botframework-webchat-core 4.14.0 → 4.15.1

package/src/selectors/combineSelectors.js

@@ -1,8 +1,16 @@
+import isForbiddenPropertyName from '../utils/isForbiddenPropertyName';
+
 export default function combineSelectors(selectors) {
   if (Array.isArray(selectors)) {
     return state => selectors.reduce((combinedState, selector) => [...combinedState, selector(state)], []);
   }
 
   return state =>
-    Object.keys(selectors).reduce((combinedState, key) => ({ ...combinedState, [key]: selectors[key](state) }), {});
+    Object.keys(selectors).reduce(
+      (combinedState, key) =>
+        // Mitigated through denylisting.
+        // eslint-disable-next-line security/detect-object-injection
+        isForbiddenPropertyName(key) ? combinedState : { ...combinedState, [key]: selectors[key](state) },
+      {}
+    );
 }

package/src/types/external/DirectLineActivity.ts

@@ -1,5 +1,7 @@
 // TODO: [P1] #3953 We should fully type it out.
 
-type DirectLineActivity = any;
+// Until we fully typed out DirectLineActivity, we need to use "any" here.
+// We only know the DirectLineActivity must be a map, and not other primitive types.
+type DirectLineActivity = Exclude<any, [] | boolean | Function | number | string>;
 
 export default DirectLineActivity;

package/src/types/external/DirectLineCardAction.ts

@@ -1,5 +1,128 @@
-// TODO: [P1] #3953 We should fully type it out.
+type CardActionWithImageAndTitle =
+  | { image: string }
+  | { title: string }
+  | {
+      image: string;
+      title: string;
+    };
 
-type DirectLineCardAction = any;
+/**
+ * A `call` action represents a telephone number that may be called.
+ *
+ * https://github.com/Microsoft/botframework-sdk/blob/main/specs/botframework-activity/botframework-activity.md#call
+ */
+type CallCardAction = CardActionWithImageAndTitle & {
+  type: 'call';
+  value: string;
+};
+
+/**
+ * A `downloadFile` action represents a hyperlink to be downloaded.
+ *
+ * https://github.com/Microsoft/botframework-sdk/blob/main/specs/botframework-activity/botframework-activity.md#download-file-actions
+ */
+type DownloadFileCardAction = CardActionWithImageAndTitle & {
+  type: 'downloadFile';
+  value: string;
+};
+
+/**
+ * An `imBack` action represents a text response that is added to the chat feed.
+ *
+ * https://github.com/Microsoft/botframework-sdk/blob/main/specs/botframework-activity/botframework-activity.md#im-back
+ */
+type IMBackCardAction = CardActionWithImageAndTitle & {
+  type: 'imBack';
+  value: string;
+};
+
+/**
+ * A `messageBack` action represents a text response to be sent via the chat system.
+ *
+ * https://github.com/Microsoft/botframework-sdk/blob/main/specs/botframework-activity/botframework-activity.md#message-back
+ */
+type MessageBackCardAction = CardActionWithImageAndTitle & {
+  displayText?: string;
+  text?: string;
+  type: 'messageBack';
+  value?: { [key: string]: any };
+};
+
+/**
+ * An `openUrl` action represents a hyperlink to be handled by the client.
+ *
+ * https://github.com/Microsoft/botframework-sdk/blob/main/specs/botframework-activity/botframework-activity.md#open-url-actions
+ */
+type OpenURLCardAction = CardActionWithImageAndTitle & {
+  type: 'openUrl';
+  value: string;
+};
+
+/**
+ * A `playAudio` action represents audio media that may be played.
+ *
+ * https://github.com/Microsoft/botframework-sdk/blob/main/specs/botframework-activity/botframework-activity.md#play-audio
+ */
+type PlayAudioCardAction = CardActionWithImageAndTitle & {
+  type: 'playAudio';
+  value: string;
+};
+
+/**
+ * A `playVideo` action represents video media that may be played.
+ *
+ * https://github.com/Microsoft/botframework-sdk/blob/main/specs/botframework-activity/botframework-activity.md#play-video
+ */
+type PlayVideoCardAction = CardActionWithImageAndTitle & {
+  type: 'playVideo';
+  value: string;
+};
+
+/**
+ * A `postBack` action represents a text response that is not added to the chat feed.
+ *
+ * https://github.com/Microsoft/botframework-sdk/blob/main/specs/botframework-activity/botframework-activity.md#post-back
+ */
+type PostBackCardAction = CardActionWithImageAndTitle & {
+  type: 'postBack';
+  value: any; // For legacy reason, postBack support any.
+};
+
+/**
+ * A `showImage` action represents an image that may be displayed.
+ *
+ * https://github.com/Microsoft/botframework-sdk/blob/main/specs/botframework-activity/botframework-activity.md#show-image-file-actions
+ */
+type ShowImageCardAction = CardActionWithImageAndTitle & {
+  type: 'showImage';
+  value: string;
+};
+
+/**
+ * A `signin` action represents a hyperlink to be handled by the client's signin system.
+ *
+ * https://github.com/Microsoft/botframework-sdk/blob/main/specs/botframework-activity/botframework-activity.md#signin
+ */
+type SignInCardAction = CardActionWithImageAndTitle & {
+  type: 'signin';
+  value: string;
+};
+
+/**
+ * A card action represents a clickable or interactive button for use within cards or as suggested actions. They are used to solicit input from users. Despite their name, card actions are not limited to use solely on cards.
+ *
+ * https://github.com/Microsoft/botframework-sdk/blob/main/specs/botframework-activity/botframework-activity.md#card-action
+ */
+type DirectLineCardAction =
+  | CallCardAction
+  | DownloadFileCardAction
+  | IMBackCardAction
+  | MessageBackCardAction
+  | OpenURLCardAction
+  | PlayAudioCardAction
+  | PlayVideoCardAction
+  | PostBackCardAction
+  | ShowImageCardAction
+  | SignInCardAction;
 
 export default DirectLineCardAction;

package/src/utils/dateToLocaleISOString.chatham.spec.js

@@ -6,6 +6,7 @@
 import dateToLocaleISOString from './dateToLocaleISOString';
 
 test('formatting a time in Chatham Islands timezone', () => {
+  // eslint-disable-next-line no-magic-numbers
   const date = new Date(Date.UTC(2000, 0, 1, 0, 12, 34, 567));
   const actual = dateToLocaleISOString(date);
 

package/src/utils/dateToLocaleISOString.japan.spec.js

@@ -6,6 +6,7 @@
 import dateToLocaleISOString from './dateToLocaleISOString';
 
 test('formatting a time in Japan timezone', () => {
+  // eslint-disable-next-line no-magic-numbers
   const date = new Date(Date.UTC(2000, 0, 1, 0, 12, 34, 567));
   const actual = dateToLocaleISOString(date);
 

package/src/utils/dateToLocaleISOString.pacific.spec.js

@@ -6,6 +6,7 @@
 import dateToLocaleISOString from './dateToLocaleISOString';
 
 test('formatting a time in Pacific Standard Time timezone', () => {
+  // eslint-disable-next-line no-magic-numbers
   const date = new Date(Date.UTC(2000, 0, 1, 0, 12, 34, 567));
   const actual = dateToLocaleISOString(date);
 

package/src/utils/dateToLocaleISOString.utc.spec.js

@@ -6,6 +6,7 @@
 import dateToLocaleISOString from './dateToLocaleISOString';
 
 test('formatting a time in UTC timezone', () => {
+  // eslint-disable-next-line no-magic-numbers
   const date = new Date(Date.UTC(2000, 0, 1, 0, 12, 34, 567));
   const actual = dateToLocaleISOString(date);
 
@@ -13,6 +14,7 @@ test('formatting a time in UTC timezone', () => {
 });
 
 test('formatting a time in UTC timezone with zero milliseconds', () => {
+  // eslint-disable-next-line no-magic-numbers
   const date = new Date(Date.UTC(2000, 0, 1, 0, 12, 34, 0));
   const actual = dateToLocaleISOString(date);
 

package/src/utils/deleteKey.js

@@ -1,11 +1,9 @@
-/* eslint no-unused-vars: ["error", { "varsIgnorePattern": "^deleted$" }] */
-
 export default function deleteKey(map, key) {
   if (!map) {
     return map;
   }
 
-  const { [key]: deleted, ...nextMap } = map;
+  const { [key]: _deleted, ...nextMap } = map;
 
   return nextMap;
 }

package/src/utils/isForbiddenPropertyName.spec.js

@@ -0,0 +1,6 @@
+import isForbiddenPropertyName from './isForbiddenPropertyName';
+
+test('should forbid "__proto__"', () => expect(isForbiddenPropertyName('__proto__')).toBeTruthy());
+test('should forbid "constructor"', () => expect(isForbiddenPropertyName('constructor')).toBeTruthy());
+test('should forbid "prototype"', () => expect(isForbiddenPropertyName('prototype')).toBeTruthy());
+test('should not forbid "abc"', () => expect(isForbiddenPropertyName('abc')).toBeFalsy());

package/src/utils/isForbiddenPropertyName.ts

@@ -0,0 +1,33 @@
+let FORBIDDEN_PROPERTY_NAMES;
+
+function getForbiddenPropertyNames(): string[] {
+  return (
+    FORBIDDEN_PROPERTY_NAMES ||
+    (FORBIDDEN_PROPERTY_NAMES = Object.freeze(
+      Array.from(
+        new Set([
+          // As-of writing, `Object.prototype` includes:
+          //   __defineGetter__
+          //   __defineSetter__
+          //   __lookupGetter__
+          //   __lookupSetter
+          //   __proto__
+          //   constructor
+          //   hasOwnProperty
+          //   isPrototypeOf
+          //   propertyIsEnumerable
+          //   toLocaleString
+          //   toString
+          //   valueOf
+          ...Object.getOwnPropertyNames(Object.prototype),
+
+          'prototype'
+        ])
+      )
+    ))
+  );
+}
+
+export default function isForbiddenPropertyName(propertyName: string): boolean {
+  return getForbiddenPropertyNames().includes(propertyName);
+}

package/src/utils/mime-wrapper.js

@@ -1,5 +1,4 @@
-/* eslint no-undef: "off"*/
-/* eslint node/global-require: "off"*/
+/* eslint no-undef: "off" */
 
 // We adopted the work from mime-wrapper, at https://github.com/marlon360/mime-wrapper.
 

package/src/utils/uniqueID.js

@@ -3,10 +3,5 @@
 import random from 'math-random';
 
 export default function uniqueID() {
-  return (
-    Date.now() +
-    random()
-      .toString(36)
-      .substr(2)
-  );
+  return Date.now() + random().toString(36).substr(2);
 }

package/.eslintignore

@@ -1,9 +0,0 @@
-/src/__tests__/**/*
-/src/**/*.spec.js
-/src/**/*.spec.jsx
-/src/**/*.spec.ts
-/src/**/*.spec.tsx
-/src/**/*.test.js
-/src/**/*.test.jsx
-/src/**/*.test.ts
-/src/**/*.test.tsx