { type: "link", url: behavior.link.url, track: true };
+    return { type: "link", url: safeParseLink(behavior.link.url), track: true };
   }
   return { type: "none", track: false };
 };
@@ -1687,9 +1715,15 @@ var mergeSections = (existing, incoming) => {
   const knownIds = new Set(existing.map((section) => section.id));
   const newSections = incoming.filter((section) => !knownIds.has(section.id));
   const merged = existing.map((section) => {
+    var _a, _b;
     const match = incoming.find((s) => s.id === section.id);
     if (!match) return section;
-    return __spreadProps(__spreadValues({}, match), { items: [...section.items, ...match.items] });
+    return {
+      id: match.id,
+      title: (_a = match.title) != null ? _a : section.title,
+      callToAction: (_b = match.callToAction) != null ? _b : section.callToAction,
+      items: [...section.items, ...match.items]
+    };
   });
   return [...merged, ...newSections];
 };
@@ -6893,7 +6927,7 @@ var getExternalConfiguration = (uid, external, onLoad, mapperProps) => {
   if (onLoad.type === "link") {
     return createExternalConfirmation(
       `${uid}-external-confirmation`,
-      onLoad == null ? void 0 : onLoad.url,
+      safeParseLink(onLoad.url),
       mapperProps.onLink,
       mapperProps.onComponentUpdate
     );
@@ -6901,7 +6935,7 @@ var getExternalConfiguration = (uid, external, onLoad, mapperProps) => {
   if ((external == null ? void 0 : external.url) && onLoad.type === "none") {
     return createExternalConfirmation(
       `${uid}-external-confirmation`,
-      external == null ? void 0 : external.url,
+      safeParseLink(external.url),
       mapperProps.onLink,
       mapperProps.onComponentUpdate
     );