cozy-sharing 4.1.2 → 4.1.3

package/CHANGELOG.md

@@ -3,6 +3,17 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [4.1.3](https://github.com/cozy/cozy-libs/compare/cozy-sharing@4.1.2...cozy-sharing@4.1.3) (2022-02-21)
+
+
+### Bug Fixes
+
+* **sharing:** Escape public name in public cozy2cozy view ([b5af978](https://github.com/cozy/cozy-libs/commit/b5af978e6f349819b8f76e097f328a87a6c18912))
+
+
+
+
+
 ## [4.1.2](https://github.com/cozy/cozy-libs/compare/cozy-sharing@4.1.1...cozy-sharing@4.1.2) (2022-02-18)
 
 

package/dist/SharingBanner/components/PublicBanner.js

@@ -29,19 +29,21 @@ var PublicBannerCozyToCozyContent = function PublicBannerCozyToCozyContent(_ref)
   var knowMore = /*#__PURE__*/React.createElement("a", {
     href: "https://cozy.io",
     target: "_blank",
-    className: 'u-link',
+    className: "u-link",
     rel: "noopener noreferrer"
   }, t('Share.banner.know_more'));
   var withAvatar = snarkdown(t('Share.banner.shared_from', {
     name: name,
     image: avatarURL
   }));
+  var beginning = withAvatar.split('<img src');
+  var translated = beginning[1].split('alt="avatar">');
   return /*#__PURE__*/React.createElement(React.Fragment, null, /*#__PURE__*/React.createElement("span", {
-    className: styles['bannermarkdown'],
-    dangerouslySetInnerHTML: {
-      __html: withAvatar
-    }
-  }), /*#__PURE__*/React.createElement("span", null, ' ', text, " ", knowMore));
+    className: styles['bannermarkdown']
+  }, beginning[0], /*#__PURE__*/React.createElement("img", {
+    src: avatarURL,
+    alt: "avatar"
+  }), translated[1]), /*#__PURE__*/React.createElement("span", null, ' ', text, " ", knowMore));
 };
 
 PublicBannerCozyToCozyContent.propTypes = {

package/dist/SharingBanner/components/PublicBanner.spec.js

@@ -0,0 +1,47 @@
+import React from 'react';
+import { render } from '@testing-library/react';
+import { SharingBannerCozyToCozy } from './PublicBanner';
+import { useI18n } from 'cozy-ui/transpiled/react/I18n';
+import { useClient } from 'cozy-client';
+jest.mock('cozy-ui/transpiled/react/I18n');
+jest.mock('cozy-client');
+describe('PublicBanner', function () {
+  beforeEach(function () {
+    useClient.mockReturnValue({
+      options: {
+        uri: 'http://cozy.localhost:8080'
+      }
+    });
+  });
+  it('should not add dangerous html', function () {
+    // Given
+    useI18n.mockReturnValue({
+      t: function t(localeToTranslate, options) {
+        if (localeToTranslate === 'Share.banner.shared_from') {
+          return "Shared from ![avatar](".concat(options.image, ") ").concat(options.name, "'s cozy.");
+        }
+
+        return localeToTranslate;
+      }
+    });
+    var publicName = '[Click me!](https://evil.com)';
+    var sharing = {
+      attributes: {
+        members: [{
+          public_name: publicName
+        }]
+      }
+    }; // When
+
+    var _render = render( /*#__PURE__*/React.createElement(SharingBannerCozyToCozy, {
+      sharing: sharing,
+      isSharingShortcutCreated: true,
+      discoveryLink: 'discoveryLink',
+      onClose: function onClose() {}
+    })),
+        container = _render.container; // Then
+
+
+    expect(container.querySelector('.bannermarkdown').innerHTML).toEqual("Shared from <img src=\"http://cozy.localhost:8080/public/avatar?fallback=initials\" alt=\"avatar\"> &lt;a href=\"https://evil.com\"&gt;Click me!&lt;/a&gt;'s cozy.");
+  });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cozy-sharing",
-  "version": "4.1.2",
+  "version": "4.1.3",
   "description": "Provides sharing login for React applications.",
   "main": "dist/index.js",
   "author": "Cozy",
@@ -61,5 +61,5 @@
   "sideEffects": [
     "*.css"
   ],
-  "gitHead": "3bfcea11a7a0d354b5feabc3d4a2655345eee2ee"
+  "gitHead": "d248d58ef7828f260799b3dfce1451ebb40ae994"
 }

package/src/SharingBanner/components/PublicBanner.jsx

@@ -30,24 +30,28 @@ const PublicBannerCozyToCozyContent = ({
     <a
       href="https://cozy.io"
       target="_blank"
-      className={'u-link'}
+      className="u-link"
       rel="noopener noreferrer"
     >
       {t('Share.banner.know_more')}
     </a>
   )
+
   const withAvatar = snarkdown(
     t('Share.banner.shared_from', {
       name: name,
       image: avatarURL
     })
   )
+  const beginning = withAvatar.split('<img src')
+  const translated = beginning[1].split('alt="avatar">')
   return (
     <>
-      <span
-        className={styles['bannermarkdown']}
-        dangerouslySetInnerHTML={{ __html: withAvatar }}
-      />
+      <span className={styles['bannermarkdown']}>
+        {beginning[0]}
+        <img src={avatarURL} alt="avatar" />
+        {translated[1]}
+      </span>
       <span>
         {' '}
         {text} {knowMore}

package/src/SharingBanner/components/PublicBanner.spec.jsx

@@ -0,0 +1,45 @@
+import React from 'react'
+import { render } from '@testing-library/react'
+import { SharingBannerCozyToCozy } from './PublicBanner'
+import { useI18n } from 'cozy-ui/transpiled/react/I18n'
+import { useClient } from 'cozy-client'
+
+jest.mock('cozy-ui/transpiled/react/I18n')
+jest.mock('cozy-client')
+
+describe('PublicBanner', () => {
+  beforeEach(() => {
+    useClient.mockReturnValue({
+      options: { uri: 'http://cozy.localhost:8080' }
+    })
+  })
+
+  it('should not add dangerous html', () => {
+    // Given
+    useI18n.mockReturnValue({
+      t: (localeToTranslate, options) => {
+        if (localeToTranslate === 'Share.banner.shared_from') {
+          return `Shared from ![avatar](${options.image}) ${options.name}'s cozy.`
+        }
+        return localeToTranslate
+      }
+    })
+    const publicName = '[Click me!](https://evil.com)'
+    const sharing = { attributes: { members: [{ public_name: publicName }] } }
+
+    // When
+    const { container } = render(
+      <SharingBannerCozyToCozy
+        sharing={sharing}
+        isSharingShortcutCreated={true}
+        discoveryLink={'discoveryLink'}
+        onClose={() => {}}
+      />
+    )
+
+    // Then
+    expect(container.querySelector('.bannermarkdown').innerHTML).toEqual(
+      `Shared from <img src="http://cozy.localhost:8080/public/avatar?fallback=initials" alt="avatar"> &lt;a href="https://evil.com"&gt;Click me!&lt;/a&gt;'s cozy.`
+    )
+  })
+})