featurely-site-manager 1.0.4 → 1.0.7

package/CHANGELOG.md

@@ -5,6 +5,34 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.7] - 2026-03-15
+
+### Added
+
+- **SDK Health Monitoring**: Integrated Featurely error tracking to monitor SDK issues in production
+- Internal error tracking helps us identify and fix SDK bugs faster
+- Error tracking is minimal and privacy-focused (no user data collection)
+
+### Changed
+
+- Cleaned up package dependencies (removed accidental packages: dom, pur, ify)
+
+## [1.0.6] - 2026-03-15
+
+### Security
+
+- **CRITICAL FIX**: Replaced Math.random() with crypto.getRandomValues() for CSPRNG session IDs and anonymous IDs
+- **CRITICAL FIX**: Added RegExp pattern escaping to prevent ReDoS (Regular Expression Denial of Service) attacks
+- Added error handling for invalid targetPages patterns
+## [1.0.5] - 2026-03-15
+
+### Security
+
+- **CRITICAL FIXAdded DOMPurify sanitization for customHtml maintenance pages to prevent XSS attacks
+- Blocks dangerous tags (script, iframe, embed, object, etc.)
+- Removes event handlers (onerror, onload, onclick, etc.)
+- Prevents javascript: URIs and other malicious protocols
+
 ## [1.0.4] - 2026-03-15
 
 ### Fixed

package/dist/index.js

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,6 +17,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
@@ -24,6 +34,25 @@ __export(index_exports, {
   default: () => index_default
 });
 module.exports = __toCommonJS(index_exports);
+var import_dompurify = __toESM(require("dompurify"));
+var import_featurely_error_tracker = require("featurely-error-tracker");
+var internalErrorTracker = (() => {
+  try {
+    const tracker = new import_featurely_error_tracker.ErrorTracker({
+      apiKey: "ft_live_R4nAn9dDWxk6X3oMzB-tcQh0NrYvA04IhSfwPMUmyaU",
+      apiUrl: "https://featurely.no",
+      environment: "production",
+      appVersion: "1.0.7",
+      maxBreadcrumbs: 30,
+      enabled: true
+    });
+    tracker.install();
+    return tracker;
+  } catch (e) {
+    console.warn("Failed to initialize SDK error tracking:", e);
+    return null;
+  }
+})();
 var _SiteManager = class _SiteManager {
   constructor(config) {
     this.siteConfig = null;
@@ -140,7 +169,11 @@ var _SiteManager = class _SiteManager {
       return null;
     }
     const cacheKey = `variant_${flagKey}`;
-    const cached = localStorage.getItem(cacheKey);
+    let cached = null;
+    try {
+      cached = localStorage.getItem(cacheKey);
+    } catch {
+    }
     if (cached) {
       return cached;
     }
@@ -149,12 +182,18 @@ var _SiteManager = class _SiteManager {
     for (const variant of flag.variants) {
       cumulative += variant.weight;
       if (bucket < cumulative) {
-        localStorage.setItem(cacheKey, variant.key);
+        try {
+          localStorage.setItem(cacheKey, variant.key);
+        } catch {
+        }
         return variant.key;
       }
     }
     const defaultVariant = flag.defaultVariant || flag.variants[0].key;
-    localStorage.setItem(cacheKey, defaultVariant);
+    try {
+      localStorage.setItem(cacheKey, defaultVariant);
+    } catch {
+    }
     return defaultVariant;
   }
   /**
@@ -308,6 +347,11 @@ var _SiteManager = class _SiteManager {
     }
   }
   generateSessionId() {
+    if (typeof crypto !== "undefined" && crypto.getRandomValues) {
+      const array = new Uint8Array(16);
+      crypto.getRandomValues(array);
+      return `${Date.now()}-${Array.from(array, (byte) => byte.toString(36)).join("")}`;
+    }
     return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
   }
   // ============================================================================
@@ -369,7 +413,13 @@ var _SiteManager = class _SiteManager {
     const storageKey = "featurely_anonymous_id";
     let id = localStorage.getItem(storageKey);
     if (!id) {
-      id = `anon_${Date.now()}_${Math.random().toString(36).substring(2, 15)}`;
+      if (typeof crypto !== "undefined" && crypto.getRandomValues) {
+        const array = new Uint8Array(16);
+        crypto.getRandomValues(array);
+        id = `anon_${Date.now()}_${Array.from(array, (byte) => byte.toString(36)).join("")}`;
+      } else {
+        id = `anon_${Date.now()}_${Math.random().toString(36).substring(2, 15)}`;
+      }
       localStorage.setItem(storageKey, id);
     }
     return id;
@@ -435,7 +485,35 @@ var _SiteManager = class _SiteManager {
     overlay.id = "featurely-maintenance-overlay";
     overlay.className = "featurely-maintenance-overlay";
     if (config.type === "custom" && config.customHtml) {
-      overlay.innerHTML = config.customHtml;
+      overlay.innerHTML = import_dompurify.default.sanitize(config.customHtml, {
+        ALLOWED_TAGS: [
+          "div",
+          "span",
+          "p",
+          "h1",
+          "h2",
+          "h3",
+          "h4",
+          "h5",
+          "h6",
+          "strong",
+          "em",
+          "b",
+          "i",
+          "u",
+          "br",
+          "ul",
+          "ol",
+          "li",
+          "a",
+          "img",
+          "button"
+        ],
+        ALLOWED_ATTR: ["class", "id", "href", "src", "alt", "title", "style"],
+        FORBID_TAGS: ["script", "iframe", "embed", "object", "applet", "meta", "link", "form", "input"],
+        FORBID_ATTR: ["onerror", "onload", "onclick", "onmouseover"],
+        ALLOW_DATA_ATTR: false
+      });
     } else {
       overlay.innerHTML = this.getDefaultMaintenanceHtml(config);
     }
@@ -480,8 +558,14 @@ var _SiteManager = class _SiteManager {
       }
       if (message.targetPages && message.targetPages.length > 0) {
         const matches = message.targetPages.some((pattern) => {
-          const regex = new RegExp(pattern);
-          return regex.test(currentPath);
+          try {
+            const escapedPattern = pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+            const regex = new RegExp(escapedPattern);
+            return regex.test(currentPath);
+          } catch (e) {
+            console.warn("Invalid pattern:", pattern, e);
+            return false;
+          }
         });
         if (!matches) return false;
       }

package/dist/index.mjs

@@ -1,4 +1,23 @@
 // src/index.ts
+import DOMPurify from "dompurify";
+import { ErrorTracker } from "featurely-error-tracker";
+var internalErrorTracker = (() => {
+  try {
+    const tracker = new ErrorTracker({
+      apiKey: "ft_live_R4nAn9dDWxk6X3oMzB-tcQh0NrYvA04IhSfwPMUmyaU",
+      apiUrl: "https://featurely.no",
+      environment: "production",
+      appVersion: "1.0.7",
+      maxBreadcrumbs: 30,
+      enabled: true
+    });
+    tracker.install();
+    return tracker;
+  } catch (e) {
+    console.warn("Failed to initialize SDK error tracking:", e);
+    return null;
+  }
+})();
 var _SiteManager = class _SiteManager {
   constructor(config) {
     this.siteConfig = null;
@@ -115,7 +134,11 @@ var _SiteManager = class _SiteManager {
       return null;
     }
     const cacheKey = `variant_${flagKey}`;
-    const cached = localStorage.getItem(cacheKey);
+    let cached = null;
+    try {
+      cached = localStorage.getItem(cacheKey);
+    } catch {
+    }
     if (cached) {
       return cached;
     }
@@ -124,12 +147,18 @@ var _SiteManager = class _SiteManager {
     for (const variant of flag.variants) {
       cumulative += variant.weight;
       if (bucket < cumulative) {
-        localStorage.setItem(cacheKey, variant.key);
+        try {
+          localStorage.setItem(cacheKey, variant.key);
+        } catch {
+        }
         return variant.key;
       }
     }
     const defaultVariant = flag.defaultVariant || flag.variants[0].key;
-    localStorage.setItem(cacheKey, defaultVariant);
+    try {
+      localStorage.setItem(cacheKey, defaultVariant);
+    } catch {
+    }
     return defaultVariant;
   }
   /**
@@ -283,6 +312,11 @@ var _SiteManager = class _SiteManager {
     }
   }
   generateSessionId() {
+    if (typeof crypto !== "undefined" && crypto.getRandomValues) {
+      const array = new Uint8Array(16);
+      crypto.getRandomValues(array);
+      return `${Date.now()}-${Array.from(array, (byte) => byte.toString(36)).join("")}`;
+    }
     return `${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
   }
   // ============================================================================
@@ -344,7 +378,13 @@ var _SiteManager = class _SiteManager {
     const storageKey = "featurely_anonymous_id";
     let id = localStorage.getItem(storageKey);
     if (!id) {
-      id = `anon_${Date.now()}_${Math.random().toString(36).substring(2, 15)}`;
+      if (typeof crypto !== "undefined" && crypto.getRandomValues) {
+        const array = new Uint8Array(16);
+        crypto.getRandomValues(array);
+        id = `anon_${Date.now()}_${Array.from(array, (byte) => byte.toString(36)).join("")}`;
+      } else {
+        id = `anon_${Date.now()}_${Math.random().toString(36).substring(2, 15)}`;
+      }
       localStorage.setItem(storageKey, id);
     }
     return id;
@@ -410,7 +450,35 @@ var _SiteManager = class _SiteManager {
     overlay.id = "featurely-maintenance-overlay";
     overlay.className = "featurely-maintenance-overlay";
     if (config.type === "custom" && config.customHtml) {
-      overlay.innerHTML = config.customHtml;
+      overlay.innerHTML = DOMPurify.sanitize(config.customHtml, {
+        ALLOWED_TAGS: [
+          "div",
+          "span",
+          "p",
+          "h1",
+          "h2",
+          "h3",
+          "h4",
+          "h5",
+          "h6",
+          "strong",
+          "em",
+          "b",
+          "i",
+          "u",
+          "br",
+          "ul",
+          "ol",
+          "li",
+          "a",
+          "img",
+          "button"
+        ],
+        ALLOWED_ATTR: ["class", "id", "href", "src", "alt", "title", "style"],
+        FORBID_TAGS: ["script", "iframe", "embed", "object", "applet", "meta", "link", "form", "input"],
+        FORBID_ATTR: ["onerror", "onload", "onclick", "onmouseover"],
+        ALLOW_DATA_ATTR: false
+      });
     } else {
       overlay.innerHTML = this.getDefaultMaintenanceHtml(config);
     }
@@ -455,8 +523,14 @@ var _SiteManager = class _SiteManager {
       }
       if (message.targetPages && message.targetPages.length > 0) {
         const matches = message.targetPages.some((pattern) => {
-          const regex = new RegExp(pattern);
-          return regex.test(currentPath);
+          try {
+            const escapedPattern = pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+            const regex = new RegExp(escapedPattern);
+            return regex.test(currentPath);
+          } catch (e) {
+            console.warn("Invalid pattern:", pattern, e);
+            return false;
+          }
         });
         if (!matches) return false;
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "featurely-site-manager",
-  "version": "1.0.4",
+  "version": "1.0.7",
   "description": "Site management SDK for maintenance mode, status messages, and feature flags",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -44,9 +44,12 @@
   },
   "homepage": "https://featurely.no",
   "devDependencies": {
+    "@types/dompurify": "^3.0.5",
     "tsup": "^8.5.1",
     "typescript": "^5.0.0"
   },
-  "peerDependencies": {},
-  "dependencies": {}
+  "dependencies": {
+    "dompurify": "^3.3.3",
+    "featurely-error-tracker": "^1.0.7"
+  }
 }