astro-accelerator 6.0.2 → 6.0.4

package/package.json

@@ -1,5 +1,5 @@
 {
-    "version": "6.0.2",
+    "version": "6.0.4",
     "author": "Steve Fenton",
     "name": "astro-accelerator",
     "description": "A super-lightweight, accessible, SEO-friendly starter project for Astro",
@@ -34,12 +34,12 @@
         "dts": "tsc ./tests/locate-content.js ./tests/locate-navigation.js ./tests/locate-search.js --allowJs --declaration --emitDeclarationOnly"
     },
     "dependencies": {
-        "@astrojs/mdx": "^5.0.0",
+        "@astrojs/mdx": "^5.0.2",
         "@img/sharp-linux-x64": "^0.34.5",
-        "astro": "^6.0.4",
-        "astro-accelerator-utils": "^0.3.74",
+        "astro": "^6.0.8",
+        "astro-accelerator-utils": "^0.3.75",
         "cspell": "^9.7.0",
-        "csv": "^6.4.1",
+        "csv": "^6.5.1",
         "glob": "^13.0.6",
         "hast-util-from-selector": "^3.0.1",
         "html-to-text": "^9.0.5",

package/public/js/modules/click-blocks.js

@@ -33,6 +33,7 @@ function setClickableBlocks() {
 /**
  * Handles the block-level clicks
  *
+ * @this {HTMLElement}
  * @param {Event} e
  * @returns
  */
@@ -40,10 +41,16 @@ function handleClick(e) {
     const location = this.getAttribute(dataAttributeName);
 
     if (location) {
-        e.preventDefault();
-        document.location = location;
-        return false;
+        // Ensure links are same origin
+        const isSafeUrl = location.startsWith('/') || location.startsWith(window.location.origin);
+        
+        if (isSafeUrl) {
+            e.preventDefault();
+            document.location = location;
+            return false;
+        }
     }
 }
 
+
 export { setClickableBlocks };

package/public/js/modules/youtube.js

@@ -9,6 +9,18 @@
 
 import { qsa } from './query.js';
 
+/**
+ * Validates a YouTube video ID.
+ * @param {string | null} id
+ * @returns {boolean}
+ */
+function isValidYoutubeId(id) {
+    if (!id) {
+        return false;
+    }
+    return /^[a-zA-Z0-9_-]{11}$/.test(id);
+}
+
 function enhanceYoutubeLinks() {
     const videos = qsa('a[href^="https://www.youtube.com/watch?v="]');
 
@@ -19,6 +31,11 @@ function enhanceYoutubeLinks() {
         }
 
         const id = new URL(video.href).searchParams.get('v');
+
+        if (!id || !isValidYoutubeId(id)) {
+            continue;
+        }
+
         video.setAttribute('data-youtube', id);
         video.classList.add('init');
         video.setAttribute('role', 'button');
@@ -29,8 +46,12 @@ function enhanceYoutubeLinks() {
         </div>`;
     }
 
+    /**
+     * @param {Event} event
+     */
     function clickHandler(event) {
-        var link = event.target.closest('[data-youtube]');
+        var target = /** @type {HTMLElement} */ (event.target);
+        var link = target && target.closest ? target.closest('[data-youtube]') : null;
 
         if (!link) {
             return;
@@ -39,6 +60,10 @@ function enhanceYoutubeLinks() {
         event.preventDefault();
         var id = link.getAttribute('data-youtube');
 
+        if (!id || !isValidYoutubeId(id)) {
+            return;
+        }
+
         var player = document.createElement('div');
         player.innerHTML = `<iframe class="yt-iframe" width="560" height="315" src="https://www.youtube-nocookie.com/embed/${id}?autoplay=1" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>`;