@wix/himalaya-cli 0.844.0 → 0.845.0

package/templates/yoga-studio-owner/tier5-src/_shared/aria-chat.ts

@@ -233,25 +233,69 @@ function linkFieldsOf(raw: string, role: string) {
   };
 }
 
-/** The host of an `https://host/…` url, lowercased, or "" if it has none.
+/** A syntactically plain hostname: labels of letters, digits and dashes joined
+ *  by dots, or a bracketed IPv6 literal. Anything else — a backslash, a space,
+ *  a stray `@`, the empty string — means the parse below did not yield a host,
+ *  and a non-host must never be matched against the Wix suffixes: `endsWith` is
+ *  a plain string test, and `evil.example\.wix.com` ends with `.wix.com` while
+ *  the browser opens `evil.example`. */
+const PLAIN_HOST = /^(?:[a-z0-9-]+(?:\.[a-z0-9-]+)*|\[[0-9a-f:.]+\])$/;
+
+/** The host an `https://host/…` url will actually open, lowercased, or "" when
+ *  that cannot be established.
+ *
  *  A regex, not `new URL`: the worker runtimes (JSContext, Hermes, QuickJS) do
- *  not all ship the URL constructor. Credentials before an `@` are ignored, so
- *  `https://manage.wix.com@evil.example/` reads as `evil.example` — the whole
- *  point of showing a host is that it is the one the device will actually open. */
+ *  not all ship the URL constructor. So this has to imitate the URL standard's
+ *  authority parsing closely enough that the host it reports is the host the
+ *  device opens — the entire value of showing a host is that it is the one the
+ *  tap goes to. Two details earn their keep:
+ *
+ *  - Credentials before an `@` are ignored, so
+ *    `https://manage.wix.com@evil.example/` reads as `evil.example`.
+ *  - A BACKSLASH ends the authority, because for http(s) the URL standard
+ *    treats `\` exactly like `/`. Without that, `https://evil.example\@wix.com/`
+ *    reads as `wix.com` here while every browser opens `evil.example` with the
+ *    path `/@wix.com/`. That is exactly the lie this disclosure exists to
+ *    prevent, so the separator set has to match the URL standard's rather than
+ *    RFC 3986's.
+ *
+ *  A string that survives parsing but is not a plain hostname returns "", which
+ *  callers must treat as untrusted rather than as "there is no host here". */
 export function hostOf(url: string): string {
-  const m = /^https?:\/\/([^/?#]*)/i.exec(url.trim());
+  const m = /^https?:\/\/([^/?#\\]*)/i.exec(url.trim());
   if (!m) return "";
   const authority = m[1];
   const at = authority.lastIndexOf("@");
   const hostPort = at >= 0 ? authority.slice(at + 1) : authority;
-  return hostPort.replace(/:\d+$/, "").toLowerCase();
+  const host = hostPort.replace(/:\d+$/, "").toLowerCase();
+  return PLAIN_HOST.test(host) ? host : "";
 }
 
-/** Is this url somewhere Wix itself serves? */
+/** Is this url somewhere Wix itself serves?
+ *
+ *  Guarded by `PLAIN_HOST` first. The suffix tests are string operations, so
+ *  without the guard anything ending in `.wix.com` passes no matter what else
+ *  it contains. `hostOf` already applies the same guard; this repeats it because
+ *  a predicate that decides whether to warn somebody should not depend on its
+ *  caller having sanitized the input. */
 export function isWixHost(host: string): boolean {
+  if (!PLAIN_HOST.test(host)) return false;
   return host === "wix.com" || host.endsWith(".wix.com") || host === "wixsite.com" || host.endsWith(".wixsite.com");
 }
 
+/** Shown in place of a host when an `http(s)` link's host cannot be
+ *  established. Deliberately not domain-shaped: it has to read as "this could
+ *  not be checked", never as a site the owner might think they recognize.
+ *
+ *  KNOWN LIMITATION: this is the one user-facing string here that does not come
+ *  from the copy pack, so it does not localize. It is a literal for the same
+ *  reason the `(host)` parenthetical beside it is: both are appended by a PURE
+ *  function, reached from a pure one, with no copy resolver in scope — and
+ *  threading one through to reach a safety annotation is a larger change than
+ *  the annotation. Route it through copy when this file next has a reason to
+ *  take a resolver, rather than half-threading one now. */
+const UNKNOWN_HOST_LABEL = "unknown site";
+
 /** A link row's label, with the destination host appended when the link leaves
  *  Wix.
  *
@@ -269,8 +313,14 @@ export function isWixHost(host: string): boolean {
  *  is an `/add-sdui-component`-class parity change. */
 export function disclosedLabel(link: { label: string; url: string }): string {
   const host = hostOf(link.url);
-  if (!host || isWixHost(host)) return link.label;
-  return `${link.label} (${host})`;
+  // Silence is reserved for a host positively identified as Wix's. Every link
+  // reaching here came from `extractLinks`, which accepts `http(s)://` only —
+  // so a url whose host cannot be established is a MALFORMED one, not a scheme
+  // with nothing to show, and reading that as "nothing to disclose" is how
+  // `https:///evil.example/` rendered with no host while opening
+  // `evil.example`. Fail closed: unknown is disclosed, never trusted.
+  if (isWixHost(host)) return link.label;
+  return `${link.label} (${host || UNKNOWN_HOST_LABEL})`;
 }
 
 /** Aria replies come back as markdown. There is no native markdown renderer

package/templates/yoga-studio-owner/tier5-src/himi-owner-lite-analytics/index.ts

@@ -39,6 +39,12 @@ import {
   type WixAnalyticsMeasurement,
   type WixMeasure,
 } from "@himalaya/wix-analytics";
+// The REPORTS service — the Semantic Model reporting engine — is the
+// second service in this bundle. Imported for its registration side effect:
+// `defineService` registers at call time and the host resolves
+// `$service:ownerLiteAnalyticsReport` out of that registry. See report.ts for
+// why the two share a bundle and why only this one auto-loads.
+import { svc as reportSvc } from "./report.js";
 
 interface CardRow { id: string; label: string; value: string; delta: string; }
 interface StatRow { id: string; label: string; state: string; }
@@ -549,4 +555,4 @@ const svc = defineService<AnalyticsState, {
 });
 
 svc.load();
-export { svc };
+export { svc, reportSvc };