botframework-webchat-core 4.14.1 → 4.15.0

package/src/selectors/combineSelectors.js

@@ -1,8 +1,16 @@
+import isForbiddenPropertyName from '../utils/isForbiddenPropertyName';
+
 export default function combineSelectors(selectors) {
   if (Array.isArray(selectors)) {
     return state => selectors.reduce((combinedState, selector) => [...combinedState, selector(state)], []);
   }
 
   return state =>
-    Object.keys(selectors).reduce((combinedState, key) => ({ ...combinedState, [key]: selectors[key](state) }), {});
+    Object.keys(selectors).reduce(
+      (combinedState, key) =>
+        // Mitigated through denylisting.
+        // eslint-disable-next-line security/detect-object-injection
+        isForbiddenPropertyName(key) ? combinedState : { ...combinedState, [key]: selectors[key](state) },
+      {}
+    );
 }

package/src/types/external/DirectLineActivity.ts

@@ -1,6 +1,7 @@
 // TODO: [P1] #3953 We should fully type it out.
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-type DirectLineActivity = any;
+// Until we fully typed out DirectLineActivity, we need to use "any" here.
+// We only know the DirectLineActivity must be a map, and not other primitive types.
+type DirectLineActivity = Exclude<any, [] | boolean | Function | number | string>;
 
 export default DirectLineActivity;

package/src/types/external/DirectLineAnimationCard.ts

@@ -1,6 +1,5 @@
 // TODO: [P1] #3953 We should fully type it out.
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 type DirectLineAnimationCard = any;
 
 export default DirectLineAnimationCard;

package/src/types/external/DirectLineAttachment.ts

@@ -1,6 +1,5 @@
 // TODO: [P1] #3953 We should fully type it out.
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 type DirectLineAttachment = any;
 
 export default DirectLineAttachment;

package/src/types/external/DirectLineAudioCard.ts

@@ -1,6 +1,5 @@
 // TODO: [P1] #3953 We should fully type it out.
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 type DirectLineAudioCard = any;
 
 export default DirectLineAudioCard;

package/src/types/external/DirectLineHeroCard.ts

@@ -1,6 +1,5 @@
 // TODO: [P1] #3953 We should fully type it out.
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 type DirectLineHeroCard = any;
 
 export default DirectLineHeroCard;

package/src/types/external/DirectLineJSBotConnection.ts

@@ -1,6 +1,5 @@
 // TODO: [P1] #3953 We should fully type it out.
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 type DirectLineJSBotConnection = any;
 
 export default DirectLineJSBotConnection;

package/src/types/external/DirectLineOAuthCard.ts

@@ -1,6 +1,5 @@
 // TODO: [P1] #3953 We should fully type it out.
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 type DirectLineOAuthCard = any;
 
 export default DirectLineOAuthCard;

package/src/types/external/DirectLineReceiptCard.ts

@@ -1,6 +1,5 @@
 // TODO: [P1] #3953 We should fully type it out.
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 type DirectLineReceiptCard = any;
 
 export default DirectLineReceiptCard;

package/src/types/external/DirectLineSignInCard.ts

@@ -1,6 +1,5 @@
 // TODO: [P1] #3953 We should fully type it out.
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 type DirectLineSignInCard = any;
 
 export default DirectLineSignInCard;

package/src/types/external/DirectLineSuggestedAction.ts

@@ -1,6 +1,5 @@
 // TODO: [P1] #3953 We should fully type it out.
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 type DirectLineSuggestedAction = any;
 
 export default DirectLineSuggestedAction;

package/src/types/external/DirectLineThumbnailCard.ts

@@ -1,6 +1,5 @@
 // TODO: [P1] #3953 We should fully type it out.
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 type DirectLineThumbnailCard = any;
 
 export default DirectLineThumbnailCard;

package/src/types/external/DirectLineVideoCard.ts

@@ -1,6 +1,5 @@
 // TODO: [P1] #3953 We should fully type it out.
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 type DirectLineVideoCard = any;
 
 export default DirectLineVideoCard;

package/src/utils/dateToLocaleISOString.chatham.spec.js

@@ -6,6 +6,7 @@
 import dateToLocaleISOString from './dateToLocaleISOString';
 
 test('formatting a time in Chatham Islands timezone', () => {
+  // eslint-disable-next-line no-magic-numbers
   const date = new Date(Date.UTC(2000, 0, 1, 0, 12, 34, 567));
   const actual = dateToLocaleISOString(date);
 

package/src/utils/dateToLocaleISOString.japan.spec.js

@@ -6,6 +6,7 @@
 import dateToLocaleISOString from './dateToLocaleISOString';
 
 test('formatting a time in Japan timezone', () => {
+  // eslint-disable-next-line no-magic-numbers
   const date = new Date(Date.UTC(2000, 0, 1, 0, 12, 34, 567));
   const actual = dateToLocaleISOString(date);
 

package/src/utils/dateToLocaleISOString.pacific.spec.js

@@ -6,6 +6,7 @@
 import dateToLocaleISOString from './dateToLocaleISOString';
 
 test('formatting a time in Pacific Standard Time timezone', () => {
+  // eslint-disable-next-line no-magic-numbers
   const date = new Date(Date.UTC(2000, 0, 1, 0, 12, 34, 567));
   const actual = dateToLocaleISOString(date);
 

package/src/utils/dateToLocaleISOString.utc.spec.js

@@ -6,6 +6,7 @@
 import dateToLocaleISOString from './dateToLocaleISOString';
 
 test('formatting a time in UTC timezone', () => {
+  // eslint-disable-next-line no-magic-numbers
   const date = new Date(Date.UTC(2000, 0, 1, 0, 12, 34, 567));
   const actual = dateToLocaleISOString(date);
 
@@ -13,6 +14,7 @@ test('formatting a time in UTC timezone', () => {
 });
 
 test('formatting a time in UTC timezone with zero milliseconds', () => {
+  // eslint-disable-next-line no-magic-numbers
   const date = new Date(Date.UTC(2000, 0, 1, 0, 12, 34, 0));
   const actual = dateToLocaleISOString(date);
 

package/src/utils/deleteKey.js

@@ -1,11 +1,9 @@
-/* eslint no-unused-vars: ["error", { "varsIgnorePattern": "^deleted$" }] */
-
 export default function deleteKey(map, key) {
   if (!map) {
     return map;
   }
 
-  const { [key]: deleted, ...nextMap } = map;
+  const { [key]: _deleted, ...nextMap } = map;
 
   return nextMap;
 }

package/src/utils/isForbiddenPropertyName.spec.js

@@ -0,0 +1,6 @@
+import isForbiddenPropertyName from './isForbiddenPropertyName';
+
+test('should forbid "__proto__"', () => expect(isForbiddenPropertyName('__proto__')).toBeTruthy());
+test('should forbid "constructor"', () => expect(isForbiddenPropertyName('constructor')).toBeTruthy());
+test('should forbid "prototype"', () => expect(isForbiddenPropertyName('prototype')).toBeTruthy());
+test('should not forbid "abc"', () => expect(isForbiddenPropertyName('abc')).toBeFalsy());

package/src/utils/isForbiddenPropertyName.ts

@@ -0,0 +1,33 @@
+let FORBIDDEN_PROPERTY_NAMES;
+
+function getForbiddenPropertyNames(): string[] {
+  return (
+    FORBIDDEN_PROPERTY_NAMES ||
+    (FORBIDDEN_PROPERTY_NAMES = Object.freeze(
+      Array.from(
+        new Set([
+          // As-of writing, `Object.prototype` includes:
+          //   __defineGetter__
+          //   __defineSetter__
+          //   __lookupGetter__
+          //   __lookupSetter
+          //   __proto__
+          //   constructor
+          //   hasOwnProperty
+          //   isPrototypeOf
+          //   propertyIsEnumerable
+          //   toLocaleString
+          //   toString
+          //   valueOf
+          ...Object.getOwnPropertyNames(Object.prototype),
+
+          'prototype'
+        ])
+      )
+    ))
+  );
+}
+
+export default function isForbiddenPropertyName(propertyName: string): boolean {
+  return getForbiddenPropertyNames().includes(propertyName);
+}

package/src/utils/mime-wrapper.js

@@ -1,5 +1,4 @@
-/* eslint no-undef: "off"*/
-/* eslint node/global-require: "off"*/
+/* eslint no-undef: "off" */
 
 // We adopted the work from mime-wrapper, at https://github.com/marlon360/mime-wrapper.
 

package/src/utils/uniqueID.js

@@ -3,10 +3,5 @@
 import random from 'math-random';
 
 export default function uniqueID() {
-  return (
-    Date.now() +
-    random()
-      .toString(36)
-      .substr(2)
-  );
+  return Date.now() + random().toString(36).substr(2);
 }

package/.eslintignore

@@ -1,9 +0,0 @@
-/src/__tests__/**/*
-/src/**/*.spec.js
-/src/**/*.spec.jsx
-/src/**/*.spec.ts
-/src/**/*.spec.tsx
-/src/**/*.test.js
-/src/**/*.test.jsx
-/src/**/*.test.ts
-/src/**/*.test.tsx