spyne 0.22.4 → 0.23.0

package/lib/spyne.umd.js.LICENSE.txt

@@ -1,5 +1,5 @@
 /*!
-     * Spyne 0.22.4
+     * Spyne 0.23.0
      * https://spynejs.org
      *
      * @license
@@ -15,7 +15,7 @@
      */
 
 /*!
- * spynejs 0.22.4
+ * spynejs 0.23.0
  * https://spynejs.org
  * (c) 2017-present Frank Batista
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spyne",
-  "version": "0.22.4",
+  "version": "0.23.0",
   "description": "Reactive Real-DOM Framework for Advanced Javascript applications",
   "sideEffects": true,
   "main": "./lib/spyne.esm.js",

package/src/spyne/channels/channel-fetch-class.js

@@ -46,7 +46,7 @@ export class ChannelFetch extends Channel {
    *
    */
 
-  constructor(name, props = {}) {
+  constructor(name, props = { disableSanitize:false }) {
     // ALLOW FOR GENERIC MAP PROPERTY
 
     ChannelFetch.validateMapMethod(props, name)
@@ -123,7 +123,7 @@ export class ChannelFetch extends Channel {
   }
 
   consolidateAllFetchProps(options, props = this.props) {
-    const propsOptions = pick(['mapFn', 'url', 'header', 'body', 'mode', 'method', 'responseType', 'debug'], props)
+    const propsOptions = pick(['mapFn', 'url', 'header', 'body', 'mode', 'disableSanitize', 'method', 'responseType', 'debug'], props)
     const mergeOptions = (o1, o2) => mergeDeepRight(o1, o2)
     const filterOutUndefined = reject(isNil)
     return compose(filterOutUndefined, mergeOptions)(propsOptions, options)

package/src/spyne/spyne-app.js

@@ -6,7 +6,7 @@ import { sanitizeHTMLConfigure } from './utils/sanitize-html.js'
 import { sanitizeDataConfigure } from './utils/sanitize-data.js'
 
 const _channels = new ChannelsMap()
-const version = '0.22.3'
+const version = '0.23.0'
 
 class SpyneApplication {
   /**
@@ -41,7 +41,7 @@ class SpyneApplication {
   init(config = {}, testMode = false) {
     // this.channels = new ChannelsMap();
     /*!
-     * Spyne 0.22.4
+     * Spyne 0.23.0
      * https://spynejs.org
      *
      * @license

package/src/spyne/utils/channel-fetch-util.js

@@ -59,6 +59,7 @@ export class ChannelFetchUtil {
     this._serverOptions = ChannelFetchUtil.setServerOptions(options)
     this._subscriber = subscriber !== undefined ? subscriber : testSubscriber
     this.debug = options.debug !== undefined ? options.debug : false
+    this.disableSanitize = options?.disableSanitize
     this.channelName = CHANNEL_NAME
 
     const fetchProps = {
@@ -66,6 +67,7 @@ export class ChannelFetchUtil {
       url: this.url,
       serverOptions: this.serverOptions,
       responseType: this.responseType,
+      disableSanitize: this.disableSanitize,
       debug: this.debug
     }
     if (testMode !== true) {
@@ -82,8 +84,8 @@ export class ChannelFetchUtil {
       const metadata = { channelName, url, responseType, serverOptions }
 
       return (data) => {
-        const disableSanitize = props?.disableSanitize === true
-
+        const disableSanitize =  props?.disableSanitize === true
+        /*
         if (disableSanitize) {
           const env = (typeof process !== 'undefined' && process.env && process.env.NODE_ENV)
             ? process.env.NODE_ENV
@@ -100,6 +102,7 @@ export class ChannelFetchUtil {
             )
           }
         }
+*/
 
         const sanitizedData = disableSanitize ? data : sanitizeData(data)
         return mapMethod(sanitizedData, metadata)

package/src/spyne/utils/sanitize-html.js

@@ -3,25 +3,77 @@ import DOMPurify from 'dompurify'
 let _sanitizeHTML
 let isConfigured = false
 
-const sanitizeHTMLConfigure = (config) => {
-  if (!isConfigured) {
-    if (config.strict) {
-      if (window.trustedTypes) {
-        const policy = window.trustedTypes.createPolicy('default', {
-          createHTML: (to_escape) => DOMPurify.sanitize(to_escape, { RETURN_TRUSTED_TYPE: false })
-        })
-
-        _sanitizeHTML = (html) => policy.createHTML(html)
-      } else {
-        _sanitizeHTML = (html) => DOMPurify.sanitize(html)
-      }
-    } else {
-      _sanitizeHTML = (html) => html // No sanitization if not required
-    }
+const sanitizeHTMLConfigure = (config = {}) => {
+  if (isConfigured) {
+    console.warn('sanitizeHTML is already configured. Reconfiguration is not allowed.')
+    return
+  }
+
+  const {
+    strict = true,
+    allowTargetAttr = true,
+    addNoopener = true
+  } = config
+
+  if (!strict) {
+    _sanitizeHTML = (html) => html
     isConfigured = true
+    return
+  }
+
+  const domPurifyConfig = {
+    RETURN_TRUSTED_TYPE: false,
+    ADD_ATTR: allowTargetAttr ? ['target'] : []
+  }
+
+  const sanitizeWithPolicy = (html) => DOMPurify.sanitize(html, domPurifyConfig)
+
+  if (allowTargetAttr) {
+    DOMPurify.addHook('afterSanitizeAttributes', (node) => {
+      if (!node || typeof node.getAttribute !== 'function') return
+      if (node.tagName !== 'A') return
+
+      const href = node.getAttribute('href')
+      const target = node.getAttribute('target')
+
+      // remove target on anchors without href
+      if (!href && target) {
+        node.removeAttribute('target')
+        return
+      }
+
+      if (!target) return
+
+      const validTargets = ['_blank', '_self', '_parent', '_top']
+      if (!validTargets.includes(target)) {
+        node.removeAttribute('target')
+        return
+      }
+
+      if (target === '_blank' && addNoopener) {
+        const currentRel = node.getAttribute('rel') || ''
+        const relParts = currentRel.split(/\s+/).filter(Boolean)
+        const relSet = new Set(relParts)
+
+        relSet.add('noopener')
+        relSet.add('noreferrer')
+
+        node.setAttribute('rel', Array.from(relSet).join(' '))
+      }
+    })
+  }
+
+  if (window.trustedTypes) {
+    const policy = window.trustedTypes.createPolicy('default', {
+      createHTML: (toEscape) => sanitizeWithPolicy(toEscape)
+    })
+
+    _sanitizeHTML = (html) => policy.createHTML(html)
   } else {
-    console.warn('sanitizeHTML is already configured. Reconfiguration is not allowed.')
+    _sanitizeHTML = (html) => sanitizeWithPolicy(html)
   }
+
+  isConfigured = true
 }
 
 const sanitizeHTML = (html) => {

package/src/spyne/utils/spyne-trait.js

@@ -1,5 +1,6 @@
 import { getAllMethodNames } from './frp-tools.js'
 import { reject, curryN, __, map } from 'ramda'
+import { SpyneAppProperties } from './spyne-app-properties.js'
 
 export class SpyneTrait {
   /**
@@ -44,7 +45,9 @@ export class SpyneTrait {
   }
 
   checkForMalformedMethods(methodsArr) {
-    if (this.prefix === '') {
+    const isDebugMode = SpyneAppProperties?.debug || false
+
+    if (this.prefix === '' && isDebugMode) {
       console.warn(`SPYNE WARNING: The following SpyneTrait ${this.constructor.name} needs a prefix`)
       return
     }
@@ -53,7 +56,7 @@ export class SpyneTrait {
     const hasPrefix = (str) => str.indexOf(this.prefix) === 0
 
     const malformedMethodsArr = reject(hasPrefix, methodsArr)
-    if (malformedMethodsArr.length >= 1) {
+    if (malformedMethodsArr.length >= 1 && isDebugMode) {
       const warningStr = `Spyne Warning: The following method(s) in ${this.constructor.name} require the prefix, "${this.prefix}": [${malformedMethodsArr.join(', ')}];`
       console.warn(warningStr)
     }

package/src/spyne/views/dom-element-template.js

@@ -51,10 +51,12 @@ export class DomElementTemplate {
     this.template = DomElementTemplate.normalizeTripleBrackets(this.template)
 
     if (this.isProxyData === true) {
-      if (SpyneAppProperties.enableCMSProxies === true) {
-        this.template = SpyneAppProperties.formatTemplateForProxyData(this.template)
-      } else {
-        console.warn('You need to be logged in to use the CMS Tools.')
+      const proxyFormatter = SpyneAppProperties.enableCMSProxies === true
+        ? SpyneAppProperties.formatTemplateForProxyData
+        : DomElementTemplate.formatTemplateForProxyData
+
+      if (typeof proxyFormatter === 'function') {
+        this.template = proxyFormatter(this.template)
       }
     }
 

package/src/spyne/views/view-stream-broadcaster.js

@@ -85,6 +85,10 @@ export class ViewStreamBroadcaster {
       const data = {}// convertDomStringMapToObj(q.dataset);
       data.payload = convertDomStringMapToObj(q.dataset)
       data.payload = omit(['channel'], data.payload)
+      if (data.channel === 'ROUTE') {
+        data.payload.endPreventDefault = true
+      }
+
       data.channel = channel
       // payload needs vsid# to pass verification